1# OP-TEE Trusted OS 2## Contents 31. [Introduction](#1-introduction) 42. [License](#2-license) 53. [Platforms supported](#3-platforms-supported) 6 3. [Development board for community user] (#31-development-board-for-community-user) 74. [Get and build OP-TEE software](#4-get-and-build-op-tee-software) 8 4. [Prerequisites](#41-prerequisites) 9 4. [Basic setup](#42-basic-setup) 10 4. [STMicroelectronics boards](#44-stmicroelectronics-boards) 11 4. [Allwinner A80](#45-allwinner-a80) 12 4. [Freescale MX6UL EVK](#46-freescale-mx6ul-evk) 135. [repo manifests](#5-repo-manifests) 14 5. [Install repo](#51-install-repo) 15 5. [Get the source code](#52-get-the-source-code) 16 5. [Targets](#521-targets) 17 5. [Branches](#522-branches) 18 5. [Get the toolchains](#523-get-the-toolchains) 19 5. [QEMU](#53-qemu) 20 5. [FVP](#54-fvp) 21 5. [HiKey](#55-hikey) 22 5. [MT8173-EVB](#56-mt8173-evb) 23 5. [Juno](#57-juno) 24 5. [Update flash and its layout](#571-update-flash-and-its-layout) 25 5. [GlobalPlatform testsuite support](#572-globalplatform-testsuite-support) 26 5. [GCC5 support](#573-gcc5-support) 27 5. [Tips and tricks](#58-tips-and-tricks) 28 5. [Reference existing project to speed up repo sync](#581-reference-existing-project-to-speed-up-repo-sync) 29 5. [Use ccache](#582-use-ccache) 306. [Load driver, tee-supplicant and run xtest](#6-load-driver-tee-supplicant-and-run-xtest) 317. [Coding standards](#7-coding-standards) 32 7. [checkpatch](#71-checkpatch) 33 34# 1. Introduction 35The `optee_os git`, contains the source code for the TEE in Linux using the 36ARM® TrustZone® technology. This component meets the GlobalPlatform 37TEE System Architecture specification. It also provides the TEE Internal core API 38v1.1 as defined by the GlobalPlatform TEE Standard for the development of 39Trusted Applications. For a general overview of OP-TEE and to find out how to 40contribute, please see the [Notice.md](Notice.md) file. 41 42The Trusted OS is accessible from the Rich OS (Linux) using the 43[GlobalPlatform TEE Client API Specification v1.0](http://www.globalplatform.org/specificationsdevice.asp), 44which also is used to trigger secure execution of applications within the TEE. 45 46--- 47## 2. License 48The software is distributed mostly under the 49[BSD 2-Clause](http://opensource.org/licenses/BSD-2-Clause) open source 50license, apart from some files in the `optee_os/lib/libutils` directory 51which are distributed under the 52[BSD 3-Clause](http://opensource.org/licenses/BSD-3-Clause) or public domain 53licenses. 54 55--- 56## 3. Platforms supported 57Several platforms are supported. In order to manage slight differences 58between platforms, a `PLATFORM_FLAVOR` flag has been introduced. 59The `PLATFORM` and `PLATFORM_FLAVOR` flags define the whole configuration 60for a chip the where the Trusted OS runs. Note that there is also a 61composite form which makes it possible to append `PLATFORM_FLAVOR` directly, 62by adding a dash in-between the names. The composite form is shown below 63for the different boards. For more specific details about build flags etc, 64please read the file [build_system.md](documentation/build_system.md). Some 65platforms have different sub-maintainers, please refer to the file 66[MAINTAINERS.md](MAINTAINERS.md) for contact details for various platforms. 67 68<!