[PATCH 1/2] boards: qemu-virt: drop unused __dtb_fitimage_pubkey_start

[PATCH 1/2] boards: qemu-virt: drop unused __dtb_fitimage_pubkey_start

[Ahmad Fatoum]

Commit f018a6e4606e ("boards: qemu-virt: drop fitimage-pubkey.dts") has
removed the reference to this symbol, so remove the unused/unusable
left-over declaration as well.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/boards/qemu-virt/board.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/common/boards/qemu-virt/board.c b/common/boards/qemu-virt/board.c
index 0c9cc1a75d3b..1e3b647f11e5 100644
--- a/common/boards/qemu-virt/board.c
+++ b/common/boards/qemu-virt/board.c
@@ -38,7 +38,6 @@ static inline void arm_virt_init(void) {}
 #endif
 
 extern char __dtbo_qemu_virt_flash_start[];
-extern char __dtb_fitimage_pubkey_start[];
 
 static const struct of_device_id virt_of_match[] = {
 	{ .compatible = "linux,dummy-virt", .data = arm_virt_init },
-- 
2.47.3

[PATCH 2/2] boards: qemu-virt: add overlay for when first flash is secure-world only

[Ahmad Fatoum]

When booting with OP-TEE, the first flash will be off-limits when
barebox starts executing and the device tree will have the flash
directly start at 0x4000000.

Detect this case and apply a different device tree overlay that
references only the non-secure flash.

To test this, one needs to prepare a flash image for QEMU with TF-A and
barebox inside a FIP image.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/boards/qemu-virt/Makefile              |   2 +
 common/boards/qemu-virt/board.c               |   9 +-
 .../qemu-virt/qemu-virt-flash-nonsecure.dtso  |   8 ++
 common/boards/qemu-virt/qemu-virt-flash.dtsi  | 105 ++++++++++++++++++
 common/boards/qemu-virt/qemu-virt-flash.dtso  | 100 +----------------
 common/boards/qemu-virt/qemu-virt-flash.h     |   4 +
 6 files changed, 128 insertions(+), 100 deletions(-)
 create mode 100644 common/boards/qemu-virt/qemu-virt-flash-nonsecure.dtso
 create mode 100644 common/boards/qemu-virt/qemu-virt-flash.dtsi

diff --git a/common/boards/qemu-virt/Makefile b/common/boards/qemu-virt/Makefile
index 457ee5cdc6c9..8d0cf2773402 100644
--- a/common/boards/qemu-virt/Makefile
+++ b/common/boards/qemu-virt/Makefile
@@ -2,11 +2,13 @@
 
 obj-y += board.o commandline.o
 obj-y += qemu-virt-flash.dtbo.o
+obj-$(CONFIG_ARM) += qemu-virt-flash-nonsecure.dtbo.o
 ifeq ($(CONFIG_RISCV),y)
 DTC_CPP_FLAGS_qemu-virt-flash.dtbo := -DCONFIG_RISCV
 endif
 ifeq ($(CONFIG_ARM),y)
 DTC_CPP_FLAGS_qemu-virt-flash.dtbo := -DCONFIG_ARM
+DTC_CPP_FLAGS_qemu-virt-flash-nonsecure.dtbo := -DCONFIG_ARM
 endif
 
 policy-y += qemu-virt-factory.sconfig
diff --git a/common/boards/qemu-virt/board.c b/common/boards/qemu-virt/board.c
index 1e3b647f11e5..f2f7beec35db 100644
--- a/common/boards/qemu-virt/board.c
+++ b/common/boards/qemu-virt/board.c
@@ -38,6 +38,7 @@ static inline void arm_virt_init(void) {}
 #endif
 
 extern char __dtbo_qemu_virt_flash_start[];
+extern char __dtbo_qemu_virt_flash_nonsecure_start[];
 
 static const struct of_device_id virt_of_match[] = {
 	{ .compatible = "linux,dummy-virt", .data = arm_virt_init },
@@ -73,8 +74,14 @@ static int virt_board_driver_init(void)
 	 * configurations, where the first flash bank is secure-world only
 	 */
 	flash = of_find_node_by_path(PARTS_TARGET_PATH_STR);
-	if (flash && of_device_is_available(flash))
+	if (flash && of_device_is_available(flash)) {
 		of_overlay_apply_dtbo(root, __dtbo_qemu_virt_flash_start);
+	} else if (IS_ENABLED(CONFIG_ARM)) {
+		flash = of_find_node_by_path("/flash@4000000");
+		if (flash && of_device_is_available(flash))
+			of_overlay_apply_dtbo(root, __dtbo_qemu_virt_flash_nonsecure_start);
+	}
+
 
