Hi everyone,

I've made a post a couple of months ago regarding ARM TrustZone support (can be found here.
In short: I wanted to research working with ARM TrustZone on non-Android devices, and as there seemed to be almost no documentation available I asked here.

Now, after a quite some time of back-and-forth I've got some insights on the architecture and links between the different components (ARM TrustZone/Trusted Execution Engine -> Kernel -> Secure/Rich OS).

The goal of this post is two-fold:

1. Share the stuff I've learned so it hopefully helps others treading the same or a similar path.
2. Verify my assumptions and possibly help me answer one or two questions, which are solely regarding building a binary using the UT built libraries that Android also has (most notably the keymaster stuff).

Regarding the first point:
An Android install utilizing a Trusted Execution Environment (which is every phone nowadays) looks like the following from an OS perspective:

Quick Explanation:

• The Rich OS is the userspace, here all apps reside and run.
• The Trusted Execution Environment is strictly separated from the Rich OS, only exposing API functions as provided in a TEE Client API
• The Kernel is able to communicate with both the Rich OS and TEE.

Now, my assumption regarding an Ubuntu Touch installation looked something like this:

As you can see, in this image, all components (Rich OS, Kernel and TEE) have been replaced with Ubuntu Touch variants. This led me to believe that Ubuntu Touch would have a documented TEE Client API (which was not the case).
After some more research, I realised that Ubuntu Touch is not reimplementing all the stuff Android provides in their libraries (i.e. hidl definitions, keymaster etc). Instead, it only compiles them against the Ubuntu Touch libc++.
This can easily be verified: Take any Android shared object file, locate the same file on Ubuntu Touch and from a terminal use nm:

nm -D -C <.so-file>

This results in the outputting of all symbols in their respective files.
For Android, the namespace they're compiled into is std::__ndk1, which is the namespace used for bionic.
For Ubuntu Touch, the namespace is std::__1, which is the libc++ namespace.

As a conclusion, after installing Ubuntu Touch the system (to my knowledge) looks like this:
.

This means that theoretically, all the Android shared objects are still there and should work as expected (given some restrictions).

At this point, I've tried cross-compiling a simple C++ binary for Ubuntu Touch. Not a problem whatsoever, as long as I don't use any of the more exotic libraries (keymaster from android/hardware/keymaster/3.0/ in my case).
This is where it all starts to get a little hairy: No matter what I do, I am unable to build a binary utilizing an android library for Ubuntu Touch.
I tried

• cross-compiling
• compiling natively on the phone inside of a libertine container
• Compiling against the Android NDK and changing the namespace to match the symbols present in Ubuntu Touch libraries

None have worked so far, with only two options left:

1. I have overlooked something essential, as the Ubuntu Touch platform has to have a way to compile for their own platform (or we would be using std::__ndk1 stuff still).
2. Have some sort of compatibility layer (I know about Halium). In regards to this: I've found some stuff about libhybris which might be helpful, but documentation is sparse.

This is also where my questions come in: Can any of you offer insight on if libhybris could possibly solve my problem?
Any insight is very welcome, sorry for the long and detailed post Thank you all in advance!

TL;DR: Trusted Execution Environment is a great thing, documentation is sparse. How do I build a native binary using .so files that Android also has, but are newly compiled for Ubuntu Touch/How do I use libhybris?

@ikoz Thanks for the response!

Yeah my understanding matches yours, however to me it seems that most ARM Cortex-A series CPUs should support ARM TrustZone by default, even running on a non-secure kernel.

I did find code for some implementations of the Trusted Execution Engine (see: https://github.com/mqttz/optee-apps/tree/master which is code for benchmarking MQTT TZ).

However I also couldn't find anything in regards to other linux-based mobile operating systems (or even any desktop distro for that matter), or even Android. Which begs the question: Is nobody but Android using it at all? And even for Android it seems to be a proprietary implementation (which isn't surprising, as this alone keeps a lot of Android folk away from any other non-Android/Apple device).

Hi Ubuntu Touch Community,

I hope you all are doing well.
I'm a software developer currently researching getting ARM TrustZone/Trusted Execution Engine running on non-Android operating systems. This would allow different applications, like eGovernment apps, to run on operating systems with TrustZone support even if the device can't provide any biometric data (e.g. fingerprint). Maybe the user just doesn't want to use those features.

However, I haven't been able to find any specific information in the documentation about whether Ubuntu Touch provides any interfaces or support for ARM TrustZone. It's possible I might have missed it, so I wanted to reach out to the community here.

Could anyone provide me with some insight into whether Ubuntu Touch has any support or planned support for ARM TrustZone? Any pointers or guidance would be greatly appreciated, even if not specifically Ubuntu Touch related.

Thank you in advance for your help!