tf-a and u-boot custom compile fails

[ASkri.1]

Hi, Everybody!

Referring to this issue:

https://community.st.com/s/question/0D53W00000oVNtqSAG/qaudspi-spinand-flash-device-tree-for-tfa-and-uboot

PatrickF suggested to manually configure U-BOOT for my board. I have downloaded tf-a sources patched it, of course installed and configured SDK and trying to do all according to it's README.HOW_TO.txt file.

As I have my specific DT I need to specify it in makefile parameters:

README.HOW_TO.txt has this example:

make -f $PWD/../Makefile.sdk TFA_DEVICETREE=stm32mp157c-ev1 TF_A_CONFIG=trusted ELF_DEBUG_ENABLE='1' all

But in fact TFA_DEVICETREE var-name should be TF_A_DEVICETREE. Is this correct?

Then, file format. We have .stm32, also .fip file format avaialble

I can compile both .stm32 tf-a and u-boot, but u-boot fail to start with following error:

NOTICE: CPU: STM32MP157DAB Rev.Z

NOTICE: Model: STMicroelectronics STM32MP157A-DK1 STM32CubeMX board

INFO:  Reset reason (0x14):

INFO:   Pad Reset from NRST

INFO:  PMIC version = 0x21

INFO:  FCONF: Reading TB_FW firmware configuration file from: 0x2ffe3000

INFO:  FCONF: Reading firmware configuration information for: stm32mp_io

INFO:  Using USB

INFO:   Instance 2

INFO:  Boot used partition fsbl1

NOTICE: BL2: v2.4-r1.0(debug):

NOTICE: BL2: Built : 11:12:52, May 27 2021

INFO:  BL2: Doing platform setup

INFO:  RAM: DDR3-DDR3L 16bits 533000Khz

WARNING: Couldn't find property st,phy-cal in dtb

INFO:  Memory size = 0x20000000 (512 MB)

INFO:  DFU USB START...

INFO:  phase ID :0, Manifestation 0 at c00001d9

INFO:  phase ID :3, Manifestation 3 at c80e1fa2

ERROR:  FIP Header check failed for phase 3

ERROR:  usb_core_ctl_error : Send an ERROR

INFO:  handle USB : Suspend int

INFO:  USB Suspend mode

Then I'm trying to compile tf-a with fip option, but it fails with following error:

 make -f ../Makefile.sdk TF_A_CONFIG=trusted TF_A_DEVICETREE=stm32mp157a-stm32mp151-dk1-mx fip

fiptool-stm32mp config:

 optee:

  bl32 config value: optee

 trusted:

  bl32 config value: tfa

 FIP_DEVICETREE: stm32mp157a-stm32mp151-dk1-mx

 FIP_DEPLOYDIR_FIP  : /home/screep/Distribution-Package/stm32mp1-openstlinux-5.10-dunfell-mp1-21-03-31/sources/arm-ostl-linux-gnueabi/FIP_artifacts//fip

 FIP_DEPLOYDIR_TFA  : /home/screep/Distribution-Package/stm32mp1-openstlinux-5.10-dunfell-mp1-21-03-31/sources/arm-ostl-linux-gnueabi/tf-a-stm32mp-2.4.r1-r0/tf-a-sources/../deploy/bl32

 FIP_DEPLOYDIR_FWCONF: /home/screep/Distribution-Package/stm32mp1-openstlinux-5.10-dunfell-mp1-21-03-31/sources/arm-ostl-linux-gnueabi/tf-a-stm32mp-2.4.r1-r0/tf-a-sources/../deploy/fwconfig

 FIP_DEPLOYDIR_OPTEE : /home/screep/Distribution-Package/stm32mp1-openstlinux-5.10-dunfell-mp1-21-03-31/sources/arm-ostl-linux-gnueabi/FIP_artifacts//optee

 FIP_DEPLOYDIR_UBOOT : /home/screep/Distribution-Package/stm32mp1-openstlinux-5.10-dunfell-mp1-21-03-31/sources/arm-ostl-linux-gnueabi/FIP_artifacts//u-boot

Missing stm32mp157a-stm32mp151-dk1-mx-fw-config-optee.dtb file in folder: $FIP_DEPLOYDIR_FWCONF or '$FIP_DEPLOYDIR_ROOT/arm-trusted-firmware/fwconfig'

Why optee? I don;t need optee.

Can anybody help me with correct sequence compiling tf-a and u-boot starting from source download and finishing with success kernel load...

Thank you in advance

Looking forward for your reply

[PatrickF]

Hi,

I see you already play with OTP for eMMC (not checked in details).

The main issue I see is that you try secure boot (https://wiki.st.com/stm32mpu/wiki/STM32MP15_ROM_code_secure_boot) and this fail (==> < @ 16398676 | [ERR ] - BOOTCORE_AuthWrongImageChecksum >)

Whereas your device (STM32MP157DAB does not support secure boot).

Secure boot is usually disabled by default during build process.

Please check some issue linked to signing tool (which add the header) during TF-A build.

As I'm not really used to secure boot, on my side, I will check what could be the mistake which lead to unwanted secure boot setting.

Regards

[ASkri.1]

You mean, that my tf-a.stm32 file HAS a secure boot record, but MCU does not support it? So, I need to find a way to remove it by checking tf-a source headers? �?р, 2 июн. 2021 г. в 15:30, ST Community :

[ASkri.1]

Patrick, There is similar issue: https://community.st.com/s/question/0D50X0000BFFpHsSQL/stm32mp1-qspi-boot-problem Here you insists (opposite) to add auth record using Signing tool: "Before Flashing, did you append your image with the header using Signing tool <> provided with STM32CubeProgrammer ? This is required even if not using secure boot." �?р, 2 июн. 2021 г. в 15:30, ST Community :

[PatrickF]

Hi,

yes, but usually not possible remove it in the header using signing tool on an already signed binary.

One hack could be to remove the header (256 first bytes) using an hex editor and manually use signing tool with "-of 0"

Need to have public/private key pair (e.g. using keygen), even if not used

e.g. on W10:

STM32MP_SigningTool_CLI.exe -bin <your_app.bin> -la 0x2ffc2400 -ep 0x2ffc2500 -t fsbl -o <your_app_signed.bin> -pubk <publicKey.pem> -prvk <privateKey.pem> -pwd <key_pwd> -iv 1 -of 0

Best would be to find where during the build process you enable the secure boot.

Regards,

[ASkri.1]

Here is lines from tf-a's make file: # Add Secure Partition packages ifeq (${NEED_SP_PKG},yes) $(BUILD_PLAT)/sp_gen.mk: ${SP_MK_GEN} ${SP_LAYOUT_FILE} | ${BUILD_PLAT} ${Q}${PYTHON} "$<" "$@" $(filter-out $<,$^) $(BUILD_PLAT) ${COT} sp: $(SPTOOL) $(DTBS) $(BUILD_PLAT)/sp_gen.mk ${Q}$(SPTOOL) $(SPTOOL_ARGS) @${ECHO_BLANK_LINE} @echo "Built SP Images successfully" @${ECHO_BLANK_LINE} endif Isn't it? �?р, 2 июн. 2021 г. в 15:53, ST Community :

[ASkri.1]

Finally I've tried your hack suggested:
1. Rebuild TFA:
make -f ../Makefile.sdk TF_A_DEVICETREE=stm32mp157a-stm32mp151-dk1-mx FIP_CONFIG=" trusted" FIP_BL32_CONF="tfa," TF_A_CONFIG="trusted emmc nand nor sdcard uart usb" DEPLOYDIR=$FIP_DEPLOYDIR_ROOT/arm-trusted-firmware stm32
2. Took tf-a-stm32mp157a-stm32mp151-dk1-mx-nand.stm32 file
3. Remove first 256 bytes of data
4. Generated keys with STM32MP_KeyGen_CLI.exe tool
5. Sign file with following command line:
"C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin\STM32MP_SigningTool_CLI.exe" -bin tf-a-stm32mp157a-stm32mp151-dk1-mx-nand.bin -la 0x2ffc2400 -ep 0x2ffc2500 -t fsbl -o tf-a-stm32mp157a-stm32mp151-dk1-mx-nand_sign.bin -pubk publicKey.pem -prvk privateKey.pem -pwd 123456789 -iv 1 -of 0
6. Download all with following tsv file:
#Opt Id Name Type IP Offset Binary
- 0x01 fsbl-boot Binary none 0x0 ./tf-a-stm32mp157a-stm32mp151-dk1-mx-usb.stm32
- 0x03 fip-boot Binary none 0x0 ./fip-stm32mp157a-stm32mp151-dk1-mx-trusted.bin
P 0x04 fsbl Binary(2) spi-nand0 0x000000 ./tf-a-stm32mp157a-stm32mp151-dk1-mx-nand_sign.stm32
P 0x05 fip1 Binary spi-nand0 0x200000 ./fip-stm32mp157a-stm32mp151-dk1-mx-trusted.bin
P 0x06 fip2 Binary spi-nand0 0x400000 ./fip-stm32mp157a-stm32mp151-dk1-mx-trusted.bin
P 0x10 UBI System spi-nand0 0x600000 ./st-image-weston-openstlinux-weston-stm32mp1-disco-mx_nand_4_256_multivolume.ubi
(Not re-sign tf-a-stm32mp157a-stm32mp151-dk1-mx-usb.stm32)
Now the result is little bit different:
1. No console activity during boot;
2. Can't download boot-rom log with following openocd output:
Info : STLINK V3J7M2 (API v3) VID:PID 0483:374E
Info : Target voltage: 0.000000
Error: target voltage may be too low for reliable debugging
Info : Unable to match requested speed 5000 kHz, using 3300 kHz
Info : Unable to match requested speed 5000 kHz, using 3300 kHz
Info : clock speed 3300 kHz
Info : stlink_dap_op_connect(connect)
Info : SWD DPIDR 0x6ba02477
Info : stlink_dap_op_connect(connect)
Info : SWD DPIDR 0x6ba02477
Info : starting gdb server for stm32mp15x.cpu0 on 3333
Info : Listening on port 3333 for gdb connections
Info : starting gdb server for stm32mp15x.cm4 on 3334
Info : Listening on port 3334 for gdb connections
Error: Target not examined yet
3. LED connected to PA13 pin flashed at 9600bps following message:

[PatrickF]

Hi,

I have no clues, if you cannot get BootROM log, this could mean the BootROM has started TF-A code (and so debug was not enabled as it is in case of error).

