spike: investigate UKI and TB support on aarch64 devices

[mudler]

Is your feature request related to a problem? Please describe.
Currently UKI Kairos installations are supporting only x86_64 architectures. It would be beneficial to extend support to ARM boards (E.g. Nvidia AGX Orin).

Describe the solution you'd like
ARM does have the so called TrustedZone: it provides fTPM support "emulation" which provides Trusted Boot support, however, so far implementations are very different from what is proposed with systemd and UKIs, see e.g. https://github.com/ARM-software/arm-trusted-firmware/blob/master/docs/design/trusted-board-boot.rst .

However, UKI are generic, and looks like very recently projects like yocto and archboot are gearing support to this:

• https://patchwork.yoctoproject.org/project/oe-core/patch/[email protected]/#21631
• https://archboot.com/ (https://release.archboot.com/aarch64/2024.12/uki/)

Describe alternatives you've considered
Use a TEE-ARM environment to handle disk encryption.

Additional context

• https://developer.arm.com/-/media/Arm%20Developer%20Community/PDF/PSA/DEN0072-PSA_TBFU_1.1-BETA0.pdf?revision=3ce2513a-ae0f-4b43-96a0-851ed67a640b
• https://trustedfirmware-a.readthedocs.io/en/latest/index.html
• https://www.arm.com/technologies/trustzone-for-cortex-m
• https://www.usenix.org/sites/default/files/conference/protected-files/security16_slides_raj.pdf

[mauromorales]

Jason from ARM recommended we check these options:

There are some sources. I have seen a TPM added to an Arm system to be able to run Windows:
https://youtu.be/AshDjtlV6go?si=-5WRYZGLjQ0vZrhL

I believe the hardware is this, but I haven't tried myself yet.
https://mitxpc.com/products/tpm-spi
https://www.newegg.com/asrock-rack-tpm-spi/p/N82E16816775069

Probably also possible using Raspberry Pi hardware:
https://github.com/Infineon/optiga-tpm
https://github.com/joholl/rpi4-uboot-tpm

[Itxaka]

Does this comment and card link with the fTpm card?

It's nice that on that card we found out the same about the ASRock tpm and RPI tpm and even the same system76 workstation loool