python3 lemans/security/swiv_build_utility.py \
  u-boot/.output/spl/u-boot-spl-swiv.elf \
  u-boot/.output/spl/u-boot-spl.elf \
  lemans

# Input:  u-boot-spl.elf  (raw U-Boot SPL output)
# Output: u-boot-spl-swiv.elf  (SPL + SWIV segment)

qtestsign -v6 tz \
  -o u-boot/.output/spl/u-boot-spl.mbn \
  u-boot/.output/spl/u-boot-spl-swiv.elf

# Cloned from msm8916-mainline/qtestsign
# No CASS / remote signing server needed

OP-TEE is an open-source Trusted Execution Environment that runs in the Arm TrustZone Secure World (EL1-S). It hosts Trusted Applications (TAs) and handles Secure Monitor Calls (SMCs) from the Normal World.

Configuration

• Platform: qcom-lemans
• Output: optee_os/out/arm/core/tee.elf
• Passed to U-Boot as: TEE= (embedded in SPL FIT image)

U-Boot SPL loads TF-A BL31, OP-TEE (BL32), and U-Boot proper (BL33) from the SPL FIT image. TF-A BL31 runs at EL3 as Secure Monitor.

The Linux kernel communicates with OP-TEE via the tee-supplicant daemon and the CONFIG_OPTEE driver, both enabled in the kernel defconfig.

The TEE Client API library. User-space applications call it to open sessions with Trusted Applications and invoke commands across the Normal/Secure World boundary.

• TEEC_InitializeContext / TEEC_FinalizeContext
• TEEC_OpenSession — open a channel to a TA
• TEEC_InvokeCommand — call a TA entry point
• TEEC_CloseSession

Buildroot Package

• Package: optee_client_ext (br-ext)
• Init script: /etc/init.d/S30optee (auto-start)
• User tee — runs supplicant, owns /dev/teepriv0
• Group teeclnt — client apps; includes user test

Runs in Normal World as a privileged daemon. Acts as the bridge between the OP-TEE Secure World and REE filesystem / hardware resources.

• TA loading — reads /lib/optee_armtz/*.ta and passes TA binaries to the Secure World on demand
• Secure storage — mediates RPMB and REE-filesystem secure storage RPCs from OP-TEE OS
• Socket / time RPCs — handles other Secure World RPC calls that need REE access (entropy, sockets, time)

Without tee-supplicant running, TA loading and secure storage fail silently — always verify it is active before running xtest.

What it covers

• Core TEE OS functionality (panics, memory, threads)
• GlobalPlatform TEE Internal Core API
• GlobalPlatform TEE Client API
• Cryptographic operations — AES, RSA, ECC, hash, ECDH
• Secure Storage — RPMB and REE-filesystem backends
• Regression suite and benchmarks

Buildroot Package

• Package: optee_test_ext (br-ext, on by default)
• Depends on: optee_client_ext, openssl
• TAs installed to: /lib/optee_armtz/
• Init: S30test-arm-ffa-user for ARM FF-A user tests
• Source: OP-TEE/optee_test.git (via manifest)

Connect via serial (ttyMSM0 115200) or SSH. Verify tee-supplicant is running before starting.

# Full test suite
xtest

# Regression tests only
xtest -t regression

# Single test case by number
xtest 1001

# List all test identifiers
xtest -l

# Help
xtest -h

Test results show OK / FAILED per case. A clean run ends with "RESULT: regression tests PASSED".

Build — two defconfigs

• SPL: qcom_lemans_spl_defconfig → .output/spl/u-boot-spl.elf (→ tz.mbn)
• Proper (BL33): qcom_lemans_defconfig → .output-proper/u-boot.bin @ 0xaf000000
• Cross-compiler: aarch64-none-linux-gnu-
• SPL is built with SPL_LOAD_FIT + SPL_ATF: it reads the uefi partition as a FIT and hands off to BL31 → OP-TEE → U-Boot proper
• OP-TEE enabled in proper via source overlay: /firmware/optee node + CONFIG_TEE/OPTEE

Why U-Boot?

U-Boot is configured in UEFI mode so the system presents a standard UEFI firmware interface. This lets the EFI partition be read using standard UEFI boot discovery — no bespoke boot config needed.

• Reads the EFI system partition (FAT32 efi.bin)
• Falls back to EFI/BOOT/bootaa64.efi as the UEFI fallback path
• Discovers and launches EFI/Linux/uki.efi (the Unified Kernel Image)
• Hands kernel execution over at EL2 once the UKI is loaded

Build Config

• Defconfig: defconfig (override via LINUX_DEFCONFIG)
• Auto-enabled: CONFIG_TEE, CONFIG_OPTEE
• Auto-enabled: CONFIG_EFI_BOOT, CONFIG_EFI_ZBOOT
• Auto-enabled: CONFIG_DEVTMPFS, CONFIG_QCOM_PAS_TEE
• Output: arch/arm64/boot/Image
• EFI_ZBOOT: arch/arm64/boot/vmlinuz.efi

Console

console=ttyMSM0,115200
qcom_scm.download_mode=1
arm-smmu.disable_bypass=0
clk_ignore_unused
pd_ignore_unused

lemans-evk-el2.dtb is a special Device Tree variant required when running Linux at EL2 without the Gunyah hypervisor.

