Secure Monitor
Secure Monitor Calls
The secure monitor provides two top level handlers of which each provides a range of sub handlers.
Secure Monitor Calls follow the ARM SMC calling convention up to a small change:
| Bit number | Bit mask | Description |
|---|---|---|
| 31 | 0x80000000 | Set to 0 means Yielding Call; Set to 1 means Fast Call. |
| 30 | 0x40000000 | Set to 0 means SMC32 convention; Set to 1 means SMC64. |
| 29-24 | 0x3F000000 | Service Call ranges. |
| 23-16 | 0x00FF0000 | Must be zero. |
| 15-8 | 0x0000FF00 | Argument type. This is different from the ARM SMC calling convention. |
| 7-0 | 0x000000FF | Function number within the range call type. |
If bit n is set in the argument type then parameter Xn is treated as a pointer and the kernel will setup address translation for it in svcCallSecureMonitor.
SMC arguments are passed using registers X0-X7 with X0 always sending the call sub-id and returning the result of the call.
ID 0
Functions exposed to user-mode processes using svcCallSecureMonitor.
| Sub-ID | Name | In | Out |
|---|---|---|---|
| 0xC3000401 | SetConfig | ||
| 0xC3000002 | GetConfig (Same as ID 1, Sub-ID 4) | ||
| 0xC3000003 | CheckStatus | ||
| 0xC3000404 | GetResult | ||
| 0xC3000E05 | ExpMod | ||
| 0xC3000006 | GetRandomBytes (Same as ID 1, Sub-ID 5) | ||
| 0xC3000007 | #GenerateAesKek | ||
| 0xC3000008 | #LoadAesKey | ||
| 0xC3000009 | #CryptAes | ||
| 0xC300000A | #GenerateSpecificAesKey | ||
| 0xC300040B | #ComputeCmac | ||
| 0xC300100C | #LoadRsaOaepKey | ||
| 0xC300100D | #DecryptRsaPrivateKey | ||
| 0xC300100E | #LoadSecureExpModKey | ||
| 0xC300060F | #SecureExpMod | ||
| 0xC3000610 | #UnwrapRsaOaepWrappedTitleKey | ||
| 0xC3000011 | #LoadTitleKey | ||
| 0xC3000012 | [2.0.0+] UnwrapAesWrappedTitleKey |
The overall concept here is the following:
- All key material (AES and RSA) is stored in userspace, but it's encrypted with random AES kek's ("key encryption keys").
- Each kek is generated as a function of an access key (picked at random).
- The kek is generated differently depending on the #CryptoUsecase the key is used for.
- This means: Each key is "locked" to the #CryptoUsecase it was designated for.
- You can use a key for a different usecase, but you will only get garbage output.
- After the kek has been generated, it is wrapped with a session-specific key and given back to userspace.
- This means: Plaintext kek keys never leave TrustZone.
- Further, this means: Actual AES/RSA keys never leave TrustZone.
Note: The CryptoUsecase_TitleKey represents a RSA wrapped AES key.
GenerateAesKek
Takes an "access key" as input, an #CryptoUsecase.
Returns a session-unique kek for said usecase.
LoadAesKey
Takes a session kek created with #GenerateAesKek, and a wrapped AES key.
The session kek must have been created with CryptoUsecase_Aes.
CryptAes
Encrypts/decrypts using Aes (CTR and CBC).
Key must be set prior using one of the #LoadAesKey, #GenerateSpecificAesKey or #LoadRsaWrappedAesKey commands.
GenerateSpecificAesKey
Todo: This one seems unrelated to #CryptoUsecase.
LoadRsaOaepKey
Takes a session kek created with #GenerateAesKek, a wrapped AES key, and a wrapped RSA private key.
The session kek must have been created with CryptoUsecase_RsaOaep.
DecryptRsaPrivateKey
Takes a session kek created with #GenerateAesKek, a wrapped AES key, and a wrapped RSA private key.
The session kek must have been created with CryptoUsecase_RsaPrivate.
[{Unknown version}+] The SMC handler when certain conditions pass and SMC_ID==0xC300100D now returns error 0x6 instead of calling the handler funcptr.
