STM32MP15x lines: Activate secure_and_system_services profile

[Charles Dias]

Dear all,

I'm trying to run a TA application on STM32MP157C-DK2 board. Im using the STM32MPU Developer Package to build the TF-A and the OP-TEE.

I've built the TF-A using the command below:

make -f $PWD/../Makefile.sdk TF_A_DEVICETREE=stm32mp157c-dk2 TF_A_CONFIG=optee-sdcard STM32MP1_OPTEE_IN_SYSRAM=1 ELF_DEBUG_ENABLE='1' all

After that, I copied the file generated file STM32MP1-Ecosystem-v5.1.0/Developer-Package/stm32mp1-openstlinux-6.1-yocto-mickledore-mpu-v24.06.26/sources/arm-ostl-linux-gnueabi/tf-a-stm32mp-v2.8.15-stm32mp-r2-r0/deploy/tf-a-stm32mp157c-dk2-optee-sdcard.stm32 to STM32MP1-Ecosystem-v5.1.0/Starter-Package/stm32mp1-openstlinux-6.1-yocto-mickledore-mpu-v24.06.26/images/stm32mp1/arm-trusted-firmware/

Is this right?

Then, I built the OP-TEE

make -f $PWD/../Makefile.sdk CFG_EMBED_DTB_SOURCE_FILE=stm32mp157c-dk2 CFG_STM32MP_PROFILE=secure_and_system_services all

And copied the files from STM32MP1-Ecosystem-v5.1.0/Developer-Package/stm32mp1-openstlinux-6.1-yocto-mickledore-mpu-v24.06.26/sources/arm-ostl-linux-gnueabi/FIP_artifacts/fip/ to STM32MP1-Ecosystem-v5.1.0/Starter-Package/stm32mp1-openstlinux-6.1-yocto-mickledore-mpu-v24.06.26/images/stm32mp*/fip/

So, when I try to flash the board I receive the following output:

NOTICE: CPU: STM32MP157CAC Rev.B
NOTICE: Model: STMicroelectronics STM32MP157C-DK2 Discovery Board
NOTICE: Board: MB1272 Var2.0 Rev.C-01
INFO: PMIC version = 0x10
INFO: Reset reason (0x15):
INFO: Power-on Reset (rst_por)
INFO: FCONF: Reading TB_FW firmware configuration file from: 0x2ffe2000
INFO: FCONF: Reading firmware configuration information for: stm32mp_io
INFO: FCONF: Reading firmware configuration information for: stm32mp_fuse
INFO: Using USB
INFO: Instance 2
INFO: Boot used partition fsbl1
NOTICE: BL2: v2.8-stm32mp1-r2.0(debug):lts-v2.8.15-dirty(567af710)
NOTICE: BL2: Built : 00:51:33, Jan 26 2024
INFO: BL2: Doing platform setup
INFO: RAM: DDR3-DDR3L 16bits 533000kHz
INFO: Memory size = 0x20000000 (512 MB)
INFO: DFU USB START...
INFO: phase ID :3, Manifestation 3 at c71a7e52
INFO: Send detach request
INFO: Receive DFU Detach
INFO: DFU USB STOP...
INFO: BL2: Loading image id 1
INFO: Loading image id=1 at address 0x2ffff000
INFO: Image id=1 loaded: 0x2ffff000 - 0x2ffff1ea
INFO: FCONF: Reading FW_CONFIG firmware configuration file from: 0x2ffff000
INFO: FCONF: Reading firmware configuration information for: dyn_cfg
INFO: FCONF: Reading firmware configuration information for: stm32mp1_firewall
INFO: BL2: Loading image id 4
INFO: Loading image id=4 at address 0xde000000
INFO: Image id=4 loaded: 0xde000000 - 0xde00002c
INFO: OPTEE ep=0xde000000
INFO: OPTEE header info:
INFO: magic=0x4554504f
INFO: version=0x2
INFO: arch=0x0
INFO: flags=0x0
INFO: nb_images=0x2
WARNING: The load address in optee header 0x2ffc0000 - 0x2ffd3bd0 is not in reserved area: 0xde000000 - 0xe0000000.
ERROR: OPTEE header parse error.
PANIC at PC : 0x2ffec987

Exception mode=0x00000016 at: 0x2ffec987

 

 

Thank you!

