[PATCH] mkimage: Add support for bundling TEE in mkimage -f auto

Quentin Schulz quentin.schulz at cherry.de
Tue Nov 25 11:07:28 CET 2025 

Hi Marek,

On 11/24/25 8:23 PM, Marek Vasut wrote:
> On 11/24/25 4:05 PM, Quentin Schulz wrote:
> 
> Hello Quentin,
> 
>>> Example invocation:
>>> "
>>> $ mkimage -E -A arm -C none -e 0xc0008000 -a 0xc0008000 -f auto \
>>>            -d arch/arm/boot/zImage \
>>>            -b arch/arm/boot/dts/st/stm32mp135f-dhcor-dhsbc.dtb \
>>>            -z ../optee_os/out/arm-plat-stm32mp1/core/tee-raw.bin \
>>>       -Z 0xde000000 \
>>>            /path/to/output/fitImage
>>> "
> 
> ...
> 
>> Which formats are supported for the --tee-file parameter? OP-TEE OS 
>> itself has multiple versions for the binary header (v1 and v2?) and we 
>> can pass either a binary (tee.bin) or an ELF (tee.elf) in binman, c.f. 
>> tools/binman/etype/tee_os.py
> 
> The raw binary only, see the example invocation above.
> 

Must be documented then please.

> [...]
> 
>> OK so... On Rockchip we have TF-A and OP-TEE OS split in multiple 
>> entries with different load addresses (see @atf-seq and @tee-seq in 
>> arch/arm/dts/rockchip-u-boot.dtsi). I guess this means we wouldn't be 
>> able to use this auto FIT?
> 
> Are those multiple "versions" of these binaries or are those really 
> separate parts of a single binary ? The later seems a bit odd. Do you 
> have an example of such configuration?
> 

Same binary split.

Rk3399, PX30 and RK3588 (the three Rockchip SoCs we use on our product 
line) have this.

- For PX30:

Checkout trusted-firmware-a repo and build with

make CROSS_COMPILE=aarch64-linux-gnu- PLAT=px30 -j`nproc`

Compile U-Boot:

export BL31=/path/to/trusted-firmware-a/build/px30/release/bl31/bl31.elf

make CROSS_COMPILE=aarch64-linux-gnu- O=build/ringneck 
ringneck-px30_defconfig -j`nproc`

- For RK3399:

Checkout trusted-firmware-a repo and build with

make CROSS_COMPILE=aarch64-linux-gnu- PLAT=rk3399 -j`nproc`

Compile U-Boot:

export BL31=/path/to/trusted-firmware-a/build/rk3399/release/bl31/bl31.elf

make CROSS_COMPILE=aarch64-linux-gnu- O=build/puma puma-rk3399_defconfig 
-j`nproc`

For PX30:

$ mkimage -l build/ringneck/u-boot.itb
FIT description: FIT image for U-Boot with bl31 (TF-A)
Created:         Tue Nov 25 10:52:42 2025
  Image 0 (u-boot)
   Description:  U-Boot
   Created:      Tue Nov 25 10:52:42 2025
   Type:         Standalone Program
   Compression:  uncompressed
   Data Size:    659944 Bytes = 644.48 KiB = 0.63 MiB
   Architecture: AArch64
   Load Address: 0x00200000
   Entry Point:  0x00200000
   Hash algo:    sha256
   Hash value: 
2f6a1658befcd8330843ed5d61ee5b539000f3dca5f2b35311be064596fc94f7
  Image 1 (atf-1)
   Description:  ARM Trusted Firmware
   Created:      Tue Nov 25 10:52:42 2025
   Type:         Firmware
   Compression:  uncompressed
   Data Size:    106496 Bytes = 104.00 KiB = 0.10 MiB
   Architecture: AArch64
   OS:           ARM Trusted Firmware
   Load Address: 0x00040000
   Hash algo:    sha256
   Hash value: 
e6d48a0c4a47d8132d8185b58a1f5e44c025eed6eb9c4328a40feec85446281e
  Image 2 (atf-2)
   Description:  ARM Trusted Firmware
   Created:      Tue Nov 25 10:52:42 2025
   Type:         Firmware
   Compression:  uncompressed
   Data Size:    129 Bytes = 0.13 KiB = 0.00 MiB
   Architecture: AArch64
   OS:           ARM Trusted Firmware
   Load Address: 0x0005a000
   Hash algo:    sha256
   Hash value: 
3125317584ab4860216e817612321962a0a904f14c830fd64961eaf12c15215a
  Image 3 (atf-3)
   Description:  ARM Trusted Firmware
   Created:      Tue Nov 25 10:52:42 2025
   Type:         Firmware
   Compression:  uncompressed
   Data Size:    112 Bytes = 0.11 KiB = 0.00 MiB
   Architecture: AArch64
   OS:           ARM Trusted Firmware
   Load Address: 0xff020000
   Hash algo:    sha256
   Hash value: 
d856721b954d3b7d74bca14ae49a3ce52b17acde932bb2218f927af73c422b9b
  Image 4 (fdt-1)
   Description:  fdt-rockchip/px30-ringneck-haikou
   Created:      Tue Nov 25 10:52:42 2025
   Type:         Flat Device Tree
   Compression:  uncompressed
   Data Size:    72912 Bytes = 71.20 KiB = 0.07 MiB
   Architecture: Unknown Architecture
   Hash algo:    sha256
   Hash value: 
0d8d2d650a311a7085ccb883409e680daec58df83a27b76724de60465342777e
  Default Configuration: 'config-1'
  Configuration 0 (config-1)
   Description:  rockchip/px30-ringneck-haikou.dtb
   Kernel:       unavailable
   Firmware:     atf-1
   FDT:          fdt-1
   Loadables:    u-boot
                 atf-2
                 atf-3

According to datasheet:

0x00040000 = DRAM
0x0005a000 = DRAM
0xff020000 = PMU_MEM (SRAM?)

