IMX8M OP-TEE

12 Oct 2021

Greetings,
Is anyone successfully booting U-Boot with OP-TEE support on the IMX8M?
My understanding is that you need to add tee.bin to the images in the
FIT image and include it in loadables following the ATF.
While this was done with arch/arm/mach-imx/mkimage_fit_atf.sh before
the switch to binman by simply having tee.bin in the U-Boot directory
and passing in TEE_LOAD_ADDR (or accepting the default of 0xfe000000)
once you switch to binman it needs to be added for your board.
Additionally in order to use OP-TEE from U-Boot (ie for dek_blob
command) you need to add a node with compatible=linaro,optee-tz as
well.
I've done the following to add OP-TEE for imx8mm_venice:

diff --git a/configs/imx8mm_venice_defconfig b/configs/imx8mm_venice_defconfig
index d85827b588..85d2b20810 100644
-u-boot.dtsi
index e0fa9ff4bf..7a71b974e1 100644
--- a/arch/arm/dts/imx8mm-venice-u-boot.dtsi
+++ b/arch/arm/dts/imx8mm-venice-u-boot.dtsi
@@ -10,6 +10,13 @@
                multiple-images;
        };
+       firmware {
+               optee {
+                       compatible = "linaro,optee-tz";
+                       method = "smc";
+               };
+       };
+
        wdt-reboot {
                compatible = "wdt-reboot";
                wdt = <&wdog1>;
@@ -152,6 +159,16 @@
                                        };
                                };
+                               tee {
+                                       description = "TEE firmware";
+                                       type = "firmware";
+                                       arch = "arm64";
+                                       compression = "none";
+                                       data = "tee.bin";
+                                       load = <0xbe000000>;
+                                       entry = <0xbe000000>;
+                               };
+
                                @fdt-SEQ {
                                        description = "NAME";
                                        type = "flat_dt";
@@ -165,7 +182,7 @@
                                @config-SEQ {
                                        description = "NAME";
                                        firmware = "uboot";
-                                       loadables = "atf";
+                                       loadables = "atf", "tee";
                                        fdt = "fdt-SEQ";
                                };
                        };
However, when I attempt to boot I hang when the ATF is run.
Where does the TEE_LOAD_ADDR come from specifically? I would think
this needs to be defined when building tee and needs to match the load
address used in the FIT image. It appears that perhaps this is supped
to be DDR_BASE + DDR_SIZE - 32MIB but I'm not entirely sure.
I'm currently using NXP's ATF (imx_5.4.3_2.0.0) and NXP's TEE
(imx_5.4.70_2.3.0) and would also like to understand if NXP's branches
are strictly required here and if so what the pros and cons of using
them are.
Anyone using IMX8MM OP-TEE that could point me in the right direction?
Best regards,
Tim

    

IMX8M OP-TEE

Tim Harvey