Skip to content

Commit c87bafe

Browse files
committed
feat(optee): Update RPMB sections to be shown for AM62L
So far, RPMB sections were excluded from AM62L docs since AM62L was not supporting RPMB. But now it does support. Therefore show those sections for AM62L as well. Signed-off-by: Suhaas Joshi <s-joshi@ti.com>
1 parent 2ff5b4d commit c87bafe

1 file changed

Lines changed: 25 additions & 43 deletions

File tree

source/linux/Foundational_Components_OPTEE.rst

Lines changed: 25 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -110,56 +110,40 @@ OP-TEE Secure Storage
110110
*********************
111111

112112
OP-TEE provides secure storage functionality through two mechanisms:
113-
**REE FS** (Rich Execution Environment Filesystem) and **RPMB**
114-
(Replay Protected Memory Block).
113+
**Rich Execution Environment Filesystem (REE FS)** and **Replay Protected Memory Block (RPMB)**.
115114

116115
TI SDK enables REE FS by-default, and configures OP-TEE to store
117116
encrypted binary blobs created by REE FS in
118117
:file:`/var/lib/tee/`.
119118

120-
.. ifconfig:: CONFIG_part_variant in ('AM62LX')
121-
122-
.. note::
123-
124-
Presently, AM62L does not support RPMB. This support will be added
125-
in subsequent releases. It does support REE FS.
126-
127-
The remaining devices support both: REE FS by-default and RPMB if
128-
OP-TEE binaries are re-compiled with required flags.
129-
130-
For learning more about secure storage in OP-TEE, refer:
131-
https://optee.readthedocs.io/en/latest/architecture/secure_storage.html
132-
133-
.. ifconfig:: CONFIG_part_variant not in ('AM62LX')
134-
135-
RPMB works in TI SoCs with HS configuration. These embed a KEK
136-
that programs across OP-TEE instances in a derived manner. Each HS
137-
device has its own HUK signing key (DKEK), which is different from
138-
other HS devices. TI SDK disables RPMB by-default. To enable it,
139-
re-compiling OP-TEE with ``CFG_RPMB_FS=y`` flag.
119+
RPMB works in TI SoCs with HS configuration. These embed a Key Encryption Key (KEK)
120+
that programs across OP-TEE instances in a derived manner. Each HS
121+
device has its own HUK signing key Derived Key Encryption Key (DKEK), which is different from
122+
other HS devices. TI SDK disables RPMB by-default. To enable it,
123+
re-compiling OP-TEE with ``CFG_RPMB_FS=y`` flag.
140124

141-
For learning more about secure storage in OP-TEE, and instructions to
142-
enable RPMB, refer:
143-
https://optee.readthedocs.io/en/latest/architecture/secure_storage.html
125+
For learning more about secure storage in OP-TEE, and instructions to
126+
enable RPMB, refer:
127+
https://optee.readthedocs.io/en/latest/architecture/secure_storage.html
144128

145-
There is a hybrid mode in which both the flags i.e `CFG_REE_FS=y` and `CFG_RPMB_FS=y` are enabled.
146-
This mode stores the state of the Secure Storage directory in RPMB partition to check for the
147-
integrity of the data present in it. It is the recommended way.
129+
There is a hybrid mode, which enables both ``CFG_REE_FS=y`` and ``CFG_RPMB_FS=y``.
130+
This mode stores the state of the Secure Storage directory in RPMB partition to check for the
131+
integrity of the data present in it. It is the recommended way.
148132

149-
E.g. For enabling hybrid mode of RPMB along with REE_FS
133+
E.g. For enabling hybrid mode of RPMB along with REE_FS
150134

151-
.. ifconfig:: CONFIG_part_variant in ('J721S2')
135+
.. ifconfig:: CONFIG_part_variant in ('J721S2')
152136

153-
.. code-block:: console
137+
.. code-block:: console
154138
155-
$ export CFG_CONSOLE_UART=0x8
139+
$ export CFG_CONSOLE_UART=0x8
156140
157-
.. parsed-literal::
141+
.. parsed-literal::
158142
159-
$ make CROSS_COMPILE64="$CROSS_COMPILE_64" PLATFORM=\ |__OPTEE_PLATFORM_FLAVOR__| CFG_ARM64_core=y CFG_REE_FS=y CFG_RPMB_FS=y
143+
$ make CROSS_COMPILE64="$CROSS_COMPILE_64" PLATFORM=\ |__OPTEE_PLATFORM_FLAVOR__| CFG_ARM64_core=y CFG_REE_FS=y CFG_RPMB_FS=y
160144
161-
OPTEE-client also needs to be updated to enable the use of real
162-
emmc instead of the virtual emmc that is enabled by default
145+
Also update optee-client to enable the use of real
146+
eMMC instead of the virtual eMMC, which is the default option.
163147

164148
As an example to show the usage of secure storage, the filesystem
165149
provides a binary :file:`/usr/bin/optee_examples_secure_storage`.
@@ -221,12 +205,10 @@ Integrate binary output into U-boot
221205

222206
|
223207
224-
.. ifconfig:: CONFIG_part_variant not in ('AM62LX')
225-
226-
.. rubric:: PKCS#11
208+
.. rubric:: PKCS#11
227209

228-
PKCS#11 is a cryptographic token interface standard that allows applications
229-
to access cryptographic services through a platform-independent API.
210+
PKCS#11 is a cryptographic token interface standard that allows applications
211+
to access cryptographic services through a platform-independent API.
230212

231-
For userland integration details, refer:
232-
https://optee.readthedocs.io/en/latest/building/userland_integration.html
213+
For userspace integration details, refer:
214+
https://optee.readthedocs.io/en/latest/building/userland_integration.html

0 commit comments

Comments
 (0)