Security

FAQ

Secure RAM concerning on Secure Boot Flow

1. Does Mediatek AIoT SoC have a Secure RAM?

Yes, Mediatek AIoT SOC uses EMI memory protection unit(MPU) hardware to protect secure DRAM.

2. If answer of Q1 is yes, does it have access from Normal World after booting?

No, the secure DRAM regions do not permit to be accessed by Normal World after booting. MT8365 has the EMI MPU settings in TF-A bl31_platform_setup() to make BL31 & BL32 can only be accessed by Secure World. Besides, BL2 is no longer existed after booting to BL31. https://gitlab.com/mediatek/aiot/bsp/trusted-firmware-a/-/blob/mtk-v2.6/plat/mediatek/mt8365/include/plat_emi_mpu.h#L42

3. Does the secure DRAM exist independently as hardware?

No, Secure DRAM is supported by MPU HW in EMI controller, and the MPU HW checks the permission on the memory bus connected to external DRAM.

4. How many memory size does your secure DRAM?

It depends on the DRAM size, and users can configure the secure DRAM region with start address and size on demand.

5. Is “EMI memory protection unit(MPU) hardware” the same as TZASC(TrustZone Address Space Controller) ? Or, is it your original hardware?

The EMI MPU hardware design is based on the TZASC mechanism and implemented in EMI controller by MediaTek.

6. Is Trustzone essential requisite for SoC support secure boot feature?

Yes. ARM Trustzone support is necessary for the secure boot mechanism. The system execution state can be separated to normal world and secure world by Trustzone. The verification of secure boot is started and processed in secure world.

By the way, TEE OS(BL32) is optional, the secure boot mechanism can be supported without TEE OS.