LoadSecureExpModKey
Takes a session kek created with #GenerateAesKek, and a wrapped RSA key.
The session kek must have been created with CryptoUsecase_RsaSecureExpMod.
SecureExpMod
Performs an Exp Mod operation using an exponent previously loaded with the #LoadSecureExpModKey command.
UnwrapRsaOaepWrappedTitleKey
Takes an Rsa-Oaep-wrapped TitleKey, an RSA Public Key, and a label hash.
Performs an Exp Mod operation using an exponent previously loaded with the #LoadRsaOaepKey command, and then validates/extracts a Titlekey from the resulting message.
Returns a session-unique AES key especially for use in #LoadTitleKey.
LoadTitleKey
Takes a session-unique AES key from #UnwrapAesWrappedTitleKey or #UnwrapRsaOaepWrappedTitleKey.
enum CryptoUsecase
| Value | Name |
|---|---|
| 0 | CryptoUsecase_Aes |
| 1 | CryptoUsecase_RsaPrivate |
| 2 | CryptoUsecase_RsaSecureExpMod |
| 3 | CryptoUsecase_RsaOaep |
ID 1
Functions exposed to the kernel internally.
| Sub-ID | Name | In | Out |
|---|---|---|---|
| 0xC4000001 | #CpuSuspend | X1=power_state, X2=entrypoint_addr, X3=context_id | None |
| 0x84000002 | #CpuOff | None | None |
| 0xC4000003 | #CpuOn | X1=target_cpu, X2=entrypoint_addr, X3=context_id, X4,X5,X6,X7=0 | X0=result |
| 0xC3000004 | #GetConfig (Same as ID 0, Sub-ID 2) | W1=config_item, X2,X3,X4,X5,X6,X7=0 | X0=result, X1,X2,X3,X4=config_val |
| 0xC3000005 | #GetRandomBytes (Same as ID 0, Sub-ID 6) | X1=size, X2,X3,X4,X5,X6,X7=0 | X0=result, X1,X2,X3,X4,X5,X6,X7=rand_bytes |
| 0xC3000006 | #Panic | W1=panic_color, X2,X3,X4,X5,X6,X7=0 | X0=result |
| 0xC3000007 | [2.0.0+] #ProtectKernelRegion | X1=carveout_index, X2=region_phys_addr, X3=region_size, X4,X5,X6,X7=0 | X0=result |
| 0xC3000008 | [2.0.0+] #ReadWriteRegister | X1=reg_addr, W2=rw_mask, W3=in_val, X4,X5,X6,X7=0 | X0=result, W1=out_val |
CpuSuspend
Standard ARM PCSI SMC. Suspends the CPU (CPU0).
The kernel calls this SMC on shutdown with power_state set to 0x0201001B (power level: 0x02==system; power type: 0x01==powerdown; ID: 0x1B).
CpuOff
Standard ARM PCSI SMC. Turns off the CPU (CPU1, CPU2 or CPU3).
CpuOn
Standard ARM PCSI SMC. Turns on the CPU (CPU1, CPU2 or CPU3).
GetConfig
Takes a config_item and returns an associated config_val.
GetRandomBytes
Takes a size and returns rand_bytes.
The kernel limits size to 0x38 (for fitting in return registers).
Panic
Issues a system panic.
The kernel always calls this with panic_color set to 0xF00.
ProtectKernelRegion
Configures memory controller carveout regions.
If carveout_index is 0, region_phys_addr and region_size are used to configure MC_SECURITY_CARVEOUT4. If carveout_index is 1, region_phys_addr and region_size are used to configure MC_SECURITY_CARVEOUT5. Any other carveout_index values are invalid.
The kernel calls this with carveout_index set to 0, region_phys_addr set to 0x80060000 and region_size set to a dynamically calculated size which covers all the kernel and built-in sysmodules' DRAM regions.
ReadWriteRegister
Relays svcReadWriteRegister to the Secure Monitor.
Errors
| Value | Description |
|---|---|
| 2 | Invalid input |
| 3 | Busy |