[PATCH 1/4] ARM: i.MX8M: add option to install OP-TEE

[PATCH 1/4] ARM: i.MX8M: add option to install OP-TEE

[Ahmad Fatoum]

While infrastructure for installing OP-TEE was already there, no
upstream boards made use of it. Let's have OP-TEE installation happen in
generic code, so it may be enabled for any upstream board.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/mach-imx/atf.c                | 50 ++++++++++++++++++++------
 arch/arm/mach-imx/include/mach/xload.h | 16 +++++++++
 firmware/.gitignore                    |  1 +
 firmware/Kconfig                       | 12 +++++++
 firmware/Makefile                      |  9 +++--
 5 files changed, 74 insertions(+), 14 deletions(-)

diff --git a/arch/arm/mach-imx/atf.c b/arch/arm/mach-imx/atf.c
index 2a3e3f53b885..640881afaaca 100644
--- a/arch/arm/mach-imx/atf.c
+++ b/arch/arm/mach-imx/atf.c
@@ -7,6 +7,9 @@
 #include <mach/generic.h>
 #include <mach/xload.h>
 #include <mach/romapi.h>
+#include <mach/esdctl.h>
+#include <asm-generic/memory_layout.h>
+#include <asm/barebox-arm.h>
 #include <soc/fsl/fsl_udc.h>
 #include <soc/fsl/caam.h>
 
@@ -133,9 +136,17 @@ void imx8mm_load_bl33(void *bl33)
 
 __noreturn void imx8mm_load_and_start_image_via_tfa(void)
 {
-	imx8mm_save_bootrom_log();
-	imx8mm_load_bl33((void *)MX8M_ATF_BL33_BASE_ADDR);
-	imx8mm_load_and_start_tfa(imx8mm_bl31_bin);
+	void *bl33 = (void *)MX8M_ATF_BL33_BASE_ADDR;
+	void *endmem = (void *)MX8M_DDR_CSD1_BASE_ADDR +
+		imx8m_barebox_earlymem_size(32);
+
+	imx8m_save_bootrom_log(__arm_mem_scratch(endmem));
+	imx8mm_load_bl33(bl33);
+
+	if (IS_ENABLED(CONFIG_FIRMWARE_IMX8MM_OPTEE))
+		imx8m_load_and_start_optee_via_tfa(imx8mm, endmem - OPTEE_SIZE, bl33);
+	else
+		imx8mm_load_and_start_tfa(imx8mm_bl31_bin);
 }
 
 void imx8mp_load_bl33(void *bl33)
@@ -168,13 +179,22 @@ void imx8mp_load_bl33(void *bl33)
 	memcpy(bl33, __image_start, barebox_pbl_size);
 }
 
-void imx8mp_load_and_start_image_via_tfa(void)
+__noreturn void imx8mp_load_and_start_image_via_tfa(void)
 {
-	imx8mp_save_bootrom_log();
-	imx8mp_load_bl33((void *)MX8M_ATF_BL33_BASE_ADDR);
-	imx8mp_load_and_start_tfa(imx8mp_bl31_bin);
+	void *bl33 = (void *)MX8M_ATF_BL33_BASE_ADDR;
+	void *endmem = (void *)MX8M_DDR_CSD1_BASE_ADDR +
+		imx8m_barebox_earlymem_size(32);
+
+	imx8m_save_bootrom_log(__arm_mem_scratch(endmem));
+	imx8mp_load_bl33(bl33);
+
+	if (IS_ENABLED(CONFIG_FIRMWARE_IMX8MP_OPTEE))
+		imx8m_load_and_start_optee_via_tfa(imx8mp, endmem - OPTEE_SIZE, bl33);
+	else
+		imx8mp_load_and_start_tfa(imx8mp_bl31_bin);
 }
 
+
 void imx8mn_load_bl33(void *bl33)
 {
 	enum bootsource src;
@@ -205,9 +225,17 @@ void imx8mn_load_bl33(void *bl33)
 	memcpy(bl33, __image_start, barebox_pbl_size);
 }
 
