SPM: Introduce Secure Partition Manager
authorAntonio Nino Diaz <[email protected]>
Tue, 24 Oct 2017 09:07:35 +0000 (10:07 +0100)
committerAntonio Nino Diaz <[email protected]>
Wed, 8 Nov 2017 18:05:14 +0000 (18:05 +0000)
commit2fccb228045696b98f83b1d865bac3c65d96b980
tree4c3a4b67406989e65611a103a7adaf233fed4f2e
parentad02a7596f73ea9f07ebc9e04970ab7e9961c868
SPM: Introduce Secure Partition Manager

A Secure Partition is a software execution environment instantiated in
S-EL0 that can be used to implement simple management and security
services. Since S-EL0 is an unprivileged exception level, a Secure
Partition relies on privileged firmware e.g. ARM Trusted Firmware to be
granted access to system and processor resources. Essentially, it is a
software sandbox that runs under the control of privileged software in
the Secure World and accesses the following system resources:

- Memory and device regions in the system address map.
- PE system registers.
- A range of asynchronous exceptions e.g. interrupts.
- A range of synchronous exceptions e.g. SMC function identifiers.

A Secure Partition enables privileged firmware to implement only the
absolutely essential secure services in EL3 and instantiate the rest in
a partition. Since the partition executes in S-EL0, its implementation
cannot be overly complex.

The component in ARM Trusted Firmware responsible for managing a Secure
Partition is called the Secure Partition Manager (SPM). The SPM is
responsible for the following:

- Validating and allocating resources requested by a Secure Partition.
- Implementing a well defined interface that is used for initialising a
  Secure Partition.
- Implementing a well defined interface that is used by the normal world
  and other secure services for accessing the services exported by a
  Secure Partition.
- Implementing a well defined interface that is used by a Secure
  Partition to fulfil service requests.
- Instantiating the software execution environment required by a Secure
  Partition to fulfil a service request.

Change-Id: I6f7862d6bba8732db5b73f54e789d717a35e802f
Co-authored-by: Douglas Raillard <[email protected]>
Co-authored-by: Sandrine Bailleux <[email protected]>
Co-authored-by: Achin Gupta <[email protected]>
Co-authored-by: Antonio Nino Diaz <[email protected]>
Signed-off-by: Antonio Nino Diaz <[email protected]>
18 files changed:
Makefile
bl31/bl31.ld.S
bl31/bl31.mk
include/common/aarch64/asm_macros.S
include/common/param_header.h
include/lib/aarch64/arch.h
include/plat/common/platform.h
include/services/secure_partition.h [new file with mode: 0644]
include/services/spm_svc.h [new file with mode: 0644]
make_helpers/defaults.mk
services/std_svc/spm/aarch64/spm_helpers.S [new file with mode: 0644]
services/std_svc/spm/aarch64/spm_shim_exceptions.S [new file with mode: 0644]
services/std_svc/spm/secure_partition_setup.c [new file with mode: 0644]
services/std_svc/spm/spm.mk [new file with mode: 0644]
services/std_svc/spm/spm_main.c [new file with mode: 0644]
services/std_svc/spm/spm_private.h [new file with mode: 0644]
services/std_svc/spm/spm_shim_private.h [new file with mode: 0644]
services/std_svc/std_svc_setup.c