Merge branch 'release/2.0.x' into main
Accommodate changes made during release v2.0.0
Signed-off-by: David Hu <david.hu@arm.com>
Change-Id: Ic28ef51065f6ba5ca41066961b0e378e3511eff2
diff --git a/docs/partitions/adac/adac_impl_for_rss.rst b/docs/partitions/adac/adac_impl_for_rss.rst
new file mode 100644
index 0000000..e35891a
--- /dev/null
+++ b/docs/partitions/adac/adac_impl_for_rss.rst
@@ -0,0 +1,125 @@
+####################################
+ADAC implementation for RSS platform
+####################################
+
+ADAC Requirements for RSS
+=========================
+
+For RSS, ADAC design and implementation must meet below requirements.
+
+1. Since RSS is HES (Hardware Enforced Security) host for CCA (Confidential
+ Compute Architecture) system, ADAC functionality must be implemented by RSS.
+2. By default, CCA HES and other trusted subsystems debug should be disabled
+ all the time.
+3. When in a secured (trustworthy) state, no debug should be allowed to RSS,
+ and other components of CCA System security Domain.
+4. If life cycle is not in a secured state and if a CCA component debug is
+ requested, a new debug session should be initiated.
+5. Likewise at the end of debug session, all debug interfaces should be closed
+ and a system reset is required to return to the previous state.
+6. Depending on current policy, the debug start and stop request may require
+ a system reset for the request to be processed in a distinct debug session.
+ For RSS, a system reset is required for handling debug requests for any
+ components of CCA security domain.
+7. Finally, CCA Platform Attestation token should be different if any CCA debug
+ is enabled.
+
+Implementation Constraints
+==========================
+
+PSA ADAC protocol specifies use of asymmetric key cryptography for certificate
+parsing and authentication. Ideally, authentication and application of
+permissions should be done at the same time in boot so that they cannot be
+tampered later on, but
+
+* BL1 is constrained on memory resources and
+* BL1 is immutable, so any flaw in the authentication scheme would result in
+ a permanent security vulnerability.
+
+Hence, authentication has to handled as runtime service while appropriate
+permissions can be applied in the bootloader.
+
+Design description
+==================
+
+As per the ADAC architecture, debug host must implement Secure Debug Manager
+(SDM) component while debug target requires Secure Debug Authenticator (SDA)
+as mentioned in architecture specification. Logical link is established
+among the above two components to establish secure debug connection.
+
+To meet the above requirements, ADAC protocol is integrated in TF-M as follows:
+
+1. A new ADAC runtime service which calls SDA to authenticate any incoming debug
+ request from other components.
+2. Above service only acknowledges any incoming debug request if the device is
+ in appropriate life cycle state. Else, it rejects any incoming debug request.
+ Here the appropriate life cycle state is defined by the platform specific
+ policy.
+3. Once the service acknowledges the request, it sends the request to the
+ core protocol API for authentication. It also checks if the host has
+ appropriate access rights permissions. If it authenticates the host
+ successfully, it stores the debug state and may initiate the reset (depending
+ on platform policy).
+4. On immediate reset, the bootloader (BL1_2) retrieves the stored debug state
+ and applies corresponding debug permissions.
+5. It also locks the related DCU bits so that the applied permissions stays
+ the same throughout the debug session.
+6. Runtime service now waits for debug end signal to end debug session. To end
+ current debug session, it stores the state again and initiates the reset
+ (depending on platform policy).
+7. On reset, BL1_2 resets the permission and locks the DCU to continue
+ normal execution.
+8. For debug request of any components where platform policy does not require a
+ reset, ADAC service does not initiate any reset and enables the debug
+ immediately.
+
+Hardware abstraction layer Interface
+====================================
+
+Classification of various debug zones is platform/system specific.
+For system with RSS subsystem, these are mainly classified into CCA security
+domain debug and Non-CCA debug zones.
+
+- ``tfm_debug_zones``: enumerates 2 CCA and 4 Non-CCA debug zones.
+
+- ``tfm_platform_system_reset()``: Request system reset to initiate or terminate
+ a debug session.
+
+- ``tfm_plat_otp_read()``: Reads the life cycle state as well as secure debug
+ key required for authentication.
