diff mbox series

[1/2] trusted-firmware-a: continue if TPM device is missing

Message ID 20240417110722.283283-1-mikko.rapeli@linaro.org
State New
Headers show
Series [1/2] trusted-firmware-a: continue if TPM device is missing | expand

Commit Message

Mikko Rapeli April 17, 2024, 11:07 a.m. UTC 
All other firmware boot components also continue booting
if TPM is not found. It is up to subsequent SW components
to e.g. fail if rootfs can't be decrypted. Enables policies
like fall back to unencrypted rootfs if TPM device is
not found with qemu and swtpm.

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 ...ot.c-ignore-TPM-error-and-continue-w.patch | 36 +++++++++++++++++++
 .../trusted-firmware-a_2.10.3.bb              |  5 +++
 2 files changed, 41 insertions(+)
 create mode 100644 meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch

Comments

Jon Mason April 20, 2024, 10:40 p.m. UTC | #1 
On Wed, Apr 17, 2024 at 02:07:21PM +0300, Mikko Rapeli wrote:
> All other firmware boot components also continue booting
> if TPM is not found. It is up to subsequent SW components
> to e.g. fail if rootfs can't be decrypted. Enables policies
> like fall back to unencrypted rootfs if TPM device is
> not found with qemu and swtpm.
> 
> Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>

This series is failing on all instances of qemuarm64-secureboot and
qemuarm-secureboot.  You can see it on my gitlab CI at:
https://gitlab.com/jonmason00/meta-arm/-/pipelines/1261200728

All of them appear to be due to detecting the following error (snipped
from the dmesg of the errorlog):
optee-ftpm optee-ta-bc50d971-d4c9-42c4-82cb-343fb7f37896: ftpm_tee_probe: tee_client_open_session failed, err=ffff3024
optee-ftpm: probe of optee-ta-bc50d971-d4c9-42c4-82cb-343fb7f37896 failed with error -22

Thanks,
Jon

> ---
>  ...ot.c-ignore-TPM-error-and-continue-w.patch | 36 +++++++++++++++++++
>  .../trusted-firmware-a_2.10.3.bb              |  5 +++
>  2 files changed, 41 insertions(+)
>  create mode 100644 meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch
> 
> diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch b/meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch
> new file mode 100644
> index 00000000..2d189d8e
> --- /dev/null
> +++ b/meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch
> @@ -0,0 +1,36 @@
> +From 1d1425bde8435d6e2b3e4f2b7bcb2eb293ef9601 Mon Sep 17 00:00:00 2001
> +From: Mikko Rapeli <mikko.rapeli@linaro.org>
> +Date: Mon, 15 Jan 2024 09:26:56 +0000
> +Subject: [PATCH] qemu_measured_boot.c: ignore TPM error and continue with boot
> +
> +If firmware is configured with TPM support but it's missing
> +on HW, e.g. swtpm not started and/or configured with qemu,
> +then continue booting. Missing TPM is not a fatal error.
> +Enables testing boot without TPM device to see that
> +missing TPM is detected further up the SW stack and correct
> +fallback actions are taken.
> +
> +Upstream-Status: Pending
> +
> +Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
> +---
> + plat/qemu/qemu/qemu_measured_boot.c | 3 ++-
> + 1 file changed, 2 insertions(+), 1 deletion(-)
> +
> +diff --git a/plat/qemu/qemu/qemu_measured_boot.c b/plat/qemu/qemu/qemu_measured_boot.c
> +index 122bb23b14..731b081c47 100644
> +--- a/plat/qemu/qemu/qemu_measured_boot.c
> ++++ b/plat/qemu/qemu/qemu_measured_boot.c
> +@@ -79,7 +79,8 @@ void bl2_plat_mboot_finish(void)
> + 		 * Note: In QEMU platform, OP-TEE uses nt_fw_config to get the
> + 		 * secure Event Log buffer address.
> + 		 */
> +-		panic();
> ++		ERROR("Ignoring TPM errors, continuing without\n");
> ++		return;
> + 	}
> + 
> + 	/* Copy Event Log to Non-secure memory */
> +-- 
> +2.34.1
> +
> diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
> index b30ac725..13942dbb 100644
> --- a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
> +++ b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
> @@ -11,3 +11,8 @@ SRC_URI_MBEDTLS = "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=ht
>  SRCREV_mbedtls = "72718dd87e087215ce9155a826ee5a66cfbe9631"
>  
>  LIC_FILES_CHKSUM_MBEDTLS = "file://mbedtls/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
> +
> +# continue to boot also without TPM
> +SRC_URI += "\
> +    file://0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch \
> +"
> -- 
> 2.34.1
> 
>
Mikko Rapeli April 22, 2024, 7:29 a.m. UTC | #2 
Hi,

