If you ever wanted to experiment with ARM Trustzone, and IoT security, you’ll soon be able to do so with the Raspberry Pi 3 board thanks to a port of Linaro OP-TEE (Open Portable Trusted Environment Execution) by Sequitur Labs.
OP-TEE Architecture: optee_client, optee_linuxdriver and optee_os
Broadcom BCM2737 SoC found in Raspberry Pi 3 board already had TrustZone hardware for isolation and protection for sensitive material such as cryptographic keys, algorithms and data, but the upcoming software release will mean the feature can now be used, and it’s free for trial/evaluation, and education. Trustzone is also used for DRM (digital rights management), but in the case of Raspberry Pi 3 it will most likely used to teach how to secure the Internet of Things (IoT).
The release is scheduled for July 11, with source code and documentation to be available in OP-TEE github account. All you’ll need to get started is a Raspberry Pi 3 board, a micro SD card to load, a Bus blaster, a custom cable to enable bare metal debugging, a single firmware image with 64-bit Linux, ARM Trusted Firmware, and OP-TEE image, OpenOCD and the configuration file for the Raspberry Pi 3, as well as some code samples and a quick start guide.
Support for OP-TEE will be provided through forums on Linaro.
Last month, we found out that Arrows Electronics was working on DragonBoard 600c development board featuring Qualcomm Snapragon 600 processor and based on 96Boards CE Extended version which allows for extra features such as SATA and Ethernet ports. At the time, the complete specifications were not available, and neither pricing. We do now have more details, as the board designed by Elinfochips is (also) called SD 600eval, and is available on back order for $279.
Click to Enlarge
SD 600eval specifications:
SoC- Qualcomm Snapdragon 600 (APQ8064) quad-core Krait 300 processor @ up to 1.7 GHz with Adreno 320 GPU @ 400MHz supporting OpenGL ES 1.1/2.0, OpenCL 1.1, WebGL 1.0, and DirectX 9.3
System Memory – 2GB PoP LPDDR2 @ 533 MHz
Storage – 16GB eMMC Flash + micro SD 3.0 (UHS-1) slot + SATA port
Dimensions – 100 x 100 mm (96Boards Consumer Edition Extended dimensions specifications)
Operating Temperature Range – 0 to 50 deg. C
Click to Enlarge
The company provides Android 5.1 with Linux 3.4 support for the board, and Linaro will provide the Linux BSP for D 600eval/Dragonboard 600c, so hopefully a more recent Linux kernel will be supported. There are several links to software and hardware documentation, source code and binaries on the “Resources” section of the product page, including schematics (PDF) and hardware user manual.
I purchased Qualcomm DragonBoard 410c development board last year, and first tested it and run some benchmark on the 96Boards compliant hardware with Android. I found that it was still work-in-progress, and decided to wait before trying Debian on the board. I’ve now done so, and will report by experience installing Debian Linux, playing with the board, and running Phoronix benchmarks to compare it to other ARM Linux boards.
Installing Debian on DragonBoard 410c
The first challenge is to navigate through the documentation that is not always clear or up-to-date. I eventually ended up on DragonBoard 410c Wiki on Github.
You then have to decided which image you want. While there are two official operating systems with Android and Debian, you can three “entities” releasiong their own images. For Debian specifically, you have the Linaro image, and Reference Platform Build (RPB) image. I could not find any changelog or known issues with the former, but the latter as its own Wiki with the latest release being RPB 16.03 (March 2016), and the next one scheduled to be RPB 16.06 in June.
