agherzan · RajdeepBora14 · Apr 22, 2026
diff --git a/conf/machine/raspberrypi3-64.conf b/conf/machine/raspberrypi3-64.conf
@@ -34,3 +34,6 @@ KERNEL_BOOTCMD ?= "booti"
 
 VC4DTBO ?= "vc4-fkms-v3d"
 ARMSTUB ?= "armstub8.bin"
+
+# Ensure armstub is included so rpi-config writes armstub= into config.txt
+MACHINE_FEATURES += " armstub"
diff --git a/recipes-bsp/bootfiles/rpi-config_git.bb b/recipes-bsp/bootfiles/rpi-config_git.bb
@@ -32,7 +32,7 @@ CAN_OSCILLATOR ?= "16000000"
 CAN0_INTERRUPT_PIN ?= "25"
 CAN1_INTERRUPT_PIN ?= "24"
 
-ENABLE_UART ??= ""
+ENABLE_UART = "1"
 
 WM8960="${@bb.utils.contains("MACHINE_FEATURES", "wm8960", "1", "0", d)}"
 
@@ -308,11 +308,14 @@ do_deploy() {
 }
 
 do_deploy:append:raspberrypi3-64() {
-    echo "# have a properly sized image" >> $CONFIG
-    echo "disable_overscan=1" >> $CONFIG
-
-    echo "# Enable audio (loads snd_bcm2835)" >> $CONFIG
-    echo "dtparam=audio=on" >> $CONFIG
+    echo "enable_uart=1" >> $CONFIG
+    echo "kernel_address=0x02000000" >> $CONFIG
+    echo "device_tree=bcm2710-rpi-3-b-plus.dtb" >> $CONFIG
+    echo "device_tree_address=0x01000000" >> $CONFIG
+    echo "cpu=armv8" >> $CONFIG
+    echo "smp=on" >> $CONFIG
+    echo "core_freq=250" >> $CONFIG
+    echo "core_freq_min=250" >> $CONFIG
 }
 
