Integrate OP-TEE with minimal effort

[GalaxyGorilla]

This commit extends the boot sequence for the Kontron iMX8MM by a BL32 component, in this case OP-TEE:

ROM -> SPL -> BL31 (ATF) -> BL32 (OP-TEE) -> BL33 (U-Boot) -> ...

Since OP-TEE is about separation of memory for a secure world (TEE) and a normal world (REE) the integration of OP-TEE also means that DRAM now has 32MiB separated area for the TEE. This piece of memory sits at the end of the 1GiB memory that the board has (starting at 0x7e000000).

The TEE can be accessed from user space (linux) using 'tee-supplicant' (started as daemon) and for example 'optee_example_hello_world' which is part of the optee_examples suite.

For now OP-TEE is integrated in INSECURE mode as for production there are more things to integrate, e.g. the CAAM random number generator. This yields log warnings about insecure configurations which can be ignored for now.

There are multiple ways to build and package OP-TEE:

1. Use Binman as part of U-Boot build process
2. Use a special version of mkimage (see NXP manual)
3. Manual scripting and padding

All three methods are widely used, there is no 'best' way of doing this. For the sake of the changes in this commit option 1. is used. Note that this process can also be executed in a post-script, which can be interesting when artefacts need to be signed for HAB (i.MX CST tools are integrated with Binman in newer versions of U-Boot). The output of these build processes is usually a 'flash.bin' file which contains the SPL binary as well as a FIT image that consists of BL31, BL32 and BL33.

The Kontron i.MX8MM just has 1GiB and needs a special configuration for this size in the ATF and OP-TEE artefacts, as the defaults in the respective build processes assume 2GiB memory. Also the memory region which was chosen here is purely subjective (but common), other vendors like Phytec put the TEE region at different places.

Also note that in this build process the binary 'tee-raw.bin' is used. This is quite important as the normal 'tee.bin' (output from optee-os build) already contains FIT-ready headers, making it unsuitable for Binman (which would put these headers again on top).

[ziopio]

@GalaxyGorilla how should I rebuild the SDK? (which flags)
And what should I look for in the logs to verify it is working ?

[sylane]

Tested it and it boot fine. I had to do a full rebuild of the SDK. I assume this shows OP-TEE is enabled:

...
I/TC: Reserved shared memory is enabled
I/TC: Dynamic shared memory is enabled
I/TC: Normal World virtualization support is disabled
I/TC: Asynchronous notifications are disabled
...
I/TC: Secondary CPU 1 initializing
I/TC: Secondary CPU 1 switching to normal world boot
I/TC: Secondary CPU 2 initializing
I/TC: Secondary CPU 2 switching to normal world boot
I/TC: Secondary CPU 3 initializing
I/TC: Secondary CPU 3 switching to normal world boot
...

[sylane]

mmm, I just reverted to my old branch (without OP-TEE) and I still see the "I/TC" stuff... So I have no idea if this branch actually run OP-TEE or not, I can only say that the SDK builds, and the generated firmware boots...