Re: [isar-cip-core][PATCH 3/8] Include optee into u-boot

From: Jan Kiszka <jan.kiszka@siemens.com>
To: "Su, Bao Cheng" <baocheng.su@siemens.com>,
	"Schultschik, Sven" <sven.schultschik@siemens.com>,
	"cip-dev@lists.cip-project.org" <cip-dev@lists.cip-project.org>
Subject: Re: [isar-cip-core][PATCH 3/8] Include optee into u-boot
Date: Wed, 26 Oct 2022 10:52:59 +0200	[thread overview]
Message-ID: <d8d40615-4e43-86ad-c947-cd3c0827e389@siemens.com> (raw)
In-Reply-To: <3d75d1509a201b658f4e5be035265ef82fa43b08.camel@siemens.com>

On 26.10.22 09:36, Su, Bao Cheng wrote:
> On Mon, 2022-10-24 at 14:27 +0200, sven.schultschik@siemens.com wrote:
>> From: Sven Schultschik <sven.schultschik@siemens.com>
>>
>> Optee is part of u-boot In the secureboot scenario to use optee and RPMB as secure storage.
>>
>> Signed-off-by: Sven Schultschik <sven.schultschik@siemens.com>
>> ---
>>  recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 7 +++++++
>>  recipes-bsp/u-boot/u-boot-qemu-common.inc     | 2 ++
>>  2 files changed, 9 insertions(+)
>>
>> diff --git a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
>> index 956dcbfed..8e6428238 100644
>> --- a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
>> +++ b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
>> @@ -4,3 +4,10 @@ CONFIG_USE_BOOTCOMMAND=y
>>  CONFIG_BOOTCOMMAND="setenv scan_dev_for_boot 'if test -e ${devtype} ${devnum}:${distro_bootpart} efi/boot/boot${EFI_ARCH}.efi; then load ${devtype} ${devnum}:${distro_bootpart} ${kernel_addr_r} efi/boot/boot${EFI_ARCH}.efi; bootefi ${kernel_addr_r} ${fdtcontroladdr}; fi'; run distro_bootcmd; echo 'EFI Boot failed!'; sleep 1000; reset"
>>  CONFIG_EFI_VARIABLES_PRESEED=y
>>  CONFIG_EFI_SECURE_BOOT=y
>> +### OPTEE config
>> +CONFIG_CMD_OPTEE_RPMB=y
>> +CONFIG_MMC=y
>> +CONFIG_SUPPORT_EMMC_RPMB=y
>> +CONFIG_TEE=y
>> +CONFIG_OPTEE=y
>> +CONFIG_EFI_MM_COMM_TEE=y
> 
> According to lib/efi_loader/Makefile:
> 
> ifeq ($(CONFIG_EFI_MM_COMM_TEE),y)
> obj-y += efi_variable_tee.o
> else
> obj-y += efi_variable.o
> obj-$(CONFIG_EFI_VARIABLES_PRESEED) += efi_var_seed.o
> endif
> 
> The `CONFIG_EFI_MM_COMM_TEE` conflicts with
> `CONFIG_EFI_VARIABLES_PRESEED`, so you have to choose one.
> 

Right. When we switch this, we also need to switch the secure boot setup
procedure so that the result remains securely booted.

Jan

-- 
Siemens AG, Technology
Competence Center Embedded Linux