+
+Bootloader Interface
+====================
+
+The ADAC runtime service requires to convey debug state information between
+runtime service and bootloader. This needs be in platform specific
+predefined persistent area as this information needs to be retained after reset.
+
+For RSS platform, this functionality is provided by RESET_SYNDROME register.
+8 bits field, SWSYN, of above register is allocated to convey debug state
+information between bootloader and runtime service
+
+- ``lcm_dcu_set_enabled()``: Apply appropriate debug zone permissions by setting
+ the DCU register values.
+
+- ``lcm_dcu_set_locked()``: Locks the DCU so permission cannot be modified
+ during that power cycle.
+
+ADAC Protocol (SDA) integration
+===============================
+
+- ``tfm_to_psa_adac_rss_secure_debug()``: Initiates the connection with the
+ host debugger and performs secure debug authentication process.
+
+Enable Secure Debug
+===================
+
+To enable ADAC on RSS, below options must be configured:
+
+- ``-DPLATFORM_PSA_ADAC_SECURE_DEBUG=ON``
+
+- ``-DTFM_PARTITION_ADAC=ON``
+
+--------------
+
+*Copyright (c) 2023, Arm Limited. All rights reserved.*
diff --git a/docs/partitions/adac/adac_integration_guide.rst b/docs/partitions/adac/adac_integration_guide.rst
new file mode 100644
index 0000000..041b4fa
--- /dev/null
+++ b/docs/partitions/adac/adac_integration_guide.rst
@@ -0,0 +1,158 @@
+#########################################
+ADAC (Authenticated Debug Access Control)
+#########################################
+
+************
+Introduction
+************
+
+Background
+==========
+In order to make sure debug capabilities of any system do not become attack
+vectors, PSA provides reference ADAC system architecture. It specifies
+functional layers that reside above actual physical link.
+
+Authenticated Debug Access Control (ADAC), also referred to as Secure Debug, is
+a protocol that provides a way to use strong authentication to restrict device
+debug access to only authorized entities. Across various life cycle states of
+target device, it permits appropriate access to finely configured domains.
+
+Requirements
+============
+Debug capabilities must achieve several safety goals to be fully resilient.
+It requires
+
+1. Strong authentication
+2. Finely grained hardware and firmware domains
+3. Enforcing debug limitations
+
+ADAC protocol is fully flexible to meet the above goals. But depending on the
+system design and topology, it must be implemented so to meet varying attack
+surface.
+
+ADAC runtime services fulfills requirement #1 mentioned above and authenticates
+incoming debug request by calling ADAC core protocol Secure debug manager API.
+
+Secure debug policy
+===================
+
+Depending on hardware and system topology and security requirements, each
+platform may have its own custom policy. It includes (but is not limited to)
+
+1. Classification of various debug zones
+2. Determination of appropriate debug permissions for each zone
+3. Appropriate life cycle states where debug request should be acknowledged
+4. Whether a new power cycle session is required to initiate and close a specific
+ session
+
+Implementation of policies (#1 and #2) is outside of scope of runtime ADAC
+service and must be implemented and integrated into suitable layer of firmware.
+However, depending on platform specific implementation, ADAC runtime service may
+check for appropriate current device life cycle state. It may also request a
+system reset to initiate and close a debug session.
+
+************************************
+Code structure & Service Integration
+************************************
+
+The ADAC Service source and header files are located in the current directory.
+The interface for the ADAC runtime Service is located in ``interface/include``.
+The only header to be included by applications that want to use functions from
+the PSA API is ``tfm_adac_api.h``.
+
+Service interface
+=================
+The ADAC Service exposes the following interface:
+
+.. code-block:: c
+
+ /*!
+ * \brief Authenticates the requested debug service.
+ *
+ * \param[in] debug_request Request identifier for the debug zone
+ * (valid values vary based on the platform
+ * Each bit of the \p debug_request represents
+ * debug request for corresponding zone.
+ * e.g.
+ * If no bits are set => no debug request
+ * If bit0 is set => start debug for zone1
+ * If bit0 is cleared => end debug for zone1
+ * If bit1 is set => start debug for zone2
+ * If bit1 is cleared => end debug for zone2
+ * ...
