README.md
1
2# tee_tee_dev_kit #
3
4## Introduction ##
5
6The TEE SDK development kit supports independent development of TA, including TA dependent header files, compilation frameworks, signature scripts, etc.
7
8| Abbreviations | English | Chinese|
9| ------ | ----------------------------- | ------------ |
10| TEE | Trusted Execution Environment | Trusted Execution Environment|
11| TA | Trusted Application | Trusted Application|
12| SDK | Software Development Kit | Software Development Kit|
13
14## Table of Contents<a name="section161941989596"></a>
15
16The directory structure of TEE SDK is as follows:
17
18```
19├── sdk/build
20│ ├── ld
21│ ├── mk
22│ ├── signkey
23│ └── tools
24├── sysroot
25│ └── usr
26| └── include
27├── sdk/src
28│ └── TA
29| └── sample
30├── thirdparty
31│ └── open_source
32│ └── import_open_source_header.sh
33└── CHANGELOG
34```
35
36## Instructions for use<a name="section161941989597"></a>
37
38Developers need to do some preparation work before using the TEE SDK development kit to develop TA.
39
40### Configure the compilation toolchain
41
42The compilation toolchain used by TEE is LLVM, which is consistent with OpenHarmony. Developers need to download the OpenHarmony compilation toolchain first.
43
44First choice to download OpenHarmony [build code repository]（ https://gitee.com/openharmony/build )
45
46```
47git clone git@gitee.com : openharmony/build.git
48```
49
50Then execute the download script in the repository
51
52```
53./build/prebuilts_download.sh
54```
55
56After downloading, it is necessary to declare the path of the LLVM compilation toolchain in the current compilation environment. The compilation toolchain path can be declared using the following command:
57
58```
59export PATH=openharmony/prebuilts/clang/ohos/linux-x86_64/15.0.4/llvm/bin:$PATH
60```
61
62This command is only an example, developers need to specify the correct compilation toolchain path.
63
64### Import third-party header files
65
66TEE integrates the Musl library and security function library, which TA can use. The TEE SDK does not include header files for the musl library and security function library by default, but provides import scripts. Developers need to download the [musl library] first（ https://gitee.com/openharmony/third_party_musl ）And [Security Function Library]（ https://gitee.com/openharmony/third_party_bounds_checking_function ）Source code repository:
67
68```
69git clone git@gitee.com : openharmony/third_party_musl.git
70git clone git@gitee.com : openharmony/third_party_bounds_checking_function.git
71```
72
73Then execute
74
75```
76./tee_dev_kit/sdk/thirdparty/open_source/import_open_source_header.sh
77```
78
79Import the musl header file and security function library header file from the source code repository into the TEE SDK.
80
81### Replace TA signature and verification key
82
83The TEE SDK has a preset private key for signing TA files, which can only be used for debugging. In the commercial version, developers need to replace this private key themselves. The private key path: tee_dev_kit/sdk/build/signkey/ta_sign_priv_key.pem。 At the same time, it provides the scripts tee_dev-kit/sdk/build/signkey/ta-sign_algonfig.ini, which can be used to configure the signature algorithm. The default signature algorithm is RSA, with a key length of 4096 bits.
84
85If the developer replaces the signature private key in the TEE SDK, they need to correspondingly replace the signature verification public key in the OpenTrustee operating system. The path of the signature verification public key is:/ base/tee/tee_os_framework/lib/syslib/libelf_verify_key/src/common/ta_verify_key.c。
86
87## Tool Dependency<a name="section11914418405"></a>
88
89The TEE SDK uses Python scripts to parse TA's property configuration files, sign TA files, and perform other operations, so Python tools need to be installed in the development environment.
90
911. Install Python 3 and above versions
92
932. Install Python related libraries, such as:
94
95```
96pip install pycryptodome
97
98pip install defusedxml
99```
100
101If there is a prompt during the compilation process that other Python libraries are missing, they need to be installed together.
