Guide to Disable Secure Images on Total Compute Platform

Total Compute (TC) software stack is a reference software stack for the Arm Total Compute Fixed Virtual Platform (FVP). The TC software consists of firmware, kernel and file system components that can run on the associated FVP.

Some of its main components are as follows:

RSS firmware, which provides Hardware Root of Trust
SCP firmware, which is responsible for system initialization, clock and power control;
AP firmware, which is Trusted Firmware-A (TF-A)
Secure Partition Manager - Hafnium
Secure Partitions:
- OP-TEE Trusted OS in Buildroot
- Trusted Services in Buildroot
U-Boot, which loads and verifies kernel and rootfs
Linux Kernel

Some developer user does not need the related secure component for the TC software stack usage, the related secure image component such as the BL32(Hafnium) and other Secure Partition images which is implemented as trusted service, when the user just need to boot up into the normal linux, we can disable them.

Note: After the Secure Image is disabled, the related secure service will not available from non-secure world, for example, the U-Boot and Linux OS will not able to use the FF-A function call for the secure service.

Firmware Image Overview

Steps to Disable Secure World Images

For the default TC2 software stack, the BL31 has the support of the SPMD service which is used for support SPM(secure partition manager) of Hafnium, the change will include the TF-A. Another component is u-boot, u-boot will use the FF-A call to work with the secure firmware update service, it needs to be disable toot.

Step1. Change Build Script of Image Creation

Remove the hafnium, optee, trusted service from the “$workspace/build-scripts/build-all.sh”

diff --git a/build-all.sh b/build-all.sh
index a6717fa..b513b1b 100755
--- a/build-all.sh
+++ b/build-all.sh
@@ -8,12 +8,8 @@ for_each_build_script() {
     # Scripts are ordered so that components that depends on others are built last
     local scripts=(
         "build-scp.sh"
-        "build-hafnium.sh"
         "build-linux.sh"
-        "build-optee-os.sh"
-        "build-optee-test.sh"
         "build-u-boot.sh"
-        "build-trusted-services.sh"
    )

 if [ -d "$SRC_DIR/trusty" ]; then