* [PATCH v3 0/5] stm32mp1: handle TF-A boot with FIP
@ 2021-07-26 9:21 Patrick Delaunay
2021-07-26 9:21 ` [PATCH v3 1/5] arm: stm32mp: add config for STM32IMAGE support Patrick Delaunay
` (4 more replies)
0 siblings, 5 replies; 11+ messages in thread
From: Patrick Delaunay @ 2021-07-26 9:21 UTC (permalink / raw)
To: u-boot
Cc: Yann GAUTIER, Patrick Delaunay, Ilias Apalodimas, Jaehoon Chung,
Jean-Philippe ROMAIN, Patrice Chotard, Simon Glass, Tom Rini,
U-Boot STM32
In next TF-A version the stm32mp1 platform will support the Firmware
Image Package (FIP) [1], a container filled with:
- the U-Boot binary = u-boot-nodtb.bin
- the U-Boot device tree = u-boot.dtb
- the Secure OS (OP-TEE) or the secure monitor (SP_MIN)
Upstream is in progress on TF-A side ([3] but reviews don't yet start).
Each part of the FIP is loaded by TF-A BL2 and U-Boot
is executed with its device tree address as parameter (nt_fw_dtb = r2
introduced by commit 4ac345220afa ("board: stm32mp1: use FDT address
provided by TF-A at boot time")
This FIP container simplifies the OP-TEE management (same number of partition
with or without OP-TEE, OP-TEE dynamically updates the U-Boot device tree
to add the required OP-TEE nodes) and allow support of generic TF-A
features as PKI [2].
This serie allows to generate U-Boot configured for the TF-A BL2 image
types:
- STM32IMAGE: stm32mp15_trusted_defconfig (current behavior)
- FIP: stm32mp15_defconfig (NEW)
The FIP will be the STMicroelectronics recommended image type for
STM32MP15x and the STM32IMAGE support should be marked deprecated in a
future TF-A release.
To prepare this migration, the serie move all the specific code or
device tree nodes for TF-A load of STM32IMAGE under compilation
flag CONFIG_STM32MP15x_STM32IMAGE.
This V3 serie of [4] is rebased on top for u-boot-stm32/master.
I just update documentation after [5] message to clarify TF-A
compilation step.
[1] 4.11. Firmware Image Package (FIP)
fiphttps://trustedfirmware-a.readthedocs.io/en/latest/design/firmware-design.html
stm32mp1: handle TF-A boot with FIP
[2] Authentication Framework & Chain of Trust
https://trustedfirmware-a.readthedocs.io/en/latest/design/auth-framework.html
[3] TF-A Serie proposal : FIP and FCONF for STM32MP1
https://github.com/Yann-lms/arm-trusted-firmware/commits/fip_fconf
[4] stm32mp1: handle TF-A boot with FIP
http://patchwork.ozlabs.org/project/uboot/list/?series=253677&state=*
[5] U-BOOT 2021.07 and STM32MP15x issues for Trusted Boot Chain
https://lists.denx.de/pipermail/u-boot/2021-July/455750.html
Changes in v3:
- add reference for STM32 WIKI, TF-A and OP-TEE
- add information about TF-A compilation and clarify the output files
Changes in v2:
- synchronize defconfig with latest change
- fix one typo: s/ enought / enough
Patrick Delaunay (5):
arm: stm32mp: add config for STM32IMAGE support
arm: stm32mp: handle the OP-TEE nodes in DT with FIP support
arm: stm32mp: add defconfig for trusted boot with FIP
doc: st: stm32mp1: Add FIP support for trusted boot
stm32mp1: stm32prog: remove stm32prog_get_tee_partitions with FIP
arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi | 9 +-
arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi | 9 +-
arch/arm/mach-stm32mp/Kconfig | 7 +
.../cmd_stm32prog/cmd_stm32prog.c | 2 +
.../mach-stm32mp/cmd_stm32prog/stm32prog.c | 4 +
.../mach-stm32mp/cmd_stm32prog/stm32prog.h | 2 +
arch/arm/mach-stm32mp/config.mk | 2 +-
arch/arm/mach-stm32mp/fdt.c | 11 +-
.../arm/mach-stm32mp/include/mach/stm32prog.h | 2 +
board/st/common/Kconfig | 21 +-
board/st/common/stm32mp_mtdparts.c | 31 +-
board/st/stm32mp1/MAINTAINERS | 1 +
board/st/stm32mp1/stm32mp1.c | 10 +-
configs/stm32mp15_defconfig | 158 +++++++++
configs/stm32mp15_trusted_defconfig | 1 +
doc/board/st/stm32mp1.rst | 328 +++++++++++++-----
16 files changed, 481 insertions(+), 117 deletions(-)
create mode 100644 configs/stm32mp15_defconfig
--
2.25.1
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH v3 1/5] arm: stm32mp: add config for STM32IMAGE support
2021-07-26 9:21 [PATCH v3 0/5] stm32mp1: handle TF-A boot with FIP Patrick Delaunay
@ 2021-07-26 9:21 ` Patrick Delaunay
2021-08-16 11:38 ` Patrice CHOTARD
2021-07-26 9:21 ` [PATCH v3 2/5] arm: stm32mp: handle the OP-TEE nodes in DT with FIP support Patrick Delaunay
` (3 subsequent siblings)
4 siblings, 1 reply; 11+ messages in thread
From: Patrick Delaunay @ 2021-07-26 9:21 UTC (permalink / raw)
To: u-boot
Cc: Yann GAUTIER, Patrick Delaunay, Patrice Chotard,
Ilias Apalodimas, Jean-Philippe ROMAIN, Simon Glass, Tom Rini,
U-Boot STM32
By default for trusted boot with TF-A, U-Boot (u-boot-nodtb)
is located in FIP container with its device tree and with
the secure monitor (provided by TF-A or OP-TEE).
The FIP file is loaded by TF-A BL2 and each components is
extracted at the final location.
This patch add CONFIG_STM32MP15x_STM32IMAGE to request the
STM32 image generation for SOC STM32MP15x
when FIP container is not used (u-boot.stm32 is loaded by TF-A
as done previously to keep the backward compatibility).
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
---
(no changes since v1)
arch/arm/mach-stm32mp/Kconfig | 7 +++++++
arch/arm/mach-stm32mp/config.mk | 2 +-
board/st/stm32mp1/stm32mp1.c | 10 +++++++---
configs/stm32mp15_trusted_defconfig | 1 +
4 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/arch/arm/mach-stm32mp/Kconfig b/arch/arm/mach-stm32mp/Kconfig
index 0e59931679..b9e623bc3c 100644
--- a/arch/arm/mach-stm32mp/Kconfig
+++ b/arch/arm/mach-stm32mp/Kconfig
@@ -56,6 +56,13 @@ config STM32MP15x
dual core A7 for STM32MP157/3, monocore for STM32MP151
target all the STMicroelectronics board with SOC STM32MP1 family
+config STM32MP15x_STM32IMAGE
+ bool "Support STM32 image for generated U-Boot image"
+ depends on STM32MP15x && TFABOOT
+ help
+ Support of STM32 image generation for SOC STM32MP15x
+ for TF-A boot when FIP container is not used
+
choice
prompt "STM32MP15x board select"
optional
diff --git a/arch/arm/mach-stm32mp/config.mk b/arch/arm/mach-stm32mp/config.mk
index c30bf482f7..f7f5b77c41 100644
--- a/arch/arm/mach-stm32mp/config.mk
+++ b/arch/arm/mach-stm32mp/config.mk
@@ -4,7 +4,7 @@
#
ifndef CONFIG_SPL
-INPUTS-y += u-boot.stm32
+INPUTS-$(CONFIG_STM32MP15x_STM32IMAGE) += u-boot.stm32
else
ifdef CONFIG_SPL_BUILD
INPUTS-y += u-boot-spl.stm32
diff --git a/board/st/stm32mp1/stm32mp1.c b/board/st/stm32mp1/stm32mp1.c
index 2faf5c81b4..70bd4d1ed5 100644
--- a/board/st/stm32mp1/stm32mp1.c
+++ b/board/st/stm32mp1/stm32mp1.c
@@ -105,10 +105,14 @@ int checkboard(void)
const char *fdt_compat;
int fdt_compat_len;
- if (IS_ENABLED(CONFIG_TFABOOT))
- mode = "trusted";
- else
+ if (IS_ENABLED(CONFIG_TFABOOT)) {
+ if (IS_ENABLED(CONFIG_STM32MP15x_STM32IMAGE))
+ mode = "trusted - stm32image";
+ else
+ mode = "trusted";
+ } else {
mode = "basic";
+ }
fdt_compat = fdt_getprop(gd->fdt_blob, 0, "compatible",
&fdt_compat_len);
diff --git a/configs/stm32mp15_trusted_defconfig b/configs/stm32mp15_trusted_defconfig
index a58ea91d3e..6a8ccb1f3d 100644
--- a/configs/stm32mp15_trusted_defconfig
+++ b/configs/stm32mp15_trusted_defconfig
@@ -7,6 +7,7 @@ CONFIG_SYS_MEMTEST_END=0xc4000000
CONFIG_ENV_OFFSET=0x280000
CONFIG_ENV_SECT_SIZE=0x40000
CONFIG_DEFAULT_DEVICE_TREE="stm32mp157c-ev1"
+CONFIG_STM32MP15x_STM32IMAGE=y
CONFIG_TARGET_ST_STM32MP15x=y
CONFIG_CMD_STM32KEY=y
CONFIG_CMD_STM32PROG=y
--
2.25.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [PATCH v3 2/5] arm: stm32mp: handle the OP-TEE nodes in DT with FIP support
2021-07-26 9:21 [PATCH v3 0/5] stm32mp1: handle TF-A boot with FIP Patrick Delaunay
2021-07-26 9:21 ` [PATCH v3 1/5] arm: stm32mp: add config for STM32IMAGE support Patrick Delaunay
@ 2021-07-26 9:21 ` Patrick Delaunay
2021-08-16 11:38 ` Patrice CHOTARD
2021-07-26 9:21 ` [PATCH v3 3/5] arm: stm32mp: add defconfig for trusted boot with FIP Patrick Delaunay
` (2 subsequent siblings)
4 siblings, 1 reply; 11+ messages in thread
From: Patrick Delaunay @ 2021-07-26 9:21 UTC (permalink / raw)
To: u-boot
Cc: Yann GAUTIER, Patrick Delaunay, Patrice Chotard, Tom Rini, U-Boot STM32
With FIP support in TF-A (when CONFIG_STM32MP15x_STM32IMAGE
is not activated), the DT nodes needed by OP-TEE are added by OP-TEE
firmware in U-Boot device tree, present in FIP.
These nodes are only required in trusted boot, when TF-A load the file
u-boot.stm32, including the U-Boot device tree with STM32IMAGE header,
in this case OP-TEE can't update the U-Boot device tree.
Moreover in trusted boot mode with FIP, as the OP-TEE nodes are present
in U-Boot device tree only when needed the function
stm32_fdt_disable_optee can be removed.
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
---
(no changes since v1)
arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi | 3 +++
arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi | 3 +++
arch/arm/mach-stm32mp/fdt.c | 11 ++++++++++-
3 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi b/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi
index 7dcc96c19c..8b66dace37 100644
--- a/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi
+++ b/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi
@@ -21,6 +21,8 @@
st,stm32prog-gpios = <&gpioa 14 GPIO_ACTIVE_LOW>;
};
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
+ /* only needed for boot with TF-A, witout FIP support */
firmware {
optee {
compatible = "linaro,optee-tz";
@@ -34,6 +36,7 @@
no-map;
};
};
+#endif
led {
red {
diff --git a/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi b/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi
index 46a43371bd..e5a1cb7084 100644
--- a/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi
+++ b/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi
@@ -20,6 +20,8 @@
st,stm32prog-gpios = <&gpioa 14 GPIO_ACTIVE_LOW>;
};
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
+ /* only needed for boot with TF-A, witout FIP support */
firmware {
optee {
compatible = "linaro,optee-tz";
@@ -33,6 +35,7 @@
no-map;
};
};
+#endif
led {
red {
diff --git a/arch/arm/mach-stm32mp/fdt.c b/arch/arm/mach-stm32mp/fdt.c
index ce2fe0206f..a19e954cf7 100644
--- a/arch/arm/mach-stm32mp/fdt.c
+++ b/arch/arm/mach-stm32mp/fdt.c
@@ -332,7 +332,16 @@ int ft_system_setup(void *blob, struct bd_info *bd)
"st,package", pkg, false);
}
- if (!CONFIG_IS_ENABLED(OPTEE) ||
+ /*
+ * TEMP: remove OP-TEE nodes in kernel device tree
+ * copied from U-Boot device tree by optee_copy_fdt_nodes
+ * when OP-TEE is not detected (probe failed)
+ * these OP-TEE nodes are present in <board>-u-boot.dtsi
+ * under CONFIG_STM32MP15x_STM32IMAGE only for compatibility
+ * when FIP is not used by TF-A
+ */
+ if (CONFIG_IS_ENABLED(STM32MP15x_STM32IMAGE) &&
+ CONFIG_IS_ENABLED(OPTEE) &&
!tee_find_device(NULL, NULL, NULL, NULL))
stm32_fdt_disable_optee(blob);
--
2.25.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [PATCH v3 3/5] arm: stm32mp: add defconfig for trusted boot with FIP
2021-07-26 9:21 [PATCH v3 0/5] stm32mp1: handle TF-A boot with FIP Patrick Delaunay
2021-07-26 9:21 ` [PATCH v3 1/5] arm: stm32mp: add config for STM32IMAGE support Patrick Delaunay
2021-07-26 9:21 ` [PATCH v3 2/5] arm: stm32mp: handle the OP-TEE nodes in DT with FIP support Patrick Delaunay
@ 2021-07-26 9:21 ` Patrick Delaunay
2021-08-16 11:38 ` Patrice CHOTARD
2021-07-26 9:21 ` [PATCH v3 4/5] doc: st: stm32mp1: Add FIP support for trusted boot Patrick Delaunay
2021-07-26 9:21 ` [PATCH v3 5/5] stm32mp1: stm32prog: remove stm32prog_get_tee_partitions with FIP Patrick Delaunay
4 siblings, 1 reply; 11+ messages in thread
From: Patrick Delaunay @ 2021-07-26 9:21 UTC (permalink / raw)
To: u-boot
Cc: Yann GAUTIER, Patrick Delaunay, Patrice Chotard,
Jean-Philippe ROMAIN, Simon Glass, Tom Rini, U-Boot STM32
Add TF-A FIP support for trusted boot on STM32MP15x,
when STM32MP15x_STM32IMAGE is not activated.
With FIP support the SSBL partition is named "fip" and its size is 4MB,
so the ENV partition name in device tree (for SD card or eMMC)
or offset in defconfig (CONFIG_ENV_OFFSET / CONFIG_ENV_OFFSET_REDUND)
need to be modified.
With FIP the TEE MTD partitions are removed because the OP-TEE binray are
included in the FIP containers.
