Re: [DistroKit] [PATCH] reason: silence reason warning about CFG_INSECURE being set

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

On 16.12.24 15:10, Robert Schwebel wrote:
> On Fri, Dec 13, 2024 at 10:59:55AM +0100, Ahmad Fatoum wrote:
>> In actual products, CFG_INSECURE should be disabled after we verify
>> the configuration to be secure. DistroKit uses OP-TEE only on STM32MP13
>> and not for security, but for power management, so we'll just override
>> the option and live with the boot-time warning.
>>
>> Reported-by: Michael Olbrich <m.olbrich@pengutronix.de>
>> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> 
> Applied to next

Please drop again. We only need this override with newer OP-TEE versions.
This will likely be the case with PTXdist v2025.01.0, but for now it's
not needed.

Thanks,
Ahmad

> 
>> ---
>>  configs/platform-v7a/bsp.ref | 8 ++++++++
>>  1 file changed, 8 insertions(+)
>>
>> diff --git a/configs/platform-v7a/bsp.ref b/configs/platform-v7a/bsp.ref
>> index 169e555df53a..bda4db20af2c 100644
>> --- a/configs/platform-v7a/bsp.ref
>> +++ b/configs/platform-v7a/bsp.ref
>> @@ -9,4 +9,12 @@ optee_disabled_features:
>>      - CFG_ENABLE_EMBEDDED_TESTS
>>      - CFG_TEE_CORE_TA_TRACE
>>  
>> +optee_security_warning_disabled:
>> +  description: |
>> +    OP-TEE is used as secure monitor on STM32MP13x providing power
>> +    management and clock/reset control support. We don't use it as
>> +    part of a trusted boot setup, so it's apt for OP-TEE to warn
>> +    about this at startup and thus we'll keep CFG_INSECURE enabled.
>> +  value: True
>> +
>>  # vim: filetype=yaml shiftwidth=2 expandtab
>> -- 
>> 2.39.5
> 


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |