Compiling ATF with SPD support for OPTEE

[Rajasjoshi]

Hi All,

I am trying to build imx-atf for IMX8MM. I want to enable optee as well. I have set  SPD=opteed during the compile process. But, this results into the board getting stuck in SPL. The only way to get it running is removing " SPD=opteed" and building the atf.

My problem is similar to the one mentioned in https://community.nxp.com/t5/i-MX-Processors/Compiling-ATF-with-SPD-support/m-p/955353 

Please let me know how I can fix this issue.

Thanks,

Rajas

[Rajasjoshi]

Hi @AldoG,

I added those changes and was able to build it as well. The board doesn't get stuck now but the bootlog does mention of optee not initializing:

U-Boot SPL 2024.04-dirty (May 28 2025 - 16:32:11 +0100)
DDRINFO: start DRAM init
DDRINFO: DRAM rate 3000MTS
DDRINFO:ddrphy calibration done
DDRINFO: ddrmix config done
SEC0: RNG instantiated
Normal Boot
Trying to boot from NAND
hab fuse not enabled

Authenticate image from DDR location 0x401fadc0...
Error: CSF header command not found
NOTICE: Do not release JR0 to NS as it can be used by HAB
NOTICE: BL31: v2.10.0 (release):automotive-15.0.0_1.1.0-dirty
NOTICE: BL31: Built : 09:45:06, May 29 2025
ERROR: Error initializing runtime service opteed_fast

U-Boot 2024.04-dirty (May 28 2025 - 16:32:11 +0100)

CPU: i.MX8MMD rev1.0 1800 MHz (running at 1200 MHz)
CPU: Commercial temperature grade (0C to 95C) at 40C
Reset cause: POR
Model: NXP i.MX8MM EVK board
DRAM: 2 GiB
optee optee: OP-TEE api uid mismatch
Core: 105 devices, 30 uclasses, devicetree: separate
NAND: 1024 MiB
MMC: FSL_SDHC: 1
Loading Environment from MMC... MMC: no card present
*** Warning - No block device, using default environment

Loading Environment from NAND... *** Warning - bad CRC, using default environment

Could you please let me know what could be the cause?

Thanks,

Rajas

[AldoG]

Hello,

If you are using Yocto for building then optee is enabled by default, so there is no need to add anything.

If you are building in standalone mode, then you may follow this steps:
$ git clone https://github.com/nxp-imx/imx-atf -b <tag you are working with>
$ cd imx-atf
$ make -j $(nproc --all) PLAT=imx8mm SPD=opteed bl31 CROSS_COMPILE=/opt/arm-gnu-toolchain-12.3.rel1-x86_64-aarch64-none-linux-gnu/bin/aarch64-none-linux-gnu-

Also, as an small note is that when building flashbin using imx-mkimage tee-raw.bin should be used and be renamed to tee.bin

Best regards/Saludos,
Aldo.

[Rajasjoshi]

Hi @AldoG ,

I was able to build the atf using the method you mentioned. Below are the steps about how I am building the mkimage:

git clone https://github.com/nxp-imx/imx-mkimage

cd imx-mkimage

cp ../../uboot-imx/u-boot-nodtb.bin ./iMX8M/

cp ../../uboot-imx/u-boot.dtb ./iMX8M/

cp ../../uboot-imx/spl/u-boot-spl.bin ./iMX8M/

cp ../../uboot-imx/arch/arm/dts/imx8mm-evk.dtb ./iMX8M/

cp ../../uboot-imx/tools/mkimage ./iMX8M/mkimage_uboot

cp ../../imx-atf/build/imx8mm/release/bl31.bin ./iMX8M/

cp ../../imx-optee-os/out/arm-plat-imx/core/tee-raw.bin ./iMX8M/tee.bin

dd if=/dev/zero of=iMX8M/dek_blob_fit_dummy.bin bs=96 count=1 && sync

make -j $(nproc --all) SOC=iMX8MM flash_evk_no_hdmi

After this I am using uuu to flash the flash.bin to my board. But now I am getting the below logs:

U-Boot SPL 2024.04-dirty (May 26 2025 - 09:25:54 +0100)
DDRINFO: start DRAM init
DDRINFO: DRAM rate 3000MTS
DDRINFO:ddrphy calibration done
DDRINFO: ddrmix config done
SEC0: RNG instantiated
Normal Boot
Trying to boot from NAND
NOTICE: Do not release JR0 to NS as it can be used by HAB
NOTICE: BL31: v2.10.0 (release):automotive-15.0.0_1.1.0-dirty
NOTICE: BL31: Built : 09:26:26, May 26 2025
I/TC:
I/TC: Non-secure external DT found
I/TC: OP-TEE version: lf-6.6.52-2.2.0-dev (gcc version 13.3.0 (Ubuntu 13.3.0-6ubuntu2~24.04)) #2 Mon May 26 08:40:05 UTC 2025 aarch64
I/TC: WARNING: This OP-TEE configuration might be insecure!
I/TC: WARNING: Please check https://optee.readthedocs.io/en/latest/architecture/porting_guidelines.html
I/TC: Primary CPU initializing
I/TC: GIC redistributor base address not provided
I/TC: Assuming default GIC group status and modifier
I/TC: Primary CPU switching to normal world boot

And It gets stuck here. Could you please let me know what could be the cause?

Thanks,

Rajas

[AldoG]

Hello,

From your command it looks like you are trying to build fit image, correct?
If so did you build optee to support DEK blob encapsulation?

If not, then you may do so with the following command:
$ CFG_NXPCRYPT=y CFG_GEN_DEK_BLOB=y source ./scripts/nxp_build.sh <Board Name>

Best regards/Saludos,
Aldo.