Re: [yocto-patches] [PATCH meta-rockchip 2/2] add support for baking OP-TEE OS into U-Boot proper binary

Hi Trevor,

On 5/27/26 5:30 PM, Trevor Woerner via lists.yoctoproject.org wrote:
> Hi Quentin,
> 
> Thanks for this patch series!
> 

Thanks for the review!

> I believe there was a little fuzz required to apply patch 1 (around the
> -D), perhaps a v2 against the current to clean that up?
> 

I'm assuming due to commit 9fb264d42a20 ("bsp: fix upstream TF-A deploy 
desync") already being merged.

> On Mon 2026-01-26 @ 03:48:30 PM, Quentin Schulz via lists.yoctoproject.org wrote:
[...]
>> diff --git a/README b/README
>> index c2697d1..f49fdb5 100644
>> --- a/README
>> +++ b/README
>> @@ -222,6 +222,48 @@ Notes:
>>   	NOTE: this variable must be set before any include/require in the
>>   	      machine configuration file
>>   
>> +  OP-TEE
>> +
>> +	PX30, RK3399 and RK3588 are all supported by upstream OP-TEE OS. By
>> +	default, OP-TEE OS is not baked into U-Boot.
>> +
>> +	You can bake OP-TEE OS in U-Boot by setting:
>> +
>> +		RK_UBOOT_TEE = "1"
> 
> Is it worth pointing out this is a boolean so any of
> "1"/"y"/"yes"/"true" or "0"/"n"/"no"/"false" will work?
> 

Not sure it's worth the added complexity? We also don't say that for 
RK_IMAGE_INCLUDES_UBOOT_ENV, RK_RAUC_DEMO, RK_KERNEL_FITIMAGE, 
RK_OVERLAY_DEMO but we word it differently for them.

Would,

You can bake OP-TEE OS in U-Boot by enabling the RK_UBOOT_TEE variable 
boolean.

work for you?

[...]
>> diff --git a/recipes-security/optee/optee-os_%.bbappend b/recipes-security/optee/optee-os_%.bbappend
>> new file mode 100644
>> index 0000000..2a5ec8b
>> --- /dev/null
>> +++ b/recipes-security/optee/optee-os_%.bbappend
>> @@ -0,0 +1,19 @@
>> +# Increase size for FDT in OP-TEE OS to the one in TF-A since v2.13 to avoid
>> +# panics on 64+KiB FDT passed by U-Boot to TF-A to OP-TEE OS.
>> +# Can be removed once https://github.com/OP-TEE/optee_os/pull/7687 is merged.
>> +EXTRA_OEMAKE:append:rockchip:aarch64 = " CFG_DTB_MAX_SIZE=0x60000"
>> +
>> +# Disable early console by default to avoid OP-TEE OS panicking on boards with
>> +# their UART console different from OP-TEE OS default (UART2 for rk322x, rk3399
>> +# and rk3588(s)).
>> +# In-tree default changes if https://github.com/OP-TEE/optee_os/pull/7688 merged
>> +OPTEE_OS_EARLY_CONSOLE ?= "n"
>> +EXTRA_OEMAKE:append:rockchip = " CFG_EARLY_CONSOLE=${OPTEE_OS_EARLY_CONSOLE}"
>> +
>> +# Enable hardware acceleration using Arm Cryptography Extensions on PX30.
>> +# Can be removed once https://github.com/OP-TEE/optee_os/pull/7689 is merged.
> 
> Have these 3 merges occurred yet?
> 

Yes.

b6c7291c246b ("plat-rockchip: increase FDT max size to 384KiB on all 
Aarch64 supported SoCs")
763be3b08c16 ("plat-rockchip: disable early console by default")
74eb4d9ed3ac ("plat-rockchip: px30: set CFG_CRYPTO_WITH_CE ?= y")

All available in 4.10.0. However, meta-arm currently is still at 4.9.0. 
I don't see patches on their ML 
(https://lore.kernel.org/yocto-meta-arm/?q=op-tee) for a version bump so 
we need to keep those in for now.

I guess I can change the comment to say we need to keep this until 
4.10.0? At the same time, it shouldn't hurt keeping them in even in 
4.10.0 or later.

Cheers,
Quentin