14:06 <rgolledge> Has anyone managaged to get optee trust solution working with mainline kernel? I have got signed spl, uboot, atf and fitimage but i can seem to get the rockchip atf to load the tee binary?

14:07 <qschulz> rgolledge: which SoC

14:08 <qschulz> mainline OP-TEE OS or ROckchip's blob?

14:09 <rgolledge> rk3566 with rockchips blob

14:12 <rgolledge> i could not get the opensource atf to build and produce BL31 and BL32 binaries, only ended up with lib files and struggled to find documentaion to help

14:13 <qschulz> rgolledge: you should be able to build upstream TF-A for RK3566 by using the RK3568 target

14:13 <qschulz> but I think it may still be half broken support

14:17 <qschulz> rgolledge: https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/31265 probably that

14:18 <qschulz> is it Rockchip's U-Boot fork or upstream U-Boot you're trying to use?

14:18 <qschulz> I don't think we support Rockchip's OP-TEE OS blob in upstream U-Boot

14:19 <rgolledge> upstream uboot

14:19 <CounterPillow> On RK3566/RK3568, optee with upstream u-boot/kernel is something where as far as I know you're the first to do it.

14:21 <rgolledge> everything working except i dont get the optee messages when the BL31 part is running and it says WARNING: No OPTEE provided .... before Uboot starts

14:22 <qschulz> CounterPillow: nah, some people started to work on it, c.f. https://github.com/OP-TEE/optee_os/pull/6954 and https://pretalx.com/media/ypdd-oss-elce-2024/submissions/9VBPNF/resources/Practical_Security_for_Embedded_Systems__p7PFTGm.pdf

14:25 <qschulz> rgolledge: did you set the env variable TEE to the path to the OP-TEE OS binary?

14:25 <qschulz> when building U-Boot?

14:26 <qschulz> but also, pretty sure this won't work, I don't think we support ROckchip's OP-TEE OS blob (using a different header/format from upstream IIRC)

14:27 <qschulz> CounterPillow: though the conclusion for now is "doesn't work quite well atm and Rockchip doesn't provide feedback" from what I understood

14:32 <rgolledge> I have had no luck getting support as rockchip uboot if failing to build using their scripts for rk3566 when secure boot is enabled. i have not even asked about mainlin stuff

14:35 <Kwiboo> rgolledge: long time ago I used something like https://github.com/Kwiboo/LibreELEC.tv/blob/work-in-progress-2020/packages/tools/rkbin/sources/tee.ld and https://github.com/Kwiboo/LibreELEC.tv/blob/work-in-progress-2020/packages/tools/rkbin/package.mk#L49-L50 to repackage bl32.bin to a elf format that mainline U-Boot can use for TEE= env, should probably still work

14:38 <rgolledge> qschulz: If i use the upstream uboot and add the TEE variable i get a binman failure as the tee file is a binfile not an elf. I use yocto to build the uboot.itb i had to grap some stuff from rockchips uboot to place the atf file in the correct place but that works now. I also have the tee file in the itb file and it is signed and loaded into ram but i have no idea how the atf loads it and

14:38 <rgolledge> where it should be

14:48 <rgolledge> Kwiboo: i will try that linker thing without yocto invvolved and see what happens

14:50 <rgolledge> Good news is customer is happy for me to push fixes back once finished.

15:53 <mmind00> qschulz: also looking at that optee PR, it seems someone has taken it upon themself to RE the needed DDR firewall parts

15:53 <mmind00> just stumbled upon that comment in there

15:54 <qschulz> yeah, but the phrasing seems to indicate this won't be made public unless someone wants to join efforts?

15:54 <mmind00> I'd also like to have that in TF-A

15:55 <qschulz> yeah I didn't want to volunteer someone :)

16:24 <Ermine> did rockchip also fork op-tee? geez

16:26 <qschulz> I believe that's how they setup Secure Boot, and everybody knows secure boot needs to be secret sauce

16:26 <qschulz> /s of course

16:34 <Ermine> they could mess with trusty instead, given that they ship android everywhere

16:39 <dsimic> it's actually Secret Boot :)

18:58 <diederik> CounterPillow: Can you help me convert https://lore.kernel.org/all/20250825-rk3588-10bpc-v2-5-955622d16985@collabora.com/ to "BYEWORD_UPDATE" ?

18:59 <CounterPillow> diederik: instead of `HIWORD_UPDATE(FIELD_PREP(`, write `FIELD_PREP_WM16(`

18:59 <diederik> That sounds doable, thanks!