{"id":1184,"date":"2026-07-07T21:10:18","date_gmt":"2026-07-08T04:10:18","guid":{"rendered":"https:\/\/xn--y9aq2bc.com\/?p=1184"},"modified":"2026-07-07T21:12:22","modified_gmt":"2026-07-08T04:12:22","slug":"secure-time-arm-trustedzone","status":"publish","type":"post","link":"https:\/\/xn--y9aq2bc.com\/?p=1184","title":{"rendered":"Secure Time Arm Trustedzone"},"content":{"rendered":"<div class=\"taxonomy-category wp-block-post-terms\"><span class=\"wp-block-post-terms__prefix\">Category: <\/span><a href=\"https:\/\/xn--y9aq2bc.com\/?cat=223\" rel=\"tag\">LLM Chats<\/a><span class=\"wp-block-post-terms__separator\">\u2192<\/span><a href=\"https:\/\/xn--y9aq2bc.com\/?cat=224\" rel=\"tag\">Technical Solutions<\/a><\/div>\n\n\n<p class=\"wp-block-paragraph\">====================<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">User prompt 1 of 3 &#8211; 7\/1\/2026, 7:13:07 PM:<br>In arm64 is there a trusted zone clock source?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">GPT-5.4 mini:<br><strong>Considering ARMv8 Trusted Zone<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I think the question might be about ARMv8 trusted zone and specifically related to &#8220;clock source.&#8221; It seems like I don\u2019t need to check the web for this since it\u2019s a technical topic that has enduring relevance. I want to keep my answer concise while mentioning secure world timers, which could be important in this context. Let\u2019s get started on crafting that response!Yes\u2014on ARM64 there can be a secure\/\u201ctrusted\u201d time source, but it depends on the SoC and firmware.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Typically:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Normal world<\/strong> uses the architectural generic timer.<\/li>\n\n\n\n<li><strong>Secure world (TrustZone)<\/strong> can use the same timer hardware with secure access, or a separate <strong>secure timer\/clock source<\/strong> provided by the platform.<\/li>\n\n\n\n<li>The architecture itself doesn\u2019t mandate one single \u201ctrusted zone clock source\u201d; the <strong>platform\/firmware<\/strong> defines what secure timekeeping exists.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you mean Linux\/ARM64 specifically, the kernel usually exposes the generic timer, while secure-world timing is handled by firmware, secure monitor, or vendor-specific hardware.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you want, I can explain the ARMv8 timer architecture and how TrustZone access control works.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">User prompt 2 of 3 &#8211; 7\/1\/2026, 7:16:23 PM:<br>Yes in the context of rk3399, and rk3588 running u-boot optee-os and arm trusted firmware<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">GPT-5.4 mini:<br><strong>Evaluating secure timer source<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I need to provide a concise answer. It seems the likely secure timer source is CNTPCT, rather than a separate trusted zone clock. I should also mention that both RK3399 and RK3588 are supported platforms for this secure time source configuration. When crafting my response, I\u2019ll ensure to include the necessary citations to back up my statements. This way, I can make sure the information is reliable and well-supported!Yes: on RK3399 and RK3588 the usual \u201ctrusted\u201d time source in OP-TEE is the ARM generic timer counter, typically <code>CNTPCT<\/code>, exposed via <code>CFG_SECURE_TIME_SOURCE_CNTPCT<\/code>. OP-TEE\u2019s porting guide says a fully trustable platform should use a secure clock for <code>tee_time_get_sys_time()<\/code> \/ <code>tee_time_get_ta_time()<\/code>, but it\u2019s also OK to fall back to REE time if the hardware\/platform doesn\u2019t provide one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So in practice:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Secure world time:<\/strong> often the generic timer counter, read from secure world<\/li>\n\n\n\n<li><strong>No special TrustZone-only clock<\/strong> mandated by ARM<\/li>\n\n\n\n<li><strong>If you need higher trust<\/strong>, the platform must provide a real secure clock path; otherwise OP-TEE uses the counter\/REE time model depending on the port.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For RK3399\/RK3588 specifically, this is the normal setup in OP-TEE ports, and both platforms are supported.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you want, I can show where this is wired in TF-A\/OP-TEE for RK3399 vs RK3588.