PanGuBoard DevelopmentKit

TF-A Introduction

 

TF-A (Trusted Firmware-A) is a reference implementation of security software provided by ARM®. The TF-A was originally designed for the Armv8-A platform and is now adapted and used by the STMicroelectronics on the Armv7-A platform. The project has now handed over the Trusted Firmware project to Linaro for management as an open source project. This part of the code complies with the BSD-3-Clause copyright.

In the case of the Trusted boot chain, TF-A can be used and acts as the FSBL.

The global architecture of TF-A is explained in the Trusted Firmware-A design [8] document.

TF-A is divided into different phases, each with major functions.

  • Boot loader stage 1 (BL1) application processor trusted ROM

  • Boot loader stage 2 (BL2) trusted boot firmware

  • Boot loader stage 3-2 (BL32) runtime software

  • Boot loader stage 3-3 (BL33) non-trusted firmware

BL1 is currently optional. If you compile the trial open parameter BL2_AT_EL3, BL1 will be removed. On the PanGu development board, since this part of the function is done by ROM code and BL2, the BL1 part is removed. BL2 is the first part of the PanGu development board to be loaded.

BL33 is the first non-secure code loaded by TF-A. In the startup process, this is SSBL, and the SSBL for the PanGu development board is U-Boot.

On the PanGu development board, the two binary BL2 and BL32, as well as the device tree, are placed in the same binary file and loaded into the SYSRAM by the ROM at power-on.

image

TF-A loading order:

  1. ROM code loads TF-A binary, then calls BL2

  2. BL2 prepare BL32

  3. BL2 load BL33

  4. BL2 call BL32

  5. BL32 call BL33

 

Compile TF-A

 

Download the TF-A source package and put it in the development directory, then extract the code

$ cd $HOME/PanGu
$ tar xvf arm-trusted-firmware.tar.gz

Before compiling TF-A, you need a Makefile.sdk file, click the link below and download it, and put it in the development directory.
Download Makefile.sdk

$ mv ~/Makefile.sdk $HOME/PanGu
$ make -f ../Makefile.sdk  TFA_DEVICETREE=stm32mp157a-panguboard TF_A_CONFIG=trusted ELF_DEBUG_ENABLE='1' all

After the compilation is complete, the generated file is in the build directory of the development directory, which is $HOME/PanGu/build. The compiled binary file name is tf-a-stm32mp157a-panguboard.stm32.