Skip to content

Commit 5d40612

Browse files
amratheshamrathesh
committed
README updates
- updated SIE ACS verification guide. - updated README.md wth SIE ACS instructions. - updated init_call debug instruction in IR README. Signed-off-by: Amrathesh <amrathesh@arm.com>
1 parent 9307cd7 commit 5d40612

3 files changed

Lines changed: 105 additions & 16 deletions

File tree

‎IR/Yocto/README.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,18 @@ The live image boots to UEFI Shell. The different test applications can be run i
143143

144144
For the verification steps of SIE ACS, refer to the [SIE ACS Verification](../../common/docs/SIE_ACS_Verification.md).
145145

146+
### Enabling Initcall debug prints in IR Yocto Linux boot
147+
148+
Enabling initcall debug prints allows the kernel to print traces of initcall functions. This feature is not enabled by default, but manually booting Linux with initcall_debug can assist users in debugging kernel issues.
149+
150+
Edit the "Linux boot" boot option by pressing `e` in grub window and append the boot command with following command line options.
151+
152+
```
153+
initcall_debug ignore_loglevel=1
154+
```
155+
156+
Press Ctrl+x to boot the Yocto linux with initcall debug prints enabled.
157+
146158
## Baselines for Open Source Software in this release:
147159

148160
- [Firmware Test Suite (FWTS)](http://kernel.ubuntu.com/git/hwe/fwts.git) TAG: v23.07.00

‎IR/Yocto/meta-woden/recipes-acs/install-files/files/init.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,7 @@ if [ $ADDITIONAL_CMD_OPTION != "noacs" ]; then
137137
pushd /usr/kernel-selftest
138138
./run_kselftest.sh -t dt:test_unprobed_devices.sh > /mnt/acs_results/linux_tools/dt_kselftest.log
139139
popd
140+
140141
# update resolv.conf with 8.8.8.8 DNS server
141142
echo "nameserver 8.8.8.8" >> /etc/resolv.conf
142143

‎common/docs/SIE_ACS_Verification.md‎

Lines changed: 92 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,14 @@ The Security Interface Extension ACS tests the following security related interf
88
* Secure firmware update using update capsules
99
* For systems with Trusted Platform Modules(TPMs), TPM measured boot and the TCG2 protocol
1010

11-
# Running SIE ACS
12-
13-
The Prebuilt SR/ES/IR band images can now be used to verify the requirements of SIE from this release, as they are integrated with the SIE ACS.
14-
15-
See the Section 3.4 [Security Interface Extension ACS Users Guide](https://developer.arm.com/documentation/102872/latest) for instructions to enroll the SecureBoot keys.
11+
Note:
12+
1. The Prebuilt SR/ES/IR band images can be used to verify the requirements of SIE.
13+
2. See the Section 3.4 [Security Interface Extension ACS Users Guide](https://developer.arm.com/documentation/102872/latest) for instructions to enroll the SecureBoot keys.
1614
This document also contains the background information on the SIE related specification and ACS.
1715

18-
## Installing swtpm package (TPM emulator)
16+
## Prerequisite for running SIE ACS on QEMU
17+
18+
### Install swtpm package (TPM emulator)
1919
Note: Install only if there is no past installation of swtpm present. Check by running "swtpm -v" in the terminal, which should output the version.
2020

