Is pre-emption while in secure mode supported? If so, NS RTOS may have to be modified to handle switching from a thread who's PC and SP are in secure domain.
How would a secure service thread block while waiting for a security-protected hardware process to finish (ie what is the secure driver model)?
Alan
From: TF-M [mailto:tf-m-bounces@lists.trustedfirmware.org] On Behalf Of Reinhard Keil via TF-M Sent: Thursday, April 2, 2020 5:49 AM To: tf-m@lists.trustedfirmware.org Cc: nd Subject: [EXTERNAL] [TF-M] Multi-threaded single-scheduler model proposal
Hi Erik,
Really great to see your involvement. Let me share my view on a TF-M execution model for constrained single core v8-M with TrustZone using Secure Function Call (aka library) mode:
On secure side: single thread execution only. Not stack swapping. NS to S calls are blocking until secure execution completes. On non-secure side: RTOS with threaded execution. Entry to secure side protected with Mutex.
This structure is explain on page 27 of https://github.com/ARM-software/CMSIS_5/blob/develop/CMSIS_Review_Meeting_20...
IMHO, there are various benefits: * Overall less complexity, no need of tz_context, any RTOS would work, less memory overhead (i.e. single stack at secure side) * No impact to time deterministic execution on the NS side unless two threads call secure services * Conflict of mulitple threads calling secure services could be minimized with RTOS that offers priority inversion
Are there any obvious problems with the above model?
Thanks Reinhard Keil - Sr. Director Embedded Tools, Arm
P.S. maybe you read also https://lists.trustedfirmware.org/pipermail/tf-m/2020-March/000805.html IMHO we need to simplify the NS to S call entry to speed-up the overall system