public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* [PATCH v3 0/6] Arm 32bit support in PlatformStandaloneMmRpmb
@ 2021-08-10 16:40 Etienne Carriere
  2021-08-10 16:40 ` [PATCH v3 1/6] Platform/ARM/SgiPkg: sync with edk2 StandaloneMmCpu path change Etienne Carriere
                   ` (6 more replies)
  0 siblings, 7 replies; 8+ messages in thread
From: Etienne Carriere @ 2021-08-10 16:40 UTC (permalink / raw)
  To: devel
  Cc: Ard Biesheuvel, Ilias Apalodimas, Leif Lindholm, Sami Mujawar,
	Sughosh Ganu, Thomas Abraham, Etienne Carriere

This series brings support for building PlatformStandaloneMmRpmb for
32bit Arm architectures. This series is based on series tracked through
[1] in edk2 that allows to build StandaloneMm package for 32bit Arm.
This series starts by syncing with paths changes from [1] series,
then comes changes for Arm 32bit support in OpTee drivers and last
updates PlatformStandaloneMmRpmb.dsc for 32bit the ARM architure.
This series is tracked through ticket [2].

One can test the generated StMM image with OP-TEE release for
stm32mp157c-ev1 board which integrates an eMMC device with a
RPMB partition. Se below are the fetch/build directives.
Note that enabling EFI secure boot on stm32mp1 needs more than the
build instruction below. At least these show how U-Boot and OP-TEE
can leverage StMM with an RPMB device.

Step 1: fetch edk2, edk2-platforms, apply patches and Build StMM.
I build edk2 with the following command (one shall replace ${path_to_xxx}
with the appropriate paths.

  # export WORKSPACE=${path_to_edk2_build_dir}
  # export PYTHON3_ENABLE=TRUE
  # export PACKAGES_PATH=${path_to_edk2}:${path_to_edk2_platforms}
  # source ${path_to_edk2}/edksetup.sh
  # make -j$(nproc) -C ${path_to_edk2}/BaseTools
  # GCC5_ARM_PREFIX=${path_to_arm_tooclain}/bin/arm-linux-gnueabihf- \
      build -n $(nproc) -a ARM -t GCC5 -b RELEASE -D DO_X86EMU=TRUE \
       -p Platform/StandaloneMm/PlatformStandaloneMmPkg/PlatformStandaloneMmRpmb.dsc \
       all

Step 2: clone and build OP-TEE release for stm32mp1 (see also [3]):

  # mkdir /tmp/optee-stm32mp1-stmm
  # cd /tmp/optee-stm32mp1-stmm
  # repo init -u https://github.com/OP-TEE/manifest.git -t 3.14.0 -m stm32mp1.xml
  # repo sync
  # cd build
  # make toolchains
  # make all 

Step 3: sync with U-Boot master branch, at least commit [4] which merges
a fix in MMC/RPMB driver OP-TEE [5]. Platform defconfig must be changed
to enable StMM and RPMB support.
The command below builds u-boot using OP-TEE build env (from build/ dir)

  # git -C ../u-boot checkout 99bb5f248ade371ee4713e0ef51401708ecbb13c
  # echo CONFIG_EFI_MM_COMM_TEE=y >> ../u-boot/configs/stm32mp15_trusted_defconfig
  # echo CONFIG_SUPPORT_EMMC_RPMB=y >> ../u-boot/configs/stm32mp15_trusted_defconfig
  # make u-boot

Step 4: rebuild optee_os (and SDcard image) with StMM image embedded in
OP-TEE core wand RPMB support for stm32mp15c-ev1 (the board has an eMMC
device with an RPMB partition).
The command below builds u-boot using OP-TEE build env.
  
  # make optee-os all \
     CFG_STMM_PATH=${path_to_edk2_build_dir}/Build/MmStandaloneRpmb/RELEASE_GCC5/FV/BL32_AP_MM.fd \
     PLATFORM=stm32mp1-157C_ED1 \
     CFG_RPMB_FS=y CFG_CORE_HUK_SUBKEY_COMPAT=n CFG_RPMB_FS_DEV_ID=1

Once done, program SDcard (/dev/sdX relates to SDcard slot device file)
  # dd conf=fdatasync if=../out/bin/sdcard of=/dev/sdX # where /dev/sdX is

The target (stm32mp157c-ev1 board) can boot with the programmed
SDcard. One can interrupt the U-Boot console, possibly program
RPMB key (see note below) and read the EFI variable (read from the
RPMB though StMM executing in OP-TEE.

