| Message ID | 20221024122725.383791-1-sven.schultschik@siemens.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | Secureboot on QEMU with EDK2, OP-TEE and RPBM | expand |
On Mon, 2022-10-24 at 14:27 +0200, sven.schultschik@siemens.com wrote: > From: Sven Schultschik <sven.schultschik@siemens.com> > > This series of patches will add recipes to build a QEMU setup > which uses OP-TEE to use RPBM (Replay protected memory) of > an EMMC for a secure storage. Which is used within Secureboot > on ARM64. QEMU itself does not have an implementation of a > virtual RPBM. Therefore a patch for u-boot is needed which > adds this feature to u-boot, but breaks hardware > compatibility within u-boot. As soon as QEMU has a native > RPMB support included, the patch can be removed. > Part of this patch could also be integrated into real setup, besides QEMU? By the way, s/RPBM/RPMB/ > The last patch is ment for manually test and verify the > patches, but should not be merged. > > Sven Schultschik (8): > add recipe for edk2 > add recipe for optee qemu arm64 > Include optee into u-boot > add u-boot patch for qemu to support RPMB > add recipe for trusted firmware a qemu arm64 > add kas files for building qemu secure boot images > enhance start-qemu.sh for arm64 secure boot > no merge - manually instructions test secure boot > > README.md | 65 + > kas/opt/u-boot-efi-ebg-op-tee-qemu.yml | 11 + > keys/helloworld.efi | Bin 0 -> 4576 bytes > recipes-bsp/edk2/edk2_202205.bb | 43 + > recipes-bsp/edk2/files/rules.tmpl | 61 + > .../op-tee/optee-os-qemu-arm64_3.17.0.bb | 54 + > .../trusted-firmware-a-qemu-arm64_2.7.0.bb | 61 + > ...hack.-Breaks-proper-hardware-support.patch | 1375 +++++++++++++++++ > recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 9 +- > recipes-bsp/u-boot/u-boot-qemu-common.inc | 5 + > start-qemu.sh | 14 +- > 11 files changed, 1695 insertions(+), 3 deletions(-) > create mode 100644 kas/opt/u-boot-efi-ebg-op-tee-qemu.yml > create mode 100644 keys/helloworld.efi > create mode 100644 recipes-bsp/edk2/edk2_202205.bb > create mode 100755 recipes-bsp/edk2/files/rules.tmpl > create mode 100644 recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb > create mode 100644 recipes-bsp/trusted-firmware-a/trusted-firmware-a-qemu-arm64_2.7.0.bb > create mode 100644 recipes-bsp/u-boot/files/0002-rpmb-emulation-hack.-Breaks-proper-hardware-support.patch >
On 25.10.22 10:09, Su, Bao Cheng (DI FA CTR IPC CN PRC4) wrote: > On Mon, 2022-10-24 at 14:27 +0200, sven.schultschik@siemens.com wrote: >> From: Sven Schultschik <sven.schultschik@siemens.com> >> >> This series of patches will add recipes to build a QEMU setup >> which uses OP-TEE to use RPBM (Replay protected memory) of >> an EMMC for a secure storage. Which is used within Secureboot >> on ARM64. QEMU itself does not have an implementation of a >> virtual RPBM. Therefore a patch for u-boot is needed which >> adds this feature to u-boot, but breaks hardware >> compatibility within u-boot. As soon as QEMU has a native >> RPMB support included, the patch can be removed. >> > > Part of this patch could also be integrated into real setup, besides > QEMU? Yes, this is the plan. QEMU is the friendly testing environment, and then devices like the IOT2050 could pick up the baseline and use it for its own, real setup. So, whatever can be done generically here, should be done this way. Jan > > By the way, s/RPBM/RPMB/ > >> The last patch is ment for manually