tee/libteec: Add optee_client/libteec library

Support for downloading, patching and linking against
optee_client/libteec by NuttX apps. Defaults to version
4.6.0.

Enabled with CONFIG_LIBTEEC.

More info:
 - https://github.com/OP-TEE/optee_client
 - https://optee.readthedocs.io/en/latest/architecture/globalplatform_api.html#tee-client-api
 - https://globalplatform.org/specs-library/?filter-committee=tee (GPD_SPE_007)

Signed-off-by: George Poulios <gpoulios@census-labs.com>

tee/.gitignore

@@ -0,0 +1 @@
+/Kconfig

tee/CMakeLists.txt

@@ -0,0 +1,25 @@
+# ##############################################################################
+# apps/tee/CMakeLists.txt
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more contributor
+# license agreements.  See the NOTICE file distributed with this work for
+# additional information regarding copyright ownership.  The ASF licenses this
+# file to you under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License.  You may obtain a copy of
+# the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+# License for the specific language governing permissions and limitations under
+# the License.
+#
+# ##############################################################################
+
+nuttx_add_subdirectory()
+
+nuttx_generate_kconfig(MENUDESC "TEE Libraries Support")

tee/Make.defs

@@ -0,0 +1,21 @@
+############################################################################
+# apps/tee/Make.defs
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.  The
+# ASF licenses this file to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance with the
+# License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+############################################################################
+
+include $(wildcard $(APPDIR)/tee/*/Make.defs)

tee/Makefile

@@ -0,0 +1,23 @@
+############################################################################
+# apps/tee/Makefile
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.  The
+# ASF licenses this file to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance with the
+# License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+############################################################################
+
+MENUDESC = "TEE Libraries Support"
+
+include $(APPDIR)/Directory.mk

tee/libteec/.gitignore

@@ -0,0 +1,3 @@
+/optee_client
+/*.zip
+/*.tar.gz

tee/libteec/0001-libteec-NuttX.patch

@@ -0,0 +1,47 @@
+From 70a12eb84a1276cad15bc2ac867ffad513d5c732 Mon Sep 17 00:00:00 2001
+From: George Poulios <gpoulios@census-labs.com>
+Date: Sun, 11 May 2025 00:44:22 +0300
+Subject: [PATCH] libteec: NuttX patches
+
+Fix use of gettid() syscall in teec_trace.c and
+replace include of linux/tee.h with nuttx/tee.h.
+
+Signed-off-by: George Poulios <gpoulios@census-labs.com>
+---
+ libteec/src/tee_client_api.c | 6 +++++-
+ libteec/src/teec_trace.c     | 2 +-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/libteec/src/tee_client_api.c b/libteec/src/tee_client_api.c
+index 512fdac..b54e0b6 100644
+--- a/libteec/src/tee_client_api.c
++++ b/libteec/src/tee_client_api.c
+@@ -44,7 +44,11 @@
+ #ifndef __aligned
+ #define __aligned(x) __attribute__((__aligned__(x)))
+ #endif
+-#include <linux/tee.h>
++#ifdef __NuttX__
++#  include <nuttx/tee.h>
++#else
++#  include <linux/tee.h>
++#endif
+ 
+ #define MIN(x, y) (((x) < (y)) ? (x) : (y))
+ 
+diff --git a/libteec/src/teec_trace.c b/libteec/src/teec_trace.c
+index 7194c8c..025cc4b 100644
+--- a/libteec/src/teec_trace.c
++++ b/libteec/src/teec_trace.c
+@@ -75,7 +75,7 @@ void _dprintf(const char *function, int line, int level, const char *prefix,
+ 	va_list ap;
+ 
+ 	if (function) {
+-		int thread_id = syscall(SYS_gettid);
++		int thread_id = (int)gettid();
+ 
+ 		n = snprintf(msg, sizeof(msg), "%s [%d] %s:%s:%d: ",
+ 			trace_level_strings[level], thread_id, prefix,
+-- 
+2.34.1
+

tee/libteec/CMakeLists.txt

@@ -0,0 +1,59 @@
+# ##############################################################################
+# apps/tee/libteec/CMakeLists.txt
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Copyright (C) 2023 Xiaomi Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy of
+# the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations under
+# the License.
+#
+# ##############################################################################
+
+if(CONFIG_LIBTEEC)
+
+  set(OPTEE_CLIENT_DIR ${CMAKE_CURRENT_LIST_DIR}/optee_client)
+
+  if(NOT EXISTS ${OPTEE_CLIENT_DIR})
+    FetchContent_Declare(
+      optee_client_fetch
+      URL https://github.com/OP-TEE/optee_client/archive/refs/tags/${CONFIG_LIBTEEC_VERSION}.tar.gz
+          SOURCE_DIR
+          ${OPTEE_CLIENT_DIR}
+          BINARY_DIR
+          ${CMAKE_BINARY_DIR}/tee/libteec/optee_client
+      PATCH_COMMAND patch -p1 -d ${OPTEE_CLIENT_DIR} <
+                    ${CMAKE_CURRENT_LIST_DIR}/0001-libteec-NuttX.patch
+      DOWNLOAD_NO_PROGRESS true
+      TIMEOUT 30)
+
+    FetchContent_GetProperties(optee_client_fetch)
+
+    if(NOT optee_client_fetch_POPULATED)
+      FetchContent_Populate(optee_client_fetch)
+    endif()
+  endif()
+
+  set_property(
+    TARGET nuttx
+    APPEND
+    PROPERTY NUTTX_INCLUDE_DIRECTORIES ${OPTEE_CLIENT_DIR}/libteec/include)
+
+  nuttx_add_library(libteec STATIC)
+
+  target_sources(libteec PRIVATE optee_client/libteec/src/tee_client_api.c
+                                 optee_client/libteec/src/teec_trace.c)
+  target_include_directories(libteec
+                             PRIVATE ${OPTEE_CLIENT_DIR}/libteec/include)
+  target_compile_definitions(libteec PRIVATE BINARY_PREFIX=\"TEEC\")
+
+endif()