That’s the current list of known issues
bug 285 USB host doesn’t detect any plugged devices
bug 121 [RPB] Cannot soft power off or shutdown db410c
bug 284 [RPB] Dragon board Display sleep not working
bug 289 [RPB] USB devices don’t work after reboot
bug 207 [RPB] Bluetooth does not work on Dragon board debian
bug 153 [RPB] Missing information about hwpack usage
USB host not working did not inspire confidence, so I first tested the Linaro image. The (other) Wiki points to the “latest version”, but the link would point to Linaro Debian 16.02 release, while I could find a more recent Linaro Debian 16.04 which I downloaded in a terminal:
I used a micro SD card to install it. If you use Windows, simply use Win32DiskImager, but in computer running Linux or in Windows via Windows subsystem for Linux, you may want to do it in the terminal. First check the SD card device with lsblk. Mine was /dev/sdb, but your may be different, and I use /dev/sdX in the command below tp flash the Debian installer to a micro SD card:
Now remove the micro SD card from your computer and insert it in to the board, set the jumper to boot from SD card on the DragonBoard 410c, and connect the power. I could see LED 1 blinking, but nothing on my HDMI TV. Last time, I did not manage to make the serial console (requiring a 1.8V USB to TTL board or cable) using Hardkernel ODROID board, so I went to the support forums, and after several minutes of reading, I found that the RPB image is recommended, as well as a clear explanation between the Linaro and RPB images:
Use the Reference Platform Build instead of the Linaro release. The Reference Platform is an integrated build with support for multiple boards, and that is where all engineering effort is going. The Linaro build is the old single-platform image that we’re not working on anymore.
The reference platform will run on all 96boards CE (Consumer Edition) and EE (Enterprise Edition), while the Linaro image is built specifically for a given board, and they are not really working on it. [Update: This answer was specific to Hikey board, and for DragonBoard 410c there are two images provided by Qualcomm Landing Team and the Reference Platform team]
So let’s start again from scratch using the RPB image, and download the bootloader, Linux kernel and rootfs to my Ubuntu computer:
That was a lot of commands to install the operating system… Now you can unplug the board, remove the micro USB cable, and connect the power again. After a few seconds, you should see the kernel log, and eventually LXDE desktop environment.
Click to Original Size
You’ll be asked to configure WiFi, and you’re basically done.
DragonBoard 410c Debian System Info
I’ve then run a few command to learn more about the image and system:
Linux linaro-alip4.4.0-104-arm64#1 SMP Debian 4.4.0.linaro.104-1.linarojessie.1 (2016-03-01) aarch64 GNU/Linux
FilesystemSizeUsed Avail Use%Mounted on
Features:fp asimd evtstrm crc32
Features:fp asimd evtstrm crc32
Features:fp asimd evtstrm crc32
Features:fp asimd evtstrm crc32
One of the main advantage of 96Boards should be recent Linux version,and that’s exactly what we have here with Linux 4.4 running on the board. Out of a total of 866MB reported RAM, 64MB is free, and the 6.9GB rootfs has 4.8 GB available to the user. Snapdragon 410 SoC is correctly reported as being a quad core Cortex A53 (0xd03) processor.
I used file utility to make sure a 64-bit rootfs is being used here:
The thing that often do not work on ARM Linux board are 3D graphics and hardware video decoding, so I’ve specifically tested these two, and also played with the pre-installed Chromium browser.
If I understand correctly the debian image comes with Freedreno open source graphics driver, and if that’s the case I have the first ever platform with working open source 3D graphics drivers:
vertex shader info:
fragment shader info:
vertex shader info:
fragment shader info:
So that means both framebuffer and X11 3D graphics acceleration are working. Nice !
I also tried to play Tuxracer as it was part of the board’s test results provided by Linaro.
sudo apt-getinstall extremetuxracer
It works, but it’s so slow that it’s barely playable (see video below).
I installed VLC to play 1080op h.264 videos, but based on the CPU usage the system is clearly using software decoding, and there’s no audio via HDMI. I’ve asked about those two issues on the forums about 24 hours ago, but I have yet to get a reply.
Chromium loads OK, but I did notice some freezes during use, and YouTube will struggle at full screen at 1080p, in similar way to many other low end ARM Linux platforms.
After over 3 hours the results are in. Bear in mind that the board does not have heatsink, just a metallic shield, and this may affects the performance. It’s also running an OS with a 64-bit ARM rootfs, while platforms like Raspberry Pi 3 features a 64-bit processor running 32-bit code.