On Sat, Apr 20, 2024 at 06:40:54PM -0400, Jon Mason wrote:
> On Wed, Apr 17, 2024 at 02:07:21PM +0300, Mikko Rapeli wrote:
> > All other firmware boot components also continue booting
> > if TPM is not found. It is up to subsequent SW components
> > to e.g. fail if rootfs can't be decrypted. Enables policies
> > like fall back to unencrypted rootfs if TPM device is
> > not found with qemu and swtpm.
> > 
> > Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
> 
> This series is failing on all instances of qemuarm64-secureboot and
> qemuarm-secureboot.  You can see it on my gitlab CI at:
> https://gitlab.com/jonmason00/meta-arm/-/pipelines/1261200728
> 
> All of them appear to be due to detecting the following error (snipped
> from the dmesg of the errorlog):
> optee-ftpm optee-ta-bc50d971-d4c9-42c4-82cb-343fb7f37896: ftpm_tee_probe: tee_client_open_session failed, err=ffff3024
> optee-ftpm: probe of optee-ta-bc50d971-d4c9-42c4-82cb-343fb7f37896 failed with error -22

Bummer, checking what I missed here.

Did optee-test/xtest run and possibly pass despite of this? I don't see this from the logs.

Cheers,

-Mikko

> Thanks,
> Jon
> 
> > ---
> >  ...ot.c-ignore-TPM-error-and-continue-w.patch | 36 +++++++++++++++++++
> >  .../trusted-firmware-a_2.10.3.bb              |  5 +++
> >  2 files changed, 41 insertions(+)
> >  create mode 100644 meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch
> > 
> > diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch b/meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch
> > new file mode 100644
> > index 00000000..2d189d8e
> > --- /dev/null
> > +++ b/meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch
> > @@ -0,0 +1,36 @@
> > +From 1d1425bde8435d6e2b3e4f2b7bcb2eb293ef9601 Mon Sep 17 00:00:00 2001
> > +From: Mikko Rapeli <mikko.rapeli@linaro.org>
> > +Date: Mon, 15 Jan 2024 09:26:56 +0000
> > +Subject: [PATCH] qemu_measured_boot.c: ignore TPM error and continue with boot
> > +
> > +If firmware is configured with TPM support but it's missing
> > +on HW, e.g. swtpm not started and/or configured with qemu,
> > +then continue booting. Missing TPM is not a fatal error.
> > +Enables testing boot without TPM device to see that
> > +missing TPM is detected further up the SW stack and correct
> > +fallback actions are taken.
> > +
> > +Upstream-Status: Pending
> > +
> > +Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
> > +---
> > + plat/qemu/qemu/qemu_measured_boot.c | 3 ++-
> > + 1 file changed, 2 insertions(+), 1 deletion(-)
> > +
> > +diff --git a/plat/qemu/qemu/qemu_measured_boot.c b/plat/qemu/qemu/qemu_measured_boot.c
> > +index 122bb23b14..731b081c47 100644
> > +--- a/plat/qemu/qemu/qemu_measured_boot.c
> > ++++ b/plat/qemu/qemu/qemu_measured_boot.c
> > +@@ -79,7 +79,8 @@ void bl2_plat_mboot_finish(void)
> > + 		 * Note: In QEMU platform, OP-TEE uses nt_fw_config to get the
> > + 		 * secure Event Log buffer address.
> > + 		 */
> > +-		panic();
> > ++		ERROR("Ignoring TPM errors, continuing without\n");
> > ++		return;
> > + 	}
> > + 
> > + 	/* Copy Event Log to Non-secure memory */
> > +-- 
> > +2.34.1
> > +
> > diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
> > index b30ac725..13942dbb 100644
> > --- a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
> > +++ b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
> > @@ -11,3 +11,8 @@ SRC_URI_MBEDTLS = "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=ht
> >  SRCREV_mbedtls = "72718dd87e087215ce9155a826ee5a66cfbe9631"
> >  
> >  LIC_FILES_CHKSUM_MBEDTLS = "file://mbedtls/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
> > +
> > +# continue to boot also without TPM
> > +SRC_URI += "\
> > +    file://0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch \
> > +"
> > -- 
> > 2.34.1
> > 
> >
Jon Mason April 23, 2024, 6:21 p.m. UTC | #3 
On Mon, Apr 22, 2024 at 10:29:01AM +0300, Mikko Rapeli wrote:
> Hi,
> 
> On Sat, Apr 20, 2024 at 06:40:54PM -0400, Jon Mason wrote:
> > On Wed, Apr 17, 2024 at 02:07:21PM +0300, Mikko Rapeli wrote:
> > > All other firmware boot components also continue booting
> > > if TPM is not found. It is up to subsequent SW components
> > > to e.g. fail if rootfs can't be decrypted. Enables policies
> > > like fall back to unencrypted rootfs if TPM device is
> > > not found with qemu and swtpm.
> > > 
> > > Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
> > 
> > This series is failing on all instances of qemuarm64-secureboot and
> > qemuarm-secureboot.  You can see it on my gitlab CI at:
> > https://gitlab.com/jonmason00/meta-arm/-/pipelines/1261200728
> > 
> > All of them appear to be due to detecting the following error (snipped
> > from the dmesg of the errorlog):
> > optee-ftpm optee-ta-bc50d971-d4c9-42c4-82cb-343fb7f37896: ftpm_tee_probe: tee_client_open_session failed, err=ffff3024
> > optee-ftpm: probe of optee-ta-bc50d971-d4c9-42c4-82cb-343fb7f37896 failed with error -22
> 
> Bummer, checking what I missed here.
> 
> Did optee-test/xtest run and possibly pass despite of this? I don't see this from the logs.

