[PATCH] arm64: dts: imx8m: Reinstate TEE ifdeffery

[Marek Vasut]

On 7/2/26 9:04 AM, Yannic Moog wrote:

Hello Yannic,

> On Tue, 2026-06-30 at 18:08 +0200, Marek Vasut wrote:
>> Since b57ed147939c ("dts: imx8m{m,n,p,q}: Make optee packaging optional")
>> the TEE node is always present in U-Boot proper fitImage, even if the
>> CONFIG_OPTEE is disabled because the u-boot.itb should not contain any
>> tee.bin. This is wasteful, and produces the following warning which is
>> also confusing to users:
>>
>> "
>> Image 'image' is missing optional external blobs but is still functional: tee-os
>>
>> /binman/section/fit/images/tee/tee-os (tee.bin):
>>     See the documentation for your board. You may need to build Open Portable
>>     Trusted Execution Environment (OP-TEE) and build with TEE=/path/to/tee.bin
>> "
>>
>> Reinstate the CONFIG_OPTEE ifdeffery to mitigate the problem, but retain the
>> binman "optional" keyword at tee.bin .
> 
> I disagree. You are removing a feature and cause further problems with this commit.

I tried to avoid outright reverting the offending commit b57ed147939c 
("dts: imx8m{m,n,p,q}: Make optee packaging optional") which introduced 
the problem I described above.

> Your initial assumption
> 
>> even if the
>> CONFIG_OPTEE is disabled because the u-boot.itb should not contain any
>> tee.bin
> 
> is not accurate. You were able to package OP-TEE without needing to enable support in U-Boot. And
> afaik this is a perfectly valid use-case.

When you include optee-os in the U-Boot fitImage, what do you do with 
that optee-os which U-Boot does not support ? Details please ?

> With this change you can no longer do that, so this change is a regression.
> 
> About the warning message. I understand that you find it confusing; binman is designed so that it
> emits a warning when an optional blob is not found.

Please see above.

> I prefer that approach to no message at all. You may want to package OP-TEE (e.g. you have an tf-a
> blob which jumps to OP-TEE addr) and being alerted to a possible mistake is important; Let's say
> tee path was incorrect during build.

Is this some sort of a board-specific configuration ?

Why does U-Boot not enable OPTEE-OS support in this case ?

> Also, keeping optional when using if defs is not a good idea. Binman will still build you an image
> when no OP-TEE blob is present, but should not since you enabled OPTEE configs. If you enable
> OPTEE, you should have an OP-TEE blob packaged.
> We could add ifndef OPTEE around the optional property.

The optional keyword is actually kept in this case, it is not a full revert.

You did however miss one vital point -- the tee node is part of the 
U-boot fitImage, even if the tee.bin binary is not present and OPTEE 
support in U-Boot is disabled. Binman prints a confusing message, and 
generates a bogus empty tee {} node in the fitImage. That is incorrect.