Re: IMX8M OP-TEE

On Mon, Oct 11, 2021 at 3:29 PM Marcel Ziswiler marcel.ziswiler@toradex.com wrote:

Hi Tim

On Mon, 2021-10-11 at 15:15 -0700, Tim Harvey wrote:

...

Greetings,

Is anyone successfully booting U-Boot with OP-TEE support on the IMX8M?

I am not aware that anybody at Toradex played with OP-TEE so far but let me ask around again.

However, maybe Igor or Oleksandr (added to CC, now both with Foundries) might have some experience. I know that Igor used to work on this kind of stuff.

...

My understanding is that you need to add tee.bin to the images in the FIT image and include it in loadables following the ATF.

While this was done with arch/arm/mach-imx/mkimage_fit_atf.sh before the switch to binman by simply having tee.bin in the U-Boot directory and passing in TEE_LOAD_ADDR (or accepting the default of 0xfe000000) once you switch to binman it needs to be added for your board.

Additionally in order to use OP-TEE from U-Boot (ie for dek_blob command) you need to add a node with compatible=linaro,optee-tz as well.

I've done the following to add OP-TEE for imx8mm_venice: diff --git a/configs/imx8mm_venice_defconfig b/configs/imx8mm_venice_defconfig index d85827b588..85d2b20810 100644 -u-boot.dtsi index e0fa9ff4bf..7a71b974e1 100644 --- a/arch/arm/dts/imx8mm-venice-u-boot.dtsi +++ b/arch/arm/dts/imx8mm-venice-u-boot.dtsi @@ -10,6 +10,13 @@ multiple-images; };

•   firmware {
  

•           optee {
  

•                   compatible = "linaro,optee-tz";
  

•                   method = "smc";
  

•           };
  

•   };
  

•   wdt-reboot {
            compatible = "wdt-reboot";
            wdt = <&wdog1>;
  

@@ -152,6 +159,16 @@ }; };

•                           tee {
  

•                                   description = "TEE firmware";
  

•                                   type = "firmware";
  

•                                   arch = "arm64";
  

•                                   compression = "none";
  

•                                   data = "tee.bin";
  

•                                   load = <0xbe000000>;
  

•                                   entry = <0xbe000000>;
  

•                           };
  

•                           @fdt-SEQ {
                                    description = "NAME";
                                    type = "flat_dt";
  

@@ -165,7 +182,7 @@ @config-SEQ { description = "NAME"; firmware = "uboot";

•                                   loadables = "atf";
  

•                                   loadables = "atf", "tee";
                                    fdt = "fdt-SEQ";
                            };
                    };
  
  
  

However, when I attempt to boot I hang when the ATF is run.

Where does the TEE_LOAD_ADDR come from specifically? I would think this needs to be defined when building tee and needs to match the load address used in the FIT image. It appears that perhaps this is supped to be DDR_BASE + DDR_SIZE - 32MIB but I'm not entirely sure.

I'm currently using NXP's ATF (imx_5.4.3_2.0.0) and NXP's TEE (imx_5.4.70_2.3.0) and would also like to understand if NXP's branches are strictly required here and if so what the pros and cons of using them are.

Anyone using IMX8MM OP-TEE that could point me in the right direction?

Best regards,

Tim

BTW: Have you tried my latest stuff [1] on venice? Did/does it work? And yeah, my cover letter subject is slightly misleading as I forgot to update that one (;-p).

Marcel,

Thanks for checking into OP-TEE for me.

I haven't tested your series yet as I tried to apply it and it failed. Do you have a git repo I can cherry-pick from or what did you base it on top of?

Thanks,

Tim