From f042e47e8fb433a7a1f8a25d997ba0fe74e2db53 Mon Sep 17 00:00:00 2001 From: Ilias Apalodimas Date: Sun, 17 May 2020 22:25:44 +0300 Subject: efi_loader: Implement EFI variable handling via OP-TEE In OP-TEE we can run EDK2's StandAloneMM on a secure partition. StandAloneMM is responsible for the UEFI variable support. In combination with OP-TEE and it's U-Boot supplicant, variables are authenticated/validated in secure world and stored on an RPMB partition. So let's add a new config option in U-Boot implementing the necessary calls to OP-TEE for the variable management. Signed-off-by: Ilias Apalodimas Signed-off-by: Pipat Methavanitpong Signed-off-by: Sughosh Ganu Reviewed-by: Heinrich Schuchardt --- lib/efi_loader/Kconfig | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'lib/efi_loader/Kconfig') diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig index 1cfa24ffcf7..aad37b71550 100644 --- a/lib/efi_loader/Kconfig +++ b/lib/efi_loader/Kconfig @@ -164,4 +164,13 @@ config EFI_SECURE_BOOT it is signed with a trusted key. To do that, you need to install, at least, PK, KEK and db. +config EFI_MM_COMM_TEE + bool "UEFI variables storage service via OP-TEE" + depends on OPTEE + default n + help + If OP-TEE is present and running StandAloneMM, dispatch all UEFI variable + related operations to that. The application will verify, authenticate and + store the variables on an RPMB. + endif -- cgit v1.2.3