IMX8M OP-TEE

[Tim Harvey]

On Mon, Oct 11, 2021 at 3:29 PM Marcel Ziswiler
<marcel.ziswiler at toradex.com> wrote:
>
> Hi Tim
>
> On Mon, 2021-10-11 at 15:15 -0700, Tim Harvey wrote:
> > Greetings,
> >
> > Is anyone successfully booting U-Boot with OP-TEE support on the IMX8M?
>
> I am not aware that anybody at Toradex played with OP-TEE so far but let me ask around again.
>
> However, maybe Igor or Oleksandr (added to CC, now both with Foundries) might have some experience. I know that
> Igor used to work on this kind of stuff.
>
> > My understanding is that you need to add tee.bin to the images in the
> > FIT image and include it in loadables following the ATF.
> >
> > While this was done with arch/arm/mach-imx/mkimage_fit_atf.sh before
> > the switch to binman by simply having tee.bin in the U-Boot directory
> > and passing in TEE_LOAD_ADDR (or accepting the default of 0xfe000000)
> > once you switch to binman it needs to be added for your board.
> >
> > Additionally in order to use OP-TEE from U-Boot (ie for dek_blob
> > command) you need to add a node with compatible=linaro,optee-tz as
> > well.
> >
> > I've done the following to add OP-TEE for imx8mm_venice:
> > diff --git a/configs/imx8mm_venice_defconfig b/configs/imx8mm_venice_defconfig
> > index d85827b588..85d2b20810 100644
> > -u-boot.dtsi
> > index e0fa9ff4bf..7a71b974e1 100644
> > --- a/arch/arm/dts/imx8mm-venice-u-boot.dtsi
> > +++ b/arch/arm/dts/imx8mm-venice-u-boot.dtsi
> > @@ -10,6 +10,13 @@
> >                 multiple-images;
> >         };
> >
> > +       firmware {
> > +               optee {
> > +                       compatible = "linaro,optee-tz";
> > +                       method = "smc";
> > +               };
> > +       };
> > +
> >         wdt-reboot {
> >                 compatible = "wdt-reboot";
> >                 wdt = <&wdog1>;
> > @@ -152,6 +159,16 @@
> >                                         };
> >                                 };
> >
> > +                               tee {
> > +                                       description = "TEE firmware";
> > +                                       type = "firmware";
> > +                                       arch = "arm64";
> > +                                       compression = "none";
> > +                                       data = "tee.bin";
> > +                                       load = <0xbe000000>;
> > +                                       entry = <0xbe000000>;
> > +                               };
> > +
> >                                 @fdt-SEQ {
> >                                         description = "NAME";
> >                                         type = "flat_dt";
> > @@ -165,7 +182,7 @@
> >                                 @config-SEQ {
> >                                         description = "NAME";
> >                                         firmware = "uboot";
> > -                                       loadables = "atf";
> > +                                       loadables = "atf", "tee";
> >                                         fdt = "fdt-SEQ";
> >                                 };
> >                         };
> >
> >
> > However, when I attempt to boot I hang when the ATF is run.
> >
> > Where does the TEE_LOAD_ADDR come from specifically? I would think
> > this needs to be defined when building tee and needs to match the load
> > address used in the FIT image. It appears that perhaps this is supped
> > to be DDR_BASE + DDR_SIZE - 32MIB but I'm not entirely sure.
> >
> > I'm currently using NXP's ATF (imx_5.4.3_2.0.0) and NXP's TEE
> > (imx_5.4.70_2.3.0) and would also like to understand if NXP's branches
> > are strictly required here and if so what the pros and cons of using
> > them are.
> >
> > Anyone using IMX8MM OP-TEE that could point me in the right direction?
> >
> > Best regards,
> >
> > Tim
>
> BTW: Have you tried my latest stuff [1] on venice? Did/does it work? And yeah, my cover letter subject is
> slightly misleading as I forgot to update that one (;-p).
>

Marcel,

Thanks for checking into OP-TEE for me.

I haven't tested your series yet as I tried to apply it and it failed.
Do you have a git repo I can cherry-pick from or what did you base it
on top of?

Thanks,

Tim