From 307d7a4708deab3e32f761dc7bd6b7380a7f0929 Mon Sep 17 00:00:00 2001 From: Royyan Zahir Date: Tue, 4 Aug 2026 12:46:21 +0400 Subject: [PATCH 01/10] trusted-firmware-a-qcom: fetch qc_blobs only for qcm6490 coreboot/qc_blobs carries only the sc7280 qtiseclib that qcm6490 links into BL31, yet every machine building this recipe fetches the whole repository. Append the qc_blobs entry to SRC_URI for qcm6490 only, so machines that do not consume the blob do not fetch it. Suggested-by: Jose Quaresma Signed-off-by: Royyan Zahir (cherry picked from commit af9c2a81e55be6f7d967c9539537aecf06250d91) Signed-off-by: Dmitry Baryshkov --- .../recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc index 3ab315500..40d49ee57 100644 --- a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc +++ b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc @@ -1,6 +1,6 @@ DEPENDS += "qtestsign-native optee-os-qcom u-boot-qcom" -SRC_URI += "git://github.com/coreboot/qc_blobs.git;protocol=https;name=qc_blobs;subdir=qc_blobs;branch=main" +SRC_URI:append:qcm6490 = " git://github.com/coreboot/qc_blobs.git;protocol=https;name=qc_blobs;subdir=qc_blobs;branch=main" SRCREV_qc_blobs = "16207f367ddbf280a0c2c8a3d3ee454a59710a25" LICENSE += "& LICENSE.qcom" From ddfe2347f36753b774b4808623d270736c651951 Mon Sep 17 00:00:00 2001 From: Royyan Zahir Date: Tue, 4 Aug 2026 12:46:21 +0400 Subject: [PATCH 02/10] trusted-firmware-a-qcom: add qc-blobs to SRCREV_FORMAT The underscore is the separator in SRCREV_FORMAT, so an SCM named qc_blobs cannot be referenced as a format component and its revision is left out of the format, and with it out of the task hash. Rename the SCM to qc-blobs and accumulate per-machine components in SRCREV_FORMAT_qcom, so the blob revision takes part in the task hash on the machines that fetch it. Suggested-by: Jose Quaresma Signed-off-by: Royyan Zahir (cherry picked from commit d0132eccdbfee232bfb6d80d2028c961fd875ea5) Signed-off-by: Dmitry Baryshkov --- .../trusted-firmware-a/trusted-firmware-a-qcom.inc | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc index 40d49ee57..e85b8e63b 100644 --- a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc +++ b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc @@ -1,7 +1,12 @@ DEPENDS += "qtestsign-native optee-os-qcom u-boot-qcom" -SRC_URI:append:qcm6490 = " git://github.com/coreboot/qc_blobs.git;protocol=https;name=qc_blobs;subdir=qc_blobs;branch=main" -SRCREV_qc_blobs = "16207f367ddbf280a0c2c8a3d3ee454a59710a25" +SRCREV_FORMAT_qcom ?= "" + +SRC_URI:append:qcm6490 = " git://github.com/coreboot/qc_blobs.git;protocol=https;name=qc-blobs;subdir=qc_blobs;branch=main" +SRCREV_qc-blobs = "16207f367ddbf280a0c2c8a3d3ee454a59710a25" +SRCREV_FORMAT_qcom:qcm6490 = "_qc-blobs" + +SRCREV_FORMAT .= "${SRCREV_FORMAT_qcom}" LICENSE += "& LICENSE.qcom" LIC_FILES_CHKSUM:qcm6490 += "file://${UNPACKDIR}/qc_blobs/sc7280/qtiseclib/LICENSE;md5=fa83f30385e617b56ef0934f13645621" From 9e2e5ec69593fe175a2006f53357236a918b34f4 Mon Sep 17 00:00:00 2001 From: Royyan Zahir Date: Wed, 5 Aug 2026 10:56:09 +0400 Subject: [PATCH 03/10] trusted-firmware-a-qcom: upgrade qcom-next-2.14-20260507 -> qcom-next-2.15-20260804 The 2.14 tags predate the lemans platform drivers, so BL31 built from them is not functional on qcs9100, and the lemans qtiseclib blob is superseded work in progress. The native drivers landed with qcom-next-2.15-20260804. Upgrade all machines to that tag; lemans builds native, no qtiseclib. Signed-off-by: Royyan Zahir (cherry picked from commit 8047e1eaedb9ba7a4bc27f05bf2b24d576f410cd) Signed-off-by: Dmitry Baryshkov --- .../trusted-firmware-a/trusted-firmware-a-qcom_git.bb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom_git.bb