 do_deploy:append() {

diff --git a/recipes-bsp/optee/optee-client.inc b/recipes-bsp/optee/optee-client.inc
@@ -0,0 +1,48 @@
+SUMMARY = "OP-TEE Client API"
+DESCRIPTION = "Open Portable Trusted Execution Environment - Normal World Client side of the TEE"
+HOMEPAGE = "https://www.op-tee.org/"
+
+LICENSE = "BSD-2-Clause"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=69663ab153298557a59c67a60a743e5b"
+
+inherit systemd update-rc.d cmake 
+# inherit useradd
+
+# USERADD_PACKAGES = "${PN}"
+# USERADD_PARAM:${PN} = "-r -g teesuppl -d /var/lib/tee -s /sbin/nologin teesuppl"
+# GROUPADD_PARAM:${PN} = "-r teesuppl"
+
+FILESEXTRAPATHS:prepend := "${THISDIR}/optee-client:"
+
+SRC_URI = " \
+    git://github.com/OP-TEE/optee_client.git;branch=master;protocol=https \
+    file://tee-supplicant.service \
+    file://tee-supplicant.sh \
+"
+
+UPSTREAM_CHECK_GITTAGREGEX = "^(?P<pver>\d+(\.\d+)+)$"
+
+S = "${WORKDIR}/git"
+
+EXTRA_OECMAKE = " \
+    -DBUILD_SHARED_LIBS=ON \
+    -DCFG_TEE_FS_PARENT_PATH='${localstatedir}/lib/tee' \
+"
+EXTRA_OECMAKE:append:toolchain-clang = " -DCFG_WERROR=0"
+
+do_install:append() {
+    install -D -p -m0644 ${WORKDIR}/tee-supplicant.service ${D}${systemd_system_unitdir}/tee-supplicant.service
+    install -D -p -m0755 ${WORKDIR}/tee-supplicant.sh ${D}${sysconfdir}/init.d/tee-supplicant
+
+    sed -i -e s:@sysconfdir@:${sysconfdir}:g \
+           -e s:@sbindir@:${sbindir}:g \
+              ${D}${systemd_system_unitdir}/tee-supplicant.service \
+              ${D}${sysconfdir}/init.d/tee-supplicant
+}
+
+SYSTEMD_SERVICE:${PN} = "tee-supplicant.service"
+
+INITSCRIPT_PACKAGES = "${PN}"
+INITSCRIPT_NAME:${PN} = "tee-supplicant"
+INITSCRIPT_PARAMS:${PN} = "start 10 1 2 3 4 5 . stop 90 0 6 ."
+
diff --git a/recipes-bsp/optee/optee-client/tee-supplicant.service b/recipes-bsp/optee/optee-client/tee-supplicant.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=TEE Supplicant
+
+[Service]
+User=root
+EnvironmentFile=-@sysconfdir@/default/tee-supplicant
+ExecStart=@sbindir@/tee-supplicant $OPTARGS
+
+[Install]
+WantedBy=basic.target
diff --git a/recipes-bsp/optee/optee-client/tee-supplicant.sh b/recipes-bsp/optee/optee-client/tee-supplicant.sh
@@ -0,0 +1,46 @@
+#!/bin/sh
+
+# Source function library
+. /etc/init.d/functions
+
+NAME=tee-supplicant
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+DESC="OP-TEE Supplicant"
+
+DAEMON=@sbindir@/$NAME
+
+test -f $DAEMON || exit 0
+
+test -f @sysconfdir@/default/$NAME && . @sysconfdir@/default/$NAME
+test -f @sysconfdir@/default/rcS && . @sysconfdir@/default/rcS
+
+SSD_OPTIONS="--oknodo --quiet --exec $DAEMON -- -d $OPTARGS"
+
+set -e
+
+case $1 in
+    start)
+	    echo -n "Starting $DESC: "
+	    start-stop-daemon --start $SSD_OPTIONS
+        echo "${DAEMON##*/}."
+        ;;
+    stop)
+	    echo -n "Stopping $DESC: "
+	    start-stop-daemon --stop $SSD_OPTIONS
+        echo "${DAEMON##*/}."
+        ;;
+    restart|force-reload)
+	    $0 stop
+	    sleep 1
+	    $0 start
+        ;;
+    status)
+        status ${DAEMON} || exit $?
+        ;;
+    *)
+        echo "Usage: $0 {start|stop|restart|force-reload|status}" >&2
+        exit 1
+        ;;
+esac
+
+exit 0
diff --git a/recipes-bsp/optee/optee-client_4.4.0.bb b/recipes-bsp/optee/optee-client_4.4.0.bb
@@ -0,0 +1,20 @@
+require optee-client.inc
+
+SRCREV = "d221676a58b305bddbf97db00395205b3038de8e"
+PLATFORM = "rpi3"
+
+inherit pkgconfig
+
+DEPENDS += "util-linux"
+EXTRA_OEMAKE += "PKG_CONFIG=pkg-config"
+
+FILES:${PN} = " \
+                /etc/init.d/tee-supplicant \