-- Please keep this list sorted in alphabetic order --> 69| Platform | Composite PLATFORM flag | Publicly available? | 70|----------|-------------------------|---------------------| 71| [Allwinner A80 Board](http://www.allwinnertech.com/en/clq/processora/A80.html)|`PLATFORM=sunxi`| No | 72| [ARM Juno Board](http://www.arm.com/products/tools/development-boards/versatile-express/juno-arm-development-platform.php) |`PLATFORM=vexpress-juno`| Yes | 73| [FSL ls1021a](http://www.freescale.com/tools/embedded-software-and-tools/hardware-development-tools/tower-development-boards/mcu-and-processor-modules/powerquicc-and-qoriq-modules/qoriq-ls1021a-tower-system-module:TWR-LS1021A?lang_cd=en)|`PLATFORM=ls-ls1021atwr`| Yes | 74| [FSL i.MX6 UltraLite EVK Board](http://www.freescale.com/products/arm-processors/i.mx-applications-processors-based-on-arm-cores/i.mx-6-processors/i.mx6qp/i.mx6ultralite-evaluation-kit:MCIMX6UL-EVK) |`PLATFORM=imx`| Yes | 75| [ARM Foundation FVP](http://www.arm.com/fvp) |`PLATFORM=vexpress-fvp`| Yes | 76| [HiKey Board (HiSilicon Kirin 620)](https://www.96boards.org/products/hikey)|`PLATFORM=hikey`| Yes | 77| [MediaTek MT8173 EVB Board](http://www.mediatek.com/en/products/mobile-communications/tablet/mt8173)|`PLATFORM=mediatek-mt8173`| No | 78| [QEMU](http://wiki.qemu.org/Main_Page) |`PLATFORM=vexpress-qemu_virt`| Yes | 79| [QEMUv8](http://wiki.qemu.org/Main_Page) |`PLATFORM=vexpress-qemu_armv8a`| Yes | 80| [STMicroelectronics b2120 - h310 / h410](http://www.st.com/web/en/catalog/mmc/FM131/SC999/SS1628/PF258776) |`PLATFORM=stm-cannes`| No | 81| [STMicroelectronics b2020-h416](http://www.st.com/web/catalog/mmc/FM131/SC999/SS1633/PF253155?sc=internet/imag_video/product/253155.jsp)|`PLATFORM=stm-orly2`| No | 82| [Texas Instruments DRA7xx](http://www.ti.com/product/DRA746)|`PLATFORM=ti-dra7xx`| Yes | 83| [Xilinx Zynq UltraScale+ MPSOC](http://www.xilinx.com/products/silicon-devices/soc/zynq-ultrascale-mpsoc.html)|`PLATFORM=zynqmp-zcu102`| Yes | 84| [Spreadtrum SC9860](http://www.spreadtrum.com/en/SC9860GV.html)|`PLATFORM=sprd-sc9860`| No | 85 86### 3.1 Development board for community user 87For community users, we suggest using [HiKey board](https://www.96boards.org/products/ce/hikey/) 88as development board. It provides detailed documentation including chip 89datasheet, board schematics, source code, binaries etc on the download link at 90the website. 91 92--- 93## 4. Get and build OP-TEE software 94There are a couple of different build options depending on the target you are 95going to use. If you just want to get the software and compile it, then you 96should follow the instructions under the "Basic setup" below. In case you are 97going to run for a certain hardware or FVP, QEMU for example, then please follow 98the respective section found below instead, having that said, we are moving from 99the shell script based setups to instead use 100[repo](https://source.android.com/source/downloading.html), so for some targets 101you will see that we are using repo ([section 5](#5-repo-manifests)) and for 102others we are still using the shell script based setup 103([section 4](#4-get-and-build-op-tee-software)), please see this transitions as 104work in progress. 105 106--- 107### 4.1 Prerequisites 108We believe that you can use any Linux distribution to build OP-TEE, but as 109maintainers of OP-TEE we are mainly using Ubuntu-based distributions and to be 110able to build and run OP-TEE there are a few packages that needs to be installed 111to start with. Therefore install the following packages regardless of what 112target you will use in the end. 113``` 114$ sudo apt-get install android-tools-adb android-tools-fastboot autoconf bison \ 115 cscope curl flex gdisk libc6:i386 libfdt-dev \ 116 libglib2.0-dev libpixman-1-dev libstdc++6:i386 \ 117 libz1:i386 netcat python-crypto python-serial \ 118 python-wand uuid-dev xdg-utils xz-utils zlib1g-dev \ 119 mtools 120``` 121 122--- 123### 4.2 Basic setup 124#### 4.2.1 Get the compiler 125We strive to use the latest available