[PATCH] mkimage: Add support for bundling TEE in mkimage -f auto
Marek Vasut
marek.vasut at mailbox.org
Tue Nov 25 15:20:08 CET 2025
On 11/25/25 11:07 AM, Quentin Schulz wrote:
Hello Quentin,
>>>> Example invocation:
>>>> "
>>>> $ mkimage -E -A arm -C none -e 0xc0008000 -a 0xc0008000 -f auto \
>>>> -d arch/arm/boot/zImage \
>>>> -b arch/arm/boot/dts/st/stm32mp135f-dhcor-dhsbc.dtb \
>>>> -z ../optee_os/out/arm-plat-stm32mp1/core/tee-raw.bin \
>>>> -Z 0xde000000 \
>>>> /path/to/output/fitImage
>>>> "
>>
>> ...
>>
>>> Which formats are supported for the --tee-file parameter? OP-TEE OS
>>> itself has multiple versions for the binary header (v1 and v2?) and
>>> we can pass either a binary (tee.bin) or an ELF (tee.elf) in binman,
>>> c.f. tools/binman/etype/tee_os.py
>>
>> The raw binary only, see the example invocation above.
>>
>
> Must be documented then please.
Where would you document this ? In the manpage ? Elsewhere ?
>> [...]
>>
>>> OK so... On Rockchip we have TF-A and OP-TEE OS split in multiple
>>> entries with different load addresses (see @atf-seq and @tee-seq in
>>> arch/arm/dts/rockchip-u-boot.dtsi). I guess this means we wouldn't be
>>> able to use this auto FIT?
>>
>> Are those multiple "versions" of these binaries or are those really
>> separate parts of a single binary ? The later seems a bit odd. Do you
>> have an example of such configuration?
>>
>
> Same binary split.
>
> Rk3399, PX30 and RK3588 (the three Rockchip SoCs we use on our product
> line) have this.
>
> - For PX30:
>
> Checkout trusted-firmware-a repo and build with
>
> make CROSS_COMPILE=aarch64-linux-gnu- PLAT=px30 -j`nproc`
>
> Compile U-Boot:
>
> export BL31=/path/to/trusted-firmware-a/build/px30/release/bl31/bl31.elf
>
> make CROSS_COMPILE=aarch64-linux-gnu- O=build/ringneck ringneck-
> px30_defconfig -j`nproc`
>
> - For RK3399:
>
> Checkout trusted-firmware-a repo and build with
>
> make CROSS_COMPILE=aarch64-linux-gnu- PLAT=rk3399 -j`nproc`
>
> Compile U-Boot:
>
> export BL31=/path/to/trusted-firmware-a/build/rk3399/release/bl31/bl31.elf
>
> make CROSS_COMPILE=aarch64-linux-gnu- O=build/puma puma-rk3399_defconfig
> -j`nproc`
>
> For PX30:
>
> $ mkimage -l build/ringneck/u-boot.itb
> FIT description: FIT image for U-Boot with bl31 (TF-A)
> Created: Tue Nov 25 10:52:42 2025
> Image 0 (u-boot)
> Description: U-Boot
> Created: Tue Nov 25 10:52:42 2025
> Type: Standalone Program
> Compression: uncompressed
> Data Size: 659944 Bytes = 644.48 KiB = 0.63 MiB
> Architecture: AArch64
> Load Address: 0x00200000
> Entry Point: 0x00200000
> Hash algo: sha256
> Hash value:
> 2f6a1658befcd8330843ed5d61ee5b539000f3dca5f2b35311be064596fc94f7
> Image 1 (atf-1)
> Description: ARM Trusted Firmware
> Created: Tue Nov 25 10:52:42 2025
> Type: Firmware
> Compression: uncompressed
> Data Size: 106496 Bytes = 104.00 KiB = 0.10 MiB
> Architecture: AArch64
> OS: ARM Trusted Firmware
> Load Address: 0x00040000
> Hash algo: sha256
> Hash value:
> e6d48a0c4a47d8132d8185b58a1f5e44c025eed6eb9c4328a40feec85446281e
> Image 2 (atf-2)
> Description: ARM Trusted Firmware
> Created: Tue Nov 25 10:52:42 2025
> Type: Firmware
> Compression: uncompressed
> Data Size: 129 Bytes = 0.13 KiB = 0.00 MiB
> Architecture: AArch64
> OS: ARM Trusted Firmware
> Load Address: 0x0005a000
> Hash algo: sha256
> Hash value:
> 3125317584ab4860216e817612321962a0a904f14c830fd64961eaf12c15215a
> Image 3 (atf-3)
> Description: ARM Trusted Firmware
> Created: Tue Nov 25 10:52:42 2025
> Type: Firmware
> Compression: uncompressed
> Data Size: 112 Bytes = 0.11 KiB = 0.00 MiB
> Architecture: AArch64
> OS: ARM Trusted Firmware
> Load Address: 0xff020000
> Hash algo: sha256
> Hash value:
> d856721b954d3b7d74bca14ae49a3ce52b17acde932bb2218f927af73c422b9b
> Image 4 (fdt-1)
> Description: fdt-rockchip/px30-ringneck-haikou
> Created: Tue Nov 25 10:52:42 2025
> Type: Flat Device Tree
> Compression: uncompressed
> Data Size: 72912 Bytes = 71.20 KiB = 0.07 MiB
> Architecture: Unknown Architecture
> Hash algo: sha256
> Hash value:
> 0d8d2d650a311a7085ccb883409e680daec58df83a27b76724de60465342777e
> Default Configuration: 'config-1'
> Configuration 0 (config-1)
> Description: rockchip/px30-ringneck-haikou.dtb
> Kernel: unavailable
> Firmware: atf-1
> FDT: fdt-1
> Loadables: u-boot
> atf-2
> atf-3
>
> According to datasheet:
>
> 0x00040000 = DRAM
> 0x0005a000 = DRAM
> 0xff020000 = PMU_MEM (SRAM?)
