3.11. OP-TEE

OP-TEE is a Trusted Execution Environment (TEE) designed as a companion to a non-secure Linux kernel running on Arm Cortex-A cores using the TrustZone technology.

Furthur information about it can be found at: https://optee.readthedocs.io/en/latest/general/about.html
Official OP-TEE documentation: https://optee.readthedocs.io/en/latest
OP-TEE advisory listing: https://github.com/OP-TEE/optee_os/security/advisories

The OP-TEE binary (bl32.bin/tee-pager_v2.bin) is bundled into tispl.bin and the following are the instructions to build:

3.11.1. Getting the OP-TEE Source Code

The pre-built OPTEE binary should be packaged in TI Processor SDK: <path-to-processor-sdk>/board-support/prebuilt-images/<optional-build-machine-name>/bl32.bin. Use this binary since it has been tested with TI Processor SDK.

If it is not possible to use pre-build binary, use the following:

$ git clone https://github.com/OP-TEE/optee_os.git
$ git checkout <hash>

Where <hash> is the OPTEE commit shown in Build Information.

3.11.2. Setting up the toolchain paths

Before compiling any of the sources referenced in this document, set the cross compiler paths to the toolchains packaged in the Processor SDK [Recommended] as shown below. Refer to Yocto-built SDK Toolchains section for more details on usage.

host# export CROSS_COMPILE_64="${SDK_INSTALL_DIR}/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/aarch64-oe-linux/aarch64-oe-linux-"
host# export SYSROOT_64="${SDK_INSTALL_DIR}/linux-devkit/sysroots/aarch64-oe-linux"
host# export CC_64="${CROSS_COMPILE_64}gcc --sysroot=${SYSROOT_64}"
host# export CFLAGS64="--sysroot=${SYSROOT_64}"
host# export KCFLAGS="--sysroot=${SYSROOT_64}"
host# export LDFLAGS="--sysroot=${SYSROOT_64}"

If the Processor SDK is not installed, the Arm GNU toolchains can be downloaded and setup. Refer to ARM toolchains section for more details on usage.

3.11.3. Building OP-TEE OS

3.11.3.1. Building the OP-TEE image

$ make CROSS_COMPILE64="$CROSS_COMPILE_64" PLATFORM=|__OPTEE_PLATFORM_FLAVOR__| CFG_ARM64_core=y CFG_USER_TA_TARGETS=ta_arm64

3.11.3.2. Building the OP-TEE image with debug parameters

$ make CROSS_COMPILE64="$CROSS_COMPILE_64" PLATFORM=|__OPTEE_PLATFORM_FLAVOR__| CFG_ARM64_core=y CFG_TEE_CORE_LOG_LEVEL=2 CFG_TEE_CORE_DEBUG=y CFG_USER_TA_TARGETS=ta_arm64

3.11.3.3. Building OP-TEE with Pseudo RNG drivers

In certain highly specific use-cases the true RNG drivers could have a detrimental effect to the overall system latency. Using the CFG_WITH_SOFTWARE_PRNG flag to use OP-TEE’s Pseudo RNG drivers as a source of entropy can work around these issues.

$ make CROSS_COMPILE64="$CROSS_COMPILE_64" PLATFORM=k3-k3-am62lx CFG_ARM64_core=y CFG_WITH_SOFTWARE_PRNG=y CFG_USER_TA_TARGETS=ta_arm64

3.11.3.4. OP-TEE Secure Storage

OP-TEE provides secure storage functionality through two mechanisms: REE FS (Rich Execution Environment Filesystem) and RPMB (Replay Protected Memory Block).

TI SDK enables REE FS by-default, and configures OP-TEE to store encrypted binary blobs created by REE FS in /var/lib/tee/.

Note

Presently, AM62L does not support RPMB. This support will be added in subsequent releases. It does support REE FS.

The remaining devices support both: REE FS by-default and RPMB if OP-TEE binaries are re-compiled with required flags.

For learning more about secure storage in OP-TEE, refer: https://optee.readthedocs.io/en/latest/architecture/secure_storage.html

As an example to show the usage of secure storage, the filesystem provides a binary /usr/bin/optee_examples_secure_storage.

optee_examples_secure_storage

For more details, see optee_examples: https://github.com/linaro-swg/optee_examples

3.11.4. Getting OP-TEE Client source code

To get optee_client source code, do:

Getting OP-TEE Client source code

$ git clone https://github.com/OP-TEE/optee_client

Building OP-TEE Client with RPMB support

To use emulated RPMB, set RPMB_EMU=1. Otherwise, set RPMB_EMU=0.

For example, the following command builds optee_client to use the real RPMB, instead of the emulated one.

$ make CROSS_COMPILE="$CROSS_COMPILE_64" PLATFORM=k3 CFG_TEE_SUPP_LOG_LEVEL=2 RPMB_EMU=0 CFG_ARM64_core=y

Now update optee-client binary and libraries on your SD card with the generated ones in out/export/usr folder

3.11.5. Building u-boot with OP-TEE OS

As of Processor SDK 9.0, the signing functionality earlier provided by the TI Security Development Package, has been integrated within U-Boot itself. This means tee-pager_v2.bin does not need to be signed before being packaged in tispl.bin in U-Boot for HS devices.

Expected binary output

Generated binary: tee-pager_v2.bin

Binary saved saved in: <path-to-optee>/out/arm-plat-k3/core

Integrate binary output into U-boot

Go to u-boot folder <path-to-u-boot>

Re-build U-boot with A72/A53 instructions found under: Build U-Boot, but with the TEE parameter pointing to the newly built tee-pager_v2.bin. i.e. TEE=<path-to-optee>/out/arm-plat-k3/core/tee-pager_v2.bin

Note

tee-pager_v2.bin may be called bl32.bin in other documentation.