Posted on by Shant Tchatalbachian

Secure Time Arm Trustedzone

Category: →

====================

User prompt 1 of 3 – 7/1/2026, 7:13:07 PM:
In arm64 is there a trusted zone clock source?

GPT-5.4 mini:
Considering ARMv8 Trusted Zone

I think the question might be about ARMv8 trusted zone and specifically related to “clock source.” It seems like I don’t need to check the web for this since it’s a technical topic that has enduring relevance. I want to keep my answer concise while mentioning secure world timers, which could be important in this context. Let’s get started on crafting that response!Yes—on ARM64 there can be a secure/“trusted” time source, but it depends on the SoC and firmware.

Typically:

  • Normal world uses the architectural generic timer.
  • Secure world (TrustZone) can use the same timer hardware with secure access, or a separate secure timer/clock source provided by the platform.
  • The architecture itself doesn’t mandate one single “trusted zone clock source”; the platform/firmware defines what secure timekeeping exists.

If you mean Linux/ARM64 specifically, the kernel usually exposes the generic timer, while secure-world timing is handled by firmware, secure monitor, or vendor-specific hardware.

If you want, I can explain the ARMv8 timer architecture and how TrustZone access control works.

User prompt 2 of 3 – 7/1/2026, 7:16:23 PM:
Yes in the context of rk3399, and rk3588 running u-boot optee-os and arm trusted firmware

GPT-5.4 mini:
Evaluating secure timer source

I need to provide a concise answer. It seems the likely secure timer source is CNTPCT, rather than a separate trusted zone clock. I should also mention that both RK3399 and RK3588 are supported platforms for this secure time source configuration. When crafting my response, I’ll ensure to include the necessary citations to back up my statements. This way, I can make sure the information is reliable and well-supported!Yes: on RK3399 and RK3588 the usual “trusted” time source in OP-TEE is the ARM generic timer counter, typically CNTPCT, exposed via CFG_SECURE_TIME_SOURCE_CNTPCT. OP-TEE’s porting guide says a fully trustable platform should use a secure clock for tee_time_get_sys_time() / tee_time_get_ta_time(), but it’s also OK to fall back to REE time if the hardware/platform doesn’t provide one.

So in practice:

  • Secure world time: often the generic timer counter, read from secure world
  • No special TrustZone-only clock mandated by ARM
  • If you need higher trust, the platform must provide a real secure clock path; otherwise OP-TEE uses the counter/REE time model depending on the port.

For RK3399/RK3588 specifically, this is the normal setup in OP-TEE ports, and both platforms are supported.

If you want, I can show where this is wired in TF-A/OP-TEE for RK3399 vs RK3588.

User prompt 3 of 3 – 7/1/2026, 7:26:37 PM:
Yes

GPT-5.4 mini:
Searching for citations

I see that I need a factual answer with citations from web search results, but I can’t see citation sources 3 and 10. It seems like a good idea to conduct a targeted search to find the necessary information. I’ll focus on ensuring that I gather reliable data to support my response, as it’s important to have accurate references when discussing real-world topics. Let’s get started on that search!Searching for TF-A/OP-TEE info

I need to find a concise answer regarding the wiring for TF-A/OP-TEE on rk3399/rk3588. I should look into the OP-TEE config in platform conf.mk and also check timer_a64.c. It seems like reading the documentation on porting guidelines would be helpful too. So, I’ll search for timer_a64.c in relation to rk3399/rk3588, possibly on GitHub to find the source code or any related details.Looking into secure clock support

I need an answer that likely comes from the documentation. It might be useful to mention specific files that aren’t board-specific. In OP-TEE, I know the secure clock support is found in core/arch/arm/kernel/timer_a64.c for AArch64 builds, and the board configuration activates CFG_SECURE_TIME_SOURCE_CNTPCT in the platform conf.mk. I should provide a source from the docs that illustrates the config option and the secure clock concept to answer comprehensively.On both RK3399 and RK3588, the usual wiring is the same:

  • TF-A provides the EL3 monitor/secure monitor path for switching worlds.
  • OP-TEE is configured to use the secure generic timer counter as its secure time source, usually via CFG_SECURE_TIME_SOURCE_CNTPCT=y.
  • The actual AArch64 timer code path is in OP-TEE’s core/arch/arm/kernel/timer_a64.c for secure-world timer handling. The porting docs explicitly show CFG_SECURE_TIME_SOURCE_CNTPCT as the platform setting for the secure time source, and they describe that a real secure clock is optional but preferred for tee_time_get_sys_time() / tee_time_get_ta_time().

So the short answer is: yes, but it’s not a separate RK3399/RK3588 “TrustZone clock”. It’s typically the ARM generic timer counter exposed to secure world, with the platform choosing whether to treat it as the secure time source.

If you want to verify it in your tree, look for:

  • CFG_SECURE_TIME_SOURCE_CNTPCT in the board/platform conf.mk
  • core/arch/arm/kernel/timer_a64.c
  • TF-A build using SPD=opteed on RK3588 (and the equivalent RK3399 platform port)