optee-test is only being compiled, not being run as part of CI
(patches very much wanted and welcomed).  So, nothing exciting here
except the kernel trying to load the modules and erroring out.

Thanks,
Jon

> 
> Cheers,
> 
> -Mikko
> 
> > Thanks,
> > Jon
> > 
> > > ---
> > >  ...ot.c-ignore-TPM-error-and-continue-w.patch | 36 +++++++++++++++++++
> > >  .../trusted-firmware-a_2.10.3.bb              |  5 +++
> > >  2 files changed, 41 insertions(+)
> > >  create mode 100644 meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch
> > > 
> > > diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch b/meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch
> > > new file mode 100644
> > > index 00000000..2d189d8e
> > > --- /dev/null
> > > +++ b/meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch
> > > @@ -0,0 +1,36 @@
> > > +From 1d1425bde8435d6e2b3e4f2b7bcb2eb293ef9601 Mon Sep 17 00:00:00 2001
> > > +From: Mikko Rapeli <mikko.rapeli@linaro.org>
> > > +Date: Mon, 15 Jan 2024 09:26:56 +0000
> > > +Subject: [PATCH] qemu_measured_boot.c: ignore TPM error and continue with boot
> > > +
> > > +If firmware is configured with TPM support but it's missing
> > > +on HW, e.g. swtpm not started and/or configured with qemu,
> > > +then continue booting. Missing TPM is not a fatal error.
> > > +Enables testing boot without TPM device to see that
> > > +missing TPM is detected further up the SW stack and correct
> > > +fallback actions are taken.
> > > +
> > > +Upstream-Status: Pending
> > > +
> > > +Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
> > > +---
> > > + plat/qemu/qemu/qemu_measured_boot.c | 3 ++-
> > > + 1 file changed, 2 insertions(+), 1 deletion(-)
> > > +
> > > +diff --git a/plat/qemu/qemu/qemu_measured_boot.c b/plat/qemu/qemu/qemu_measured_boot.c
> > > +index 122bb23b14..731b081c47 100644
> > > +--- a/plat/qemu/qemu/qemu_measured_boot.c
> > > ++++ b/plat/qemu/qemu/qemu_measured_boot.c
> > > +@@ -79,7 +79,8 @@ void bl2_plat_mboot_finish(void)
> > > + 		 * Note: In QEMU platform, OP-TEE uses nt_fw_config to get the
> > > + 		 * secure Event Log buffer address.
> > > + 		 */
> > > +-		panic();
> > > ++		ERROR("Ignoring TPM errors, continuing without\n");
> > > ++		return;
> > > + 	}
> > > + 
> > > + 	/* Copy Event Log to Non-secure memory */
> > > +-- 
> > > +2.34.1
> > > +
> > > diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
> > > index b30ac725..13942dbb 100644
> > > --- a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
> > > +++ b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
> > > @@ -11,3 +11,8 @@ SRC_URI_MBEDTLS = "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=ht
> > >  SRCREV_mbedtls = "72718dd87e087215ce9155a826ee5a66cfbe9631"
> > >  
> > >  LIC_FILES_CHKSUM_MBEDTLS = "file://mbedtls/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
> > > +
> > > +# continue to boot also without TPM
> > > +SRC_URI += "\
> > > +    file://0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch \
> > > +"
> > > -- 
> > > 2.34.1
> > > 
> > > 
>
Mikko Rapeli April 24, 2024, 6:37 a.m. UTC | #4 
Hi,

