Last edited 5 years ago

How to build TEE for Android

This article explains how to build TEE components, except the OP-TEE drivers. The latter are part of the Linux build process and are compiled as loadable modules, please refer to How to build kernel for Android. It is intended for Distribution Package users.

The OP-TEE Security feature is composed of several parts:

For detail, you can refer to OP-TEE overview page.

1. Prerequisites[edit source]

The environment must be installed using the distribution package adapted to the selected microprocessor device. See the list of supported Android Distribution Package.

To be able to execute the following instructions, work from the distribution root directory, initialize the environment and then run lunch:

 source build/envsetup.sh
 bspsetup
 lunch aosp_<BoardId>-userdebug

2. Partition layout[edit source]

The OP-TEE OS is separated in three different partitions teeh, teed and teex to allow page management.

The OP-TEE TA (Trusted Applications) are integrated in the vendor partition.

The binaries are available in device/stm/<STM32Series>-tee/prebuilt.

3. Load the TEE sources[edit source]

By default, the OP-TEE sources are not part of the STM32MPU distribution for Android™. To load the sources, execute the following instruction:

 load_tee

The loaded sources can then be accessed at the device/stm/<STM32Series>-tee/optee_os-<STM32Series> directory.

4. Build the TEE[edit source]

After retrieving the OP-TEE sources, build them using:

 build_tee

This instruction generates an OP-TEE for every available board. To generate an OP-TEE for one board:

 build_tee --board <BoardId>

or

 build_tee --current

For more information check the instruction definitions:

 build_tee -h
Usage: build_tee [Options] [Board] [Command]

  This script builds the OP-TEE OS source

Options:
  -h/--help: print this message
  -i/--install: update prebuilt images
  -v/--version: get script version
  --verbose <level>: enable verbosity (1 or 2 depending on level of verbosity required)

Board: Optional (default = all)
  -c/--current: build only for current configuration (board and memory)
  or
  -b/--board <name>: set board name = eval or disco

Command: Optional, only one instruction is supported at a time
  clean: execute make clean on targeted module

5. Integrate the TEE[edit source]

To integrate the new OP-TEE solution within your distribution, first the prebuilt images have to be updated:

 build_tee -i

Then build the full distribution

 make -j

Finally, update the associated partitions for the device. Refer to Flashing the built image

6. Build Trusted Applications[edit source]

Customize trusted applications can be built as needed. For this purpose, the configuration fileandroid_tabuild.config located in device/stm/<STM32Series>-tee/source has to be changed.

To build trusted applications, execute:

 build_ta

This script generates every applications for all available boards. To generate an application for one board only:

 build_ta --board <BoardId>

or

 build_ta --current

For more information check the instruction definition:

 build_ta -h
Usage: build_ta [Options] [Board options]

  This script builds the trust applications (TA) source listed in android_tabuild.config file

Options:
  -h/--help: print this message
  -i/--install: update prebuilt images
  -v/--version: get script version
  --verbose <level>: enable verbosity (1 or 2 depending on level of verbosity required)

Board options:
  -c/--current: build only for current configuration (board and memory)
  or
  -b/--board <name>: set board name = eval or disco (default: all)

7. Integrate Trusted Applications[edit source]

To integrate the new trusted applications into a distribution, first update the prebuilt images:

 build_ta -i

Then update the file device.mk copying the trusted application in the /vendor/lib/optee_armtz directory.

PRODUCT_COPY_FILES += \
	device/stm/{{HighlightParam|''<STM32Series>''}}-tee/prebuilt/{{HighlightParam|''<BoardId>''}}/ta/{{HighlightParam|''<UUID>''}}.ta:$(TARGET_COPY_OUT_VENDOR)/lib/optee_armtz/{{HighlightParam|''<UUID>''}}.ta

Next build the full distribution

 make -j

Finally, update the associated partitions on the device. Refer to How to populate boards for Android