AM4378: Help required to build the TI SDK for AM437x

Hi Mark,

the current version of the SDK is v08.02 (https://www.ti.com/tool/PROCESSOR-SDK-AM437X). Can't you use just that? Or does it have to be that older version?

Regards, Andreas

Hi Andreas,

thank you for your reply. Apologies, I forgot to say that I need the HS version, as I want to incorporate a TEE. It seems that the most recent SDK version for HS is 06.03.00.106; is that right?

Mark.

Hi Mark,

ah ok, that may be different. Let me re-assign this to our security expert. He's currently out of the office but will be back early next week. So please allow a few days for a response, thanks.

Regards, Andreas

Hi Andreas,

thank you for your help.

Mark.

Hi Mark,
Have you downloaded AM437x secure Linux SDK 6.3 package on secure download portal?
If yes, one option to build u-boot and kernel by following the u-boot and kernel build instructions
software-dl.ti.com/.../Foundational_Components_U-Boot.html
software-dl.ti.com/.../Foundational_Components_Kernel_Users_Guide.html
I'll send an invitation for you to join semi-private security forum to discuss any security related topics.
You'll find some topics from early forum posts...
Best,
-Hong

Hi Hong,

Thank you for your response.

I have tried to build U-Boot using the link you gave, but the second make command fails:

 cd am437x-hs-evm-linux-sdk-src-06.03.00.106/board-support/u-boot-2019.01+gitAUTOINC+333c3e72d3-g333c3e72d3/
$ echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
$ export PATH=$HOME/gcc-arm-8.3-2019.03-x86_64-arm-linux-gnueabihf/bin:$PATH
$ rm -fr ./am437x_evm
$ make CROSS_COMPILE=arm-linux-gnueabihf- O=am437x_evm am43xx_evm_defconfig
make[1]: Entering directory '/home/markr/Spark/am437x-hs-evm-linux-sdk-src-06.03.00.106/board-support/u-boot-2019.01+gitAUTOINC+333c3e72d3-g333c3e72d3/am437x_evm'
  HOSTCC  scripts/basic/fixdep
  GEN     ./Makefile
  HOSTCC  scripts/kconfig/conf.o
  YACC    scripts/kconfig/zconf.tab.c
  LEX     scripts/kconfig/zconf.lex.c
  HOSTCC  scripts/kconfig/zconf.tab.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
make[1]: Leaving directory '/home/markr/Spark/am437x-hs-evm-linux-sdk-src-06.03.00.106/board-support/u-boot-2019.01+gitAUTOINC+333c3e72d3-g333c3e72d3/am437x_evm'
$ make CROSS_COMPILE=arm-linux-gnueabihf- O=am437x_evm
make[1]: Entering directory '/home/markr/Spark/am437x-hs-evm-linux-sdk-src-06.03.00.106/board-support/u-boot-2019.01+gitAUTOINC+333c3e72d3-g333c3e72d3/am437x_evm'
  GEN     ./Makefile
scripts/kconfig/conf  --syncconfig Kconfig
  CHK     include/config.h
  UPD     include/config.h
  CFG     u-boot.cfg
  GEN     include/autoconf.mk
  GEN     include/autoconf.mk.dep
  CFG     spl/u-boot.cfg
  GEN     spl/include/autoconf.mk
  CHK     include/config/uboot.release
  UPD     include/config/uboot.release
  Using .. as source for U-Boot
  .. is not clean, please run 'make mrproper'
  in the '..' directory.
/home/markr/Spark/am437x-hs-evm-linux-sdk-src-06.03.00.106/board-support/u-boot-2019.01+gitAUTOINC+333c3e72d3-g333c3e72d3/Makefile:1560: recipe for target 'prepare3' failed
make[1]: *** [prepare3] Error 1
make[1]: Leaving directory '/home/markr/Spark/am437x-hs-evm-linux-sdk-src-06.03.00.106/board-support/u-boot-2019.01+gitAUTOINC+333c3e72d3-g333c3e72d3/am437x_evm'
Makefile:148: recipe for target 'sub-make' failed
make: *** [sub-make] Error 2

I cannot run "make mrproper" in the parent directory, as there's no Makefile there.

Also, did you send an invitation to the semi-private security forum? I haven't received any invites.

Mark.

Hello Mark,
I tried building u-boot with Linux SDK6.3, and it works for me.

cd $Linux_SDK_Installation_Path
export PATH=$PWD/linux-devkit/sysroots/x86_64-arago-linux/usr/bin:$PATH
cd board-support/u-boot-2019.01+gitAUTOINC+333c3e72d3-g333c3e72d3
make CROSS_COMPILE=arm-linux-gnueabihf- distclean
make CROSS_COMPILE=arm-linux-gnueabihf- O=am43xx_gp_test am43xx_evm_config all

Hi Hong,

Please send me an invite to the semi-private security forum.

Mark.

Hello Mark,
Did you build secure variants successfully?
I sent the invitation again, you'd need to accept the invitation from your side.
Best,
-Hong

Hello Hong,

I built U-Boot using the instructions above, but when I ran it on the board no output was generated on the console.  The U-Boot source code was from here:

repository: git://git.ti.com/processor-sdk/processor-sdk-u-boot.git
branch:     processor-sdk-u-boot-2019.01
revision:   333c3e72d362c1fd1e5011e4e961c231b8f8edc8

I followed OP-TEE's instructions:

optee.readthedocs.io/.../build.html

for OP-TEE version 3.18.0 (released 15 July 2022). The build uses the following version of U-Boot:

repository: git://git.ti.com/ti-u-boot/ti-u-boot.git
revision:   c68ed086bd00054e28c46e033385f79104c3f84c

When I run this version, I see output on the serial port, but the default boot doesn't attempt to boot the kernel: "Starting kernel ..." isn't shown after loading the TEE image:

Authentication passed: CERT_ZIMAGE
## Loading fdt from FIT Image at 87000000 ...
   Using 'am437x-gp-evm.dtb' configuration
   Trying 'am437x-gp-evm.dtb' fdt subimage
     Description:  Flattened Device Tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x873f1acc
     Data Size:    54928 Bytes = 53.6 KiB
     Architecture: ARM
   Verifying Hash Integrity ... OK
Authentication passed: CERT_AM437X-GP-
   Booting using the fdt blob at 0x873f1acc
## Loading loadables from FIT Image at 87000000 ...
   Trying 'optee' loadables subimage
     Description:  OPTEE OS Image
     Type:         Trusted Execution Environment Image
     Compression:  uncompressed
     Data Start:   0x8740bcd8
     Data Size:    329788 Bytes = 322.1 KiB
   Verifying Hash Integrity ... OK
Authentication passed: CERT_TEE
   Loading loadables from 0x8740bcd8 to 0xbdb000e4

However, if I copy onto the SD-Card the zImage that is used in the fitImage, I can get the kernel to boot using the following commands:

run findfdt
set devtype mmc
run loadfdt
fdt addr $fdtaddr
setenv bootargs "console=ttyS0,115200n8 root=/dev/mmcblk1p2 rootwait rw rootfstype=ext4"
load mmc 0:2 $loadaddr boot/zImage
bootz $loadaddr - $fdtaddr

So I think the TEE Image is not loading successfully.  Do I need to use
completely secure boot (with certificates) for the TEE Image to be loaded?

Mark.