-void imx8mn_load_and_start_image_via_tfa(void)
+__noreturn void imx8mn_load_and_start_image_via_tfa(void)
 {
-	imx8mn_save_bootrom_log();
-	imx8mn_load_bl33((void *)MX8M_ATF_BL33_BASE_ADDR);
-	imx8mn_load_and_start_tfa(imx8mn_bl31_bin);
+	void *bl33 = (void *)MX8M_ATF_BL33_BASE_ADDR;
+	void *endmem = (void *)MX8M_DDR_CSD1_BASE_ADDR +
+		imx8m_barebox_earlymem_size(16);
+
+	imx8m_save_bootrom_log(__arm_mem_scratch(endmem));
+	imx8mn_load_bl33(bl33);
+
+	if (IS_ENABLED(CONFIG_FIRMWARE_IMX8MN_OPTEE))
+		imx8m_load_and_start_optee_via_tfa(imx8mn, endmem - OPTEE_SIZE, bl33);
+	else
+		imx8mn_load_and_start_tfa(imx8mn_bl31_bin);
 }
diff --git a/arch/arm/mach-imx/include/mach/xload.h b/arch/arm/mach-imx/include/mach/xload.h
index aa2fa5129a11..713fc1a8fcb7 100644
--- a/arch/arm/mach-imx/include/mach/xload.h
+++ b/arch/arm/mach-imx/include/mach/xload.h
@@ -5,6 +5,7 @@
 
 #include <linux/compiler.h>
 #include <linux/types.h>
+#include <mach/tzasc.h>
 
 int imx53_nand_start_image(void);
 int imx6_spi_load_image(int instance, unsigned int flash_offset, void *buf, int len);
@@ -42,4 +43,19 @@ struct imx_scratch_space *__imx8m_scratch_space(int ddr_buswidth);
 #define imx8mn_scratch_space() __imx8m_scratch_space(16)
 #define imx8mp_scratch_space() __imx8m_scratch_space(32)
 
+#define imx8m_load_and_start_optee_via_tfa(soc, bl32, bl33)	\
+do {								\
+	size_t bl32_size;					\
+	void *bl32_image;					\
+								\
+	soc##_tzc380_init();					\
+	get_builtin_firmware_ext(soc##_bl32_bin,		\
+				 bl33, &bl32_image,		\
+				 &bl32_size);			\
+								\
+	memcpy(bl32, bl32_image, bl32_size);			\
+								\
+	soc##_load_and_start_tfa(soc##_bl31_bin_optee);		\
+} while (0)
+
 #endif /* __MACH_XLOAD_H */
diff --git a/firmware/.gitignore b/firmware/.gitignore
index 4f3e56d8b719..8f9a956eb661 100644
--- a/firmware/.gitignore
+++ b/firmware/.gitignore
@@ -1,3 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0-only
 
 *.bin
+*.bin-optee
diff --git a/firmware/Kconfig b/firmware/Kconfig
index 1a5e1bf5142a..a12a8f304476 100644
--- a/firmware/Kconfig
+++ b/firmware/Kconfig
@@ -24,6 +24,18 @@ config FIRMWARE_IMX8MP_ATF
 config FIRMWARE_IMX8MQ_ATF
 	bool
 