Click to Enlarge
I like to check John the Ripper for multi-threaded performance.
While FLAC audio encoding is nice to single threaded performance.
In theory the CPU performance of Snapdragon 410 and Broadcom BCM2837 (as found in RPi 3) should be equal since both are quad core Cortex A53 processors @ 1.2 GHz, but for some reasons DragonBoard 410c is a little slower in the multi-threaded benchmark, and quite faster during FLAC audio encoding likely due to software differences (Aarch64 vs Aarch32).
We’ve already seem Intrinsyc’s Snapdragon 820 development board and module, but there’s now an alternative thanks to Inforce Computing 6601 micro SoM which is pin-to-pin compatible to the company’s earlier Inforce 6401 and Inforce 6501 Micro SOMs, also based on Qualcomm Snapdragon processors, and works with the same SYS6501 carrier board.
Click to Enlarge
Inforce Computing 6601 Micro SoM specifications:
SoC – Qualcomm Snapdragon 820 (APQ8096) quad core ARMv8 processor with two “Gold” cores up to 2.2 GHz, two “Silver” cores up to 1.6 GHz, Adreno 530 GPU with support for OpenGL ES 3.2, OpenCL 2.0, and Vulkan, as well as Hexagon 680 DSP up to 825 MHz
System Memory – 4GB LPDDR4 @ 1866 MHz
Storage – 64GB UFS 2.0 gear 3 flash up to 5.83Gbps, 1x micro SD card 3.0 interface for support for to HS400, optional eMMC 5.1 flash.
Connectivity – Bluetooth 4.1 & 2×2 dual band 802.11 b/g/n/ac Wi-Fi (QCA6174), and GPS (WGR4310)
Peripherals and I/O via two 100-pin SoM connectors:
Codec support for MP3, AAC + eAAC, WMA 9/Pro, Dolby AC-3, eAC-3, DTS
Camera – 3x MIPI-CSI (3x 4-lane) up to 28 MP with zero shutter lag
USB – 1x USB 2.0 host port, 1x USB 3.0 host/OTG port
1x PCIe, 1x SDC, SLIMBUS
JTAG, 8x GPIO, 12x BLSPs for UART, I2C, and SPI
Video / Image Capabilities
H.264 playback and capture @4K60
H.265 playback @4K60 and capture @4K30
VP9 playback up to 4K60
Dual 14-bit Spectra ISP with support for up to 1.2GPix/sec throughput
Power Supply – +3.3V/6A DC input; On-module MA8996 MIC
Dimensions – 50 x 28 mm
Weight – 11 grams
Temperature Range – Operating: 0° C to 70° C; Storage: -20° C to 80° C
Certifications – RoHS and WEEE compliant, FCC.
6601 Micro SoM Block Diagram – Click to Enlarge
The company provides Android 6.0 Marshmallow / Linaro Ubuntu Linux BSPs for the module, as well as several free Qualcomm SDK such as Vuforia VR, Alljoyn proximity connectivity, FastCV computer vision, Symphony System Manager, and Snapdragon for facial recognition. SYS6601 development kit includes a Inforce 6601 Micro SOM pre-loaded with either Linux and Android, a mini-ITX baseboard, and other accessories.
Hikey is a one of the first 96Boards compliant development board manufactured by either LeMaker in China and CircuitCo in the US, and while the hardware requirements of 96Boards specifications are rather easy to meet, the software requirements including “bootloader (open source), accelerated graphics support (binary or open source), a Linux kernel buildable from source code based from mainline, or the latest Google-supported Android kernel version” are much harder to comply with. Linaro had a very good news for Linaro Connect Bangkok as they announced Hikey board was supported in Android Open Source Project (AOSP).
So that means Hikey board will run the latest version of Android like Google Nexus devices, with the advantage of also getting more recent devices.
