diff options
| author | Ilias Apalodimas <ilias.apalodimas@linaro.org> | 2020-05-17 22:25:47 +0300 |
|---|---|---|
| committer | Heinrich Schuchardt <xypron.glpk@gmx.de> | 2020-05-17 21:59:53 +0200 |
| commit | e498dac43e6270f156f1cc90cb9f40b359477853 (patch) | |
| tree | 4dafa5b4ae99c35348007eb5a320fa75b3f33fbd /doc | |
| parent | e4acbe4e34b0e9bc0243b9d21720111128a1b5b3 (diff) | |
doc: uefi.rst: Add OP-TEE variable storage config options
If OP-TEE is compiled with an EDK2 application running in secure world
it can process and store UEFI variables in an RPMB.
Add documentation for the config options enabling this.
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/uefi/uefi.rst | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/doc/uefi/uefi.rst b/doc/uefi/uefi.rst index 4fda00d687..03d6fd0c6a 100644 --- a/doc/uefi/uefi.rst +++ b/doc/uefi/uefi.rst @@ -188,6 +188,23 @@ on the sandbox cd <U-Boot source directory> pytest.py test/py/tests/test_efi_secboot/test_signed.py --bd sandbox +Using OP-TEE for EFI variables +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Instead of implementing UEFI variable services inside U-Boot they can +also be provided in the secure world by a module for OP-TEE[1]. The +interface between U-Boot and OP-TEE for variable services is enabled by +CONFIG_EFI_MM_COMM_TEE=y. + +Tianocore EDK II's standalone management mode driver for variables can +be linked to OP-TEE for this purpose. This module uses the Replay +Protected Memory Block (RPMB) of an eMMC device for persisting +non-volatile variables. When calling the variable services via the +OP-TEE API U-Boot's OP-TEE supplicant relays calls to the RPMB driver +which has to be enabled via CONFIG_SUPPORT_EMMC_RPMB=y. + +[1] https://optee.readthedocs.io/ - OP-TEE documentation + Executing the boot manager ~~~~~~~~~~~~~~~~~~~~~~~~~~ |