i.MX ProcessorsのトピックRe: IMX8MP trusted boot flow

IMX8MP trusted boot flow

KwImxUser — Thu, 09 Nov 2023 16:04:18 GMT

Hi Community,

Currently I'm working on imx8mp boot flow, and have some questions regarding that topic

As far as I understand regular boot flow is something like this:

Boot rom –> SPL –> BL31 –> u-boot –> Linux kernel

Is it possible to modify boot flow to get rid of SPL? So that boot rom bootloader will load ATF. Is SPL required for DDR configuration or can it replaced?

What is preferable flow that will guaranty being compliant with Trusted Board Boot Requirements?

Re: IMX8MP trusted boot flow

brian14 — Tue, 14 Nov 2023 18:06:17 GMT

Hi @KwImxUser,

No, SPL loads the DDR initialization firmware and is required to load ATF (Arm Trusted Firmware) and then Uboot.

The boot flow for the iMX8M have the following process:

Boot ROM -> SPL -> ATF -> OP-TEE -> U-Boot -> Linux Kernel

Please have a look at the following documentation. Here you will find the boot flow on the iMX8M processors and information about each stage.
Boot Software Updates on iMX — FoundriesFactory 83 documentation

I hope this information will be helpful.

Have a great day

Re: IMX8MP trusted boot flow

KwImxUser — Thu, 16 Nov 2023 14:06:48 GMT

Thanks for reply,
As far as I understand mentioned boot flow forced to use HABv4, due to lack of BL2 (which is responsible for validating all BL3x).
What if I would like to be more compliant with ATF Trusted Board Boot Requirements.
I see that ATF documentation mentions alternative boot flow which contains BL2 just after SPL

https://trustedfirmware-a.readthedocs.io/en/latest/plat/imx8m.html

Is such boot flow is valid for this particular chip?
If so do Nxp tools supports building bootloader images to support such flow?

Re: IMX8MP trusted boot flow

brian14 — Fri, 17 Nov 2023 00:57:37 GMT

Hi @KwImxUser,

Yes, based on your information you can test a boot flow using BL2 after SPL. However, there is not a specific tool to build a bootloader supporting that boot flow. You will need to do the proper configurations for the bootloader building process.
Finally, to implement you will need to verify the usage of HAB and iMX Code Signing Tool please refer to the following application notes:

AN12812

AN12263

I hope this information will be helpful.

Have a great day!

Re: IMX8MP trusted boot flow

KwImxUser — Thu, 23 Nov 2023 14:10:40 GMT

Hi, again thanks for response.

Is there any chances for finding any helps (tutorials) related to how prepare FIT with BL2, FIP with reset bootloaders, connect both in one binary and configure BL2 and SPL to load correct images? I'm not expert in bootloaders, and seems like this might be quite challenging.

I also have question related to link that you provided. I found there information about primary secondary boot path selection, but I haven't found any of this in "i.MX 8M Plus Applications Processor Reference Manual", so I assume that this is not valid for IM8MP chip?