[PATCH v2 0/3] mach-snapdragon: Enable OP-TEE support

[PATCH v2 0/3] mach-snapdragon: Enable OP-TEE support

[Sumit Garg]

From: Sumit Garg <sumit.garg@oss.qualcomm.com>

Introduce TF-A and OP-TEE config fragment
    
Recently upstream TF-A/OP-TEE has started gaining support for Qcom
platforms. RB3Gen2 being the first one and more to come. U-Boot in
corresponding boot flow is packaged as a position independent executable.
    
So, lets add a generic U-Boot config fragment for Qcom platforms to
support TF-A/OP-TEE based TrustZone stack. Build command:
    
$ ./scripts/kconfig/merge_config.sh \
       configs/qcom_defconfig \
       board/qualcomm/tfa-optee.config
$ make -j`nproc` DEVICE_TREE=qcom/qcs6490-rb3gen2

---
Changes in v2:
- Add new patch #1 to export OP-TEE message UID check API
- Use OP-TEE message UID check API in order to perform the DT fixup for
  OP-TEE.
- Switch from new defconfig to a config fragment instead.

Sumit Garg (3):
  tee: optee: Export OP-TEE message UID check API
  mach-snapdragon: of_fixup: Add OP-TEE DT fixup support
  board/qualcomm: Introduce TF-A and OP-TEE config fragment

 arch/arm/mach-snapdragon/of_fixup.c | 35 +++++++++++++++++++++++++++++
 board/qualcomm/tfa-optee.config     |  4 ++++
 drivers/tee/optee/core.c            |  5 +++++
 include/tee/optee.h                 |  9 ++++++++
 4 files changed, 53 insertions(+)
 create mode 100644 board/qualcomm/tfa-optee.config

-- 
2.51.0

[PATCH v2 1/3] tee: optee: Export OP-TEE message UID check API

[Sumit Garg]

From: Sumit Garg <sumit.garg@oss.qualcomm.com>

OP-TEE message UID check API can be useful to know whether OP-TEE
is enabled on not assuming the corresponding SMC call is properly
handled if OP-TEE is not supported.

This API can be used by platform code to know OP-TEE presence and
on that basis OP-TEE DT node can be added as part of DT fixups for
the OP-TEE driver probe to happen for both U-Boot and Linux.

Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
 drivers/tee/optee/core.c | 5 +++++
 include/tee/optee.h      | 9 +++++++++
 2 files changed, 14 insertions(+)

diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
index 5fc0505c788..4d67c948ec1 100644
--- a/drivers/tee/optee/core.c
+++ b/drivers/tee/optee/core.c
@@ -795,6 +795,11 @@ static optee_invoke_fn *get_invoke_func(struct udevice *dev)
 	return ERR_PTR(-EINVAL);
 }
 
+bool is_optee_smc_api(void)
+{
+	return is_optee_api(optee_smccc_smc);
+}
+
 static int optee_of_to_plat(struct udevice *dev)
 {
 	struct optee_pdata *pdata = dev_get_plat(dev);
diff --git a/include/tee/optee.h b/include/tee/optee.h
index 77729450bb6..d1194493780 100644
--- a/include/tee/optee.h
+++ b/include/tee/optee.h
@@ -65,4 +65,13 @@ static inline int optee_copy_fdt_nodes(void *new_blob)
 }
 #endif
 
+#if defined(CONFIG_OPTEE)
+bool is_optee_smc_api(void);
+#else
+static inline bool is_optee_smc_api(void)
+{
+	return false;
+}
+#endif
+
 #endif /* _OPTEE_H */
-- 
2.51.0

[PATCH v2 2/3] mach-snapdragon: of_fixup: Add OP-TEE DT fixup support

[Sumit Garg]

From: Sumit Garg <sumit.garg@oss.qualcomm.com>

Add support for OP-TEE live tree DT fixup support which enables U-Boot
OP-TEE driver to be probed. As well as the EFI DT fixup protocol allows
the live tree fixup to be carried over to the OS for the OP-TEE driver
in the OS to probe as well.

Note that this fixup only gets applied if OP-TEE support is detected via
checking for OP-TEE message UID.

Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
 arch/arm/mach-snapdragon/of_fixup.c | 35 +++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/arch/arm/mach-snapdragon/of_fixup.c b/arch/arm/mach-snapdragon/of_fixup.c
index 5b6076ea8e5..3d19449f133 100644
--- a/arch/arm/mach-snapdragon/of_fixup.c
+++ b/arch/arm/mach-snapdragon/of_fixup.c
@@ -25,6 +25,7 @@
 #include <fdt_support.h>
 #include <linux/errno.h>
 #include <stdlib.h>
+#include <tee/optee.h>
 #include <time.h>
 
 /* U-Boot only supports USB high-speed mode on Qualcomm platforms with DWC3
@@ -164,6 +165,37 @@ static void fixup_power_domains(struct device_node *root)
 	}
 }
 
+static void add_optee_node(struct device_node *root)
+{
+	struct device_node *fw = NULL, *optee = NULL;
+	int ret;
+
+	fw = of_find_node_by_path("/firmware");
+	if (!fw) {
+		log_err("Failed to find /firmware node\n");
+		return;
+	}
+
+	ret = of_add_subnode(fw, "optee", strlen("optee") + 1, &optee);
+	if (ret) {
+		log_err("Failed to add 'maximum-speed' property: %d\n", ret);
+		return;
+	}
+
+	ret = of_write_prop(optee, "compatible", strlen("linaro,optee-tz") + 1,
+			    "linaro,optee-tz");
+	if (ret) {
+		log_err("Failed to optee 'compatible' property: %d\n", ret);
+		return;
+	}
+
+	ret = of_write_prop(optee, "method", strlen("smc") + 1, "smc");
+	if (ret) {
+		log_err("Failed to optee 'method' property: %d\n", ret);
+		return;
+	}
+}
+
 #define time_call(func, ...) \
 	do { \
 		u64 start = timer_get_us(); \
@@ -178,6 +210,9 @@ static int qcom_of_fixup_nodes(void * __maybe_unused ctx, struct event *event)
 	time_call(fixup_usb_nodes, root);
 	time_call(fixup_power_domains, root);
 
+	if (is_optee_smc_api())
+		time_call(add_optee_node, root);
+
 	return 0;
 }
 
-- 
2.51.0

Re: [PATCH v2 2/3] mach-snapdragon: of_fixup: Add OP-TEE DT fixup support

[Varadarajan Narayanan]

On Thu, Jan 22, 2026 at 02:28:05PM +0530, Sumit Garg wrote:
> From: Sumit Garg <sumit.garg@oss.qualcomm.com>
>
> Add support for OP-TEE live tree DT fixup support which enables U-Boot
> OP-TEE driver to be probed. As well as the EFI DT fixup protocol allows
> the live tree fixup to be carried over to the OS for the OP-TEE driver
> in the OS to probe as well.
>
> Note that this fixup only gets applied if OP-TEE support is detected via
> checking for OP-TEE message UID.
>
> Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> ---
>  arch/arm/mach-snapdragon/of_fixup.c | 35 +++++++++++++++++++++++++++++
>  1 file changed, 35 insertions(+)
>
> diff --git a/arch/arm/mach-snapdragon/of_fixup.c b/arch/arm/mach-snapdragon/of_fixup.c
> index 5b6076ea8e5..3d19449f133 100644
> --- a/arch/arm/mach-snapdragon/of_fixup.c
> +++ b/arch/arm/mach-snapdragon/of_fixup.c
> @@ -25,6 +25,7 @@
>  #include <fdt_support.h>
>  #include <linux/errno.h>
>  #include <stdlib.h>
> +#include <tee/optee.h>
>  #include <time.h>
>
>  /* U-Boot only supports USB high-speed mode on Qualcomm platforms with DWC3
> @@ -164,6 +165,37 @@ static void fixup_power_domains(struct device_node *root)
>  	}
>  }
>
> +static void add_optee_node(struct device_node *root)
> +{
> +	struct device_node *fw = NULL, *optee = NULL;
> +	int ret;
> +
> +	fw = of_find_node_by_path("/firmware");
> +	if (!fw) {
> +		log_err("Failed to find /firmware node\n");
> +		return;
> +	}
> +
> +	ret = of_add_subnode(fw, "optee", strlen("optee") + 1, &optee);
> +	if (ret) {
> +		log_err("Failed to add 'maximum-speed' property: %d\n", ret);

Failed to add 'optee' subnode??

> +		return;
> +	}
> +
> +	ret = of_write_prop(optee, "compatible", strlen("linaro,optee-tz") + 1,
> +			    "linaro,optee-tz");
> +	if (ret) {
> +		log_err("Failed to optee 'compatible' property: %d\n", ret);

s/to optee/to add/

> +		return;
> +	}
> +
> +	ret = of_write_prop(optee, "method", strlen("smc") + 1, "smc");
> +	if (ret) {
> +		log_err("Failed to optee 'method' property: %d\n", ret);

s/to optee/to add/

> +		return;
> +	}
> +}

Not sure if add_optee_node() should be wrapped within #ifdef CONFIG_OPTEE,
due to size concerns.