PA13 at 9600bps could mean an unrecoverable error occurred (e.g. exception taken by bootROM, e.g. TF-A is started but fail to initialize its context, e.g. illegal instruction, abort, etc...)

I would suspect some HW issue which make NAND data read not reliable. Could you check power and signal integrity on your board ?

Is the error/behavior always the same after few reboot (power down/up) ?

Did you have another Flash (e.g. SD-Card, eMMC) on the system where you can test same TF-A ? You could even test it on another platform like DK2 or EV1 (it would likely crash, but maybe with some UART log if you are using same pins).

Regards.

[ASkri.1]

I'm not sure, that it is HW problem due following reasons:
1. qspi signals @ 64Mhz looks good. I have all pull-ups, etc...
2. I have no problem flashing tsv files with CubeMXProgrammer. Hope USB protocol assumes any read-back to check written;
3. TF-A and U-BOOT DT set qspi speed at 64Mhz now. Exactly the same as BOOT-ROM QSPI speed;
4. Result always the same;
5. As far as I understand, the stm2 header has an image CRC to check. So, I assume that it's a read image from SPI, then check it's CRC,
then start TF-A. If crc is not correct - return ROM-code error.
Maybe the problem is a hacked .stm32 image - how to be sure that it is correct?...
Reboots:
bootfailed
S-00000005C040CFFE
NS-0000000000000000

[PatrickF]

Hi,

First try to understand why during TF-A generation, the checksum is badly generated (all should be automatic). Please double check your sequences Vs https://wiki.st.com/stm32mpu/wiki/How_to_compile_the_device_tree_with_the_Developer_Package#TF-A_-_regenerate_TF-A

Maybe for further analyzing, dump here the header (256 first bytes) as 32-bits hex words (or send me in a private message the zipped binary file).

Ultimately, when checksum is ok without hacked image and you still get 'bootfailed' message with debug disable (bo trace log), this issue may be linked to your Serial-NAND Flash which cannot be auto-detected by BootROM, and so need custom OTP WORD9 settings.

Seems the MT29F1G01ABAFDWB flash has a plane select (even if stated 'dummy' for 1Gb devices), which might need to setup WORD9 = 0x80204000 (please double check the value with your memory datasheet and https://wiki.st.com/stm32mpu/wiki/STM32MP15_ROM_code_overview#OTP_WORD_9_-_NAND_configuration).

As OTP burning is not recoverable and could 'brick' the device, only try this if you have a way to replace the device (e.g. socket).

Regards.

[ASkri.1]

Hi, Patrick!
Sorry for long discussion, I'm quite new in such kind of devices, so a lot of stupid situations...
Finally, I've got TF-A started correctly. At least I have such console output while quadspi boot:
NOTICE: CPU: STM32MP157DAB Rev.Z
NOTICE: Model: STMicroelectronics STM32MP157A-DK1 STM32CubeMX board
INFO: Reset reason (0x14):
INFO: Pad Reset from NRST
INFO: PMIC version = 0x21
INFO: FCONF: Reading TB_FW firmware configuration file from: 0x2ffe3000
INFO: FCONF: Reading firmware configuration information for: stm32mp_io
INFO: Using SPI NAND
INFO: Instance 1
INFO: Boot used partition fsbl1
ERROR: Boot interface 7 not supported
PANIC at PC : 0x2ffeb031
Exception mode=0x00000016 at: 0x2ffeb031
(btw what is boot interface 7?)
Here is EMMC TF-A loaded to QSPI, so, according *.map I't failed somewhere while u-boot finding partition enumeration...
It is not so important, at least we've got qspi booted 🙂
Possible reason is, ubi image that needs to be loaded to 0x10 partition was too big to fit to nand-flash and the write sequence
at the end of flash might be overlapped to zero address and damage TF-A image. That's my suspicion... I'm not quite sure about it...
Good idea is to build the correct ubi image to fit to 128Mb nand. I've built a core image with bitbake st-image-core command (hope I'm correct here) and got UBI image with size 116Mb (121896960b). I'm expecting it can be fitted to a UBI partition that has size 0x07a00000b = 127926272b. Please refer to nand partition table below.
Bot while loading images with CubeMXProgrammer I've got following error:
dfu_fill_entity_mtd: Memory layout (/0x10/1*122Me) not supported!
I can't imagine what this means... Ans asking for hints again.
Here is console full output while CubeMX programming (one more question after log):