M2351 Security Architecture. TrustZone Technology for Armv8-M Architecture

Transcription

1 Architecture TrustZone Technology for Armv8-M Architecture

2 Outline NuMicro Architecture TrustZone for Armv8-M Processor Core, Interrupt Handling, Memory Partitioning, State Transitions. TrustZone Implementation on IDAU / SAU, Unit (SCU), s. functions Crypto Accelerator, bootloader, KPROM, XOM, Flash Lock, Debug and Tamper Detector.

3 for Armv8-M Processor Core, Interrupt Handling, Memory Partitioning, State Transitions.

4 The memory and peripherals can be grouped into World and Non-secure World according to the memory address. World The processor supports and Non- operating states. Microcontroller TrustZone! Non-secure World for Armv8-M Processor Core Interrupt Handling Memory Partitioning State Transitions

5 for ARMv8-M code and Non-secure code can run on the same microcontroller - world is an isolated execution environment protected by hardware. - State transition is handled by hardware! Cortex -M NS-Flash S-Flash NS-SRAM S-SRAM Cortex -M NS-Flash S-Flash NS-SRAM S-SRAM State Transition Handled by hardware! P1 P2 P3 P4 Pn World P1 P2 P3 P4 Pn Non-secure World for Armv8-M Processor Core Interrupt Handling Memory Partitioning State Transitions

6 Processor Core Processor states - and Non-secure states that are orthogonal to the existing Thread and Handler modes privileged unprivileged Source: Introducing ARM Cortex-M23 and Cortex-M33 Processors with TrustZone for ARMv8-M for Armv8-M Processor Core Interrupt Handling Memory Partitioning State Transitions

7 Separate hardware resources for secure and non-secure states - SysTick timer - MPU configuration registers - Stack register (R13) Main stack Thread stack MSP_S / MSPLIM_S, PSP_S / PSPLIM_S MSP_NS / MSPLIM_NS*, PSP_MS / PSPLIM_NS* (* is not supported in Cortex -M23) Non-secure State State for Armv8-M Processor Core Interrupt Handling Memory Partitioning State Transitions Source: The Next Steps in the Evolution of Embedded Processors for the Smart Connected Era

8 Interrupt Handling Interrupt management mechanism is similar to ARMv7-M. Support separated exception vector tables for the and Non- exceptions - Can share the same priority level, or can force non-secure interrupts to use lower half priority range. for Armv8-M Processor Core Interrupt Handling Memory Partitioning State Transitions Source: arm

9 Memory Partitioning The 4GB memory space is partitioned into (S) and Nonsecure (NS) memory regions - Only secure code can access secure memory and peripherals. - Support optional secure MPU and non-secure MPU Non- Callable (NSC) - This secure memory area contains valid entry points for secure APIs - First instruction in API must be SG ( Gateway) for Armv8-M Processor Core Interrupt Handling Memory Partitioning State Transitions

10 State Transitions The processor s secure state is determined by the program address - Instructions from secure memory executed in the secure state - Boot into secure state - Direct function calls between states - Interrupts directly taken to target state Non-secure Handler Calls Handler Thread Exception Return Exception Request Calls Reset Thread Exception Return Exception Request for Armv8-M Processor Core Interrupt Handling Memory Partitioning State Transitions

11 Non-secure code to secure function - Non-secure code can call a function in secure memory where The entry point is in a NSC region The first instruction is Gateway (SG) - The LSB of R14 will be cleared to 0 for Armv8-M Processor Core Interrupt Handling Memory Partitioning State Transitions Source: The Next Steps in the Evolution of Embedded Processors for the Smart Connected Era

12 code to non-secure function - code can call a function in non-secure memory by using BLXNS instruction Return address and part of the PSR is pushed to the current stack FUN_RETURN is assigned to Link register (R14) LSB=0 (NS) */ for Armv8-M Processor Core Interrupt Handling Memory Partitioning State Transitions Source: The Next Steps in the Evolution of Embedded Processors for the Smart Connected Era

13 Implementation on IDAU / SAU, Unit (SCU), s.

14 Implementation on IDAU / SAU, Unit (SCU), s.

15 Arm Cortex -M23 64MHz, 512KB/ 96KB Flash and SRAM. Support TrustZone for Armv8-M. CPU Mask ROM SAU IDAU Flash 2 kbytes FMC SRAM SCU (SRAM Control) Boot ROM AHB5 Block Diagram Fixed area Control units to support TrustZone - access only SCU (Peripheral control) S-PDMA NS-PDMA Master AHB-APB bridge APB Control units to support - New IP to support S-Timer S-WDT P1 P2 P3 Pn Master or Slave IP Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

