Question regarding optee-ftpm TA recipe
Tanguy Raufflet <[email protected]>
| Newsgroups | org.yoctoproject.lists.meta-arm |
|---|---|
| Message-ID | <957048281.3165100.1759839079101.JavaMail.zimbra@savoirfairelinux.com> |
Hello, I recently updated my BSP to a more recent version of Kirktone which leads me to use the new optee-ftpm_git recipe. This one is based on Microsoft/ms-tpm-20-ref while the older recipe was using MSRsec (changes introduced by [1]). After this change I could not boot my target anymore and had no meaningful errors. I finally figured out that one of the 4 "Authentication passed" messages was missing compared to the secure-boot documentation from TI regarding the AM64x [2]. I manage to link this to a problem with the bl32.bin file, which is actually much smaller when using the new version of the optee-ftpm recipe (0.7MiB against 1.2MiB with the recipe using MSRsec). I solved my issue by reverting [1], but I would prefer not to do so since MSRsec looks to be not maintained anymore. When looking at the MSRsec repo, we can see it uses ms-tpm-20-ref as a submodule, so I wonder if we can really use ms-tpm-20-ref alone as is currently done. In addition, I saw that the recipe from the master branch has changed to introduce the new optee_ftpm from OP-TEE in addition to ms-tpm-20-ref. Do you know if the recipe from the Kirktone branch is applicable in my case (AM64) or if I absolutely need to backport the recipe from master to make the fTPM work? [1]: optee-ftpm: Use the latest fTPM sources commit: 3ee7d019898854f776f95ed31f4b7ea8c8a73dfe [2]: https://software-dl.ti.com/processor-sdk-linux/esd/AM64X/latest/exports/docs/linux/Foundational_Components_Secure_Boot.html#secure-boot-flow