Re: [yocto-patches] [PATCH meta-rockchip 2/2] add support for baking OP-TEE OS into U-Boot proper binary

[Trevor Woerner <twoerner@gmail.com>]

On Thu 2026-05-28 @ 10:48:24 AM, Quentin Schulz via lists.yoctoproject.org wrote:
> Hi Trevor,
> 
> On 5/27/26 5:30 PM, Trevor Woerner via lists.yoctoproject.org wrote:
> > Hi Quentin,
> > 
> > Thanks for this patch series!
> > 
> 
> Thanks for the review!
> 
> > I believe there was a little fuzz required to apply patch 1 (around the
> > -D), perhaps a v2 against the current to clean that up?
> > 
> 
> I'm assuming due to commit 9fb264d42a20 ("bsp: fix upstream TF-A deploy
> desync") already being merged.

Yes, I think so.

> > On Mon 2026-01-26 @ 03:48:30 PM, Quentin Schulz via lists.yoctoproject.org wrote:
> [...]
> > > diff --git a/README b/README
> > > index c2697d1..f49fdb5 100644
> > > --- a/README
> > > +++ b/README
> > > @@ -222,6 +222,48 @@ Notes:
> > >   	NOTE: this variable must be set before any include/require in the
> > >   	      machine configuration file
> > > +  OP-TEE
> > > +
> > > +	PX30, RK3399 and RK3588 are all supported by upstream OP-TEE OS. By
> > > +	default, OP-TEE OS is not baked into U-Boot.
> > > +
> > > +	You can bake OP-TEE OS in U-Boot by setting:
> > > +
> > > +		RK_UBOOT_TEE = "1"
> > 
> > Is it worth pointing out this is a boolean so any of
> > "1"/"y"/"yes"/"true" or "0"/"n"/"no"/"false" will work?
> > 
> 
> Not sure it's worth the added complexity? We also don't say that for
> RK_IMAGE_INCLUDES_UBOOT_ENV, RK_RAUC_DEMO, RK_KERNEL_FITIMAGE,
> RK_OVERLAY_DEMO but we word it differently for them.
> 
> Would,
> 
> You can bake OP-TEE OS in U-Boot by enabling the RK_UBOOT_TEE variable
> boolean.
> 
> work for you?

Sounds great!

> [...]
> > > diff --git a/recipes-security/optee/optee-os_%.bbappend b/recipes-security/optee/optee-os_%.bbappend
> > > new file mode 100644
> > > index 0000000..2a5ec8b
> > > --- /dev/null
> > > +++ b/recipes-security/optee/optee-os_%.bbappend
> > > @@ -0,0 +1,19 @@
> > > +# Increase size for FDT in OP-TEE OS to the one in TF-A since v2.13 to avoid
> > > +# panics on 64+KiB FDT passed by U-Boot to TF-A to OP-TEE OS.
> > > +# Can be removed once https://github.com/OP-TEE/optee_os/pull/7687 is merged.
> > > +EXTRA_OEMAKE:append:rockchip:aarch64 = " CFG_DTB_MAX_SIZE=0x60000"
> > > +
> > > +# Disable early console by default to avoid OP-TEE OS panicking on boards with
> > > +# their UART console different from OP-TEE OS default (UART2 for rk322x, rk3399
> > > +# and rk3588(s)).
> > > +# In-tree default changes if https://github.com/OP-TEE/optee_os/pull/7688 merged
> > > +OPTEE_OS_EARLY_CONSOLE ?= "n"
> > > +EXTRA_OEMAKE:append:rockchip = " CFG_EARLY_CONSOLE=${OPTEE_OS_EARLY_CONSOLE}"
> > > +
> > > +# Enable hardware acceleration using Arm Cryptography Extensions on PX30.
> > > +# Can be removed once https://github.com/OP-TEE/optee_os/pull/7689 is merged.
> > 
> > Have these 3 merges occurred yet?
> > 
> 
> Yes.
> 
> b6c7291c246b ("plat-rockchip: increase FDT max size to 384KiB on all Aarch64
> supported SoCs")
> 763be3b08c16 ("plat-rockchip: disable early console by default")
> 74eb4d9ed3ac ("plat-rockchip: px30: set CFG_CRYPTO_WITH_CE ?= y")
> 
> All available in 4.10.0. However, meta-arm currently is still at 4.9.0. I
> don't see patches on their ML
> (https://lore.kernel.org/yocto-meta-arm/?q=op-tee) for a version bump so we
> need to keep those in for now.
> 
> I guess I can change the comment to say we need to keep this until 4.10.0?

Please do.

> At the same time, it shouldn't hurt keeping them in even in 4.10.0 or later.

Okay.

> Cheers,
> Quentin
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#4082): https://lists.yoctoproject.org/g/yocto-patches/message/4082
> Mute This Topic: https://lists.yoctoproject.org/mt/117469183/900817
> Group Owner: yocto-patches+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/yocto-patches/leave/13168745/900817/63955952/xyzzy [twoerner@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
> 
>