RE: [meta-arm] Full secure boot with qemuarm64

Thank you for the suggestion. Initially, I didn't want to use UEFI to keep the things simples, but I will give it a try. I was also using scarthgap and uefi-secureboot.yml is only available in walnascar branch but it does not really matter as this is only for educational purposes.

Best regards,
Michael Grand
 
-----Message d'origine-----
De : Mikko Rapeli <[email protected]> 
Envoyé : mardi 15 juillet 2025 10:20
À : Michael Grand <[email protected]>; [email protected]
Objet : Re: [meta-arm] Full secure boot with qemuarm64

Hi,

On Tue, Jul 15, 2025 at 11:06:41AM +0300, Mikko Rapeli via lists.yoctoproject.org wrote:
> On Tue, Jul 15, 2025 at 07:57:28AM +0000, Michael Grand via lists.yoctoproject.org wrote:
> > Dear all,
> > 
> > I'm trying to develop a PoC of a fully secure embedded software. Because this PoC is intended for educational use, I don't want to depend on a specific hardware vendor and therefore, I'm using qemuarm64 as target.
> > 
> > Unfortunately, i'm struggling in having a working secure boot (TF-A + OP-TEE + U-boot + kernel) and I cannot find useful (and working) information on the internet. Do somebody has some kind of a minimal working secure boot example based on qemuarm64 ?
> 
> Check the meta-arm layer and build for example "kas build 
> ci/qemuarm64-secureboot:ci/uefi-secureboot.yml:ci/testimage.yml"
> 
> These build u-boot for UEFI secureboot and then load a UKI binary 
> signed with matching keys, which includes kernel and initrd.
> 
> The testimage part boots the thing with u-boot and checks that boot 
> was secure. The config files have the details.

Boots with qemu, I mean to write.

Cheers,

-Mikko