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
---
(no changes since v2)
Changes in v2:
- synchronize defconfig with latest change
arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi | 6 +-
arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi | 6 +-
board/st/common/Kconfig | 21 ++-
board/st/common/stm32mp_mtdparts.c | 31 +++--
board/st/stm32mp1/MAINTAINERS | 1 +
configs/stm32mp15_defconfig | 158 +++++++++++++++++++++++
6 files changed, 207 insertions(+), 16 deletions(-)
create mode 100644 configs/stm32mp15_defconfig
diff --git a/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi b/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi
index 8b66dace37..460a14e8a9 100644
--- a/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi
+++ b/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi
@@ -15,13 +15,17 @@
config {
u-boot,boot-led = "heartbeat";
u-boot,error-led = "error";
- u-boot,mmc-env-partition = "ssbl";
+ u-boot,mmc-env-partition = "fip";
st,adc_usb_pd = <&adc1 18>, <&adc1 19>;
st,fastboot-gpios = <&gpioa 13 GPIO_ACTIVE_LOW>;
st,stm32prog-gpios = <&gpioa 14 GPIO_ACTIVE_LOW>;
};
#ifdef CONFIG_STM32MP15x_STM32IMAGE
+ config {
+ u-boot,mmc-env-partition = "ssbl";
+ };
+
/* only needed for boot with TF-A, witout FIP support */
firmware {
optee {
diff --git a/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi b/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi
index e5a1cb7084..69eb285bf7 100644
--- a/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi
+++ b/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi
@@ -15,12 +15,16 @@
config {
u-boot,boot-led = "heartbeat";
u-boot,error-led = "error";
- u-boot,mmc-env-partition = "ssbl";
+ u-boot,mmc-env-partition = "fip";
st,fastboot-gpios = <&gpioa 13 GPIO_ACTIVE_LOW>;
st,stm32prog-gpios = <&gpioa 14 GPIO_ACTIVE_LOW>;
};
#ifdef CONFIG_STM32MP15x_STM32IMAGE
+ config {
+ u-boot,mmc-env-partition = "ssbl";
+ };
+
/* only needed for boot with TF-A, witout FIP support */
firmware {
optee {
diff --git a/board/st/common/Kconfig b/board/st/common/Kconfig
index ddcf33a122..2f57118bb2 100644
--- a/board/st/common/Kconfig
+++ b/board/st/common/Kconfig
@@ -8,18 +8,22 @@ config CMD_STBOARD
config MTDPARTS_NAND0_BOOT
string "mtd boot partitions for nand0"
- default "2m(fsbl),2m(ssbl1),2m(ssbl2)"
+ default "2m(fsbl),2m(ssbl1),2m(ssbl2)" if STM32MP15x_STM32IMAGE || \
+ !TFABOOT
+ default "2m(fsbl),4m(fip1),4m(fip2)"
depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP
help
This define the partitions of nand0 used to build mtparts dynamically
for boot from nand0.
Each partition need to be aligned with the device erase block size,
512KB is the max size for the NAND supported by stm32mp1 platform.
+ The fsbl partition support multiple copy of the same binary, one by
+ erase block.
config MTDPARTS_NAND0_TEE
string "mtd tee partitions for nand0"
default "512k(teeh),512k(teed),512k(teex)"
- depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP
+ depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP && STM32MP15x_STM32IMAGE
help
This define the tee partitions added in mtparts dynamically
when tee is supported with boot from nand0.
@@ -28,7 +32,9 @@ config MTDPARTS_NAND0_TEE
config MTDPARTS_NOR0_BOOT
string "mtd boot partitions for nor0"
- default "256k(fsbl1),256k(fsbl2),2m(ssbl),512k(u-boot-env)"
+ default "256k(fsbl1),256k(fsbl2),2m(ssbl),512k(u-boot-env)" if STM32MP15x_STM32IMAGE || \
+ !TFABOOT
+ default "256k(fsbl1),256k(fsbl2),4m(fip),512k(u-boot-env)"
depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP
help
This define the partitions of nand0 used to build mtparts dynamically
@@ -40,24 +46,27 @@ config MTDPARTS_NOR0_BOOT
config MTDPARTS_NOR0_TEE
string "mtd tee partitions for nor0"
default "256k(teeh),512k(teed),256k(teex)"
- depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP
+ depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP && STM32MP15x_STM32IMAGE
help
This define the tee partitions added in mtparts dynamically
when tee is supported with boot from nor0.
config MTDPARTS_SPINAND0_BOOT
string "mtd boot partitions for spi-nand0"
- default "2m(fsbl),2m(ssbl1),2m(ssbl2)"
+ default "2m(fsbl),2m(ssbl1),2m(ssbl2)" if STM32MP15x_STM32IMAGE || !TFABOOT
+ default "2m(fsbl),4m(fip1),4m(fip2)"
depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP
help
This define the partitions of nand0 used to build mtparts dynamically
for boot from spi-nand0,
512KB is the max size for the NAND supported by stm32mp1 platform.
+ The fsbl partition support multiple copy of the same binary, one by
+ erase block.
config MTDPARTS_SPINAND0_TEE
string "mtd tee partitions for spi-nand0"
default "512k(teeh),512k(teed),512k(teex)"
- depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP
+ depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP && STM32MP15x_STM32IMAGE
help
This define the tee partitions added in mtparts dynamically
when tee is supported with boot from spi-nand0,
diff --git a/board/st/common/stm32mp_mtdparts.c b/board/st/common/stm32mp_mtdparts.c
index f074fc189d..8b636d62fa 100644
--- a/board/st/common/stm32mp_mtdparts.c
+++ b/board/st/common/stm32mp_mtdparts.c
@@ -11,7 +11,9 @@
#include <log.h>
#include <mtd.h>
#include <mtd_node.h>
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
#include <tee.h>
+#endif
#include <asm/arch/stm32prog.h>
#include <asm/arch/sys_proto.h>
#include <asm/global_data.h>
@@ -31,7 +33,9 @@ static void board_set_mtdparts(const char *dev,
char *mtdids,
char *mtdparts,
const char *boot,
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
const char *tee,
+#endif
const char *user)
{
/* mtdids: "<dev>=<dev>, ...." */
@@ -55,10 +59,12 @@ static void board_set_mtdparts(const char *dev,
strncat(mtdparts, ",", MTDPARTS_LEN);
}
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
if (tee) {
strncat(mtdparts, tee, MTDPARTS_LEN);
strncat(mtdparts, ",", MTDPARTS_LEN);
}
+#endif
strncat(mtdparts, user, MTDPARTS_LEN);
}
@@ -70,7 +76,10 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
static char parts[3 * MTDPARTS_LEN + 1];
static char ids[MTDIDS_LEN + 1];
static bool mtd_initialized;
- bool tee, nor, nand, spinand, serial;
+ bool nor, nand, spinand, serial;
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
+ bool tee = false;
+#endif
if (mtd_initialized) {
*mtdids = ids;
@@ -78,7 +87,6 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
return;
}
- tee = false;
nor = false;
nand = false;
spinand = false;
@@ -89,7 +97,9 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
case BOOT_SERIAL_USB:
serial = true;
if (CONFIG_IS_ENABLED(CMD_STM32PROG)) {
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
tee = stm32prog_get_tee_partitions();
+#endif
nor = stm32prog_get_fsbl_nor();
}
nand = true;
@@ -108,9 +118,11 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
break;
}
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
if (!serial && CONFIG_IS_ENABLED(OPTEE) &&
tee_find_device(NULL, NULL, NULL, NULL))
tee = true;
+#endif
memset(parts, 0, sizeof(parts));
memset(ids, 0, sizeof(ids));
@@ -125,10 +137,11 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
if (nand) {
mtd = get_mtd_device_nm("nand0");
if (!IS_ERR_OR_NULL(mtd)) {
- const char *mtd_tee = CONFIG_MTDPARTS_NAND0_TEE;
board_set_mtdparts("nand0", ids, parts,
CONFIG_MTDPARTS_NAND0_BOOT,
- !nor && tee ? mtd_tee : NULL,
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
+ !nor && tee ? CONFIG_MTDPARTS_NAND0_TEE : NULL,
+#endif
"-(UBI)");
put_mtd_device(mtd);
}
@@ -137,10 +150,11 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
if (spinand) {
mtd = get_mtd_device_nm("spi-nand0");
if (!IS_ERR_OR_NULL(mtd)) {
- const char *mtd_tee = CONFIG_MTDPARTS_SPINAND0_TEE;
board_set_mtdparts("spi-nand0", ids, parts,
CONFIG_MTDPARTS_SPINAND0_BOOT,
- !nor && tee ? mtd_tee : NULL,
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
+ !nor && tee ? CONFIG_MTDPARTS_SPINAND0_TEE : NULL,
+#endif
"-(UBI)");
put_mtd_device(mtd);
}
@@ -148,10 +162,11 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
if (nor) {
if (!uclass_get_device(UCLASS_SPI_FLASH, 0, &dev)) {
- const char *mtd_tee = CONFIG_MTDPARTS_NOR0_TEE;
board_set_mtdparts("nor0", ids, parts,
CONFIG_MTDPARTS_NOR0_BOOT,
- tee ? mtd_tee : NULL,
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
+ tee ? CONFIG_MTDPARTS_NOR0_TEE : NULL,
+#endif
"-(nor_user)");
}
}
diff --git a/board/st/stm32mp1/MAINTAINERS b/board/st/stm32mp1/MAINTAINERS
index fe8fc6f484..0e6d80fb45 100644
--- a/board/st/stm32mp1/MAINTAINERS
+++ b/board/st/stm32mp1/MAINTAINERS
@@ -5,6 +5,7 @@ T: git https://source.denx.de/u-boot/custodians/u-boot-stm.git
S: Maintained
F: arch/arm/dts/stm32mp15*
F: board/st/stm32mp1/
+F: configs/stm32mp15_defconfig
F: configs/stm32mp15_basic_defconfig
F: configs/stm32mp15_trusted_defconfig
F: include/configs/stm32mp1.h
diff --git a/configs/stm32mp15_defconfig b/configs/stm32mp15_defconfig
new file mode 100644
index 0000000000..b11da7dc9f
--- /dev/null
+++ b/configs/stm32mp15_defconfig
@@ -0,0 +1,158 @@
+CONFIG_ARM=y
+CONFIG_ARCH_STM32MP=y
+CONFIG_TFABOOT=y
+CONFIG_SYS_MALLOC_F_LEN=0x3000
+CONFIG_SYS_MEMTEST_START=0xc0000000
+CONFIG_SYS_MEMTEST_END=0xc4000000
+CONFIG_ENV_OFFSET=0x480000
+CONFIG_ENV_SECT_SIZE=0x40000
+CONFIG_DEFAULT_DEVICE_TREE="stm32mp157c-ev1"
+CONFIG_TARGET_ST_STM32MP15x=y
+CONFIG_CMD_STM32KEY=y
+CONFIG_CMD_STM32PROG=y
+CONFIG_ENV_OFFSET_REDUND=0x4C0000
+CONFIG_TYPEC_STUSB160X=y
+CONFIG_DISTRO_DEFAULTS=y
+CONFIG_FIT=y
+CONFIG_BOOTDELAY=1
+CONFIG_BOOTCOMMAND="run bootcmd_stm32mp"
+CONFIG_SYS_PROMPT="STM32MP> "
+CONFIG_CMD_ADTIMG=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_NVEDIT_EFI=y
+CONFIG_CMD_MEMINFO=y
+CONFIG_CMD_MEMTEST=y
+CONFIG_CMD_UNZIP=y
+CONFIG_CMD_ADC=y
+CONFIG_CMD_CLK=y
+CONFIG_CMD_DFU=y
+CONFIG_CMD_FUSE=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_I2C=y
+CONFIG_CMD_MMC=y
+CONFIG_CMD_REMOTEPROC=y
+CONFIG_CMD_SPI=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_USB_MASS_STORAGE=y
+CONFIG_CMD_BMP=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_EFIDEBUG=y
+CONFIG_CMD_TIME=y
+CONFIG_CMD_RNG=y
+CONFIG_CMD_TIMER=y
+CONFIG_CMD_PMIC=y
+CONFIG_CMD_REGULATOR=y
+CONFIG_CMD_EXT4_WRITE=y
+CONFIG_CMD_MTDPARTS=y
+CONFIG_CMD_LOG=y
+CONFIG_CMD_UBI=y
+CONFIG_OF_LIVE=y
+CONFIG_ENV_IS_NOWHERE=y
+CONFIG_ENV_IS_IN_MMC=y
+CONFIG_ENV_IS_IN_SPI_FLASH=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
+CONFIG_ENV_UBI_PART="UBI"
+CONFIG_ENV_UBI_VOLUME="uboot_config"
+CONFIG_ENV_UBI_VOLUME_REDUND="uboot_config_r"
+CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+CONFIG_SYS_MMC_ENV_DEV=-1
+CONFIG_STM32_ADC=y
+CONFIG_CLK_SCMI=y
+CONFIG_SET_DFU_ALT_INFO=y
+CONFIG_USB_FUNCTION_FASTBOOT=y
+CONFIG_FASTBOOT_BUF_ADDR=0xC0000000
+CONFIG_FASTBOOT_BUF_SIZE=0x02000000
+CONFIG_FASTBOOT_USB_DEV=1
+CONFIG_FASTBOOT_FLASH=y
+CONFIG_FASTBOOT_FLASH_MMC_DEV=1
+CONFIG_FASTBOOT_MMC_BOOT_SUPPORT=y
+CONFIG_FASTBOOT_MMC_BOOT1_NAME="mmc1boot0"
+CONFIG_FASTBOOT_MMC_BOOT2_NAME="mmc1boot1"
+CONFIG_FASTBOOT_MMC_USER_SUPPORT=y
+CONFIG_FASTBOOT_MMC_USER_NAME="mmc1"
+CONFIG_FASTBOOT_CMD_OEM_FORMAT=y
+CONFIG_FASTBOOT_CMD_OEM_PARTCONF=y
+CONFIG_FASTBOOT_CMD_OEM_BOOTBUS=y
+CONFIG_GPIO_HOG=y
+CONFIG_DM_HWSPINLOCK=y
+CONFIG_HWSPINLOCK_STM32=y
+CONFIG_DM_I2C=y
+CONFIG_SYS_I2C_STM32F7=y
+CONFIG_LED=y
+CONFIG_LED_GPIO=y
+CONFIG_DM_MAILBOX=y
+CONFIG_STM32_IPCC=y
+CONFIG_STM32_FMC2_EBI=y
+CONFIG_SUPPORT_EMMC_BOOT=y
+CONFIG_STM32_SDMMC2=y
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_SYS_MTDPARTS_RUNTIME=y
+CONFIG_MTD_RAW_NAND=y
+CONFIG_NAND_STM32_FMC2=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_DM_SPI_FLASH=y
+CONFIG_SPI_FLASH_MACRONIX=y
+CONFIG_SPI_FLASH_SPANSION=y
+CONFIG_SPI_FLASH_STMICRO=y
+CONFIG_SPI_FLASH_WINBOND=y
+# CONFIG_SPI_FLASH_USE_4K_SECTORS is not set
+CONFIG_SPI_FLASH_MTD=y
+CONFIG_PHY_REALTEK=y
+CONFIG_DM_ETH=y
+CONFIG_DWC_ETH_QOS=y
+CONFIG_PHY=y
+CONFIG_PHY_STM32_USBPHYC=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_STMFX=y
+CONFIG_DM_PMIC=y
+CONFIG_PMIC_STPMIC1=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_DM_REGULATOR_STM32_VREFBUF=y
+CONFIG_DM_REGULATOR_STPMIC1=y
+CONFIG_REMOTEPROC_STM32_COPRO=y
+CONFIG_RESET_SCMI=y
+CONFIG_DM_RNG=y
+CONFIG_RNG_STM32MP1=y
+CONFIG_DM_RTC=y
+CONFIG_RTC_STM32=y
+CONFIG_SERIAL_RX_BUFFER=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_STM32_QSPI=y
+CONFIG_STM32_SPI=y
+CONFIG_TEE=y
+CONFIG_OPTEE=y
+# CONFIG_OPTEE_TA_AVB is not set
+CONFIG_USB=y
+CONFIG_DM_USB=y
+CONFIG_DM_USB_GADGET=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_GENERIC=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_GADGET_MANUFACTURER="STMicroelectronics"
+CONFIG_USB_GADGET_VENDOR_NUM=0x0483
+CONFIG_USB_GADGET_PRODUCT_NUM=0x5720
+CONFIG_USB_GADGET_DWC2_OTG=y
+CONFIG_DM_VIDEO=y
+CONFIG_BACKLIGHT_GPIO=y
+CONFIG_VIDEO_LCD_ORISETECH_OTM8009A=y
+CONFIG_VIDEO_LCD_RAYDIUM_RM68200=y
+CONFIG_VIDEO_STM32=y
+CONFIG_VIDEO_STM32_DSI=y
+CONFIG_VIDEO_STM32_MAX_XRES=1280
+CONFIG_VIDEO_STM32_MAX_YRES=800
+CONFIG_VIDEO_BMP_RLE8=y
+CONFIG_BMP_16BPP=y
+CONFIG_BMP_24BPP=y
+CONFIG_BMP_32BPP=y
+CONFIG_WDT=y
+CONFIG_WDT_STM32MP=y
+CONFIG_ERRNO_STR=y
+CONFIG_FDT_FIXUP_PARTITIONS=y
+# CONFIG_LMB_USE_MAX_REGIONS is not set
+CONFIG_LMB_MEMORY_REGIONS=2
+CONFIG_LMB_RESERVED_REGIONS=16
--
2.25.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [PATCH v3 4/5] doc: st: stm32mp1: Add FIP support for trusted boot
2021-07-26 9:21 [PATCH v3 0/5] stm32mp1: handle TF-A boot with FIP Patrick Delaunay
` (2 preceding siblings ...)