+                /etc/udev/rules.d/optee-udev.rules \
+                /lib/systemd/system/tee-supplicant.service \
+                /usr/include/* \
+                /usr/lib/* \
+                /usr/lib/pkgconfig/* \
+                /usr/lib/systemd/system/* \
+                /usr/sbin/tee-supplicant \
+                "
diff --git a/recipes-bsp/optee/optee-examples.inc b/recipes-bsp/optee/optee-examples.inc
@@ -0,0 +1,46 @@
+SUMMARY = "OP-TEE examples"
+DESCRIPTION = "Open Portable Trusted Execution Environment - Sample Applications"
+HOMEPAGE = "https://github.com/linaro-swg/optee_examples"
+
+LICENSE = "BSD-2-Clause"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=cd95ab417e23b94f381dafc453d70c30"
+
+DEPENDS = "optee-client optee-os-tadevkit python3-cryptography-native"
+
+inherit python3native
+
+require optee.inc
+
+SRC_URI = "git://github.com/linaro-swg/optee_examples.git;branch=master;protocol=https \
+           "
+
+EXTRA_OEMAKE += "TA_DEV_KIT_DIR=${TA_DEV_KIT_DIR} \
+                 HOST_CROSS_COMPILE=${HOST_PREFIX} \
+                 TA_CROSS_COMPILE=${HOST_PREFIX} \
+                 OUTPUT_DIR=${B} \
+               "
+
+S = "${WORKDIR}/git"
+B = "${WORKDIR}/build"
+
+
+do_compile() {
+    oe_runmake -C ${S}
+}
+do_compile[cleandirs] = "${B}"
+
+do_install () {
+    mkdir -p ${D}${nonarch_base_libdir}/optee_armtz
+    mkdir -p ${D}${bindir}
+    mkdir -p ${D}${libdir}/tee-supplicant/plugins
+    install -D -p -m0755 ${B}/ca/* ${D}${bindir}
+    install -D -p -m0444 ${B}/ta/* ${D}${nonarch_base_libdir}/optee_armtz
+    install -D -p -m0444 ${B}/plugins/* ${D}${libdir}/tee-supplicant/plugins
+}
+
+FILES:${PN} += "${nonarch_base_libdir}/optee_armtz/ \
+                ${libdir}/tee-supplicant/plugins/ \
+               "
+
+# Imports machine specific configs from staging to build
+PACKAGE_ARCH = "${MACHINE_ARCH}"
diff --git a/recipes-bsp/optee/optee-examples_4.4.0.bb b/recipes-bsp/optee/optee-examples_4.4.0.bb
@@ -0,0 +1,22 @@
+require optee-examples.inc
+
+SRCREV = "378dc0db2d5dd279f58a3b6cb3f78ffd6b165035"
+
+COMPATIBLE_MACHINE = "^rpi$"
+
+do_install:append(){
+    install -d ${D}${base_libdir}/optee_armtz
+    install -m 0444 ${B}/ta/* ${D}${base_libdir}/optee_armtz
+
+    install -d ${D}${bindir}
+    install -m 0744 ${B}/ta/* ${D}${bindir}
+
+    install -d ${D}${libdir}/tee-supplicant/plugins
+    install -m 0444 ${B}/plugins/* ${D}${libdir}/tee-supplicant/plugins
+}
+
+FILES:${PN} += " \
+                ${base_libdir}/optee_armtz/* \
+                ${bindir}/* \
+                ${libdir}/tee-supplicant/plugins/* \
+                "
diff --git a/recipes-bsp/optee/optee-os-tadevkit_4.4.0.bb b/recipes-bsp/optee/optee-os-tadevkit_4.4.0.bb
@@ -0,0 +1,21 @@
+FILESEXTRAPATHS:prepend := "${THISDIR}/optee-os:"
+require optee-os_4.4.0.bb
+
+SUMMARY = "OP-TEE Trusted OS TA devkit"
+DESCRIPTION = "OP-TEE TA devkit for build TAs"
+HOMEPAGE = "https://www.op-tee.org/"
+
+
+do_install() {
+    #install TA devkit
+    install -d ${D}${includedir}/optee/export-user_ta/
+    for f in ${B}/export-ta_${OPTEE_ARCH}/* ; do
+        cp -aR $f ${D}${includedir}/optee/export-user_ta/
+    done
+}
+
+do_deploy() {
+	echo "Do not inherit do_deploy from optee-os."
+}
+
+FILES:${PN} = "${includedir}/optee/"
diff --git a/recipes-bsp/optee/optee-os.inc b/recipes-bsp/optee/optee-os.inc
@@ -0,0 +1,77 @@
+SUMMARY = "OP-TEE Trusted OS"
+DESCRIPTION = "Open Portable Trusted Execution Environment - Trusted side of the TEE"
+HOMEPAGE = "https://www.op-tee.org/"
+