 	/* fragment may have added aliases to the DT */
 	of_alias_scan();
diff --git a/common/boards/qemu-virt/qemu-virt-flash-nonsecure.dtso b/common/boards/qemu-virt/qemu-virt-flash-nonsecure.dtso
new file mode 100644
index 000000000000..9a0c9442145b
--- /dev/null
+++ b/common/boards/qemu-virt/qemu-virt-flash-nonsecure.dtso
@@ -0,0 +1,8 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+/dts-v1/;
+/plugin/;
+
+#define USE_NONSECURE_SECOND_FLASH
+
+#include "qemu-virt-flash.dtsi"
diff --git a/common/boards/qemu-virt/qemu-virt-flash.dtsi b/common/boards/qemu-virt/qemu-virt-flash.dtsi
new file mode 100644
index 000000000000..582c213c948e
--- /dev/null
+++ b/common/boards/qemu-virt/qemu-virt-flash.dtsi
@@ -0,0 +1,105 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+/dts-v1/;
+/plugin/;
+
+#include "qemu-virt-flash.h"
+
+&{PARTS_TARGET_PATH} {
+#ifdef VIRTUAL_REG
+	virtual-reg = <VIRTUAL_REG>;
+#endif
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "initramfs";
+			reg = <0x0 0x3c00000>;
+		};
+
+		environment_flash: partition@3c00000 {
+			label = "barebox-environment";
+			reg = <0x3c00000 0x200000>;
+		};
+
+		backend_state_flash: partition@3e00000 {
+			label = "barebox-state";
+			reg = <0x3e00000 0x200000>;
+		};
+	};
+};
+
+&{/chosen} {
+	environment {
+		compatible = "barebox,environment";
+		device-path = ENV_DEVICE_PATH_STR;
+	};
+};
+
+&{/} {
+	aliases {
+		state = "/state";
+	};
+
+	state {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "barebox,state";
+		magic = <0x290cf8c6>;
+		backend-type = "raw";
+		backend = < &backend_state_flash >;
+		backend-stridesize = <0x200>;
+
+		bootstate {
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			system0 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				remaining_attempts@0 {
+					reg = <0x0 0x4>;
+					type = "uint32";
+					default = <3>;
+				};
+
+				priority@4 {
+					reg = <0x4 0x4>;
+					type = "uint32";
+					default = <20>;
+				};
+			};
+
+			system1 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				remaining_attempts@8 {
+					reg = <0x8 0x4>;
+					type = "uint32";
+					default = <0>;
+				};
+
+				priority@c {
+					reg = <0xc 0x4>;
+					type = "uint32";
+					default = <0>;
+				};
+			};
+
+			last_chosen@10 {
+				reg = <0x10 0x4>;
+				type = "uint32";
+			};
+
+			attempts_locked@14 {
+				reg = <0x14 0x4>;
+				type = "uint32";
+			};
+		};
+	};
+};
+
diff --git a/common/boards/qemu-virt/qemu-virt-flash.dtso b/common/boards/qemu-virt/qemu-virt-flash.dtso
index 0020ecfcea98..ac9fd34787a6 100644
--- a/common/boards/qemu-virt/qemu-virt-flash.dtso
+++ b/common/boards/qemu-virt/qemu-virt-flash.dtso
@@ -3,102 +3,4 @@
 /dts-v1/;
 /plugin/;
 