16 Implementation Defined Attribution Unit

17 Non-programmable, defines static address partitioning Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

18 Address Bit 28 is used to partition secure and non-secure memory region. Non-secure region Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

19 Region Range Memory Attribute Device System External Device External RAM Device SRAM Code 0xFFFFFFFF 0xF xE xD xC xB xA x x x x x x x x x x Non- + Exempted Region Non- Non- Non- Non- Non- Non- + NSC Non- + NSC Default Address Map the size of a subregion is 256MB 0x x Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

20 Attribution Unit

21 Programmable, provides dynamic address partitioning. Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

22 Up to 8 memory regions can be defined by programming its control registers. Address Register 0xE00EDD0 SAU_CTRL Control Register 0xE00EDD4 SAU_TYPE Number of SAU region (read only) 0xE00EDD8 SAU_RNR Region Number Register used to define a SAU region. 0xE00EDDC SAU_RBAR Region Base Address Register 0xE00EDE0 SAU_RLAR Region Limit Address Register Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

23 #1 SAU_RLAR.NSC = 0 A memory region defined by SAU is either Non-secure or Non-secure Callable. #0 SAU_RLAR.NSC = 1 Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

24

25 The address space partitioning is completed by IDAU and SAU together Compare IDAU and SAU definition, higher security attribute is selected for a memory address - S > NSC > NS Address Implementation Defined Attribution Unit (IDAU) Attribution Unit (SAU) Attribution Compare Higher security attribute is selected Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

26 The address space partitioning is completed by IDAU and SAU together Compare IDAU and SAU definition, higher security attribute is selected for a memory address - S > NSC > NS Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

27 Attribute

28 If the security state of a hardware resource is changeable, both secure and non-secure address range are allocated for it. Once assigned to be non-secure by system initialization code, the hardware resource will only respond to non-secure address. S S-Flash Cortex -M23 Address Space S System NS S NS-Flash S-SRAM Configured via FMC (defined by IDAU / SAU) NS Address Map NS S NS-SRAM S-Peripherals Configured via SCU NS NS-Peripherals Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

29 Most of the Flash areas are always secure and cannot be changed. Only APROM area can be changed to be non-secure. - NSCBA[23:0] indicates the starting address of non-secure APROM, which should align with Flash page size. FMC Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

30 Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

31 FMC can block unsecure access to flash. - processor uses secure address (address bit 28 = 0) to access non-secure APROM. - processor uses non-secure address (address bit 28 = 1) to access secure APROM. - Non-secure processor uses non-secure address (address bit 28 = 1) to access secure APROM. Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

32 Unit

33 Used to configure the security attribute of SRAM and peripherals. Divided into 12 blocks, SRAMNSSET PNSSET0 ~ PNSSET6 NS S NS S P1 (NS) P2 (S) P3 (S) Pn (NS) SRAM Peripherals each block can be set as secure or non-secure. If a peripheral is secure, all the control registers are secure. Can t be changed the state of some critical peripherals (such as FMC, Crypto,...). Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

34 SCU can block unsecure access to SRAM or peripherals. - processor or master peripheral Uses secure address (address bit 28 = 0) to access non-secure SRAM or non-secure Peripheral. Uses non-secure address (address bit 28 = 1) to access secure SRAM or secure Peripheral - Non-secure processor or master peripheral uses non-secure address to access secure SRAM or secure Peripheral. - Non-secure master peripheral tries to access a secure address (address bit 28 = 0). CPU / Master P. CPU / Master P. CPU / Master P. CPU / Master P. CPU / Master P. CPU / Master P. SRAMNSSET PNSSET0 ~ PNSSET3 SRAM or Peripheral CPU / Master P. Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

35 SRAM is in secure state after reset. Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

36 Register SRAMNSSET in SCU is used to set SRAM block to non-secure state. Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

37 each block is 8KB. bit n controls n th block: 0 for secure, 1 for non-secure. Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

38 All peripherals are in secure state after reset. Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

39 The secure state of each configurable peripheral is controlled by a corresponding bit in registers Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

40 Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

41 Register IONSSET is used to configure secure state of individual GPIO port. Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

