
4.6.4 Configuring OP-TEE on LS1021A-TSN platform
Use the following commands to build the images with the OP-TEE feature on the LS1021A-TSN platform.
$ cd openil
$ make clean
$ make nxp_ls1021atsn_optee-sb_defconfig
$ make
#or make with a log
$ make 2>&1 | tee build.log
The host Linux machine must have the following libraries:
•
libmagickwand-dev
for APT on Debian/Ubuntu.
•
ImageMagick-devel
for Yum on CentOS.
NOTE
The
nxp_ls1021atsn_optee-sb_defconfig
configuration file includes some default configurations for secure boot and OP-
TEE. These are listed below:
1.
ls1021atsn_sdcard_SECURE_BOOT_TEE
U-Boot configuration.
2.
kernel CONFIG_OPTEE
configuration.
3. OP-TEE OS, client, and test applications.
4.
CST tool
to create secure boot keys and headers.
The CST tool can support two special functions, which are:
1. Using custom srk.pri and srk.pub files to maintain the consistent keys. For this feature, move the custom srk.pri and srk.pub
files into the directory named
board/nxp/ls1021atsn/
. Then, the CST tool creates all the keys and header files for
secure boot based on the two files, each time. In addition, after running
gen_keys 1024
to get the
srk.pri
and
srk.pub
files
at the first instance, if there are no custom files in
board/nxp/ls1021atsn/
, the CST tool always uses the existing
srk.pri and srk.pub, until the two files are deleted.
2. Enabling/disabling the core hold-off switch for the secure boot, by using the
make menuconfig
command.
This can be done by using the following command:
Host utilities --->
[*]host cst tool
*** core hold-off ***
[*] secure boot core hold-off
After the correct building, the final SD card image named
sdcard.img
can be located at
output/images
. The keys for
secure boot that should be programmed into the silicon can be located in the file
output/images/srk.txt
.
4.6.5 Running OP-TEE on LS1021A-TSN platform
This section provides the commands for running OP-TEE on the LS1021A-TSN platform. It includes commands for secure boot,
executing OP-TEE daemon, and executing OP-TEE test cases.
4.6.5.1 Running secure boot
OP-TEE must run together with secure boot in order to protect all images to avoid being attacked. For details about secure boot,
refer to the section,
Secure Boot
in the Chapter,
Boot Loaders
freescalereach01.sdlproducts.com/LiveContent/web/pub.xql?c=t&action=home&pub=QorIQ_SDK&lang=en-US
NXP Semiconductors
Industrial features
Open Industrial User Guide, Rev. 1.8, 05/2020
User's Guide
57 / 199