The Next Steps in the Evolution of ARM Cortex-M

Transcription

1 The Next Steps in the Evolution of ARM Cortex-M Joseph Yiu Senior Embedded Technology Manager CPU Group ARM Tech Symposia China 2015 November 2015

2 Trust & Device Integrity from Sensor to Server 2 ARM 2015

3 Device Security Fundamentals non-trusted trusted Separation Isolate trusted resources from non-trusted Isolate non-trusted software Reduce attack surface of key components Trusted Software Provision of security services Small, well reviewed code crypto trusted software trusted hardware secure system secure storage TRNG Trusted Hardware Hardware assist for cryptography Secure access validation built into SoC 3 ARM 2015

4 Bringing Security to the Smallest Devices Tomorrow ARMv8-M architecture The ARM architecture for ARM Cortex -M processors Provides a security foundation with TrustZone New AMBA 5 AHB5 specification Extends the security foundation through the ultra-low power SoC 4 ARM 2015

5 ARMv8-M: Taking Embedded to the Next Level Security Taking TrustZone security to the smallest devices Bringing security within reach of all developers Productivity Making scalable software development even easier 5 ARM 2015

6 Introducing ARMv8-M 7 ARM 2015

7 ARMv8-M Sub-profiles Scalable architecture ARMv8-M Baseline: Lowest cost, smallest, ARMv8-M implementations. ARMv7-M ARMv6-M Today MAINLINE BASELINE ARMv8-M ARMv8-M Mainline: For general purpose microcontroller products Highly scalable Optional DSP and floating-point extensions. 8 ARM 2015

8 ARMv8-M Baseline Performance & Scalability Instruction set feature uplift for baseline microcontroller Feature Key benefits Hardware divide Faster integer divide operation in hardware. Removes need for library code. Compare and branch Combined compare-with-zero and branch. Faster control code. Long branch Long non-linking branch to compliment branch with link. Enables support for cross unit tail calls. Wide immediate moves Pointer and large immediate creation without needing a literal load. Provides a linking mechanism for execute-only code. Exclusive accesses Load-link / store-conditional support for semaphore use. Enables common semaphore handling between CPUs. Interrupt active bits Active status of all interrupts individually tracked. Offers dynamic re-prioritization of interrupts. 9 ARM 2015

9 ARMv8-M Mainline Variants Comprehensive instruction set support with optional DSP and floating-point extensions Retains Baseline fundamentals. Adds extensive 32-bit instruction set ~ 40% performance uplift over Baseline. Optional integer digital signal processing (DSP) extension ~ 80 saturating arithmetic and SIMD operations. Optional floating-point (FP) extension ~ 45 instructions, IEEE754 compatible single, and/or double precision floating-point operations. FP MAINLINE BASE LINE DSP 10 ARM 2015

10 Memory Protection and Watchpoints Improved programmability and flexibility ARMv8-M adopts base and limit style comparators for regions Replaces previous power-of-two size, sized aligned scheme Simplifies software development, encouraging creation of safer software Accelerates programming, potentially reducing context switch times. 0x3BC00 0x80400 PMSAv7 PMSAv8 1kB 16kB 256kB 1kB SINGLE 274kB REGION MPU configurable down to 32-byte granularity. Debug variable watchpoints also enhanced to support more flexible scheme. 11 ARM 2015

11 Introducing ARM TrustZone for ARMv8-M 12 ARM 2015

12 ARM TrustZone Technology Bringing ARM security extensions to the embedded world Optional security extension for the ARMv8-M architecture Security architecture for deeply embedded processors Enables containerisation of software Simplifies security assessment of embedded devices. Conceptually similar and compatible with existing TrustZone technology New architecture tailored for embedded devices Preserves low interrupt latencies of Cortex-M Provides high performance cross-domain calling. 13 ARM 2015

13 ARMv8-M Additional States Existing handler and thread modes mirrored with secure and non-secure states Secure and Non-Secure code run on a single CPU For efficient embedded implementation. Secure state for trusted code New Secure stack pointers for robust operation Addition of stack-limit checking. Handler Mode Thread Mode ARMv7-M Dedicated resources for isolation between domains Separate memory protection units for Secure and Non-secure Private SysTick timer for each state. Secure side can configure target domain of interrupts. Non-secure Handler Mode Non-secure Thread Mode ARMv8-M Secure Handler Mode Secure Thread Mode 14 ARM 2015

