From: Sven Schultschik <sven.schultschik@...>

This series of patches will add recipes to build a QEMU setup
which uses OP-TEE to use RPBM (Replay protected memory) of
an EMMC for a secure storage. Which is used within Secureboot
on ARM64. QEMU itself does not have an implementation of a
virtual RPBM. Therefore a patch for u-boot is needed which
adds this feature to u-boot, but breaks hardware
compatibility within u-boot. As soon as QEMU has a native
RPMB support included, the patch can be removed.

The last patch is ment for manually test and verify the
patches, but should not be merged.

Sven Schultschik (8):
add recipe for edk2
add recipe for optee qemu arm64
Include optee into u-boot
add u-boot patch for qemu to support RPMB
add recipe for trusted firmware a qemu arm64
add kas files for building qemu secure boot images
enhance start-qemu.sh for arm64 secure boot
no merge - manually instructions test secure boot

README.md | 65 +
kas/opt/u-boot-efi-ebg-op-tee-qemu.yml | 11 +
keys/helloworld.efi | Bin 0 -> 4576 bytes
recipes-bsp/edk2/edk2_202205.bb | 43 +
recipes-bsp/edk2/files/rules.tmpl | 61 +
.../op-tee/optee-os-qemu-arm64_3.17.0.bb | 54 +
.../trusted-firmware-a-qemu-arm64_2.7.0.bb | 61 +
...hack.-Breaks-proper-hardware-support.patch | 1375 +++++++++++++++++
recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 9 +-
recipes-bsp/u-boot/u-boot-qemu-common.inc | 5 +
start-qemu.sh | 14 +-
11 files changed, 1695 insertions(+), 3 deletions(-)
create mode 100644 kas/opt/u-boot-efi-ebg-op-tee-qemu.yml
create mode 100644 keys/helloworld.efi
create mode 100644 recipes-bsp/edk2/edk2_202205.bb
create mode 100755 recipes-bsp/edk2/files/rules.tmpl
create mode 100644 recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb
create mode 100644 recipes-bsp/trusted-firmware-a/trusted-firmware-a-qemu-arm64_2.7.0.bb
create mode 100644 recipes-bsp/u-boot/files/0002-rpmb-emulation-hack.-Breaks-proper-hardware-support.patch

--
2.30.2

On Mon, 2022-10-24 at 14:27 +0200, sven.schultschik@... wrote:

From: Sven Schultschik <sven.schultschik@...>

This series of patches will add recipes to build a QEMU setup
which uses OP-TEE to use RPBM (Replay protected memory) of
an EMMC for a secure storage. Which is used within Secureboot
on ARM64. QEMU itself does not have an implementation of a
virtual RPBM. Therefore a patch for u-boot is needed which
adds this feature to u-boot, but breaks hardware
compatibility within u-boot. As soon as QEMU has a native
RPMB support included, the patch can be removed.

Part of this patch could also be integrated into real setup, besides
QEMU?

By the way, s/RPBM/RPMB/

The last patch is ment for manually test and verify the
patches, but should not be merged.

Sven Schultschik (8):
  add recipe for edk2
  add recipe for optee qemu arm64
  Include optee into u-boot
  add u-boot patch for qemu to support RPMB
  add recipe for trusted firmware a qemu arm64
  add kas files for building qemu secure boot images
  enhance start-qemu.sh for arm64 secure boot
  no merge - manually instructions test secure boot

 README.md | 65 +
 kas/opt/u-boot-efi-ebg-op-tee-qemu.yml | 11 +
 keys/helloworld.efi | Bin 0 -> 4576 bytes
 recipes-bsp/edk2/edk2_202205.bb | 43 +
 recipes-bsp/edk2/files/rules.tmpl | 61 +
 .../op-tee/optee-os-qemu-arm64_3.17.0.bb | 54 +
 .../trusted-firmware-a-qemu-arm64_2.7.0.bb | 61 +
 ...hack.-Breaks-proper-hardware-support.patch | 1375 +++++++++++++++++
 recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 9 +-
 recipes-bsp/u-boot/u-boot-qemu-common.inc | 5 +
 start-qemu.sh | 14 +-
 11 files changed, 1695 insertions(+), 3 deletions(-)
 create mode 100644 kas/opt/u-boot-efi-ebg-op-tee-qemu.yml
 create mode 100644 keys/helloworld.efi
 create mode 100644 recipes-bsp/edk2/edk2_202205.bb
 create mode 100755 recipes-bsp/edk2/files/rules.tmpl
 create mode 100644 recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb
 create mode 100644 recipes-bsp/trusted-firmware-a/trusted-firmware-a-qemu-arm64_2.7.0.bb
 create mode 100644 recipes-bsp/u-boot/files/0002-rpmb-emulation-hack.-Breaks-proper-hardware-support.patch

On 25.10.22 10:09, Su, Bao Cheng (DI FA CTR IPC CN PRC4) wrote:

On Mon, 2022-10-24 at 14:27 +0200, sven.schultschik@... wrote:

From: Sven Schultschik <sven.schultschik@...>

This series of patches will add recipes to build a QEMU setup
which uses OP-TEE to use RPBM (Replay protected memory) of
an EMMC for a secure storage. Which is used within Secureboot
on ARM64. QEMU itself does not have an implementation of a
virtual RPBM. Therefore a patch for u-boot is needed which
adds this feature to u-boot, but breaks hardware
compatibility within u-boot. As soon as QEMU has a native
RPMB support included, the patch can be removed.

Part of this patch could also be integrated into real setup, besides
QEMU?

Yes, this is the plan. QEMU is the friendly testing environment, and
then devices like the IOT2050 could pick up the baseline and use it for
its own, real setup. So, whatever can be done generically here, should
be done this way.

Jan

By the way, s/RPBM/RPMB/

The last patch is ment for manually test and verify the
patches, but should not be merged.

Sven Schultschik (8):
add recipe for edk2
add recipe for optee qemu arm64
Include optee into u-boot
add u-boot patch for qemu to support RPMB
add recipe for trusted firmware a qemu arm64
add kas files for building qemu secure boot images
enhance start-qemu.sh for arm64 secure boot
no merge - manually instructions test secure boot

README.md | 65 +
kas/opt/u-boot-efi-ebg-op-tee-qemu.yml | 11 +
keys/helloworld.efi | Bin 0 -> 4576 bytes
recipes-bsp/edk2/edk2_202205.bb | 43 +
recipes-bsp/edk2/files/rules.tmpl | 61 +
.../op-tee/optee-os-qemu-arm64_3.17.0.bb | 54 +
.../trusted-firmware-a-qemu-arm64_2.7.0.bb | 61 +
...hack.-Breaks-proper-hardware-support.patch | 1375 +++++++++++++++++
recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 9 +-
recipes-bsp/u-boot/u-boot-qemu-common.inc | 5 +
start-qemu.sh | 14 +-
11 files changed, 1695 insertions(+), 3 deletions(-)
create mode 100644 kas/opt/u-boot-efi-ebg-op-tee-qemu.yml
create mode 100644 keys/helloworld.efi
create mode 100644 recipes-bsp/edk2/edk2_202205.bb
create mode 100755 recipes-bsp/edk2/files/rules.tmpl
create mode 100644 recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb
create mode 100644 recipes-bsp/trusted-firmware-a/trusted-firmware-a-qemu-arm64_2.7.0.bb
create mode 100644 recipes-bsp/u-boot/files/0002-rpmb-emulation-hack.-Breaks-proper-hardware-support.patch

--
Siemens AG, Technology
Competence Center Embedded Linux