Page Comparison

Open Portable Trusted Execution Environment, or OP-TEE, is an open-source project that provides a Trusted Execution Environment (TEE) for secure computing on ARM-based processors. A TEE is a secure area within a processor that ensures the confidentiality and integrity of the code and data running inside it. OP-TEE specifically targets ARM TrustZone technology, which is a hardware-based security feature available on ARM Cortex-A processors.

...

OP-TEE Documentation

OP-TEE GitHub Repository

Table of Contents

Software

...

Architecture of OP-TEE

The software architecture of OP-TEE can be depicted as follows:

...

Trusted OS is the heart of the OP-TEE, often referred to as the TEE Core. It provides the foundational layer for secure execution of trusted applications and services. It manages the secure world of the system, handling secure bootstrapping, memory isolation, and secure context switching between trusted and non-trusted execution environments. It also provides essential services such as cryptographic operations, secure storage, and secure inter-process communication between trusted applications and other components.

Trusted

...

Applications (TA)

Trusted applications are designed to execute sensitive or security-critical operations within the TEE. They ensure the confidentiality, integrity, and authenticity of the data and processes they manage. A Dynamic Trusted Application (DTA) is a type of trusted application within the TEE that is loaded and executed dynamically at runtime. Unlike Static Trusted Applications (STAs), which are statically linked into the TEE core image during the build process, DTAs are loaded into memory and executed as needed, allowing for more flexibility and dynamic behavior in the TEE environment.

...

OP-TEE defines internal APIs that allow developers to access various TEE functionalities, including cryptographic services, secure storage, and secure communication between trusted applications.

Client

...

Applications (CA)

Client applications utilize the "TEE Client API" to communicate with trusted applications within TEE, thereby accessing security services provided by these trusted applications.

...

This layer provides a set of APIs that enable communication between non-secure (normal world) applications and trusted applications running within the TEE. Non-secure applications can use these APIs to securely invoke services provided by trusted applications and access secure resources managed by the TEE Core.

Linux TEE

...

Framework

The Linux TEE (Trusted Execution Environment) framework is a subsystem within the Linux kernel designed to support the integration of TEE into the Linux operating system. The Linux TEE framework enables communication and interaction between the Linux kernel and TEE, facilitating the execution of trusted applications and services within the TEE.

Linux OP-TEE

...

Driver

The Linux OP-TEE driver serves as the interface between the Linux kernel and specific TEE implementations. It provides a standardized interface for communication and interaction with the TEE from the Linux kernel.

TEE Msg SMC

...

Calls

"TEE msg SMC calls" is used for communication between the Normal World (non-secure) and the Secure World (trusted execution environment) in a TEE. When an application or service in the Normal World needs to access secure resources or execute secure operations managed by the Trusted OS (TEE Core), it issues an SMC call. This call triggers an exception that switches the processor from Non-secure mode to Secure mode, allowing the TEE Core to handle the request securely. The TEE Core processes the request, performs the necessary operations in the Secure World, and sends back the result to the Normal World through another SMC call.

Implementation of OP-TEE in SP7350

...

Platform

Loading and

...

Initialization

During the boot process, OP-TEE must be initiated at the earliest feasible stage to prevent potential security vulnerabilities. In the SP7350 software environment, the x-boot (the first-stage bootloader loads the OP-TEE, BL31 (Trusted Firmware-A), and U-Boot images from the boot storage devices. Subsequently, control is transferred to BL31, acting as a secure monitor, which initiates OP-TEE.

Reserved

...

Memory for OP-TEE

In the SP7350 platform's device tree source (dts), a two-megabyte area starting at memory address 0x300000 is reserved for OP-TEE. Below is a snippet illustrating the reserved memory configuration:

	reserved-memory {
		:
		/*OP-TEE reserve memory: 0x300000-0x4fffff, total 2M */
		optee_reserve@300000 {
			reg = <0x0 0x300000 0x0 0x200000>;
			no-map;
		};
		:
		:
	};

Linux TEE

...

Framework and OP-TEE

...

Driver

To integrate the Linux TEE framework and the OP-TEE driver into the SP7350 platform, the following configurations are required in the device tree source (dts):

...

Enabling the Linux TEE framework (CONFIG_TEE=y) and the OP-TEE driver (CONFIG_OPTEE=y) in the kernel configuration are essential prerequisites for this configuration to take effect.

Source

...

Files

The source files of OP-TEE are organized within the "optee/" directory at the top level of the project. Below is a breakdown of the main subdirectories:

Within the "optee_os/" directory, you would typically find the following:

Within the "core/" directory, further subdivisions include:

OP-TEE Log and

...

Explanation

The log of OP-TEE is directed to UART0. The following log details the initialization process of OP-TEE (BL32):

...