diff mbox series

[2/2] optee-ftpm: rewrite its optee-os bbappend to use EARLY_TA_PATHS bitbake variable

Message ID 20260827133720.3246210-2-ravi@prevas.dk
State New
Headers show
Series [1/2] optee-os: make early TAs more convenient to add for .bbappends | expand

Commit Message

Rasmus Villemoes Aug. 27, 2026, 1:37 p.m. UTC 
From: Rasmus Villemoes <ravi@prevas.dk>

If anything else in the BSP also wants or needs to add an early TA to
optee, that will conflict with this .bbappend adding its own
EARLY_TA_PATHS="..." argument to EXTRA_OEMAKE.

Instead, add the path to the ftpm TA to the newly introduced
EARLY_TA_PATHS bitbake variable, which the main recipe will use to
produce the make argument.

Passing CFG_EARLY_TA=y explicitly is not needed, as optee-os' build
system sets that automatically if the EARLY_TA_PATHS list is
non-empty.

CFG_CORE_HEAP_SIZE is somewhat harder to make play along nicely with
other .bbappends that might have an opinion on its proper (minimum)
value. For now, keep adding it explicitly to EXTRA_OEMAKE.

Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
---
 .../recipes-security/optee-ftpm/optee-os_%.bbappend    | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

Comments

Jan Kiszka Aug. 27, 2026, 5 p.m. UTC | #1 
On 27.08.26 15:37, Rasmus Villemoes wrote:
> From: Rasmus Villemoes <ravi@prevas.dk>
> 
> If anything else in the BSP also wants or needs to add an early TA to
> optee, that will conflict with this .bbappend adding its own
> EARLY_TA_PATHS="..." argument to EXTRA_OEMAKE.
> 
> Instead, add the path to the ftpm TA to the newly introduced
> EARLY_TA_PATHS bitbake variable, which the main recipe will use to
> produce the make argument.
> 
> Passing CFG_EARLY_TA=y explicitly is not needed, as optee-os' build
> system sets that automatically if the EARLY_TA_PATHS list is
> non-empty.
> 
> CFG_CORE_HEAP_SIZE is somewhat harder to make play along nicely with
> other .bbappends that might have an opinion on its proper (minimum)
> value. For now, keep adding it explicitly to EXTRA_OEMAKE.
> 
> Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
> ---
>  .../recipes-security/optee-ftpm/optee-os_%.bbappend    | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend b/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend
> index 92c11157..74bde25e 100644
> --- a/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend
> +++ b/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend
> @@ -4,8 +4,8 @@ DEPENDS:append = "\
>      ${@bb.utils.contains('MACHINE_FEATURES', 'optee-ftpm', 'optee-ftpm', '' , d)} \
>  "
>  
> -EXTRA_OEMAKE:append = "\
> -    ${@bb.utils.contains('MACHINE_FEATURES', 'optee-ftpm', \
> -        'CFG_CORE_HEAP_SIZE=131072 CFG_EARLY_TA=y EARLY_TA_PATHS="${STAGING_DIR_TARGET}/${base_libdir}/optee_armtz/${FTPM_UUID}.stripped.elf"', \
> -        '', d)} \
> -"
> +python() {
> +    if bb.utils.contains('MACHINE_FEATURES', 'optee-ftpm', True, False, d):
> +        d.appendVar('EARLY_TA_PATHS', ' ${STAGING_DIR_TARGET}/${base_libdir}/optee_armtz/${FTPM_UUID}.stripped.elf')
> +        d.appendVar('EXTRA_OEMAKE', ' CFG_CORE_HEAP_SIZE=131072')
> +}

Both patches look good to me, but I currently have no nothing in place 
to test.

Also good to know that CFG_EARLY_TA=y can be dropped - I have it 
elsewhere redundantly in use as well.

In case you are currently using optee_ftpm, I hope you are aware that
this layer probably needs more updates. See [1] and [2] for what we did 
in isar-cip-core to update the TPM core and add recent CVE fixes. If all 
goes well, at least optee_ftpm patch will become part of the next optee 
release. But there is more.

Jan

[1] https://gitlab.com/cip-project/cip-core/isar-cip-core/-/commit/d233084880dffef3fd5037b3159c88e3b35259ac
[2] https://gitlab.com/cip-project/cip-core/isar-cip-core/-/commit/77f75df8c69868f335ffa36f671fe06b1f983247
diff mbox series

Patch

diff --git a/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend b/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend
index 92c11157..74bde25e 100644
--- a/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend
+++ b/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend
@@ -4,8 +4,8 @@  DEPENDS:append = "\
     ${@bb.utils.contains('MACHINE_FEATURES', 'optee-ftpm', 'optee-ftpm', '' , d)} \
 "
 
-EXTRA_OEMAKE:append = "\
-    ${@bb.utils.contains('MACHINE_FEATURES', 'optee-ftpm', \
-        'CFG_CORE_HEAP_SIZE=131072 CFG_EARLY_TA=y EARLY_TA_PATHS="${STAGING_DIR_TARGET}/${base_libdir}/optee_armtz/${FTPM_UUID}.stripped.elf"', \
-        '', d)} \
-"
+python() {
+    if bb.utils.contains('MACHINE_FEATURES', 'optee-ftpm', True, False, d):
+        d.appendVar('EARLY_TA_PATHS', ' ${STAGING_DIR_TARGET}/${base_libdir}/optee_armtz/${FTPM_UUID}.stripped.elf')
+        d.appendVar('EXTRA_OEMAKE', ' CFG_CORE_HEAP_SIZE=131072')
+}