Skip to main content
Configuring Qualcomm TEE is essential for maintaining the security, compliance, performance, and flexibility of devices that manage sensitive data and run trusted applications. Qualcomm TEE configurations can be adjusted using the device configuration (devcfg) framework, which provides a centralized way to manage and adjust device-specific settings.

​
Prerequisites

​
Compile devcfg image from TrustZone

  1. Select the configuration options that TrustZone offers through the built in devcfg.mbn/ devcfg_iot.mbn XML files. For example: trustzone_images/ssg/securemsm/trustzone/qsee/mink/oem/config/<chipset>/oem_config.xml.
  2. Use the command to compile the devcfg image from TZ.XF.5.29.1.
    This steps generates the devcfg.mbn/ devcfg_iot.mbn images at trustzone_images/build/ms/bin/<build_flavor>. Use the following build flavors and commands.
Build flavors
Build commands:
Use the following devcfg files:<devcfg> is
  • devcfg for QCS6490
  • devcfg_iot for IQ-9100, IQ-8300, IQ-615

​
Customize device using configuration parameters

Use the configuration parameters listed in the following table to customize the device as needed.

​
Enable RPMB-based SFS anti-rollback protection

To enable or disable the RPMB-based SFS anti-rollback protection, use the following configuration parameter and the XML file.

​
Configuration parameter

cmnlib_gppo_rpmb_enablement, can be set to Enabled or Disabled, where the default value is Enabled and must be changed only when required.

​
XML file location

trustzone_images/ssg/securemsm/trustzone/qsee/mink/oem/config/common/cmnlib_oem_config.xml

​
Next steps

  • To enable secure boot and to ensure only trusted applications runs on the device, see Enable secure boot.
  • To enable secure boot, QFPROM fuses must be blown. This is a one-time, irreversible process that permanently sets these values. For more information, see Set the QFPROM fuses.