02. Writing Trusted Applications
In the second part of our lab, it's time to run some Trusted Applications (TAs)!
We will use the official optee_examples as starting point.
Two questions arise: how can one compile a TA? + how to test it on our board?
Step 5. Not so fast... we forgot about the kernel?
If we wish to communicate with OP-TEE from Linux, we need to configure its driver (don't worry, we don't need to recompile the kernel, it's included in defconfig').
Of course, the intended way to do that is by modifying the Linux Device Tree. Do it as documented here ;)
arch/arm64/.
We promised that you won't need to recompile the kernel, you just need to recompile its DTB ;) use:
make ARCH=... dtbs
Afterwards, you need to copy the new .dtb into your staging/ directory and re-build the Linux uImage (using the previously provided staging/Makefile).
As for the userspace (rootfs), there are two choices: either Debian or Buildroot (disable RAUC nevertheless and use the first version of mk-disk-image.sh to upload the rootfs when ready to test, towards the end of the task).
For Buildroot, you must use menuconfig and enable PACKAGE_OPTEE_CLIENT! Built it & unpack it to the secondary ext4 disk partition (just edit the mk-disk-image script).
For Debian, you can either cross compile the OP-TEE client or try out the optee-client package from APT (use a chroot to install from host).
Step 6. Building a TA
We can use our workstation / laptop to cross-compile a trusted application!
Read the official instructions here.
Build both the host app and the Trusted Application need to be compiled TOGETHER with the TEE Client Library, and the OPTEE OS exported SDK, respectively.
Make sure to read the examples documentation to see the make variables to set!
TA_DEV_KIT_DIR of a Trusted Application, it must point to an SDK generated inside BL32 (optee_os) source directory (something like export-ta…'.
Step 7. Signing the TA
Remember the secure boot process? The Secure OS (OP-TEE) will also verify each TA before being able to load it!
Fortunately, OP-TEE comes with a predefined key pair, used to facilitate development / testing (warning: highly insecure since anybody can retrieve that key from the source repository!).
Read on for the TA signing procedure!
Even better: the TA Makefile automatically signs the .ta using the development key. So we won't need to do anything more! Yay…
Step 8. Testing the TA
Our rootfs image already contains the OP-TEE client library.
You just need to copy to the cross-compiled binaries to your boot partition.
For this, put u-boot in USB Mass Storage mode:
u-boot=> ums mmc 0
Use lsblk to find out which is the second (ext4) partition, mount it and copy the TA files:
mount /dev/sda2 /mnt ls -l /mnt # copy them inside your home cp $OPTEE_FILES /mnt/root/
After copying the files, boot Linux.
On buildroot, check if tee-supplicant is running… or start it:
ps aux | grep tee-supplicant tee-supplicant -d
Then execute the trusted application ;)
.ta file inside a trusted memory or REE.
For this, you will need to copy the signed <UUID>.ta file to /lib/optee_armtz/ (create it if it doesn't exist), as (very badly) documented.