$ mkimage -l build/puma/u-boot.itb
FIT description: FIT image for U-Boot with bl31 (TF-A)
Created:         Tue Nov 25 10:53:47 2025
  Image 0 (u-boot)
   Description:  U-Boot
   Created:      Tue Nov 25 10:53:47 2025
   Type:         Standalone Program
   Compression:  uncompressed
   Data Size:    897112 Bytes = 876.09 KiB = 0.86 MiB
   Architecture: AArch64
   Load Address: 0x00200000
   Entry Point:  0x00200000
   Hash algo:    sha256
   Hash value: 
5da93c500366e99d5fe3acb84b32b5757a90d8ef32fe73052bc20f6ca17f0b89
  Image 1 (atf-1)
   Description:  ARM Trusted Firmware
   Created:      Tue Nov 25 10:53:47 2025
   Type:         Firmware
   Compression:  uncompressed
   Data Size:    143360 Bytes = 140.00 KiB = 0.14 MiB
   Architecture: AArch64
   OS:           ARM Trusted Firmware
   Load Address: 0x00040000
   Hash algo:    sha256
   Hash value: 
30e187d1b9c029657b1a9e029e5f7ad34fbfd5f9ca4a44cb1cb48750a92cf09b
  Image 2 (atf-2)
   Description:  ARM Trusted Firmware
   Created:      Tue Nov 25 10:53:47 2025
   Type:         Firmware
   Compression:  uncompressed
   Data Size:    81 Bytes = 0.08 KiB = 0.00 MiB
   Architecture: AArch64
   OS:           ARM Trusted Firmware
   Load Address: 0x00063000
   Hash algo:    sha256
   Hash value: 
7380684a38dedb22d648d835934ef573c3e32a15e4b81cbc4ec158d17cb707ea
  Image 3 (atf-3)
   Description:  ARM Trusted Firmware
   Created:      Tue Nov 25 10:53:47 2025
   Type:         Firmware
   Compression:  uncompressed
   Data Size:    8024 Bytes = 7.84 KiB = 0.01 MiB
   Architecture: AArch64
   OS:           ARM Trusted Firmware
   Load Address: 0xff3b0000
   Hash algo:    sha256
   Hash value: 
a887bbaec347403739e27430cc512922178b694ebe001e22c2cb4774254d67e6
  Image 4 (atf-4)
   Description:  ARM Trusted Firmware
   Created:      Tue Nov 25 10:53:47 2025
   Type:         Firmware
   Compression:  uncompressed
   Data Size:    8192 Bytes = 8.00 KiB = 0.01 MiB
   Architecture: AArch64
   OS:           ARM Trusted Firmware
   Load Address: 0xff8c0000
   Hash algo:    sha256
   Hash value: 
67bf4dd100c6c99dbbf76c0b19072e6e9756383925795d94ced000c2a7cf3b9e
  Image 5 (atf-5)
   Description:  ARM Trusted Firmware
   Created:      Tue Nov 25 10:53:47 2025
   Type:         Firmware
   Compression:  uncompressed
   Data Size:    0 Bytes = 0.00 KiB = 0.00 MiB
   Architecture: AArch64
   OS:           ARM Trusted Firmware
   Load Address: 0xff8c2000
   Hash algo:    sha256
   Hash value: 
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  Image 6 (fdt-1)
   Description:  fdt-rockchip/rk3399-puma-haikou
   Created:      Tue Nov 25 10:53:47 2025
   Type:         Flat Device Tree
   Compression:  uncompressed
   Data Size:    97832 Bytes = 95.54 KiB = 0.09 MiB
   Architecture: Unknown Architecture
   Hash algo:    sha256
   Hash value: 
5439f6f77ab01fa191a6a69a8691165669497fe74fc909f13a6d448b1004d629
  Default Configuration: 'config-1'
  Configuration 0 (config-1)
   Description:  rockchip/rk3399-puma-haikou.dtb
   Kernel:       unavailable
   Firmware:     atf-1
   FDT:          fdt-1
   Loadables:    u-boot
                 atf-2
                 atf-3
                 atf-4
                 atf-5

According to the datasheet:

0x00040000 = RAM
0x00063000 = RAM
0xff3b0000 = INTMEM1 (SRAM)
0xff8c0000 = INTMEM0 (SRAM)
0xff8c2000 = INTMEM0 (SRAM)

RK3399 is a special case because TF-A is running both on A and M cores.

Cheers,
Quentin

More information about the U-Boot mailing list