[DistroKit] [PATCH] reason: silence reason warning about CFG_INSECURE being set

[DistroKit] [PATCH] reason: silence reason warning about CFG_INSECURE being set

[Ahmad Fatoum]

In actual products, CFG_INSECURE should be disabled after we verify
the configuration to be secure. DistroKit uses OP-TEE only on STM32MP13
and not for security, but for power management, so we'll just override
the option and live with the boot-time warning.

Reported-by: Michael Olbrich <m.olbrich@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 configs/platform-v7a/bsp.ref | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/configs/platform-v7a/bsp.ref b/configs/platform-v7a/bsp.ref
index 169e555df53a..bda4db20af2c 100644
--- a/configs/platform-v7a/bsp.ref
+++ b/configs/platform-v7a/bsp.ref
@@ -9,4 +9,12 @@ optee_disabled_features:
     - CFG_ENABLE_EMBEDDED_TESTS
     - CFG_TEE_CORE_TA_TRACE
 
+optee_security_warning_disabled:
+  description: |
+    OP-TEE is used as secure monitor on STM32MP13x providing power
+    management and clock/reset control support. We don't use it as
+    part of a trusted boot setup, so it's apt for OP-TEE to warn
+    about this at startup and thus we'll keep CFG_INSECURE enabled.
+  value: True
+
 # vim: filetype=yaml shiftwidth=2 expandtab
-- 
2.39.5

Re: [DistroKit] [PATCH] reason: silence reason warning about CFG_INSECURE being set

[Robert Schwebel]

On Fri, Dec 13, 2024 at 10:59:55AM +0100, Ahmad Fatoum wrote:
> In actual products, CFG_INSECURE should be disabled after we verify
> the configuration to be secure. DistroKit uses OP-TEE only on STM32MP13
> and not for security, but for power management, so we'll just override
> the option and live with the boot-time warning.
> 
> Reported-by: Michael Olbrich <m.olbrich@pengutronix.de>
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

Applied to next

> ---
>  configs/platform-v7a/bsp.ref | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/configs/platform-v7a/bsp.ref b/configs/platform-v7a/bsp.ref
> index 169e555df53a..bda4db20af2c 100644
> --- a/configs/platform-v7a/bsp.ref
> +++ b/configs/platform-v7a/bsp.ref
> @@ -9,4 +9,12 @@ optee_disabled_features:
>      - CFG_ENABLE_EMBEDDED_TESTS
>      - CFG_TEE_CORE_TA_TRACE
>  
> +optee_security_warning_disabled:
> +  description: |
> +    OP-TEE is used as secure monitor on STM32MP13x providing power
> +    management and clock/reset control support. We don't use it as
> +    part of a trusted boot setup, so it's apt for OP-TEE to warn
> +    about this at startup and thus we'll keep CFG_INSECURE enabled.
> +  value: True
> +
>  # vim: filetype=yaml shiftwidth=2 expandtab
> -- 
> 2.39.5

-- 
Pengutronix e.K.                           | Dipl.-Ing. Robert Schwebel  |
Steuerwalder Str. 21                       | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-9    |

Re: [DistroKit] [PATCH] reason: silence reason warning about CFG_INSECURE being set

[Ahmad Fatoum]

On 16.12.24 15:10, Robert Schwebel wrote:
> On Fri, Dec 13, 2024 at 10:59:55AM +0100, Ahmad Fatoum wrote:
>> In actual products, CFG_INSECURE should be disabled after we verify
>> the configuration to be secure. DistroKit uses OP-TEE only on STM32MP13
>> and not for security, but for power management, so we'll just override
>> the option and live with the boot-time warning.
>>
>> Reported-by: Michael Olbrich <m.olbrich@pengutronix.de>
>> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> 
> Applied to next

Please drop again. We only need this override with newer OP-TEE versions.
This will likely be the case with PTXdist v2025.01.0, but for now it's
not needed.

Thanks,
Ahmad

> 
>> ---
>>  configs/platform-v7a/bsp.ref | 8 ++++++++
>>  1 file changed, 8 insertions(+)
>>
>> diff --git a/configs/platform-v7a/bsp.ref b/configs/platform-v7a/bsp.ref
>> index 169e555df53a..bda4db20af2c 100644
>> --- a/configs/platform-v7a/bsp.ref
>> +++ b/configs/platform-v7a/bsp.ref
>> @@ -9,4 +9,12 @@ optee_disabled_features:
>>      - CFG_ENABLE_EMBEDDED_TESTS
>>      - CFG_TEE_CORE_TA_TRACE
>>  
>> +optee_security_warning_disabled:
>> +  description: |
>> +    OP-TEE is used as secure monitor on STM32MP13x providing power
>> +    management and clock/reset control support. We don't use it as
>> +    part of a trusted boot setup, so it's apt for OP-TEE to warn
>> +    about this at startup and thus we'll keep CFG_INSECURE enabled.
>> +  value: True
>> +
>>  # vim: filetype=yaml shiftwidth=2 expandtab
>> -- 
>> 2.39.5
> 


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

Re: [DistroKit] [PATCH] reason: silence reason warning about CFG_INSECURE being set

[Ahmad Fatoum]

Hello Robert,

On 16.12.24 18:17, Ahmad Fatoum wrote:
> On 16.12.24 15:10, Robert Schwebel wrote:
>> On Fri, Dec 13, 2024 at 10:59:55AM +0100, Ahmad Fatoum wrote:
>>> In actual products, CFG_INSECURE should be disabled after we verify
>>> the configuration to be secure. DistroKit uses OP-TEE only on STM32MP13
>>> and not for security, but for power management, so we'll just override
>>> the option and live with the boot-time warning.
>>>
>>> Reported-by: Michael Olbrich <m.olbrich@pengutronix.de>
>>> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
>>
>> Applied to next
> 
> Please drop again. We only need this override with newer OP-TEE versions.
> This will likely be the case with PTXdist v2025.01.0, but for now it's
> not needed.