2021-07-26 9:21 ` [PATCH v3 3/5] arm: stm32mp: add defconfig for trusted boot with FIP Patrick Delaunay
@ 2021-07-26 9:21 ` Patrick Delaunay
2021-08-16 11:39 ` Patrice CHOTARD
2021-07-26 9:21 ` [PATCH v3 5/5] stm32mp1: stm32prog: remove stm32prog_get_tee_partitions with FIP Patrick Delaunay
4 siblings, 1 reply; 11+ messages in thread
From: Patrick Delaunay @ 2021-07-26 9:21 UTC (permalink / raw)
To: u-boot; +Cc: Yann GAUTIER, Patrick Delaunay, Patrice Chotard, U-Boot STM32
TF-A for STM32MP15 now supports the FIP: it is a packaging format which
includes the secure monitor, u-boot-nodtb.bin and u-boot.dtb
This FIP file is loaded by FSBL = TF-A BL2.
This patch updates the board documentation to use this FIP file and no
more u-boot.stm32 (with STM32 image header) which is no more generated.
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
---
Changes in v3:
- add reference for STM32 WIKI, TF-A and OP-TEE
- add information about TF-A compilation and clarify the output files
Changes in v2:
- fix one typo: s/ enought / enough
doc/board/st/stm32mp1.rst | 328 +++++++++++++++++++++++++++-----------
1 file changed, 232 insertions(+), 96 deletions(-)
diff --git a/doc/board/st/stm32mp1.rst b/doc/board/st/stm32mp1.rst
index f0c2b09b98..42bb94148d 100644
--- a/doc/board/st/stm32mp1.rst
+++ b/doc/board/st/stm32mp1.rst
@@ -6,6 +6,8 @@ STM32MP15x boards
This is a quick instruction for setup STM32MP15x boards.
+Futher information can be found in STMicrolectronics STM32 WIKI_.
+
Supported devices
-----------------
@@ -60,7 +62,7 @@ Currently the following boards are supported:
Boot Sequences
--------------
-3 boot configurations are supported with:
+2 boot configurations are supported with:
+----------+------------------------+-------------------------+--------------+
| **ROM** | **FSBL** | **SSBL** | **OS** |
@@ -70,32 +72,37 @@ Boot Sequences
| | embedded RAM | DDR |
+----------+------------------------+-------------------------+--------------+
-The **Trusted** boot chain
-``````````````````````````
-
-defconfig_file : stm32mp15_trusted_defconfig
+The **Trusted** boot chain with TF-A_
+`````````````````````````````````````
- +-------------+-------------------------+------------+-------+
- | ROM code | FSBL | SSBL | OS |
- + +-------------------------+------------+-------+
- | |Trusted Firmware-A (TF-A)| U-Boot | Linux |
- +-------------+-------------------------+------------+-------+
- | TrustZone |secure monitor |
- +-------------+-------------------------+------------+-------+
+defconfig_file :
+ + **stm32mp15_defconfig** (for TF-A_ with FIP support)
+ + **stm32mp15_trusted_defconfig** (for TF-A_ without FIP support)
-TF-A performs a full initialization of Secure peripherals and installs a
-secure monitor, BL32:
+ +-------------+--------------------------+------------+-------+
+ | ROM code | FSBL | SSBL | OS |
+ + +--------------------------+------------+-------+
+ | |Trusted Firmware-A (TF-A_)| U-Boot | Linux |
+ +-------------+--------------------------+------------+-------+
+ | TrustZone |secure monitor = SPMin or OP-TEE_ |
+ +-------------+--------------------------+------------+-------+
- * SPMin provided by TF-A or
- * OP-TEE from specific partitions (teeh, teed, teex).
+TF-A_ and OP-TEE_ are 2 separate projects, with their git repository;
+they are compiled separately.
-U-Boot is running in normal world and uses the secure monitor to access
-to secure resources.
+TF-A_ (BL2) initialize the DDR and loads the next stage binaries from a FIP file:
+ + BL32: a secure monitor BL32 = SPMin provided by TF-A_ or OP-TEE_ :
+ performs a full initialization of Secure peripherals and provides service
+ to normal world
+ + BL33: a non-trusted firmware = U-Boot, running in normal world and uses
+ the secure monitor to access to secure resources.
+ + HW_CONFIG: The hardware configuration file = the U-Boot device tree
-The **Basic** boot chain
-````````````````````````
+The **Basic** boot chain with SPL
+`````````````````````````````````
-defconfig_file : stm32mp15_basic_defconfig
+defconfig_file :
+ + **stm32mp15_basic_defconfig**
+-------------+------------+------------+-------+
| ROM code | FSBL | SSBL | OS |
@@ -105,7 +112,7 @@ defconfig_file : stm32mp15_basic_defconfig
| TrustZone | | PSCI from U-Boot |
+-------------+------------+------------+-------+
-SPL has limited security initialization
+SPL has limited security initialization.
U-Boot is running in secure mode and provide a secure monitor to the kernel
with only PSCI support (Power State Coordination Interface defined by ARM).
@@ -163,12 +170,13 @@ Build Procedure
for example: use one output directory for each configuration::
+ # export KBUILD_OUTPUT=stm32mp15
# export KBUILD_OUTPUT=stm32mp15_trusted
# export KBUILD_OUTPUT=stm32mp15_basic
you can build outside of code directory::
- # export KBUILD_OUTPUT=../build/stm32mp15_trusted
+ # export KBUILD_OUTPUT=../build/stm32mp15
4. Configure U-Boot::
@@ -176,7 +184,8 @@ Build Procedure
with <defconfig_file>:
- - For **trusted** boot mode : **stm32mp15_trusted_defconfig**
+ - For **trusted** boot mode : **stm32mp15_defconfig** or
+ stm32mp15_trusted_defconfig
- For basic boot mode: stm32mp15_basic_defconfig
5. Configure the device-tree and build the U-Boot image::
@@ -185,13 +194,13 @@ Build Procedure
Examples:
- a) trusted boot on ev1::
+ a) trusted boot with FIP on ev1::
- # export KBUILD_OUTPUT=stm32mp15_trusted
- # make stm32mp15_trusted_defconfig
+ # export KBUILD_OUTPUT=stm32mp15
+ # make stm32mp15_defconfig
# make DEVICE_TREE=stm32mp157c-ev1 all
- b) trusted with OP-TEE boot on dk2::
+ b) trusted boot without FIP on dk2::
# export KBUILD_OUTPUT=stm32mp15_trusted
# make stm32mp15_trusted_defconfig
@@ -221,24 +230,74 @@ Build Procedure
# make stm32mp15_basic_defconfig
# make DEVICE_TREE=stm32mp15xx-dhcor-avenger96 all
-6. Output files
-
- BootRom and TF-A expect binaries with STM32 image header
- SPL expects file with U-Boot uImage header
+6. U-Boot Output files
So in the output directory (selected by KBUILD_OUTPUT),
- you can found the needed files:
+ you can found the needed U-Boot files:
+
+ - stm32mp15_defconfig = **u-boot-nodtb.bin** and **u-boot.dtb**
+
+ - stm32mp15_trusted_defconfig = u-boot.stm32
+
+ - stm32mp15_basic_defconfig
+
+ - FSBL = spl/u-boot-spl.stm32
+
+ - SSBL = u-boot.img (without CONFIG_SPL_LOAD_FIT) or
+ u-boot.itb (with CONFIG_SPL_LOAD_FIT=y)
+
+7. TF-A_ compilation
+
+ This step is required only for **Trusted** boot (stm32mp15_defconfig and
+ stm32mp15_trusted_defconfig); see OP-TEE_ and TF-A_ documentation for build
+ commands.
+
+ - For TF-A_ with FIP support: **stm32mp15_defconfig**
+
+ - with OP-TEE_ support, compile the OP-TEE to generate the binary included
+ in FIP
+
+ - after TF-A compilation, the used files are:
+
+ - TF-A_ BL2 => FSBL = **tf-a.stm32**
+
+ - FIP => **fip.bin**
+
+ FIP file includes the 2 files given in arguments of TF-A_ compilation:
- - For **Trusted** boot (with or without OP-TEE)
+ - BL33=u-boot-nodtb.bin
+ - BL33_CFG=u-boot.dtb
- - FSBL = **tf-a.stm32** (provided by TF-A compilation)
- - SSBL = **u-boot.stm32**
+ You can also update a existing FIP after U-boot compilation with fiptool,
+ a tool provided by TF-A_::
- - For Basic boot
+ # fiptool update --nt-fw u-boot-nodtb.bin --hw-config u-boot.dtb fip-stm32mp157c-ev1.bin
+
+ - For TF-A_ without FIP support : **stm32mp15_trusted_defconfig**
+ SPMin is used and the used files are:
+
+ - FSBL = **tf-a.stm32** (provided by TF-A_ compilation, contening BL2 and
+ BL32 = SPMin)
+
+ - SSBL = **u-boot.stm32** used instead of fip.bin in next chapters
+
+8. The bootloaders files
+
++ The **ROM code** expects FSBL binaries with STM32 image header =
+ tf-a.stm32 or u-boot-spl.stm32
+
+According the FSBL / the boot mode:
+
++ **TF-A** expect a FIP binary = fip.bin, including the OS monitor (SPMin or
+ OP-TEE_) and the U-Boot binary + device tree
+
+ or, without FIP support, binaries with STM32 image header: U-Boot
+ = u-boot.stm32 and eventually OP-TEE files (tee-header.stm32, tee-pageable.stm32,
+ tee-pager.stm32)
+
++ **SPL** expects SSBL = U-Boot with uImage header = u-boot.img
+ or FIT = u-boot.itb.
- - FSBL = spl/u-boot-spl.stm32
- - SSBL = u-boot.img (without CONFIG_SPL_LOAD_FIT) or
- u-boot.itb (with CONFIG_SPL_LOAD_FIT=y)
Switch Setting for Boot Mode
----------------------------
@@ -299,51 +358,96 @@ Prepare an SD card
The minimal requirements for STMP32MP15x boot up to U-Boot are:
- GPT partitioning (with gdisk or with sgdisk)
-- 2 fsbl partitions, named fsbl1 and fsbl2, size at least 256KiB
-- one ssbl partition for U-Boot
+- 2 fsbl partitions, named "fsbl1" and "fsbl2", size at least 256KiB
+- one partition named "fip" for FIP or U-Boot (TF-A_ search the "fip"
+ partition and SPL search the 3th partition, because
+ CONFIG_SYS_MMCSD_RAW_MODE_U_BOOT_PARTITION=3)
+
+The 2 fsbl partitions have the same content and are present to guarantee a
+fail-safe update of FSBL; fsbl2 can be omitted if this ROM code feature is
+not required.
+
+Without FIP support in TF-A_, the 3rd partition "fip" for u-boot.stm32 must
+be named "ssbl".
Then the minimal GPT partition is:
- +-------+--------+---------+-------------+
- | *Num* | *Name* | *Size* | *Content* |
- +=======+========+=========+=============+
- | 1 | fsbl1 | 256 KiB | TF-A or SPL |
- +-------+--------+---------+-------------+
- | 2 | fsbl2 | 256 KiB | TF-A or SPL |
- +-------+--------+---------+-------------+
- | 3 | ssbl | enought | U-Boot |
- +-------+--------+---------+-------------+
- | 4 | <any> | <any> | Rootfs |
- +-------+--------+---------+-------------+
-
-Add a 4th partition (Rootfs) marked bootable with a file extlinux.conf
+For TF-A_ with FIP support:
+
+ +-------+--------+---------+------------------------+
+ | *Num* | *Name* | *Size* | *Content* |
+ +=======+========+=========+========================+
+ | 1 | fsbl1 | 256 KiB | TF-A_ BL2 (tf-a.stm32) |
+ +-------+--------+---------+------------------------+
+ | 2 | fsbl2 | 256 KiB | TF-A_ BL2 (tf-a.stm32) |
+ +-------+--------+---------+------------------------+
+ | 3 | fip | 4MB | fip.bin |
+ +-------+--------+---------+------------------------+
+ | 4 | <any> | <any> | Rootfs |
+ +-------+--------+---------+------------------------+
+
+or:
+
+ +-------+--------+---------+------------------------+------------------------+
+ | *Num* | *Name* | *Size* | *Trusted boot content* | *Basic boot content* |
+ +=======+========+=========+========================+========================+
+ | 1 | fsbl1 | 256 KiB | TF-A_ BL2 (tf-a.stm32) | SPL (u-boot-spl.stm32) |
+ +-------+--------+---------+------------------------+------------------------+
+ | 2 | fsbl2 | 256 KiB | TF-A_ BL2 (tf-a.stm32) | SPL (u-boot-spl.stm32) |
+ +-------+--------+---------+------------------------+------------------------+
+ | 3 | ssbl | 2MB | U-Boot (u-boot.stm32) | U-Boot (u-boot.img) |
+ +-------+--------+---------+------------------------+------------------------+
+ | 4 | <any> | <any> | Rootfs |
+ +-------+--------+---------+------------------------+------------------------+
+
+And the 4th partition (Rootfs) is marked bootable with a file extlinux.conf
following the Generic Distribution feature (doc/README.distro for use).
-According the used card reader select the correct block device
-(for example /dev/sdx or /dev/mmcblk0).
+The size of fip or ssbl partition must be enough for the associated binary file,
+4MB and 2MB are default values.
-In the next example, it is /dev/mmcblk0
+According the used card reader select the correct block device
+(for example /dev/sdx or /dev/mmcblk0), in the next example, it is /dev/mmcblk0
-For example: with gpt table with 128 entries
+For example:
a) remove previous formatting::
# sgdisk -o /dev/<SD card dev>
-b) create minimal image::
+b) create minimal image for FIP
+
+ For FIP support in TF-A_::
# sgdisk --resize-table=128 -a 1 \
-n 1:34:545 -c 1:fsbl1 \
-n 2:546:1057 -c 2:fsbl2 \
- -n 3:1058:5153 -c 3:ssbl \
- -n 4:5154: -c 4:rootfs \
+ -n 3:1058:9249 -c 3:fip \
+ -n 4:9250: -c 4:rootfs -A 4:set:2 \
-p /dev/<SD card dev>
- With other partition for kernel one partition rootfs for kernel.
+ With gpt table with 128 entries an the partition 4 marked bootable (bit 2).
+
+ For basic boot mode or without FIP support in TF-A_::
+
+ # sgdisk --resize-table=128 -a 1 \
+ -n 1:34:545 -c 1:fsbl1 \
+ -n 2:546:1057 -c 2:fsbl2 \
+ -n 3:1058:5153 -c 3:ssbl \
+ -n 4:5154: -c 4:rootfs -A 4:set:2 \
+ -p /dev/<SD card dev>
c) copy the FSBL (2 times) and SSBL file on the correct partition.
in this example in partition 1 to 3
+ for trusted boot: ::
+
+ # dd if=tf-a.stm32 of=/dev/mmcblk0p1
+ # dd if=tf-a.stm32 of=/dev/mmcblk0p2
+ # dd if=fip.bin of=/dev/mmcblk0p3
+ OR
+ dd if=u-boot.stm32 of=/dev/mmcblk0p3 # Without FIT support
+
for basic boot mode : <SD card dev> = /dev/mmcblk0::
# dd if=u-boot-spl.stm32 of=/dev/mmcblk0p1
@@ -352,12 +456,6 @@ c) copy the FSBL (2 times) and SSBL file on the correct partition.
