OP-TEE SPMC implementation
==========================
Introduction
------------
### OP-TEE SPMC implementation
This document describes the OP-TEE SPMC implementation. This
implementation is used to support the Trusted Services PSA SPs. The PSA
SPs are based on the Arm FF-A specifications. The OP-TEE SPMC can be
used as a reference S-EL1 implementation and the Trusted Service can be
used a reference S-EL0 SP implementations.
### FF-A
Arm Firmware Framework for Arm A-profile (FF-A) is a framework designed
to standardize the communication between the various software images.
Including the communication between the various software images in the
Secure world and Normal world. The current release of the OP-TEE SPMC is
based around the [FF-A v1.0
spec](https://developer.arm.com/documentation/den0077/latest.)
### OP-TEE
OP-TEE is an open source Trusted Execution Environment (TEE)
implementing the Arm TrustZone technology. More information can be found
at [readthedocs](https://optee.readthedocs.io/en/latest/) OP-TEE can run
both as a S-EL1 SP or as the S-EL1 SPMC. This document describes OP-TEE
as a S-El1 SPMC. The current mainline OP-TEE version can be found
[here](https://github.com/OP-TEE/optee_os)
### Trusted Services
The Trusted Services project provides a framework for developing and
deploying device Root Of Trust (RoT) services across a range of secure
processing environments such as those provided by OP-TEE and Hafnium.
More information about Trusted Service can be found at
[Trusted-Services](https://trusted-services.readthedocs.io/en/latest/)
Current Status
--------------
Currently the mainline OP-TEE SPMC is not yet fully compliant with the
FF-A V1.0 spec. It also doesn\'t support all of the Trusted Services
SPs.
### SPMC status
OP-TEE mainline SPMC FF-A status:
------------------- ---------------
SP loading Supported
SP messaging Supported
Manifest file Not Supported
Memory management Supported
Interrupts Not supported
------------------- ---------------
OP-TEE mainline SPMC FF-A messages status:
------------------------------ -------------------------
FFA\_ERROR Supported
FFA\_SUCCESS Supported
FFA\_INTERRUPT Not supported
FFA\_VERSION Supported
FFA\_FEATURES Supported
FFA\_RX\_RELEASE Supported
FFA\_RXTX\_MAP Supported
FFA\_RXTX\_UNMAP Supported
FFA\_PARTITION\_INFO\_GET Supported
FFA\_ID\_GET Supported
FFA\_MSG\_WAIT Supported
FFA\_YIELD Not supported
FFA\_RUN Not supported
FFA\_NORMAL\_WORLD\_RESUME Not supported
FFA\_MSG\_SEND Not supported
FFA\_MSG\_SEND\_DIRECT\_REQ Supported
FFA\_MSG\_SEND\_DIRECT\_RESP Supported
FFA\_MSG\_POLL Not supported
FFA\_MEM\_DONATE Not supported
FFA\_MEM\_LEND Not supported
FFA\_MEM\_SHARE Partially supported[^1]
FFA\_MEM\_RETRIEVE\_REQ Supported
FFA\_MEM\_RETRIEVE\_RESP Supported
FFA\_MEM\_RELINQUISH Supported
FFA\_MEM\_RECLAIM Supported
------------------------------ -------------------------
### Trusted Service status
Currently not all Trusted Service functionality is supported when using
the OP-TEE SPMC. We are planning to support all functionality over time.
Currently the OP-TEE SPMC supports the following PSA Trusted Services
SPs:
--------------------------- --------------------------------------------------------------------
internal-trusted-storage: Supported
protected-storage: Supported
crypto: Supported with mock backend. A hardware trngs is not yet supported
attestation: Not yet supported
smm-gateway: Not yet supported
--------------------------- --------------------------------------------------------------------
Build
-----
The build process is based around the [OP-TEE build
process](https://optee.readthedocs.io/en/latest/building/gits/build.html)
with some extra steps.
### Requirements:
- The Trusted Services project has some extra
[requirements](https://trusted-services.readthedocs.io/en/latest/developer/software-requirements.html)
from OP-TEE. It mainly depends on cmake.
- The current system uses the Arm FVP to run the test environment. The
latest version can be found at
[developer.arm.com](https://developer.arm.com/-/media/Files/downloads/ecosystem-models/FVP_Base_RevC-2xAEMvA_11.16_16.tgz)
The default path for FVP in the build scripts is set to
/opt/fvp/latest
### Build steps
Get the manifest file:
rm -rf optee_test
mkdir optee_test
cd optee_test
repo init -u https://review.trustedfirmware.org/OP-TEE/manifest -m psa-sp-fvp.xml -b refs/changes/91/10991/30
repo sync -j4 --no-clone-bundle
Build the OP-TEE image:
The OP-TEE build will default be configure to use mainline OP-TEE SPMC.
To be able to build OP-TEE mainline version, it might be needed to
change the SPMC\_VERSION to SPMC\_VERSION=github in build/fvp\_ffa.mk.
Build OP-TEE:
cd build
make toolchains
make
cd ..
Build TS apps:
make -C trusted-services/tools/b-test r-ts-service-test-arm-linux
cp -r trusted-services/tools/b-test/install/arm-linux/bin/ts-service-test shared
make -C trusted-services/tools/b-test r-libts-arm-linux
cp -r trusted-services/tools/b-test/install/arm-linux/lib/libts.so.1.0.0 shared/libts.so.1
More info about building TS-apps can be found at the [Trusted Services
build
instructions](https://trusted-services.readthedocs.io/en/latest/developer/build-instructions.html)
Run fvp:
cd build
make run
Set up the [fvp
environment](https://trusted-services.readthedocs.io/en/latest/environments/deployment-guides/fvp-deployment-guide.html?highlight=ts-service-test#deploying-service-level-tests):
cd /mnt/
sh load_module.sh
cp libts.so.1 /usr/lib/.
Run the PSA ServiceTests:
./ts-service-test -v -sg ItsServiceTests
./ts-service-test -v -sg PsServiceTests
./ts-service-test -v -sg CryptoKeyDerivationServicePackedcTests
./ts-service-test -v -sg CryptoMacServicePackedcTests
./ts-service-test -v -sg CryptoCipherServicePackedcTests
./ts-service-test -v -sg CryptoHashServicePackedcTests
./ts-service-test -v -sg CryptoServiceProtobufTests
./ts-service-test -v -sg CryptoServiceLimitTests
./ts-service-test -v -sg DiscoveryServiceTests
./ts-service-test -v -sg CryptoServicePackedcTests
Currently the attestation and fail due the lack of the attestation SP
support.
[^1]: Device memory is not yet supported.