optee-os: add optee rpmb support #326

fr0st61te · 2022-06-09T17:37:48Z

This patch provides rpmb support for IOT2050 on am65 which includes:

TISCI protocol support
DKEK retrieval
DDR setup for DYNSHM
compile option changes for optee

Signed-off-by: Ivan Mikhaylov [email protected]

recipes-bsp/optee-os/optee-os-iot2050_3.16.0.bb

fr0st61te · 2022-06-09T17:40:48Z

recipes-bsp/optee-os/files/0001-plat-k3-drivers-Add-secure-proxy-driver-for-communic.patch

@@ -0,0 +1,460 @@
+From cf20f0a4f77eddf47f278f3d20dc786793542ab4 Mon Sep 17 00:00:00 2001


I didn't test it yet just bring it up for discussion.

Didn't checked it but I notice this patch already acked by Linaro, so I guess this is already upstreamed or under upstreaming... So I believe somebody else had already tested it...

I think this patch is the prerequisite for the following SCI api patch so it must be picked.

Sure, if we can pick the patches via upstream, that would be better. But the question is also if there is already a release with the patch included...

I am ok with a OPTee version bump as long as it does not generate clearing delta.

More important would be a careful check if security fixes need to be picked up - we are starting to put OP-TEE on the critical path now for real.

Agree. We have CERT report to refer to, maybe that could be helpful.

Sure, if we can pick the patches via upstream, that would be better. But the question is also if there is already a release with the patch included...

there is no release, it's not under any tags, it's just directly from master which could be to dangerous to bump into that state.

Didn't checked it but I notice this patch already acked by Linaro, so I guess this is already upstreamed or under upstreaming... So I believe somebody else had already tested it...

I think this patch is the prerequisite for the following SCI api patch so it must be picked.

Yes, TI and me both did testing but not for 3.16.0, I'll test it out to check if all works from upstream.

jan-kiszka · 2022-06-24T09:18:39Z

recipes-bsp/optee-os/optee-os-iot2050_3.16.0_rpmbw.bb

+
+require optee-os-iot2050_3.16.0.inc
+
+OPTEE_EXTRA_BUILDARGS += " CFG_RPMB_WRITE_KEY=y"


Let's control that via an OVERRIDE, something like OPTEE_EXTRA_BUILDARGS_append_rpmb-setup = '...'. Then you can fold both recipes together again. The override would be set by a kas option file, similar to the secure boot enabling.

ok, I'll check how it will goes with OVERRIDE.

recipes-bsp/optee-os/optee-os-iot2050_3.16.0_rpmbw.bb

jan-kiszka · 2022-06-24T09:20:42Z

We also need that kas option file to enable the special firmware build. And that setup should exclude signing the firmware, ie. detect and reject secure boot mode. With that safety measure, I think we could offer to build the special firmware also via kconfig. That would additionally provide the change to explain the usage and constraints in the help entry.

fr0st61te · 2022-06-24T15:10:03Z

We also need that kas option file to enable the special firmware build.

kas-iot2050-boot-pg1-optee-rpmbw.yml
kas-iot2050-boot-pg2-optee-rpmbw.yml ? Or something else?

jan-kiszka · 2022-06-24T15:15:12Z

Do we need pg1/2 differentiation for that? Officially supported will be pg2 only anyway, but we can leave that door technically open. Otherwise maybe kas/opt/rpbm-setup.yml?

Kconfig

jan-kiszka · 2022-06-30T07:50:15Z

What is now the actual testing status of these OP-TEE patches in the backported environment (3.16.0, rather than master)? Can we trust that? Or should we move at least to 3.17.0 (upstream merged them not that many commits after the release)?

fr0st61te · 2022-06-30T08:29:29Z

What is now the actual testing status of these OP-TEE patches in the backported environment (3.16.0, rather than master)? Can we trust that? Or should we move at least to 3.17.0 (upstream merged them not that many commits after the release)?