OR
dd if=u-boot.itb of=/dev/mmcblk0p3 # With CONFIG_SPL_LOAD_FIT=y
- for trusted boot mode: ::
-
- # dd if=tf-a.stm32 of=/dev/mmcblk0p1
- # dd if=tf-a.stm32 of=/dev/mmcblk0p2
- # dd if=u-boot.stm32 of=/dev/mmcblk0p3
-
To boot from SD card, select BootPinMode = 1 0 1 and reset.
Prepare eMMC
@@ -366,34 +464,41 @@ Prepare eMMC
You can use U-Boot to copy binary in eMMC.
In the next example, you need to boot from SD card and the images
-(u-boot-spl.stm32, u-boot.img for systems without CONFIG_SPL_LOAD_FIT
-or u-boot.itb for systems with CONFIG_SPL_LOAD_FIT=y) are presents on
-SD card (mmc 0) in ext4 partition 4 (bootfs).
+(tf-a.stm32, fip.bin / u-boot-spl.stm32, u-boot.img for systems without
+CONFIG_SPL_LOAD_FIT or u-boot.itb for systems with CONFIG_SPL_LOAD_FIT=y) are
+presents on SD card (mmc 0) in ext4 partition 4 (bootfs)
To boot from SD card, select BootPinMode = 1 0 1 and reset.
Then you update the eMMC with the next U-Boot command :
a) prepare GPT on eMMC,
- example with 2 partitions, bootfs and roots::
+ example with 3 partitions, fip, bootfs and roots::
- # setenv emmc_part "name=ssbl,size=2MiB;name=bootfs,type=linux,bootable,size=64MiB;name=rootfs,type=linux,size=512"
+ # setenv emmc_part "name=fip,size=4MiB;name=bootfs,type=linux,bootable,size=64MiB;name=rootfs,type=linux,size=512"
# gpt write mmc 1 ${emmc_part}
-b) copy SPL on eMMC on firts boot partition
+b) copy FSBL, TF-A_ or SPL, on first eMMC boot partition
(SPL max size is 256kB, with LBA 512, 0x200)::
+ # ext4load mmc 0:4 0xC0000000 tf-a.stm32
+ or
# ext4load mmc 0:4 0xC0000000 u-boot-spl.stm32
+
# mmc dev 1
# mmc partconf 1 1 1 1
# mmc write ${fileaddr} 0 200
# mmc partconf 1 1 1 0
-c) copy U-Boot in first GPT partition of eMMC::
+c) copy SSBL, FIP or U-Boot binary, in first GPT partition of eMMC::
+ # ext4load mmc 0:4 0xC0000000 fip.bin
+ or
# ext4load mmc 0:4 0xC0000000 u-boot.img # Without CONFIG_SPL_LOAD_FIT
- OR
- ext4load mmc 0:4 0xC0000000 u-boot.itb # With CONFIG_SPL_LOAD_FIT=y
+ or
+ # ext4load mmc 0:4 0xC0000000 u-boot.itb # With CONFIG_SPL_LOAD_FIT=y
+
+
# mmc dev 1
# part start mmc 1 1 partstart
# mmc write ${fileaddr} ${partstart} ${filesize}
@@ -495,7 +600,8 @@ b) Automatically by using FIT feature and generic DISTRO bootcmd
see examples in the board stm32mp1 directory: fit_copro_kernel_dtb.its
- Generate FIT including kernel + device tree + M4 firmware with cfg with M4 boot::
+ Generate FIT including kernel + device tree + M4 firmware with cfg with M4
+ boot::
$> mkimage -f fit_copro_kernel_dtb.its fit_copro_kernel_dtb.itb
@@ -517,7 +623,7 @@ The dfu mode is started by the command::
STM32MP> dfu 0
-On EV1 board, booting from SD card, without OP-TEE::
+On EV1 board, booting from SD card, without OP-TEE_::
STM32MP> dfu 0 list
DFU alt settings list:
@@ -526,14 +632,14 @@ On EV1 board, booting from SD card, without OP-TEE::
dev: RAM alt: 2 name: uramdisk.image.gz layout: RAM_ADDR
dev: eMMC alt: 3 name: mmc0_fsbl1 layout: RAW_ADDR
dev: eMMC alt: 4 name: mmc0_fsbl2 layout: RAW_ADDR
- dev: eMMC alt: 5 name: mmc0_ssbl layout: RAW_ADDR
+ dev: eMMC alt: 5 name: mmc0_fip layout: RAW_ADDR
dev: eMMC alt: 6 name: mmc0_bootfs layout: RAW_ADDR
dev: eMMC alt: 7 name: mmc0_vendorfs layout: RAW_ADDR
dev: eMMC alt: 8 name: mmc0_rootfs layout: RAW_ADDR
dev: eMMC alt: 9 name: mmc0_userfs layout: RAW_ADDR
dev: eMMC alt: 10 name: mmc1_boot1 layout: RAW_ADDR
dev: eMMC alt: 11 name: mmc1_boot2 layout: RAW_ADDR
- dev: eMMC alt: 12 name: mmc1_ssbl layout: RAW_ADDR
+ dev: eMMC alt: 12 name: mmc1_fip layout: RAW_ADDR
dev: eMMC alt: 13 name: mmc1_bootfs layout: RAW_ADDR
dev: eMMC alt: 14 name: mmc1_vendorfs layout: RAW_ADDR
dev: eMMC alt: 15 name: mmc1_rootfs layout: RAW_ADDR
@@ -554,14 +660,14 @@ All the supported device are exported for dfu-util tool::
Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=15, name="mmc1_rootfs", serial="002700333338511934383330"
Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=14, name="mmc1_vendorfs", serial="002700333338511934383330"
Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=13, name="mmc1_bootfs", serial="002700333338511934383330"
- Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=12, name="mmc1_ssbl", serial="002700333338511934383330"
+ Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=12, name="mmc1_fip", serial="002700333338511934383330"
Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=11, name="mmc1_boot2", serial="002700333338511934383330"
Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=10, name="mmc1_boot1", serial="002700333338511934383330"
Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=9, name="mmc0_userfs", serial="002700333338511934383330"
Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=8, name="mmc0_rootfs", serial="002700333338511934383330"
Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=7, name="mmc0_vendorfs", serial="002700333338511934383330"
Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=6, name="mmc0_bootfs", serial="002700333338511934383330"
- Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=5, name="mmc0_ssbl", serial="002700333338511934383330"
+ Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=5, name="mmc0_fip", serial="002700333338511934383330"
Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=4, name="mmc0_fsbl2", serial="002700333338511934383330"
Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=3, name="mmc0_fsbl1", serial="002700333338511934383330"
Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=2, name="uramdisk.image.gz", serial="002700333338511934383330"
@@ -572,9 +678,9 @@ You can update the boot device:
- SD card (mmc0) ::
- $> dfu-util -d 0483:5720 -a 3 -D tf-a-stm32mp157c-ev1-trusted.stm32
- $> dfu-util -d 0483:5720 -a 4 -D tf-a-stm32mp157c-ev1-trusted.stm32
- $> dfu-util -d 0483:5720 -a 5 -D u-boot-stm32mp157c-ev1-trusted.img
+ $> dfu-util -d 0483:5720 -a 3 -D tf-a-stm32mp157c-ev1.stm32
+ $> dfu-util -d 0483:5720 -a 4 -D tf-a-stm32mp157c-ev1.stm32
+ $> dfu-util -d 0483:5720 -a 5 -D fip-stm32mp157c-ev1.bin
$> dfu-util -d 0483:5720 -a 6 -D st-image-bootfs-openstlinux-weston-stm32mp1.ext4
$> dfu-util -d 0483:5720 -a 7 -D st-image-vendorfs-openstlinux-weston-stm32mp1.ext4
$> dfu-util -d 0483:5720 -a 8 -D st-image-weston-openstlinux-weston-stm32mp1.ext4
@@ -582,9 +688,9 @@ You can update the boot device:
- EMMC (mmc1)::
- $> dfu-util -d 0483:5720 -a 10 -D tf-a-stm32mp157c-ev1-trusted.stm32
- $> dfu-util -d 0483:5720 -a 11 -D tf-a-stm32mp157c-ev1-trusted.stm32
- $> dfu-util -d 0483:5720 -a 12 -D u-boot-stm32mp157c-ev1-trusted.img
+ $> dfu-util -d 0483:5720 -a 10 -D tf-a-stm32mp157c-ev1.stm32
+ $> dfu-util -d 0483:5720 -a 11 -D tf-a-stm32mp157c-ev1.stm32
+ $> dfu-util -d 0483:5720 -a 12 -D fip-stm32mp157c-ev1.bin
$> dfu-util -d 0483:5720 -a 13 -D st-image-bootfs-openstlinux-weston-stm32mp1.ext4
$> dfu-util -d 0483:5720 -a 14 -D st-image-vendorfs-openstlinux-weston-stm32mp1.ext4
$> dfu-util -d 0483:5720 -a 15 -D st-image-weston-openstlinux-weston-stm32mp1.ext4
@@ -601,14 +707,44 @@ only the MTD partition on the boot devices are available, for example:
- NOR (nor0 = alt 20) & NAND (nand0 = alt 26) ::
- $> dfu-util -d 0483:5720 -a 21 -D tf-a-stm32mp157c-ev1-trusted.stm32
- $> dfu-util -d 0483:5720 -a 22 -D tf-a-stm32mp157c-ev1-trusted.stm32
- $> dfu-util -d 0483:5720 -a 23 -D u-boot-stm32mp157c-ev1-trusted.img
+ $> dfu-util -d 0483:5720 -a 21 -D tf-a-stm32mp157c-ev1.stm32
+ $> dfu-util -d 0483:5720 -a 22 -D tf-a-stm32mp157c-ev1.stm32
+ $> dfu-util -d 0483:5720 -a 23 -D fip-stm32mp157c-ev1.bin
$> dfu-util -d 0483:5720 -a 27 -D st-image-weston-openstlinux-weston-stm32mp1_nand_4_256_multivolume.ubi
- NAND (nand0 = alt 21)::
- $> dfu-util -d 0483:5720 -a 22 -D tf-a-stm32mp157c-ev1-trusted.stm32
- $> dfu-util -d 0483:5720 -a 23 -D u-boot-stm32mp157c-ev1-trusted.img
- $> dfu-util -d 0483:5720 -a 24 -D u-boot-stm32mp157c-ev1-trusted.img
+ $> dfu-util -d 0483:5720 -a 22 -D tf-a-stm32mp157c-ev1.stm32
+ $> dfu-util -d 0483:5720 -a 23 -D fip-stm32mp157c-ev1.bin
+ $> dfu-util -d 0483:5720 -a 24 -D fip-stm32mp157c-ev1.bin
$> dfu-util -d 0483:5720 -a 25 -D st-image-weston-openstlinux-weston-stm32mp1_nand_4_256_multivolume.ubi
+
+References
+----------
+
+.. _WIKI:
+
+STM32 Arm® Cortex®-based MPUs user guide
+
+ + https://wiki.st.com/
+ + https://wiki.st.com/stm32mpu/wiki/Main_Page
+
+.. _TF-A:
+
+TF-A = The Trusted Firmware-A project provides a reference implementation of
+secure world software for Armv7-A and Armv8-A class processors
+
+ + https://www.trustedfirmware.org/projects/tf-a/
+ + https://trustedfirmware-a.readthedocs.io/en/latest/
+ + https://trustedfirmware-a.readthedocs.io/en/latest/plat/stm32mp1.html
+ + https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/
+
+.. _OP-TEE:
+
+OP-TEE = an open source Trusted Execution Environment (TEE) implementing the
+Arm TrustZone technology
+
+ + https://www.op-tee.org/
+ + https://optee.readthedocs.io/en/latest/
+ + https://optee.readthedocs.io/en/latest/building/devices/stm32mp1.html
+ + https://github.com/OP-TEE/optee_os
\ No newline at end of file
--
2.25.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [PATCH v3 5/5] stm32mp1: stm32prog: remove stm32prog_get_tee_partitions with FIP
2021-07-26 9:21 [PATCH v3 0/5] stm32mp1: handle TF-A boot with FIP Patrick Delaunay
` (3 preceding siblings ...)
2021-07-26 9:21 ` [PATCH v3 4/5] doc: st: stm32mp1: Add FIP support for trusted boot Patrick Delaunay
@ 2021-07-26 9:21 ` Patrick Delaunay
2021-08-16 11:39 ` Patrice CHOTARD
4 siblings, 1 reply; 11+ messages in thread
From: Patrick Delaunay @ 2021-07-26 9:21 UTC (permalink / raw)
To: u-boot
Cc: Yann GAUTIER, Patrick Delaunay, Patrice Chotard, Jaehoon Chung,
Simon Glass, U-Boot STM32
The MTD tee partitions used to save the OP-TEE binary are needed when
TF-A doesn't use the FIP container to load binaries.
This patch puts under CONFIG_STM32MP15x_STM32IMAGE flag the associated
code in U-Boot binary and prepare the code cleanup when
CONFIG_STM32MP15x_STM32IMAGE support will be removed after TF-A migration
to FIP support.
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
---
(no changes since v1)
arch/arm/mach-stm32mp/cmd_stm32prog/cmd_stm32prog.c | 2 ++
arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.c | 4 ++++
arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.h | 2 ++
arch/arm/mach-stm32mp/include/mach/stm32prog.h | 2 ++
4 files changed, 10 insertions(+)
diff --git a/arch/arm/mach-stm32mp/cmd_stm32prog/cmd_stm32prog.c b/arch/arm/mach-stm32mp/cmd_stm32prog/cmd_stm32prog.c
index 064f51b2c7..1bccad4e6d 100644
--- a/arch/arm/mach-stm32mp/cmd_stm32prog/cmd_stm32prog.c
+++ b/arch/arm/mach-stm32mp/cmd_stm32prog/cmd_stm32prog.c
@@ -185,6 +185,7 @@ U_BOOT_CMD(stm32prog, 5, 0, do_stm32prog,
" <size> = size of flashlayout (optional for image with STM32 header)\n"
);
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
bool stm32prog_get_tee_partitions(void)
{
if (stm32prog_data)
@@ -192,6 +193,7 @@ bool stm32prog_get_tee_partitions(void)
return false;
}
+#endif
bool stm32prog_get_fsbl_nor(void)
{
diff --git a/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.c b/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.c
index 96ebc6d978..0971ee79af 100644
--- a/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.c
+++ b/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.c
@@ -824,7 +824,9 @@ static int treat_partition_list(struct stm32prog_data *data)
INIT_LIST_HEAD(&data->dev[j].part_list);
}
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
data->tee_detected = false;
+#endif
data->fsbl_nor_detected = false;
for (i = 0; i < data->part_nb; i++) {
part = &data->part_array[i];
@@ -878,10 +880,12 @@ static int treat_partition_list(struct stm32prog_data *data)
/* fallthrough */
case STM32PROG_NAND:
case STM32PROG_SPI_NAND:
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
if (!data->tee_detected &&
!strncmp(part->name, "tee", 3))
data->tee_detected = true;
break;
+#endif
default:
break;
}
diff --git a/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.h b/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.h
index 9d58cf0e2d..240c5c44bc 100644
--- a/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.h
+++ b/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.h
@@ -122,7 +122,9 @@ struct stm32prog_data {
struct stm32prog_dev_t dev[STM32PROG_MAX_DEV]; /* array of device */
int part_nb; /* nb of partition */
struct stm32prog_part_t *part_array; /* array of partition */
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
bool tee_detected;
+#endif
bool fsbl_nor_detected;
/* command internal information */
diff --git a/arch/arm/mach-stm32mp/include/mach/stm32prog.h b/arch/arm/mach-stm32mp/include/mach/stm32prog.h
index c080b9cc42..99be4e1d65 100644
--- a/arch/arm/mach-stm32mp/include/mach/stm32prog.h
+++ b/arch/arm/mach-stm32mp/include/mach/stm32prog.h
@@ -11,6 +11,8 @@ int stm32prog_read_medium_virt(struct dfu_entity *dfu, u64 offset,
void *buf, long *len);
int stm32prog_get_medium_size_virt(struct dfu_entity *dfu, u64 *size);
+#ifdef CONFIG_STM32MP15x_STM32IMAGE
bool stm32prog_get_tee_partitions(void);
+#endif
bool stm32prog_get_fsbl_nor(void);
--
2.25.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [PATCH v3 1/5] arm: stm32mp: add config for STM32IMAGE support
2021-07-26 9:21 ` [PATCH v3 1/5] arm: stm32mp: add config for STM32IMAGE support Patrick Delaunay
@ 2021-08-16 11:38 ` Patrice CHOTARD
0 siblings, 0 replies; 11+ messages in thread
From: Patrice CHOTARD @ 2021-08-16 11:38 UTC (permalink / raw)
To: Patrick Delaunay, u-boot
Cc: Yann GAUTIER, Ilias Apalodimas, Jean-Philippe ROMAIN,
Simon Glass, Tom Rini, U-Boot STM32
Hi Patrick
On 7/26/21 11:21 AM, Patrick Delaunay wrote:
> By default for trusted boot with TF-A, U-Boot (u-boot-nodtb)
> is located in FIP container with its device tree and with
> the secure monitor (provided by TF-A or OP-TEE).
