@@ -110,56 +110,40 @@ OP-TEE Secure Storage
110110*********************
111111
112112OP-TEE provides secure storage functionality through two mechanisms:
113- **REE FS ** (Rich Execution Environment Filesystem) and **RPMB **
114- (Replay Protected Memory Block).
113+ **Rich Execution Environment Filesystem (REE FS) ** and **Replay Protected Memory Block (RPMB) **.
115114
116115TI SDK enables REE FS by-default, and configures OP-TEE to store
117116encrypted binary blobs created by REE FS in
118117:file: `/var/lib/tee/ `.
119118
120- .. ifconfig :: CONFIG_part_variant in ('AM62LX')
121-
122- .. note ::
123-
124- Presently, AM62L does not support RPMB. This support will be added
125- in subsequent releases. It does support REE FS.
126-
127- The remaining devices support both: REE FS by-default and RPMB if
128- OP-TEE binaries are re-compiled with required flags.
129-
130- For learning more about secure storage in OP-TEE, refer:
131- https://optee.readthedocs.io/en/latest/architecture/secure_storage.html
132-
133- .. ifconfig :: CONFIG_part_variant not in ('AM62LX')
134-
135- RPMB works in TI SoCs with HS configuration. These embed a KEK
136- that programs across OP-TEE instances in a derived manner. Each HS
137- device has its own HUK signing key (DKEK), which is different from
138- other HS devices. TI SDK disables RPMB by-default. To enable it,
139- re-compiling OP-TEE with ``CFG_RPMB_FS=y `` flag.
119+ RPMB works in TI SoCs with HS configuration. These embed a Key Encryption Key (KEK)
120+ that programs across OP-TEE instances in a derived manner. Each HS
121+ device has its own HUK signing key Derived Key Encryption Key (DKEK), which is different from
122+ other HS devices. TI SDK disables RPMB by-default. To enable it,
123+ re-compiling OP-TEE with ``CFG_RPMB_FS=y `` flag.
140124
141- For learning more about secure storage in OP-TEE, and instructions to
142- enable RPMB, refer:
143- https://optee.readthedocs.io/en/latest/architecture/secure_storage.html
125+ For learning more about secure storage in OP-TEE, and instructions to
126+ enable RPMB, refer:
127+ https://optee.readthedocs.io/en/latest/architecture/secure_storage.html
144128
145- There is a hybrid mode in which both the flags i.e ` CFG_REE_FS=y ` and `CFG_RPMB_FS=y ` are enabled .
146- This mode stores the state of the Secure Storage directory in RPMB partition to check for the
147- integrity of the data present in it. It is the recommended way.
129+ There is a hybrid mode, which enables both `` CFG_REE_FS=y `` and `` CFG_RPMB_FS=y `` .
130+ This mode stores the state of the Secure Storage directory in RPMB partition to check for the
131+ integrity of the data present in it. It is the recommended way.
148132
149- E.g. For enabling hybrid mode of RPMB along with REE_FS
133+ E.g. For enabling hybrid mode of RPMB along with REE_FS
150134
151- .. ifconfig :: CONFIG_part_variant in ('J721S2')
135+ .. ifconfig :: CONFIG_part_variant in ('J721S2')
152136
153- .. code-block :: console
137+ .. code-block :: console
154138
155- $ export CFG_CONSOLE_UART=0x8
139+ $ export CFG_CONSOLE_UART=0x8
156140
157- .. parsed-literal ::
141+ .. parsed-literal ::
158142
159- $ make CROSS_COMPILE64="$CROSS_COMPILE_64" PLATFORM=\ |__OPTEE_PLATFORM_FLAVOR__ | CFG_ARM64_core=y CFG_REE_FS=y CFG_RPMB_FS=y
143+ $ make CROSS_COMPILE64="$CROSS_COMPILE_64" PLATFORM=\ |__OPTEE_PLATFORM_FLAVOR__ | CFG_ARM64_core=y CFG_REE_FS=y CFG_RPMB_FS=y
160144
161- OPTEE -client also needs to be updated to enable the use of real
162- emmc instead of the virtual emmc that is enabled by default
145+ Also update optee -client to enable the use of real
146+ eMMC instead of the virtual eMMC, which is the default option.
163147
164148As an example to show the usage of secure storage, the filesystem
165149provides a binary :file: `/usr/bin/optee_examples_secure_storage `.
@@ -221,12 +205,10 @@ Integrate binary output into U-boot
221205
222206|
223207
224- .. ifconfig :: CONFIG_part_variant not in ('AM62LX')
225-
226- .. rubric :: PKCS#11
208+ .. rubric :: PKCS#11
227209
228- PKCS#11 is a cryptographic token interface standard that allows applications
229- to access cryptographic services through a platform-independent API.
210+ PKCS#11 is a cryptographic token interface standard that allows applications
211+ to access cryptographic services through a platform-independent API.
230212
231- For userland integration details, refer:
232- https://optee.readthedocs.io/en/latest/building/userland_integration.html
213+ For userspace integration details, refer:
214+ https://optee.readthedocs.io/en/latest/building/userland_integration.html
0 commit comments