Re: [PATCH 1/2] trusted-firmware-a: continue if TPM device is missing

[Mikko Rapeli <mikko.rapeli@linaro.org>]

Hi,

On Tue, Apr 23, 2024 at 02:21:12PM -0400, Jon Mason wrote:
> On Mon, Apr 22, 2024 at 10:29:01AM +0300, Mikko Rapeli wrote:
> > Hi,
> > 
> > On Sat, Apr 20, 2024 at 06:40:54PM -0400, Jon Mason wrote:
> > > On Wed, Apr 17, 2024 at 02:07:21PM +0300, Mikko Rapeli wrote:
> > > > All other firmware boot components also continue booting
> > > > if TPM is not found. It is up to subsequent SW components
> > > > to e.g. fail if rootfs can't be decrypted. Enables policies
> > > > like fall back to unencrypted rootfs if TPM device is
> > > > not found with qemu and swtpm.
> > > > 
> > > > Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
> > > 
> > > This series is failing on all instances of qemuarm64-secureboot and
> > > qemuarm-secureboot.  You can see it on my gitlab CI at:
> > > https://gitlab.com/jonmason00/meta-arm/-/pipelines/1261200728
> > > 
> > > All of them appear to be due to detecting the following error (snipped
> > > from the dmesg of the errorlog):
> > > optee-ftpm optee-ta-bc50d971-d4c9-42c4-82cb-343fb7f37896: ftpm_tee_probe: tee_client_open_session failed, err=ffff3024
> > > optee-ftpm: probe of optee-ta-bc50d971-d4c9-42c4-82cb-343fb7f37896 failed with error -22
> > 
> > Bummer, checking what I missed here.
> > 
> > Did optee-test/xtest run and possibly pass despite of this? I don't see this from the logs.
> 
> optee-test is only being compiled, not being run as part of CI
> (patches very much wanted and welcomed).  So, nothing exciting here
> except the kernel trying to load the modules and erroring out.

Ok. I managed to reproduce this issue and also saw that optee-test xtest was
failing on the core-image-base. The image needs

IMAGE_INSTALL:append = " optee-client optee-os-ta optee-test"

and then optee-test/xtest passes. So optee itself is working and fine.

What exact config and commands does the CI job run? I could provide
the patches for optee-test/xtest.

Looking into the ftpm kernel error now...

Cheers,

-Mikko