Differences
This shows you the differences between two versions of the page.
|
ass:labs-2025:05:tasks:01 [2025/08/08 09:37] florin.stancu |
ass:labs-2025:05:tasks:01 [2026/07/17 16:16] (current) florin.stancu |
||
|---|---|---|---|
| Line 49: | Line 49: | ||
| * set the ''CFG_TZDRAM_START'', ''CFG_TZDRAM_SIZE'', ''CFG_TEE_SHMEM_START'', ''CFG_TEE_SHMEM_SIZE'' configuration flags to the values calculated above (reminder: you can reference another Makefile variable using ''$(VARIABLE_NAME)'' syntax); | * set the ''CFG_TZDRAM_START'', ''CFG_TZDRAM_SIZE'', ''CFG_TEE_SHMEM_START'', ''CFG_TEE_SHMEM_SIZE'' configuration flags to the values calculated above (reminder: you can reference another Makefile variable using ''$(VARIABLE_NAME)'' syntax); | ||
| * finally, you will also need to pass ''CFG_DDR_SIZE=0x80000000'' (yep, that's 2GB, our board's actual installed memory). | * finally, you will also need to pass ''CFG_DDR_SIZE=0x80000000'' (yep, that's 2GB, our board's actual installed memory). | ||
| + | |||
| + | <note warning> | ||
| + | There is currently a bug inside OP-TEE that makes it unable to boot: it uses the NXP EdgeLock Enclave for TRNG generation, whose firmware does not start (and we weren't able to figure it out since its documentation is "secret" / available using NDA-only). | ||
| + | |||
| + | As workaround, we can disable the ELE RNG driver and enable a software one using the following additional make configuration options: ''CFG_WITH_SOFTWARE_PRNG=y CFG_IMX_ELE=n CFG_IMX_TRUSTED_ARM_CE=n''. So make sure to also set them! | ||
| + | </note> | ||
| After a successful build, check the output (''O'') directory's ''core'' subdirectory for the ''tee.bin'', ''tee-raw.bin'' and many other files! | After a successful build, check the output (''O'') directory's ''core'' subdirectory for the ''tee.bin'', ''tee-raw.bin'' and many other files! | ||
| Line 68: | Line 74: | ||
| * ATF also has to know the memory region where we've put OP-TEE (set the ''BL32_BASE'' variable to lower limit, in hexadecimal); we also need to specify its total size: ''BL32_SIZE'' (remember: we allocated ''36MB'', but give it in bytes, either in base 10 or 16 using C integer notation); | * ATF also has to know the memory region where we've put OP-TEE (set the ''BL32_BASE'' variable to lower limit, in hexadecimal); we also need to specify its total size: ''BL32_SIZE'' (remember: we allocated ''36MB'', but give it in bytes, either in base 10 or 16 using C integer notation); | ||
| * We want ATF to print some debug messages over the first serial peripheral so, finally, set the ''LOG_LEVEL=40'' and ''%%IMX_BOOT_UART_BASE=0x44380000%%'' (if you look in iMX93's Memory Map (the Reference Manual), this is the physical address of our LPUART1 - i.e. our serial communication module!). | * We want ATF to print some debug messages over the first serial peripheral so, finally, set the ''LOG_LEVEL=40'' and ''%%IMX_BOOT_UART_BASE=0x44380000%%'' (if you look in iMX93's Memory Map (the Reference Manual), this is the physical address of our LPUART1 - i.e. our serial communication module!). | ||
| + | |||
| == Step 4. Rebuild the firmware image package == | == Step 4. Rebuild the firmware image package == | ||
| Line 73: | Line 80: | ||
| Before we can take a look at the fruits of our effort so far, we need to re-build the firmware package with these last two components. | Before we can take a look at the fruits of our effort so far, we need to re-build the firmware package with these last two components. | ||
| - | This is easy if you saved your mkimage script (in your Makefile). You will need JUST one additional file copied: ''tee-raw.bin'' from ''optee'' build output directory, ''core'' subdirectory (as mentioned in the subtask above!) inside ''mkimage'''s build directory, but rename it as ''tee.bin''. | + | Since we're using mainline [[https://docs.u-boot-project.org/en/latest/develop/package/binman.html|u-boot's binman]] to generate our ''flash.bin'', we must reconfigure its descriptor to embed our new ''BL32'' component. |
| - | The bundled scripts will [[https://github.com/nxp-imx/imx-mkimage/blob/lf-6.12.20_2.0.0/iMX93/soc.mak#L43|see that this file exists]] and add it to the image automatically! | + | |
| - | <note warning> | + | Fortunately, [[https://lists.denx.de/pipermail/u-boot/2026-June/621618.html|it's quite easy]], so manually apply this patch (minus the ''if def''): |
| - | One more thing: when calling the imx-mkimage's script, set ''TEE_LOAD_ADDR=<TrustZone DRAM start address>''. | + | <code patch> |
| - | + | diff --git i/arch/arm/dts/imx93-u-boot.dtsi w/arch/arm/dts/imx93-u-boot.dtsi | |
| - | The default value is wrong for our SoC. | + | index dc86746ac90..06fe228d568 100644 |
| - | </note> | + | --- i/arch/arm/dts/imx93-u-boot.dtsi |
| + | +++ w/arch/arm/dts/imx93-u-boot.dtsi | ||
| + | @@ -69,6 +69,7 @@ | ||
| + | container; | ||
| + | image0 = "a55", "bl31.bin", "0x204E0000"; | ||
| + | image1 = "a55", "u-boot.bin", "0x80200000"; | ||
| + | + image2 = "a55", "tee-raw.bin", "0xfdc00000"; // replace with your OP-TEE TZDRAM addr | ||
| + | }; | ||
| + | }; | ||
| + | }; | ||
| + | </code> | ||
| + | Then simply copy ''tee-raw.bin'' from op-tee's ''build/core'' directory to u-boot's source and run your make script again. | ||
| Also make sure to replace ''bl31.bin'' with the newly recompiled one from ARM Trusted Firmware-A! | Also make sure to replace ''bl31.bin'' with the newly recompiled one from ARM Trusted Firmware-A! | ||
| + | To verify, the newly obtained ''flash.bin'' should be ''>=2MB'' in size. | ||
| Proceed to load this image over the serial boot protocol using the IMX ''uuu'' utility. | Proceed to load this image over the serial boot protocol using the IMX ''uuu'' utility. | ||
| - | Check the serial console (the one provided by the board's Micro USB port) for confirmation! | + | Check the serial console (the one provided by the board's DEBUG USB port) for confirmation! |
| <spoiler Example UART output> | <spoiler Example UART output> | ||