b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom_git.bb index 894a93d0a..7a7fc4d1c 100644 --- a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom_git.bb +++ b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom_git.bb @@ -1,10 +1,10 @@ require recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc -PV = "2.14.0-qcom+git" +PV = "2.15.0-qcom+git" -SRC_TAG = "tag=qcom-next-2.14-20260507" +SRC_TAG = "tag=qcom-next-2.15-20260804" SRC_URI = "git://github.com/qualcomm-linux/trusted-firmware-a.git;protocol=https;name=tfa;nobranch=1;${SRC_TAG}" -SRCREV_tfa = "7336923157d8e55ec6e1111b111d6c1befdb1054" +SRCREV_tfa = "10ecf7dcc641e8453e2e2ea2f21c13c7a867ffe0" LIC_FILES_CHKSUM += "file://docs/license.rst;md5=6ed7bace7b0bc63021c6eba7b524039e" From 11fbaca4ba35b7aee09147ca4a4854151e46abfb Mon Sep 17 00:00:00 2001 From: Kavinaya S Date: Mon, 3 Aug 2026 21:30:19 +0530 Subject: [PATCH 04/10] trusted-firmware-a-qcom: add bl31 to TFA build targets The existing TFA_BUILD_TARGET only built bl2 and fip, which is sufficient for a standard UEFI-based boot flow. However, to support the U-Boot SPL + FIT image based secure boot flow, bl31 must be built as an explicit binary artifact. U-Boot SPL loads a FIT image that bundles bl31 (TF-A), OP-TEE (bl32), and U-Boot proper (bl33) as separate loadable images. For SPL to load and jump to bl31 directly, the bl31.bin binary must be available as a standalone artifact at deploy time. It cannot be extracted from the fip alone in this flow. Adding bl31 to TFA_BUILD_TARGET ensures bl31.bin is produced and available for packaging into the SPL FIT image. Signed-off-by: Kavinaya S (cherry picked from commit 74606d69f6b7c016558773fadae49b6329b5537a) Signed-off-by: Dmitry Baryshkov --- .../recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc index e85b8e63b..ae8ac880f 100644 --- a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc +++ b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc @@ -15,7 +15,7 @@ COMPATIBLE_MACHINE = "qcm6490|qcs9100" TFA_PLATFORM:qcm6490 = "rb3gen2" TFA_PLATFORM:qcs9100 = "lemans_evk" -TFA_BUILD_TARGET = "bl2 fip" +TFA_BUILD_TARGET = "bl2 bl31 fip" TFA_SPD = "opteed" EXTRA_OEMAKE:append = " \ From 7effe8f7632a8d1b9e984952cae657d609bdcb70 Mon Sep 17 00:00:00 2001 From: Royyan Zahir Date: Tue, 11 Aug 2026 00:50:42 +0400 Subject: [PATCH 05/10] trusted-firmware-a-qcom: split into per-device recipes One recipe gated on MACHINE builds a single TF-A platform, so the platform, the FIP address and the qtiseclib blob all had to be keyed on the machine. Give each device its own recipe holding those, and keep the shared source and build rules in the include. The blob follows its recipe, so a platform without qtiseclib no longer claims its licence. FIP_ELF_ADDR has no sensible default, so refuse a device recipe that leaves it unset. Signed-off-by: Royyan Zahir (cherry picked from commit eddb7e753198534e91d02720c957fc6fb401a9f9) Signed-off-by: Dmitry Baryshkov --- conf/machine/iq-9075-evk-open-fw.conf | 2 +- conf/machine/rb3gen2-core-kit-open-fw.conf | 2 +- .../trusted-firmware-a-qcom-lemans-evk_git.bb | 4 +++ .../trusted-firmware-a-qcom-rb3gen2_git.bb | 14 +++++++++ .../trusted-firmware-a-qcom.inc | 29 ++++++++----------- .../trusted-firmware-a-qcom_git.bb | 11 ------- 6 files changed, 32 insertions(+), 30 deletions(-) create mode 100644 dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-lemans-evk_git.bb create mode 100644 dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-rb3gen2_git.bb delete mode 100644 dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom_git.bb diff --git a/conf/machine/iq-9075-evk-open-fw.conf b/conf/machine/iq-9075-evk-open-fw.conf index 6f829612a..880d18917 100644 --- a/conf/machine/iq-9075-evk-open-fw.conf +++ b/conf/machine/iq-9075-evk-open-fw.conf @@ -4,7 +4,7 @@ require conf/machine/iq-9075-evk.conf -EXTRA_IMAGEDEPENDS += "trusted-firmware-a-qcom" +EXTRA_IMAGEDEPENDS += "trusted-firmware-a-qcom-lemans-evk" MACHINE_FEATURES += "optee" MACHINE_EXTRA_RRECOMMENDS += "${@bb.utils.contains('BBFILE_COLLECTIONS', 'meta-arm', 'packagegroup-optee', '', d)}" diff --git a/conf/machine/rb3gen2-core-kit-open-fw.conf b/conf/machine/rb3gen2-core-kit-open-fw.conf index 740c18808..2ac1836e1 100644 --- a/conf/machine/rb3gen2-core-kit-open-fw.conf +++ b/conf/machine/rb3gen2-core-kit-open-fw.conf @@ -4,7 +4,7 @@ require conf/machine/rb3gen2-core-kit.conf -EXTRA_IMAGEDEPENDS += "trusted-firmware-a-qcom" +EXTRA_IMAGEDEPENDS += "trusted-firmware-a-qcom-rb3gen2" MACHINE_FEATURES += "optee" MACHINE_EXTRA_RRECOMMENDS += "${@bb.utils.contains('BBFILE_COLLECTIONS', 'meta-arm', 'packagegroup-optee', '', d)}" diff --git a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-lemans-evk_git.bb b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-lemans-evk_git.bb new file mode 100644 index 000000000..65b2bbee4 --- /dev/null +++ b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-lemans-evk_git.bb @@ -0,0 +1,4 @@ +require trusted-firmware-a-qcom.inc + +TFA_PLATFORM = "lemans_evk" +FIP_ELF_ADDR = "0xaf000000" diff --git a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-rb3gen2_git.bb b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-rb3gen2_git.bb new file mode 100644 index 000000000..a9aa2aa7e --- /dev/null +++ b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-rb3gen2_git.bb @@ -0,0 +1,14 @@ +require trusted-firmware-a-qcom.inc + +TFA_PLATFORM = "rb3gen2" +QTISECLIB_SOC = "sc7280" +FIP_ELF_ADDR = "0x9fc00000" + +SRC_URI += "git://github.com/coreboot/qc_blobs.git;protocol=https;name=qc-blobs;subdir=qc_blobs;branch=main" +SRCREV_qc-blobs = "16207f367ddbf280a0c2c8a3d3ee454a59710a25" +SRCREV_FORMAT .= "_qc-blobs" + +LICENSE += "& LICENSE.qcom" +LIC_FILES_CHKSUM += "file://${UNPACKDIR}/qc_blobs/${QTISECLIB_SOC}/qtiseclib/LICENSE;md5=fa83f30385e617b56ef0934f13645621" + +EXTRA_OEMAKE:append = " QTISECLIB_PATH=${UNPACKDIR}/qc_blobs/${QTISECLIB_SOC}/qtiseclib/libqtisec.a" diff --git a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc index ae8ac880f..0fa6e57de 100644 --- a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc +++ b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc @@ -1,19 +1,21 @@ -DEPENDS += "qtestsign-native optee-os-qcom u-boot-qcom" +require recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc -SRCREV_FORMAT_qcom ?= "" +DEPENDS += "qtestsign-native optee-os-qcom u-boot-qcom" -SRC_URI:append:qcm6490 = " git://github.com/coreboot/qc_blobs.git;protocol=https;name=qc-blobs;subdir=qc_blobs;branch=main" -SRCREV_qc-blobs = "16207f367ddbf280a0c2c8a3d3ee454a59710a25" -SRCREV_FORMAT_qcom:qcm6490 = "_qc-blobs" +PV = "2.15.0-qcom+git" -SRCREV_FORMAT .= "${SRCREV_FORMAT_qcom}" +SRC_TAG = "tag=qcom-next-2.15-20260804" +SRC_URI = "git://github.com/qualcomm-linux/trusted-firmware-a.git;protocol=https;name=tfa;nobranch=1;${SRC_TAG}" +SRCREV_tfa = "10ecf7dcc641e8453e2e2ea2f21c13c7a867ffe0" -LICENSE += "& LICENSE.qcom" -LIC_FILES_CHKSUM:qcm6490 += "file://${UNPACKDIR}/qc_blobs/sc7280/qtiseclib/LICENSE;md5=fa83f30385e617b56ef0934f13645621" +LIC_FILES_CHKSUM += "file://docs/license.rst;md5=6ed7bace7b0bc63021c6eba7b524039e" COMPATIBLE_MACHINE = "qcm6490|qcs9100" -TFA_PLATFORM:qcm6490 = "rb3gen2" -TFA_PLATFORM:qcs9100 = "lemans_evk" + +python () { + if not d.getVar('FIP_ELF_ADDR'): + bb.fatal('FIP_ELF_ADDR must be set by the device recipe') +} TFA_BUILD_TARGET = "bl2 bl31 fip" TFA_SPD = "opteed" @@ -23,15 +25,8 @@ EXTRA_OEMAKE:append = " \ BL33=${DEPLOY_DIR_IMAGE}/u-boot.bin \ " -EXTRA_OEMAKE:append:qcm6490 = " \ - QTISECLIB_PATH=${UNPACKDIR}/qc_blobs/sc7280/qtiseclib/libqtisec.a \ - " - do_compile[depends] += " u-boot-qcom:do_deploy" -FIP_ELF_ADDR:qcm6490 = "0x9fc00000" -FIP_ELF_ADDR:qcs9100 = "0xaf000000" - do_install:append() { export CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1 diff --git a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom_git.bb b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom_git.bb deleted file mode 100644 index 7a7fc4d1c..000000000 --- a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom_git.bb +++ /dev/null @@ -1,11 +0,0 @@ -require recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc - -PV = "2.15.0-qcom+git" - -SRC_TAG = "tag=qcom-next-2.15-20260804" -SRC_URI = "git://github.com/qualcomm-linux/trusted-firmware-a.git;protocol=https;name=tfa;nobranch=1;${SRC_TAG}" -SRCREV_tfa = "10ecf7dcc641e8453e2e2ea2f21c13c7a867ffe0" - -LIC_FILES_CHKSUM += "file://docs/license.rst;md5=6ed7bace7b0bc63021c6eba7b524039e" - -require trusted-firmware-a-qcom.inc From 09b86c5ae61cf0b1cff618a8ce9e20aafd067171 Mon Sep 17 00:00:00 2001 From: Royyan Zahir Date: Tue, 11 Aug 2026 00:51:11 +0400 Subject: [PATCH 06/10] optee-os-qcom: split into per-platform recipes optee-os-qcom picks its OP-TEE platform from MACHINE, so a build can only ever hold one, while the TF-A recipes are now per device. Give each OP-TEE platform its own recipe and point each TF-A recipe at the one it needs. The devkit and optee-test stay machine-scoped; a rootfs targets a single machine. Signed-off-by: Royyan Zahir (cherry picked from commit c7a5770d0e5666286511fb8ccd524380457803ea) Signed-off-by: Dmitry Baryshkov --- .../trusted-firmware-a-qcom-lemans-evk_git.bb | 2 ++ .../trusted-firmware-a-qcom-rb3gen2_git.bb | 2 ++ .../trusted-firmware-a/trusted-firmware-a-qcom.inc | 2 +- .../recipes-security/optee/optee-os-qcom-kodiak_git.bb | 5 +++++ .../recipes-security/optee/optee-os-qcom-lemans_git.bb | 5 +++++ .../optee/{optee-os-qcom_git.bb => optee-os-qcom.inc} | 2 -- .../recipes-security/optee/optee-os-tadevkit-qcom_git.bb | 3 ++- 7 files changed, 17 insertions(+), 4 deletions(-) create mode 100644 dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb create mode 100644 dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb rename dynamic-layers/meta-arm/recipes-security/optee/{optee-os-qcom_git.bb => optee-os-qcom.inc} (92%) diff --git a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-lemans-evk_git.bb b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-lemans-evk_git.bb index 65b2bbee4..1b95452e8 100644 --- a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-lemans-evk_git.bb +++ b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-lemans-evk_git.bb @@ -1,4 +1,6 @@ require trusted-firmware-a-qcom.inc +DEPENDS += "optee-os-qcom-lemans" + TFA_PLATFORM = "lemans_evk" FIP_ELF_ADDR = "0xaf000000" diff --git a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-rb3gen2_git.bb b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-rb3gen2_git.bb index a9aa2aa7e..31e2454d7 100644 --- a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-rb3gen2_git.bb +++ b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom-rb3gen2_git.bb @@ -1,5 +1,7 @@ require trusted-firmware-a-qcom.inc +DEPENDS += "optee-os-qcom-kodiak" + TFA_PLATFORM = "rb3gen2" QTISECLIB_SOC = "sc7280" FIP_ELF_ADDR = "0x9fc00000" diff --git a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc index 0fa6e57de..e605b5b70 100644 --- a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc +++ b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc @@ -1,6 +1,6 @@ require recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc -DEPENDS += "qtestsign-native optee-os-qcom u-boot-qcom" +DEPENDS += "qtestsign-native u-boot-qcom" PV = "2.15.0-qcom+git" diff --git a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb new file mode 100644 index 000000000..3b7be8485 --- /dev/null +++ b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb @@ -0,0 +1,5 @@ +require optee-os-qcom.inc + +OPTEEMACHINE = "qcom-kodiak" + +COMPATIBLE_MACHINE = "qcm6490|qcs9100" diff --git a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb new file mode 100644 index 000000000..e4fea51b4 --- /dev/null +++ b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb @@ -0,0 +1,5 @@ +require optee-os-qcom.inc + +OPTEEMACHINE = "qcom-lemans" + +COMPATIBLE_MACHINE = "qcm6490|qcs9100" diff --git a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom_git.bb b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom.inc similarity index 92% rename from dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom_git.bb rename to dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom.inc index c4e34a533..b8502146d 100644 --- a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom_git.bb +++ b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom.inc @@ -5,5 +5,3 @@ PV = "4.10.0-qcom-20260721+git" SRC_TAG = "tag=qcom-next-4.10-20260721" SRC_URI = "git://github.com/qualcomm-linux/optee_os.git;protocol=https;name=optee;nobranch=1;${SRC_TAG}" SRCREV_optee = "690842e042dc470bf0625eb77a8cab926c372a8f" - -require optee-qcom.inc diff --git a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-tadevkit-qcom_git.bb b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-tadevkit-qcom_git.bb index a2c764da1..77ecfba28 100644 --- a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-tadevkit-qcom_git.bb +++ b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-tadevkit-qcom_git.bb @@ -1,4 +1,5 @@ -require optee-os-qcom_git.bb +require optee-os-qcom.inc +require optee-qcom.inc SUMMARY = "OP-TEE Trusted OS TA devkit" DESCRIPTION = "OP-TEE TA devkit for build TAs" From a635d908b618786e48ce7b8cbb0ca7767b86d8d9 Mon Sep 17 00:00:00 2001 From: Royyan Zahir Date: Tue, 11 Aug 2026 00:51:28 +0400 Subject: [PATCH 07/10] trusted-firmware-a-qcom, optee-os-qcom: build on any aarch64 qcom machine Now that both are per platform, nothing ties them to qcm6490 or qcs9100. Widen them so a machine like qcom-armv8a can build kodiak and lemans firmware side by side. Signed-off-by: Royyan Zahir (cherry picked from commit a5c633ae0806edf17e754742c9e83b92ade3024a) Signed-off-by: Dmitry Baryshkov --- .../recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc | 3 ++- .../recipes-security/optee/optee-os-qcom-kodiak_git.bb | 3 ++- .../recipes-security/optee/optee-os-qcom-lemans_git.bb | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc index e605b5b70..9c7a968f7 100644 --- a/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc +++ b/dynamic-layers/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a-qcom.inc @@ -10,7 +10,8 @@ SRCREV_tfa = "10ecf7dcc641e8453e2e2ea2f21c13c7a867ffe0" LIC_FILES_CHKSUM += "file://docs/license.rst;md5=6ed7bace7b0bc63021c6eba7b524039e" -COMPATIBLE_MACHINE = "qcm6490|qcs9100" +COMPATIBLE_MACHINE = "^$" +COMPATIBLE_MACHINE:aarch64 = "(qcom)" python () { if not d.getVar('FIP_ELF_ADDR'): diff --git a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb index 3b7be8485..a3851c33a 100644 --- a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb +++ b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb @@ -2,4 +2,5 @@ require optee-os-qcom.inc OPTEEMACHINE = "qcom-kodiak" -COMPATIBLE_MACHINE = "qcm6490|qcs9100" +COMPATIBLE_MACHINE = "^$" +COMPATIBLE_MACHINE:aarch64 = "(qcom)" diff --git a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb index e4fea51b4..8a6cc3acd 100644 --- a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb +++ b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb @@ -2,4 +2,5 @@ require optee-os-qcom.inc OPTEEMACHINE = "qcom-lemans" -COMPATIBLE_MACHINE = "qcm6490|qcs9100" +COMPATIBLE_MACHINE = "^$" +COMPATIBLE_MACHINE:aarch64 = "(qcom)" From dccf37386a8b0a73d1f5fa14e34209703ba14046 Mon Sep 17 00:00:00 2001 From: Dmitry Baryshkov Date: Wed, 26 Aug 2026 02:35:00 +0300 Subject: [PATCH 08/10] optee-os-qcom: let multiple OP-TEE kinds be deployed simultaneously In some cases (`build world` or just a build targeting generic machines) it might be required to deploy several OP-TEE recipes simultaneously. The optee-os.inc from meta-arm deploys all recipes to the "optee" subdir, causing conflicts between optee-os-qcom-lemans and optee-os-qcom-kodiak. Override the do_deploy() functions locally, letting individual recipes specify separate deployment directories. Signed-off-by: Dmitry Baryshkov (cherry picked from commit 1127e71b8c7e0b2d5b8de1265056da132cde669e) --- .../meta-arm/recipes-security/optee/optee-os-qcom.inc | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom.inc b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom.inc index b8502146d..051c7030b 100644 --- a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom.inc +++ b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom.inc @@ -5,3 +5,13 @@ PV = "4.10.0-qcom-20260721+git" SRC_TAG = "tag=qcom-next-4.10-20260721" SRC_URI = "git://github.com/qualcomm-linux/optee_os.git;protocol=https;name=optee;nobranch=1;${SRC_TAG}" SRCREV_optee = "690842e042dc470bf0625eb77a8cab926c372a8f" + +# Copy of do_deploy from meta-arm until we get it fixed to support configurable deploy dir +OPTEE_DEPLOY ?= "optee" +do_deploy() { + install -d ${DEPLOYDIR}/${MLPREFIX}${OPTEE_DEPLOY} + install -m 644 ${D}${nonarch_base_libdir}/firmware/* ${DEPLOYDIR}/${MLPREFIX}${OPTEE_DEPLOY} + + install -d ${DEPLOYDIR}/${MLPREFIX}${OPTEE_DEPLOY}/ta + install -m 644 ${B}/ta/*/*.elf ${DEPLOYDIR}/${MLPREFIX}${OPTEE_DEPLOY}/ta +} From dd095911e74ab22d89e084e0599eefa2897995dd Mon Sep 17 00:00:00 2001 From: Dmitry Baryshkov Date: Wed, 26 Aug 2026 02:38:31 +0300 Subject: [PATCH 09/10] optee-os-qcom-kodiak: use recipe-specific directory for deployment Now as the optee-os-qcom provides support for recipe-specific deployment dirs, deploy Kodiak OP-TEE to the "optee-kodiak" directory. Signed-off-by: Dmitry Baryshkov (cherry picked from commit 0cacb514691c55dfe4f889a4823279e5287dbd04) --- .../meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb index a3851c33a..dc3bfaeb7 100644 --- a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb +++ b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-kodiak_git.bb @@ -4,3 +4,5 @@ OPTEEMACHINE = "qcom-kodiak" COMPATIBLE_MACHINE = "^$" COMPATIBLE_MACHINE:aarch64 = "(qcom)" + +OPTEE_DEPLOY = "optee-kodiak" From d4da613000be1c7e09822e3ea8f37f7065f2faa0 Mon Sep 17 00:00:00 2001 From: Dmitry Baryshkov Date: Wed, 26 Aug 2026 02:38:31 +0300 Subject: [PATCH 10/10] optee-os-qcom-lemans: use recipe-specific directory for deployment Now as the optee-os-qcom provides support for recipe-specific deployment dirs, deploy Lemans OP-TEE to the "optee-lemans" directory. Signed-off-by: Dmitry Baryshkov (cherry picked from commit ba7c9cf46e21ba72d01c9d010a8ec2ffaa57650f) --- .../meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb index 8a6cc3acd..fef710e01 100644 --- a/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb +++ b/dynamic-layers/meta-arm/recipes-security/optee/optee-os-qcom-lemans_git.bb @@ -4,3 +4,5 @@ OPTEEMACHINE = "qcom-lemans" COMPATIBLE_MACHINE = "^$" COMPATIBLE_MACHINE:aarch64 = "(qcom)" + +OPTEE_DEPLOY = "optee-lemans"