compiler from Linaro. Start by downloading 126and unpacking the compiler. Then export the `PATH` to the compilers `bin` 127folder. Beware that we are using a couple of different toolchains depending on 128the target device. This includes both 64- and 32-bit toolchains. For the exact 129toolchain in use, please have a look at [toolchain.mk](https://github.com/OP-TEE/build/blob/master/toolchain.mk) 130and then look at the targets makefile (see [build.git](https://github.com/OP-TEE/build)) 131to find out where the respective toolchain will be used. For example in the 132[QEMU makefile](https://github.com/OP-TEE/build/blob/master/qemu.mk#L12-L15) you 133will see: 134``` 135CROSS_COMPILE_NS_USER ?= "$(CCACHE)$(AARCH32_CROSS_COMPILE)" 136CROSS_COMPILE_NS_KERNEL ?= "$(CCACHE)$(AARCH32_CROSS_COMPILE)" 137CROSS_COMPILE_S_USER ?= "$(CCACHE)$(AARCH32_CROSS_COMPILE)" 138CROSS_COMPILE_S_KERNEL ?= "$(CCACHE)$(AARCH32_CROSS_COMPILE)" 139``` 140 141However, if you only want to compile optee_os, then you can do like this: 142``` 143$ cd $HOME 144$ mkdir toolchains 145$ cd toolchains 146$ wget http://releases.linaro.org/14.08/components/toolchain/binaries/gcc-linaro-arm-linux-gnueabihf-4.9-2014.08_linux.tar.xz 147$ tar xvf gcc-linaro-arm-linux-gnueabihf-4.9-2014.08_linux.tar.xz 148$ export PATH=$HOME/toolchains/gcc-linaro-arm-linux-gnueabihf-4.9-2014.08_linux/bin:$PATH 149``` 150 151#### 4.2.2 Download the source code 152``` 153$ cd $HOME 154$ mkdir devel 155$ cd devel 156$ git clone https://github.com/OP-TEE/optee_os.git 157``` 158 159#### 4.2.3 Build 160``` 161$ cd $HOME/devel/optee_os 162$ CROSS_COMPILE=arm-linux-gnueabihf- make 163``` 164 165#### 4.2.4 Compiler flags 166To be able to see the full command when building you could build using 167following flag: 168``` 169$ make V=1 170``` 171 172To enable debug builds use the following flag: 173``` 174$ make DEBUG=1 175``` 176 177OP-TEE supports a couple of different levels of debug prints for both TEE core 178itself and for the Trusted Applications. The level ranges from 1 to 4, where 179four is the most verbose. To set the level you use the following flag: 180``` 181$ make CFG_TEE_CORE_LOG_LEVEL=4 182``` 183 184--- 185### 4.4 STMicroelectronics boards 186Currently OP-TEE is supported on Orly-2 (`b2020-h416`) and Cannes family 187(`b2120` both `h310` and `h410` chip). 188 189#### 4.4.1 Get the compiler for Orly-2 190Will be written soon. 191 192#### 4.4.2 Download the source code 193See section "4.2.2 Download the source code". 194 195#### 4.4.3 Build for Orly-2 196For Orly-2 do as follows 197``` 198$ PLATFORM=stm-orly2 CROSS_COMPILE=arm-linux-gnueabihf- make 199``` 200 201For Cannes family do as follows 202``` 203$ PLATFORM=stm-cannes CROSS_COMPILE=arm-linux-gnueabihf- make 204``` 205 206#### 4.4.4 Prepare and install the images 207Will be written soon. 208 209#### 4.4.5 Boot and run the software 210<!-- All magic with STM and so on must be stated here. --> 211Will be written soon. 212 213--- 214### 4.5 Allwinner A80 215 216#### 4.5.1 Locked versus unlocked A80 boards 217**Important!** All A80 boards sold to the general public are boards where secure 218side has been locked down, which means that you **cannot** use them for secure 219side development, i.e, it will not be possible to put OP-TEE on those devices. 220If you want to use A80 board for secure side development, then you will need to 221talk to 222[Allwinner](https://github.com/OP-TEE/optee_os/blob/master/MAINTAINERS.md) 223directly and ask if it is possible get a device from them. 224 225#### 4.5.2 Get the compiler and source 226Follow the instructions in the "4.2 Basic setup". 