zondax / buildroot-zondax Goto Github PK

There is an issue with the optee-examples package that causes a compilation error.

Is it worth to enable CI ??
We just need a simple machine with ubuntu and some packages required by buildroot

The bootloader and uboot should be validated before booting the image, for this keys and certificates are used.

By passing TA_SIGN_KEY="path_to_our_pubkey_.pem" to optee-os, using buildroot, like:

BR2_TARGET_OPTEE_OS_ADDITIONAL_VARIABLES="TA_SIGN_KEY=my_key.pem"

we can tell optee-os the key it must use to verify signed TAs. This also requires some extra steps as described here that should be included into our build steps.

It seems that there could be other issues when the TA_SIGN_KEY envar is set, according to this issue.

We should evaluate this using qemu at least and integrate it in the other targets.

The simple hello-rustee application should be installed on the final image.

Similar to yocto where users can sign the FSBL partition and fuse the device with their key. ensuring the board only but
with signed images.

here are useful instructions:
https://community.nxp.com/t5/i-MX-Processors-Knowledge-Base/Steps-to-enable-secure-boot-in-i-MX8M-Nano/ta-p/1246417

There is an issue when trying to build and run qemu

• Enable DHCP + networking inside Qemu
• STM32MP157 (confirm)
• imx8mmevk (confirm)

In yocto we had an option to build qemu for armv7 and armv8 targets.
if this feature(qemu and emulation) is desirable, we should enable it in buildroot, at least for one target either v7 or v8.

the current available command to build a qemu image is:

make zondaxtee_qemu_defconfig
make

but it is broken somewhere, giving the following error:

USERID                : 1001
make[1]: Entering directory '/home/natanael/buildroot-zondax/buildroot'
/usr/bin/make -j1 O=/home/natanael/buildroot-zondax/buildroot/output HOSTCC="/usr/bin/gcc" HOSTCXX="/usr/bin/g++" syncconfig
>>> toolchain-external-arm-arm 2021.07 Installing to staging directory
/usr/bin/install -D -m 0755 /home/natanael/buildroot-zondax/buildroot/output/build/toolchain-external-arm-arm-2021.07/toolchain-wrapper /home/natanael/buildroot-zondax/buildroot/output/per-package/toolchain-external-arm-arm/host/bin/toolchain-wrapper
ln: failed to create symbolic link '/home/natanael/buildroot-zondax/buildroot/output/per-package/toolchain-external-arm-arm/host/arm-buildroot-linux-gnueabihf/sysroot/usr/lib': No such file or directory
make[2]: *** [package/pkg-generic.mk:334: /home/natanael/buildroot-zondax/buildroot/output/build/toolchain-external-arm-arm-2021.07/.stamp_staging_installed] Error 1
make[1]: *** [Makefile:84: _all] Error 2
make[1]: Leaving directory '/home/natanael/buildroot-zondax/buildroot'
make: *** [Makefile:46: all] Error 2

an option is to enable it to run in our docker container.

🔗 zboto Link

We are currently including the optee test, examples and optee-os packages, but the optee-client lib is needed by hello-rustee and our tee-service

tee-substrate-service should be part of the image