+config FIRMWARE_IMX8MM_OPTEE
+	bool "install OP-TEE on i.MX8MM boards"
+	depends on FIRMWARE_IMX8MM_ATF && PBL_OPTEE
+
+config FIRMWARE_IMX8MN_OPTEE
+	bool "install OP-TEE on i.MX8MN boards"
+	depends on FIRMWARE_IMX8MN_ATF && PBL_OPTEE
+
+config FIRMWARE_IMX8MP_OPTEE
+	bool "install OP-TEE on i.MX8MP boards"
+	depends on FIRMWARE_IMX8MP_ATF && PBL_OPTEE
+
 config FIRMWARE_CCBV2_OPTEE
 	bool
 	depends on MACH_WEBASTO_CCBV2 && PBL_OPTEE
diff --git a/firmware/Makefile b/firmware/Makefile
index da341871d681..984192f030bb 100644
--- a/firmware/Makefile
+++ b/firmware/Makefile
@@ -12,10 +12,13 @@ firmware-$(CONFIG_FIRMWARE_IMX_DDR4_PMU_TRAIN) += \
 	ddr4_imem_1d.bin \
 	ddr4_imem_2d.bin
 
-firmware-$(CONFIG_FIRMWARE_IMX8MM_ATF) += imx8mm-bl31.bin
-firmware-$(CONFIG_FIRMWARE_IMX8MN_ATF) += imx8mn-bl31.bin
-firmware-$(CONFIG_FIRMWARE_IMX8MP_ATF) += imx8mp-bl31.bin
+firmware-$(CONFIG_FIRMWARE_IMX8MM_ATF) += imx8mm-bl31.bin$(if $(CONFIG_FIRMWARE_IMX8MM_OPTEE),-optee,)
+firmware-$(CONFIG_FIRMWARE_IMX8MN_ATF) += imx8mn-bl31.bin$(if $(CONFIG_FIRMWARE_IMX8MN_OPTEE),-optee,)
+firmware-$(CONFIG_FIRMWARE_IMX8MP_ATF) += imx8mp-bl31.bin$(if $(CONFIG_FIRMWARE_IMX8MP_OPTEE),-optee,)
 firmware-$(CONFIG_FIRMWARE_IMX8MQ_ATF) += imx8mq-bl31.bin
+fw-external-$(CONFIG_FIRMWARE_IMX8MM_OPTEE) += imx8mm-bl32.bin
+fw-external-$(CONFIG_FIRMWARE_IMX8MN_OPTEE) += imx8mn-bl32.bin
+fw-external-$(CONFIG_FIRMWARE_IMX8MP_OPTEE) += imx8mp-bl32.bin
 firmware-$(CONFIG_ARCH_RK3568) += rk3568-bl31.bin
 firmware-$(CONFIG_ARCH_RK3568_OPTEE) += rk3568-op-tee.bin
 firmware-$(CONFIG_ARCH_RK3399) += rk3399-bl31.bin
-- 
2.30.2

[PATCH 2/4] drivers: implement of_optee_fixup helper function

[Ahmad Fatoum]

This function can be called by board-code after checking whether OP-TEE
was installed or not.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/include/asm/optee.h | 18 ++++++++++++++++
 drivers/Makefile             |  1 +
 drivers/tee/optee/of.c       | 42 ++++++++++++++++++++++++++++++++++++
 3 files changed, 61 insertions(+)
 create mode 100644 arch/arm/include/asm/optee.h
 create mode 100644 drivers/tee/optee/of.c