2121
The following commands should fetch and install the swtpm package:
@@ -45,7 +45,18 @@ cd ..
4545
rm -rf swtpm/ libtpms/
4646
```
4747

48-
## Building UEFI Firmware
48+
## Running SIE ACS on QEMU with UEFI firmware
49+
50+
### Build QEMU model
51+
Follow build instructions from https://www.qemu.org/download/#source
52+
53+
Note: During configure stage, enable slirp library build by appending ./configure with --enable-slirp <br>
54+
slirp is a networking library, required by netdev in QEMU run command.
55+
```
56+
./configure --enable-slirp
57+
```
58+
59+
### Build UEFI Firmware
4960
To build the UEFI firmware images, follow these steps:
5061
1. Fetch edk2 source
5162
```
@@ -66,7 +77,9 @@ NUM_CPUS=$((`getconf _NPROCESSORS_ONLN` + 2))
6677
export GCC5_AARCH64_PREFIX=<set compiler prefix path for aarch64-linux-gnu->
6778
build -n $NUM_CPUS -a AARCH64 -t GCC5 -p ArmVirtPkg/ArmVirtQemu.dsc -b RELEASE -D TTY_TERMINAL -D SECURE_BOOT_ENABLE -D TPM2_ENABLE -D TTY_TERMINAL all
6879
```
80+
6981
NOTE: Download GCC-ARM 10.3 or later toolchain from [here](https://developer.arm.com/tools-and-software/open-source-software/developer-tools/gnu-toolchain/gnu-a/downloads). <br />
82+
7083
3. Create the required flash images
7184
```
7285
#uefi firmware image
@@ -76,7 +89,7 @@ truncate -s 64M flash0.img
7689
truncate -s 64M flash1.img
7790
```
7891

79-
## Running SIE ACS with Prebuilt SystemReady band images on QEMU
92+
### Running SIE ACS with Prebuilt SystemReady SR/ES ACS images on QEMU
8093
1. Create a script "run_qemu.sh" as below with variables configured as per your environment:
8194

8295
```
@@ -85,7 +98,7 @@ truncate -s 64M flash1.img
8598
QEMU=<path to QEMU model>
8699
FLASH0=<path to flash0.img>
87100
FLASH1=<path to flash1.img>
88-
IMG=<path to systemready IR/ES/SR image>
101+
IMG=<path to systemready SR/ES image>
89102
90103
WD=`pwd`
91104
TPMSOCK=/tmp/swtpm-sock$$
@@ -110,19 +123,82 @@ $QEMU -M virt -cpu cortex-a57 -smp 8 -m 2048 \
110123
```
111124

112125
2. To run the SIE ACS, execute the "run_qemu.sh".
126+
Once QEMU execution begins, immediately press Esc key to go into the UEFI settings. Follow the steps in Section 3.4 for "Enrolling keys in EDK2" in the [Security Interface Extension ACS Users Guide](https://developer.arm.com/documentation/102872/latest) for instructions to enroll the secureboot keys. <br>
127+
Note: The SecureBoot keys are present in \<bootfs>\security-interface-extension-keys
128+
129+
130+
3. To run the SIE ACS suites, choose following in grub options.
131+
```
132+
"SCT for Security Interface Extension (optional)" for SIE SCT tests
133+
and
134+
"Linux Boot for Security Interface Extension (optional)" for Secure Linux boot, SIE FWTS and TPM2 logs.
135+
```
136+
137+
Note: IR ACS image can also be run using the above steps, if the underlying firmware is UEFI.
113138

114-
Once QEMU execution begins, immediately press Esc key to go into the UEFI settings. Follow the steps in Section 3.4 for "Enrolling keys in EDK2" in the [Security Interface Extension ACS Users Guide](https://developer.arm.com/documentation/102872/latest) for instructions to enroll the secureboot keys.
139+
## Running SIE ACS on QEMU with uboot firmware
115140

116-
Note: The SecureBoot keys are present in \<bootfs>/security-interface-extension-keys
141+
### Build u-boot firmware and QEMU
142+
Follow the instructions provided in [Verification of the IR image on QEMU Arm machine](../../IR/Yocto/README.md#verification-of-the-ir-image-on-qemu-arm-machine) section of IR Yocto README.
117143

144+
### Running SIE ACS with Prebuilt SystemReady IR ACS image on QEMU
145+
1. Create a script "run_qemu.sh" as below with variables configured as per your environment:
146+
147+
```
148+
#! /bin/bash
149+
150+
IMG=<PATH to IR ACS image>
151+
BUILD_PATH=<path to buildroot directory where QEMU and uboot firmware is built>
152+
QEMU=$BUILD_PATH/output/host/bin/qemu-system-aarch64
153+
FLASH_BIN=$BUILD_PATH/output/images/flash.bin
154+
DISK_IMG=$BUILD_PATH/output/images/disk.img
155+
156+
WD=`pwd`
157+
TPMSOCK=/tmp/swtpm-sock$$
158+
159+
echo "Creating TPM Emulator socket"
160+
[ -e $WD/tpm ] || mkdir $WD/tpm
161+
swtpm socket --tpm2 -t -d --tpmstate dir=$WD/tpm --ctrl type=unixio,path=$TPMSOCK
162+
echo $TPMSOCK
118163
119-
3. In the grub options, choose
164+
echo "Running QEMU EBBR + TPM....."
165+
166+
$QEMU \
167+
-bios $FLASH_BIN \
168+
-cpu cortex-a53 \
169+
-d unimp \
170+
-device virtio-blk-device,drive=hd1 \
171+
-device virtio-blk-device,drive=hd0 \
172+
-device virtio-net-device,netdev=eth0 \
173+
-device virtio-rng-device,rng=rng0 \
174+
-drive file=$IMG,if=none,format=raw,id=hd0 \
175+
-drive file=$DISK_IMG,if=none,id=hd1 \
176+
-m 1024 \
177+
-machine virt,secure=on \
178+
-monitor null \
179+
-chardev socket,id=chrtpm,path=$TPMSOCK \
180+
-tpmdev emulator,id=tpm0,chardev=chrtpm \
181+
-device tpm-tis-device,tpmdev=tpm0 \
182+
-netdev user,id=eth0 \
183+
-no-acpi \
184+
-nodefaults \
185+
-nographic \
186+
-object rng-random,filename=/dev/urandom,id=rng0 \
187+
-rtc base=utc,clock=host \
188+
-serial stdio \
189+
-smp 2 | tee qemu_ebbr_sie_run.log
190+
191+
```
192+
193+
3. Execute the "run_qemu.sh", To run the SIE ACS suites, choose following in grub options.
120194
```
121-
SCT for Security Interface Extension (optional) for SIE SCT tests
195+
"SCT for Security Interface Extension (optional)" for SIE SCT tests
122196
and
123-
Linux Boot for Security Interface Extension (optional) for Secure Linux boot, SIE FWTS and TPM2 logs.
197+
"Linux Boot for Security Interface Extension (optional)" for Secure Linux boot, SIE FWTS and TPM2 logs.
124198
```
125-
to run the SIE ACS suites.
199+
200+
Note: IR Yocto ACS supports automatic enrollment of secure boot keys, still if the system fails to enter SecureBoot mode, Please refer to "Enrolling keys in U-boot" section of [Security Interface Extension ACS Users Guide](https://developer.arm.com/documentation/102872/latest) for instructions to enroll manually. <br>
201+
Note: The SecureBoot keys are present in \<bootfs>\security-interface-extension-keys
126202

127203
--------------
128-
*Copyright (c) 2023, Arm Limited and Contributors. All rights reserved.*
204+
*Copyright (c) 2023-24, Arm Limited and Contributors. All rights reserved.*

0 commit comments

Comments
 (0)