227 228#### 4.5.3 Build 229``` 230$ cd optee_os 231$ export PLATFORM=sunxi 232$ export CROSS_COMPILE=arm-linux-gnueabihf- 233$ make 234``` 235 236#### 4.5.4 Prepare the images to run on A80 Board 237 238Download Allwinner A80 platform SDK, the SDK refers to Allwinner A80 platform 239SDK root directory. A80 SDK directory tree looks like this: 240``` 241SDK/ 242 Android 243 lichee 244``` 245`Android` contains all source code related to Android and `lichee` 246contains the bootloader and Linux kernel. 247 248##### 4.5.4.1 Copy OP-TEE output to package directory 249Copy the OP-TEE output binary to `SDK/lichee/tools/pack/sun9i/bin` 250 251``` 252$ cd optee_os 253$ cp ./out/arm32-plat-sunxi/core/tee.bin SDK/lichee/tools/pack/sun9i/bin 254``` 255 256##### 4.5.4.2 Build Linux kernel 257In the `lichee` directory, run the following commands: 258``` 259$ cd SDK/lichee 260$ ./build.sh 261``` 262 263##### 4.5.4.3 Build Android 264In the Android directory, run the following commands: 265``` 266$ cd SDK/android 267$ extract-bsp 268$ make -j 269``` 270 271##### 4.5.4.4 Create the Android image 272In the Android directory, run the following commands: 273``` 274$ cd SDK/android 275$ pack 276``` 277The output image will been signed internally when packed. The output image name 278is `a80_android_board.img`. 279 280##### 4.5.4.5 Download the Android image 281Use `Allwinner PhoenixSuit` tool to download to A80 board. 282Choose the output image(`a80_android_board.img`), select download and wait 283for the download to complete. 284 285#### 4.5.5 Boot and run the software on A80 Board 286When the host platform is Windows, use a console application to connect A80 287board `uart0`. In the console window, You can install OP-TEE linux kernel 288driver `optee.ko`, load OP-TEE-Client daemon `tee-supplicant` and run 289the example "hello world" Trusted Application, do this by running: 290``` 291$ insmod /system/vendor/modules/optee.ko 292$ /system/bin/tee-supplicant & 293$ /system/bin/tee-helloworld 294``` 295 296--- 297### 4.6 Freescale MX6UL EVK 298 299Get U-Boot source: 300https://github.com/MrVan/uboot/commit/4f016adae573aaadd7bf6a37f8c58a882b391ae6 301 302Build U-Boot: 303``` 304 make ARCH=arm mx6ul_14x14_evk_optee_defconfig 305 make ARCH=arm 306 Burn u-boot.imx to offset 0x400 of SD card 307``` 308 309Get Kernel source: https://github.com/linaro-swg/linux/tree/optee 310 311Patch kernel: 312```c 313 diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dts b/arch/arm/boot/dts/imx6ul-14x14-evk.dts 314 index 6aaa5ec..2ac9c80 100644 315 --- a/arch/arm/boot/dts/imx6ul-14x14-evk.dts 316 +++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dts 317 @@ -23,6 +23,13 @@ 318 reg = <0x80000000 0x20000000>; 319 }; 320 321 + firmware { 322 + optee { 323 + compatible = "linaro,optee-tz"; 324 + method = "smc"; 325 + }; 326 + }; 327 + 328 regulators { 329 compatible = "simple-bus"; 330 #address-cells = <1>; 331``` 332 333Compile the Kernel: 334 335``` 336make ARCH=arm imx_v6_v7_defconfig 337make menuconfig 338select the two entries 339 CONFIG_TEE=y 340 CONFIG_OPTEE 341make ARCH=arm 342``` 343Copy zImage and imx6ul_14x14_evk.dtb to SD card. 344 345OPTEE OS Build: 346``` 347 PLATFORM_FLAVOR=mx6ulevk make PLATFORM=imx 348 ${CROSS_COMPILE}-objcopy -O binary out/arm-plat-imx/core/tee.elf optee.bin 349 copy optee.bin to the first partition of SD card which is used for boot. 350``` 351 352Run using U-Boot: 353``` 354 run loadfdt; 355 run loadimage; 356 fatload mmc 1:1 0x9c100000 optee.bin; 357 run mmcargs; 358 bootz ${loadaddr} - ${fdt_addr}; 359``` 360 361Note: 362 CAAM is not implemented now, this will be added later. 