ARM TrustZone TZC-400 Access Control Limitations and System Topology
The ARM TrustZone TZC-400 (TrustZone Address Space Controller) is a critical component in systems requiring secure memory and peripheral access control. It is primarily designed to enforce memory access policies by filtering transactions based on their security attributes, such as Non-Secure (NS) or Secure (S) states, and specific Non-Secure IDs (NSIDs). However, its functionality is inherently tied to the system topology, particularly the placement of the TZC-400 within the memory hierarchy.
In a typical ARM-based system, the TZC-400 is positioned downstream of the CPU and upstream of the DDR memory controller. This placement allows it to regulate access to DDR memory regions by defining secure and non-secure regions, enforcing access policies, and preventing unauthorized access. However, its influence is limited to the address ranges that are physically connected downstream of the TZC-400. This means that peripherals or memory-mapped registers located outside the DDR address range and not routed through the TZC-400 cannot be controlled by it.
For example, if a peripheral’s register set is mapped to a memory address range that is outside the DDR address space and not connected downstream of the TZC-400, the TZC-400 cannot enforce access control policies on that peripheral. This limitation arises because the TZC-400 operates at the memory interconnect level and does not have visibility or control over address ranges that bypass it.
To determine whether the TZC-400 can control access to a specific peripheral, the system topology must be carefully analyzed. This includes understanding the memory map, the interconnect architecture, and the placement of the TZC-400 relative to the peripheral in question. If the peripheral is not behind the TZC-400 in the memory hierarchy, alternative mechanisms must be employed to enforce access control.
Peripheral Access Control and System Interconnect Configuration
The inability of the TZC-400 to control access to peripherals outside its downstream address range is not a limitation of the TZC-400 itself but rather a consequence of the system design. In many ARM-based systems, peripherals are connected to the CPU via a system interconnect, such as an AXI or AHB bus. The interconnect may include its own access control mechanisms, which can be configured to enforce security policies on peripheral access.
For instance, some interconnects provide port-based access control, where specific ports can be configured to allow only secure or non-secure transactions. This functionality is similar to the TZC-400 but operates at the interconnect level rather than the memory controller level. By configuring the interconnect to restrict access to specific peripherals, it is possible to achieve the desired access control even if the TZC-400 cannot directly regulate those peripherals.
Additionally, some ARM platforms include peripheral protection controllers (PPCs) that can be used to enforce access control on individual peripherals. These controllers are typically integrated into the interconnect and provide fine-grained control over peripheral access. For example, a PPC can be configured to allow only secure-world access to a specific peripheral, effectively isolating it from the non-secure world.
When designing a system that requires secure access control for peripherals, it is essential to consider the capabilities of the interconnect and any additional protection mechanisms available. If the TZC-400 cannot be used to control access to a specific peripheral, the interconnect or PPCs may provide a viable alternative.
Implementing Peripheral Access Control in ARM TrustZone Systems
To implement peripheral access control in an ARM TrustZone system where the TZC-400 cannot regulate access to certain peripherals, the following steps can be taken:
-
Analyze the System Topology: Begin by examining the system memory map and interconnect architecture to determine the placement of the TZC-400 and the peripherals in question. Identify whether the peripherals are located downstream of the TZC-400 or bypass it entirely.
-
Configure the Interconnect: If the interconnect supports port-based access control, configure it to enforce the desired security policies. For example, set specific ports to allow only secure transactions or restrict access based on NSIDs.
-
Utilize Peripheral Protection Controllers: If the platform includes PPCs, configure them to control access to individual peripherals. This may involve setting access permissions for secure and non-secure worlds or defining specific NSIDs that are allowed to access the peripheral.
-
Implement Software-Based Access Control: In cases where hardware-based mechanisms are insufficient, implement software-based access control in the secure firmware. This can involve validating access requests in the secure monitor or hypervisor before allowing them to proceed.
-
Verify the Configuration: After configuring the access control mechanisms, thoroughly test the system to ensure that the desired security policies are enforced. This includes verifying that unauthorized access attempts are blocked and that legitimate access requests are allowed.
By following these steps, it is possible to achieve secure access control for peripherals in ARM TrustZone systems, even when the TZC-400 cannot directly regulate access to those peripherals. The key is to leverage the available hardware and software mechanisms to enforce the desired security policies effectively.
Example System Configuration for Peripheral Access Control
To illustrate the concepts discussed above, consider an example system with the following characteristics:
- CPU: Dual-core ARM Cortex-A7
- Memory: 1GB DDR3 SDRAM
- Peripherals: UART, GPIO, Ethernet controller
- Interconnect: AXI bus with port-based access control
- TZC-400: Positioned upstream of the DDR memory controller
In this system, the TZC-400 is configured to enforce access control policies for the DDR memory. However, the UART and GPIO peripherals are connected to the CPU via the AXI bus and are not downstream of the TZC-400. To enforce access control on these peripherals, the following steps are taken:
-
Analyze the System Topology: The memory map shows that the UART and GPIO peripherals are located outside the DDR address range and are not downstream of the TZC-400.
-
Configure the Interconnect: The AXI bus is configured to restrict access to the UART and GPIO peripherals. Specifically, the ports connected to these peripherals are set to allow only secure transactions.
-
Utilize Peripheral Protection Controllers: The platform includes PPCs for the UART and GPIO peripherals. These PPCs are configured to allow only secure-world access to the peripherals.
-
Implement Software-Based Access Control: The secure firmware includes a validation routine that checks access requests to the UART and GPIO peripherals. If an access request originates from the non-secure world, it is blocked.
-
Verify the Configuration: The system is tested to ensure that the UART and GPIO peripherals are accessible only from the secure world. Unauthorized access attempts from the non-secure world are blocked, and legitimate access requests from the secure world are allowed.
This example demonstrates how access control can be implemented for peripherals that are not downstream of the TZC-400. By leveraging the interconnect and PPCs, it is possible to enforce the desired security policies effectively.
Conclusion
The ARM TrustZone TZC-400 is a powerful tool for enforcing access control policies in secure systems. However, its functionality is limited to address ranges that are downstream of it in the memory hierarchy. For peripherals located outside the DDR address range, alternative mechanisms such as interconnect configuration and peripheral protection controllers must be employed to enforce access control. By carefully analyzing the system topology and leveraging the available hardware and software mechanisms, it is possible to achieve secure access control for all system components, ensuring the integrity and security of the overall system.