-Varada

> +
>  #define time_call(func, ...) \
>  	do { \
>  		u64 start = timer_get_us(); \
> @@ -178,6 +210,9 @@ static int qcom_of_fixup_nodes(void * __maybe_unused ctx, struct event *event)
>  	time_call(fixup_usb_nodes, root);
>  	time_call(fixup_power_domains, root);
>
> +	if (is_optee_smc_api())
> +		time_call(add_optee_node, root);
> +
>  	return 0;
>  }
>
> --
> 2.51.0
>

Re: [PATCH v2 2/3] mach-snapdragon: of_fixup: Add OP-TEE DT fixup support

[Sumit Garg]

On Fri, Jan 23, 2026 at 10:21:35AM +0530, Varadarajan Narayanan wrote:
> On Thu, Jan 22, 2026 at 02:28:05PM +0530, Sumit Garg wrote:
> > From: Sumit Garg <sumit.garg@oss.qualcomm.com>
> >
> > Add support for OP-TEE live tree DT fixup support which enables U-Boot
> > OP-TEE driver to be probed. As well as the EFI DT fixup protocol allows
> > the live tree fixup to be carried over to the OS for the OP-TEE driver
> > in the OS to probe as well.
> >
> > Note that this fixup only gets applied if OP-TEE support is detected via
> > checking for OP-TEE message UID.
> >
> > Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> > ---
> >  arch/arm/mach-snapdragon/of_fixup.c | 35 +++++++++++++++++++++++++++++
> >  1 file changed, 35 insertions(+)
> >
> > diff --git a/arch/arm/mach-snapdragon/of_fixup.c b/arch/arm/mach-snapdragon/of_fixup.c
> > index 5b6076ea8e5..3d19449f133 100644
> > --- a/arch/arm/mach-snapdragon/of_fixup.c
> > +++ b/arch/arm/mach-snapdragon/of_fixup.c
> > @@ -25,6 +25,7 @@
> >  #include <fdt_support.h>
> >  #include <linux/errno.h>
> >  #include <stdlib.h>
> > +#include <tee/optee.h>
> >  #include <time.h>
> >
> >  /* U-Boot only supports USB high-speed mode on Qualcomm platforms with DWC3
> > @@ -164,6 +165,37 @@ static void fixup_power_domains(struct device_node *root)
> >  	}
> >  }
> >
> > +static void add_optee_node(struct device_node *root)
> > +{
> > +	struct device_node *fw = NULL, *optee = NULL;
> > +	int ret;
> > +
> > +	fw = of_find_node_by_path("/firmware");
> > +	if (!fw) {
> > +		log_err("Failed to find /firmware node\n");
> > +		return;
> > +	}
> > +
> > +	ret = of_add_subnode(fw, "optee", strlen("optee") + 1, &optee);
> > +	if (ret) {
> > +		log_err("Failed to add 'maximum-speed' property: %d\n", ret);
> 
> Failed to add 'optee' subnode??

Ack

> 
> > +		return;
> > +	}
> > +
> > +	ret = of_write_prop(optee, "compatible", strlen("linaro,optee-tz") + 1,
> > +			    "linaro,optee-tz");
> > +	if (ret) {
> > +		log_err("Failed to optee 'compatible' property: %d\n", ret);
> 
> s/to optee/to add/
> 

Ack

> > +		return;
> > +	}
> > +
> > +	ret = of_write_prop(optee, "method", strlen("smc") + 1, "smc");
> > +	if (ret) {
> > +		log_err("Failed to optee 'method' property: %d\n", ret);
> 
> s/to optee/to add/
> 

Ack

> > +		return;
> > +	}
> > +}
> 
> Not sure if add_optee_node() should be wrapped within #ifdef CONFIG_OPTEE,
> due to size concerns.

Since on Qcom platforms we intend to support generic board code where we
don't have particular size contrains as of now, so it should be fine to
leave it as it is.