+ *
+ * Enumeration of zones (zone1, zone2, etc.) is
+ * done by ``tfm_debug_zones`` (platform specific)
+ *
+ * \return Returns PSA_SUCCESS on success,
+ * otherwise error as specified in \ref psa_status_t
+ */
+ psa_status_t tfm_adac_service(uint32_t debug_request)
+
+Service source files
+====================
+- ``tfm_adac_api.c``: Implements the secure API layer to allow
+ other services in the secure domain to request functionalities
+ from the adac service using the PSA API interface.
+
+- ``adac_req_mngr.c``: Includes the initialization entry of
+ adac service and handles adac service requests in IPC model.
+
+- ``adac.c``: Implements core functionalities such as implementation
+ of APIs, handling and processing of debug request.
+
+Hardware abstraction layer
+==========================
+As mentioned above, classification of various debug zones is output of
+platform/system specific debug policy formulation.
+
+Below additional HAL interface MAY be required depending on platform policy.
+
+- ``tfm_debug_zones``: enumerates various debug zones.
+
+- ``tfm_platform_system_reset()``: Request system reset to initiate or terminate
+ a debug session.
+
+- ``tfm_plat_otp_read()``: Reads the life cycle state as well as secure debug
+ key required for authentication.
+
+Bootloader Interface
+====================
+The ADAC runtime service requires to convey debug state information between
+runtime service and bootloader. Implementation of this functionality is
+dependant on platform hardware.
+
+ADAC Protocol (SDA) integration
+===============================
+ADAC protocol which implements the Secure Debug Authenticator (SDA) component
+is source in external github repository.
+
+ ``git@github.com:ARMmbed/psa-adac.git``.
+
+The API to initiate the connection with host debugger and to perform
+authentication process is platform specific. It requires secure debug keys as
+input for authentication.
+
+For example for RSS platform, the API to integrate is:
+
+- ``tfm_to_psa_adac_rss_secure_debug()``
+
+Please follow the below link for further information on SDA implementation.
+
+| `psa-adac read me`_
+
+.. _psa-adac read me:
+ https://developer.arm.com/documentation/den0101/latest
+
+*********
+Reference
+*********
+
+| `ADAC specification`_
+
+.. _ADAC specification:
+ https://developer.arm.com/documentation/den0101/latest
+
+--------------
+
+*Copyright (c) 2022-2023, Arm Limited. All rights reserved.*
diff --git a/docs/partitions/index.rst b/docs/partitions/index.rst
index 048cbb2..c917b63 100644
--- a/docs/partitions/index.rst
+++ b/docs/partitions/index.rst
@@ -6,6 +6,7 @@
:titlesonly:
:hidden:
+ Authenticated Debug Access Control Service Integration Guide <adac/adac_integration_guide>
Delegated Attestation Service Integration Guide <delegated_attestation/delegated_attest_integration_guide>
DICE Protection Environmnet <dice_protection_environment>
DMA-350 Privilege Separation <dma350_unpriv_partition/dma350_privilege_separation>
diff --git a/docs/partitions/partitions.rst b/docs/partitions/partitions.rst
index 203c002..2c3d9cd 100644
--- a/docs/partitions/partitions.rst
+++ b/docs/partitions/partitions.rst
@@ -66,6 +66,20 @@
- Gabor Toth `<gabor.toth@arm.com> <gabor.toth@arm.com>`_
- Mark Horvath `<mark.horvath@arm.com> <mark.horvath@arm.com>`_
+####
+adac
+####
+
+***********
+Description
+***********
+ADAC partition for authenticated debug and access control for RSS platform.
+
+***********
+Maintainers
+***********
+- Maulik Patel `<Maulik.Patel@arm.com>`_
+
---------------------------
*Copyright (c) 2021-2022, Arm Limited. All rights reserved.*
diff --git a/partitions/adac/CMakeLists.txt b/partitions/adac/CMakeLists.txt
new file mode 100644
index 0000000..70ef927
--- /dev/null
+++ b/partitions/adac/CMakeLists.txt
@@ -0,0 +1,98 @@
+#-------------------------------------------------------------------------------
+# Copyright (c) 2022-2023, Arm Limited. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-3-Clause
+#
+#-------------------------------------------------------------------------------
+
+if (NOT TFM_PARTITION_ADAC)
+ return()
+endif()
+
+cmake_minimum_required(VERSION 3.15)
+cmake_policy(SET CMP0079 NEW)
+
+add_library(tfm_app_rot_partition_adac STATIC)
+
+target_sources(tfm_app_rot_partition_adac
+ PRIVATE
+ adac.c
+ adac_req_mngr.c
+)
+
+# Add the generated source files
+target_sources(tfm_app_rot_partition_adac
+ # The intermedia file defines the partition stack.