diff --git a/arch/arm/include/asm/optee.h b/arch/arm/include/asm/optee.h
new file mode 100644
index 000000000000..f8eb7b4a8b0f
--- /dev/null
+++ b/arch/arm/include/asm/optee.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#ifndef __ARM_OPTEE_H__
+#define __ARM_OPTEE_H__
+
+#include <linux/types.h>
+
+struct device_node;
+
+struct of_optee_fixup_data {
+	const char *method;
+	size_t shm_size;
+};
+
+int of_optee_fixup(struct device_node *root, void *fixup_data);
+
+#endif /* __ARM_OPTEE_H__ */
+
diff --git a/drivers/Makefile b/drivers/Makefile
index 10ec145be5e5..be2f736eb188 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -47,3 +47,4 @@ obj-y	+= ddr/
 obj-y	+= power/
 obj-$(CONFIG_SOUND) += sound/
 obj-y	+= virtio/
+obj-$(CONFIG_HAVE_OPTEE)	+= tee/optee/of.o
diff --git a/drivers/tee/optee/of.c b/drivers/tee/optee/of.c
new file mode 100644
index 000000000000..8295a1751c52
--- /dev/null
+++ b/drivers/tee/optee/of.c
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <of.h>
+#include <linux/ioport.h>
+#include <asm/barebox-arm.h>
+#include <asm/optee.h>
+
+int of_optee_fixup(struct device_node *root, void *_data)
+{
+	struct of_optee_fixup_data *fixup_data = _data;
+	struct resource res = {};
+	struct device_node *node;
+	int ret;
+
+	node = of_create_node(root, "/firmware/optee");
+	if (!node)
+		return -ENOMEM;
+
+	ret = of_property_write_string(node, "compatible", "linaro,optee-tz");
+	if (ret)
+		return ret;
+
+	ret = of_property_write_string(node, "method", fixup_data->method);
+	if (ret)
+		return ret;
+
+	res.start = arm_mem_endmem_get() - OPTEE_SIZE;
+	res.end = arm_mem_endmem_get() - fixup_data->shm_size -1;
+	res.flags = IORESOURCE_BUSY;
+	res.name = "optee_core";
+
+	ret = of_fixup_reserved_memory(root, &res);
+	if (ret)
+		return ret;
+
+	res.start = arm_mem_endmem_get() - fixup_data->shm_size;
+	res.end = arm_mem_endmem_get() - 1;
+	res.flags &= ~IORESOURCE_BUSY;
+	res.name = "optee_shm";
+
+	return of_fixup_reserved_memory(root, &res);
+}
-- 
2.30.2

[PATCH 3/4] ARM: i.MX8M: fixup op-tee nodes

[Ahmad Fatoum]

barebox PBL will only enable Trust Zone Address Space Controller when it
installs OP-TEE, thus take this as an indication that both barebox and
kernel device tree should be patched with an OP-TEE node.

Users not wishing this to happen may disable CONFIG_PBL_OPTEE.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/mach-imx/imx8m.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/arch/arm/mach-imx/imx8m.c b/arch/arm/mach-imx/imx8m.c
index 7f3856e545c7..b90e5501b82e 100644
--- a/arch/arm/mach-imx/imx8m.c
+++ b/arch/arm/mach-imx/imx8m.c
@@ -2,6 +2,9 @@
 
 #include <init.h>
 #include <common.h>
+#include <asm/optee.h>
+#include <linux/sizes.h>
+#include <mach/tzasc.h>
 #include <io.h>
 #include <asm/syscounter.h>
 #include <asm/system.h>
@@ -70,6 +73,17 @@ static int imx8m_init(const char *cputypestr)
 			pr_info("i.MX ARM Trusted Firmware: %s\n", (char *)&res.a0);
 	}
 
+	if (IS_ENABLED(CONFIG_PBL_OPTEE) && tzc380_is_enabled() &&
+	    !of_find_node_by_path_from(NULL, "/firmware/optee")) {
+		static struct of_optee_fixup_data optee_fixup_data = {
+			.shm_size = SZ_4M,
+			.method = "smc",
+		};
+
+		of_optee_fixup(of_get_root_node(), &optee_fixup_data);
+		of_register_fixup(of_optee_fixup, &optee_fixup_data);
+	}
+
 	return 0;
 }
 
-- 
2.30.2

[PATCH 4/4] drivers: drop unneeded CONFIG_CRYPTO_HW guard

[Ahmad Fatoum]

