Show page

Differences

This shows you the differences between two versions of the page.

--- ass:labs-2025:05:tasks:02 [2026/07/14 19:04]
radu.mantu
+++ ass:labs-2025:05:tasks:02 [2026/07/17 10:11] (current)
florin.stancu
@@ Line 23: / Line 23: @@
 </note>
-Oh, and re-enable **Buildroot** if disabled for the previous lab (you backed up your ITS file, hopefully).
+Afterwards, you need to copy the new ''.dtb'' into your ''staging/'' directory and re-build the Linux uImage (using the previously provided ''staging/Makefile'').
-Then enter its ''menuconfig'' and search for ''PACKAGE_OPTEE_CLIENT''. Enable it and rebuild your rootfs!
-Afterwards, you need to copy the new ''.dtb'' into your ''staging/'' directory and [[:ass:labs-2025:02:tasks:01#task_d_-_fit_image|re-build the Linux FIT]] (e.g., ''linux.itb''). And upload it to your emmc (use u-boot's ''ums'' and simply copy the file on the FAT32 boot partition).
+As for the userspace (rootfs), there are two choices: either **Debian** or **Buildroot** (disable RAUC nevertheless and use the first version of ''mk-disk-image.sh'' to upload the rootfs when ready to test, towards the end of the task).
+For Buildroot, you must use ''menuconfig'' and enable ''PACKAGE_OPTEE_CLIENT''! Built it & unpack it to the secondary ext4 disk partition (just edit the mk-disk-image script).
+For Debian, you can either cross compile the OP-TEE client or try out the ''optee-client'' package from APT (use a ''chroot'' to install from host).
 == Step 6. Building a TA ==
@@ Line 38: / Line 41: @@
 Make sure to read the examples documentation to see the make variables to set!
-<note>
+<spoiler Special Instructions for Buildroot>
 Note that, usually, you must build optee-client from source on the host machine [[https://optee.readthedocs.io/en/latest/building/gits/optee_client.html#build-instructions|the optee_client first]]. .
-But, since we're using Buildroot and have enabled it, you can find it already compiled for the target system at ''<buildroot-dir>/output/build/optee-client-<version>''.
+Since you're using Buildroot, you can find it already compiled for the target system at ''<buildroot-dir>/output/build/optee-client-<version>''.
 Touugh we need to give a ''TEEC_EXPORT'' install path when invoking the TA makefile... Use find for ''tee_client_api.h'' and see where it's found (hint: ''sysroot'')!
-</note>
+Also note that for building Buildroot-targeted applications, your classic ''aarch64-none-gnu-'' toolchain **won't work** since Buildroot uses a custom LibC by default. But, fortunately, you may find the cross compilation prefix at ''<buildroot-dir>/output/host/bin/aarch64-buildroot-linux-gnu-'' (see the difference?)!
+</spoiler>
 <note>
 As for ''TA_DEV_KIT_DIR'' of a Trusted Application, it must point to an SDK generated inside BL32 (optee_os) source directory (something like ''export-ta...'''.
 </note>
-Also note that for building Buildroot-targeted applications, your classic ''aarch64-none-gnu-'' toolchain **won't work** since Buildroot uses custom [[https://www.uclibc.org/|ucLibC]] by default. But, fortunately, you may find the cross compilation prefix at ''<buildroot-dir>/output/host/bin/aarch64-buildroot-linux-gnu-'' (see the difference?)!
 == Step 7. Signing the TA ==
@@ Line 75: / Line 78: @@
 </code>
-Do not Ctrl+C yet, leave it running and mount the newly appeared USB device in your PC/VM!
+Use ''lsblk'' to find out which is the second (ext4) partition, mount it and copy the TA files:
+<code bash>
+mount /dev/sda2 /mnt
+ls -l /mnt
+# copy them inside your home
+cp $OPTEE_FILES /mnt/root/
+</code>
 After copying the files, boot Linux.
-Now check if ''tee-supplicant'' is running... let's mount devtmpfs then start it:
+On buildroot, check if ''tee-supplicant'' is running... or start it:
 <code bash>
-mount -t devtmpfs devtmpfs /dev
+ps aux | grep tee-supplicant
 tee-supplicant -d
 </code>
-Mount the boot partition and run the TA (you might need to copy it somewhere else and ''chmod +x'')!
+Then execute the trusted application ;)
-Then execute the program ;)
 <note info>
@@ Line 94: / Line 102: @@
 </note>
-== TODO: format me ==
-```
-# mount the relevant partitions
-[user@host]$ sudo mount /dev/nbd0p1 /mnt
-[user@host]$ sudo mkdir -p /mnt/{root,var,boot}
-[user@host]$ sudo mount /dev/nbd0p5 /mnt/root
-[user@host]$ sudo mount /dev/nbd0p6 /mnt/var
-[user@host]$ sudo mount /dev/nbd0p7 /mnt/boot
-# delete the lost+found/ directories (because I don't like them)
-[user@host]$ sudo find /mnt -type d -name lost+found -delete
-# bootstrap the rootfs and install qemu-user-static for chroot
-# NOTE: mainline debootstrap is broken on CachyOS; that's why we use a submodule
-[user@host]$ sudo ./third-party/debootstrap/debootstrap \
-                --include=neovim,locales,iproute2       \
-                --arch=arm64 --foreign                  \
-                trixie /mnt
-[user@host]$ sudo cp $(which qemu-aarch64-static) /mnt/usr/bin
-# finish up debootstrap process inside chroot
-# NOTE: arch-chroot automatically mounted /proc /sys /dev inside jail
-#       you can install it via the arch-install-scripts on non-ArchLinux distros
-[user@host]$ sudo arch-chroot /mnt
-[root@jail]$ export PATH=/usr/sbin:${PATH}
-[root@jail]$ /debootstrap/debootstrap --second-stage
-[root@jail]$ passwd
-[root@jail]$ echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen
-[root@jail]$ locale-gen
-[root@jail]$ update-locale LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8
-[root@jail]$ exit
-# before unmounting, create the fstab so that /root, /var and /boot are mounted
-# after the rootfs is verified; these three are unprotected but also unimportant
-[user@host]$ cat <<EOF | sudo tee /mnt/etc/fstab
-/dev/vda5   /root             ext4  rw,relatime                    0  2
-/dev/vda6   /var              ext4  rw,relatime                    0  2
-/dev/vda7   /boot             vfat  rw,relatime                    0  2
-EOF
-# finally, do a recursive unmount of all three partitions
-[user@host]$ sudo umount -R /mnt
-```
-`