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">User prompt 3 of 3 &#8211; 7\/1\/2026, 7:26:37 PM:<br>Yes<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">GPT-5.4 mini:<br><strong>Searching for citations<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I see that I need a factual answer with citations from web search results, but I can\u2019t see citation sources 3 and 10. It seems like a good idea to conduct a targeted search to find the necessary information. I\u2019ll focus on ensuring that I gather reliable data to support my response, as it&#8217;s important to have accurate references when discussing real-world topics. Let&#8217;s get started on that search!<strong>Searching for TF-A\/OP-TEE info<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I need to find a concise answer regarding the wiring for TF-A\/OP-TEE on rk3399\/rk3588. I should look into the OP-TEE config in platform conf.mk and also check timer_a64.c. It seems like reading the documentation on porting guidelines would be helpful too. So, I&#8217;ll search for timer_a64.c in relation to rk3399\/rk3588, possibly on GitHub to find the source code or any related details.<strong>Looking into secure clock support<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I need an answer that likely comes from the documentation. It might be useful to mention specific files that aren&#8217;t board-specific. In OP-TEE, I know the secure clock support is found in <code>core\/arch\/arm\/kernel\/timer_a64.c<\/code> for AArch64 builds, and the board configuration activates <code>CFG_SECURE_TIME_SOURCE_CNTPCT<\/code> in the platform <code>conf.mk<\/code>. I should provide a source from the docs that illustrates the config option and the secure clock concept to answer comprehensively.On both RK3399 and RK3588, the usual wiring is the same:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>TF-A<\/strong> provides the EL3 monitor\/secure monitor path for switching worlds.<\/li>\n\n\n\n<li><strong>OP-TEE<\/strong> is configured to use the <strong>secure generic timer counter<\/strong> as its secure time source, usually via <code>CFG_SECURE_TIME_SOURCE_CNTPCT=y<\/code>.<\/li>\n\n\n\n<li>The actual AArch64 timer code path is in OP-TEE\u2019s <code>core\/arch\/arm\/kernel\/timer_a64.c<\/code> for secure-world timer handling. The porting docs explicitly show <code>CFG_SECURE_TIME_SOURCE_CNTPCT<\/code> as the platform setting for the secure time source, and they describe that a real secure clock is optional but preferred for <code>tee_time_get_sys_time()<\/code> \/ <code>tee_time_get_ta_time()<\/code>.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">So the short answer is: <strong>yes, but it\u2019s not a separate RK3399\/RK3588 \u201cTrustZone clock\u201d<\/strong>. It\u2019s typically the ARM generic timer counter exposed to secure world, with the platform choosing whether to treat it as the secure time source.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you want to verify it in your tree, look for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>CFG_SECURE_TIME_SOURCE_CNTPCT<\/code> in the board\/platform <code>conf.mk<\/code><\/li>\n\n\n\n<li><code>core\/arch\/arm\/kernel\/timer_a64.c<\/code><\/li>\n\n\n\n<li>TF-A build using <code>SPD=opteed<\/code> on RK3588 (and the equivalent RK3399 platform port)<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>==================== User prompt 1 of 3 &#8211; 7\/1\/2026, 7:13:07 PM:In arm64 is there a trusted zone clock source? GPT-5.4 mini:Considering ARMv8 Trusted Zone I think the question might be about ARMv8 trusted zone and specifically related to &#8220;clock source.&#8221; It seems like I don\u2019t need to check the web for this since it\u2019s a technical &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/xn--y9aq2bc.com\/?p=1184\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Secure Time Arm Trustedzone&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"chat","meta":{"footnotes":""},"categories":[223,224],"tags":[],"class_list":["post-1184","post","type-post","status-publish","format-chat","hentry","category-llms","category-technical-solutions","post_format-post-format-chat"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/xn--y9aq2bc.com\/index.php?rest_route=\/wp\/v2\/posts\/1184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/xn--y9aq2bc.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xn--y9aq2bc.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xn--y9aq2bc.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/xn--y9aq2bc.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1184"}],"version-history":[{"count":1,"href":"https:\/\/xn--y9aq2bc.com\/index.php?rest_route=\/wp\/v2\/posts\/1184\/revisions"}],"predecessor-version":[{"id":1185,"href":"https:\/\/xn--y9aq2bc.com\/index.php?rest_route=\/wp\/v2\/posts\/1184\/revisions\/1185"}],"wp:attachment":[{"href":"https:\/\/xn--y9aq2bc.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xn--y9aq2bc.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xn--y9aq2bc.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}