> The FIP file is loaded by TF-A BL2 and each components is
> extracted at the final location.
>
> This patch add CONFIG_STM32MP15x_STM32IMAGE to request the
> STM32 image generation for SOC STM32MP15x
> when FIP container is not used (u-boot.stm32 is loaded by TF-A
> as done previously to keep the backward compatibility).
>
> Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
> Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
> ---
>
> (no changes since v1)
>
> arch/arm/mach-stm32mp/Kconfig | 7 +++++++
> arch/arm/mach-stm32mp/config.mk | 2 +-
> board/st/stm32mp1/stm32mp1.c | 10 +++++++---
> configs/stm32mp15_trusted_defconfig | 1 +
> 4 files changed, 16 insertions(+), 4 deletions(-)
>
> diff --git a/arch/arm/mach-stm32mp/Kconfig b/arch/arm/mach-stm32mp/Kconfig
> index 0e59931679..b9e623bc3c 100644
> --- a/arch/arm/mach-stm32mp/Kconfig
> +++ b/arch/arm/mach-stm32mp/Kconfig
> @@ -56,6 +56,13 @@ config STM32MP15x
> dual core A7 for STM32MP157/3, monocore for STM32MP151
> target all the STMicroelectronics board with SOC STM32MP1 family
>
> +config STM32MP15x_STM32IMAGE
> + bool "Support STM32 image for generated U-Boot image"
> + depends on STM32MP15x && TFABOOT
> + help
> + Support of STM32 image generation for SOC STM32MP15x
> + for TF-A boot when FIP container is not used
> +
> choice
> prompt "STM32MP15x board select"
> optional
> diff --git a/arch/arm/mach-stm32mp/config.mk b/arch/arm/mach-stm32mp/config.mk
> index c30bf482f7..f7f5b77c41 100644
> --- a/arch/arm/mach-stm32mp/config.mk
> +++ b/arch/arm/mach-stm32mp/config.mk
> @@ -4,7 +4,7 @@
> #
>
> ifndef CONFIG_SPL
> -INPUTS-y += u-boot.stm32
> +INPUTS-$(CONFIG_STM32MP15x_STM32IMAGE) += u-boot.stm32
> else
> ifdef CONFIG_SPL_BUILD
> INPUTS-y += u-boot-spl.stm32
> diff --git a/board/st/stm32mp1/stm32mp1.c b/board/st/stm32mp1/stm32mp1.c
> index 2faf5c81b4..70bd4d1ed5 100644
> --- a/board/st/stm32mp1/stm32mp1.c
> +++ b/board/st/stm32mp1/stm32mp1.c
> @@ -105,10 +105,14 @@ int checkboard(void)
> const char *fdt_compat;
> int fdt_compat_len;
>
> - if (IS_ENABLED(CONFIG_TFABOOT))
> - mode = "trusted";
> - else
> + if (IS_ENABLED(CONFIG_TFABOOT)) {
> + if (IS_ENABLED(CONFIG_STM32MP15x_STM32IMAGE))
> + mode = "trusted - stm32image";
> + else
> + mode = "trusted";
> + } else {
> mode = "basic";
> + }
>
> fdt_compat = fdt_getprop(gd->fdt_blob, 0, "compatible",
> &fdt_compat_len);
> diff --git a/configs/stm32mp15_trusted_defconfig b/configs/stm32mp15_trusted_defconfig
> index a58ea91d3e..6a8ccb1f3d 100644
> --- a/configs/stm32mp15_trusted_defconfig
> +++ b/configs/stm32mp15_trusted_defconfig
> @@ -7,6 +7,7 @@ CONFIG_SYS_MEMTEST_END=0xc4000000
> CONFIG_ENV_OFFSET=0x280000
> CONFIG_ENV_SECT_SIZE=0x40000
> CONFIG_DEFAULT_DEVICE_TREE="stm32mp157c-ev1"
> +CONFIG_STM32MP15x_STM32IMAGE=y
> CONFIG_TARGET_ST_STM32MP15x=y
> CONFIG_CMD_STM32KEY=y
> CONFIG_CMD_STM32PROG=y
>
Applied to u-boot-stm/master
Thanks
Patrice
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH v3 2/5] arm: stm32mp: handle the OP-TEE nodes in DT with FIP support
2021-07-26 9:21 ` [PATCH v3 2/5] arm: stm32mp: handle the OP-TEE nodes in DT with FIP support Patrick Delaunay
@ 2021-08-16 11:38 ` Patrice CHOTARD
0 siblings, 0 replies; 11+ messages in thread
From: Patrice CHOTARD @ 2021-08-16 11:38 UTC (permalink / raw)
To: Patrick Delaunay, u-boot; +Cc: Yann GAUTIER, Tom Rini, U-Boot STM32
Hi Patrick
On 7/26/21 11:21 AM, Patrick Delaunay wrote:
> With FIP support in TF-A (when CONFIG_STM32MP15x_STM32IMAGE
> is not activated), the DT nodes needed by OP-TEE are added by OP-TEE
> firmware in U-Boot device tree, present in FIP.
>
> These nodes are only required in trusted boot, when TF-A load the file
> u-boot.stm32, including the U-Boot device tree with STM32IMAGE header,
> in this case OP-TEE can't update the U-Boot device tree.
>
> Moreover in trusted boot mode with FIP, as the OP-TEE nodes are present
> in U-Boot device tree only when needed the function
> stm32_fdt_disable_optee can be removed.
>
> Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
> Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
> ---
>
> (no changes since v1)
>
> arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi | 3 +++
> arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi | 3 +++
> arch/arm/mach-stm32mp/fdt.c | 11 ++++++++++-
> 3 files changed, 16 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi b/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi
> index 7dcc96c19c..8b66dace37 100644
> --- a/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi
> +++ b/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi
> @@ -21,6 +21,8 @@
> st,stm32prog-gpios = <&gpioa 14 GPIO_ACTIVE_LOW>;
> };
>
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> + /* only needed for boot with TF-A, witout FIP support */
> firmware {
> optee {
> compatible = "linaro,optee-tz";
> @@ -34,6 +36,7 @@
> no-map;
> };
> };
> +#endif
>
> led {
> red {
> diff --git a/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi b/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi
> index 46a43371bd..e5a1cb7084 100644
> --- a/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi
> +++ b/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi
> @@ -20,6 +20,8 @@
> st,stm32prog-gpios = <&gpioa 14 GPIO_ACTIVE_LOW>;
> };
>
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> + /* only needed for boot with TF-A, witout FIP support */
> firmware {
> optee {
> compatible = "linaro,optee-tz";
> @@ -33,6 +35,7 @@
> no-map;
> };
> };
> +#endif
>
> led {
> red {
> diff --git a/arch/arm/mach-stm32mp/fdt.c b/arch/arm/mach-stm32mp/fdt.c
> index ce2fe0206f..a19e954cf7 100644
> --- a/arch/arm/mach-stm32mp/fdt.c
> +++ b/arch/arm/mach-stm32mp/fdt.c
> @@ -332,7 +332,16 @@ int ft_system_setup(void *blob, struct bd_info *bd)
> "st,package", pkg, false);
> }
>
> - if (!CONFIG_IS_ENABLED(OPTEE) ||
> + /*
> + * TEMP: remove OP-TEE nodes in kernel device tree
> + * copied from U-Boot device tree by optee_copy_fdt_nodes
> + * when OP-TEE is not detected (probe failed)
> + * these OP-TEE nodes are present in <board>-u-boot.dtsi
> + * under CONFIG_STM32MP15x_STM32IMAGE only for compatibility
> + * when FIP is not used by TF-A
> + */
> + if (CONFIG_IS_ENABLED(STM32MP15x_STM32IMAGE) &&
> + CONFIG_IS_ENABLED(OPTEE) &&
> !tee_find_device(NULL, NULL, NULL, NULL))
> stm32_fdt_disable_optee(blob);
>
>
Applied to u-boot-stm/master
Thanks
Patrice
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH v3 3/5] arm: stm32mp: add defconfig for trusted boot with FIP
2021-07-26 9:21 ` [PATCH v3 3/5] arm: stm32mp: add defconfig for trusted boot with FIP Patrick Delaunay
@ 2021-08-16 11:38 ` Patrice CHOTARD
0 siblings, 0 replies; 11+ messages in thread
From: Patrice CHOTARD @ 2021-08-16 11:38 UTC (permalink / raw)
To: Patrick Delaunay, u-boot
Cc: Yann GAUTIER, Jean-Philippe ROMAIN, Simon Glass, Tom Rini, U-Boot STM32
HI Patrick
On 7/26/21 11:21 AM, Patrick Delaunay wrote:
> Add TF-A FIP support for trusted boot on STM32MP15x,
> when STM32MP15x_STM32IMAGE is not activated.
>
> With FIP support the SSBL partition is named "fip" and its size is 4MB,
> so the ENV partition name in device tree (for SD card or eMMC)
> or offset in defconfig (CONFIG_ENV_OFFSET / CONFIG_ENV_OFFSET_REDUND)
> need to be modified.
>
> With FIP the TEE MTD partitions are removed because the OP-TEE binray are
> included in the FIP containers.
>
> Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
> Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
> ---
>
> (no changes since v2)
>
> Changes in v2:
> - synchronize defconfig with latest change
>
> arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi | 6 +-
> arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi | 6 +-
> board/st/common/Kconfig | 21 ++-
> board/st/common/stm32mp_mtdparts.c | 31 +++--
> board/st/stm32mp1/MAINTAINERS | 1 +
> configs/stm32mp15_defconfig | 158 +++++++++++++++++++++++
> 6 files changed, 207 insertions(+), 16 deletions(-)
> create mode 100644 configs/stm32mp15_defconfig
>
> diff --git a/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi b/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi
> index 8b66dace37..460a14e8a9 100644
> --- a/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi
> +++ b/arch/arm/dts/stm32mp157a-dk1-u-boot.dtsi
> @@ -15,13 +15,17 @@
> config {
> u-boot,boot-led = "heartbeat";
> u-boot,error-led = "error";
> - u-boot,mmc-env-partition = "ssbl";
> + u-boot,mmc-env-partition = "fip";
> st,adc_usb_pd = <&adc1 18>, <&adc1 19>;
> st,fastboot-gpios = <&gpioa 13 GPIO_ACTIVE_LOW>;
> st,stm32prog-gpios = <&gpioa 14 GPIO_ACTIVE_LOW>;
> };
>
> #ifdef CONFIG_STM32MP15x_STM32IMAGE
> + config {
> + u-boot,mmc-env-partition = "ssbl";
> + };
> +
> /* only needed for boot with TF-A, witout FIP support */
> firmware {
> optee {
> diff --git a/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi b/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi
> index e5a1cb7084..69eb285bf7 100644
> --- a/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi
> +++ b/arch/arm/dts/stm32mp157c-ed1-u-boot.dtsi
> @@ -15,12 +15,16 @@
> config {
> u-boot,boot-led = "heartbeat";
> u-boot,error-led = "error";
> - u-boot,mmc-env-partition = "ssbl";
> + u-boot,mmc-env-partition = "fip";
> st,fastboot-gpios = <&gpioa 13 GPIO_ACTIVE_LOW>;
> st,stm32prog-gpios = <&gpioa 14 GPIO_ACTIVE_LOW>;
> };
>
> #ifdef CONFIG_STM32MP15x_STM32IMAGE
> + config {
> + u-boot,mmc-env-partition = "ssbl";
> + };
> +
> /* only needed for boot with TF-A, witout FIP support */
> firmware {
> optee {
> diff --git a/board/st/common/Kconfig b/board/st/common/Kconfig
> index ddcf33a122..2f57118bb2 100644
> --- a/board/st/common/Kconfig
> +++ b/board/st/common/Kconfig
> @@ -8,18 +8,22 @@ config CMD_STBOARD
>
> config MTDPARTS_NAND0_BOOT
> string "mtd boot partitions for nand0"
> - default "2m(fsbl),2m(ssbl1),2m(ssbl2)"
> + default "2m(fsbl),2m(ssbl1),2m(ssbl2)" if STM32MP15x_STM32IMAGE || \
> + !TFABOOT
> + default "2m(fsbl),4m(fip1),4m(fip2)"
> depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP
> help
> This define the partitions of nand0 used to build mtparts dynamically
> for boot from nand0.
> Each partition need to be aligned with the device erase block size,
> 512KB is the max size for the NAND supported by stm32mp1 platform.
> + The fsbl partition support multiple copy of the same binary, one by
> + erase block.
>
> config MTDPARTS_NAND0_TEE
> string "mtd tee partitions for nand0"
> default "512k(teeh),512k(teed),512k(teex)"
> - depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP
> + depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP && STM32MP15x_STM32IMAGE
> help
> This define the tee partitions added in mtparts dynamically
> when tee is supported with boot from nand0.
> @@ -28,7 +32,9 @@ config MTDPARTS_NAND0_TEE
>
> config MTDPARTS_NOR0_BOOT
> string "mtd boot partitions for nor0"
> - default "256k(fsbl1),256k(fsbl2),2m(ssbl),512k(u-boot-env)"
> + default "256k(fsbl1),256k(fsbl2),2m(ssbl),512k(u-boot-env)" if STM32MP15x_STM32IMAGE || \
> + !TFABOOT
> + default "256k(fsbl1),256k(fsbl2),4m(fip),512k(u-boot-env)"
> depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP
> help
> This define the partitions of nand0 used to build mtparts dynamically
> @@ -40,24 +46,27 @@ config MTDPARTS_NOR0_BOOT
> config MTDPARTS_NOR0_TEE
> string "mtd tee partitions for nor0"
> default "256k(teeh),512k(teed),256k(teex)"
> - depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP
> + depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP && STM32MP15x_STM32IMAGE
> help
> This define the tee partitions added in mtparts dynamically
> when tee is supported with boot from nor0.
>
> config MTDPARTS_SPINAND0_BOOT
> string "mtd boot partitions for spi-nand0"
> - default "2m(fsbl),2m(ssbl1),2m(ssbl2)"
> + default "2m(fsbl),2m(ssbl1),2m(ssbl2)" if STM32MP15x_STM32IMAGE || !TFABOOT
> + default "2m(fsbl),4m(fip1),4m(fip2)"
> depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP
> help
> This define the partitions of nand0 used to build mtparts dynamically
> for boot from spi-nand0,
> 512KB is the max size for the NAND supported by stm32mp1 platform.
> + The fsbl partition support multiple copy of the same binary, one by
> + erase block.