+LICENSE = "BSD-2-Clause"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=c1f21c4f72f372ef38a5a4aee55ec173"
+
+inherit deploy python3native
+require optee.inc
+
+CVE_PRODUCT = "linaro:op-tee op-tee:op-tee_os"
+
+DEPENDS = "python3-pyelftools-native python3-cryptography-native"
+
+DEPENDS:append:toolchain-clang = " compiler-rt"
+
+FILESEXTRAPATHS:prepend := "${THISDIR}/optee-os:"
+
+SRC_URI = "git://github.com/OP-TEE/optee_os.git;branch=master;protocol=https"
+
+SRC_URI += "file://0001-remove-TA-access-permission-and-change-uuid.patch"
+
+S = "${WORKDIR}/git"
+B = "${WORKDIR}/build"
+
+EXTRA_OEMAKE += " \
+    PLATFORM=${OPTEEMACHINE} \
+    CFG_${OPTEE_CORE}_core=y \
+    CROSS_COMPILE_core=${HOST_PREFIX} \
+    CROSS_COMPILE_ta_${OPTEE_ARCH}=${HOST_PREFIX} \
+    NOWERROR=1 \
+    ta-targets=ta_${OPTEE_ARCH} \
+    O=${B} \
+"
+
+CFLAGS[unexport] = "1"
+LDFLAGS[unexport] = "1"
+CPPFLAGS[unexport] = "1"
+AS[unexport] = "1"
+LD[unexport] = "1"
+
+do_configure[noexec] = "1"
+
+do_compile() {
+    oe_runmake -C ${S} all
+}
+do_compile[cleandirs] = "${B}"
+
+do_install() {
+    #install core in firmware
+    install -d ${D}${nonarch_base_libdir}/firmware/
+    install -m 644 ${B}/core/*.bin ${B}/core/tee.elf ${D}${nonarch_base_libdir}/firmware/
+
+    #install tas in optee_armtz
+    install -d ${D}${nonarch_base_libdir}/optee_armtz/
+    install -m 444 ${B}/ta/*/*.ta ${D}${nonarch_base_libdir}/optee_armtz
+}
+
+PACKAGE_ARCH = "${MACHINE_ARCH}"
+
+do_deploy() {
+    install -d ${DEPLOYDIR}/${MLPREFIX}optee
+    install -m 644 ${D}${nonarch_base_libdir}/firmware/* ${DEPLOYDIR}/${MLPREFIX}optee
+}
+
+addtask deploy before do_build after do_install
+
+SYSROOT_DIRS += "${nonarch_base_libdir}/firmware"
+
+PACKAGES += "${PN}-ta"
+# FILES:${PN} = "${nonarch_base_libdir}/firmware/"
+
+# note: "textrel" is not triggered on all archs
+INSANE_SKIP:${PN} = "textrel"
+INSANE_SKIP:${PN}-dev = "staticdev"
+
+INHIBIT_PACKAGE_STRIP = "1"
diff --git a/recipes-bsp/optee/optee-os/0001-remove-TA-access-permission-and-change-uuid.patch b/recipes-bsp/optee/optee-os/0001-remove-TA-access-permission-and-change-uuid.patch
@@ -0,0 +1,32 @@
+diff --git a/ta/trusted_keys/entry.c b/ta/trusted_keys/entry.c
+index a806e7240..08be85723 100644
+--- a/ta/trusted_keys/entry.c
++++ b/ta/trusted_keys/entry.c
+@@ -299,26 +299,7 @@ TEE_Result TA_OpenSessionEntryPoint(uint32_t pt __unused,
+ 				    TEE_Param params[TEE_NUM_PARAMS] __unused,
+ 				    void **session __unused)
+ {
+-	TEE_Result res = TEE_ERROR_GENERIC;
+-	TEE_PropSetHandle h = TEE_HANDLE_NULL;
+-	TEE_Identity id = { };
+-
+-	res = TEE_AllocatePropertyEnumerator(&h);
+-	if (res)
+-		goto out;
+-
+-	TEE_StartPropertyEnumerator(h, TEE_PROPSET_CURRENT_CLIENT);
+-
+-	res = TEE_GetPropertyAsIdentity(h, NULL, &id);
+-	if (res)
+-		goto out;
+-
+-	if (id.login != TEE_LOGIN_REE_KERNEL)
+-		res = TEE_ERROR_ACCESS_DENIED;
+-
+-out:
+-	if (h)
+-		TEE_FreePropertyEnumerator(h);
++	TEE_Result res = TEE_SUCCESS;
+ 	return res;
+ }
+
diff --git a/recipes-bsp/optee/optee-os_4.4.0.bb b/recipes-bsp/optee/optee-os_4.4.0.bb
@@ -0,0 +1,20 @@
+require optee-os.inc
+
+DEPENDS += "dtc-native"
+
+SRCREV = "8f645256efc0dc66bd5c118778b0b50c44469ae1"
+
+COMPATIBLE_MACHINE = "^rpi$"
+
+EXTRA_OEMAKE += "\
+                CFG_DEBUG_INFO=y \
+                CFG_TEE_CORE_DEBUG=y \
+                CFG_TEE_CORE_LOG_LEVEL=4 \
+                CFG_TEE_TA_LOG_LEVEL=3 \
+                CFG_DT=y \
+            "
+
+FILES:${PN} = " \
+                /lib/firmware/* \
+                /lib/optee_armtz/* \
+                "