Re: [meta-arm] Question regarding optee-ftpm TA recipe

Hi,

Adding OP-TEE maintainers to Cc:

On Tue, Oct 07, 2025 at 08:11:19AM -0400, Tanguy Raufflet via lists.yoctoproject.org wrote:
> Hello, 
> 
> I recently updated my BSP to a more recent version of Kirktone 
> which leads me to use the new optee-ftpm_git recipe. This one is based 
> on Microsoft/ms-tpm-20-ref while the older recipe was using MSRsec 
> (changes introduced by [1]). 
> 
> After this change I could not boot my target anymore and had no 
> meaningful errors. I finally figured out that one of the 4 
> "Authentication passed" messages was missing compared to the secure-boot 
> documentation from TI regarding the AM64x [2]. 
> I manage to link this to a problem with the bl32.bin file, which is 
> actually much smaller when using the new version of the optee-ftpm 
> recipe (0.7MiB against 1.2MiB with the recipe using MSRsec). I solved my 
> issue by reverting [1], but I would prefer not to do so since MSRsec 
> looks to be not maintained anymore. 
> 
> When looking at the MSRsec repo, we can see it uses ms-tpm-20-ref as a 
> submodule, so I wonder if we can really use ms-tpm-20-ref alone as is 
> currently done. In addition, I saw that the recipe from the master 
> branch has changed to introduce the new optee_ftpm from OP-TEE in 
> addition to ms-tpm-20-ref. 
> 
> Do you know if the recipe from the Kirktone branch is applicable in my 
> case (AM64) or if I absolutely need to backport the recipe from master 
> to make the fTPM work? 

The answer depends. I think the ftpm version from meta-arm kirkstone branch
is too old to ship in new products because the ftpm tree is no longer maintained.
I think it would be better to make the new ftpm version from meta-arm master
branch work but that may mean updating also to newer OP-TEE version as well.
At least this version of ftpm is now maintained by the OP-TEE developers.

I think your boot issue is not fully resolved yet. I would enable logging
from OP-TEE to figure out why the boot is hanging. It is possible that
this is a configuration issue with OP-TEE, e.g. new ftpm using some calls/APIs
which don't exist in the old OP-TEE version. It is possible that your firmware
needs an update to ftpm, OP-TEE, TF-A etc to get all versions in sync and working
with each other.

Cheers,

-Mikko

> [1]: optee-ftpm: Use the latest fTPM sources 
> commit: 3ee7d019898854f776f95ed31f4b7ea8c8a73dfe 
> [2]: https://software-dl.ti.com/processor-sdk-linux/esd/AM64X/latest/exports/docs/linux/Foundational_Components_Secure_Boot.html#secure-boot-flow 
> 

> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#6726): https://lists.yoctoproject.org/g/meta-arm/message/6726
> Mute This Topic: https://lists.yoctoproject.org/mt/115634462/7159507
> Group Owner: [email protected]
> Unsubscribe: https://lists.yoctoproject.org/g/meta-arm/unsub [[email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
>