test and verify the >> patches, but should not be merged. >> >> Sven Schultschik (8): >> add recipe for edk2 >> add recipe for optee qemu arm64 >> Include optee into u-boot >> add u-boot patch for qemu to support RPMB >> add recipe for trusted firmware a qemu arm64 >> add kas files for building qemu secure boot images >> enhance start-qemu.sh for arm64 secure boot >> no merge - manually instructions test secure boot >> >> README.md | 65 + >> kas/opt/u-boot-efi-ebg-op-tee-qemu.yml | 11 + >> keys/helloworld.efi | Bin 0 -> 4576 bytes >> recipes-bsp/edk2/edk2_202205.bb | 43 + >> recipes-bsp/edk2/files/rules.tmpl | 61 + >> .../op-tee/optee-os-qemu-arm64_3.17.0.bb | 54 + >> .../trusted-firmware-a-qemu-arm64_2.7.0.bb | 61 + >> ...hack.-Breaks-proper-hardware-support.patch | 1375 +++++++++++++++++ >> recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 9 +- >> recipes-bsp/u-boot/u-boot-qemu-common.inc | 5 + >> start-qemu.sh | 14 +- >> 11 files changed, 1695 insertions(+), 3 deletions(-) >> create mode 100644 kas/opt/u-boot-efi-ebg-op-tee-qemu.yml >> create mode 100644 keys/helloworld.efi >> create mode 100644 recipes-bsp/edk2/edk2_202205.bb >> create mode 100755 recipes-bsp/edk2/files/rules.tmpl >> create mode 100644 recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb >> create mode 100644 recipes-bsp/trusted-firmware-a/trusted-firmware-a-qemu-arm64_2.7.0.bb >> create mode 100644 recipes-bsp/u-boot/files/0002-rpmb-emulation-hack.-Breaks-proper-hardware-support.patch >> >
From: Sven Schultschik <sven.schultschik@siemens.com> This series of patches will add recipes to build a QEMU setup which uses OP-TEE to use RPBM (Replay protected memory) of an EMMC for a secure storage. Which is used within Secureboot on ARM64. QEMU itself does not have an implementation of a virtual RPBM. Therefore a patch for u-boot is needed which adds this feature to u-boot, but breaks hardware compatibility within u-boot. As soon as QEMU has a native RPMB support included, the patch can be removed. The last patch is ment for manually test and verify the patches, but should not be merged. Sven Schultschik (8): add recipe for edk2 add recipe for optee qemu arm64 Include optee into u-boot add u-boot patch for qemu to support RPMB add recipe for trusted firmware a qemu arm64 add kas files for building qemu secure boot images enhance start-qemu.sh for arm64 secure boot no merge - manually instructions test secure boot README.md | 65 + kas/opt/u-boot-efi-ebg-op-tee-qemu.yml | 11 + keys/helloworld.efi | Bin 0 -> 4576 bytes recipes-bsp/edk2/edk2_202205.bb | 43 + recipes-bsp/edk2/files/rules.tmpl | 61 + .../op-tee/optee-os-qemu-arm64_3.17.0.bb | 54 + .../trusted-firmware-a-qemu-arm64_2.7.0.bb | 61 + ...hack.-Breaks-proper-hardware-support.patch | 1375 +++++++++++++++++ recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 9 +- recipes-bsp/u-boot/u-boot-qemu-common.inc | 5 + start-qemu.sh | 14 +- 11 files changed, 1695 insertions(+), 3 deletions(-) create mode 100644 kas/opt/u-boot-efi-ebg-op-tee-qemu.yml create mode 100644 keys/helloworld.efi create mode 100644 recipes-bsp/edk2/edk2_202205.bb create mode 100755 recipes-bsp/edk2/files/rules.tmpl create mode 100644 recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb create mode 100644 recipes-bsp/trusted-firmware-a/trusted-firmware-a-qemu-arm64_2.7.0.bb create mode 100644 recipes-bsp/u-boot/files/0002-rpmb-emulation-hack.-Breaks-proper-hardware-support.patch