-#include "qemu-virt-flash.h"
-
-&{PARTS_TARGET_PATH} {
-#ifdef CONFIG_ARM
-	virtual-reg = <0x1000>;
-#endif
-	partitions {
-		compatible = "fixed-partitions";
-		#address-cells = <1>;
-		#size-cells = <1>;
-
-		partition@0 {
-			label = "initramfs";
-			reg = <0x0 0x3c00000>;
-		};
-
-		environment_flash: partition@3c00000 {
-			label = "barebox-environment";
-			reg = <0x3c00000 0x200000>;
-		};
-
-		backend_state_flash: partition@3e00000 {
-			label = "barebox-state";
-			reg = <0x3e00000 0x200000>;
-		};
-	};
-};
-
-&{/chosen} {
-	environment {
-		compatible = "barebox,environment";
-		device-path = ENV_DEVICE_PATH_STR;
-	};
-};
-
-&{/} {
-	aliases {
-		state = "/state";
-	};
-
-	state {
-		#address-cells = <1>;
-		#size-cells = <1>;
-		compatible = "barebox,state";
-		magic = <0x290cf8c6>;
-		backend-type = "raw";
-		backend = < &backend_state_flash >;
-		backend-stridesize = <0x200>;
-
-		bootstate {
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			system0 {
-				#address-cells = <1>;
-				#size-cells = <1>;
-
-				remaining_attempts@0 {
-					reg = <0x0 0x4>;
-					type = "uint32";
-					default = <3>;
-				};
-
-				priority@4 {
-					reg = <0x4 0x4>;
-					type = "uint32";
-					default = <20>;
-				};
-			};
-
-			system1 {
-				#address-cells = <1>;
-				#size-cells = <1>;
-
-				remaining_attempts@8 {
-					reg = <0x8 0x4>;
-					type = "uint32";
-					default = <0>;
-				};
-
-				priority@c {
-					reg = <0xc 0x4>;
-					type = "uint32";
-					default = <0>;
-				};
-			};
-
-			last_chosen@10 {
-				reg = <0x10 0x4>;
-				type = "uint32";
-			};
-
-			attempts_locked@14 {
-				reg = <0x14 0x4>;
-				type = "uint32";
-			};
-		};
-	};
-};
+#include "qemu-virt-flash.dtsi"
diff --git a/common/boards/qemu-virt/qemu-virt-flash.h b/common/boards/qemu-virt/qemu-virt-flash.h
index 85f67ff03057..e7c67b8e383a 100644
--- a/common/boards/qemu-virt/qemu-virt-flash.h
+++ b/common/boards/qemu-virt/qemu-virt-flash.h
@@ -8,9 +8,13 @@
 #ifdef CONFIG_RISCV
 #define PARTS_TARGET_PATH	/flash@20000000
 #define ENV_DEVICE_PATH		/flash@20000000/partitions/partition@3c00000
+#elif defined(CONFIG_ARM) && defined(USE_NONSECURE_SECOND_FLASH)
+#define PARTS_TARGET_PATH	/flash@4000000
+#define ENV_DEVICE_PATH		/flash@4000000/partitions/partition@0
 #elif defined CONFIG_ARM
 #define PARTS_TARGET_PATH	/flash@0
 #define ENV_DEVICE_PATH		/flash@0/partitions/partition@3c00000
+#define VIRTUAL_REG		0x1000
 #else
 #define PARTS_TARGET_PATH
 #define ENV_DEVICE_PATH
-- 
2.47.3

Re: [PATCH 1/2] boards: qemu-virt: drop unused __dtb_fitimage_pubkey_start

[Sascha Hauer]

On Fri, 16 Jan 2026 18:15:13 +0100, Ahmad Fatoum wrote:
> Commit f018a6e4606e ("boards: qemu-virt: drop fitimage-pubkey.dts") has
> removed the reference to this symbol, so remove the unused/unusable
> left-over declaration as well.
> 
> 

Applied, thanks!

[1/2] boards: qemu-virt: drop unused __dtb_fitimage_pubkey_start
      https://git.pengutronix.de/cgit/barebox/commit/?id=47872f98bace (link may not be stable)
[2/2] boards: qemu-virt: add overlay for when first flash is secure-world only
      https://git.pengutronix.de/cgit/barebox/commit/?id=6d8084554542 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>