363 364More steps: http://mrvan.github.io/optee-imx6ul 365 366--- 367## 5. repo manifests 368 369A Git repository is available at https://github.com/OP-TEE/manifest where you 370will find XML-files for use with the Android 'repo' tool. 371 372### 5.1. Install repo 373Follow the instructions under the "Installing Repo" section 374[here](https://source.android.com/source/downloading.html). 375 376### 5.2. Get the source code 377First ensure that you have the necessary Ubuntu packages installed, see [4.1 378Prerequisites](#41-prerequisites) (this is the only important step from section 3794 in case you are setting up any of the target devices mentioned below). 380 381``` 382$ mkdir -p $HOME/devel/optee 383$ cd $HOME/devel/optee 384$ repo init -u https://github.com/OP-TEE/manifest.git -m ${TARGET}.xml [-b ${BRANCH}] 385$ repo sync 386``` 387**Notes**<br> 388* The folder could be at any location, we are just giving a suggestion by 389 saying `$HOME/devel/optee`. 390* `repo sync` can take an additional parameter -j to sync multiple remotes. For 391 example `repo sync -j3` will sync three remotes in parallel. 392 393#### 5.2.1 Targets 394| Target | Latest | Stable | 395|--------|--------|--------| 396| QEMU | `default.xml` | `default_stable.xml` | 397| QEMUv8 | `qemu_v8.xml` | `Not available` | 398| FVP | `fvp.xml` | `fvp_stable.xml` | 399| HiKey | `hikey.xml` | `hikey_stable.xml` | 400| HiKey Debian (experimental) | `hikey_debian.xml` | Not available | 401| MediaTek MT8173 EVB Board | `mt8173-evb.xml` | `mt8173-evb_stable.xml` | 402| ARM Juno board| `juno.xml` | `juno_stable.xml` | 403 404#### 5.2.2 Branches 405Currently we are only using one branch, i.e, the `master` branch. 406 407#### 5.2.3 Get the toolchains 408This is a one time thing you run only once after getting all the source code 409using repo. 410``` 411$ cd build 412$ make toolchains 413``` 414 415##### Note : 416If you have been using GCC4.9 and are upgrading to GCC5 via [this commit] (https://github.com/OP-TEE/build/commit/69a8a37bc417d28d62ae57e7ca2a8df4bdec93c8), please make sure that you delete the `toolchains` directory before running `make toolchains` again, or else the toolchain binaries can get mixed up or corrupted, and generate errors during builds. 417 418--- 419### 5.3. QEMU 420After getting the source and toolchain, just run (from the `build` folder) 421``` 422$ make all run 423``` 424and everything should compile and at the end QEMU should start. 425 426--- 427### 5.4. FVP 428After getting the source and toolchain you must also obtain Foundation Model 429([link](http://www.arm.com/products/tools/models/fast-models/foundation-model.php)) 430binaries and untar it to the forest root, then just run (from the `build` folder) 431 432``` 433$ make all run 434``` 435and everything should compile and at the end FVP should start. 436 437--- 438### 5.5. HiKey 439#### 5.5.1 Initramfs based 440After getting the source and toolchain, just run (from the `build` folder) 441``` 442$ make all 443``` 444 445After that connect the board and flash the binaries by running: 446``` 447$ make flash 448``` 449 450(more information about how to flash individual binaries could be found 451[here](https://github.com/96boards/documentation/wiki/HiKeyUEFI#flash-binaries-to-emmc-)) 452 453The board is ready to be booted. 