Re: [yocto-patches] [PATCH meta-rockchip 2/2] add support for baking OP-TEE OS into U-Boot proper binary

Hi Trevor,

On 7/6/26 12:29 AM, Trevor Woerner via lists.yoctoproject.org wrote:
> It looks like I forgot to add you, Quentin, to the "to:" or "cc:" for
> this reply. Are you working on a v2?
> 

I saw the mail, no worries but I appreciate the follow-up! I have a 
local branch but I'm lacking time to test at the moment (images built, 
waiting for me to boot them and type `xtest`). Hopefully I find some 
time before end of the week but no promise.

(FYI, there's also an NPU series for meta-rockchip that never got a 
review, so if you're looking for something to keep you busy: 
https://lore.kernel.org/yocto-patches/[email protected]/ 
(don't know if it still applies cleanly or still works))

> On Thu 2026-06-04 @ 03:40:35 PM, Trevor Woerner via lists.yoctoproject.org wrote:
>> On Thu 2026-05-28 @ 10:48:24 AM, Quentin Schulz via lists.yoctoproject.org wrote:
>>> Hi Trevor,
>>>
>>> On 5/27/26 5:30 PM, Trevor Woerner via lists.yoctoproject.org wrote:
>>>> Hi Quentin,
>>>>
>>>> Thanks for this patch series!
>>>>
>>>
>>> Thanks for the review!
>>>
>>>> I believe there was a little fuzz required to apply patch 1 (around the
>>>> -D), perhaps a v2 against the current to clean that up?
>>>>
>>>
>>> I'm assuming due to commit 9fb264d42a20 ("bsp: fix upstream TF-A deploy
>>> desync") already being merged.
>>
>> Yes, I think so.
>>
>>>> On Mon 2026-01-26 @ 03:48:30 PM, Quentin Schulz via lists.yoctoproject.org wrote:
>>> [...]
>>>>> diff --git a/README b/README
>>>>> index c2697d1..f49fdb5 100644
>>>>> --- a/README
>>>>> +++ b/README
>>>>> @@ -222,6 +222,48 @@ Notes:
>>>>>    	NOTE: this variable must be set before any include/require in the
>>>>>    	      machine configuration file
>>>>> +  OP-TEE
>>>>> +
>>>>> +	PX30, RK3399 and RK3588 are all supported by upstream OP-TEE OS. By
>>>>> +	default, OP-TEE OS is not baked into U-Boot.
>>>>> +
>>>>> +	You can bake OP-TEE OS in U-Boot by setting:
>>>>> +
>>>>> +		RK_UBOOT_TEE = "1"
>>>>
>>>> Is it worth pointing out this is a boolean so any of
>>>> "1"/"y"/"yes"/"true" or "0"/"n"/"no"/"false" will work?
>>>>
>>>
>>> Not sure it's worth the added complexity? We also don't say that for
>>> RK_IMAGE_INCLUDES_UBOOT_ENV, RK_RAUC_DEMO, RK_KERNEL_FITIMAGE,
>>> RK_OVERLAY_DEMO but we word it differently for them.
>>>
>>> Would,
>>>
>>> You can bake OP-TEE OS in U-Boot by enabling the RK_UBOOT_TEE variable
>>> boolean.
>>>
>>> work for you?
>>
>> Sounds great!
>>
>>> [...]
>>>>> diff --git a/recipes-security/optee/optee-os_%.bbappend b/recipes-security/optee/optee-os_%.bbappend
>>>>> new file mode 100644
>>>>> index 0000000..2a5ec8b
>>>>> --- /dev/null
>>>>> +++ b/recipes-security/optee/optee-os_%.bbappend
>>>>> @@ -0,0 +1,19 @@
>>>>> +# Increase size for FDT in OP-TEE OS to the one in TF-A since v2.13 to avoid
>>>>> +# panics on 64+KiB FDT passed by U-Boot to TF-A to OP-TEE OS.
>>>>> +# Can be removed once https://github.com/OP-TEE/optee_os/pull/7687 is merged.
>>>>> +EXTRA_OEMAKE:append:rockchip:aarch64 = " CFG_DTB_MAX_SIZE=0x60000"
>>>>> +
>>>>> +# Disable early console by default to avoid OP-TEE OS panicking on boards with
>>>>> +# their UART console different from OP-TEE OS default (UART2 for rk322x, rk3399
>>>>> +# and rk3588(s)).
>>>>> +# In-tree default changes if https://github.com/OP-TEE/optee_os/pull/7688 merged
>>>>> +OPTEE_OS_EARLY_CONSOLE ?= "n"
>>>>> +EXTRA_OEMAKE:append:rockchip = " CFG_EARLY_CONSOLE=${OPTEE_OS_EARLY_CONSOLE}"
>>>>> +
>>>>> +# Enable hardware acceleration using Arm Cryptography Extensions on PX30.
>>>>> +# Can be removed once https://github.com/OP-TEE/optee_os/pull/7689 is merged.
>>>>
>>>> Have these 3 merges occurred yet?
>>>>
>>>
>>> Yes.
>>>
>>> b6c7291c246b ("plat-rockchip: increase FDT max size to 384KiB on all Aarch64
>>> supported SoCs")
>>> 763be3b08c16 ("plat-rockchip: disable early console by default")
>>> 74eb4d9ed3ac ("plat-rockchip: px30: set CFG_CRYPTO_WITH_CE ?= y")
>>>
>>> All available in 4.10.0. However, meta-arm currently is still at 4.9.0. I
>>> don't see patches on their ML
>>> (https://lore.kernel.org/yocto-meta-arm/?q=op-tee) for a version bump so we
>>> need to keep those in for now.
>>>
>>> I guess I can change the comment to say we need to keep this until 4.10.0?
>>
>> Please do.
>>
>>> At the same time, it shouldn't hurt keeping them in even in 4.10.0 or later.
>>
>> Okay.
>>
>>> Cheers,
>>> Quentin
>>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>
>>
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#4419): https://lists.yoctoproject.org/g/yocto-patches/message/4419
> Mute This Topic: https://lists.yoctoproject.org/mt/117469183/6293953
> Group Owner: [email protected]
> Unsubscribe: https://lists.yoctoproject.org/g/yocto-patches/leave/13168703/6293953/1843281461/xyzzy [[email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
> 
>