Technical Details

• Architecture
  • Overview
    • Protected
    • User
  • Component Split
  • Bootup Flow
• World and Permission Control
  • Switching between Secure and Non-secure World
• System call
  • Implementation
  • Adding custom system call
    • 1. Create a custom system call table
    • 2. Assign new system call number
    • 3. User system call implementation
    • 4. Protected system call implementation
    • 5. Build system changes to add custom system calls
  • Translation of API to system call
  • Performance impact of system call
• Design choices
  • Separate stack for servicing system calls
  • Data handling during context switch
  • User space interrupt/event handling
  • Driver development
  • Separate heap allocators
• Secure boot
  • Overview
  • Protected app secure boot
  • User app secure boot
  • Certificate based verification scheme
    • Protected app
    • User app
  • Verification process
  • Signature block format
  • How to enable Secure boot
    • Protected app
    • User app