+ PRIVATE
+ ${CMAKE_BINARY_DIR}/generated/secure_fw/partitions/adac/auto_generated/intermedia_tfm_adac.c
+)
+target_sources(tfm_partitions
+ # The load info file includes the static data of the partition.
+ INTERFACE
+ ${CMAKE_BINARY_DIR}/generated/secure_fw/partitions/adac/auto_generated/load_info_tfm_adac.c
+)
+
+# Set include directories
+target_include_directories(tfm_app_rot_partition_adac
+ PUBLIC
+ ${CMAKE_BINARY_DIR}/generated/secure_fw/partitions/adac
+ PRIVATE
+ ${CMAKE_CURRENT_SOURCE_DIR}
+)
+
+# Add dependency to the manifest_tool
+add_dependencies(tfm_app_rot_partition_adac manifest_tool)
+
+target_link_libraries(tfm_app_rot_partition_adac
+ PRIVATE
+ platform_s
+ tfm_sprt
+ trusted-firmware-m-psa-adac
+)
+
+############################ Secure API ########################################
+
+set(INTERFACE_SRC_DIR ${CMAKE_CURRENT_SOURCE_DIR}/interface/src)
+set(INTERFACE_INC_DIR ${CMAKE_CURRENT_SOURCE_DIR}/interface/include)
+
+target_sources(tfm_sprt
+ PRIVATE
+ ${INTERFACE_SRC_DIR}/tfm_adac_api.c
+)
+
+target_include_directories(tfm_sprt
+ PUBLIC
+ ${INTERFACE_INC_DIR}
+)
+
+############################ Non-secure API ####################################
+
+add_library(adac_api_ns INTERFACE)
+
+target_sources(adac_api_ns
+ INTERFACE
+ ${INTERFACE_SRC_DIR}/tfm_adac_api.c
+)
+
+target_include_directories(adac_api_ns
+ INTERFACE
+ ${INTERFACE_INC_DIR}
+)
+
+############################ Partition Defs ####################################
+
+target_link_libraries(tfm_partitions
+ INTERFACE
+ tfm_app_rot_partition_adac
+)
+
+target_compile_definitions(tfm_config
+ INTERFACE
+ TFM_PARTITION_ADAC
+)
+
+install(FILES ${INTERFACE_SRC_DIR}/tfm_adac_api.c
+ DESTINATION ${INSTALL_INTERFACE_SRC_DIR})
+
+install(FILES ${INTERFACE_INC_DIR}/tfm_adac_api.h
+ DESTINATION ${INSTALL_INTERFACE_INC_DIR})
diff --git a/partitions/adac/adac.c b/partitions/adac/adac.c
new file mode 100644
index 0000000..820abc4
--- /dev/null
+++ b/partitions/adac/adac.c
@@ -0,0 +1,156 @@
+/*
+ * Copyright (c) 2022-2023, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ */
+
+#include <stdint.h>
+#include <stdbool.h>
+#include "tfm_plat_defs.h"
+#include "tfm_plat_otp.h"
+#include "platform_regs.h"
+#include "platform_base_address.h"
+#include "tfm_platform_system.h"
+#include "psa_adac_platform.h"
+#include "target_cfg.h"
+#include "tfm_platform_api.h"
+
+#define ROTPK_SIZE 32
+
+static uint8_t secure_debug_rotpk[ROTPK_SIZE];
+static uint32_t current_debug_session;
+
+static uint32_t read_persistent_debug_state(void)
+{
+ uint16_t read_mask;
+ uint32_t reg_value;
+ uint32_t debug_state;
+
+ struct rss_sysctrl_t *sysctrl = (struct rss_sysctrl_t *)RSS_SYSCTRL_BASE_S;
+ reg_value = sysctrl->reset_syndrome;
+
+ /* Bits 24:31 (SWSYN) are allocated for software defined reset syndrome */
+ reg_value = (reg_value >> 24) & 0xFF;
+ /* Use last TFM_PLAT_LAST_CCA_ADAC_ZONE number of bits of
+ * RESET_SYNDROME.SWSYN register for conveying debug state information
+ */
+ read_mask = (1 << TFM_PLAT_LAST_CCA_ADAC_ZONE) - 1;
+ debug_state = reg_value & read_mask;
+
+ return debug_state;
+}
+
+static void write_persistent_debug_state(uint32_t debug_state)
+{
+ struct rss_sysctrl_t *sysctrl = (struct rss_sysctrl_t *)RSS_SYSCTRL_BASE_S;