If you want to build an Android image from AOSP just retrieve the source code:
If you are interested in finding out how Linaro managed to do this feat, and what kind of challenges they had to overcome, you may want to watch Linaro Connect “HiKey and AOSP collaborative experience” presentation.
You can also download the presentation slides for a quick look. Some interesting tidbits in the talk include that Google plans to use Linaro’s Linux 4.4 experimental tree, and Rockchip is also working on doing porting some hardware to AOSP.
There are two versions of Linaro’s 96Boards specifications the Consumer Edition (CE) and the Enterprise Edition (EE) with higher hardware requirements, and while several boards mostly compliant with 96Boards CE are available such as DragonBoard 410c and Hikey boards, the only board announced to be compliant with 96Boards EE specifications was AMD Huskyboard based on Opteron A1100 series processor and is yet to be available for sale. LeMaker has now designed a similar EE boards called Cello.
Debugging – micro USB port for console access, 10-pin JTAG connector
Power Supply – 4-pin power connector
Dimensions – 160×120 mm as per 96Boards EE specifications
Weight – 500 grams (Package weight)
The board don’t show an heatsink, but the holes are there, and considering the SoC has a whopping 25W TDP, an heatsink and likely fan will likely be required. There’s also no information about operating systems, but the latest Linaro Reference Platform release for Enterprise supports Debian 8.3 and an image based on Centos 7.2, as well as UEFI with ACPI, KVM and PCIe support.
[Update: So I’ve been watching Linaro BKK 2016 keynote, and there was a demo with Huskyboard (similar to Cello featured in that post) running the developer preview of Red Hat Enterprise Linux Server release 7.2 (MaiPo). That’s what the board is supposed to look like with a heatsink and fan. They’ve also added a PCIe network card to show that PCIe is also working
Bubblegum-96 development board was unveiled nearly a year ago, and finally the Actions Semi S900 quad core Cortex A53 board compliant with Linaro’s 96Boards specifications will soon go on sale for $89. Most 96Boards development boards take a while to come to market, likely due to the software requirements.
Click to Enlarge
uCRobotics Bubblegum-96 specifications:
SoC – Actions Semi S900 quad core Cortex A53 @ up to 1.8 GHz with PowerVR G6230 GPU @ 600 MHz
Misc – On/off, reset, and ADFU (firmware update) buttons
Power Supply – 8-18V DC via 4.8/1.7mm power barrel; ATC2609 PMIC;
Dimensions – 85 x 54 mm (96Boards compliant)
Certifications – CE, FCC, Google GMS
The board runs Android 5.1 Lollipop, Debian Linux, Remix OS 2.0, and while not listed Phoenix OS logo is also shown. Several person has recently asked about the manufacturing process of the 64-bit ARM SoC, and S900 is built with 28nm LP process. Generally, processors using 40nm process are limited to around 1.2 GHz, while processor manufacturer using 28nm process technology can be clocked much higher and up to 2.0 GHz. Whether they can sustain that depend on software and the cooling solution.
The board is listed on 96boards.org website, and the Wiki page on Github has been setup but so far very little info has been posted, and the forums are completely inactive, but I’m sure soon enough many more details will be provided. It’s supposedly for sale, but all you can do is to “subscribe an order” for $89 by leaving your name and email on uCRobotics’ Bubblegum-96 product page.
Linaro Connect Bangkok (BKK16) will take place on March 7 – 11, 2016, and the schedule is now available for the 5-day event with keynotes and sessions. Whether you’re going to attend or not, it’s always interesting to check the schedule to find out what’s going on in terms of ARM Linux development.
The five days will focus on work by different Linaro groups, but really sessions are mixed for any given day, and I’ve created a virtual schedule for each day with available information, as Linaro has become a little more closed to the outside than when it was launched a few years ago.
Monday 7 – LITE (Linaro IoT & Embedded Group)
1400 – 14:50 – Evolution of the Reference Software Platform Project
The Reference Software Platform lead project was introduced in Linaro Connect San Francisco 2015, and since then it evolved and matured with the completion of the first tree big milestones (the 15.10, 15.12 and 16.03 releases). This session will revisit the work done as part of the previous releases, covering the projects that were incorporated through the process and our vision for the future milestones.
15:00 – 15:50 – Budget Fair Queueing heuristics in the block layer
The Budget Fair Queue (BFQ) I/O scheduler in the Linux block layer is a new heuristic approach to improving user-perceived latencies in block accessible media such as hard disks, SSD and (e)MMC and SD cards. Linaro is investing and helping in pushing this development ahead. The session describes what the BFQ patch set does and how.
– – A Gentle Introduction to Trusted Execution and OP-TEE
Smart connected devices such as mobile phones, tablets and Digital TVs are required to handle data with strong security and confidentiality requirements. A “Trusted Execution Environment” (TEE) provides an environment for processing data securely, protected from normal platform applications. This talk is intended as an introduction to Trusted Execution, and the open-source Trusted Execution Environment OP-TEE in particular. It introduces the GlobalPlatform TEE Specifications, explains how Trusted Execution is implemented by ARM TrustZone and OP-TEE, and outlines how trusted boot software manages the secure boot of an ARM platform. Finally, it gives some pointers on how to get started with OP-TEE.
Tuesday 8 – LHG & LMG (Linaro Digital Home Group and MObile Group)
– – PlayReady OPTEE Integration with Secure Video Path
This presentation provides a current view of the Security work performed in LHG. The focus is on hardware protected DRM integrated with OP TEE, creation of a Secure Data Path coupled with the Open Content Decryption Module, and the lessons learned from integrating third party libraries into trusted applications.
– – AOSP RAM reduction project retrospective
The Goal: Reduce AOSP memory requirements without hurting performance too badly.
What was tried:
Make use of new features in updated toolchains
Split libraries into smaller parts
Replace the memory allocator
– – Chromium with V4L2 playback – is it ready today?
This BOF session will analyze architectural challenges migrating Chromium from the desktop to embedded devices. The impacts of different GPU libraries with their respective limitations will be discussed. We welcome audience participation in an open discussion on the V4L2 adaptation in Chromium.
– – What’s broken on ARM64?
The arm64 port is now in pretty good shape with most things ported and built in distros. However we know that there is plenty of software that is not optimised and some may not actually work at all. Please come along and moan about anything you have found which doesn’t work as well on arm64 as it does on x86. We (Linaro, ARM and Debian) want your feedback on where to direct effort next.
– – How to generate power models for EAS and IPA (without talking to a hardware engineer)
Generating a specific power model for the platform is a pre-requirement for deploying EAS (Energy Aware Scheduler) and IPA (Intelligent Power Allocation). This makes understanding power models and how to generate parameters for them a useful skill. In this session we demonstrate how to use workload automation to gather power data from a board. We will then describe how to derive rough values for the EAS and IPA power models using nothing but this easily observable data. We will not rely on any information provided by OEM or SoC vendor.
– – Upstreaming 201
This session is an advanced course on Linux kernel upstreaming fundamentals. The course covers how the arm-soc kernel tree is maintained and why that is important to ARM Linux kernel developers. The focus of the course is the explanation of the detailed mechanics of creating and posting patch series to upstream mailing lists for several common cases. Annotated session content is made up of previously upstreamed ARM support captured from emails to the kernel mailing lists. The target audience is both software engineers and engineering managers preparing to upstream software into the kernel. The topic requires a solid background in software configuration management terminology and the git SCM tool as well as a good technical understanding of the Linux kernel itself.
Wednesday 9 – LEG (Linaro Enterprise Group)
This presentation provides the background for the requirements of the latest 96Boards TV Platform specification. It describes the range of set-top features that can be delivered and focuses on the key software and firmware support.
