[MTK] How To Enable Microtrust TEE

[DESCRIPTION]

Android R: 

configurations for enable Microtrust TEE(豆荚TEEI)

[SOLUTION]

Android S + kernel-5.10

Android S/R/Q + kernel-4.14/4.19 

• Preloader

Path： vendormediatekproprietarybootablebootloaderpreloadercustom${PROJECT}${PROJECT}.mk

Configuration：

MTK_TEE_SUPPORT = yes

TRUSTONIC_TEE_SUPPORT = no

MICROTRUST_TEE_SUPPORT = yes

MTK_GOOGLE_TRUSTY_SUPPORT = no

export MTK_TEE_SUPPORT TRUSTONIC_TEE_SUPPORT MICROTRUST_TEE_SUPPORT MTK_GOOGLE_TRUSTY_SUPPORT

• Trustzone

Path： vendormediatekproprietarytrustzonecustombuildproject${PROJECT}.mk

Configuration：

MTK_ATF_SUPPORT=yes

MTK_TEE_SUPPORT=yes

MICROTRUST_TEE_SUPPORT=yes

ifeq ($(MTK_SEC_VIDEO_PATH_SUPPORT), yes)
MTK_TEE_DRAM_SIZE=0x3200000
else ifeq ($(MTK_CAM_SECURITY_SUPPORT), yes)
MTK_TEE_DRAM_SIZE=0x3200000
else
MTK_TEE_DRAM_SIZE=0x1600000
endif

Note:

MTK_TEE_DRAM_SIZE 值不固定，根据你当前开的feature option及TA/TDRV占用的heap size决定

• Kernel @  ARMv8 A32/K32   (32 bit platform)

1，defconfig

Path：

${KERNEL_VER}\arch\arm\configs\${PROJECT}_debug_defconfig

${KERNEL_VER}\arch\arm\configs\${PROJECT}_defconfig

Configuration：

CONFIG_MICROTRUST_TEE_SUPPORT=y

CONFIG_MTK_TEE_GP_SUPPORT=y (if need SVP or SecureCamera) (removed after kernel-4.19)

2，DTS 

Path： ${KERNEL_VER}\arch\arm\boot\dts\mediatek\${CHIP}.dts (After kernel-4.14)

Configuration：

soter-shared-mem {
compatible = "microtrust,shared_mem";
no-map;
#if defined(CONFIG_MTK_SEC_VIDEO_PATH_SUPPORT) ||
defined(CONFIG_MTK_CAM_SECURITY_SUPPORT)
size = <0 0x800000>;
alignment = <0 0x1000000>;
#else
size = <0 0x200000>;
alignment = <0 0x200000>;
#endif
alloc-ranges = <0 0x40000000 0 0x50000000>;
};

• Kernel @ ARMv8 A64/K64 (64 bit platform)

1，defconfig

Path：

${KERNEL_VER}\arch\arm64\configs\${PROJECT}_debug_defconfig

${KERNEL_VER}\arch\arm64\configs\${PROJECT}_defconfig

Configuration：

CONFIG_MICROTRUST_TEE_SUPPORT=y

CONFIG_MTK_TEE_GP_SUPPORT=y (if need SVP or SecureCamera)(removed after kernel-4.19)

2，DTS

Path： ${KERNEL_VER}\arch\arm64\boot\dts\mediatek\${CHIP}.dts (After kernel-4.14)

Configuration：

soter-shared-mem {
compatible = "microtrust,shared_mem";
no-map;
#if defined(CONFIG_MTK_SEC_VIDEO_PATH_SUPPORT) ||
defined(CONFIG_MTK_CAM_SECURITY_SUPPORT)
size = <0 0x800000>;
alignment = <0 0x1000000>;
#else
size = <0 0x200000>;
alignment = <0 0x200000>;
#endif
alloc-ranges = <0 0x40000000 0 0x50000000>;
};

• ProjectConfig

Path： devicemediatekprojects${PROJECT}[ProjectConfig.mk](http://projectconfig.mk/)

Configuration：

MTK_ATF_SUPPORT = yes

MTK_TEE_SUPPORT = yes

MICROTRUST_TEE_SUPPORT = yes

MTK_PERSIST_PARTITION_SUPPORT = yes (if need attestation key of keymaster)

MTK_TEE_GP_SUPPORT=yes (if need SVP or SecureCamera)