tee/libteec/Kconfig

@@ -0,0 +1,45 @@
+############################################################################
+# apps/tee/libteec/Kconfig
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Copyright (C) 2023 Xiaomi Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+############################################################################
+
+config LIBTEEC
+	bool "TEE client library (libteec)"
+	default n
+	---help---
+	        Enable libteec from https://github.com/OP-TEE/optee_client. This
+	        is OP-TEE project's implementation of GlobalPlatform's TEE client
+	        API specification v1.0 (GPD_SPE_007):
+	         https://globalplatform.org/specs-library/?filter-committee=tee
+	        The TEE Client API describes and defines how a client running in
+	        a rich operating environment (REE, in this case NuttX) should
+	        communicate with the Trusted Execution Environment (TEE) and its
+	        Trusted Applications (TAs). The library provides a
+	        well-established and easy-to-use interface abstracting away much
+	        of the details of the underlying subsystems. For more information
+	        please refer to:
+	        https://optee.readthedocs.io/en/latest/architecture/globalplatform_api.html#tee-client-api
+
+if LIBTEEC
+
+config LIBTEEC_VERSION
+	string "optee_client version (4.6.0)"
+	default "4.6.0"
+
+endif # LIBTEEC

tee/libteec/Make.defs

@@ -0,0 +1,46 @@
+############################################################################
+# apps/tee/libteec/Make.defs
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Copyright (C) 2023 Xiaomi Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+############################################################################
+
+ifneq ($(CONFIG_LIBTEEC),)
+CONFIGURED_APPS += $(APPDIR)/tee/libteec
+
+FLAGS += ${INCDIR_PREFIX}$(APPDIR)/tee/libteec/optee_client/libteec/include
+FLAGS += ${DEFINE_PREFIX}BINARY_PREFIX="\"TEEC\""
+
+ifneq ($(CONFIG_DEBUG_INFO),)
+  FLAGS += ${DEFINE_PREFIX}DEBUGLEVEL=3
+else ifneq ($(CONFIG_DEBUG_WARN),)
+  FLAGS += ${DEFINE_PREFIX}DEBUGLEVEL=2
+else ifneq ($(CONFIG_DEBUG_ERROR),)
+  FLAGS += ${DEFINE_PREFIX}DEBUGLEVEL=1
+else
+# the default DEBUGLEVEL are 1(with error level)
+  FLAGS += ${DEFINE_PREFIX}DEBUGLEVEL=1
+endif
+
+AFLAGS += $(FLAGS)
+CFLAGS += $(FLAGS)
+CXXFLAGS += $(FLAGS)
+
+DEPPATH += --dep-path libteec
+VPATH += :libteec
+
+endif

tee/libteec/Makefile

@@ -0,0 +1,52 @@
+############################################################################
+# apps/tee/libteec/Makefile
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Copyright (C) 2023 Xiaomi Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+############################################################################
+
+include $(APPDIR)/Make.defs
+
+LIBTEEC_VERSION = $(patsubst "%",%,$(strip $(CONFIG_LIBTEEC_VERSION)))
+LIBTEEC_URL ?= "https://github.com/OP-TEE/optee_client/archive/refs/tags"
+LIBTEEC_ZIP = $(LIBTEEC_VERSION).zip
+LIBTEEC_UNPACKNAME = optee_client
+UNPACK ?= unzip -q -o
+
+CSRCS += optee_client/libteec/src/tee_client_api.c
+CSRCS += optee_client/libteec/src/teec_trace.c
+
+$(LIBTEEC_ZIP):
+	@echo "Downloading: $(LIBTEEC_URL)/$(LIBTEEC_ZIP)"
+	$(Q) $(call DOWNLOAD,$(LIBTEEC_URL),$(LIBTEEC_ZIP))
+
+$(LIBTEEC_UNPACKNAME): $(LIBTEEC_ZIP)
+	@echo "Unpacking: $(LIBTEEC_ZIP) -> $(LIBTEEC_UNPACKNAME)"
+	$(Q) $(UNPACK) $(LIBTEEC_ZIP)
+	$(Q) mv $(LIBTEEC_UNPACKNAME)-$(LIBTEEC_VERSION) $(LIBTEEC_UNPACKNAME)
+	$(Q) echo "Patching $(LIBTEEC_UNPACKNAME)"
+	$(Q) patch -p1 -d $(LIBTEEC_UNPACKNAME) < 0001-libteec-NuttX.patch
+	$(Q) touch $(LIBTEEC_UNPACKNAME)
+
+ifeq ($(wildcard $(LIBTEEC_UNPACKNAME)/.git),)
+context:: $(LIBTEEC_UNPACKNAME)
+
+distclean::
+	$(Q) rm -rf $(LIBTEEC_UNPACKNAME)
+endif
+
+include $(APPDIR)/Application.mk