>
> config MTDPARTS_SPINAND0_TEE
> string "mtd tee partitions for spi-nand0"
> default "512k(teeh),512k(teed),512k(teex)"
> - depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP
> + depends on SYS_MTDPARTS_RUNTIME && ARCH_STM32MP && STM32MP15x_STM32IMAGE
> help
> This define the tee partitions added in mtparts dynamically
> when tee is supported with boot from spi-nand0,
> diff --git a/board/st/common/stm32mp_mtdparts.c b/board/st/common/stm32mp_mtdparts.c
> index f074fc189d..8b636d62fa 100644
> --- a/board/st/common/stm32mp_mtdparts.c
> +++ b/board/st/common/stm32mp_mtdparts.c
> @@ -11,7 +11,9 @@
> #include <log.h>
> #include <mtd.h>
> #include <mtd_node.h>
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> #include <tee.h>
> +#endif
> #include <asm/arch/stm32prog.h>
> #include <asm/arch/sys_proto.h>
> #include <asm/global_data.h>
> @@ -31,7 +33,9 @@ static void board_set_mtdparts(const char *dev,
> char *mtdids,
> char *mtdparts,
> const char *boot,
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> const char *tee,
> +#endif
> const char *user)
> {
> /* mtdids: "<dev>=<dev>, ...." */
> @@ -55,10 +59,12 @@ static void board_set_mtdparts(const char *dev,
> strncat(mtdparts, ",", MTDPARTS_LEN);
> }
>
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> if (tee) {
> strncat(mtdparts, tee, MTDPARTS_LEN);
> strncat(mtdparts, ",", MTDPARTS_LEN);
> }
> +#endif
>
> strncat(mtdparts, user, MTDPARTS_LEN);
> }
> @@ -70,7 +76,10 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
> static char parts[3 * MTDPARTS_LEN + 1];
> static char ids[MTDIDS_LEN + 1];
> static bool mtd_initialized;
> - bool tee, nor, nand, spinand, serial;
> + bool nor, nand, spinand, serial;
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> + bool tee = false;
> +#endif
>
> if (mtd_initialized) {
> *mtdids = ids;
> @@ -78,7 +87,6 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
> return;
> }
>
> - tee = false;
> nor = false;
> nand = false;
> spinand = false;
> @@ -89,7 +97,9 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
> case BOOT_SERIAL_USB:
> serial = true;
> if (CONFIG_IS_ENABLED(CMD_STM32PROG)) {
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> tee = stm32prog_get_tee_partitions();
> +#endif
> nor = stm32prog_get_fsbl_nor();
> }
> nand = true;
> @@ -108,9 +118,11 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
> break;
> }
>
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> if (!serial && CONFIG_IS_ENABLED(OPTEE) &&
> tee_find_device(NULL, NULL, NULL, NULL))
> tee = true;
> +#endif
>
> memset(parts, 0, sizeof(parts));
> memset(ids, 0, sizeof(ids));
> @@ -125,10 +137,11 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
> if (nand) {
> mtd = get_mtd_device_nm("nand0");
> if (!IS_ERR_OR_NULL(mtd)) {
> - const char *mtd_tee = CONFIG_MTDPARTS_NAND0_TEE;
> board_set_mtdparts("nand0", ids, parts,
> CONFIG_MTDPARTS_NAND0_BOOT,
> - !nor && tee ? mtd_tee : NULL,
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> + !nor && tee ? CONFIG_MTDPARTS_NAND0_TEE : NULL,
> +#endif
> "-(UBI)");
> put_mtd_device(mtd);
> }
> @@ -137,10 +150,11 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
> if (spinand) {
> mtd = get_mtd_device_nm("spi-nand0");
> if (!IS_ERR_OR_NULL(mtd)) {
> - const char *mtd_tee = CONFIG_MTDPARTS_SPINAND0_TEE;
> board_set_mtdparts("spi-nand0", ids, parts,
> CONFIG_MTDPARTS_SPINAND0_BOOT,
> - !nor && tee ? mtd_tee : NULL,
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> + !nor && tee ? CONFIG_MTDPARTS_SPINAND0_TEE : NULL,
> +#endif
> "-(UBI)");
> put_mtd_device(mtd);
> }
> @@ -148,10 +162,11 @@ void board_mtdparts_default(const char **mtdids, const char **mtdparts)
>
> if (nor) {
> if (!uclass_get_device(UCLASS_SPI_FLASH, 0, &dev)) {
> - const char *mtd_tee = CONFIG_MTDPARTS_NOR0_TEE;
> board_set_mtdparts("nor0", ids, parts,
> CONFIG_MTDPARTS_NOR0_BOOT,
> - tee ? mtd_tee : NULL,
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> + tee ? CONFIG_MTDPARTS_NOR0_TEE : NULL,
> +#endif
> "-(nor_user)");
> }
> }
> diff --git a/board/st/stm32mp1/MAINTAINERS b/board/st/stm32mp1/MAINTAINERS
> index fe8fc6f484..0e6d80fb45 100644
> --- a/board/st/stm32mp1/MAINTAINERS
> +++ b/board/st/stm32mp1/MAINTAINERS
> @@ -5,6 +5,7 @@ T: git https://source.denx.de/u-boot/custodians/u-boot-stm.git
> S: Maintained
> F: arch/arm/dts/stm32mp15*
> F: board/st/stm32mp1/
> +F: configs/stm32mp15_defconfig
> F: configs/stm32mp15_basic_defconfig
> F: configs/stm32mp15_trusted_defconfig
> F: include/configs/stm32mp1.h
> diff --git a/configs/stm32mp15_defconfig b/configs/stm32mp15_defconfig
> new file mode 100644
> index 0000000000..b11da7dc9f
> --- /dev/null
> +++ b/configs/stm32mp15_defconfig
> @@ -0,0 +1,158 @@
> +CONFIG_ARM=y
> +CONFIG_ARCH_STM32MP=y
> +CONFIG_TFABOOT=y
> +CONFIG_SYS_MALLOC_F_LEN=0x3000
> +CONFIG_SYS_MEMTEST_START=0xc0000000
> +CONFIG_SYS_MEMTEST_END=0xc4000000
> +CONFIG_ENV_OFFSET=0x480000
> +CONFIG_ENV_SECT_SIZE=0x40000
> +CONFIG_DEFAULT_DEVICE_TREE="stm32mp157c-ev1"
> +CONFIG_TARGET_ST_STM32MP15x=y
> +CONFIG_CMD_STM32KEY=y
> +CONFIG_CMD_STM32PROG=y
> +CONFIG_ENV_OFFSET_REDUND=0x4C0000
> +CONFIG_TYPEC_STUSB160X=y
> +CONFIG_DISTRO_DEFAULTS=y
> +CONFIG_FIT=y
> +CONFIG_BOOTDELAY=1
> +CONFIG_BOOTCOMMAND="run bootcmd_stm32mp"
> +CONFIG_SYS_PROMPT="STM32MP> "
> +CONFIG_CMD_ADTIMG=y
> +CONFIG_CMD_ERASEENV=y
> +CONFIG_CMD_NVEDIT_EFI=y
> +CONFIG_CMD_MEMINFO=y
> +CONFIG_CMD_MEMTEST=y
> +CONFIG_CMD_UNZIP=y
> +CONFIG_CMD_ADC=y
> +CONFIG_CMD_CLK=y
> +CONFIG_CMD_DFU=y
> +CONFIG_CMD_FUSE=y
> +CONFIG_CMD_GPIO=y
> +CONFIG_CMD_I2C=y
> +CONFIG_CMD_MMC=y
> +CONFIG_CMD_REMOTEPROC=y
> +CONFIG_CMD_SPI=y
> +CONFIG_CMD_USB=y
> +CONFIG_CMD_USB_MASS_STORAGE=y
> +CONFIG_CMD_BMP=y
> +CONFIG_CMD_CACHE=y
> +CONFIG_CMD_EFIDEBUG=y
> +CONFIG_CMD_TIME=y
> +CONFIG_CMD_RNG=y
> +CONFIG_CMD_TIMER=y
> +CONFIG_CMD_PMIC=y
> +CONFIG_CMD_REGULATOR=y
> +CONFIG_CMD_EXT4_WRITE=y
> +CONFIG_CMD_MTDPARTS=y
> +CONFIG_CMD_LOG=y
> +CONFIG_CMD_UBI=y
> +CONFIG_OF_LIVE=y
> +CONFIG_ENV_IS_NOWHERE=y
> +CONFIG_ENV_IS_IN_MMC=y
> +CONFIG_ENV_IS_IN_SPI_FLASH=y
> +CONFIG_ENV_IS_IN_UBI=y
> +CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
> +CONFIG_ENV_UBI_PART="UBI"
> +CONFIG_ENV_UBI_VOLUME="uboot_config"
> +CONFIG_ENV_UBI_VOLUME_REDUND="uboot_config_r"
> +CONFIG_SYS_RELOC_GD_ENV_ADDR=y
> +CONFIG_SYS_MMC_ENV_DEV=-1
> +CONFIG_STM32_ADC=y
> +CONFIG_CLK_SCMI=y
> +CONFIG_SET_DFU_ALT_INFO=y
> +CONFIG_USB_FUNCTION_FASTBOOT=y
> +CONFIG_FASTBOOT_BUF_ADDR=0xC0000000
> +CONFIG_FASTBOOT_BUF_SIZE=0x02000000
> +CONFIG_FASTBOOT_USB_DEV=1
> +CONFIG_FASTBOOT_FLASH=y
> +CONFIG_FASTBOOT_FLASH_MMC_DEV=1
> +CONFIG_FASTBOOT_MMC_BOOT_SUPPORT=y
> +CONFIG_FASTBOOT_MMC_BOOT1_NAME="mmc1boot0"
> +CONFIG_FASTBOOT_MMC_BOOT2_NAME="mmc1boot1"
> +CONFIG_FASTBOOT_MMC_USER_SUPPORT=y
> +CONFIG_FASTBOOT_MMC_USER_NAME="mmc1"
> +CONFIG_FASTBOOT_CMD_OEM_FORMAT=y
> +CONFIG_FASTBOOT_CMD_OEM_PARTCONF=y
> +CONFIG_FASTBOOT_CMD_OEM_BOOTBUS=y
> +CONFIG_GPIO_HOG=y
> +CONFIG_DM_HWSPINLOCK=y
> +CONFIG_HWSPINLOCK_STM32=y
> +CONFIG_DM_I2C=y
> +CONFIG_SYS_I2C_STM32F7=y
> +CONFIG_LED=y
> +CONFIG_LED_GPIO=y
> +CONFIG_DM_MAILBOX=y
> +CONFIG_STM32_IPCC=y
> +CONFIG_STM32_FMC2_EBI=y
> +CONFIG_SUPPORT_EMMC_BOOT=y
> +CONFIG_STM32_SDMMC2=y
> +CONFIG_MTD=y
> +CONFIG_DM_MTD=y
> +CONFIG_SYS_MTDPARTS_RUNTIME=y
> +CONFIG_MTD_RAW_NAND=y
> +CONFIG_NAND_STM32_FMC2=y
> +CONFIG_MTD_SPI_NAND=y
> +CONFIG_DM_SPI_FLASH=y
> +CONFIG_SPI_FLASH_MACRONIX=y
> +CONFIG_SPI_FLASH_SPANSION=y
> +CONFIG_SPI_FLASH_STMICRO=y
> +CONFIG_SPI_FLASH_WINBOND=y
> +# CONFIG_SPI_FLASH_USE_4K_SECTORS is not set
> +CONFIG_SPI_FLASH_MTD=y
> +CONFIG_PHY_REALTEK=y
> +CONFIG_DM_ETH=y
> +CONFIG_DWC_ETH_QOS=y
> +CONFIG_PHY=y
> +CONFIG_PHY_STM32_USBPHYC=y
> +CONFIG_PINCONF=y
> +CONFIG_PINCTRL_STMFX=y
> +CONFIG_DM_PMIC=y
> +CONFIG_PMIC_STPMIC1=y
> +CONFIG_DM_REGULATOR=y
> +CONFIG_DM_REGULATOR_FIXED=y
> +CONFIG_DM_REGULATOR_GPIO=y
> +CONFIG_DM_REGULATOR_STM32_VREFBUF=y
> +CONFIG_DM_REGULATOR_STPMIC1=y
> +CONFIG_REMOTEPROC_STM32_COPRO=y
> +CONFIG_RESET_SCMI=y
> +CONFIG_DM_RNG=y
> +CONFIG_RNG_STM32MP1=y
> +CONFIG_DM_RTC=y
> +CONFIG_RTC_STM32=y
> +CONFIG_SERIAL_RX_BUFFER=y
> +CONFIG_SPI=y
> +CONFIG_DM_SPI=y
> +CONFIG_STM32_QSPI=y
> +CONFIG_STM32_SPI=y
> +CONFIG_TEE=y
> +CONFIG_OPTEE=y
> +# CONFIG_OPTEE_TA_AVB is not set
> +CONFIG_USB=y
> +CONFIG_DM_USB=y
> +CONFIG_DM_USB_GADGET=y
> +CONFIG_USB_EHCI_HCD=y
> +CONFIG_USB_EHCI_GENERIC=y
> +CONFIG_USB_GADGET=y
> +CONFIG_USB_GADGET_MANUFACTURER="STMicroelectronics"
> +CONFIG_USB_GADGET_VENDOR_NUM=0x0483
> +CONFIG_USB_GADGET_PRODUCT_NUM=0x5720
> +CONFIG_USB_GADGET_DWC2_OTG=y
> +CONFIG_DM_VIDEO=y
> +CONFIG_BACKLIGHT_GPIO=y
> +CONFIG_VIDEO_LCD_ORISETECH_OTM8009A=y
> +CONFIG_VIDEO_LCD_RAYDIUM_RM68200=y
> +CONFIG_VIDEO_STM32=y
> +CONFIG_VIDEO_STM32_DSI=y
> +CONFIG_VIDEO_STM32_MAX_XRES=1280
> +CONFIG_VIDEO_STM32_MAX_YRES=800
> +CONFIG_VIDEO_BMP_RLE8=y
> +CONFIG_BMP_16BPP=y
> +CONFIG_BMP_24BPP=y
> +CONFIG_BMP_32BPP=y
> +CONFIG_WDT=y
> +CONFIG_WDT_STM32MP=y
> +CONFIG_ERRNO_STR=y
> +CONFIG_FDT_FIXUP_PARTITIONS=y
> +# CONFIG_LMB_USE_MAX_REGIONS is not set
> +CONFIG_LMB_MEMORY_REGIONS=2
> +CONFIG_LMB_RESERVED_REGIONS=16
>
Applied to u-boot-stm/master
Thanks
Patrice
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH v3 4/5] doc: st: stm32mp1: Add FIP support for trusted boot
2021-07-26 9:21 ` [PATCH v3 4/5] doc: st: stm32mp1: Add FIP support for trusted boot Patrick Delaunay
@ 2021-08-16 11:39 ` Patrice CHOTARD
0 siblings, 0 replies; 11+ messages in thread
From: Patrice CHOTARD @ 2021-08-16 11:39 UTC (permalink / raw)
To: Patrick Delaunay, u-boot; +Cc: Yann GAUTIER, U-Boot STM32
Hi Patrick
On 7/26/21 11:21 AM, Patrick Delaunay wrote:
> TF-A for STM32MP15 now supports the FIP: it is a packaging format which
> includes the secure monitor, u-boot-nodtb.bin and u-boot.dtb
>
> This FIP file is loaded by FSBL = TF-A BL2.
>
> This patch updates the board documentation to use this FIP file and no
> more u-boot.stm32 (with STM32 image header) which is no more generated.
>
> Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
> Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
> ---
>
> Changes in v3:
> - add reference for STM32 WIKI, TF-A and OP-TEE
> - add information about TF-A compilation and clarify the output files
>
> Changes in v2:
> - fix one typo: s/ enought / enough
>
> doc/board/st/stm32mp1.rst | 328 +++++++++++++++++++++++++++-----------
> 1 file changed, 232 insertions(+), 96 deletions(-)
>
> diff --git a/doc/board/st/stm32mp1.rst b/doc/board/st/stm32mp1.rst
> index f0c2b09b98..42bb94148d 100644
> --- a/doc/board/st/stm32mp1.rst
> +++ b/doc/board/st/stm32mp1.rst
> @@ -6,6 +6,8 @@ STM32MP15x boards
>
> This is a quick instruction for setup STM32MP15x boards.
>
> +Futher information can be found in STMicrolectronics STM32 WIKI_.