+ uint32_t reg_value = sysctrl->swreset;
+
+ /* Clear bits 24:31 (SWSYN)in SWRESET reg */
+ reg_value = reg_value & 0x00FFFFFF;
+ sysctrl->swreset = reg_value | ((debug_state & 0xFF) << 24);
+}
+
+static psa_status_t set_non_cca_debug(uint32_t debug_request)
+{
+// TODO: Implement the required updates
+ current_debug_session = debug_request;
+
+ return PSA_SUCCESS;
+}
+
+static psa_status_t set_cca_debug(uint32_t debug_request)
+{
+ enum tfm_platform_err_t plat_err;
+
+ write_persistent_debug_state(debug_request);
+
+ /* Trigger a reset */
+ plat_err = tfm_platform_system_reset();
+ if (plat_err != TFM_PLATFORM_ERR_SUCCESS) {
+ return PSA_ERROR_SERVICE_FAILURE;
+ }
+
+ return PSA_SUCCESS;
+}
+
+psa_status_t adac_service_request(uint32_t debug_request)
+{
+ int rc;
+
+ /* check if invalid debug request */
+ if (debug_request & ~((1U << (TFM_PLAT_MAX_NUM_DEBUG_ZONES - 1)) - 1)) {
+ return PSA_ERROR_INVALID_ARGUMENT;
+ }
+
+ if (debug_request == current_debug_session) {
+ /* Do nothing as requested session already in progress */
+ return PSA_SUCCESS;
+ }
+
+ if ((current_debug_session != TFM_PLAT_NO_DEBUG) &&
+ (debug_request != TFM_PLAT_NO_DEBUG)) {
+
+ /* A debug session is already in progress; terminate it first before
+ * any new request
+ */
+ return PSA_ERROR_NOT_PERMITTED;
+ }
+
+ if (debug_request == TFM_PLAT_NO_DEBUG) {
+ /* Request to terminate the current debug session in progress */
+ if (current_debug_session & ((1 << TFM_PLAT_LAST_CCA_ADAC_ZONE) - 1)) {
+ return set_cca_debug(TFM_PLAT_NO_DEBUG);
+ } else {
+ return set_non_cca_debug(TFM_PLAT_NO_DEBUG);
+ }
+ }
+
+ /* Authenticate incoming debug request */
+ rc = tfm_to_psa_adac_rss_secure_debug(secure_debug_rotpk, ROTPK_SIZE);
+ if (rc != 0) {
+ /* Authentication failure */
+ return PSA_ERROR_NOT_PERMITTED;
+ }
+
+ if (debug_request & ((1 << TFM_PLAT_LAST_CCA_ADAC_ZONE) - 1)) {
+ return set_cca_debug(debug_request);
+ } else {
+ return set_non_cca_debug(debug_request);
+ }
+
+ return PSA_SUCCESS;
+}
+
+psa_status_t adac_sp_init(bool *is_service_enabled)
+{
+ enum tfm_plat_err_t err;
+ enum plat_otp_lcs_t lcs;
+
+ *is_service_enabled = false;
+
+ /* Read LCS from OTP */
+ err = tfm_plat_otp_read(PLAT_OTP_ID_LCS, sizeof(lcs), (uint8_t*)&lcs);
+ if (err != TFM_PLAT_ERR_SUCCESS) {
+ return PSA_ERROR_SERVICE_FAILURE;
+ }
+
+ if(lcs != PLAT_OTP_LCS_SECURED) {
+ /* Device is not in secured state, hence ADAC service should be
+ * disabled
+ */
+
+ } else {
+ err = tfm_plat_otp_read(PLAT_OTP_ID_SECURE_DEBUG_PK, ROTPK_SIZE,
+ secure_debug_rotpk);
+ if (err != TFM_PLAT_ERR_SUCCESS) {
+ return PSA_ERROR_SERVICE_FAILURE;
+ }
+
+ *is_service_enabled = true;
+ /* Read current value of debug state from PSI */
+ current_debug_session = read_persistent_debug_state();
+ }
+
+ return PSA_SUCCESS;
+}
diff --git a/partitions/adac/adac.h b/partitions/adac/adac.h
new file mode 100644
index 0000000..bc76373
--- /dev/null
+++ b/partitions/adac/adac.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2022-2023, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ */
+#ifndef __ADAC_H__
+#define __ADAC_H__
+
+#include <stdbool.h>
+#include "psa/error.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * \brief Initialise ADAC secure partition service.