 

 

[Erwan SZYMANSKI]

Hello @Charles Dias ,
You well compiled and deployed TF-A BL2 but I suspect you did not update the BL31 FIP device tree. 
It is mentioned in this paragraph, after the TF-A BL2 compilation : https://wiki.st.com/stm32mpu/wiki/TF-A_BL31_overview#Build_process

So please follow this article https://wiki.st.com/stm32mpu/wiki/How_to_configure_TF-A_FIP#STM32MP1_series and update your TF-A built fw-config.dtb device tree into the FIP.

As you ask OP-TEE to run in SYSRAM, it means the FW config has changed. However inside your FIP, it still think that OP-TEE is in DDR due to a non updated fw-config.dtb.

Kind regards,
Erwan.

[Charles Dias]

Hello @Erwan SZYMANSKI.

I'll take a look, but could ST provide a tutorial about changing the profile to allow running a TA for one of the developer boards? I read countless pages of documentation and found essential information scattered across different pages. Even after that, I still couldn't manage to change the profile to run a TA.

Thanks for your help.

[Erwan SZYMANSKI]

Hello @Charles Dias ,
Thank you for your feedback, can you explain your current status right now and at which step you are blocked ? 

Kind regards,
Erwan.

[Charles Dias]

Hello @Erwan SZYMANSKI,

The last link shared by you help me a lot! Thank you!

I was stuck on how to create the FIP with the updated TF-A and OP-TEE at the same time. When I ran the commands described at the beginning of this post, the FIP was generated with only the TF-A or OP-TEE update information, not both. Using the fiptool I updated the fip file.

Profile changed to secure_and_system_services.

Test with optee_example_hello_world.

 

 

[Charles Dias]

I summarized the steps to change the profile to secure_and_system_services and enable the execution in SYSRAM for STM32MP157C-DK2 board:

 

Environment Setup

1. Set up the environment as described in the https://wiki.st.com/stm32mpu/wiki/STM32MPU_Developer_Package.

 

Updating OP-TEE

1. Follow the OP-TEE setup instructions provided in the https://github.com/STMicroelectronics/meta-st-stm32mp/blob/mickledore/recipes-security/optee/optee-os/README.HOW_TO.txt.

 

2. Initialize the SDK.

 

3. Navigate to the directory <path-to-folder>/STM32MP1-Ecosystem-v5.1.0/Developer-Package/stm32mp1-openstlinux-6.1-yocto-mickledore-mpu-v24.06.26/sources/arm-ostl-linux-gnueabi/optee-os-stm32mp-3.19.0-stm32mp-r2-r0/optee-os-stm32mp-3.19.0-stm32mp-r2

4. Export the FIP_DEPLOYDIR_ROOT variable:
export FIP_DEPLOYDIR_ROOT=$PWD/../../FIP_artifacts

5. Compile OP-TEE with the following command. Skipping this step may result in a compilation error in the next step.

make -f $PWD/../Makefile.sdk all

 

6. Enable the secure_and_system_services profile and execution in SYSRAM:
make -f $PWD/../Makefile.sdk CFG_EMBED_DTB_SOURCE_FILE=stm32mp157c-dk2 CFG_STM32MP_PROFILE=secure_and_system_services CFG_STM32MP1_OPTEE_IN_SYSRAM=y all

7. Check the generated files. These will be used to update the FIP:
- ../deploy/tee-header_v2-stm32mp157c-dk2.bin
- ../deploy/tee-pager_v2-stm32mp157c-dk2.bin
- ../deploy/tee-pageable_v2-stm32mp157c-dk2.bin

 

Updating TF-A

1. Follow the TF-A setup instructions provided in the https://github.com/STMicroelectronics/meta-st-stm32mp/blob/mickledore/recipes-bsp/trusted-firmware-a/tf-a-stm32mp/README.HOW_TO.txt.