  $ printenv -e              # read EFI variables
  $ setenv -e <some args>    # write an EFI variable

Note about the RPMB key:
  With the build instructions above, OP-TEE assumes the RPMB device key
  is generated from a known derivation of an all-zero root key. If the
  RPMB device key was not yet programmed, one can program it from the
  U-Boot console with command 'mmc rpmc key <key-data-address>. The
  commands below can be used to program the platform default RPMB
  development key that is (hexadecimal notation, first byte first):
    15 46 75 8c 61 8e d8 b8 a2 27 89 02 df 54 ef 63
    11 de e2 96 49 99 5b d7 d9 12 f1 53 6d 8a 67 c7

  $ mw.l 0xc0000000 0x8c754615
  $ mw.l 0xc0000004 0xb8d88e61
  $ mw.l 0xc0000008 0x028927a2
  $ mw.l 0xc000000c 0x63ef54df
  $ mw.l 0xc0000010 0x96e2de11
  $ mw.l 0xc0000014 0xd75b9949
  $ mw.l 0xc0000018 0x53f112d9
  $ mw.l 0xc000001c 0xc7678a6d
  $ mmc rpmb key 0xc0000000

[1] https://bugzilla.tianocore.org/show_bug.cgi?id=3381
[2] https://bugzilla.tianocore.org/show_bug.cgi?id=3383
[3] https://optee.readthedocs.io/en/latest/building/devices/stm32mp1.html#build-instructions
[4] https://source.denx.de/u-boot/u-boot/-/commit/99bb5f248ade371ee4713e0ef51401708ecbb13c
[5] https://source.denx.de/u-boot/u-boot/-/commit/a9f7be509af90fa5f2c308867ad3b0bd48532c6e

Etienne Carriere (6):
  Platform/ARM/SgiPkg: sync with edk2 StandaloneMmCpu path change
  Platform/Socionext/DeveloperBox: sync with edk2 StandaloneMmCpu path
    change
  Platform/StandaloneMm: sync with edk2 StandaloneMmCpu path change
  Drivers/OpTee: Add Aarch32 SVC IDs for 32bit Arm targets
  Drivers/OpTee: address cast build warning issue in 32b mode
  Platform/StandaloneMm: build StandaloneMmRpmb for 32bit architectures

 Drivers/OpTee/OpteeRpmbPkg/OpTeeRpmbFvb.c     | 23 ++++++++++++-------
 Drivers/OpTee/OpteeRpmbPkg/OpTeeRpmbFvb.h     | 16 +++++++++++--
 Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf  |  2 +-
 Platform/ARM/SgiPkg/SgiPlatformMm.dsc.inc     |  2 +-
 .../Socionext/DeveloperBox/DeveloperBoxMm.dsc |  2 +-
 .../Socionext/DeveloperBox/DeveloperBoxMm.fdf |  2 +-
 .../PlatformStandaloneMmRpmb.dsc              | 14 +++++++++--
 .../PlatformStandaloneMmRpmb.fdf              |  3 ++-
 8 files changed, 47 insertions(+), 17 deletions(-)

-- 
2.17.1


^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2021-08-11 11:47 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-08-10 16:40 [PATCH v3 0/6] Arm 32bit support in PlatformStandaloneMmRpmb Etienne Carriere
2021-08-10 16:40 ` [PATCH v3 1/6] Platform/ARM/SgiPkg: sync with edk2 StandaloneMmCpu path change Etienne Carriere
2021-08-10 16:40 ` [PATCH v3 2/6] Platform/Socionext/DeveloperBox: " Etienne Carriere
2021-08-10 16:40 ` [PATCH v3 3/6] Platform/StandaloneMm: " Etienne Carriere
2021-08-10 16:40 ` [PATCH v3 4/6] Drivers/OpTee: Add Aarch32 SVC IDs for 32bit Arm targets Etienne Carriere
2021-08-10 16:40 ` [PATCH v3 5/6] Drivers/OpTee: address cast build warning issue in 32b mode Etienne Carriere
2021-08-10 16:40 ` [PATCH v3 6/6] Platform/StandaloneMm: build StandaloneMmRpmb for 32bit architectures Etienne Carriere
2021-08-11 11:47 ` [PATCH v3 0/6] Arm 32bit support in PlatformStandaloneMmRpmb Ard Biesheuvel

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox