On Fri, Mar 1, 2024 at 4:00 AM Manuel Traut manut@mecka.net wrote:

Used to embed the OPTEE OS binary into flash.bin so it can be detected and loaded by trusted-firmware-arm.

Signed-off-by: Manuel Traut manuel.traut@mt.com

arch/arm/dts/imx8mm-u-boot.dtsi | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)

diff --git a/arch/arm/dts/imx8mm-u-boot.dtsi b/arch/arm/dts/imx8mm-u-boot.dtsi index 06f2f73a03..8ca4515c9f 100644 --- a/arch/arm/dts/imx8mm-u-boot.dtsi +++ b/arch/arm/dts/imx8mm-u-boot.dtsi @@ -130,6 +130,22 @@ type = "atf-bl31"; }; };

+#ifdef CONFIG_OPTEE

•                           optee {
  

•                                           description = "OP-TEE";
  

•                                           type = "firmware";
  

•                                           arch = "arm";
  

•                                           os = "tee";
  

•                                           compression = "none";
  

•                                           load = <0xbe000000>;
  

•                                           entry = <0xbe000000>;
  

•                                           blob-ext {
  

•                                                           filename = "tee.bin";
  

•                                           };
  

•                           };
  

+#endif #endif

                            binman_fip: fip {

@@ -160,7 +176,11 @@ fdt = "fdt-SEQ"; firmware = "uboot"; #ifndef CONFIG_ARMV8_PSCI +#ifdef CONFIG_OPTEE

•                                   loadables = "atf", "optee";
  

+#else loadables = "atf"; +#endif #endif }; }; -- 2.43.0

Hi Manuel,

The load/entry address of 0xbe000000 you are using is only appropriate for a 2GiB DRAM config. You need to ensure that BL32_BASE used when building the ATF and CFG_TZDRAM_START used when building OPTEE match this address.

I have some documentation on this at [1] which assumes you have the patch I added [2] to our downstream U-Boot to put the address in a configurable variable

I submitted something similar a while back that does what your trying to do for imx8mm/imx8mn/imx8mp via a new config variable but the variable caused some issue [3] and needed some rework.

Could you look at that or explain to me why 0xbe000000 could work in all DRAM size cases?

Best Regards,

Tim [1] https://trac.gateworks.com/wiki/venice/secure_boot#OP-TEEonvenice [2] https://github.com/Gateworks/uboot-venice/commit/0bfe0f8155dc9c4f8ec370c5cbd... [3] https://lists.denx.de/pipermail/u-boot/2023-July/522513.html