3.16.0 works fine with backported patches. 3.17.0 and 3.17.0-rc1 don't have these patches, probably in new rc or .18 it will be available.

fr0st61te · 2022-09-20T19:58:11Z

Last version of commits is not tested with 3.18.0, will do it on the current week.

recipes-bsp/optee-os/optee-os-iot2050_3.18.0.bb

kas/opt/rpbm-setup.yml

BaochengSu · 2022-09-26T03:06:26Z

Testing on PG2, below error print could be confusing.

Security ID 0xc8beb00d-0x7f55c02e
Security policy: none
No options found, skip.
Validating FIT...
Loading image atf...
Loading image tee...
Loading image spl...
Loading image k3-am65-iot2050-spl.dtb...
NOTICE:  BL31: v2.6(release):
NOTICE:  BL31: Built : 02:56:00, Sep 14 2022
I/TC:
I/TC: OP-TEE version: 3.18.0 (gcc version 10.2.1 20210110 (Debian 10.2.1-6)) #1 Mon Sep 26 02:11:06 UTC 2022 aarch64
I/TC: WARNING: This OP-TEE configuration might be insecure!
I/TC: WARNING: Please check https://optee.readthedocs.io/en/latest/architecture/porting_guidelines.html
I/TC: Primary CPU initializing
I/TC: SYSFW ABI: 3.1 (firmware rev 0x0015 '21.9.1--v2021.09a (Terrific Lla')
I/TC: HUK Initialized
I/TC: Activated SA2UL device
E/TC:0 0 ti_sci_get_response:120 Message not acknowledged
E/TC:0 0 ti_sci_do_xfer:149 Failed to get response (-65536)
I/TC: Enabled firewalls for SA2UL TRNG device
I/TC: SA2UL TRNG initialized
I/TC: SA2UL Drivers initialized
I/TC: Primary CPU switching to normal world boot

This happens during Line 64 of core/arch/arm/plat-k3/drivers/sa2ul.c

	/* Try to claim the SA2UL firewall for ourselves */
	ret = ti_sci_change_fwl_owner(fwl_id, sa2ul_region, owner_index,
				      &owner_privid, &owner_permission_bits);
	if (ret) {
		/*
		 * This is not fatal, it just means we are on an HS device
		 * where the DMSC already owns the SA2UL. On GP we need
		 * to do additional setup for access permissions below.
		 */
		DMSG("Could not change SA2UL firewall owner");
	}

So it is expected on HS device. However, it is still confusing if I am a end user.

Already reported to upstream, see: OP-TEE/optee_os#5552 & https://github.com/OP-TEE/optee_os/pull/5328/files#r979529747

BaochengSu · 2022-09-26T05:37:13Z

Seems CONFIG_CMD_OPTEE_RPMB is missing from u-boot?

BaochengSu · 2022-09-26T07:10:46Z

I think we should have some wikis regarding how to program the RPMB key, just as what we've done for secure boot otp key programming.

This patch provides rpmb support for IOT2050 on am65 which includes: * TISCI protocol support * DKEK retrieval * DDR setup for DYNSHM * compile option changes for optee Signed-off-by: Ivan Mikhaylov <[email protected]>

Signed-off-by: Ivan Mikhaylov <[email protected]>

This patch provides do_patch_prepend for OPTEE recipe which needed for prevention of usage rpmb-setup and secureboot because rpmb-setup shouldn't be used on production systems. Signed-off-by: Ivan Mikhaylov <[email protected]>

BaochengSu · 2022-09-26T08:57:21Z

Test passed on PG2 device.

fr0st61te commented Jun 9, 2022

View reviewed changes

recipes-bsp/optee-os/optee-os-iot2050_3.16.0.bb Show resolved Hide resolved

fr0st61te commented Jun 9, 2022

View reviewed changes

jan-kiszka reviewed Jun 24, 2022

View reviewed changes

recipes-bsp/optee-os/optee-os-iot2050_3.16.0_rpmbw.bb Outdated Show resolved Hide resolved

fr0st61te force-pushed the rpmb_support branch 2 times, most recently from e57bf82 to e8b3747 Compare June 27, 2022 18:09

fr0st61te commented Jun 29, 2022

View reviewed changes

Kconfig Outdated Show resolved Hide resolved

fr0st61te force-pushed the rpmb_support branch from 4bba67e to 606943d Compare June 29, 2022 11:56

fr0st61te force-pushed the rpmb_support branch 2 times, most recently from 0efef04 to c90f3ec Compare September 20, 2022 19:56

BaochengSu reviewed Sep 21, 2022

View reviewed changes

recipes-bsp/optee-os/optee-os-iot2050_3.18.0.bb Show resolved Hide resolved

BaochengSu reviewed Sep 26, 2022

View reviewed changes

kas/opt/rpbm-setup.yml Outdated Show resolved Hide resolved

fr0st61te added 3 commits September 26, 2022 03:41

optee-os: add optee rpmb support

d6dfb36

This patch provides rpmb support for IOT2050 on am65 which includes: * TISCI protocol support * DKEK retrieval * DDR setup for DYNSHM * compile option changes for optee Signed-off-by: Ivan Mikhaylov <[email protected]>

optee: add rpmb build setup

9621383

Signed-off-by: Ivan Mikhaylov <[email protected]>

fr0st61te force-pushed the rpmb_support branch from c90f3ec to 69fc6d3 Compare September 26, 2022 07:42

BaochengSu approved these changes Sep 27, 2022

View reviewed changes

BaochengSu merged commit 142b0ae into siemens:master Sep 27, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

optee-os: add optee rpmb support #326

optee-os: add optee rpmb support #326

fr0st61te commented Jun 9, 2022

fr0st61te Jun 9, 2022

BaochengSu Jun 10, 2022 •

edited

Loading

jan-kiszka Jun 10, 2022

BaochengSu Jun 10, 2022

jan-kiszka Jun 10, 2022

BaochengSu Jun 10, 2022

fr0st61te Jun 10, 2022

fr0st61te Jun 10, 2022

jan-kiszka Jun 24, 2022

fr0st61te Jun 24, 2022

jan-kiszka commented Jun 24, 2022 •

edited

Loading

fr0st61te commented Jun 24, 2022

jan-kiszka commented Jun 24, 2022

jan-kiszka commented Jun 30, 2022

fr0st61te commented Jun 30, 2022

fr0st61te commented Sep 20, 2022

BaochengSu commented Sep 26, 2022 •

edited

Loading

BaochengSu commented Sep 26, 2022

BaochengSu commented Sep 26, 2022

BaochengSu commented Sep 26, 2022

		@@ -0,0 +1,460 @@
		From cf20f0a4f77eddf47f278f3d20dc786793542ab4 Mon Sep 17 00:00:00 2001


		require optee-os-iot2050_3.16.0.inc

		OPTEE_EXTRA_BUILDARGS += " CFG_RPMB_WRITE_KEY=y"

optee-os: add optee rpmb support #326

optee-os: add optee rpmb support #326

Conversation

fr0st61te commented Jun 9, 2022

Choose a reason for hiding this comment

BaochengSu Jun 10, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jan-kiszka commented Jun 24, 2022 • edited Loading

fr0st61te commented Jun 24, 2022

jan-kiszka commented Jun 24, 2022

jan-kiszka commented Jun 30, 2022

fr0st61te commented Jun 30, 2022

fr0st61te commented Sep 20, 2022

BaochengSu commented Sep 26, 2022 • edited Loading

BaochengSu commented Sep 26, 2022

BaochengSu commented Sep 26, 2022

BaochengSu commented Sep 26, 2022

BaochengSu Jun 10, 2022 •

edited

Loading

jan-kiszka commented Jun 24, 2022 •

edited

Loading

BaochengSu commented Sep 26, 2022 •

edited

Loading