On 7/2/26 9:04 AM, Yannic Moog wrote:
Hello Yannic,
On Tue, 2026-06-30 at 18:08 +0200, Marek Vasut wrote:
Since b57ed147939c ("dts: imx8m{m,n,p,q}: Make optee packaging optional")
the TEE node is always present in U-Boot proper fitImage, even if the
CONFIG_OPTEE is disabled because the u-boot.itb should not contain any
tee.bin. This is wasteful, and produces the following warning which is
also confusing to users:
"
Image 'image' is missing optional external blobs but is still functional: tee-os
/binman/section/fit/images/tee/tee-os (tee.bin):
See the documentation for your board. You may need to build Open Portable
Trusted Execution Environment (OP-TEE) and build with TEE=/path/to/tee.bin
"
Reinstate the CONFIG_OPTEE ifdeffery to mitigate the problem, but retain the
binman "optional" keyword at tee.bin .
I disagree. You are removing a feature and cause further problems with this
commit.
I tried to avoid outright reverting the offending commit b57ed147939c
("dts: imx8m{m,n,p,q}: Make optee packaging optional") which introduced
the problem I described above.
Your initial assumption
even if the
CONFIG_OPTEE is disabled because the u-boot.itb should not contain any
tee.bin
is not accurate. You were able to package OP-TEE without needing to enable
support in U-Boot. And
afaik this is a perfectly valid use-case.
When you include optee-os in the U-Boot fitImage, what do you do with
that optee-os which U-Boot does not support ? Details please ?
With this change you can no longer do that, so this change is a regression.
About the warning message. I understand that you find it confusing; binman is
designed so that it
emits a warning when an optional blob is not found.
Please see above.
I prefer that approach to no message at all. You may want to package OP-TEE
(e.g. you have an tf-a
blob which jumps to OP-TEE addr) and being alerted to a possible mistake is
important; Let's say
tee path was incorrect during build.
Is this some sort of a board-specific configuration ?
Why does U-Boot not enable OPTEE-OS support in this case ?
Also, keeping optional when using if defs is not a good idea. Binman will still
build you an image
when no OP-TEE blob is present, but should not since you enabled OPTEE configs.
If you enable
OPTEE, you should have an OP-TEE blob packaged.
We could add ifndef OPTEE around the optional property.
The optional keyword is actually kept in this case, it is not a full revert.
You did however miss one vital point -- the tee node is part of the
U-boot fitImage, even if the tee.bin binary is not present and OPTEE
support in U-Boot is disabled. Binman prints a confusing message, and
generates a bogus empty tee {} node in the fitImage. That is incorrect.