14 ARMv8-M Interrupt Security High-performance interrupt handling with register protection Subject to priority, Secure can interrupt Non-secure and vice versa Secure can boost priority of own interrupts Uses current stack pointer to preserve context. Running Secure Code Non-secure Interrupt Uses ARMv7-M exception stacking mechanism Hardware pushes selected registers. Non-secure interruption of Secure code CPU pushes all registers and zeroes them Removes ability for Non-secure to snoop Secure register values. Pop All Registers Switch to Secure Return from Interrupt Push All Registers Zero All Registers Switch to Non-secure Run Non-Secure Handler 15 ARM 2015

15 Security Defined by Address All transactions from core and debugger checked All addresses are either Secure or Non-secure. Policing managed by Secure Attribution Unit (SAU) Internal SAU similar to MPU Supports use of external system-level definition E.g. based on flash blocks or per peripheral. Request from CPU Security Attribution Unit (SAU) System Level Control Banked MPU configuration Independent memory protection per security state. Non-Secure MPU Secure MPU Load/stores acquire NS attribute based on address Non-secure access attempts to Secure address = memory fault. Request to System 16 ARM 2015

16 High Performance Cross-Domain Calls Efficient microcontroller focussed implementation Security inferred from instruction address Secure memory considered to hold Secure code. Direct function calls across boundary High performance and high security Multiple entry points No need to go via monitor for transitions. Uses Secure Gateway instruction SG Only permitted in special Secure memory with Non-secure-callable attribute (NSC). Non-secure Handler Mode Non-secure Thread Mode Calls Calls Secure Handler Mode Secure Thread Mode 17 ARM 2015

17 TrustZone for ARMv8-A TrustZone for ARMv8-M NON-SECURE STATES Rich OS, e.g.linux SECURE STATES Secure App/Libs Secure OS NON-SECURE STATES Nonsecure App Nonsecure OS SECURE STATES Secure App/Libs Secure OS Secure Monitor TrustZone for ARMv8-M 18 ARM 2015 Secure transitions handled by the processor to maintain embedded class latency

18 Cross-Domain Function Calls An assembly code level example Non-secure memory NonSecureFunc: BL SecureFunc <Non-secure code> Call Return to NS Secure memory (Non-secure callable) SecureFunc: SG Enter Secure state <Secure code> BXNS lr Guard instruction (SG) polices entry point Placed at the start of function callable from non-secure code. Non-secure secure branch faults if SG isn t at target address Can t branch into the middle of functions Can t call internal functions. Code on Non-secure side identical to existing code. 19 ARM 2015

19 A Simplified Use Case Composing a system from Secure and Non-secure projects Non-secure state USER PROJECT User application Start Function calls Secure state FIRMWARE PROJECT System start Firmware Non-secure project cannot access Secure resources. Secure project can access everything. I/O driver Function calls Function calls Communication stack Secure and Non-secure projects may implement independent time scheduling. 21 ARM 2015

20 Microcontroller System With TrustZone technology CPU AHB5 Interconnect Non- Secure DMA Security driven from master Dynamically from an ARMv8-M CPU Statically from a simple DMA. Propagated by AHB5 interconnect Compatible with existing Cortex-A. Flash SRAM Secure Peripheral A Non-secure Peripheral B Enables selective access Individual flash pages Regions of memory Peripherals. 22 ARM 2015

21 ARMv8-M Ecosystem Development Underway ARMv8-M provides the standard for the extensive Cortex-M ecosystem to create the security solutions needed in a connected world Contact us to start your ARMv8-M development 23 ARM 2015

22 ARMv8-M: Security in Small, Real-time Embedded Optimised for small real-time processors Hardware based security state switch Fully programmable in C Transparent to the software developer Low, deterministic interrupt latency Transition via a standard function call Efficient every cycle counts No hypervisor code and processing overhead Easy to program easy to debug 24 ARM 2015

23 ARMv8-M: Increased Software Productivity Improved scalability Easier, standardised device protection Enhanced debug Continuum across product family TrustZone security Simplified MPU Improved trace More flexible breakpoints/watchpoints 25 ARM 2015

24 The Next Steps in the Evolution of Cortex-M ARMv8-M Provides a continuum of performance and compatibility ARM TrustZone Technology Simplifies and accelerates security in the microcontroller space AMBA 5 AHB5 Extends security to the system 26 ARM 2015

25 Thank you The trademarks featured in this presentation are registered and/or unregistered trademarks of ARM Limited (or its subsidiaries) in the EU and/or elsewhere. All rights reserved. All other marks featured may be trademarks of their respective owners. Copyright 2015 ARM Limited