CAAM and imx-scc both have their own Kconfig symbols, so
CONFIG_CRYPTO_HW only serves the purpose of hiding a two entry
menu behind it. Let's just get rid of it. This has the added benefit of
being able to use imply on the drivers.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/Makefile       | 2 +-
 drivers/crypto/Kconfig | 7 ++-----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/Makefile b/drivers/Makefile
index be2f736eb188..41a2054db083 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -38,7 +38,7 @@ obj-$(CONFIG_FIRMWARE) += firmware/
 obj-$(CONFIG_FPGA) += fpga/
 obj-$(CONFIG_GENERIC_PHY) += phy/
 obj-$(CONFIG_HAB) += hab/
-obj-$(CONFIG_CRYPTO_HW) += crypto/
+obj-y += crypto/
 obj-$(CONFIG_AIODEV) += aiodev/
 obj-y	+= memory/
 obj-y	+= soc/
diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index 6b7966e5c216..594c79127382 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -1,11 +1,8 @@
 # SPDX-License-Identifier: GPL-2.0-only
 
-menuconfig CRYPTO_HW
-	bool "Hardware crypto devices"
-
-if CRYPTO_HW
+menu "Hardware crypto devices"
 
 source "drivers/crypto/caam/Kconfig"
 source "drivers/crypto/imx-scc/Kconfig"
 
-endif
+endmenu
-- 
2.30.2

Re: [PATCH 1/4] ARM: i.MX8M: add option to install OP-TEE

[Sascha Hauer]

On Tue, Mar 07, 2023 at 10:34:23AM +0100, Ahmad Fatoum wrote:
> While infrastructure for installing OP-TEE was already there, no
> upstream boards made use of it. Let's have OP-TEE installation happen in
> generic code, so it may be enabled for any upstream board.
> 
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> ---
>  arch/arm/mach-imx/atf.c                | 50 ++++++++++++++++++++------
>  arch/arm/mach-imx/include/mach/xload.h | 16 +++++++++
>  firmware/.gitignore                    |  1 +
>  firmware/Kconfig                       | 12 +++++++
>  firmware/Makefile                      |  9 +++--
>  5 files changed, 74 insertions(+), 14 deletions(-)

