OP-TEE in Falcon Mode || iMX8MP_EVK Hi, I want to enable OP-TEE along with Falcon Mode on the i.MX8MP EVK. Machine: imx8mpevk Repository: https://github.com/nxp-imx/imx-manifest Branch: imx-linux-walnascar XML: imx-6.12.34-2.1.0.xml Currently, I am using meta-imx-fastboot (lf-6.12.20-2.0.0-secure) to achieve fast boot via Falcon Mode. However, when Falcon Mode is enabled, OP-TEE gets disabled. As per my requirement, I need both OP-TEE and Falcon Mode to be enabled simultaneously. Could you please guide me on how to enable OP-TEE in Falcon Mode on the i.MX8MP EVK? i.MX 8 Family | i.MX 8QuadMax (8QM) | 8QuadPlus i.MX 8M | i.MX 8M Mini | i.MX 8M Nano Security Yocto Project Re: OP-TEE in Falcon Mode || iMX8MP_EVK Hi @Sanjiv_Mns
Currently, the meta-imx-fastboot layer does not support OP-TEE. It should be possible in principle, but it is not implemented yet.
Explanation: In the default BSP, the OP-TEE start address and size are calculated during the U-Boot proper boot stage based on the rom_pointer (see: https://github.com/nxp-imx/uboot-imx/blob/lf-6.12.20-2.0.0/arch/arm/mach-imx/dt_optee.c#L13).
The rom_pointer has different meaning/values in the SPL, compared to U-Boot proper. So, the ft_add_optee_node function cannot be executed from SPL without further changes.
Thanks,
Elena Re: OP-TEE in Falcon Mode || iMX8MP_EVK Hi @elena_popa Could you please guide me on how to proceed further to achieve the SPL → OP-TEE → Linux boot flow? I’d like to understand the correct steps and components involved to make this work reliably. I also came across the following link where a similar flow was implemented on STM32MP platforms: https://patchwork.ozlabs.org/project/uboot/cover/
[email protected]/ Could you please let me know whether this approach is applicable to my use case, or if parts of it can be reused or adapted for achieving the same boot sequence on my platform? Re: OP-TEE in Falcon Mode || iMX8MP_EVK Hi @elena_popa I have already completed this activity, and it is now booting successfully on my i.MX8MP board. The current boot flow is: SPL → ATF → OP-TEE → Linux Everything is working as expected. Thank you for your comments @elena_popa [ 0.412349] optee: probing for conduit method. [ 0.412373] optee: revision 4.6 (788dc101b05ae47b) [ 0.412678] optee: dynamic shared memory is enabled [ 0.413062] optee: initialized driver Re: OP-TEE in Falcon Mode || iMX8MP_EVK Hi @Sanjiv_Mns
I managed to enable and run OP-TEE in Falcon Mode for i.MX 8MP.
The boot flow on i.MX 8MP will be: SPL -> ATF -> OP-TEE -> Linux
Here are the steps:
1. Remove the following line in the conf/layer.conf of the meta-imx-fastboot layer.
MACHINE_FEATURES:remove = "optee"
2. In imx-boot mkimage source code, modify the iMX8M/mkimage_fit_atf_kernel.sh script to add the OP-TEE binary into the FIT image.
6a7,9
> # keep backward compatibility
> [ -z "$TEE_LOAD_ADDR" ] && TEE_LOAD_ADDR="0xfe000000"
>
19a23,41
> [ -z "$BL32" ] && BL32="tee.bin"
> PAD=../scripts/pad_image.sh
>
> if [ ! -f $BL32 ]; then
> BL32=/dev/null
> else
> echo "Building with TEE support, make sure $BL31 is compiled with spd. If you do not want tee, please delete $BL32" >&2
> if [ $TEE_COMPRESS_ENABLE ]; then
> echo "Start compress $BL32" >&2
> rm -f $BL32.lz4
> lz4 -9 $BL32 $BL32.lz4 >&2
> BL32=$BL32.lz4
> ./$PAD $BL32 >&2
> fi
> echo "$BL32 size: " >&2
> ls -lct $BL32 | awk '{print $5}' >&2
> LOADABLES="$LOADABLES, \"tee-1\""
> fi
>
71a94,103
> tee-1 {
> description = "TEE firmware";
> data = /incbin/("$BL32");
> type = "firmware";
> arch = "arm64";
> compression = "none";
> load = <$TEE_LOAD_ADDR>;
> entry = <$TEE_LOAD_ADDR>;
> };
>
87c119
< loadables = "kernel","dtb";
---
> loadables = "tee-1","kernel","dtb";
3. In the kernel device tree, add manually the OP-TEE nodes (firmware and reserved memory). Edit the imx8mp.dtsi device tree and:
- add the following OP-TEE firmware node in the root node ("/").
firmware {
optee {
compatible = "linaro,optee-tz";
method = "smc";
};
};
- add the OP-TEE reserved memory regions under the reserved-memory node:
optee_core@56000000 {
reg = <0 0x56000000 0 0x1e00000>;
no-map;
};
optee_shm@57e00000 {
reg = <0 0x57e00000 0 0x200000>;
no-map;
};
4. Build the image and write it on the boot device.
5. To check that OP-TEE has started and Linux probed the driver, run:
root@imx8mp-lpddr4-evk:~# dmesg | grep optee
[ 0.000000] OF: reserved mem: 0x0000000057e00000..0x0000000057ffffff (2048 KiB) nomap non-reusable optee_shm@57e00000
[ 0.000000] OF: reserved mem: 0x0000000056000000..0x0000000057dfffff (30720 KiB) nomap non-reusable optee_core@56000000
[ 2.581777] optee: probing for conduit method.
[ 2.590862] optee: revision 4.8 (e7ed997213779e3d)
[ 2.596363] optee: dynamic shared memory is enabled
[ 2.601567] optee: initialized driver
6. If you want to test the OP-TEE you can run xtest.
root@imx8mp-lpddr4-evk:~# xtest
Run test suite with level=0
TEE test application started over default TEE instance
######################################################
#
# regression+pkcs11+regression_nxp
#
######################################################
* regression_1001 Core self tests
o regression_1001.1 Core self tests
regression_1001.1 OK
o regression_1001.2 Core dt_driver self tests
regression_1001.2 OK
o regression_1001.3 Core transfer list self tests
.....
+-----------------------------------------------------
49354 subtests of which 0 failed
161 test cases of which 0 failed
0 test cases were skipped
TEE test application done!
Please, let me know if you have issues during enablement.
Thanks,
Elena
