How to integrate Plug and Trust MW into OP-TEE

[Uc_S]

Hello NXP Community,

I am currently working on integrating the Plug and Trust Middleware with OP-TEE (Binding for MCUs with TrustZone) for our project.
I have reviewed AN12662 (Binding a host device to EdgeLock SE05x) Rev. 1.1, but I could not find detailed, step-by-step instructions or the specific sections covering the exact integration process.

Could you please point me to the specific sections or pages in AN12662 that cover this integration, or provide additional documentation/sample code showing how to build and integrate Plug and Trust MW with OP-TEE?

Here are my environment details:

Board: MCIMX8M-WEVK and OM-SE051ARD
Plug and Trust MW Version: v04.07.01
OP-TEE OS Version: 3.19.0
Linux Kernel: 6.1.151

Any guidance, application notes, or pointers to relevant code repositories would be greatly appreciated.

[Kan_Li]

Hi @Uc_S ,

Thank you for the detailed question. You are right that AN12662 Rev. 1.1 does not contain step-by-step build instructions for OP-TEE — it covers the conceptual binding architecture. The section most relevant to your use case is Section 3.2 (pages 12–13): "Binding for MCUs with TrustZone", which describes loading the Plug & Trust MW into the TEE so that SCP03 channel establishment is handled from within the Trusted Execution Environment.

The actual build integration is handled through a different path — here is a summary of the correct approach for your environment.

---

How it works

Rather than running the full Plug & Trust MW as a standalone TA inside OP-TEE, the supported approach is to use OP-TEE's built-in SE05x crypto driver (CFG_NXP_SE05X=y). This driver links the Plug & Trust MW as a static library at OP-TEE build time, allowing OP-TEE core to offload RSA, ECC, RNG, and other operations to the SE051.

---

Step 1 — Disable Linux I2C for the SE051 bus

The I2C controller connected to the SE051 must be owned exclusively by OP-TEE. You need a Linux DTB that disables that I2C interface so Linux does not probe it at boot. Build your board's DTB from a branch that includes this change, or manually disable the relevant I2C node in your DTS.

Step 2 — Build OP-TEE OS with SE05x driver

Point the build to your extracted Plug & Trust MW v04.07.01 directory via CFG_NXP_SE05X_PLUG_AND_TRUST. Example build command (adjust PLATFORM= for your board):

make -j8 PLATFORM=imx-mx8mevk   O=./build-imx8m-se050   CFG_TEE_CORE_LOG_LEVEL=4   CFG_NXP_CAAM=n   CFG_NXP_SE05X=y   CFG_IMX_I2C=y   CFG_STACK_{THREAD,TMP}_EXTRA=8192   CFG_NXP_SE05X_RSA_DRV=y   CFG_NXP_SE05X_ECC_DRV=y   CFG_NXP_SE05X_CTR_DRV=n   CFG_NXP_SE05X_RNG_DRV=y   CFG_WITH_SOFTWARE_PRNG=n   CFG_NXP_SE05X_PLUG_AND_TRUST=/path/to/plug-and-trust

If you want to keep CAAM enabled alongside the SE051 (e.g., CAAM handles AES/RNG, SE051 handles RSA/ECC), replace the CAAM flags accordingly:

CFG_NXP_CAAM=y CFG_NXP_CAAM_AE_{GCM,CCM}_DRV=y CFG_NXP_CAAM_RNG_DRV=y CFG_NXP_SE05X_RNG_DRV=n CFG_WITH_SOFTWARE_PRNG=n CFG_NXP_SE05X_{DIEID,RSA,ECC,CTR}_DRV=y CFG_NXP_SE05X_RSA_DRV_FALLBACK=y CFG_NXP_SE05X_ECC_DRV_FALLBACK=y CFG_CRYPTO_DRV_{CIPHER,ACIPHER,AUTHENC}=y

Step 3 — Verify SE051 is detected at OP-TEE boot

On successful boot, you should see output like the following in the OP-TEE console:

I/TC: se050: Info: Applet Major = 7
I/TC: se050: Info: OEF ID  a8.fa

OEF ID A8FA confirms you have an SE051C2 variant, which matches the OM-SE051ARD board.

---

Known caveats

• The MCIMX8M-WEVK (i.MX8MQ EVK) platform flag may differ slightly from imx-mx8mmevk. Adjust the PLATFORM= value to match your board.

• Running heavy OP-TEE crypto regression tests (e.g., xtest regression_4007_rsa) while RSA is offloaded to the SE051 can exhaust the SE051's persistent NVM. This is a known limitation — you can clear the SE051 NVM with ssscli se05x reset if needed.

• Your Linux Kernel 6.1.151 should work, but ensure the I2C controller node for the SE051 is fully disabled in the kernel DTS.

---

Useful external references

The Foundries.io team has published detailed public documentation on this exact integration, which is a good complement to the NXP application notes:

• Reference manual: https://docs.foundries.io/86/reference-manual/security/secure-elements/secure-element.050.html

• Blog Part I (I2C, early boot): https://foundries.io/insights/blog/se050-000.processor-to-se-comms/

• Blog Part II (SCP03 with OP-TEE): https://foundries.io/insights/blog/se050-001.scp03/

Please let me know if you run into any build issues and I will be happy to help further.

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[Uc_S]

Hello,  @Kan_Li 

Thank you very much for the detailed explanation and helpful references.

I will proceed with testing and verifying the integration steps based on your advice.
I will reach out again if I run into any further questions or issues.