454#### 5.5.2 Debian based / 96boards RPB (experimental) 455Start by getting the source and toolchain (see above), then continue by 456downloading the system image (root fs). Note that this step is something you 457only should do once. 458 459``` 460$ make system-img 461``` 462 463Which should be followed by 464``` 465$ make all 466``` 467 468When everything has been built, flash the files to the device: 469``` 470$ make flash 471``` 472 473Now you can boot up the device, note that OP-TEE normal world binaries still 474hasn't been put on the device at this stage. So by now you're basically booting 475up an RPB build. When you have a prompt, the next step is to connect the device 476to the network. WiFi is preferable, since HiKey has no Ethernet jack. Easiest is 477to edit `/etc/network/interfaces`. To find out what to add, run: 478``` 479$ make help 480``` 481 482When that's been added, reboot and when you have a prompt again, you're ready to 483push the OP-TEE client binaries and the kernel with OP-TEE support. First find 484out the IP for your device (`ifconfig`). Then send the files to HiKey by 485running: 486``` 487$ IP=111.222.333.444 make send 488 489Credentials for the image are: 490username: linaro 491password: linaro 492``` 493 494When the files has been transfered, please follow the commands from the `make 495send` command which will install the debian packages on the device. Typically it 496tells you to run something like this on the device itself: 497``` 498$ dpkg --force-all -i /tmp/out/optee_2.0-1.deb 499$ dpkg --force-all -i /tmp/linux-image-*.deb 500``` 501 502Now you are ready to use OP-TEE on HiKey using Debian, please goto step 6 below 503to continue. 504 505##### Good to know 506Just want to update secure side? Put the device in fastboot mode and 507``` 508$ make arm-tf 509$ make flash-fip 510 511``` 512 513Just want to update OP-TEE client software? Put the device in fastboot mode and 514``` 515$ make optee-client 516$ make xtest 517``` 518 519Boot up the device and follow the instructions from make send 520``` 521$ IP=111.222.333.444 make send 522``` 523 524--- 525### 5.6. MT8173-EVB 526After getting the source and toolchain, just run (from the `build` folder) 527 528``` 529$ make all run 530``` 531 532When `< waiting for device >` prompt appears, press reset button and the 533flashing procedure should begin. 534 535--- 536### 5.7 Juno 537After getting the source and toolchain, just run (from the `build` folder) 538``` 539$ make all 540``` 541 542Enter the firmware console on the juno board and press enter to stop 543the auto boot flow 544``` 545ARM V2M_Juno Firmware v1.3.9 546Build Date: Nov 11 2015 547 548Time : 12:50:45 549Date : 29:03:2016 550 551Press Enter to stop auto boot... 552 553``` 554Enable ftp at the firmware prompt 555``` 556Cmd> ftp_on 557Enabling ftp server... 558 MAC address: xxxxxxxxxxxx 559 560 IP address: 192.168.1.158 561 562 Local host name = V2M-JUNO-A2 563``` 564 565Flash the binary by running (note the IP address from above): 566``` 567make JUNO_IP=192.168.1.158 flash 568``` 569 570Once the binaries are transferred, reboot the board: 571``` 572Cmd> reboot 573 574``` 575 576#### 5.7.1 Update flash and its layout 577The flash in the board may need to be updated for the flashing above to 578work. If the flashing fails or if ARM-TF refuses to boot due to wrong 579version of the SCP binary the flash needs to be updated. To update the 580flash please follow the instructions at [Using Linaro's deliverable on 581Juno](https://community.arm.com/docs/DOC-10804) selecting one of the zips 582under "4.1 Prebuilt configurations" flashing it as described under "5. 583Running the software". 584 585#### 5.7.2 GlobalPlatform testsuite support 586##### Warning : 587Depending on the Juno pre-built configuration, the built ramdisk.img 588size with GlobalPlatform testsuite may exceed its pre-defined Juno flash 589memory reserved location (image.txt file). 590In that case, you will need to extend the Juno flash block size reserved 591location for the ramdisk.img in the image.txt file accordingly and 592follow the instructions under "5.7.1 Update flash and its layout". 