i.MX ProcessorsのトピックRe: Handling OpTEE binary header with Arm Trusted Firmware on iMX8M

Handling OpTEE binary header with Arm Trusted Firmware on iMX8M

NeilShipp-MSFT — Thu, 27 Sep 2018 20:49:04 GMT

I'm attempting to load OpTEE on the MCIMX8MEVK board and am having an issue with the image loading.

The build process for OpTEE on https://source.codeaurora.org/external/imx/imx-optee-os/tree/core/arch/arm/kernel/link.mk?h=imx_4.9.88_2.0.0_ga produces a tee.bin with a 24 byte header, and two more files tee-pager.bin and a zero length tee-pageable.bin. The mkimage build process on https://source.codeaurora.org/external/imx/imx-mkimage/tree/iMX8M/mkimage_fit_atf.sh?h=imx_4.9.123_imx8mm_ga looks for a tee.bin and puts it into the fit unchanged. Finally the opteed_setup code in https://source.codeaurora.org/external/imx/imx-atf/tree/services/spd/opteed/opteed_main.c?h=imx_4.9.123_imx8mm_ga assumes that there's no header and uses the binary as is. This results in the processor attempting to execute the header block.

I can resolve this by using the tee-pager.bin file as the input to mkimage, but this throws away the header information. And will cause problems if data is moved into the tee-pageable.bin file. The change to handle this header has been available since 2014 in the Linaro-SecureWorkingGroup tree, https://github.com/linaro-swg/arm-trusted-firmware/commit/f6244e85df1d931e2ed6bd80e76fbf05a1b32f23#diff-5b5a3d8c61b39e1fe27ee096c7bc41ee which checks for the header and shifts the memory region. In NXP's https://source.codeaurora.org/external/imx/imx-atf/tree/lib/optee/optee_utils.c?h=imx_4.9.123_imx8mm_ga there is code that reads the OpTEE header, but it is only used by arm_bl2_setup.c which isn't built using the current yocto recipes.

I'm wondering it is NXP's plan to merge this change to the ATF opteed SPD, or to what their recommendation is for using OpTEE on imx8m?

Re: Handling OpTEE binary header with Arm Trusted Firmware on iMX8M

diegoadrian — Wed, 10 Oct 2018 16:50:09 GMT

I apologize for the late answer.

Are using the script imx_build.sh for building the imx-optee-os project?

/external-link.jspa?url=https%3A%2F%2Fsource.codeaurora.org%2Fexternal%2Fimx%2Fimx-optee-os%2Ftree%2Fscripts%2Fimx_build.sh%3Fh%3Dimx_4.9.51_imx8m_ga

imx_build.sh\scripts - imx-optee-os - i.MX optee os

On i.MX8MQ the header is not included tee.bin when built with this script, the only difference between the tee-pager.bin and tee.bin is a padding at the end of the binary.

Currently, we are not using the OP-TEE header as you pointed in the link below.

OP-TEE header · linaro-swg/arm-trusted-firmware@f6244e8 · GitHub

The recommended way to build a flash.bin image containing OP-TEE is explained in post below:
https://community.nxp.com/docs/DOC-340663

Just summarizing the process:

- U-Boot:
$ make imx8mq_evk_defconfig
$ make -j4
Copy u-boot.bin, u-boot-nodtb.bin, u-boot-spl.bin and fsl-imx8mq-evk.dtb to imx_mkimage/iMX8M/

- ATF:
$ make PLAT=imx8mq SPD=opteed bl31
Copy bl31.bin to imx_mkimage/iMX8M/

- OP-TEE:
$ ./scripts/imx_build.sh mx8mqevk
Copy tee.bin to imx_mkimage/iMX8M/

- Firmwares:
$ wget https://www.nxp.com/lgfiles/NMG/MAD/YOCTO/firmware-imx-7.6.bin
$ ./firmware-imx-7.6.bin
Copy lpddr4_pmu_train_*.bin and signed_hdmi_imx8m.bin to imx_mkimage/iMX8M/

- mkimage:
$ make SOC=iMX8M flash_evk

Please let me know if this help.

Best Regards,

Diego.

Re: Handling OpTEE binary header with Arm Trusted Firmware on iMX8M

NeilShipp-MSFT — Mon, 26 Nov 2018 20:28:18 GMT

Thank you for your response. Unfortunately, I don't have access to the document you linked to: https://community.nxp.com/docs/DOC-340663

However your pointer to the imx_build.sh script shows how to build a unified tee.bin file. Thank you.

Neil.