Applied, thanks

Sascha

> 
> diff --git a/arch/arm/mach-imx/atf.c b/arch/arm/mach-imx/atf.c
> index 2a3e3f53b885..640881afaaca 100644
> --- a/arch/arm/mach-imx/atf.c
> +++ b/arch/arm/mach-imx/atf.c
> @@ -7,6 +7,9 @@
>  #include <mach/generic.h>
>  #include <mach/xload.h>
>  #include <mach/romapi.h>
> +#include <mach/esdctl.h>
> +#include <asm-generic/memory_layout.h>
> +#include <asm/barebox-arm.h>
>  #include <soc/fsl/fsl_udc.h>
>  #include <soc/fsl/caam.h>
>  
> @@ -133,9 +136,17 @@ void imx8mm_load_bl33(void *bl33)
>  
>  __noreturn void imx8mm_load_and_start_image_via_tfa(void)
>  {
> -	imx8mm_save_bootrom_log();
> -	imx8mm_load_bl33((void *)MX8M_ATF_BL33_BASE_ADDR);
> -	imx8mm_load_and_start_tfa(imx8mm_bl31_bin);
> +	void *bl33 = (void *)MX8M_ATF_BL33_BASE_ADDR;
> +	void *endmem = (void *)MX8M_DDR_CSD1_BASE_ADDR +
> +		imx8m_barebox_earlymem_size(32);
> +
> +	imx8m_save_bootrom_log(__arm_mem_scratch(endmem));
> +	imx8mm_load_bl33(bl33);
> +
> +	if (IS_ENABLED(CONFIG_FIRMWARE_IMX8MM_OPTEE))
> +		imx8m_load_and_start_optee_via_tfa(imx8mm, endmem - OPTEE_SIZE, bl33);
> +	else
> +		imx8mm_load_and_start_tfa(imx8mm_bl31_bin);
>  }
>  
>  void imx8mp_load_bl33(void *bl33)
> @@ -168,13 +179,22 @@ void imx8mp_load_bl33(void *bl33)
>  	memcpy(bl33, __image_start, barebox_pbl_size);
>  }
>  
> -void imx8mp_load_and_start_image_via_tfa(void)
> +__noreturn void imx8mp_load_and_start_image_via_tfa(void)
>  {
> -	imx8mp_save_bootrom_log();
> -	imx8mp_load_bl33((void *)MX8M_ATF_BL33_BASE_ADDR);
> -	imx8mp_load_and_start_tfa(imx8mp_bl31_bin);
> +	void *bl33 = (void *)MX8M_ATF_BL33_BASE_ADDR;
> +	void *endmem = (void *)MX8M_DDR_CSD1_BASE_ADDR +
> +		imx8m_barebox_earlymem_size(32);
> +
> +	imx8m_save_bootrom_log(__arm_mem_scratch(endmem));
> +	imx8mp_load_bl33(bl33);
> +
> +	if (IS_ENABLED(CONFIG_FIRMWARE_IMX8MP_OPTEE))
> +		imx8m_load_and_start_optee_via_tfa(imx8mp, endmem - OPTEE_SIZE, bl33);
> +	else
> +		imx8mp_load_and_start_tfa(imx8mp_bl31_bin);
>  }
>  
> +
>  void imx8mn_load_bl33(void *bl33)
>  {
>  	enum bootsource src;
> @@ -205,9 +225,17 @@ void imx8mn_load_bl33(void *bl33)
>  	memcpy(bl33, __image_start, barebox_pbl_size);
>  }
>  
> -void imx8mn_load_and_start_image_via_tfa(void)
> +__noreturn void imx8mn_load_and_start_image_via_tfa(void)
>  {
> -	imx8mn_save_bootrom_log();
> -	imx8mn_load_bl33((void *)MX8M_ATF_BL33_BASE_ADDR);
> -	imx8mn_load_and_start_tfa(imx8mn_bl31_bin);
> +	void *bl33 = (void *)MX8M_ATF_BL33_BASE_ADDR;
> +	void *endmem = (void *)MX8M_DDR_CSD1_BASE_ADDR +
> +		imx8m_barebox_earlymem_size(16);
> +
> +	imx8m_save_bootrom_log(__arm_mem_scratch(endmem));
> +	imx8mn_load_bl33(bl33);
> +
> +	if (IS_ENABLED(CONFIG_FIRMWARE_IMX8MN_OPTEE))
> +		imx8m_load_and_start_optee_via_tfa(imx8mn, endmem - OPTEE_SIZE, bl33);
> +	else
> +		imx8mn_load_and_start_tfa(imx8mn_bl31_bin);
>  }
> diff --git a/arch/arm/mach-imx/include/mach/xload.h b/arch/arm/mach-imx/include/mach/xload.h
> index aa2fa5129a11..713fc1a8fcb7 100644
> --- a/arch/arm/mach-imx/include/mach/xload.h
> +++ b/arch/arm/mach-imx/include/mach/xload.h
> @@ -5,6 +5,7 @@
>  
>  #include <linux/compiler.h>
>  #include <linux/types.h>
> +#include <mach/tzasc.h>
>  
>  int imx53_nand_start_image(void);
>  int imx6_spi_load_image(int instance, unsigned int flash_offset, void *buf, int len);
> @@ -42,4 +43,19 @@ struct imx_scratch_space *__imx8m_scratch_space(int ddr_buswidth);
>  #define imx8mn_scratch_space() __imx8m_scratch_space(16)
>  #define imx8mp_scratch_space() __imx8m_scratch_space(32)
>  
> +#define imx8m_load_and_start_optee_via_tfa(soc, bl32, bl33)	\
> +do {								\
> +	size_t bl32_size;					\
> +	void *bl32_image;					\
> +								\
> +	soc##_tzc380_init();					\
> +	get_builtin_firmware_ext(soc##_bl32_bin,		\
> +				 bl33, &bl32_image,		\
> +				 &bl32_size);			\
> +								\
> +	memcpy(bl32, bl32_image, bl32_size);			\
> +								\
> +	soc##_load_and_start_tfa(soc##_bl31_bin_optee);		\
> +} while (0)
> +
>  #endif /* __MACH_XLOAD_H */
> diff --git a/firmware/.gitignore b/firmware/.gitignore
> index 4f3e56d8b719..8f9a956eb661 100644
> --- a/firmware/.gitignore
> +++ b/firmware/.gitignore
> @@ -1,3 +1,4 @@
>  # SPDX-License-Identifier: GPL-2.0-only
>  
>  *.bin
> +*.bin-optee
> diff --git a/firmware/Kconfig b/firmware/Kconfig
> index 1a5e1bf5142a..a12a8f304476 100644
> --- a/firmware/Kconfig
> +++ b/firmware/Kconfig
> @@ -24,6 +24,18 @@ config FIRMWARE_IMX8MP_ATF
>  config FIRMWARE_IMX8MQ_ATF
>  	bool
>  
> +config FIRMWARE_IMX8MM_OPTEE
> +	bool "install OP-TEE on i.MX8MM boards"
> +	depends on FIRMWARE_IMX8MM_ATF && PBL_OPTEE
> +
> +config FIRMWARE_IMX8MN_OPTEE
> +	bool "install OP-TEE on i.MX8MN boards"
> +	depends on FIRMWARE_IMX8MN_ATF && PBL_OPTEE
> +
> +config FIRMWARE_IMX8MP_OPTEE
> +	bool "install OP-TEE on i.MX8MP boards"
> +	depends on FIRMWARE_IMX8MP_ATF && PBL_OPTEE
> +
>  config FIRMWARE_CCBV2_OPTEE
>  	bool
>  	depends on MACH_WEBASTO_CCBV2 && PBL_OPTEE
> diff --git a/firmware/Makefile b/firmware/Makefile
> index da341871d681..984192f030bb 100644
> --- a/firmware/Makefile
> +++ b/firmware/Makefile
> @@ -12,10 +12,13 @@ firmware-$(CONFIG_FIRMWARE_IMX_DDR4_PMU_TRAIN) += \
>  	ddr4_imem_1d.bin \
>  	ddr4_imem_2d.bin
>  
> -firmware-$(CONFIG_FIRMWARE_IMX8MM_ATF) += imx8mm-bl31.bin
> -firmware-$(CONFIG_FIRMWARE_IMX8MN_ATF) += imx8mn-bl31.bin
> -firmware-$(CONFIG_FIRMWARE_IMX8MP_ATF) += imx8mp-bl31.bin
> +firmware-$(CONFIG_FIRMWARE_IMX8MM_ATF) += imx8mm-bl31.bin$(if $(CONFIG_FIRMWARE_IMX8MM_OPTEE),-optee,)
> +firmware-$(CONFIG_FIRMWARE_IMX8MN_ATF) += imx8mn-bl31.bin$(if $(CONFIG_FIRMWARE_IMX8MN_OPTEE),-optee,)
> +firmware-$(CONFIG_FIRMWARE_IMX8MP_ATF) += imx8mp-bl31.bin$(if $(CONFIG_FIRMWARE_IMX8MP_OPTEE),-optee,)
>  firmware-$(CONFIG_FIRMWARE_IMX8MQ_ATF) += imx8mq-bl31.bin
> +fw-external-$(CONFIG_FIRMWARE_IMX8MM_OPTEE) += imx8mm-bl32.bin
> +fw-external-$(CONFIG_FIRMWARE_IMX8MN_OPTEE) += imx8mn-bl32.bin
> +fw-external-$(CONFIG_FIRMWARE_IMX8MP_OPTEE) += imx8mp-bl32.bin
>  firmware-$(CONFIG_ARCH_RK3568) += rk3568-bl31.bin
>  firmware-$(CONFIG_ARCH_RK3568_OPTEE) += rk3568-op-tee.bin
>  firmware-$(CONFIG_ARCH_RK3399) += rk3399-bl31.bin
> -- 
> 2.30.2
> 
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |