【SoCVista】ARM TrustZone Technology.pdf

1 Conf idential ARM TrustZone? Technology Don Felton Technical Lead, TrustZone Software Embedded Software Division 2 Conf idential Agenda ? What is TrustZone technology ? How do you use TrustZone technology ? Tools from ARM to help with TrustZone development ? Hardware ? Debug environments ? Software for the TrustZone execution space 3 Conf idential What is TrustZone Providing execution isolation in a standard processor 4 Conf idential TrustZone is a Framework ? You can not ? Put your current operating system on a TrustZone capable processor and find it is miraculously “SECURE” ? Add TrustZone software to an operating system and have magical security ? Change to an ARM1176JZ-S? processor, add TrustZone software, make no other hardware changes, and expect the system to be secure ? You must consider the whole package ? You must consider what protection profile you need ? Software vs hardware attacks ? On-SoC vs Off-SoC secret storage 5 Conf idential Software System Overview Normal Rich OS Existing Apps … Driver Software Existing Apps Existing Apps USER MODE Privileged Modes Rich OS Kernel TrustZone Modes WRONG! To much communication Secrets not hidden 6 Conf idential So What Does TrustZone Provide? 7 Conf idential TrustZone Gives Virtual Processors ? TrustZone virtualizes an ARM processor into two processors ? Normal world for the rich OS ? Secure world for a restricted security code base ? On-SoC and off-SoC hardware reacts to processor security state ? Hardware enforced isolation ? Full JTAG debug with no information leakage between ‘worlds’ ? TrustZone secure world ? Looks like hardware to the normal world 8 Conf idential From the Software Point of View… SMI Software Monitor Interrupt Normal World Privileged Modes User System Abort Undef IRQ FIQ Supervisor Monitor SMI Secure World Privileged Modes User System Abort Undef IRQ FIQ Supervisor SMI 9 Conf idential From the Hardware Point of View… ? TrustZone technology provides restricted access to critical hardware ? E