 

2. Navigate to the directory <path-to-folder>/STM32MP1-Ecosystem-v5.1.0/Developer-Package/stm32mp1-openstlinux-6.1-yocto-mickledore-mpu-v24.06.26/sources/arm-ostl-linux-gnueabi/tf-a-stm32mp-v2.8.15-stm32mp-r2-r0/tf-a-stm32mp-v2.8.15-stm32mp-r2

3. Export the `FIP_DEPLOYDIR_ROOT` variable:
export FIP_DEPLOYDIR_ROOT=$PWD/../../FIP_artifacts

4. Compile TF-A, enabling execution in SYSRAM:
make -f $PWD/../Makefile.sdk TF_A_DEVICETREE=stm32mp157c-dk2 TF_A_CONFIG=optee-sdcard ELF_DEBUG_ENABLE='1' STM32MP1_OPTEE_IN_SYSRAM=1 all

5. Check the generated file:
- ../deploy/tf-a-stm32mp157c-dk2-optee-sdcard.stm32

 

6. Copy the generated file to the appropriate directory:
cp -rvf ../deploy/tf-a-stm32mp157c-dk2-optee-sdcard.stm32 <path-to-folder>/STM32MP1-Ecosystem-v5.1.0/Starter-Package/stm32mp1-openstlinux-6.1-yocto-mickledore-mpu-v24.06.26/images/stm32mp1/arm-trusted-firmware/

Updating the FIP

After compiling TF-A, the fip-stm32mp157c-dk2-optee-sdcard.bin file is 1,466,490 bytes. It is necessary to update the Secure OS (OP-TEE), OP-TEE pager, and OP-TEE pageable. This can be done using the fiptool. Refer to the https://wiki.st.com/stm32mpu/wiki/How_to_configure_TF-A_FIP.

 

1. Navigate to the directory <path-to-folder>/STM32MP1-Ecosystem-v5.1.0/Developer-Package/stm32mp1-openstlinux-6.1-yocto-mickledore-mpu-v24.06.26/sources/arm-ostl-linux-gnueabi/optee-os-stm32mp-3.19.0-stm32mp-r2-r0/optee-os-stm32mp-3.19.0-stm32mp-r2

2. Update the FIP with the generated OP-TEE files:
fiptool update --tos-fw ../deploy/tee-header_v2-stm32mp157c-dk2.bin ../../FIP_artifacts/fip/fip-stm32mp157c-dk2-optee-sdcard.bin && \
fiptool update --tos-fw-extra1 ../deploy/tee-pager_v2-stm32mp157c-dk2.bin ../../FIP_artifacts/fip/fip-stm32mp157c-dk2-optee-sdcard.bin && \
fiptool update --tos-fw-extra2 ../deploy/tee-pageable_v2-stm32mp157c-dk2.bin ../../FIP_artifacts/fip/fip-stm32mp157c-dk2-optee-sdcard.bin

3. After updating, the fip-stm32mp157c-dk2-optee-sdcard.bin file size should be 1,736,274 bytes.

 

4. Copy the updated FIP to the Starter Package directory:
cp -rvf $FIP_DEPLOYDIR_ROOT/fip/* <path-to-folder>/STM32MP1-Ecosystem-v5.1.0/Starter-Package/stm32mp1-openstlinux-6.1-yocto-mickledore-mpu-v24.06.26/images/stm32mp*/fip/

Populating the SD Card

1. Use the STM32CubeProgrammer to populate the SD Card as described in the https://wiki.st.com/stm32mpu/wiki/Getting_started/STM32MP1_boards/STM32MP157x-DK2/Let's_start/Populate_the_target_and_boot_the_image#Populate_the_SD_card.