-Sumit

> 
> -Varada
> 
> > +
> >  #define time_call(func, ...) \
> >  	do { \
> >  		u64 start = timer_get_us(); \
> > @@ -178,6 +210,9 @@ static int qcom_of_fixup_nodes(void * __maybe_unused ctx, struct event *event)
> >  	time_call(fixup_usb_nodes, root);
> >  	time_call(fixup_power_domains, root);
> >
> > +	if (is_optee_smc_api())
> > +		time_call(add_optee_node, root);
> > +
> >  	return 0;
> >  }
> >
> > --
> > 2.51.0
> >

Re: [PATCH v2 2/3] mach-snapdragon: of_fixup: Add OP-TEE DT fixup support

[neil.armstrong]

On 1/22/26 09:58, Sumit Garg wrote:
> From: Sumit Garg <sumit.garg@oss.qualcomm.com>
> 
> Add support for OP-TEE live tree DT fixup support which enables U-Boot
> OP-TEE driver to be probed. As well as the EFI DT fixup protocol allows
> the live tree fixup to be carried over to the OS for the OP-TEE driver
> in the OS to probe as well.
> 
> Note that this fixup only gets applied if OP-TEE support is detected via
> checking for OP-TEE message UID.
> 
> Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> ---
>   arch/arm/mach-snapdragon/of_fixup.c | 35 +++++++++++++++++++++++++++++
>   1 file changed, 35 insertions(+)
> 
> diff --git a/arch/arm/mach-snapdragon/of_fixup.c b/arch/arm/mach-snapdragon/of_fixup.c
> index 5b6076ea8e5..3d19449f133 100644
> --- a/arch/arm/mach-snapdragon/of_fixup.c
> +++ b/arch/arm/mach-snapdragon/of_fixup.c
> @@ -25,6 +25,7 @@
>   #include <fdt_support.h>
>   #include <linux/errno.h>
>   #include <stdlib.h>
> +#include <tee/optee.h>
>   #include <time.h>
>   
>   /* U-Boot only supports USB high-speed mode on Qualcomm platforms with DWC3
> @@ -164,6 +165,37 @@ static void fixup_power_domains(struct device_node *root)
>   	}
>   }
>   
> +static void add_optee_node(struct device_node *root)
> +{
> +	struct device_node *fw = NULL, *optee = NULL;
> +	int ret;
> +
> +	fw = of_find_node_by_path("/firmware");
> +	if (!fw) {
> +		log_err("Failed to find /firmware node\n");
> +		return;
> +	}
> +
> +	ret = of_add_subnode(fw, "optee", strlen("optee") + 1, &optee);
> +	if (ret) {
> +		log_err("Failed to add 'maximum-speed' property: %d\n", ret);
> +		return;
> +	}
> +
> +	ret = of_write_prop(optee, "compatible", strlen("linaro,optee-tz") + 1,
> +			    "linaro,optee-tz");
> +	if (ret) {
> +		log_err("Failed to optee 'compatible' property: %d\n", ret);
> +		return;
> +	}
> +
> +	ret = of_write_prop(optee, "method", strlen("smc") + 1, "smc");
> +	if (ret) {
> +		log_err("Failed to optee 'method' property: %d\n", ret);
> +		return;
> +	}
> +}
> +
>   #define time_call(func, ...) \
>   	do { \
>   		u64 start = timer_get_us(); \
> @@ -178,6 +210,9 @@ static int qcom_of_fixup_nodes(void * __maybe_unused ctx, struct event *event)
>   	time_call(fixup_usb_nodes, root);
>   	time_call(fixup_power_domains, root);
>   
> +	if (is_optee_smc_api())
> +		time_call(add_optee_node, root);

Since is_optee_smc_api only returns false when CONFIG_OPTEE is disabled, the compiler should
drop this, but to help it optimize you should replace with:
	if (IS_ENABLED(CONFIG_OPTEE) && is_optee_smc_api())
		time_call(add_optee_node, root);

Thanks,
Neil

> +
>   	return 0;
>   }
>   

Re: [PATCH v2 2/3] mach-snapdragon: of_fixup: Add OP-TEE DT fixup support

[Sumit Garg]