• Enables the Qualcomm watchdog at EL2
• Disables the GPU Zap shader (not needed at EL2)
• Remaps IOMMU streams for ADSP, CDSP, WPSS remoteprocs
• Adjusts power domain topology for EL2 operation

The DTB is bundled into the UKI alongside the kernel Image and the Buildroot initramfs — no separate flash step required.

Target Format

Buildroot produces a compressed CPIO archive (out-br/images/rootfs.cpio.gz). It is embedded directly into the UKI as an initramfs, loaded entirely into RAM at boot.

Firmware Overlay

The kernel is built CONFIG_MODULES=n (all drivers are built-in, so the PAS remoteprocs can probe without waiting on late-loaded modules) — there are no .ko files. Buildroot's only root overlay is the DSP/remoteproc firmware staged into lemans/overlay/, so it lands in /lib/firmware inside the initramfs.

• Busybox (core utilities, watchdog support)
• OpenSSH server + key utilities
• OpenSSL CLI
• DHCPCD (networking), Ethtool, xinetd
• GStreamer 1.x + v4l-utils — V4L2 video decode/encode pipeline
• optee_client_ext — libteec.so + tee-supplicant
• optee_test_ext — xtest binary + TAs (on by default)

Login banner: "OP-TEE embedded distrib for lemans"

br-ext — External Package Tree

All OP-TEE packages use br-ext/, which points to local source checkouts. Stock BR2_PACKAGE_OPTEE_* packages are explicitly disabled — always use the _ext variants.

Bundles four inputs into a single PE/COFF EFI binary — no grub.cfg, no extlinux.conf. UEFI loads and verifies it in one shot.

A blank 512 MB file is formatted as FAT32, then populated with two files using mtools (no loop-mount needed):

truncate -s 512M lemans/output/efi.bin
mkfs.fat -F 32 -S 4096 lemans/output/efi.bin
mmd -i efi.bin ::/EFI/BOOT ::/EFI/Linux
mcopy -i efi.bin bootaa64.efi ::/EFI/BOOT/  # UEFI fallback
mcopy -i efi.bin uki.efi     ::/EFI/Linux/ # UKI

efi.bin (FAT32, 512 MB)
├── EFI/BOOT/bootaa64.efi   ← UEFI fallback entry
└── EFI/Linux/uki.efi       ← Unified Kernel Image

Why Yocto?

Yocto builds Qualcomm's official BSP — a complete, known-good working system you can flash and run as a reference. It lets you confirm the board and firmware are healthy on a trusted baseline, and compare the open firmware stack against it when hunting regressions.

It is not required to build or flash the open stack — for that always use make fetch-blobs, which downloads just the firmware blobs in minutes and keeps the open boot firmware stack functional.

make yocto — full BSP (hours)

• Clones qualcomm-linux/meta-qcom from GitHub
• Builds via kas using iq-9075-evk.yml
• Produces yocto/build/tmp/deploy/images/iq-9075-evk/
• Consumed only by make flash-yocto — flash-loader/flash-kernel never read from here

Use make fetch-blobs instead to skip the build entirely.

Note: flashing the Yocto BSP image programs the traditional Qualcomm boot stack (closed XBL / ABL / UEFI), not the open firmware stack this repo builds (U-Boot SPL → TF-A → OP-TEE → U-Boot). Its purpose here is a working reference stack to evaluate regressions against — for the open firmware stack always use make fetch-blobs to keep it functional.

Directory layout

br-ext/package/mypkg/
├── Config.in        ← Kconfig menu entry
└── mypkg.mk         ← build rules

Mirror the pattern from br-ext/package/optee_client_ext/. Register with:
source "$BR2_EXTERNAL_BR_EXT_PATH/package/mypkg/Config.in" in br-ext/package/Config.in.

Enable in lemans.mk

# In lemans.mk — package selection block
BR2_PACKAGE_MYPKG      ?= y
BR2_PACKAGE_MYPKG_SITE ?= $(ROOT)/mypkg

The ?= operator allows command-line overrides without editing the file.

MYPKG_VERSION       = 1.0
MYPKG_SITE          = $(BR2_PACKAGE_MYPKG_SITE)
MYPKG_SITE_METHOD   = local
MYPKG_INSTALL_STAGING = YES

MYPKG_CONF_OPTS += -DENABLE_TESTS=OFF

define MYPKG_INSTALL_TAS
  @$(foreach f,$(wildcard $(@D)/ta/out/*.ta), \
    $(INSTALL) -m 444 $$f \
      $(TARGET_DIR)/lib/optee_armtz/ &&) true
endef
MYPKG_POST_INSTALL_TARGET_HOOKS += MYPKG_INSTALL_TAS

$(eval $(cmake-package))

TAs installed to /lib/optee_armtz/ are loaded dynamically by tee-supplicant on demand.

Build & flash

# Full rootfs rebuild:
make buildroot efi flash-kernel

# Rebuild just one package:
make -C ../buildroot O=$(ROOT)/out-br \
    mypkg-rebuild
make efi flash-kernel