[Pavestone7762]

@Erwan SZYMANSKII've spent a very long time trying to get this to work for the stm32mp157f-dk2 with ecosystem version 5.1.0. I was able to get OP-TEE running in SYSRAM for 5.0.0, but it seems something has changed with 5.1.0. I'm using the following script to build OP-TEE and TF-A, create the FIP, update the Starter Package, and program the board:

#!/bin/bash

# Compiles U-BOOT, TF-A BL2, and OP-TEE for mp157f-dk2 with OP-TEE in SYSRAM and updates Starter Package
# NB: This script expects that all sources are extracted with patches already applied and that the cross-compilation environment has been sourced

BASEDIR="${PWD}/stm32mp1-openstlinux-6.1-yocto-mickledore-mpu-v24.06.26/sources/arm-ostl-linux-gnueabi"
FIP_DEPLOYDIR_ROOT="${BASEDIR}/FIP_artifacts"
FWCONF_DIR="${FIP_DEPLOYDIR_ROOT}/arm-trusted-firmware/fwconfig/"
STARTER_PKG_DIR="${PWD}/../Starter-Package/stm32mp1-openstlinux-6.1-yocto-mickledore-mpu-v24.06.26"

echo ""
echo "******************************"
echo "**** STEP 1: BUILD U-BOOT ****"
echo "******************************"
cd "$BASEDIR/u-boot-stm32mp-v2022.10-stm32mp-r2-r0/u-boot-stm32mp-v2022.10-stm32mp-r2"
make stm32mp15_defconfig
make DEVICE_TREE=stm32mp157f-dk2 all
cp u-boot-nodtb.bin $FIP_DEPLOYDIR_ROOT/u-boot/u-boot-nodtb-stm32mp15.bin
cp u-boot.dtb $FIP_DEPLOYDIR_ROOT/u-boot/u-boot-stm32mp157f-dk2.dtb
echo Done


echo ""
echo "******************************"
echo "**** STEP 3: BUILD OP-TEE ****"
echo "******************************"
cd "$BASEDIR/optee-os-stm32mp-3.19.0-stm32mp-r2-r0/optee-os-stm32mp-3.19.0-stm32mp-r2"
make -f $PWD/../Makefile.sdk all
make -f $PWD/../Makefile.sdk CFG_EMBED_DTB_SOURCE_FILE=stm32mp157f-dk2 CFG_STM32MP_PROFILE=secure_and_system_services CFG_STM32MP1_OPTEE_IN_SYSRAM=y CFG_WITH_USER_TA=y FIP_DEPLOYDIR_ROOT=$FIP_DEPLOYDIR_ROOT DEPLOYDIR=$FIP_DEPLOYDIR_ROOT/optee all
echo Done


echo ""
echo "********************************"
echo "**** STEP 2: BUILD TF-A BL2 ****"
echo "********************************"
cd "$BASEDIR/tf-a-stm32mp-v2.8.15-stm32mp-r2-r0/tf-a-stm32mp-v2.8.15-stm32mp-r2"
make -f $PWD/../Makefile.sdk PLAT=stm32mp1 STM32MP_SDMMC=1 STM32MP15=1 DTB_FILE_NAME=stm32mp157f-dk2.dtb TF_A_DEVICETREE=stm32mp157f-dk2 \
 STM32MP1_OPTEE_IN_SYSRAM=1 TF_A_CONFIG=optee-sdcard DEPLOYDIR=$FIP_DEPLOYDIR_ROOT/arm-trusted-firmware all
cp -rvf $BASEDIR/tf-a-stm32mp-v2.8.15-stm32mp-r2-r0/build/fwconfig/* $FWCONF_DIR
echo Done


