OP-TEE documentation is the primary site for OP-TEE.

This document describes the sama5d2 platform support for OP-TEE that has been added in various components (at91bootstrap, OP-TEE, U-Boot, Linux Kernel and buildroot). The sama5d27_som1_ek board will be used as an example through this whole document.

Note: In this documentation, we expect CROSS_COMPILE and ARCH environment variables to be defined in the user development environment: CROSS_COMPILE=arm-linux-gnueabi- ARCH=arm


Get Sources

You can easily download AT91Bootstrap source code on the at91bootstrap repository.

To get the source code, you should clone the repository by doing:

$ git clone https://github.com/linux4sam/at91bootstrap.git
Cloning into 'at91bootstrap'...
remote: Enumerating objects: 17621, done.
remote: Counting objects: 100% (3324/3324), done.
remote: Compressing objects: 100% (1029/1029), done.
remote: Total 17621 (delta 2465), reused 3102 (delta 2285), pack-reused 14297
Receiving objects: 100% (17621/17621), 5.65 MiB | 4.65 MiB/s, done.
Resolving deltas: 100% (13459/13459), done.
$ cd at91bootstrap/

Configure AT91Bootstrap

Inside the AT91Bootstrap root directory you will find a configs folder which contains several default configuration files only one file contains the correct configuration for OP-TEE:


You can configure AT91Bootstrap by doing:

$ make mrproper
$ make sama5d27_som1_ek-opteesd_uboot_defconfig

If the configuring process is successful, the .config file can be found at AT91Bootstrap root directory.

Build AT91Bootstrap

Then you can build the AT91Bootstrap binary by doing:

$ make

If the building process is successful, the final .bin image is build/binaries/at91bootstrap.bin.


Get Sources

To get the source code for OP-TEE OS the repository must be cloned.
$ git clone git@github.com:linux4sam/optee_os-at91.git
Cloning into 'optee_os-at91'...
remote: Enumerating objects: 60471, done.
remote: Counting objects: 100% (5228/5228), done.
remote: Compressing objects: 100% (1160/1160), done.
remote: Total 60471 (delta 4183), reused 4539 (delta 3900), pack-reused 55243
Receiving objects: 100% (60471/60471), 24.84 MiB | 26.09 MiB/s, done.
Resolving deltas: 100% (43205/43205), done.
$cd optee_os-at91/
After cloning the default branch is master which pointing to the latest version of optee_os-at91. We advise to use linux4sam tags to be sure taht there is no mismatch between the versions of this repository and u-boot.

You can list them by doing this

$ git tag | grep linux4sam
$ git checkout linux4sam-2022.10


OP-TEE does not have any Kconfig system but can be configured through command line. However, by default, there is no need to add more options. Default platform flavor is sama5d27_som1_ek. Note: Currently there is only the sama5d27_som1_ek is supported.

To build OP-TEE binary

 $ make CROSS_COMPILE=arm-linux-gnueabi- PLATFORM=sam PLATFORM_FLAVOR=sama5d27_som1_ek -j12 
A tee.bin file will be created in out/arm-plat-sam/core and should be copied on a SDCard to allow at91bootstrap booting it.

Note: By default OP-TEE will not display anything, only some messages in case of errors. To enable a more verbose debug, compile it with the following options:

 $ make CROSS_COMPILE=arm-linux-gnueabi- PLATFORM=sam PLATFORM_FLAVOR=sama5d27_som1_ek  DEBUG=1 CFG_TEE_CORE_LOG_LEVEL=4 CFG_TEE_CORE_DEBUG=y -j12


As mentioned above debug messages are not enabled by default and have to be enabled by build variables.

Different print log levels are able to be configured for both TEE core and TEE trusted application. The default value is 1

  • 0: none
  • 1: error only
  • 2: error and info
  • 3: error, info, and debug
  • 4: error,info,debug, and flow

Along with showing the core log for debugging OP-TEE provides a helper script called symbolize.py located in the optee-os/scripts folder. This script will extend the abort or panic message from OP-TEE, example of this call is here

scripts/symbolize.py -d out/arm-plat-hikey/core -d ../optee_test/out/ta/*

Secure Storage

Secure storage is implemented in two different ways as described in the documentation as well as API and the data-path flow. The commands that are mentioned for example, CFG_REE_FS, this would be passed into the additional build variables.

Both secure storage implementations can be enabled at the same time by passing these commands into the build variables, CFG_RPMB_FS=y CFG_RPMB_WRITE_KEY=y CFG_RPMB_TESTKEY=y CFG_REE_FS=y

The xtest program will verify the secure storage when it runs its regression test. To call a specific secure storage memory test run xtest _6, and xtest -t benchmark -l 15.


Follow the steps to get U-Boot

To build U-boot with OP-TEE configs there is only one config in configs/

$ make sama5d27_som1_ek_mmc_optee_defconfig
$ make

Once built, a u-boot.bin file will be available in the build directory. This file should be copied on the SDCard.


Get Sources

Follow the steps listed here to download the kernel source files.


To configure the Linux kernel the default configuration must be loaded found in arch/arm/configs/
$make ARCH=arm sama5_defconfig
  HOSTCC  scripts/basic/fixdep
  HOSTCC  scripts/kconfig/conf.o
  HOSTCC  scripts/kconfig/confdata.o
  HOSTCC  scripts/kconfig/expr.o
  LEX     scripts/kconfig/lexer.lex.c
  YACC    scripts/kconfig/parser.tab.[ch]
  HOSTCC  scripts/kconfig/lexer.lex.o
  HOSTCC  scripts/kconfig/menu.o
  HOSTCC  scripts/kconfig/parser.tab.o
  HOSTCC  scripts/kconfig/preprocess.o
  HOSTCC  scripts/kconfig/symbol.o
  HOSTCC  scripts/kconfig/util.o
  HOSTLD  scripts/kconfig/conf
# configuration written to .config

TO add the OP-TEE support configurations to the .config file need to be changed to match what is shown below:

# CONFIG_ARM_AT91_CPUIDLE is not set
# CONFIG_ATMEL_PM is not set

Now to build the Linux kernel image, before you build you need to set up the cross compile toochain here(link).

$ARCH=arm make
Now you have a usable compressed kernel image zImage.


For OP-TEE the steps for BuildRoot should be followed remembering to select one of the two OP-TEE configs listed below:


Then to load the OP-TEE config you'll have to do:

$ BR2_EXTERNAL=../buildroot-external-microchip/ make sama5d2_xplained_graphics_defconfig

Then you can build the image:

$ make

Advanced Features

Before building the Buildroot image you may want to customize the OP-TEE arguments such as adding debug messages.

Configurations in Kconfig

OP-TEE has multiple extra configurations, as mentioned above, that are not included in the default build configuration.

These can be added by running:

BR2_EXTERNAL=../buildroot-external-microchip/ make menuconfig

and go into Bootloaders menu to find the highlighted portion:

Simply add any additional build variables that you might need as if you are building OP-TEE stand alone.

Trusted Applications

In OP-TEE there are two types of applications the traditional user-space applications and trusted applications. Trusted applications are applications that access the secure portion of the OS.

To see more Trusted Application examples they can be found here OP-TEE Examples.

Building Trusted Application

In OP-TEE to build a trusted application there are a mandatory files that need to follow a certain layout shown below:

The parent directory for the tree is called my_program, this format makes it easy to organize multiple trusted applications.


The host folder contains the main user-space program.

This program will need to:

  • Initialize a context connecting to TEE
  • Open a TEE session
  • Use a TEEC_Operation variable to pass in arguments from the non-secure world to the secure world
  • Prepare the arguments that are about to be passed using TEEC_PARAM_TYPES() function
  • Call the trusted application using TEEC_InvokeCommand()
  • At the end Close the session and context

The Makefile is similar to other Makefiles just adding the flags to include the trusted application and the host application this belongs in the host folder, shown below:

Trusted Application (TA)

The trusted application folder is more complicated and has many moving parts.

Include Folder

This contains the programs header file that has the TA commands API and the TA_UUID. The UUID can be generated here. Shown below is an example header file called ta_my_program.h

Note: For clarity the UUID that was generated for this instance is cd9a3290-457b-4e49-99ff-32145fbde7cb and TA_MY_PROGRAM_CMD_INC_VALUE is a parameter passed into the main program from the host program.

Main Program

The main program that interacts with the TA entry points his located in this folder as a .c file. The OP-TEE documentation mentioned above that there are TA mandatory entry points. These entry points are implemented in this main function, in this example my_program_ta.c. An example of implementing a counter within the TA is shown below, notice that InvokeCommandEntryPoint can be used to call different functions depending on the parameters passed into it similar to an ISR.

Trusted Application Properties Header File

This is a header file that stores the uuid, flags, stack size, and data size. This file is normally called user_ta_header_defines.h and is located in the ta folder. An Example:


There are two Makefiles that need to be in the TA folder a Makefile and a sub.mk file. The Makefile needs to have the UUID labeled BINARY and the include path for the TA devkit, this is taken from the OP-TEE build and passed in as compile arguments.


The sub.mk file is the entry point for the source files to build example shown below:

global-incdirs-y +=include
srcs-y += my_program_ta.c

This adds the include folder globally and adds the trusted application main.c file to the list of source files.

Compiling Trusted Applications

Inside the host folder the cross compiler needs to be set and the tee client export needs to be set as well.

If using the Buildroot OP-TEE build:

$ make CROSS_COMPILE=<buildroot-at91>/output/host/bin/arm-buildroot-gnueabihf- TEEC_EXPORT=<buildroot-at91>/output/build/optee-client-3.15.0/out/export/usr --no-builtin-variables

This will output the program as a binary in the host folder, where the build was done.

To compile the trusted application first navigate to the ta folder. The cross compiler needs to be set just like the above step as well as the location of the ta_dev_kit, which is made when the optee_os is built.

An example using buildroot:

$ make CROSS_COMPILE=<buildroot-at91>/output/host/bin/arm-buildroot-gnueabihf- PLATFORM=sam TA_DEV_KIT_DIR=<buildroot-at91>/output/build/<optee-os>/out/export-ta_arm32/

Copy the Trusted Application

Once the TA and the host application are compiled they can be copied into the root file system.

If using buildroot follow these steps after build has finished:

  • Copy the trusted application from the ta folder, the application would be titled .ta into <buildroot-at91>/output/target/lib/optee_armtz/ folder If this folder is not there double check the environment was configured correctly for OP-TEE and finished building.
  • Copy the host application from the host folder into the root file system, <buildroot-at91>/output/target/usr/bin/ This location is different due to how OP-TEE separates the secure world and the non secure world.
  • Go into the buildroot-at91 main build directory and run make, this will build the file system with the new application added.

The image is ready for use.

Topic attachments
I Attachment Action Size Date Who Comment
JPEGjpg ExampleFileTree.jpg manage 143.6 K 2022-11-17 - 21:04 RyanWanner  
JPEGjpg ExampleHeaderFile.jpg manage 85.9 K 2022-11-17 - 21:04 RyanWanner  
JPEGjpg ExampleMakeFile.jpg manage 35.2 K 2022-11-17 - 21:04 RyanWanner  
JPEGjpg ExampleTAPropertiesFile.jpg manage 120.7 K 2022-11-17 - 21:16 RyanWanner  
JPEGjpg ExampleTaMakeFile.jpg manage 76.5 K 2022-11-17 - 21:16 RyanWanner  
JPEGjpg OP-TEEKconfig.jpg manage 269.6 K 2022-11-16 - 21:40 RyanWanner  
r2 - 17 Nov 2022 - 21:46:41 - RyanWanner
Linux & Open Source for AT91 Microchip Microprocessors

Copyright © by the contributing authors. All material on this collaboration platform is the property of the contributing authors.

Linux® is the registered trademark of Linus Torvalds in the U.S. and other countries.

Microchip® and others, are registered trademarks or trademarks of Microchip Technology Inc. and its subsidiaries. This site is powered by the TWiki collaboration platform

Arm® and others are registered trademarks or trademarks of Arm Limited (or its affiliates). Other terms and product names may be trademarks of others.

Ideas, requests, contributions ? Connect to LinksToCommunities page.

Syndicate this siteRSS ATOM