>
> $ mkimage -l build/puma/u-boot.itb
> FIT description: FIT image for U-Boot with bl31 (TF-A)
> Created: Tue Nov 25 10:53:47 2025
> Image 0 (u-boot)
> Description: U-Boot
> Created: Tue Nov 25 10:53:47 2025
> Type: Standalone Program
> Compression: uncompressed
> Data Size: 897112 Bytes = 876.09 KiB = 0.86 MiB
> Architecture: AArch64
> Load Address: 0x00200000
> Entry Point: 0x00200000
> Hash algo: sha256
> Hash value:
> 5da93c500366e99d5fe3acb84b32b5757a90d8ef32fe73052bc20f6ca17f0b89
> Image 1 (atf-1)
> Description: ARM Trusted Firmware
> Created: Tue Nov 25 10:53:47 2025
> Type: Firmware
> Compression: uncompressed
> Data Size: 143360 Bytes = 140.00 KiB = 0.14 MiB
> Architecture: AArch64
> OS: ARM Trusted Firmware
> Load Address: 0x00040000
> Hash algo: sha256
> Hash value:
> 30e187d1b9c029657b1a9e029e5f7ad34fbfd5f9ca4a44cb1cb48750a92cf09b
> Image 2 (atf-2)
> Description: ARM Trusted Firmware
> Created: Tue Nov 25 10:53:47 2025
> Type: Firmware
> Compression: uncompressed
> Data Size: 81 Bytes = 0.08 KiB = 0.00 MiB
> Architecture: AArch64
> OS: ARM Trusted Firmware
> Load Address: 0x00063000
> Hash algo: sha256
> Hash value:
> 7380684a38dedb22d648d835934ef573c3e32a15e4b81cbc4ec158d17cb707ea
> Image 3 (atf-3)
> Description: ARM Trusted Firmware
> Created: Tue Nov 25 10:53:47 2025
> Type: Firmware
> Compression: uncompressed
> Data Size: 8024 Bytes = 7.84 KiB = 0.01 MiB
> Architecture: AArch64
> OS: ARM Trusted Firmware
> Load Address: 0xff3b0000
> Hash algo: sha256
> Hash value:
> a887bbaec347403739e27430cc512922178b694ebe001e22c2cb4774254d67e6
> Image 4 (atf-4)
> Description: ARM Trusted Firmware
> Created: Tue Nov 25 10:53:47 2025
> Type: Firmware
> Compression: uncompressed
> Data Size: 8192 Bytes = 8.00 KiB = 0.01 MiB
> Architecture: AArch64
> OS: ARM Trusted Firmware
> Load Address: 0xff8c0000
> Hash algo: sha256
> Hash value:
> 67bf4dd100c6c99dbbf76c0b19072e6e9756383925795d94ced000c2a7cf3b9e
> Image 5 (atf-5)
> Description: ARM Trusted Firmware
> Created: Tue Nov 25 10:53:47 2025
> Type: Firmware
> Compression: uncompressed
> Data Size: 0 Bytes = 0.00 KiB = 0.00 MiB
> Architecture: AArch64
> OS: ARM Trusted Firmware
> Load Address: 0xff8c2000
> Hash algo: sha256
> Hash value:
> e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
> Image 6 (fdt-1)
> Description: fdt-rockchip/rk3399-puma-haikou
> Created: Tue Nov 25 10:53:47 2025
> Type: Flat Device Tree
> Compression: uncompressed
> Data Size: 97832 Bytes = 95.54 KiB = 0.09 MiB
> Architecture: Unknown Architecture
> Hash algo: sha256
> Hash value:
> 5439f6f77ab01fa191a6a69a8691165669497fe74fc909f13a6d448b1004d629
> Default Configuration: 'config-1'
> Configuration 0 (config-1)
> Description: rockchip/rk3399-puma-haikou.dtb
> Kernel: unavailable
> Firmware: atf-1
> FDT: fdt-1
> Loadables: u-boot
> atf-2
> atf-3
> atf-4
> atf-5
>
> According to the datasheet:
>
> 0x00040000 = RAM
> 0x00063000 = RAM
> 0xff3b0000 = INTMEM1 (SRAM)
> 0xff8c0000 = INTMEM0 (SRAM)
> 0xff8c2000 = INTMEM0 (SRAM)
>
> RK3399 is a special case because TF-A is running both on A and M cores.
Neither of the binaries listed above is TEE ?
I can imagine you can have tee header and something else bundled in the
fitImage, but for such more complex case, better use .its file to
describe it.
More information about the U-Boot
mailing list