42 Implementation On Block Diagram IDAU SAU s of Flash Unit of SRAM of Peripheral

43 Functions Crypto Accelerator, bootloader, KPROM, XOM, Flash Lock, Debug and Tamper Detector.

44 Functions Crypto Accelerator, bootloader, KPROM, XOM, Flash Lock, Debug and Tamper Detector.

45 Functions Integrity check and secure firmware upgrade Device identification bootloader Hardware authentication for updating Flash memory Execute-only memory region Unique ID KPROM Cortex -M23 Flash XOM Crypto. Accelerator SRAM Random Number Generator Peripherals Tamper Pin Detector Detect input state transition Flash Lock Bits SWD interface Two level setting for Flash lock, SWD disabled Encryption and Decryption operating to offload CPU Functions Crypto Accelerator Bootloader KPROM XOM Flash Lock Bits Debug Tamper Detector

46 Crypto Accelerator Support cryptographic operations for ciphering and message integrity - Elliptic Curve Cryptography (ECC) - DES, 3DES in ECB, CBC, CFB, OFB and CTR mode - AES 128-, 192-, and 256-bit ECB, CBC, CFB, OFB, CTR, CBC-CS1, CBC-CS2, and CBC-CS3 mode - SHA-160/224/256/384 - TRNG for key generation 64, 128, 192 and 256-bit random number Functions Crypto Accelerator Bootloader KPROM XOM Flash Lock Bits Debug Tamper Detector

47 Bootloader An immutable ROM code resident in execution-only region - Assures application code in flash memory has not been tampered. reset Verify the hash value of application code Comparing with the signature bootloader Application code APROM App. Code SHA-256 ECDSA signature Functions Crypto Accelerator Bootloader KPROM XOM Flash Lock Bits Debug Tamper Detector 256-bit secure boot key

48 KPROM Offset 0x14 KPKEYENROM KEYLOCK Enable Control 4 Kbytes flash to store 96-bit User Key and Offset 0x10 Offset 0x0C KPKEMAXROM KPMAXROM Retry counters User Key Retry Limitation Offset 0x08 KPKEY2ROM - The 96-bit User Key cannot be read directly and only can be verified Offset 0x04 Offset 0x00 KPKEY1ROM KPKEY0ROM 96-bit User Key by hardware. KPROM Memory Map 96-bit User Key Compare - LDROM, APROM and KPROM are write-protected once KPROM is enabled. Flash Write or Erase Success LDROM APROM Functions Crypto Accelerator Bootloader KPROM XOM Flash Lock Bits Debug Tamper Detector Fail KPROM

49 execution-only Memory (XOM) Up to 4 XOM regions can be defined in APROM Execution-only, data access is not allowed. XOM region Data access (PC-relative data access is not allowed). Data access Function call APROM Functions Crypto Accelerator Bootloader KPROM XOM Flash Lock Bits Debug Tamper Detector

50 Flash Lock Bits SCRLOCK - When SCRLOCK is set, external read and write access to secure Flash regions (LDROM, secure APROM region) are denied. LDROM ARLOCK - When ARLOCK is set, external read and write access to Flash SCRLOCK Non-secure ARLOCK regions (LDROM, entire APROM) are prohibited. APROM Functions Crypto Accelerator Bootloader KPROM XOM Flash Lock Bits Debug Tamper Detector

51 Debug Debug interface (SWD) is controlled by the status of SCRLOCK and ARLOCK SCRLOCK ARLOCK Debug Capability Can debug and trace any software code. Only can debug and trace non-secure software code. Debug interface is disabled, cannot debug and trace any software code. Functions Crypto Accelerator Bootloader KPROM XOM Flash Lock Bits Debug Tamper Detector

52 Tamper Detector Tamper pins can be configured as six individual inputs or 3 tamper loops. H/L H/L 64-bits H/L H/L Tamper Detector H/L H/L Tamper Detector Tamper Pin Tamper Loop When the defined transition condition is detected - A tamper alarm interrupt will be triggered. - The RTC spare registers (80 bytes) will be cleared. Functions Crypto Accelerator Bootloader KPROM XOM Flash Lock Bits Debug Tamper Detector

53 Summary is equipped with hardware functions to improve system security. bootloader Crypto Accelerator boot Communication Protection boot bootloader Data Protection Communication Protection Data and Firmware Protection Crypto Accelerator XOM, KPROM, Flash Lock and TrustZone TrustZone (SCU, FMC) Firmware Protection XOM KPROM Flash Lock Operation Protection TrustZone Operation Protection Tamper Protection Tamper pin Detector Tamper Pin Detector Tamper Protection