IMX8M OP-TEE

[Marcel Ziswiler]

Hi Tim

On Mon, 2021-10-11 at 15:15 -0700, Tim Harvey wrote:
> Greetings,
> 
> Is anyone successfully booting U-Boot with OP-TEE support on the IMX8M?

I am not aware that anybody at Toradex played with OP-TEE so far but let me ask around again.

However, maybe Igor or Oleksandr (added to CC, now both with Foundries) might have some experience. I know that
Igor used to work on this kind of stuff.

> My understanding is that you need to add tee.bin to the images in the
> FIT image and include it in loadables following the ATF.
> 
> While this was done with arch/arm/mach-imx/mkimage_fit_atf.sh before
> the switch to binman by simply having tee.bin in the U-Boot directory
> and passing in TEE_LOAD_ADDR (or accepting the default of 0xfe000000)
> once you switch to binman it needs to be added for your board.
> 
> Additionally in order to use OP-TEE from U-Boot (ie for dek_blob
> command) you need to add a node with compatible=linaro,optee-tz as
> well.
> 
> I've done the following to add OP-TEE for imx8mm_venice:
> diff --git a/configs/imx8mm_venice_defconfig b/configs/imx8mm_venice_defconfig
> index d85827b588..85d2b20810 100644
> -u-boot.dtsi
> index e0fa9ff4bf..7a71b974e1 100644
> --- a/arch/arm/dts/imx8mm-venice-u-boot.dtsi
> +++ b/arch/arm/dts/imx8mm-venice-u-boot.dtsi
> @@ -10,6 +10,13 @@
>                 multiple-images;
>         };
> 
> +       firmware {
> +               optee {
> +                       compatible = "linaro,optee-tz";
> +                       method = "smc";
> +               };
> +       };
> +
>         wdt-reboot {
>                 compatible = "wdt-reboot";
>                 wdt = <&wdog1>;
> @@ -152,6 +159,16 @@
>                                         };
>                                 };
> 
> +                               tee {
> +                                       description = "TEE firmware";
> +                                       type = "firmware";
> +                                       arch = "arm64";
> +                                       compression = "none";
> +                                       data = "tee.bin";
> +                                       load = <0xbe000000>;
> +                                       entry = <0xbe000000>;
> +                               };
> +
>                                 @fdt-SEQ {
>                                         description = "NAME";
>                                         type = "flat_dt";
> @@ -165,7 +182,7 @@
>                                 @config-SEQ {
>                                         description = "NAME";
>                                         firmware = "uboot";
> -                                       loadables = "atf";
> +                                       loadables = "atf", "tee";
>                                         fdt = "fdt-SEQ";
>                                 };
>                         };
> 
> 
> However, when I attempt to boot I hang when the ATF is run.
> 
> Where does the TEE_LOAD_ADDR come from specifically? I would think
> this needs to be defined when building tee and needs to match the load
> address used in the FIT image. It appears that perhaps this is supped
> to be DDR_BASE + DDR_SIZE - 32MIB but I'm not entirely sure.
> 
> I'm currently using NXP's ATF (imx_5.4.3_2.0.0) and NXP's TEE
> (imx_5.4.70_2.3.0) and would also like to understand if NXP's branches
> are strictly required here and if so what the pros and cons of using
> them are.
> 
> Anyone using IMX8MM OP-TEE that could point me in the right direction?
> 
> Best regards,
> 
> Tim

BTW: Have you tried my latest stuff [1] on venice? Did/does it work? And yeah, my cover letter subject is
slightly misleading as I forgot to update that one (;-p).

[1] https://marc.info/?l=u-boot&m=163372696806292

Cheers

Marcel