Boot a real secure world: upstream OP-TEE as BL32 in the boot FIT

[MrMati]

Brings up OP-TEE on the Pico Max, recreating the working bring-up from luckfox-pico-yocto on this repo's mainline boot chain. Upstream OP-TEE gained an RV1106 port in plat-rockchip; the new make optee stage pins that exact commit and builds it from source (no rv1106_tee_ta blob from rkbin). Since this repo already runs mainline U-Boot, none of the vendor fit_nodes.sh surgery the Yocto reference needed applies here: the stock CONFIG_SPL_OPTEE_IMAGE flow (the RK3229/RK3288 path) has binman pack tee-raw.bin into u-boot.itb, which now ships as u-boot.img. The SPL enters OP-TEE, and OP-TEE returns to U-Boot in the normal world.

Two mismatches between mainline conventions and the upstream RV1106 port had to be bridged. The FIT template hardcodes the vendor blob's load address, so the board -u-boot.dtsi re-points it to where upstream OP-TEE links:

&fit_template {
	images {
		op-tee {
			load = <0x03d00000>;	/* CFG_TZDRAM_START, not the blob's 0x8400000 */
			entry = <0x03d00000>;
		};
	};
};

And the platform forces CFG_DT_ADDR=0x08000000 because the vendor SPL passes garbage in r2; mainline SPL passes the real control-DTB address there, so build-optee.sh builds with CFG_DT_ADDR=n and OP-TEE believes r2. The non-secure entry needs no override: the SPL hands over lr = CONFIG_TEXT_BASE = 0x00200000, which is exactly the platform's CFG_NS_ENTRY_ADDR default.

Kernel side: the devicetree reserves the TZDRAM+SHM window [0x03d00000, 0x04e00000) no-map and enables the existing &optee node; a new config fragment adds TEE/OPTEE/ARM_PSCI/HW_RANDOM_OPTEE (the DT's psci { method = "smc" } calls finally have a monitor to land in). Notably, pico-max.env's fdt/ramdisk/script/pxefile staging addresses sat inside that window and moved above it; make check now holds all four statements of the window (OP-TEE link address, FIT load, kernel reservation, staging addresses) to one another. The standard rootfs profile picks up Debian's tee-supplicant + libteec2 so userspace is ready when a TA needs it.

Validated by building all of it: tee.elf links with entry 0x3d00000, the produced FIT carries firmware = "op-tee" at 0x03d00000 with U-Boot as loadable at 0x00200000, u-boot.img comes out at 848 KiB (inside the 1 MiB NAND slot, now enforced by build-uboot.sh), the kernel fragment survives olddefconfig symbol-for-symbol, and the DTB compiles with the optee node okay and the no-map reservation. One flashing caveat, called out in the README: a kernel from this tree expects to run in the normal world, so u-boot.img and the system must be reflashed together.

Update: the secure world is now exercisable end to end from userspace, and the core traces at debug level. build-optee.sh pins the debug configuration explicitly (CFG_TEE_CORE_DEBUG=y, upstream's default, forced so it cannot silently change) and raises core and TA trace levels from 1 to 3 (error+info+debug; level 4 flow-traces every SMC and would drown the 115200 console), which costs the core 8.5 KiB. It also exports the TA dev kit, and a new stage builds six upstream examples against it:

# scripts/build-optee-examples.sh, consumed by the standard rootfs profile
want="hello_world random aes acipher hotp secure_storage"
make -C "$examples/$ex/host" CROSS_COMPILE="$CROSS_COMPILE" TEEC_EXPORT="$texp"
make -C "$examples/$ex/ta"   CROSS_COMPILE="$CROSS_COMPILE" TA_DEV_KIT_DIR="$devkit"

Host apps land in /usr/bin/optee_example_*, signed TAs in /lib/optee_armtz/ where Debian's tee-supplicant loads them from (upstream default path, unchanged by Debian). optee_client and optee_examples are pinned at 4.9.0; the host apps link a source-built libteec at build time but resolve Debian's libteec2 on the board, and the build asserts the libteec.so.2 soname to catch a divergence early. The examples ride the standard profile only, since minimal ships no libteec2. Running optee_example_hello_world on the board is the smoke test: it opens a session, invokes the increment command, and the secure console narrates the TA load as it happens; optee_example_secure_storage additionally round-trips tee-supplicant's REE FS RPC through /var/lib/tee.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}