With the v2025.03 bump now in next, can you cherry-pick this patch
to next as well?

Thanks,
Ahmad

> 
> Thanks,
> Ahmad
> 
>>
>>> ---
>>>  configs/platform-v7a/bsp.ref | 8 ++++++++
>>>  1 file changed, 8 insertions(+)
>>>
>>> diff --git a/configs/platform-v7a/bsp.ref b/configs/platform-v7a/bsp.ref
>>> index 169e555df53a..bda4db20af2c 100644
>>> --- a/configs/platform-v7a/bsp.ref
>>> +++ b/configs/platform-v7a/bsp.ref
>>> @@ -9,4 +9,12 @@ optee_disabled_features:
>>>      - CFG_ENABLE_EMBEDDED_TESTS
>>>      - CFG_TEE_CORE_TA_TRACE
>>>  
>>> +optee_security_warning_disabled:
>>> +  description: |
>>> +    OP-TEE is used as secure monitor on STM32MP13x providing power
>>> +    management and clock/reset control support. We don't use it as
>>> +    part of a trusted boot setup, so it's apt for OP-TEE to warn
>>> +    about this at startup and thus we'll keep CFG_INSECURE enabled.
>>> +  value: True
>>> +
>>>  # vim: filetype=yaml shiftwidth=2 expandtab
>>> -- 
>>> 2.39.5
>>
> 
> 


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

Re: [DistroKit] [PATCH] reason: silence reason warning about CFG_INSECURE being set

[Robert Schwebel]

On Mon, Mar 24, 2025 at 07:40:37PM +0100, Ahmad Fatoum wrote:
> With the v2025.03 bump now in next, can you cherry-pick this patch
> to next as well?

Must have missed this, I've added the snippet to next and the warning is
gone. Please have a look if I did it right.

rsc

> >>> diff --git a/configs/platform-v7a/bsp.ref b/configs/platform-v7a/bsp.ref
> >>> index 169e555df53a..bda4db20af2c 100644
> >>> --- a/configs/platform-v7a/bsp.ref
> >>> +++ b/configs/platform-v7a/bsp.ref
> >>> @@ -9,4 +9,12 @@ optee_disabled_features:
> >>>      - CFG_ENABLE_EMBEDDED_TESTS
> >>>      - CFG_TEE_CORE_TA_TRACE
> >>>  
> >>> +optee_security_warning_disabled:
> >>> +  description: |
> >>> +    OP-TEE is used as secure monitor on STM32MP13x providing power
> >>> +    management and clock/reset control support. We don't use it as
> >>> +    part of a trusted boot setup, so it's apt for OP-TEE to warn
> >>> +    about this at startup and thus we'll keep CFG_INSECURE enabled.
> >>> +  value: True
> >>> +
> >>>  # vim: filetype=yaml shiftwidth=2 expandtab

-- 
Pengutronix e.K.                           | Dipl.-Ing. Robert Schwebel  |
Steuerwalder Str. 21                       | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-9    |

Re: [DistroKit] [PATCH] reason: silence reason warning about CFG_INSECURE being set

[Ahmad Fatoum]

Hello Robert,

On 3/25/25 07:42, Robert Schwebel wrote:
> On Mon, Mar 24, 2025 at 07:40:37PM +0100, Ahmad Fatoum wrote:
>> With the v2025.03 bump now in next, can you cherry-pick this patch
>> to next as well?
> 
> Must have missed this, I've added the snippet to next and the warning is
> gone. Please have a look if I did it right.

The patch became only relevant with the upgrade to PTXdist >= v2025.01.0.

The applied patch to next looks fine.

Thanks,
Ahmad

> 
> rsc
> 
>>>>> diff --git a/configs/platform-v7a/bsp.ref b/configs/platform-v7a/bsp.ref
>>>>> index 169e555df53a..bda4db20af2c 100644
>>>>> --- a/configs/platform-v7a/bsp.ref
>>>>> +++ b/configs/platform-v7a/bsp.ref
>>>>> @@ -9,4 +9,12 @@ optee_disabled_features:
>>>>>      - CFG_ENABLE_EMBEDDED_TESTS
>>>>>      - CFG_TEE_CORE_TA_TRACE
>>>>>  
>>>>> +optee_security_warning_disabled:
>>>>> +  description: |
>>>>> +    OP-TEE is used as secure monitor on STM32MP13x providing power
>>>>> +    management and clock/reset control support. We don't use it as
>>>>> +    part of a trusted boot setup, so it's apt for OP-TEE to warn
>>>>> +    about this at startup and thus we'll keep CFG_INSECURE enabled.
>>>>> +  value: True
>>>>> +
>>>>>  # vim: filetype=yaml shiftwidth=2 expandtab
>