– – ARMv8 Server Lab Users BoF
The ARMv8 Server Lab has been up and running for more than a year since the inception in the late Fall of 2014 and helped continuously those who need server-grade hardware to verify their software, from the kernel to user applications. In this BoF at BKK16, the Server Lab users get together for the first time to review what we have accomplished so far and share knowledge obtained from our experiences in the Lab. Constructive feedback from the users should shape the direction of the Lab in the coming months of 2016. The BoF structure is as follows: possibly a few short talks from the users, 10-15 minutes each, will be given after the introductory address of the status of the Lab from the managers, followed by a discussion between the attendees.
– – ILP32 Performance on AArch64
ILP32 is a programming model that may be useful on AArch64 systems for performance and also for legacy code with 32-bit data size assumptions. We combined ILP32 support from upstream projects with the LEAP distribution to enable experimentation with this model. This talk discusses the relative benchmark performance of the LP64 and ILP32 programming models under AArch64.
– – The tool called Auto-Tuned Optimization System (ATOS)
ATOS is an Auto Tuning Optimization System that is able to find automatically the best performance/size tradeoff from a build system and a training application. The input of ATOS tools are a build command and a run command. From the build command, ATOS will infer an internal build configuration that it will run with different sets of compiler options. These build configurations are executed with the run command from which code size and performance will be extracted.
From the set of build configurations that ATOS explores, one can extract the preferred trade-off between code size and performance. The extracted build configuration can be archived and replayed later in order to generate the optimized executable without any modification into the initial build system.
The nice property of ATOS is that NO modification of the sources or the makefiles are needed. ATOS can work on any large/deep project, as soon as the compiler used is gcc or LLVM under Linux.
– – Integrating and controlling embedded devices in LAVA
Previous introductory tutorials on LAVA have focused on virtual platforms. This is an end-to-end tutorial as a basis to evaluate LAVA with one or more embedded targets using U-Boot. It integrates both a physical bootloader device with a stand-alone installation of LAVA, along with a simple PDU for target power control which is based on off-the-shelf Arduino components and fully integrated with pdudaemon. It covers device requirements, device configuration for 32- and 64-bit platforms, use of lavatool, tftp, pduclient and logging via the LAVA web interface and /var.
– – ARMv8 Firmware Mini-Summit
Current state of ACPI on ARM
Support/backing for a longer term organization: mailing lists ([email protected]), web sites, further meetings…
Use of _DSD device properties
Follow-up on others items from the last meeting (mostly promised documents).
Thursday 10 – LNG (Linaro Networking Group)
– – Android HAL Consolidation Status
Update on progress and discuss next steps on Android HAL consolidation Lead Project
– – Applications on ODP
Session discussion on various opensource applications on ODP and their implementations. Applications to be discussed include NGiNX, TRex, OFP
– – Device Tree Standardization
Announcement of the process to update the old specs and kernel documentation into a new Device Tree Specification
– – Workspace setup tips and tricks
The complexity of the tools and working environments is very high in IT area, especially in software engineering field. Thanks to Linux’s freedom of choice and flexibility it gets even higher. Due to the amount of time needed for learning all those bits of technology, it is not practically possible to set up an ideal workspace without talking to others and learning the results of their research. So, let’s come together and discuss hardware/software setups for our workspaces and learn from each other.
Friday 11 – 96Boards and Community
– – Kernel and bootloader consolidation and upstreaming
An update to the state of reference platform kernel and bootloader and a discussion about the patch-inclusion policy. We’ll also cover roadmap plans. Participation is invited if you have ideas on how we can make it easy to use the reference platform kernel for your development projects.
– – 96Boards mezzanine hardware ecosystem
An overview of the work being done to support the mezzanine hardware ecosystem. Will cover the tools available, the boards that have already been created, and materials provided to support mezzanine board designers.
Materials require having registered to Linaro Connect BKK16, but several PDF slides have been uploaded to Linaro slideshare, you can get a peak if one subject interests you.
Anybody can attend, but you’ll need to purchase tickets ranging from 500 GBP ($726) for one day to 1,600 GBP ($2323) for the full week, unless you are a student,work in academia, or open source projects connected with ARM development, in which case you may get a free ticket.