openharmony_ciIntroduction to tee_tee_os_framework repository
Introduction
OpenTrustee provides a Trusted Execution Environment (TEE) that runs in a hardware isolated secure area, running simultaneously with regular operating systems such as OpenHarmony but isolated from each other. OpenTrustee has higher security than conventional operating systems and can provide protection for confidential data on devices.
OpenTrustee is a complete TEE solution that includes multiple components. The system architecture is shown in the figure below:
The tee_tee_os_framework component mainly includes the operating system framework of OpenTrustee, responsible for managing the entire lifecycle of TA (Trusted Application), processing interaction information between CA (Client Application) and TA, and managing drivers. In addition, it also provides core services such as encryption and decryption, secure storage, etc. Below are specific module introductions.
1. The specific module introduction of tee_os_framework
| Name of module | Functions |
|---|---|
| gtask | TA lifetime control, create and destroy TA process, commication manager, session manager and agent manager of CA2TA, process error information for TA |
| teesmcmgr | dispatch smc command, including CA commands, system suspend and resume command, idle state management |
| tarunner | load,analysis and relocate the elf file of TA/drivers/services |
| drvmgr | management lifetime of drivers, including the create and destroy of drivers, interface permission control, driver process rights management, drivers access control, process incorrect state of drivers |
| permission service | permission management of SEC file |
| ssa | secure storage functions |
| huk service | hardware root key access control |
| teemiscdrv | base driver, get shared information from bootloader |
| cryptomgr | the framework code of encrypt/decrypt drivers |
| TEE base API | base interfaces of TA development, including encrypt/decrypt, secure storage, secure timer and GP interface of TA2TA |
| TEE driver API | interfaces for driver develepment, including interrupt, IO and DMA |
| sample | sample code for TEE load(teeloader) and sample code for ATF-TEE adapt code(tee_atf) |
| test | tee test suit |
tee_os_framework code directories
base/tee/tee_os_framework
├── framework
│ ├── gtask
│ ├── teesmcmgr
│ ├── drvmgr
│ └── tarunner
├── lib
│ ├── drvlib # libs for drvmgr and drivers
│ ├── syslib # libs for TEE internal services
│ └── teelib # libs for TA and services
├── drivers
│ ├── tee_misc_drv
│ ├── include
│ └── crypto_mgr
├── service
│ ├── permission_service
│ ├── huk_service
│ └── ssa
├── config
│ ├── release_config # release config macros
│ └── debug_config # debug config macros
├── build
├── test
└── sample
Tee_os_framework Construction Guide
The tee_tee_os_framework and tee_tee_os_kernel work together to build TEEOS, and the commands for building them separately are as follows:
./build.sh --product-name rk3568 --build-target tee --ccache
Build the product as a TEEOS image: base/tee/tee_os_kernel/kernel/bl32.bin