Re: [PATCH 2/5] arm: dts: st: Import optee node from u-boot device trees

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Fri Jul 10, 2026 at 5:39 PM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Missing `bootph-pre-ram` property in the newly added `optee@fe000000` reserved memory node for `stm32mp157c-ed1.dts`, which will cause U-Boot to strip the reservation during SPL and pre-relocation, leading to memory corruption.
> --
>
> --- Patch [2]: [PATCH 2/5] arm: dts: st: Import optee node from u-boot device trees ---
> commit e001824900768a597c1390aaf3fe0b9e2c46bdd1
> Author: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
>
> arm: dts: st: Import optee node from u-boot device trees
>
> U-Boot is importing kernel device trees for these platforms, but adding
> a firmware node to enable communication with OP-TEE. Importing
> changes here will allow to remove these additions in U-Boot.
>
> [ ... ]
>
>> diff --git a/arch/arm/boot/dts/st/stm32mp157c-ed1.dts b/arch/arm/boot/dts/st/stm32mp157c-ed1.dts
>> index 49dd555cc228c..7da7260350869 100644
>> --- a/arch/arm/boot/dts/st/stm32mp157c-ed1.dts
>> +++ b/arch/arm/boot/dts/st/stm32mp157c-ed1.dts
>> @@ -70,6 +70,18 @@ retram: retram@38000000 {
>>  			reg = <0x38000000 0x10000>;
>>  			no-map;
>>  		};
>> +
>> +		optee@fe000000 {
>> +			reg = <0xfe000000 0x02000000>;
>> +			no-map;
>> +		};
>
> [Severity: High]
> Does this optee reserved memory node also need the bootph-pre-ram property
> like the one added for stm32mp157a-dk1.dts?
>
> Without the bootph-pre-ram property, U-Boot's fdtgrep utility strips the
> optee reserved-memory node from the SPL and pre-relocation device trees.
>
> Because U-Boot typically relocates itself to the top of available RAM (which
> on this platform overlaps with 0xfe000000), omitting this reservation could
> allow U-Boot to allocate over OP-TEE's secure memory region, potentially
> causing data corruption or TrustZone violations.

I'm a bit torn on this point.

So first, this commit only imports existing code, so I was not planning
to modify the device tree. But looking at the docs, and the
stm32mp157a-dk1.dts file, I suspect bootph-pre-ram is also needed here.

I will probably add a separate commit, adding bootph-pre-ram tag.

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com