1 2# tee_tee_dev_kit # 3 4## Introduction ## 5 6The TEE SDK development kit supports independent development of TA, including TA dependent header files, compilation frameworks, signature scripts, etc. 7 8| Abbreviations | English | Chinese| 9| ------ | ----------------------------- | ------------ | 10| TEE | Trusted Execution Environment | Trusted Execution Environment| 11| TA | Trusted Application | Trusted Application| 12| SDK | Software Development Kit | Software Development Kit| 13 14## Table of Contents<a name="section161941989596"></a> 15 16The directory structure of TEE SDK is as follows: 17 18``` 19├── sdk/build 20│ ├── ld 21│ ├── mk 22│ ├── signkey 23│ └── tools 24├── sysroot 25│ └── usr 26| └── include 27├── sdk/src 28│ └── TA 29| └── sample 30├── thirdparty 31│ └── open_source 32│ └── import_open_source_header.sh 33└── CHANGELOG 34``` 35 36## Instructions for use<a name="section161941989597"></a> 37 38Developers need to do some preparation work before using the TEE SDK development kit to develop TA. 39 40### Configure the compilation toolchain 41 42The compilation toolchain used by TEE is LLVM, which is consistent with OpenHarmony. Developers need to download the OpenHarmony compilation toolchain first. 43 44First choice to download OpenHarmony [build code repository]（ https://gitee.com/openharmony/build ) 45 46``` 47git clone git@gitee.com : openharmony/build.git 48``` 49 50Then execute the download script in the repository 51 52``` 53./build/prebuilts_download.sh 54``` 55 56After downloading, it is necessary to declare the path of the LLVM compilation toolchain in the current compilation environment. The compilation toolchain path can be declared using the following command: 57 58``` 59export PATH=openharmony/prebuilts/clang/ohos/linux-x86_64/15.0.4/llvm/bin:$PATH 60``` 61 62This command is only an example, developers need to specify the correct compilation toolchain path. 63 64### Import third-party header files 65 66TEE integrates the Musl library and security function library, which TA can use. The TEE SDK does not include header files for the musl library and security function library by default, but provides import scripts. Developers need to download the [musl library] first（ https://gitee.com/openharmony/third_party_musl ）And [Security Function Library]（ https://gitee.com/openharmony/third_party_bounds_checking_function ）Source code repository: 67 68``` 69git clone git@gitee.com : openharmony/third_party_musl.git 70git clone git@gitee.com : openharmony/third_party_bounds_checking_function.git 71``` 72 73Then execute 74 75``` 76./tee_dev_kit/sdk/thirdparty/open_source/import_open_source_header.sh 77``` 78 79Import the musl header file and security function library header file from the source code repository into the TEE SDK. 80 81### Replace TA signature and verification key 82 83The TEE SDK has a preset private key for signing TA files, which can only be used for debugging. In the commercial version, developers need to replace this private key themselves. The private key path: tee_dev_kit/sdk/build/signkey/ta_sign_priv_key.pem。 At the same time, it provides the scripts tee_dev-kit/sdk/build/signkey/ta-sign_algonfig.ini, which can be used to configure the signature algorithm. The default signature algorithm is RSA, with a key length of 4096 bits. 84 85If the developer replaces the signature private key in the TEE SDK, they need to correspondingly replace the signature verification public key in the OpenTrustee operating system. The path of the signature verification public key is:/ base/tee/tee_os_framework/lib/syslib/libelf_verify_key/src/common/ta_verify_key.c。 86 87## Tool Dependency<a name="section11914418405"></a> 88 89The TEE SDK uses Python scripts to parse TA's property configuration files, sign TA files, and perform other operations, so Python tools need to be installed in the development environment. 90 911. Install Python 3 and above versions 92 932. Install Python related libraries, such as: 94 95``` 96pip install pycryptodome 97 98pip install defusedxml 99``` 100 101If there is a prompt during the compilation process that other Python libraries are missing, they need to be installed together. 