Handling OpTEE binary header with Arm Trusted Firmware on iMX8M

[NeilShipp-MSFT]

I'm attempting to load OpTEE on the MCIMX8MEVK board and am having an issue with the image loading. 

The build process for OpTEE on https://source.codeaurora.org/external/imx/imx-optee-os/tree/core/arch/arm/kernel/link.mk?h=imx_4.9.... produces a tee.bin with a 24 byte header, and two more files tee-pager.bin and a zero length tee-pageable.bin.  The mkimage build process on https://source.codeaurora.org/external/imx/imx-mkimage/tree/iMX8M/mkimage_fit_atf.sh?h=imx_4.9.123_i... looks for a tee.bin and puts it into the fit unchanged. Finally the opteed_setup code in https://source.codeaurora.org/external/imx/imx-atf/tree/services/spd/opteed/opteed_main.c?h=imx_4.9.... assumes that there's no header and uses the binary as is.  This results in the processor attempting to execute the header block.

I can resolve this by using the tee-pager.bin file as the input to mkimage, but this throws away the header information. And will cause problems if data is moved into the tee-pageable.bin file. The change to handle this header has been available since 2014 in the Linaro-SecureWorkingGroup tree, https://github.com/linaro-swg/arm-trusted-firmware/commit/f6244e85df1d931e2ed6bd80e76fbf05a1b32f23#d...  which checks for the header and shifts the memory region.  In NXP's https://source.codeaurora.org/external/imx/imx-atf/tree/lib/optee/optee_utils.c?h=imx_4.9.123_imx8mm... there is code that reads the OpTEE header, but it is only used by arm_bl2_setup.c which isn't built using the current yocto recipes.

I'm wondering it is NXP's plan to merge this change to the ATF opteed SPD, or to what their recommendation is for using OpTEE on imx8m?

[diegoadrian]

I apologize for the late answer.

Are using the script imx_build.sh for building the imx-optee-os project?

/external-link.jspa?url=https%3A%2F%2Fsource.codeaurora.org%2Fexternal%2Fimx%2Fimx-optee-os%2Ftree%2...

imx_build.sh\scripts - imx-optee-os - i.MX optee os 

On i.MX8MQ the header is not included tee.bin when built with this script, the only difference between the tee-pager.bin and tee.bin is a padding at the end of the binary.

Currently, we are not using the OP-TEE header as you pointed in the link below.

OP-TEE header · linaro-swg/arm-trusted-firmware@f6244e8 · GitHub 

The recommended way to build a flash.bin image containing OP-TEE is explained in post below:
https://community.nxp.com/docs/DOC-340663 

Just summarizing the process:

- U-Boot:
$ make imx8mq_evk_defconfig
$ make -j4
Copy u-boot.bin, u-boot-nodtb.bin, u-boot-spl.bin and fsl-imx8mq-evk.dtb to imx_mkimage/iMX8M/

- ATF:
$ make PLAT=imx8mq SPD=opteed bl31
Copy bl31.bin to imx_mkimage/iMX8M/

- OP-TEE:
$ ./scripts/imx_build.sh mx8mqevk
Copy tee.bin to imx_mkimage/iMX8M/

- Firmwares:
$ wget https://www.nxp.com/lgfiles/NMG/MAD/YOCTO/firmware-imx-7.6.bin
$ ./firmware-imx-7.6.bin
Copy lpddr4_pmu_train_*.bin and signed_hdmi_imx8m.bin to imx_mkimage/iMX8M/

- mkimage:
$ make SOC=iMX8M flash_evk

Please let me know if this help.

Best Regards,

Diego.

[NeilShipp-MSFT]

Thank you for your response.  Unfortunately, I don't have access to the document you linked to:  https://community.nxp.com/docs/DOC-340663 

However your pointer to the imx_build.sh script shows how to build a unified tee.bin file.  Thank you.

Neil.