[DistroKit] [PATCH] reason: silence reason warning about CFG_INSECURE being set

[DistroKit] [PATCH] reason: silence reason warning about CFG_INSECURE being set

[Ahmad Fatoum]

In actual products, CFG_INSECURE should be disabled after we verify
the configuration to be secure. DistroKit uses OP-TEE only on STM32MP13
and not for security, but for power management, so we'll just override
the option and live with the boot-time warning.

Reported-by: Michael Olbrich <m.olbrich@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 configs/platform-v7a/bsp.ref | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/configs/platform-v7a/bsp.ref b/configs/platform-v7a/bsp.ref
index 169e555df53a..bda4db20af2c 100644
--- a/configs/platform-v7a/bsp.ref
+++ b/configs/platform-v7a/bsp.ref
@@ -9,4 +9,12 @@ optee_disabled_features:
     - CFG_ENABLE_EMBEDDED_TESTS
     - CFG_TEE_CORE_TA_TRACE
 
+optee_security_warning_disabled:
+  description: |
+    OP-TEE is used as secure monitor on STM32MP13x providing power
+    management and clock/reset control support. We don't use it as
+    part of a trusted boot setup, so it's apt for OP-TEE to warn
+    about this at startup and thus we'll keep CFG_INSECURE enabled.
+  value: True
+
 # vim: filetype=yaml shiftwidth=2 expandtab
-- 
2.39.5

Re: [DistroKit] [PATCH] reason: silence reason warning about CFG_INSECURE being set

[Robert Schwebel]

On Fri, Dec 13, 2024 at 10:59:55AM +0100, Ahmad Fatoum wrote:
> In actual products, CFG_INSECURE should be disabled after we verify
> the configuration to be secure. DistroKit uses OP-TEE only on STM32MP13
> and not for security, but for power management, so we'll just override
> the option and live with the boot-time warning.
> 
> Reported-by: Michael Olbrich <m.olbrich@pengutronix.de>
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

Applied to next

> ---
>  configs/platform-v7a/bsp.ref | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/configs/platform-v7a/bsp.ref b/configs/platform-v7a/bsp.ref
> index 169e555df53a..bda4db20af2c 100644
> --- a/configs/platform-v7a/bsp.ref
> +++ b/configs/platform-v7a/bsp.ref
> @@ -9,4 +9,12 @@ optee_disabled_features:
>      - CFG_ENABLE_EMBEDDED_TESTS
>      - CFG_TEE_CORE_TA_TRACE
>  
> +optee_security_warning_disabled:
> +  description: |
> +    OP-TEE is used as secure monitor on STM32MP13x providing power
> +    management and clock/reset control support. We don't use it as
> +    part of a trusted boot setup, so it's apt for OP-TEE to warn
> +    about this at startup and thus we'll keep CFG_INSECURE enabled.
> +  value: True
> +
>  # vim: filetype=yaml shiftwidth=2 expandtab
> -- 
> 2.39.5

-- 
Pengutronix e.K.                           | Dipl.-Ing. Robert Schwebel  |
Steuerwalder Str. 21                       | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-9    |

Re: [DistroKit] [PATCH] reason: silence reason warning about CFG_INSECURE being set

[Ahmad Fatoum]

On 16.12.24 15:10, Robert Schwebel wrote:
> On Fri, Dec 13, 2024 at 10:59:55AM +0100, Ahmad Fatoum wrote:
>> In actual products, CFG_INSECURE should be disabled after we verify
>> the configuration to be secure. DistroKit uses OP-TEE only on STM32MP13
>> and not for security, but for power management, so we'll just override
>> the option and live with the boot-time warning.
>>
>> Reported-by: Michael Olbrich <m.olbrich@pengutronix.de>
>> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> 
> Applied to next

Please drop again. We only need this override with newer OP-TEE versions.
This will likely be the case with PTXdist v2025.01.0, but for now it's
not needed.

Thanks,
Ahmad

> 
>> ---
>>  configs/platform-v7a/bsp.ref | 8 ++++++++
>>  1 file changed, 8 insertions(+)
>>
>> diff --git a/configs/platform-v7a/bsp.ref b/configs/platform-v7a/bsp.ref
>> index 169e555df53a..bda4db20af2c 100644
>> --- a/configs/platform-v7a/bsp.ref
>> +++ b/configs/platform-v7a/bsp.ref
>> @@ -9,4 +9,12 @@ optee_disabled_features:
>>      - CFG_ENABLE_EMBEDDED_TESTS
>>      - CFG_TEE_CORE_TA_TRACE
>>  
>> +optee_security_warning_disabled:
>> +  description: |
>> +    OP-TEE is used as secure monitor on STM32MP13x providing power
>> +    management and clock/reset control support. We don't use it as
>> +    part of a trusted boot setup, so it's apt for OP-TEE to warn
>> +    about this at startup and thus we'll keep CFG_INSECURE enabled.
>> +  value: True
>> +
>>  # vim: filetype=yaml shiftwidth=2 expandtab
>> -- 
>> 2.39.5
> 


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |