topic Re: Loading OPTEE + Android (or Ubuntu) on Nitrogen8M mini (iMX8MM) in i.MX Processors

Loading OPTEE + Android (or Ubuntu) on Nitrogen8M mini (iMX8MM)

dariussuciu04 — Mon, 25 Oct 2021 23:22:53 GMT

Hello,

I am trying to load OPTEE in Secure World and Android in Normal World on a Boundary Devices Nitrogen8M Mini rev 2 board (from the iMX8MM family).

First I am trying to get OPTEE to work by following boot processes from similar posts. I have managed to load ATF + Ubuntu using a FIT image. However when trying to include OPTEE the boot process log stops when jumping into the OPTEE entry address.

Could you please help me with the correct build process or figure out what is causing the OPTEE load/boot to fail?

Is there a good way to figure out if OPTEE is not loaded at 0xbe000000 or if the the the problem is early in the OPTEE execution?

Is there a better (working) build process for loading OPTEE + Android/Ubuntu on this board?

My build process is the following:

IMX-ATF:

export ARCH=arm
export CROSS_COMPILE=${CROSS_COMPILE64}
make PLAT=imx8mm NEED_BL32=yes SPD=opteed BL32_BASE=0xbe000000 bl31

IMX-OPTEE:

export ARCH=arm
make CROSS_COMPILE=${CROSS_COMPILE} CROSS_COMPILE64=${CROSS_COMPILE64} \
PLATFORM=imx PLATFORM_FLAVOR=mx8mqevk CFG_TEE_CORE_LOG_LEVEL=4 CFG_IMG_ADDR=0xbe000000 \ CFG_IMG_ENTRY=0xbe000000 O=${O}/build.mx8mqevk && \
CFG_TEE_CORE_DEBUG=y CFG_RPMB_FS=y CFG_RPMB_TESTKEY=y CFG_RPMB_WRITE_KEY=y CFG_REE_FS=n \
CFG_TA_DEBUG=y CFG_TEE_CORE_TA_TRACE=1 CFG_TEE_TA_LOG_LEVEL=4 \
CFG_IMXCRYPT=y CFG_CORE_HEAP_SIZE=131072 \
${CROSS_COMPILE64}objcopy -O binary ${O}/build.mx8mqevk/core/tee.elf ${O}/build.mx8mqevk/tee.bin

U-BOOT:

export ARCH=arm
export CROSS_COMPILE=${CROSS_COMPILE64}

wget https://www.nxp.com/lgfiles/NMG/MAD/YOCTO/firmware-imx-7.9.bin
chmod +x firmware-imx-7.9.bin ~$ ./firmware-imx-7.9.bin ~$ cp firmware-imx-7.9/firmware/hdmi/cadence/signed_hdmi_imx8m.bin u-boot-imx6/ ~$ cp firmware-imx-7.9/firmware/ddr/synopsys/lpddr4*.bin u-boot-imx6/make nitrogen8mm_rev2_2g_defconfig
Enable optee using menuconfig:
CONFIG_OPTEE=y
CONFIG_OPTEE_LOAD_ADDR=0xbe000000
CONFIG_OPTEE_TZDRAM_SIZE=0x3000000
CONFIG_OPTEE_TZDRAM_BASE=0xbe000000

copy tee.bin into u-boot-imx6
copy bl31.bin into u-boot-imx6 (renamed to bl31-iMX8MM.bin)
make flash.bin -j4

Loading image:

./uuu u-boot-imx6/flash.bin

Flash log:

parsing spl/u-boot-spl.cfgout
========= IVT HEADER [HDMI FW] =========
header.tag: 0x0
header.length: 0x0
header.version: 0x0
entry: 0x0
reserved1: 0x0
dcd_ptr: 0x0
boot_data_ptr: 0x0
self: 0x0
csf: 0x0
reserved2: 0x0
boot_data.start: 0x0
boot_data.size: 0x0
boot_data.plugin: 0x0
========= IVT HEADER [LOADER IMAGE] =========
header.tag: 0xd1
header.length: 0x2000
header.version: 0x41
entry: 0x7e1000
reserved1: 0x57c00
dcd_ptr: 0x0
boot_data_ptr: 0x7e0fe0
self: 0x7e0fc0
csf: 0x80b1c0
reserved2: 0x0
boot_data.start: 0x7e0bc0
boot_data.size: 0x2c600
boot_data.plugin: 0x0
========= OFFSET dump =========
Loader IMAGE:
header_image_off 0x0
image_off 0x40
csf_off 0x2a200
spl hab block: 0x7e0fc0 0x0 0x2a200