echo ""
echo "***********************************"
echo "**** STEP 4: UPDATE FIP BINARY ****"
echo "***********************************"
cd $FIP_DEPLOYDIR_ROOT/fip
fiptool create --tos-fw ../optee/tee-header_v2-stm32mp157f-dk2.bin \
 --tos-fw-extra1 ../optee/tee-pager_v2-stm32mp157f-dk2.bin \
 --tos-fw-extra2 ../optee/tee-pageable_v2-stm32mp157f-dk2.bin \
 --hw-config ../u-boot/u-boot-stm32mp157f-dk2.dtb \
 --fw-config ../arm-trusted-firmware/fwconfig/stm32mp157f-dk2-fw-config-optee-sdcard.dtb \
 --nt-fw ../u-boot/u-boot-nodtb-stm32mp15.bin \
 fip-stm32mp157f-dk2-optee-sdcard.bin
echo Done


echo ""
echo "****************************************"
echo "**** STEP 5: UPDATE STARTER PACKAGE ****"
echo "****************************************"
rm -rf $STARTER_PKG_DIR/images/stm32mp1/arm-trusted-firmware/*
rm -rf $STARTER_PKG_DIR/images/stm32mp1/fip/*
cd $FIP_DEPLOYDIR_ROOT
cp -rvf arm-trusted-firmware/* $STARTER_PKG_DIR/images/stm32mp1/arm-trusted-firmware/
cp -rvf fip/* $STARTER_PKG_DIR/images/stm32mp1/fip/
cp -vf $BASEDIR/tf-a-stm32mp-v2.8.15-stm32mp-r2-r0/build/optee-sdcard-stm32mp15-stm32mp157f-dk2/*.stm32 $STARTER_PKG_DIR/images/stm32mp1/arm-trusted-firmware
echo Done

 However, when programming the board, partition 0x3 fails with the following error message:

NOTICE: BL2: v2.8-stm32mp1-r2.0(debug):lts-v2.8.15-dirty(567af710)
NOTICE: BL2: Built : 00:51:33, Jan 26 2024
INFO: BL2: Doing platform setup
INFO: RAM: DDR3-DDR3L 16bits 533000kHz
INFO: Memory size = 0x20000000 (512 MB)
INFO: DFU USB START...
INFO: phase ID :3, Manifestation 3 at c71a7f22
INFO: Send detach request
INFO: Receive DFU Detach
INFO: DFU USB STOP...
INFO: BL2: Loading image id 1
INFO: Loading image id=1 at address 0x2ffff000
INFO: Image id=1 loaded: 0x2ffff000 - 0x2ffff1ea
INFO: FCONF: Reading FW_CONFIG firmware configuration file from: 0x2ffff000
INFO: FCONF: Reading firmware configuration information for: dyn_cfg
INFO: FCONF: Reading firmware configuration information for: stm32mp1_firewall
INFO: BL2: Loading image id 4
INFO: Loading image id=4 at address 0xde000000
INFO: Image id=4 loaded: 0xde000000 - 0xde00002c
INFO: OPTEE ep=0xde000000
INFO: OPTEE header info:
INFO: magic=0x4554504f
INFO: version=0x2
INFO: arch=0x0
INFO: flags=0x0
INFO: nb_images=0x2
WARNING: The load address in optee header 0x2ffc0000 - 0x2ffd3bd0 is not in reserved area: 0xde000000 - 0xe0000000.
ERROR: OPTEE header parse error.
PANIC at PC : 0x2ffec987

Exception mode=0x00000016 at: 0x2ffec987

Any help you can provide would be very appreciated.

[GatienC]

@Pavestone7762 looking at the trace you provided, it seems that there's a mix between TF-A and OP-TEE configuration here. OP-TEE is built to run in SYSRAM(0x2ffc0000) but TF-A tries to load it in DDR. Please try to update TF-A accordingly.

 

Cheers,

Gatien