- Last edited 2 weeks ago ago
How to configure TF-A BL2
- 1 Article purpose
- 2 Source code access and build process
- 3 Updating the software on board
1 Article purpose
This section details the TF-A BL2 stage (Trusted Firmware-A Boot Loader stage 2) used as FSBL (First Stage Boot Loader).
It explains how to configure and build BL2 in STM32 MPU context, describes the build process from sources, and shows how to deploy it on your target.
2 Source code access and build process
2.1 Cross compilation
Cross compilation of TF-A BL2 is only required if it needs to be modified.
Refer to Setup Cross compile environment.
The build process creates an STM32 image. This binary is built in a single step during the build process.
2.2 Install sources
2.2.1 From the Developer package
The Developer Package contains OpenSTLinux and TF-A sources: TF-A Installation
2.2.2 Official source tree
Download the source code from the official Trusted Firmware-A git repository.
For a full-featured software, go to STMicroelectronics github:
2.2.3 Distribution Package
It is possible to use the distribution package to download and rebuid TF-A BL2
2.3 Build process
2.3.1 TF-A Build flags
Generic build flags for TF-A are described in the Build Options page of the official TF-A documentation.
Other optional flags:
- STM32MP_FORCE_MTD_START_OFFSET = <value>: overrides the default start offset to read FIP on MTD devices (need to be aligned with FlashLayout).
2.4 Build command
2.4.1 Build command details
The BL2 generation depends on the selected storage device. By default, only one storage device is supported.
Then compile the TF-A BL2.
For example, default build command for STM32MP15 is:
make ARM_ARCH_MAJOR=7 ARCH=aarch32 PLAT=stm32mp1 \ <Selected storage> STM32MP15=1 DTB_FILE_NAME=<board_name>.dtb
Example with sdcard:
make ARM_ARCH_MAJOR=7 ARCH=aarch32 PLAT=stm32mp1 STM32MP_SDMMC=1 \ STM32MP15=1 DTB_FILE_NAME=stm32mp157c-ev1.dtb
Replace STM32MP_SDMMC with the chosen device.
2.4.2 Secure boot support
To enable secure boot, you have to add TRUSTED_BOARD_BOOT=1 flag:
Example with secure boot on stm32mp135f-dk:
MBEDTLS_DIR=<path_to_mbedtls_directory> make ARM_ARCH_MAJOR=7 \ ARCH=aarch32 PLAT=stm32mp1 STM32MP_SDMMC=1 TRUSTED_BOARD_BOOT=1 \ STM32MP13=1 DTB_FILE_NAME=stm32mp135f-dk.dtb
To enable secure boot with encryption support, you have to add DECRYPTION_SUPPORT=aes_gcm with the ENCRYPT_BLx to specify the encrypted binary.
Example with encrypted BL32 on stm32mp135f-dk:
MBEDTLS_DIR=<path_to_mbedtls_directory> make ARM_ARCH_MAJOR=7 \ ARCH=aarch32 PLAT=stm32mp1 STM32MP_SDMMC=1 TRUSTED_BOARD_BOOT=1 \ ENCRYPT_BL32=1 DECRYPTION_SUPPORT=aes_gcm \ STM32MP13=1 DTB_FILE_NAME=stm32mp135f-dk.dtb
If you use developer package SDK, you have to unset these flags:
unset LDFLAGS; unset CFLAGS;
2.5 Final image
The final image is available for Flash memory or SDCard update in the corresponding folder:
<BUILD_PLAT>/tf-a-<board>.stm32 Ex: build/release/tf-a-stm32mp157c-ev1.stm32
3 Updating the software on board
3.1 Partitioning of binaries
The TF-A build provides a binary named tf-a-<board>.stm32 that MUST be copied to a dedicated partition named "fsblX" (X depends on the number of needed backups in the Flash).
3.2 Updating via SDCard
If you use an SDCard, simply update TF-A using the dd command on your host.
Plug your SDCard into the computer and copy the binary to the dedicated partition; on an SDCard/USB disk the "fsbl1" partition is partition 1:
- SDCard: /dev/mmcblkXp1 (where X is the instance number) - SDCard via USB reader: /dev/sdX1 (where X is the instance number)
- Under Linux®
dd if=<tf-a file>.stm32 of=/dev/<device partition> bs=1M conv=fdatasync
- Under Windows®
CoreUtils  that includes the dd command is available for Windows.
3.3 Updating via USB mass storage on U-boot
Refer to the previous section to put tf-a-<board>.stm32 into SDCard/USB disk.
3.4 Updating your boot device via STM32CubeProgrammer
Refer to the STM32CubeProgrammer documentation to update your target.