1Trusted Firmware-A for i.MX7 WaRP7 2================================== 3 4The Trusted Firmware-A port for the i.MX7Solo WaRP7 implements BL2 at EL3. 5The i.MX7S contains a BootROM with a High Assurance Boot (HAB) functionality. 6This functionality provides a mechanism for establishing a root-of-trust from 7the reset vector to the command-line in user-space. 8 9Boot Flow 10========= 11 12BootROM --> TF-A BL2 --> BL32(OP-TEE) --> BL33(U-Boot) --> Linux 13 14In the WaRP7 port we encapsulate OP-TEE, DTB and U-Boot into a FIP. This FIP is 15expected and required 16 17# Build Instructions 18 19We need to use a file generated by u-boot in order to generate a .imx image the 20BootROM will boot. It is therefore _required_ to build u-boot before TF-A and 21furthermore it is _recommended_ to use the mkimage in the u-boot/tools directory 22to generate the TF-A .imx image. 23 24## U-Boot: 25 26https://git.linaro.org/landing-teams/working/mbl/u-boot.git 27 28.. code:: shell 29 30 git checkout -b rms-atf-optee-uboot linaro-mbl/rms-atf-optee-uboot 31 make warp7_bl33_defconfig; 32 make u-boot.imx arch=ARM CROSS_COMPILE=arm-linux-gnueabihf- 33 34## OP-TEE: 35 36https://github.com/OP-TEE/optee_os.git 37 38.. code:: shell 39 40 make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- PLATFORM=imx PLATFORM_FLAVOR=mx7swarp7 ARCH=arm CFG_PAGEABLE_ADDR=0 CFG_DT_ADDR=0x83000000 CFG_NS_ENTRY_ADDR=0x87800000 41 42## TF-A: 43 44https://github.com/ARM-software/arm-trusted-firmware.git 45 46The following commands assume that a directory exits in the top-level TFA build 47directory "fiptool_images". "fiptool_images" contains 48 49- u-boot.bin 50 The binary output from the u-boot instructions above 51 52- tee-header_v2.bin 53- tee-pager_v2.bin 54- tee-pageable_v2.bin 55 Binary outputs from the previous OPTEE build steps 56 57It is also assumed copy of mbedtls is available on the path path ../mbedtls 58 https://github.com/ARMmbed/mbedtls.git 59 At the time of writing HEAD points to 0592ea772aee48ca1e6d9eb84eca8e143033d973 60 61.. code:: shell 62 63 mkdir fiptool_images 64 cp /path/to/optee/out/arm-plat-imx/core/tee-header_v2.bin fiptool_images 65 cp /path/to/optee/out/arm-plat-imx/core/tee-pager_v2.bin fiptool_images 66 cp /path/to/optee/out/arm-plat-imx/core/tee-pageable_v2.bin fiptool_images 67 68 make CROSS_COMPILE=${CROSS_COMPILE} PLAT=warp7 ARCH=aarch32 ARM_ARCH_MAJOR=7 \ 69 ARM_CORTEX_A7=yes AARCH32_SP=optee PLAT_WARP7_UART=1 GENERATE_COT=1 \ 70 TRUSTED_BOARD_BOOT=1 USE_TBBR_DEFS=1 MBEDTLS_DIR=../mbedtls \ 71 NEED_BL32=yes BL32=fiptool_images/tee-header_v2.bin \ 72 BL32_EXTRA1=fiptool_images/tee-pager_v2.bin \ 73 BL32_EXTRA2=fiptool_images/tee-pageable_v2.bin \ 74 BL33=fiptool_images/u-boot.bin certificates all 75 76 /path/to/u-boot/tools/mkimage -n /path/to/u-boot/u-boot.cfgout -T imximage -e 0x9df00000 -d ./build/warp7/debug/bl2.bin ./build/warp7/debug/bl2.bin.imx 77 78## FIP: 79 80.. code:: shell 81 82 cp /path/to/uboot/u-boot.bin fiptool_images 83 cp /path/to/linux/arch/boot/dts/imx7s-warp.dtb fiptool_images 84 85 tools/cert_create/cert_create -n --rot-key "build/warp7/debug/rot_key.pem" \ 86 --tfw-nvctr 0 \ 87 --ntfw-nvctr 0 \ 88 --trusted-key-cert fiptool_images/trusted-key-cert.key-crt \ 89 --tb-fw=build/warp7/debug/bl2.bin \ 90 --tb-fw-cert fiptool_images/trusted-boot-fw.key-crt\ 91 --tos-fw fiptool_images/tee-header_v2.bin \ 92 --tos-fw-cert fiptool_images/tee-header_v2.bin.crt \ 93 --tos-fw-key-cert fiptool_images/tee-header_v2.bin.key-crt \ 94 --tos-fw-extra1 fiptool_images/tee-pager_v2.bin \ 95 --tos-fw-extra2 fiptool_images/tee-pageable_v2.bin \ 96 --nt-fw fiptool_images/u-boot.bin \ 97 --nt-fw-cert fiptool_images/u-boot.bin.crt \ 98 --nt-fw-key-cert fiptool_images/u-boot.bin.key-crt \ 99 --hw-config fiptool_images/imx7s-warp.dtb 100 101 tools/fiptool/fiptool create --tos-fw fiptool_images/tee-header_v2.bin \ 102 --tos-fw-extra1 fiptool_images/tee-pager_v2.bin \ 103 --tos-fw-extra2 fiptool_images/tee-pageable_v2.bin \ 104 --nt-fw fiptool_images/u-boot.bin \ 105 --hw-config fiptool_images/imx7s-warp.dtb \ 106 --tos-fw-cert fiptool_images/tee-header_v2.bin.crt \ 107 --tos-fw-key-cert fiptool_images/tee-header_v2.bin.key-crt \ 108 --nt-fw-cert fiptool_images/u-boot.bin.crt \ 109 --nt-fw-key-cert fiptool_images/u-boot.bin.key-crt \ 110 --trusted-key-cert fiptool_images/trusted-key-cert.key-crt \ 111 --tb-fw-cert fiptool_images/trusted-boot-fw.key-crt warp7.fip 112 113# Deploy Images 114 115 116First place the WaRP7 into UMS mode in u-boot this should produce an entry in 117/dev like /dev/disk/by-id/usb-Linux_UMS_disk_0_WaRP7-0xf42400d3000001d4-0\:0 118 119.. code:: shell 120 121 => ums 0 mmc 0 122 123Next flash bl2.imx and warp7.fip 124 125bl2.imx is flashed @ 1024 bytes 126warp7.fip is flash @ 1048576 bytes 127 128.. code:: shell 129 130 sudo dd if=bl2.bin.imx of=/dev/disk/by-id/usb-Linux_UMS_disk_0_WaRP7-0xf42400d3000001d4-0\:0 bs=512 seek=2 conv=notrunc 131 # Offset is 1MB 1048576 => 1048576 / 512 = 2048 132 sudo dd if=./warp7.fip of=/dev/disk/by-id/usb-Linux_UMS_disk_0_WaRP7-0xf42400d3000001d4-0\:0 bs=512 seek=2048 conv=notrunc 133 134Remember to umount the USB device pefore proceeding 135 136.. code:: shell 137 138 sudo umount /dev/disk/by-id/usb-Linux_UMS_disk_0_WaRP7-0xf42400d3000001d4-0\:0* 139 140 141# Signing BL2 142 143A further step is to sign BL2. 144 145The image_sign.sh and bl2_sign.csf files alluded to blow are available here. 146 147https://github.com/bryanodonoghue/atf-code-signing 148 149It is suggested you use this script plus the example CSF file in order to avoid 150hard-coding data into your CSF files. 151 152Download both "image_sign.sh" and "bl2_sign.csf" to your 153arm-trusted-firmware top-level directory. 154 155.. code:: shell 156 157 #!/bin/bash 158 SIGN=image_sign.sh 159 TEMP=`pwd`/temp 160 BL2_CSF=bl2_sign.csf 161 BL2_IMX=bl2.bin.imx 162 CST_PATH=/path/to/cst-2.3.2 163 CST_BIN=${CST_PATH}/linux64/cst 164 165 #Remove temp 166 rm -rf ${TEMP} 167 mkdir ${TEMP} 168 169 # Generate IMX header 170 /path/to/u-boot/tools/mkimage -n u-boot.cfgout.warp7 -T imximage -e 0x9df00000 -d ./build/warp7/debug/bl2.bin ./build/warp7/debug/bl2.bin.imx > ${TEMP}/${BL2_IMX}.log 171 172 # Copy required items to $TEMP 173 cp build/warp7/debug/bl2.bin.imx ${TEMP} 174 cp ${CST_PATH}/keys/* ${TEMP} 175 cp ${CST_PATH}/crts/* ${TEMP} 176 cp ${BL2_CSF} ${TEMP} 177 178 # Generate signed BL2 image 179 ./${SIGN} image_sign_mbl_binary ${TEMP} ${BL2_CSF} ${BL2_IMX} ${CST_BIN} 180 181 # Copy signed BL2 to top-level directory 182 cp ${TEMP}/${BL2_IMX}-signed . 183 cp ${BL2_RECOVER_CSF} ${TEMP} 184 185 186The resulting bl2.bin.imx-signed can replace bl2.bin.imx in the Deploy 187Images section above, once done. 188 189Suggested flow for verifying. 190 1911. Followed all previous steps above and verify a non-secure ATF boot 1922. Down the NXP Code Singing Tool 1933. Generate keys 1944. Program the fuses on your board 1955. Replace bl2.bin.imx with bl2.bin.imx-signed 1966. Verify inside u-boot that "hab_status" shows no events 1977. Subsequently close your board. 198 199If you have HAB events @ step 6 - do not lock your board. 200 201To get a good over-view of generating keys and programming the fuses on the 202board read "High Assurance Boot for Dummies" by Boundary Devices. 203 204https://boundarydevices.com/high-assurance-boot-hab-dummies/ 205