On Fri, Jan 23, 2026 at 11:11:45AM +0100, neil.armstrong@linaro.org wrote:
> On 1/22/26 09:58, Sumit Garg wrote:
> > From: Sumit Garg <sumit.garg@oss.qualcomm.com>
> > 
> > Add support for OP-TEE live tree DT fixup support which enables U-Boot
> > OP-TEE driver to be probed. As well as the EFI DT fixup protocol allows
> > the live tree fixup to be carried over to the OS for the OP-TEE driver
> > in the OS to probe as well.
> > 
> > Note that this fixup only gets applied if OP-TEE support is detected via
> > checking for OP-TEE message UID.
> > 
> > Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> > ---
> >   arch/arm/mach-snapdragon/of_fixup.c | 35 +++++++++++++++++++++++++++++
> >   1 file changed, 35 insertions(+)
> > 
> > diff --git a/arch/arm/mach-snapdragon/of_fixup.c b/arch/arm/mach-snapdragon/of_fixup.c
> > index 5b6076ea8e5..3d19449f133 100644
> > --- a/arch/arm/mach-snapdragon/of_fixup.c
> > +++ b/arch/arm/mach-snapdragon/of_fixup.c
> > @@ -25,6 +25,7 @@
> >   #include <fdt_support.h>
> >   #include <linux/errno.h>
> >   #include <stdlib.h>
> > +#include <tee/optee.h>
> >   #include <time.h>
> >   /* U-Boot only supports USB high-speed mode on Qualcomm platforms with DWC3
> > @@ -164,6 +165,37 @@ static void fixup_power_domains(struct device_node *root)
> >   	}
> >   }
> > +static void add_optee_node(struct device_node *root)
> > +{
> > +	struct device_node *fw = NULL, *optee = NULL;
> > +	int ret;
> > +
> > +	fw = of_find_node_by_path("/firmware");
> > +	if (!fw) {
> > +		log_err("Failed to find /firmware node\n");
> > +		return;
> > +	}
> > +
> > +	ret = of_add_subnode(fw, "optee", strlen("optee") + 1, &optee);
> > +	if (ret) {
> > +		log_err("Failed to add 'maximum-speed' property: %d\n", ret);
> > +		return;
> > +	}
> > +
> > +	ret = of_write_prop(optee, "compatible", strlen("linaro,optee-tz") + 1,
> > +			    "linaro,optee-tz");
> > +	if (ret) {
> > +		log_err("Failed to optee 'compatible' property: %d\n", ret);
> > +		return;
> > +	}
> > +
> > +	ret = of_write_prop(optee, "method", strlen("smc") + 1, "smc");
> > +	if (ret) {
> > +		log_err("Failed to optee 'method' property: %d\n", ret);
> > +		return;
> > +	}
> > +}
> > +
> >   #define time_call(func, ...) \
> >   	do { \
> >   		u64 start = timer_get_us(); \
> > @@ -178,6 +210,9 @@ static int qcom_of_fixup_nodes(void * __maybe_unused ctx, struct event *event)
> >   	time_call(fixup_usb_nodes, root);
> >   	time_call(fixup_power_domains, root);
> > +	if (is_optee_smc_api())
> > +		time_call(add_optee_node, root);
> 
> Since is_optee_smc_api only returns false when CONFIG_OPTEE is disabled, the compiler should
> drop this, but to help it optimize you should replace with:
> 	if (IS_ENABLED(CONFIG_OPTEE) && is_optee_smc_api())
> 		time_call(add_optee_node, root);

Sure, I will do that for v3.

-Sumit

[PATCH v2 3/3] board/qualcomm: Introduce TF-A and OP-TEE config fragment

[Sumit Garg]

From: Sumit Garg <sumit.garg@oss.qualcomm.com>

Recently upstream TF-A/OP-TEE has started gaining support for Qcom
platforms. RB3Gen2 being the first one and more to come. U-Boot in
corresponding boot flow is packaged as a position independent executable.

So, lets add a generic U-Boot config fragment for Qcom platforms to
support TF-A/OP-TEE based TrustZone stack. Build command:

$ ./scripts/kconfig/merge_config.sh \
       configs/qcom_defconfig \
       board/qualcomm/tfa-optee.config
$ make -j`nproc` DEVICE_TREE=qcom/qcs6490-rb3gen2

For more information refer here:
https://trustedfirmware-a.readthedocs.io/en/latest/plat/qti/rb3gen2.html

Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
 board/qualcomm/tfa-optee.config | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 board/qualcomm/tfa-optee.config

diff --git a/board/qualcomm/tfa-optee.config b/board/qualcomm/tfa-optee.config
new file mode 100644
index 00000000000..1e8364c114f
--- /dev/null
+++ b/board/qualcomm/tfa-optee.config
@@ -0,0 +1,4 @@
+# Enables support for TF-A based OP-TEE as the open
+# source TrustZone stack on Qcom platforms
+CONFIG_TEE=y
+CONFIG_OPTEE=y
-- 
2.51.0