102 103## Use constraint<a name="section1371113476307"></a> 104 105-Supported development language: C language 106-SDK runtime environment: Linux operating system 107-No code editor provided 108 109## TA development steps 110 111When developing a new TA, it is necessary to create a new TA source code directory in the tee_dev-kit/sdk/src/TA directory. The directory structure can refer to the demo example code in this directory. Taking helloworld_demo as an example, the directory structure is as follows: 112 113``` 114├── helloworld_demo 115▽-- ta_demo. c # TA source code file 116∝ - configs.xml # TA attribute configuration file 117∝ - Makefile # TA Compile Makefile 118∝ - build_ta. sh # TA One Click Script Generation 119``` 120 121### TA code writing 122 123The TA code must implement the following entry functions specified in the GP TEE standard: 124 125|TA Entry Function Name | Function Description| 126| -------------------------- | ----------------------------------------------------- | 127|TA_Create Entry Point | Constructor of TA instance, called only once in the lifecycle of each TA instance| 128|TA_SpenSessionExitPoint | Client requests to create a session with TA| 129|TA_invokeCommandEntry Point | After successfully creating a session, the client sends instructions to the TA| 130|TA_CloseSessionExitPoint | Client requests to close session with TA| 131|TA_SestroyInterpoint | The destructor of the TA instance, which OpenTrustee calls when destroying the TA instance| 132 133### TA Makefile Writing 134 135TA needs to write their own Makefile file, please refer to the example code in the SDK. There are the following key points: 136 137-The target file name generated by TA compilation is fixed as libcombine.so. 138-For 64 bit TAs, it is necessary to add the "TARGET_S_SARM64=y" tag in the Makefile header; For 32-bit TA, this tag should not be included in the Makefile. 139 140### TA attribute configuration 141 142Each TA source code directory needs to contain configs.xml, which defines the attribute information of that TA. 143 144|Attribute Name | Data Type | Attribute Description | System Default Value| 145| ------------------- | -------- | ------------------------------------------------------------ | ---------- | 146|Service_name | String | TA name, string length not exceeding 64 characters, only supports numbers and letters, '_' and '-' | None| 147|UUID | UUID | TA unique identifier | None| 148|Instance_ceep_alive | Bool | If true, it means that even if all TA sessions are closed, the TA instance will not be destroyed and the global data will still exist until the TEE runs. If false, it means that if all TA sessions are closed, the TA instance will be destroyed| false | 149|Stack_Size | Integer | The stack space size for each session of TA needs to be evaluated based on their actual situation | 8192| 150|Heapsosize | Integer | The heap space occupied by the TA instance needs to be evaluated based on its actual situation | 0| 151|Does multi-session | Bool | TA support establishing multiple sessions simultaneously | false| 152|Single_instance | Bool | Whether multiple sessions of TA belong to the same instance (currently only singleInstance is supported as true) | true| 153 154The example is as follows: 155 156``` 157<ConfigInfo> 158 <TA_Basic_Info> 159 <service_name>demo-ta</service_name> 160 <uuid>e3d37f4a-f24c-48d0-8884-3bdd6c44e988</uuid> 161 </TA_Basic_Info> 162 <TA_Manifest_Info> 163 <instance_keep_alive>false</instance_keep_alive> 164 <stack_size>8192</stack_size> 165 <heap_size>81920</heap_size> 166 <multi_session>false</multi_session> 167 <single_instance>true</single_instance> 168 </TA_Manifest_Info> 169</ConfigInfo> 170``` 171 172### TA compilation and signature 173 174The OpenTrustee SDK provides a one click script for TA generation, which copies tee_dev_kit/sdk/build/build_ta.sh to the TA source code directory for execution. This completes TA compilation, property configuration file parsing, signing, and other operations, and generates a TA installation package file named uuid.sec in the current directory. 175 176## Related Dependency Warehouse<a name="section1371113476308"></a> 177 178[OpenHarmony/build]( https://gitee.com/openharmony/build ) 179 180[OpenHarmony/third_party/musl]( https://gitee.com/openharmony/third_party_musl ) 181 182[OpenHarmony/third_party/bounds_checking_function]( https://gitee.com/openharmony/third_party_bounds_checking_function ) 183