Trustzone Security Extensions - ARM ARM1176JZF-S Technical Reference Manual

1.3

TrustZone security extensions

ARM DDI 0301H
ID012310
Caution
TrustZone security extensions enable a Secure software environment. The technology does not
protect the processor from hardware attacks and the implementor must take appropriate steps to
secure the hardware and protect trusted code.
The ARM1176JZF-S processor supports TrustZone security extensions to provide a secure
environment for software. This section summarizes processor elements that TrustZone uses. For
details of TrustZone, see the ARM Architecture Reference Manual.
The TrustZone approach to integrated system security depends on an established trusted code
base. The trusted code is a relatively small block that runs in the Secure world in the processor
and provides the foundation for security throughout the system. This security applies from
system boot and enforces a level of trust at each stage of a transaction.
The processor has:
• seven operating modes that can be either Secure or Non-secure
• Secure Monitor mode, that is always Secure.
Except when the processor is in Secure Monitor mode, the NS bit in the Secure Configuration
Register determines whether the processor runs code in the Secure or Non-secure worlds. The
Secure Configuration Register is in CP15 register c1, see c1, Secure Configuration Register on
page 3-52.
Secure Monitor mode is used to switch operation between the Secure and Non-secure worlds.
Secure Monitor mode uses these banked registers:
R13_mon Stack Pointer
R14_mon Link Register
SPSR_mon Saved Program Status Register
The processor implements this instruction to enter Secure Monitor mode:
SMC Secure Monitor Call, switches from one of the privileged modes to the Secure
Monitor mode.
The processor implements these TrustZone related signals:
nDMASIRQ Secure DMA transfer request, see c11, DMA Channel Status Register on
page 3-117.
nDMAEXTERRIR
Not maskable error DMA interrupt, see c11, DMA Channel Status Register on
page 3-117.
SPIDEN Secure privileged invasive debug enable, see Secure Monitor mode and debug on
page 13-4.
SPNIDEN Secure privileged non-invasive debug enable, see Secure Monitor mode and
debug on page 13-4.
Note
Do not confuse Secure Monitor mode with the Monitor debug-mode.
Copyright © 2004-2009 ARM Limited. All rights reserved.
Non-Confidential, Unrestricted Access
Introduction
1-4