Second Loader IMAGE:
sld_header_off 0x57c00
sld_csf_off 0x58c20
sld hab block: 0x401fcdc0 0x57c00 0x1020

Console when booting:

U-Boot SPL 2018.07-36636-gb728f6e-dirty (Oct 25 2021 - 12:21:57 -0400) 
config to do 3000 1d training. 
trying rank 0 
config to do 3000 1d training. 
config to do 3000 2d training. 
config to do 400 1d training. 
config to do 100 1d training. 
Normal Boot 
Trying to boot from USB SDP 
SDP: initialize... 
SDP: handle requests... 
Downloading file of size 1242568 to 0x40400000... done 
Jumping to header at 0x40400000 
Header Tag is not an IMX image 
Found header at 0x4042ba00 
NOTICE: BL31: v2.2(release):9f6114f-dirty 
NOTICE: BL31: Built : 11:13:34, Oct 25 2021 
INFO: GICv3 with legacy support detected. ARM GICv3 driver initialized in EL3 
INFO: BL31: Initializing runtime services 
INFO: BL31: Initializing BL32 
INFO: Entry point address = 0xbe000000 
INFO: SPSR = 0x3c5

Also changed in u-boot make file and make_fit_image.sh TEE_LOAD_ADDR = 0xbe000000

Used repositories:

https://github.com/boundarydevices/imx-atf.git

git://source.codeaurora.org/external/imx/imx-optee-os

https://github.com/boundarydevices/u-boot-imx6 -b boundary-v2018.07

Regards,
Darius

Re: Loading OPTEE + Android (or Ubuntu) on Nitrogen8M mini (iMX8MM)

igorpadykov — Tue, 26 Oct 2021 07:49:20 GMT

Hi Darius

Nitrogen8M mini is third party board developed and supported by its vendor boundary devices.

However may be useful to look at below links:

https://boundarydevices.com/high-assurance-boot-hab-i-mx8m-edition/

https://community.nxp.com/t5/i-MX-Processors/i-MX8M-OPTEE-TA-Build/m-p/806613/highlight/true

https://community.nxp.com/t5/i-MX-Processors/Enabling-OP-TEE-in-i-MX8MM-EVK-FIT-image/m-p/1160528

https://community.toradex.com/t/u-boot-spl-to-enable-optee-on-colibri-imx8qxp/13810/7

Best regards
igor

Re: Loading OPTEE + Android (or Ubuntu) on Nitrogen8M mini (iMX8MM)

dariussuciu04 — Tue, 26 Oct 2021 09:25:11 GMT

Thank you Igor!

Those are among the posts that I have following in trying to setup the mentioned boot process.

The imx8mm yocto thread seemed promissing but link to the original seems dead.

https://community.nxp.com/t5/i-MX-Processors-Knowledge-Base/Manually-build-Boot-binary-for-i-MX8M-Mini/ta-p/1116998

Unfortunately, Boundary points to this comunity for questions and do not have their own forums. However, the issue is likely related to the iMX8MM platform, or which the board is part of.

I suspect there is a mismatch in the OPTEE configuration, as I have been trying to adapt it from the closest exising one PLATFORM_FLAVOR=mx8mqevk

A difference seem be that atf and u-boot use 0xbe000000 instead of 0xfe000000 for optee images. Thus I have changed optee to use the same addresses.

Do you know of a optee build configuration or repo for imx8mm or have some prebuiilt binary for it for testing?

I really appreciate your help in this issue.

Re: Loading OPTEE + Android (or Ubuntu) on Nitrogen8M mini (iMX8MM)

igorpadykov — Tue, 26 Oct 2021 10:29:46 GMT

>Do you know of a optee build configuration or repo for imx8mm or have some prebuiilt binary for it for testing?

one can test on NXP i.MX8M Mini EVK reference board with Demo Images provided on

https://www.nxp.com/design/software/embedded-software/i-mx-software/embedded-linux-for-i-mx-applications-processors:IMXLINUX?tab=In-Depth_Tab

and build linux using sect.5.6.10 OP-TEE enablement i.MX Yocto Project User’s Guide

Chapter 5 Configuring OP-TEE i.MX Porting Guide

NXP supports only Trusty TEE in Android BSPs, documentation can be found on
https://www.nxp.com/design/software/embedded-software/i-mx-software/android-os-for-i-mx-applications-processors:IMXANDROID
For now, unfortunately, there is no plan to include optee in Android releases.

Best regards
igor