593 594##### Example with juno-latest-busybox-uboot.zip: 595The current ramdisk.img size with GlobalPlatform testsuite 596is 8.6 MBytes. 597 598###### Updated file is /JUNO/SITE1/HBI0262B/images.txt (limited to 8.3 MB) 599``` 600NOR4UPDATE: AUTO ;Image Update:NONE/AUTO/FORCE 601NOR4ADDRESS: 0x01800000 ;Image Flash Address 602NOR4FILE: \SOFTWARE\ramdisk.img ;Image File Name 603NOR4NAME: ramdisk.img 604NOR4LOAD: 00000000 ;Image Load Address 605NOR4ENTRY: 00000000 ;Image Entry Point 606``` 607 608###### Extended to 16MB 609``` 610NOR4UPDATE: AUTO ;Image Update:NONE/AUTO/FORCE 611NOR4ADDRESS: 0x01000000 ;Image Flash Address 612NOR4FILE: \SOFTWARE\ramdisk.img ;Image File Name 613NOR4NAME: ramdisk.img 614NOR4LOAD: 00000000 ;Image Load Address 615NOR4ENTRY: 00000000 ;Image Entry Point 616``` 617 618#### 5.7.3 GCC5 support 619##### Note : 620In case you are using the **Latest version** of the ARM Juno board (this is 621`juno.xml` manifest), the built `ramdisk.img` size with GCC5 compiler, at 622the moment, exceeds its pre-defined Juno flash memory reserved location 623(`image.txt` file). 624 625To solve this problem you will need to extend the Juno flash block size 626reserved location for the `ramdisk.img` and decrease the size for other 627images in the `image.txt` file accordingly and then follow the instructions 628under "5.7.1 Update flash and its layout". 629 630##### Example with juno-latest-busybox-uboot.zip: 631The current `ramdisk.img` size with GCC5 compiler is 29.15 MBytes we will 632extend it to 32 MBytes. The only changes that you need to do are those in 633**bold** 634 635###### File to update is /JUNO/SITE1/HBI0262B/images.txt 636<pre> 637NOR2UPDATE: AUTO ;Image Update:NONE/AUTO/FORCE 638NOR2ADDRESS: <b>0x00100000</b> ;Image Flash Address 639NOR2FILE: \SOFTWARE\Image ;Image File Name 640NOR2NAME: norkern ;Rename kernel to norkern 641NOR2LOAD: 00000000 ;Image Load Address 642NOR2ENTRY: 00000000 ;Image Entry Point 643 644NOR3UPDATE: AUTO ;Image Update:NONE/AUTO/FORCE 645NOR3ADDRESS: <b>0x02C00000</b> ;Image Flash Address 646NOR3FILE: \SOFTWARE\juno.dtb ;Image File Name 647NOR3NAME: board.dtb ;Specify target filename to preserve file extension 648NOR3LOAD: 00000000 ;Image Load Address 649NOR3ENTRY: 00000000 ;Image Entry Point 650 651NOR4UPDATE: AUTO ;Image Update:NONE/AUTO/FORCE 652NOR4ADDRESS: <b>0x00D00000</b> ;Image Flash Address 653NOR4FILE: \SOFTWARE\ramdisk.img ;Image File Name 654NOR4NAME: ramdisk.img 655NOR4LOAD: 00000000 ;Image Load Address 656NOR4ENTRY: 00000000 ;Image Entry Point 657 658NOR5UPDATE: AUTO ;Image Update:NONE/AUTO/FORCE 659NOR5ADDRESS: <b>0x02D00000</b> ;Image Flash Address 660NOR5FILE: \SOFTWARE\hdlcdclk.dat ;Image File Name 661NOR5LOAD: 00000000 ;Image Load Address 662NOR5ENTRY: 00000000 ;Image Entry Point 663</pre> 664 665--- 666### 5.8 Tips and tricks 667#### 5.8.1 Reference existing project to speed up repo sync 668Doing a `repo init`, `repo sync` from scratch can take a fair amount of time. 669The main reason for that is simply because of the size of some of the gits we 670are using, like for the Linux kernel and EDK2. With repo you can reference an 671existing forest and by doing so you can speed up repo sync to instead taking ~20 672seconds instead of an hour. The way to do this are as follows. 673 6741. Start by setup a clean forest that you will not touch, in this example, let 675 us call that `optee-ref` and put that under for `$HOME/devel/optee-ref`. This 676 step will take roughly an hour. 6772. Then setup a cronjob (`crontab -e`) that does a `repo sync` in this folder 678 particular folder once a night (that is more than enough). 