102
103## Use constraint<a name="section1371113476307"></a>
104
105-Supported development language: C language
106-SDK runtime environment: Linux operating system
107-No code editor provided
108
109## TA development steps
110
111When developing a new TA, it is necessary to create a new TA source code directory in the tee_dev-kit/sdk/src/TA directory. The directory structure can refer to the demo example code in this directory. Taking helloworld_demo as an example, the directory structure is as follows:
112
113```
114├── helloworld_demo
115▽-- ta_demo. c # TA source code file
116∝ - configs.xml # TA attribute configuration file
117∝ - Makefile # TA Compile Makefile
118∝ - build_ta. sh # TA One Click Script Generation
119```
120
121### TA code writing
122
123The TA code must implement the following entry functions specified in the GP TEE standard:
124
125|TA Entry Function Name | Function Description|
126| -------------------------- | ----------------------------------------------------- |
127|TA_Create Entry Point | Constructor of TA instance, called only once in the lifecycle of each TA instance|
128|TA_SpenSessionExitPoint | Client requests to create a session with TA|
129|TA_invokeCommandEntry Point | After successfully creating a session, the client sends instructions to the TA|
130|TA_CloseSessionExitPoint | Client requests to close session with TA|
131|TA_SestroyInterpoint | The destructor of the TA instance, which OpenTrustee calls when destroying the TA instance|
132
133### TA Makefile Writing
134
135TA needs to write their own Makefile file, please refer to the example code in the SDK. There are the following key points:
136
137-The target file name generated by TA compilation is fixed as libcombine.so.
138-For 64 bit TAs, it is necessary to add the "TARGET_S_SARM64=y" tag in the Makefile header; For 32-bit TA, this tag should not be included in the Makefile.
139
140### TA attribute configuration
141
142Each TA source code directory needs to contain configs.xml, which defines the attribute information of that TA.
143
144|Attribute Name | Data Type | Attribute Description | System Default Value|
145| ------------------- | -------- | ------------------------------------------------------------ | ---------- |
146|Service_name | String | TA name, string length not exceeding 64 characters, only supports numbers and letters, '_' and '-' | None|
147|UUID | UUID | TA unique identifier | None|
148|Instance_ceep_alive | Bool | If true, it means that even if all TA sessions are closed, the TA instance will not be destroyed and the global data will still exist until the TEE runs. If false, it means that if all TA sessions are closed, the TA instance will be destroyed| false |
149|Stack_Size | Integer | The stack space size for each session of TA needs to be evaluated based on their actual situation | 8192|
150|Heapsosize | Integer | The heap space occupied by the TA instance needs to be evaluated based on its actual situation | 0|
151|Does multi-session | Bool | TA support establishing multiple sessions simultaneously | false|
152|Single_instance | Bool | Whether multiple sessions of TA belong to the same instance (currently only singleInstance is supported as true) | true|
153
154The example is as follows:
155
156```
157<ConfigInfo>
158 <TA_Basic_Info>
159 <service_name>demo-ta</service_name>
160 <uuid>e3d37f4a-f24c-48d0-8884-3bdd6c44e988</uuid>
161 </TA_Basic_Info>
162 <TA_Manifest_Info>
163 <instance_keep_alive>false</instance_keep_alive>
164 <stack_size>8192</stack_size>
165 <heap_size>81920</heap_size>
166 <multi_session>false</multi_session>
167 <single_instance>true</single_instance>
168 </TA_Manifest_Info>
169</ConfigInfo>
170```
171
172### TA compilation and signature
173
174The OpenTrustee SDK provides a one click script for TA generation, which copies tee_dev_kit/sdk/build/build_ta.sh to the TA source code directory for execution. This completes TA compilation, property configuration file parsing, signing, and other operations, and generates a TA installation package file named uuid.sec in the current directory.
175
176## Related Dependency Warehouse<a name="section1371113476308"></a>
177
178[OpenHarmony/build]( https://gitee.com/openharmony/build )
179
180[OpenHarmony/third_party/musl]( https://gitee.com/openharmony/third_party_musl )
181
182[OpenHarmony/third_party/bounds_checking_function]( https://gitee.com/openharmony/third_party_bounds_checking_function )
183