| Antonio Nino Diaz | 7289f92 | 2017-11-09 11:34:09 +0000 | [diff] [blame] | 1 | ARM Trusted Firmware - SPM User Guide |
| 2 | ===================================== |
| 3 | |
| 4 | .. section-numbering:: |
| 5 | :suffix: . |
| 6 | |
| 7 | .. contents:: |
| 8 | |
| 9 | |
| 10 | This document briefly presents the Secure Partition Management (SPM) support in |
| 11 | the Arm Trusted Firmware (TF), specifically focusing on how to build Arm TF with |
| 12 | SPM support. |
| 13 | |
| 14 | Overview of the SPM software stack |
| 15 | ---------------------------------- |
| 16 | |
| 17 | SPM is supported on the Arm FVP exclusively at the moment. |
| 18 | |
| 19 | It is not currently possible for BL31 to integrate SPM support and a Secure |
| 20 | Payload Dispatcher (SPD) at the same time; they are mutually exclusive. In the |
| 21 | SPM bootflow, a Secure Partition (SP) image executing at Secure-EL0 replaces the |
| 22 | Secure Payload image executing at Secure-EL1 (e.g. a Trusted OS). Both are |
| 23 | referred to as BL32. |
| 24 | |
| 25 | A working prototype of a SP has been implemented by repurposing the EDK2 code |
| 26 | and tools, leveraging the concept of the *Standalone Management Mode (MM)* in |
| 27 | the UEFI specification (see the PI v1.6 Volume 4: Management Mode Core |
| 28 | Interface). This will be referred to as the *Standalone MM Secure Partition* in |
| 29 | the rest of this document. |
| 30 | |
| 31 | |
| 32 | Building TF with SPM support |
| 33 | ---------------------------- |
| 34 | |
| 35 | To enable SPM support in the TF, the source code must be compiled with the build |
| 36 | flag ``ENABLE_SPM=1``. On Arm platforms the build option ``ARM_BL31_IN_DRAM`` |
| 37 | can be used to select the location of BL31, both SRAM and DRAM are supported. |
| 38 | |
| 39 | |
| 40 | Using the Standalone MM SP |
| 41 | ~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 42 | |
| 43 | First, build the Standalone MM Secure Partition. To build it, refer to the |
| 44 | `instructions in the EDK2 repository`_. |
| 45 | |
| 46 | Then build TF with SPM support and include the Standalone MM Secure Partition |
| 47 | image in the FIP: |
| 48 | |
| 49 | :: |
| 50 | |
| 51 | BL32=path/to/standalone/mm/sp BL33=path/to/bl33.bin \ |
| 52 | make PLAT=fvp ENABLE_SPM=1 fip all |
| 53 | |
| 54 | |
| 55 | -------------- |
| 56 | |
| 57 | *Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.* |
| 58 | |
| 59 | .. _instructions in the EDK2 repository: https://github.com/tianocore/edk2-staging/blob/AArch64StandaloneMm/HowtoBuild.MD |