6793. Now you should setup your actual tree which you are going to use as your 680 working tree. The way to do this is almost the same as stated in the 681 instructions above, the only difference is that you reference the other local 682 forest when running `repo init`, like this 683 ``` 684 repo init -u https://github.com/OP-TEE/manifest.git --reference /home/jbech/devel/optee-ref 685 ``` 6864. The rest is the same above, but now it will only take a couple of seconds to 687 clone a forest. 688 689Normally step 1 and 2 above is something you will only do once. Also if you 690ignore step 2, then you will still get the latest from official git trees, since 691repo will also check for updates that aren't at the local reference. 692 693#### 5.8.2. Use ccache 694ccache is a tool that caches build object-files etc locally on the disc and can 695speed up build time significantly in subsequent builds. On Debian-based systems 696(Ubuntu, Mint etc) you simply install it by running: 697``` 698$ sudo apt-get install ccache 699``` 700 701The helper makefiles are configured to automatically find and use ccache if 702ccache is installed on your system, so other than having it installed you don't 703have to think about anything. 704 705--- 706## 6. Load driver, tee-supplicant and run xtest 707Since release v2.0.0 you don't have to load the kernel driver explicitly. In the 708standard configuration it will be built into the kernel directly. To actually 709run something on a device you however need to run tee-supplicant. This is the 710same for all platforms, so when a device has booted, then run 711``` 712$ tee-supplicant & 713``` 714and OP-TEE is ready to be used. 715 716In case you want to try run something that triggers both normal and secure side 717code you could run xtest (the main test suite for OP-TEE), run 718``` 719$ xtest 720``` 721 722--- 723## 7. Coding standards 724In this project we are trying to adhere to the same coding convention as used in 725the Linux kernel (see 726[CodingStyle](https://www.kernel.org/doc/Documentation/CodingStyle)). We achieve this by running 727[checkpatch](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/scripts/checkpatch.pl) 728from Linux kernel. However there are a few exceptions that we had to make since 729the code also follows GlobalPlatform standards. The exceptions are as follows: 730 731- CamelCase for GlobalPlatform types are allowed. 732- And we also exclude checking third party code that we might use in this 733 project, such as LibTomCrypt, MPA, newlib (not in this particular git, but 734 those are also part of the complete TEE solution). The reason for excluding 735 and not fixing third party code is because we would probably deviate too much 736 from upstream and therefore it would be hard to rebase against those projects 737 later on (and we don't expect that it is easy to convince other software 738 projects to change coding style). 739 740### 7.1 checkpatch 741Since checkpatch is licensed under the terms of GNU GPL License Version 2, we 742cannot include this script directly into this project. Therefore we have 743written the Makefile so you need to explicitly point to the script by exporting 744an environment variable, namely CHECKPATCH. So, suppose that the source code for 745the Linux kernel is at `$HOME/devel/linux`, then you have to export like follows: 746 747 $ export CHECKPATCH=$HOME/devel/linux/scripts/checkpatch.pl 748thereafter it should be possible to use one of the different checkpatch targets 749in the [Makefile](Makefile). There are targets for checking all files, checking 750against latest commit, against a certain base-commit etc. For the details, read 751the [Makefile](Makefile). 752