> +
> Supported devices
> -----------------
>
> @@ -60,7 +62,7 @@ Currently the following boards are supported:
> Boot Sequences
> --------------
>
> -3 boot configurations are supported with:
> +2 boot configurations are supported with:
>
> +----------+------------------------+-------------------------+--------------+
> | **ROM** | **FSBL** | **SSBL** | **OS** |
> @@ -70,32 +72,37 @@ Boot Sequences
> | | embedded RAM | DDR |
> +----------+------------------------+-------------------------+--------------+
>
> -The **Trusted** boot chain
> -``````````````````````````
> -
> -defconfig_file : stm32mp15_trusted_defconfig
> +The **Trusted** boot chain with TF-A_
> +`````````````````````````````````````
>
> - +-------------+-------------------------+------------+-------+
> - | ROM code | FSBL | SSBL | OS |
> - + +-------------------------+------------+-------+
> - | |Trusted Firmware-A (TF-A)| U-Boot | Linux |
> - +-------------+-------------------------+------------+-------+
> - | TrustZone |secure monitor |
> - +-------------+-------------------------+------------+-------+
> +defconfig_file :
> + + **stm32mp15_defconfig** (for TF-A_ with FIP support)
> + + **stm32mp15_trusted_defconfig** (for TF-A_ without FIP support)
>
> -TF-A performs a full initialization of Secure peripherals and installs a
> -secure monitor, BL32:
> + +-------------+--------------------------+------------+-------+
> + | ROM code | FSBL | SSBL | OS |
> + + +--------------------------+------------+-------+
> + | |Trusted Firmware-A (TF-A_)| U-Boot | Linux |
> + +-------------+--------------------------+------------+-------+
> + | TrustZone |secure monitor = SPMin or OP-TEE_ |
> + +-------------+--------------------------+------------+-------+
>
> - * SPMin provided by TF-A or
> - * OP-TEE from specific partitions (teeh, teed, teex).
> +TF-A_ and OP-TEE_ are 2 separate projects, with their git repository;
> +they are compiled separately.
>
> -U-Boot is running in normal world and uses the secure monitor to access
> -to secure resources.
> +TF-A_ (BL2) initialize the DDR and loads the next stage binaries from a FIP file:
> + + BL32: a secure monitor BL32 = SPMin provided by TF-A_ or OP-TEE_ :
> + performs a full initialization of Secure peripherals and provides service
> + to normal world
> + + BL33: a non-trusted firmware = U-Boot, running in normal world and uses
> + the secure monitor to access to secure resources.
> + + HW_CONFIG: The hardware configuration file = the U-Boot device tree
>
> -The **Basic** boot chain
> -````````````````````````
> +The **Basic** boot chain with SPL
> +`````````````````````````````````
>
> -defconfig_file : stm32mp15_basic_defconfig
> +defconfig_file :
> + + **stm32mp15_basic_defconfig**
>
> +-------------+------------+------------+-------+
> | ROM code | FSBL | SSBL | OS |
> @@ -105,7 +112,7 @@ defconfig_file : stm32mp15_basic_defconfig
> | TrustZone | | PSCI from U-Boot |
> +-------------+------------+------------+-------+
>
> -SPL has limited security initialization
> +SPL has limited security initialization.
>
> U-Boot is running in secure mode and provide a secure monitor to the kernel
> with only PSCI support (Power State Coordination Interface defined by ARM).
> @@ -163,12 +170,13 @@ Build Procedure
>
> for example: use one output directory for each configuration::
>
> + # export KBUILD_OUTPUT=stm32mp15
> # export KBUILD_OUTPUT=stm32mp15_trusted
> # export KBUILD_OUTPUT=stm32mp15_basic
>
> you can build outside of code directory::
>
> - # export KBUILD_OUTPUT=../build/stm32mp15_trusted
> + # export KBUILD_OUTPUT=../build/stm32mp15
>
> 4. Configure U-Boot::
>
> @@ -176,7 +184,8 @@ Build Procedure
>
> with <defconfig_file>:
>
> - - For **trusted** boot mode : **stm32mp15_trusted_defconfig**
> + - For **trusted** boot mode : **stm32mp15_defconfig** or
> + stm32mp15_trusted_defconfig
> - For basic boot mode: stm32mp15_basic_defconfig
>
> 5. Configure the device-tree and build the U-Boot image::
> @@ -185,13 +194,13 @@ Build Procedure
>
> Examples:
>
> - a) trusted boot on ev1::
> + a) trusted boot with FIP on ev1::
>
> - # export KBUILD_OUTPUT=stm32mp15_trusted
> - # make stm32mp15_trusted_defconfig
> + # export KBUILD_OUTPUT=stm32mp15
> + # make stm32mp15_defconfig
> # make DEVICE_TREE=stm32mp157c-ev1 all
>
> - b) trusted with OP-TEE boot on dk2::
> + b) trusted boot without FIP on dk2::
>
> # export KBUILD_OUTPUT=stm32mp15_trusted
> # make stm32mp15_trusted_defconfig
> @@ -221,24 +230,74 @@ Build Procedure
> # make stm32mp15_basic_defconfig
> # make DEVICE_TREE=stm32mp15xx-dhcor-avenger96 all
>
> -6. Output files
> -
> - BootRom and TF-A expect binaries with STM32 image header
> - SPL expects file with U-Boot uImage header
> +6. U-Boot Output files
>
> So in the output directory (selected by KBUILD_OUTPUT),
> - you can found the needed files:
> + you can found the needed U-Boot files:
> +
> + - stm32mp15_defconfig = **u-boot-nodtb.bin** and **u-boot.dtb**
> +
> + - stm32mp15_trusted_defconfig = u-boot.stm32
> +
> + - stm32mp15_basic_defconfig
> +
> + - FSBL = spl/u-boot-spl.stm32
> +
> + - SSBL = u-boot.img (without CONFIG_SPL_LOAD_FIT) or
> + u-boot.itb (with CONFIG_SPL_LOAD_FIT=y)
> +
> +7. TF-A_ compilation
> +
> + This step is required only for **Trusted** boot (stm32mp15_defconfig and
> + stm32mp15_trusted_defconfig); see OP-TEE_ and TF-A_ documentation for build
> + commands.
> +
> + - For TF-A_ with FIP support: **stm32mp15_defconfig**
> +
> + - with OP-TEE_ support, compile the OP-TEE to generate the binary included
> + in FIP
> +
> + - after TF-A compilation, the used files are:
> +
> + - TF-A_ BL2 => FSBL = **tf-a.stm32**
> +
> + - FIP => **fip.bin**
> +
> + FIP file includes the 2 files given in arguments of TF-A_ compilation:
>
> - - For **Trusted** boot (with or without OP-TEE)
> + - BL33=u-boot-nodtb.bin
> + - BL33_CFG=u-boot.dtb
>
> - - FSBL = **tf-a.stm32** (provided by TF-A compilation)
> - - SSBL = **u-boot.stm32**
> + You can also update a existing FIP after U-boot compilation with fiptool,
> + a tool provided by TF-A_::
>
> - - For Basic boot
> + # fiptool update --nt-fw u-boot-nodtb.bin --hw-config u-boot.dtb fip-stm32mp157c-ev1.bin
> +
> + - For TF-A_ without FIP support : **stm32mp15_trusted_defconfig**
> + SPMin is used and the used files are:
> +
> + - FSBL = **tf-a.stm32** (provided by TF-A_ compilation, contening BL2 and
> + BL32 = SPMin)
> +
> + - SSBL = **u-boot.stm32** used instead of fip.bin in next chapters
> +
> +8. The bootloaders files
> +
> ++ The **ROM code** expects FSBL binaries with STM32 image header =
> + tf-a.stm32 or u-boot-spl.stm32
> +
> +According the FSBL / the boot mode:
> +
> ++ **TF-A** expect a FIP binary = fip.bin, including the OS monitor (SPMin or
> + OP-TEE_) and the U-Boot binary + device tree
> +
> + or, without FIP support, binaries with STM32 image header: U-Boot
> + = u-boot.stm32 and eventually OP-TEE files (tee-header.stm32, tee-pageable.stm32,
> + tee-pager.stm32)
> +
> ++ **SPL** expects SSBL = U-Boot with uImage header = u-boot.img
> + or FIT = u-boot.itb.
>
> - - FSBL = spl/u-boot-spl.stm32
> - - SSBL = u-boot.img (without CONFIG_SPL_LOAD_FIT) or
> - u-boot.itb (with CONFIG_SPL_LOAD_FIT=y)
>
> Switch Setting for Boot Mode
> ----------------------------
> @@ -299,51 +358,96 @@ Prepare an SD card
> The minimal requirements for STMP32MP15x boot up to U-Boot are:
>
> - GPT partitioning (with gdisk or with sgdisk)
> -- 2 fsbl partitions, named fsbl1 and fsbl2, size at least 256KiB
> -- one ssbl partition for U-Boot
> +- 2 fsbl partitions, named "fsbl1" and "fsbl2", size at least 256KiB
> +- one partition named "fip" for FIP or U-Boot (TF-A_ search the "fip"
> + partition and SPL search the 3th partition, because
> + CONFIG_SYS_MMCSD_RAW_MODE_U_BOOT_PARTITION=3)
> +
> +The 2 fsbl partitions have the same content and are present to guarantee a
> +fail-safe update of FSBL; fsbl2 can be omitted if this ROM code feature is
> +not required.
> +
> +Without FIP support in TF-A_, the 3rd partition "fip" for u-boot.stm32 must
> +be named "ssbl".
>
> Then the minimal GPT partition is:
>
> - +-------+--------+---------+-------------+
> - | *Num* | *Name* | *Size* | *Content* |
> - +=======+========+=========+=============+
> - | 1 | fsbl1 | 256 KiB | TF-A or SPL |
> - +-------+--------+---------+-------------+
> - | 2 | fsbl2 | 256 KiB | TF-A or SPL |
> - +-------+--------+---------+-------------+
> - | 3 | ssbl | enought | U-Boot |
> - +-------+--------+---------+-------------+
> - | 4 | <any> | <any> | Rootfs |
> - +-------+--------+---------+-------------+
> -
> -Add a 4th partition (Rootfs) marked bootable with a file extlinux.conf
> +For TF-A_ with FIP support:
> +
> + +-------+--------+---------+------------------------+
> + | *Num* | *Name* | *Size* | *Content* |
> + +=======+========+=========+========================+
> + | 1 | fsbl1 | 256 KiB | TF-A_ BL2 (tf-a.stm32) |
> + +-------+--------+---------+------------------------+
> + | 2 | fsbl2 | 256 KiB | TF-A_ BL2 (tf-a.stm32) |
> + +-------+--------+---------+------------------------+
> + | 3 | fip | 4MB | fip.bin |
> + +-------+--------+---------+------------------------+
> + | 4 | <any> | <any> | Rootfs |
> + +-------+--------+---------+------------------------+
> +
> +or:
> +
> + +-------+--------+---------+------------------------+------------------------+
> + | *Num* | *Name* | *Size* | *Trusted boot content* | *Basic boot content* |
> + +=======+========+=========+========================+========================+
> + | 1 | fsbl1 | 256 KiB | TF-A_ BL2 (tf-a.stm32) | SPL (u-boot-spl.stm32) |
> + +-------+--------+---------+------------------------+------------------------+
> + | 2 | fsbl2 | 256 KiB | TF-A_ BL2 (tf-a.stm32) | SPL (u-boot-spl.stm32) |
> + +-------+--------+---------+------------------------+------------------------+
> + | 3 | ssbl | 2MB | U-Boot (u-boot.stm32) | U-Boot (u-boot.img) |
> + +-------+--------+---------+------------------------+------------------------+
> + | 4 | <any> | <any> | Rootfs |
> + +-------+--------+---------+------------------------+------------------------+
> +
> +And the 4th partition (Rootfs) is marked bootable with a file extlinux.conf
> following the Generic Distribution feature (doc/README.distro for use).
>
> -According the used card reader select the correct block device
> -(for example /dev/sdx or /dev/mmcblk0).
> +The size of fip or ssbl partition must be enough for the associated binary file,
> +4MB and 2MB are default values.
>
> -In the next example, it is /dev/mmcblk0
> +According the used card reader select the correct block device
> +(for example /dev/sdx or /dev/mmcblk0), in the next example, it is /dev/mmcblk0
>
> -For example: with gpt table with 128 entries
> +For example:
>
> a) remove previous formatting::
>
> # sgdisk -o /dev/<SD card dev>
>
> -b) create minimal image::
> +b) create minimal image for FIP
> +
> + For FIP support in TF-A_::
>
> # sgdisk --resize-table=128 -a 1 \
> -n 1:34:545 -c 1:fsbl1 \
> -n 2:546:1057 -c 2:fsbl2 \
> - -n 3:1058:5153 -c 3:ssbl \
> - -n 4:5154: -c 4:rootfs \
> + -n 3:1058:9249 -c 3:fip \
> + -n 4:9250: -c 4:rootfs -A 4:set:2 \
> -p /dev/<SD card dev>
>
> - With other partition for kernel one partition rootfs for kernel.
> + With gpt table with 128 entries an the partition 4 marked bootable (bit 2).
> +
> + For basic boot mode or without FIP support in TF-A_::
> +
> + # sgdisk --resize-table=128 -a 1 \
> + -n 1:34:545 -c 1:fsbl1 \
> + -n 2:546:1057 -c 2:fsbl2 \
> + -n 3:1058:5153 -c 3:ssbl \
> + -n 4:5154: -c 4:rootfs -A 4:set:2 \
> + -p /dev/<SD card dev>
>
> c) copy the FSBL (2 times) and SSBL file on the correct partition.
> in this example in partition 1 to 3
>
> + for trusted boot: ::
> +
> + # dd if=tf-a.stm32 of=/dev/mmcblk0p1
> + # dd if=tf-a.stm32 of=/dev/mmcblk0p2
> + # dd if=fip.bin of=/dev/mmcblk0p3
> + OR
> + dd if=u-boot.stm32 of=/dev/mmcblk0p3 # Without FIT support
> +
> for basic boot mode : <SD card dev> = /dev/mmcblk0::
>
> # dd if=u-boot-spl.stm32 of=/dev/mmcblk0p1
> @@ -352,12 +456,6 @@ c) copy the FSBL (2 times) and SSBL file on the correct partition.
> OR
> dd if=u-boot.itb of=/dev/mmcblk0p3 # With CONFIG_SPL_LOAD_FIT=y
>
> - for trusted boot mode: ::
> -
> - # dd if=tf-a.stm32 of=/dev/mmcblk0p1
> - # dd if=tf-a.stm32 of=/dev/mmcblk0p2
> - # dd if=u-boot.stm32 of=/dev/mmcblk0p3
> -
> To boot from SD card, select BootPinMode = 1 0 1 and reset.
>
> Prepare eMMC
> @@ -366,34 +464,41 @@ Prepare eMMC
> You can use U-Boot to copy binary in eMMC.
>
> In the next example, you need to boot from SD card and the images
> -(u-boot-spl.stm32, u-boot.img for systems without CONFIG_SPL_LOAD_FIT
> -or u-boot.itb for systems with CONFIG_SPL_LOAD_FIT=y) are presents on
> -SD card (mmc 0) in ext4 partition 4 (bootfs).
> +(tf-a.stm32, fip.bin / u-boot-spl.stm32, u-boot.img for systems without
> +CONFIG_SPL_LOAD_FIT or u-boot.itb for systems with CONFIG_SPL_LOAD_FIT=y) are
> +presents on SD card (mmc 0) in ext4 partition 4 (bootfs)
>
> To boot from SD card, select BootPinMode = 1 0 1 and reset.
