A Journey To the Secure World of OPTEE From the Non-secure World of Linux
summary
Walks through building an OP-TEE path from Linux to secure EL3, then implements an OTP efuse on K3 as a working example that uses SMC calls through TF-A to OP-TEE, mapping Linux TEE client → kernel driver → SMC → OP-TEE. Chooses a pseudo trusted application for direct hardware access, documents invoke commands (read/write/lock), debugs with JTAG/OpenOCD and XDS110, and actually programs efuse bits (test burns done, readback shows expected values), noting tradeoffs and load/latency differences between SMC yielding vs fast.
AI-written summary · about
chapters (9)
- 0:00OPTEE and TrustZone intro
- 3:09ARM TrustZone for security
- 7:22OPTEE core features
- 10:53Pseudo TAs vs User Mode TAs
- 15:49OPTEE architecture components
- 16:53Linux to OPTEE control flow
- 24:19OPTEE extended OTP use case
- 27:51Secure OTP writing demo
- 30:23Q&A on OPTEE testing
related talks
40mOP-TEE: When Linux Loses Control
11mOP-TEE open-source security for the mass-market
41mOP-TEE - Using TrustZone to Protect Our Own Secrets
50mUsing OP-TEE as a Cryptography Engine
48mOP-TEE: Using the ARM Trust-Zone to Control Tamper Resistant Processors
10mLightning Talk: A Trusted OS for RISC-V ? OP-TEE is a Candidate
39mHands-on OP-TEE with Andes RISC-V
30mOverview of integrating OP-TEE into HiKey620 AOSP