OPTEE: how is BL33 called from BL32 (optee, stm32mp15x)

[bsw]

Hi,

i want to enable optee-os for our STM32MP151CAA based platform. We use upstream TF-A, OPTEE and Barebox-Bootloader (very similar to u-boot), not from the yocto st layer. Yocto version is scarthgap, OPTEE version 4.1.

I was able to switch from sp_min to optee for the AARCH32_SP and to let TF-A call OPTEE (BL32):

NOTICE: CPU: STM32MP151CAA Rev.Z
NOTICE: Model: xxx
NOTICE: BL2: v2.10.4(release):devtool-patched-dirty
NOTICE: BL2: Built : 16:23:33, Apr 26 2024
NOTICE: BL2: Booting BL32
I/TC: Early console on UART#4
I/TC: 
I/TC: Pager is enabled. Hashes: 2976 bytes
I/TC: Pager pool size: 76kB
I/TC: Non-secure external DT found
I/TC: Embedded DTB found
I/TC: OP-TEE version: 4.1.0-8-g8ab3c8212-dev (gcc version 13.3.0 (GCC)) #1 Fri Nov 15 13:08:46 UTC 2024 arm
I/TC: WARNING: This OP-TEE configuration might be insecure!
I/TC: WARNING: Please check https://optee.readthedocs.io/en/latest/architecture/porting_guidelines.html
I/TC: Primary CPU initializing
I/TC: RCC is non-secure
I/TC: WARNING: All debug accesses are allowed
I/TC: Platform stm32mp1: flavor cc100 - DT stm32mp151-cc100.dts
I/TC: DTB enables console (non-secure)
I/TC: Primary CPU switching to normal world boot

And then nothing happens.

I don't understand how the BL33 should be loaded and called: from TF-A or from OPTEE-OS?

Thanks in advance

[GatienC]

Hello @bsw,

 

On ARMV7A platform, you are most likely(default on mp15 platforms) using the secure monitor present in OP-TEE OS source code. Please have a look at: Core documentation .

One thing to try would be to check the entry point of your next stage bootloader and also check the TZC400 configuration to see if it's configured as accessible from the non-secure world.

Hope this helps,

Gatien

[bsw]

I couldn't get it to work with barebox as BL33. We finally switched to u-boot and everything works as expected.