Show page

Differences

This shows you the differences between two versions of the page.

--- ass:labs-2025:05:tasks:01 [2025/08/08 10:12]
florin.stancu
+++ ass:labs-2025:05:tasks:01 [2026/07/17 16:16] (current)
florin.stancu
@@ Line 53: / Line 53: @@
 There is currently a bug inside OP-TEE that makes it unable to boot: it uses the NXP EdgeLock Enclave for TRNG generation, whose firmware does not start (and we weren't able to figure it out since its documentation is "secret" / available using NDA-only).
-As workaround, we can disable the ELE RNG driver and enable a software one using the following additional make configuration options: ''CFG_WITH_SOFTWARE_PRNG=y CFG_IMX_ELE=n''. So make sure to also set them!
+As workaround, we can disable the ELE RNG driver and enable a software one using the following additional make configuration options: ''CFG_WITH_SOFTWARE_PRNG=y CFG_IMX_ELE=n CFG_IMX_TRUSTED_ARM_CE=n''. So make sure to also set them!
 </note>
@@ Line 74: / Line 74: @@
   * ATF also has to know the memory region where we've put OP-TEE (set the ''BL32_BASE'' variable to lower limit, in hexadecimal); we also need to specify its total size: ''BL32_SIZE'' (remember: we allocated ''36MB'', but give it in bytes, either in base 10 or 16 using C integer notation);
   * We want ATF to print some debug messages over the first serial peripheral so, finally, set the ''LOG_LEVEL=40'' and ''%%IMX_BOOT_UART_BASE=0x44380000%%'' (if you look in iMX93's Memory Map (the Reference Manual), this is the physical address of our LPUART1 - i.e. our serial communication module!).
 == Step 4. Rebuild the firmware image package ==
@@ Line 79: / Line 80: @@
 Before we can take a look at the fruits of our effort so far, we need to re-build the firmware package with these last two components.
-This is easy if you saved your mkimage script (in your Makefile). You will need JUST one additional file copied: ''tee-raw.bin'' from ''optee'' build output directory, ''core'' subdirectory (as mentioned in the subtask above!) inside ''mkimage'''s build directory, but rename it as ''tee.bin''.
+Since we're using mainline [[https://docs.u-boot-project.org/en/latest/develop/package/binman.html|u-boot's binman]] to generate our ''flash.bin'', we must reconfigure its descriptor to embed our new ''BL32'' component.
-The bundled scripts will [[https://github.com/nxp-imx/imx-mkimage/blob/lf-6.12.20_2.0.0/iMX93/soc.mak#L43|see that this file exists]] and add it to the image automatically!
-<note warning>
+Fortunately, [[https://lists.denx.de/pipermail/u-boot/2026-June/621618.html|it's quite easy]], so manually apply this patch (minus the ''if def''):
-One more thing: when calling the imx-mkimage's script, set ''TEE_LOAD_ADDR=<TrustZone DRAM start address>''.
+<code patch>
+diff --git i/arch/arm/dts/imx93-u-boot.dtsi w/arch/arm/dts/imx93-u-boot.dtsi
-The default value is wrong for our SoC.
+index dc86746ac90..06fe228d568 100644
-</note>
+--- i/arch/arm/dts/imx93-u-boot.dtsi
++++ w/arch/arm/dts/imx93-u-boot.dtsi
+@@ -69,6 +69,7 @@
+ 				container;
+ 				image0 = "a55", "bl31.bin", "0x204E0000";
+ 				image1 = "a55", "u-boot.bin", "0x80200000";
++				image2 = "a55", "tee-raw.bin", "0xfdc00000"; // replace with your OP-TEE TZDRAM addr
+ 			};
+ 		};
+ 	};
+</code>
+Then simply copy ''tee-raw.bin'' from op-tee's ''build/core'' directory to u-boot's source and run your make script again.
 Also make sure to replace ''bl31.bin'' with the newly recompiled one from ARM Trusted Firmware-A!
+To verify, the newly obtained ''flash.bin'' should be ''>=2MB'' in size.
 Proceed to load this image over the serial boot protocol using the IMX ''uuu'' utility.