On Tue, Apr 23, 2024 at 02:21:12PM -0400, Jon Mason wrote:
> On Mon, Apr 22, 2024 at 10:29:01AM +0300, Mikko Rapeli wrote:
> > Hi,
> > 
> > On Sat, Apr 20, 2024 at 06:40:54PM -0400, Jon Mason wrote:
> > > On Wed, Apr 17, 2024 at 02:07:21PM +0300, Mikko Rapeli wrote:
> > > > All other firmware boot components also continue booting
> > > > if TPM is not found. It is up to subsequent SW components
> > > > to e.g. fail if rootfs can't be decrypted. Enables policies
> > > > like fall back to unencrypted rootfs if TPM device is
> > > > not found with qemu and swtpm.
> > > > 
> > > > Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
> > > 
> > > This series is failing on all instances of qemuarm64-secureboot and
> > > qemuarm-secureboot.  You can see it on my gitlab CI at:
> > > https://gitlab.com/jonmason00/meta-arm/-/pipelines/1261200728
> > > 
> > > All of them appear to be due to detecting the following error (snipped
> > > from the dmesg of the errorlog):
> > > optee-ftpm optee-ta-bc50d971-d4c9-42c4-82cb-343fb7f37896: ftpm_tee_probe: tee_client_open_session failed, err=ffff3024
> > > optee-ftpm: probe of optee-ta-bc50d971-d4c9-42c4-82cb-343fb7f37896 failed with error -22
> > 
> > Bummer, checking what I missed here.
> > 
> > Did optee-test/xtest run and possibly pass despite of this? I don't see this from the logs.
> 
> optee-test is only being compiled, not being run as part of CI
> (patches very much wanted and welcomed).  So, nothing exciting here
> except the kernel trying to load the modules and erroring out.

Ok. I managed to reproduce this issue and also saw that optee-test xtest was
failing on the core-image-base. The image needs

IMAGE_INSTALL:append = " optee-client optee-os-ta optee-test"

and then optee-test/xtest passes. So optee itself is working and fine.

What exact config and commands does the CI job run? I could provide
the patches for optee-test/xtest.

Looking into the ftpm kernel error now...

Cheers,

-Mikko
diff mbox series

Patch

diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch b/meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch
new file mode 100644
index 00000000..2d189d8e
--- /dev/null
+++ b/meta-arm/recipes-bsp/trusted-firmware-a/files/0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch
@@ -0,0 +1,36 @@ 
+From 1d1425bde8435d6e2b3e4f2b7bcb2eb293ef9601 Mon Sep 17 00:00:00 2001
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+Date: Mon, 15 Jan 2024 09:26:56 +0000
+Subject: [PATCH] qemu_measured_boot.c: ignore TPM error and continue with boot
+
+If firmware is configured with TPM support but it's missing
+on HW, e.g. swtpm not started and/or configured with qemu,
+then continue booting. Missing TPM is not a fatal error.
+Enables testing boot without TPM device to see that
+missing TPM is detected further up the SW stack and correct
+fallback actions are taken.
+
+Upstream-Status: Pending
+
+Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+---
+ plat/qemu/qemu/qemu_measured_boot.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/plat/qemu/qemu/qemu_measured_boot.c b/plat/qemu/qemu/qemu_measured_boot.c
+index 122bb23b14..731b081c47 100644
+--- a/plat/qemu/qemu/qemu_measured_boot.c
++++ b/plat/qemu/qemu/qemu_measured_boot.c
+@@ -79,7 +79,8 @@ void bl2_plat_mboot_finish(void)
+ 		 * Note: In QEMU platform, OP-TEE uses nt_fw_config to get the
+ 		 * secure Event Log buffer address.
+ 		 */
+-		panic();
++		ERROR("Ignoring TPM errors, continuing without\n");
++		return;
+ 	}
+ 
+ 	/* Copy Event Log to Non-secure memory */
+-- 
+2.34.1
+
diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
index b30ac725..13942dbb 100644
--- a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
+++ b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
@@ -11,3 +11,8 @@  SRC_URI_MBEDTLS = "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=ht
 SRCREV_mbedtls = "72718dd87e087215ce9155a826ee5a66cfbe9631"
 
 LIC_FILES_CHKSUM_MBEDTLS = "file://mbedtls/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
+
+# continue to boot also without TPM
+SRC_URI += "\
+    file://0001-qemu_measured_boot.c-ignore-TPM-error-and-continue-w.patch \
+"