1MS-IoT fTPM 2=========== 3## Trusted firmware for Windows based AArch32 (32-bit) ARM SoC's 4Please see the [build-firmware document](https://github.com/ms-iot/imx-iotcore/blob/develop/Documentation/build-firmware.md) in the iMX IoT Core repo for additional information on including this TA in an IoT Core image for iMX boards. 5 6## Included TAs 7 8### fTPM TA 9The fTPM Trusted Application (TA) provides a secure firmware implementation of a TPM using the MS reference implementation. 10Platform specific code is copied and modified locally in [`optee_ta/fTPM/platform`](./optee_ta/fTPM/platform), while [`/fTPM/reference`](./fTPM/reference) contains files to support WolfSSL, control the fTPM's functionality, and define basic types, which may not be found in OpTEE. 11 12See the reference implementation for more details. 13 14--- 15 16## Extra Installation Steps 17 18The secure firmware utilizes the OP-TEE implementation of the Global Platform specifications. The OP-TEE project is 19not duplicated in this repository but is obtained directly from the public release. The build of OP-TEE is based on a 20native Linux build, however the following installation steps allow OP-TEE to be built under Windows using WSL. Only the optee_os 21repository is relevant for trusted firmware use - the optee_client & optee_linuxdriver repositories are integration 22components for Linux and can serve as a reference for the Windows equivalent components. Note that optee_linuxdriver 23is GPL. 24 25OpTEE generates a build environment for trusted applications which is based on Make (See TA_DEV_KIT_DIR in the build directions). 26This build environment places several constraints on how the code is organized, which are explained in the relevant makefiles. 27See the [optee_os documentation](https://github.com/OP-TEE/optee_os/blob/master/documentation/build_system.md) for details about how OpTEE build works. 28 29#### 1. Enable Windows Subsystem for Linux 30See instructions [here](https://docs.microsoft.com/en-us/windows/wsl/install-win10): 31 32#### 2. Launch Bash 33Search for "bash" in the start menu, OR press Windows key + 'R', then type bash. 34Update if needed. 35 36In WSL: 37```sh 38sudo apt-get update 39``` 40 41#### 3. Install the ARM tool chain 42Install the ARM toolchain to a directory of your choice. 43```sh 44cd ~ 45wget https://releases.linaro.org/components/toolchain/binaries/6.4-2017.11/arm-linux-gnueabihf/gcc-linaro-6.4.1-2017.11-x86_64_arm-linux-gnueabihf.tar.xz 46tar xf gcc-linaro-6.4.1-2017.11-x86_64_arm-linux-gnueabihf.tar.xz 47rm gcc-linaro-6.4.1-2017.11-x86_64_arm-linux-gnueabihf.tar.xz 48``` 49 50#### 4. Clone the OpTEE OS source code 51If you do not already have a version of the OP-TEE OS repo cloned on your machine you may run: 52```sh 53cd ~ 54git clone https://github.com/ms-iot/ms-iot-optee_os.git 55``` 56 57#### 5. Build OP-TEE OS for the target platform 58 59`TA_CROSS_COMPILE` should point to the ARM toolchain installed in [step 3](#3-install-the-arm-tool-chain). 60 61```sh 62cd ~/optee_os 63CROSS_COMPILE=~/gcc-linaro-6.4.1-2017.11-x86_64_arm-linux-gnueabihf/bin/arm-linux-gnueabihf- make PLATFORM=imx-mx6qhmbedge CFG_TEE_CORE_LOG_LEVEL=4 CFG_REE_FS=n CFG_RPMB_FS=y CFG_RPMB_TESTKEY=y CFG_RPMB_WRITE_KEY=y -j20 64``` 65Additional information on Microsoft IoT fork of OP-TEE OS can be found [here](https://github.com/ms-iot/ms-iot-optee_os). 66 67#### 6. Clone the ms-tpm-20-ref source code 68```sh 69cd ~ 70git clone https://github.com/Microsoft/ms-tpm-20-ref.git 71``` 72 73#### 7. Initialize the git submodules 74```sh 75cd ~/ms-tpm-20-ref 76git submodule init 77git submodule update 78``` 79 80--- 81 82## Building the TPM 83 84#### 1. Build the Firmware TPM Trusted Application 85`TA_CROSS_COMPILE` should point to the ARM toolchain installed in [step 3](#3-install-the-arm-tool-chain). 86 87`TA_DEV_KIT_DIR` should point to the directory the optee_os TA devkit was compiled to in [step 5](#6-clone-the-ms-tpm-20-ref-source-code 88). 89 90`-j` increases the parallelism of the build process. 91 92```sh 93cd ~/ms-tpm-20-ref/Samples/ARM32-FirmwareTPM/optee_ta 94TA_CPU=cortex-a9 TA_CROSS_COMPILE=~/gcc-linaro-6.4.1-2017.11-x86_64_arm-linux-gnueabihf/bin/arm-linux-gnueabihf- TA_DEV_KIT_DIR=~/optee_os/out/arm-plat-imx/export-ta_arm32 CFG_TEE_TA_LOG_LEVEL=2 make -j20 95``` 96Debugging options you may want to add: 97 98`CFG_TEE_TA_LOG_LEVEL=3` 1 is fatal errors only, other values increase debug tracing output. 99 100`CFG_TA_DEBUG=y` Turns on debug output from the TAs, and enables extra correctness checks in the fTPM TA. 101 102