Re: [isar-cip-core][PATCH 0/8] Secureboot on QEMU with EDK2, OP-TEE and RPBM

From: Jan Kiszka <jan.kiszka@siemens.com>
To: "Su, Bao Cheng (DI FA CTR IPC CN PRC4)" <baocheng.su@siemens.com>,
	"Schultschik,
	Sven (DI PA DCP R&D 2)" <sven.schultschik@siemens.com>,
	"cip-dev@lists.cip-project.org" <cip-dev@lists.cip-project.org>
Subject: Re: [isar-cip-core][PATCH 0/8] Secureboot on QEMU with EDK2, OP-TEE and RPBM
Date: Tue, 25 Oct 2022 10:16:22 +0200	[thread overview]
Message-ID: <a8395d4c-7945-089b-ae31-a22b8b104438@siemens.com> (raw)
In-Reply-To: <23b969e6df97fb95a7e5fefe68c4a01a4c4fe7c7.camel@siemens.com>

On 25.10.22 10:09, Su, Bao Cheng (DI FA CTR IPC CN PRC4) wrote:
> On Mon, 2022-10-24 at 14:27 +0200, sven.schultschik@siemens.com wrote:
>> From: Sven Schultschik <sven.schultschik@siemens.com>
>>
>> This series of patches will add recipes to build a QEMU setup
>> which uses OP-TEE to use RPBM (Replay protected memory) of
>> an EMMC for a secure storage. Which is used within Secureboot
>> on ARM64. QEMU itself does not have an implementation of a
>> virtual RPBM. Therefore a patch for u-boot is needed which
>> adds this feature to u-boot, but breaks hardware
>> compatibility within u-boot. As soon as QEMU has a native
>> RPMB support included, the patch can be removed.
>>
> 
> Part of this patch could also be integrated into real setup, besides
> QEMU?

Yes, this is the plan. QEMU is the friendly testing environment, and
then devices like the IOT2050 could pick up the baseline and use it for
its own, real setup. So, whatever can be done generically here, should
be done this way.

Jan

> 
> By the way, s/RPBM/RPMB/
> 
>> The last patch is ment for manually test and verify the
>> patches, but should not be merged.
>>
>> Sven Schultschik (8):
>>   add recipe for edk2
>>   add recipe for optee qemu arm64
>>   Include optee into u-boot
>>   add u-boot patch for qemu to support RPMB
>>   add recipe for trusted firmware a qemu arm64
>>   add kas files for building qemu secure boot images
>>   enhance start-qemu.sh for arm64 secure boot
>>   no merge - manually instructions test secure boot
>>
>>  README.md                                     |   65 +
>>  kas/opt/u-boot-efi-ebg-op-tee-qemu.yml        |   11 +
>>  keys/helloworld.efi                           |  Bin 0 -> 4576 bytes
>>  recipes-bsp/edk2/edk2_202205.bb               |   43 +
>>  recipes-bsp/edk2/files/rules.tmpl             |   61 +
>>  .../op-tee/optee-os-qemu-arm64_3.17.0.bb      |   54 +
>>  .../trusted-firmware-a-qemu-arm64_2.7.0.bb    |   61 +
>>  ...hack.-Breaks-proper-hardware-support.patch | 1375 +++++++++++++++++
>>  recipes-bsp/u-boot/files/secure-boot.cfg.tmpl |    9 +-
>>  recipes-bsp/u-boot/u-boot-qemu-common.inc     |    5 +
>>  start-qemu.sh                                 |   14 +-
>>  11 files changed, 1695 insertions(+), 3 deletions(-)
>>  create mode 100644 kas/opt/u-boot-efi-ebg-op-tee-qemu.yml
>>  create mode 100644 keys/helloworld.efi
>>  create mode 100644 recipes-bsp/edk2/edk2_202205.bb
>>  create mode 100755 recipes-bsp/edk2/files/rules.tmpl
>>  create mode 100644 recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb
>>  create mode 100644 recipes-bsp/trusted-firmware-a/trusted-firmware-a-qemu-arm64_2.7.0.bb
>>  create mode 100644 recipes-bsp/u-boot/files/0002-rpmb-emulation-hack.-Breaks-proper-hardware-support.patch
>>
> 

-- 
Siemens AG, Technology
Competence Center Embedded Linux