Hello ST community,
For a project, we use the STM32MP157F-EV1 where we are trying to implement the secure boot chain. For this, we have to generate a FIP package that contains all required certificates.
In the ST wiki two methods are proposed :
- One using the FipTools and cert_create
- Using the TF-A make system to generate the FIP.
The second method doesn't work from my side. I have a build error. Here is my modus operandi :
- Source the STM32MP1 toolchain
./opt/st/stm32mp1/3.1-openstlinux-5.10-dunfell-mp1-21-03-31/environment-setup-cortexa7t2hf-neon-vfpv4-ostl-linux-gnueabi
- Go to the TF-A source directory
cd <Developer_Package_directory>/stm32mp1-openstlinux-5.10-dunfell-mp1-21-03-31/sources/arm-ostl-linux-gnueabi/tf-a-stm32mp-2.4.r1-r0/tf-a-stm32mp-2.4.r1
- Launch the build of TF-A as specified in the wiki :
make ARM_ARCH_MAJOR=7 ARCH=aarch32 PLAT=stm32mp1 \ MBEDTLS_DIR=~/mbedtls \
AARCH32_SP=sp_min \
BL33=../../u-boot-stm32mp-2020.10.r1-r0/deploy/u-boot-nodtb-stm32mp15.bin BL33_CFG=../../u-boot-stm32mp-2020.10.r1-r0/deploy/u-boot-stm32mp157f-ev1-trusted.dtb \
DTB_FILE_NAME=stm32mp157f-ev1.dtb TRUSTED_BOARD_BOOT=1 GENERATE_COT=1 ROT_KEY=<private_key_path>
Including bl32/sp_min/sp_min.mk LD /home/ag/STM32mp1_Ecosystem_5.10/Developer_Package/stm32mp1-openstlinux-5.10-dunfell-mp1-21-03-31/sources/arm-ostl-linux-gnueabi/tf-a-stm32mp-2.4.r1-r0/tf-a-stm32mp-2.4.r1/build/stm32mp1/release/bl32/bl32.elfarm-ostl-linux-gnueabi-ld.bfd:
unrecognized option '-Wl,-O1'arm-ostl-linux-gnueabi-ld.bfd: use the --help option for usage informationmake:
*** [Makefile:1122: /home/ag/STM32mp1_Ecosystem_5.10/Developer_Package/stm32mp1-openstlinux-5.10-dunfell-mp1-21-03-31/sources/arm-ostl-linux-gnueabi/tf-a-stm32mp-2.4.r1-r0/tf-a-stm32mp-2.4.r1/build/stm32mp1/release/bl32/bl32.elf] Error 1
This output makes me think that LDFLAGS that shall be given to GCC are given to LD directly. Does anyone have an idea of why this procedure doesn't work?
Many thanks for considering my request.