>
> Then you update the eMMC with the next U-Boot command :
>
> a) prepare GPT on eMMC,
> - example with 2 partitions, bootfs and roots::
> + example with 3 partitions, fip, bootfs and roots::
>
> - # setenv emmc_part "name=ssbl,size=2MiB;name=bootfs,type=linux,bootable,size=64MiB;name=rootfs,type=linux,size=512"
> + # setenv emmc_part "name=fip,size=4MiB;name=bootfs,type=linux,bootable,size=64MiB;name=rootfs,type=linux,size=512"
> # gpt write mmc 1 ${emmc_part}
>
> -b) copy SPL on eMMC on firts boot partition
> +b) copy FSBL, TF-A_ or SPL, on first eMMC boot partition
> (SPL max size is 256kB, with LBA 512, 0x200)::
>
> + # ext4load mmc 0:4 0xC0000000 tf-a.stm32
> + or
> # ext4load mmc 0:4 0xC0000000 u-boot-spl.stm32
> +
> # mmc dev 1
> # mmc partconf 1 1 1 1
> # mmc write ${fileaddr} 0 200
> # mmc partconf 1 1 1 0
>
> -c) copy U-Boot in first GPT partition of eMMC::
> +c) copy SSBL, FIP or U-Boot binary, in first GPT partition of eMMC::
>
> + # ext4load mmc 0:4 0xC0000000 fip.bin
> + or
> # ext4load mmc 0:4 0xC0000000 u-boot.img # Without CONFIG_SPL_LOAD_FIT
> - OR
> - ext4load mmc 0:4 0xC0000000 u-boot.itb # With CONFIG_SPL_LOAD_FIT=y
> + or
> + # ext4load mmc 0:4 0xC0000000 u-boot.itb # With CONFIG_SPL_LOAD_FIT=y
> +
> +
> # mmc dev 1
> # part start mmc 1 1 partstart
> # mmc write ${fileaddr} ${partstart} ${filesize}
> @@ -495,7 +600,8 @@ b) Automatically by using FIT feature and generic DISTRO bootcmd
>
> see examples in the board stm32mp1 directory: fit_copro_kernel_dtb.its
>
> - Generate FIT including kernel + device tree + M4 firmware with cfg with M4 boot::
> + Generate FIT including kernel + device tree + M4 firmware with cfg with M4
> + boot::
>
> $> mkimage -f fit_copro_kernel_dtb.its fit_copro_kernel_dtb.itb
>
> @@ -517,7 +623,7 @@ The dfu mode is started by the command::
>
> STM32MP> dfu 0
>
> -On EV1 board, booting from SD card, without OP-TEE::
> +On EV1 board, booting from SD card, without OP-TEE_::
>
> STM32MP> dfu 0 list
> DFU alt settings list:
> @@ -526,14 +632,14 @@ On EV1 board, booting from SD card, without OP-TEE::
> dev: RAM alt: 2 name: uramdisk.image.gz layout: RAM_ADDR
> dev: eMMC alt: 3 name: mmc0_fsbl1 layout: RAW_ADDR
> dev: eMMC alt: 4 name: mmc0_fsbl2 layout: RAW_ADDR
> - dev: eMMC alt: 5 name: mmc0_ssbl layout: RAW_ADDR
> + dev: eMMC alt: 5 name: mmc0_fip layout: RAW_ADDR
> dev: eMMC alt: 6 name: mmc0_bootfs layout: RAW_ADDR
> dev: eMMC alt: 7 name: mmc0_vendorfs layout: RAW_ADDR
> dev: eMMC alt: 8 name: mmc0_rootfs layout: RAW_ADDR
> dev: eMMC alt: 9 name: mmc0_userfs layout: RAW_ADDR
> dev: eMMC alt: 10 name: mmc1_boot1 layout: RAW_ADDR
> dev: eMMC alt: 11 name: mmc1_boot2 layout: RAW_ADDR
> - dev: eMMC alt: 12 name: mmc1_ssbl layout: RAW_ADDR
> + dev: eMMC alt: 12 name: mmc1_fip layout: RAW_ADDR
> dev: eMMC alt: 13 name: mmc1_bootfs layout: RAW_ADDR
> dev: eMMC alt: 14 name: mmc1_vendorfs layout: RAW_ADDR
> dev: eMMC alt: 15 name: mmc1_rootfs layout: RAW_ADDR
> @@ -554,14 +660,14 @@ All the supported device are exported for dfu-util tool::
> Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=15, name="mmc1_rootfs", serial="002700333338511934383330"
> Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=14, name="mmc1_vendorfs", serial="002700333338511934383330"
> Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=13, name="mmc1_bootfs", serial="002700333338511934383330"
> - Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=12, name="mmc1_ssbl", serial="002700333338511934383330"
> + Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=12, name="mmc1_fip", serial="002700333338511934383330"
> Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=11, name="mmc1_boot2", serial="002700333338511934383330"
> Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=10, name="mmc1_boot1", serial="002700333338511934383330"
> Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=9, name="mmc0_userfs", serial="002700333338511934383330"
> Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=8, name="mmc0_rootfs", serial="002700333338511934383330"
> Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=7, name="mmc0_vendorfs", serial="002700333338511934383330"
> Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=6, name="mmc0_bootfs", serial="002700333338511934383330"
> - Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=5, name="mmc0_ssbl", serial="002700333338511934383330"
> + Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=5, name="mmc0_fip", serial="002700333338511934383330"
> Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=4, name="mmc0_fsbl2", serial="002700333338511934383330"
> Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=3, name="mmc0_fsbl1", serial="002700333338511934383330"
> Found DFU: [0483:df11] ver=9999, devnum=99, cfg=1, intf=0, alt=2, name="uramdisk.image.gz", serial="002700333338511934383330"
> @@ -572,9 +678,9 @@ You can update the boot device:
>
> - SD card (mmc0) ::
>
> - $> dfu-util -d 0483:5720 -a 3 -D tf-a-stm32mp157c-ev1-trusted.stm32
> - $> dfu-util -d 0483:5720 -a 4 -D tf-a-stm32mp157c-ev1-trusted.stm32
> - $> dfu-util -d 0483:5720 -a 5 -D u-boot-stm32mp157c-ev1-trusted.img
> + $> dfu-util -d 0483:5720 -a 3 -D tf-a-stm32mp157c-ev1.stm32
> + $> dfu-util -d 0483:5720 -a 4 -D tf-a-stm32mp157c-ev1.stm32
> + $> dfu-util -d 0483:5720 -a 5 -D fip-stm32mp157c-ev1.bin
> $> dfu-util -d 0483:5720 -a 6 -D st-image-bootfs-openstlinux-weston-stm32mp1.ext4
> $> dfu-util -d 0483:5720 -a 7 -D st-image-vendorfs-openstlinux-weston-stm32mp1.ext4
> $> dfu-util -d 0483:5720 -a 8 -D st-image-weston-openstlinux-weston-stm32mp1.ext4
> @@ -582,9 +688,9 @@ You can update the boot device:
>
> - EMMC (mmc1)::
>
> - $> dfu-util -d 0483:5720 -a 10 -D tf-a-stm32mp157c-ev1-trusted.stm32
> - $> dfu-util -d 0483:5720 -a 11 -D tf-a-stm32mp157c-ev1-trusted.stm32
> - $> dfu-util -d 0483:5720 -a 12 -D u-boot-stm32mp157c-ev1-trusted.img
> + $> dfu-util -d 0483:5720 -a 10 -D tf-a-stm32mp157c-ev1.stm32
> + $> dfu-util -d 0483:5720 -a 11 -D tf-a-stm32mp157c-ev1.stm32
> + $> dfu-util -d 0483:5720 -a 12 -D fip-stm32mp157c-ev1.bin
> $> dfu-util -d 0483:5720 -a 13 -D st-image-bootfs-openstlinux-weston-stm32mp1.ext4
> $> dfu-util -d 0483:5720 -a 14 -D st-image-vendorfs-openstlinux-weston-stm32mp1.ext4
> $> dfu-util -d 0483:5720 -a 15 -D st-image-weston-openstlinux-weston-stm32mp1.ext4
> @@ -601,14 +707,44 @@ only the MTD partition on the boot devices are available, for example:
>
> - NOR (nor0 = alt 20) & NAND (nand0 = alt 26) ::
>
> - $> dfu-util -d 0483:5720 -a 21 -D tf-a-stm32mp157c-ev1-trusted.stm32
> - $> dfu-util -d 0483:5720 -a 22 -D tf-a-stm32mp157c-ev1-trusted.stm32
> - $> dfu-util -d 0483:5720 -a 23 -D u-boot-stm32mp157c-ev1-trusted.img
> + $> dfu-util -d 0483:5720 -a 21 -D tf-a-stm32mp157c-ev1.stm32
> + $> dfu-util -d 0483:5720 -a 22 -D tf-a-stm32mp157c-ev1.stm32
> + $> dfu-util -d 0483:5720 -a 23 -D fip-stm32mp157c-ev1.bin
> $> dfu-util -d 0483:5720 -a 27 -D st-image-weston-openstlinux-weston-stm32mp1_nand_4_256_multivolume.ubi
>
> - NAND (nand0 = alt 21)::
>
> - $> dfu-util -d 0483:5720 -a 22 -D tf-a-stm32mp157c-ev1-trusted.stm32
> - $> dfu-util -d 0483:5720 -a 23 -D u-boot-stm32mp157c-ev1-trusted.img
> - $> dfu-util -d 0483:5720 -a 24 -D u-boot-stm32mp157c-ev1-trusted.img
> + $> dfu-util -d 0483:5720 -a 22 -D tf-a-stm32mp157c-ev1.stm32
> + $> dfu-util -d 0483:5720 -a 23 -D fip-stm32mp157c-ev1.bin
> + $> dfu-util -d 0483:5720 -a 24 -D fip-stm32mp157c-ev1.bin
> $> dfu-util -d 0483:5720 -a 25 -D st-image-weston-openstlinux-weston-stm32mp1_nand_4_256_multivolume.ubi
> +
> +References
> +----------
> +
> +.. _WIKI:
> +
> +STM32 Arm® Cortex®-based MPUs user guide
> +
> + + https://wiki.st.com/
> + + https://wiki.st.com/stm32mpu/wiki/Main_Page
> +
> +.. _TF-A:
> +
> +TF-A = The Trusted Firmware-A project provides a reference implementation of
> +secure world software for Armv7-A and Armv8-A class processors
> +
> + + https://www.trustedfirmware.org/projects/tf-a/
> + + https://trustedfirmware-a.readthedocs.io/en/latest/
> + + https://trustedfirmware-a.readthedocs.io/en/latest/plat/stm32mp1.html
> + + https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/
> +
> +.. _OP-TEE:
> +
> +OP-TEE = an open source Trusted Execution Environment (TEE) implementing the
> +Arm TrustZone technology
> +
> + + https://www.op-tee.org/
> + + https://optee.readthedocs.io/en/latest/
> + + https://optee.readthedocs.io/en/latest/building/devices/stm32mp1.html
> + + https://github.com/OP-TEE/optee_os
> \ No newline at end of file
>
Applied to u-boot-stm/master
Thanks
Patrice
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH v3 5/5] stm32mp1: stm32prog: remove stm32prog_get_tee_partitions with FIP
2021-07-26 9:21 ` [PATCH v3 5/5] stm32mp1: stm32prog: remove stm32prog_get_tee_partitions with FIP Patrick Delaunay
@ 2021-08-16 11:39 ` Patrice CHOTARD
0 siblings, 0 replies; 11+ messages in thread
From: Patrice CHOTARD @ 2021-08-16 11:39 UTC (permalink / raw)
To: Patrick Delaunay, u-boot
Cc: Yann GAUTIER, Jaehoon Chung, Simon Glass, U-Boot STM32
Hi Patrick
On 7/26/21 11:21 AM, Patrick Delaunay wrote:
> The MTD tee partitions used to save the OP-TEE binary are needed when
> TF-A doesn't use the FIP container to load binaries.
>
> This patch puts under CONFIG_STM32MP15x_STM32IMAGE flag the associated
> code in U-Boot binary and prepare the code cleanup when
> CONFIG_STM32MP15x_STM32IMAGE support will be removed after TF-A migration
> to FIP support.
>
> Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
> Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
> ---
>
> (no changes since v1)
>
> arch/arm/mach-stm32mp/cmd_stm32prog/cmd_stm32prog.c | 2 ++
> arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.c | 4 ++++
> arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.h | 2 ++
> arch/arm/mach-stm32mp/include/mach/stm32prog.h | 2 ++
> 4 files changed, 10 insertions(+)
>
> diff --git a/arch/arm/mach-stm32mp/cmd_stm32prog/cmd_stm32prog.c b/arch/arm/mach-stm32mp/cmd_stm32prog/cmd_stm32prog.c
> index 064f51b2c7..1bccad4e6d 100644
> --- a/arch/arm/mach-stm32mp/cmd_stm32prog/cmd_stm32prog.c
> +++ b/arch/arm/mach-stm32mp/cmd_stm32prog/cmd_stm32prog.c
> @@ -185,6 +185,7 @@ U_BOOT_CMD(stm32prog, 5, 0, do_stm32prog,
> " <size> = size of flashlayout (optional for image with STM32 header)\n"
> );
>
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> bool stm32prog_get_tee_partitions(void)
> {
> if (stm32prog_data)
> @@ -192,6 +193,7 @@ bool stm32prog_get_tee_partitions(void)
>
> return false;
> }
> +#endif
>
> bool stm32prog_get_fsbl_nor(void)
> {
> diff --git a/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.c b/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.c
> index 96ebc6d978..0971ee79af 100644
> --- a/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.c
> +++ b/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.c
> @@ -824,7 +824,9 @@ static int treat_partition_list(struct stm32prog_data *data)
> INIT_LIST_HEAD(&data->dev[j].part_list);
> }
>
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> data->tee_detected = false;
> +#endif
> data->fsbl_nor_detected = false;
> for (i = 0; i < data->part_nb; i++) {
> part = &data->part_array[i];
> @@ -878,10 +880,12 @@ static int treat_partition_list(struct stm32prog_data *data)
> /* fallthrough */
> case STM32PROG_NAND:
> case STM32PROG_SPI_NAND:
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> if (!data->tee_detected &&
> !strncmp(part->name, "tee", 3))
> data->tee_detected = true;
> break;
> +#endif
> default:
> break;
> }
> diff --git a/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.h b/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.h
> index 9d58cf0e2d..240c5c44bc 100644
> --- a/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.h
> +++ b/arch/arm/mach-stm32mp/cmd_stm32prog/stm32prog.h
> @@ -122,7 +122,9 @@ struct stm32prog_data {
> struct stm32prog_dev_t dev[STM32PROG_MAX_DEV]; /* array of device */
> int part_nb; /* nb of partition */
> struct stm32prog_part_t *part_array; /* array of partition */
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> bool tee_detected;
> +#endif
> bool fsbl_nor_detected;
>
> /* command internal information */
> diff --git a/arch/arm/mach-stm32mp/include/mach/stm32prog.h b/arch/arm/mach-stm32mp/include/mach/stm32prog.h
> index c080b9cc42..99be4e1d65 100644
> --- a/arch/arm/mach-stm32mp/include/mach/stm32prog.h
> +++ b/arch/arm/mach-stm32mp/include/mach/stm32prog.h
> @@ -11,6 +11,8 @@ int stm32prog_read_medium_virt(struct dfu_entity *dfu, u64 offset,
> void *buf, long *len);
> int stm32prog_get_medium_size_virt(struct dfu_entity *dfu, u64 *size);
>
> +#ifdef CONFIG_STM32MP15x_STM32IMAGE
> bool stm32prog_get_tee_partitions(void);
> +#endif
>
> bool stm32prog_get_fsbl_nor(void);
>
Applied to u-boot-stm/master
Thanks
Patrice
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2021-08-16 11:39 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-26 9:21 [PATCH v3 0/5] stm32mp1: handle TF-A boot with FIP Patrick Delaunay
2021-07-26 9:21 ` [PATCH v3 1/5] arm: stm32mp: add config for STM32IMAGE support Patrick Delaunay
2021-08-16 11:38 ` Patrice CHOTARD
2021-07-26 9:21 ` [PATCH v3 2/5] arm: stm32mp: handle the OP-TEE nodes in DT with FIP support Patrick Delaunay
2021-08-16 11:38 ` Patrice CHOTARD
2021-07-26 9:21 ` [PATCH v3 3/5] arm: stm32mp: add defconfig for trusted boot with FIP Patrick Delaunay
2021-08-16 11:38 ` Patrice CHOTARD
2021-07-26 9:21 ` [PATCH v3 4/5] doc: st: stm32mp1: Add FIP support for trusted boot Patrick Delaunay
2021-08-16 11:39 ` Patrice CHOTARD
2021-07-26 9:21 ` [PATCH v3 5/5] stm32mp1: stm32prog: remove stm32prog_get_tee_partitions with FIP Patrick Delaunay
2021-08-16 11:39 ` Patrice CHOTARD
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.