+ *
+ * \param[out] is_service_enabled Whether authenticated debug service is
+ * enabled or not.
+ *
+ * \return A status indicating the success/failure of the operation
+ *
+ * \retval #PSA_SUCCESS
+ * Success.
+ * \retval #PSA_ERROR_SERVICE_FAILURE
+ * Service is not able to read LCS state or key from OTP.
+ */
+
+psa_status_t adac_sp_init(bool *is_service_enabled);
+/*!
+ * \brief Authenticates the requested debug service.
+ *
+ * \param[in] debug_request Request identifier for the debug zone
+ * (valid values vary based on the
+ * platform). Each bit of the
+ * \p debug_request represents
+ * request for corresponding zone.
+ *
+ * \return Returns PSA_SUCCESS on success,
+ * otherwise error as specified in \ref psa_status_t
+ */
+psa_status_t adac_service_request(uint32_t debug_request);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __ADAC_H__ */
diff --git a/partitions/adac/adac_manifest_list.yaml b/partitions/adac/adac_manifest_list.yaml
new file mode 100644
index 0000000..c3d9880
--- /dev/null
+++ b/partitions/adac/adac_manifest_list.yaml
@@ -0,0 +1,28 @@
+#-------------------------------------------------------------------------------
+# Copyright (c) 2022-2023, Arm Limited. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-3-Clause
+#
+#-------------------------------------------------------------------------------
+{
+ "description": "TFM Authenticated Debug Service",
+ "type": "manifest_list",
+ "version_major": 0,
+ "version_minor": 1,
+ "manifest_list": [
+ {
+ "description": "TFM ADAC Service Partition",
+ "manifest": "tfm_adac.yaml",
+ "output_path": "secure_fw/partitions/adac",
+ "conditional": "TFM_PARTITION_ADAC",
+ "version_major": 0,
+ "version_minor": 1,
+ "pid": 276,
+ "linker_pattern": {
+ "library_list": [
+ "*tfm_*partition_adac.*"
+ ]
+ }
+ }
+ ]
+}
diff --git a/partitions/adac/adac_req_mngr.c b/partitions/adac/adac_req_mngr.c
new file mode 100644
index 0000000..f71f737
--- /dev/null
+++ b/partitions/adac/adac_req_mngr.c
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2022-2023, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ */
+
+#include <stdint.h>
+#include <stdbool.h>
+#include "adac.h"
+#include "psa/error.h"
+#include "psa/service.h"
+#include "psa_manifest/pid.h"
+#include "tfm_adac_api.h"
+
+static bool is_service_enabled;
+
+static psa_status_t adac_service(const psa_msg_t *msg)
+{
+ uint32_t debug_request;
+ size_t num;
+
+ /* Check input parameter */
+ if (msg->in_size[0] != sizeof(debug_request)) {
+ return PSA_ERROR_PROGRAMMER_ERROR;
+ }
+
+ num = psa_read(msg->handle, 0, &debug_request, sizeof(debug_request));
+ if (num != sizeof(debug_request)) {
+ return PSA_ERROR_PROGRAMMER_ERROR;
+ }
+
+ return adac_service_request(debug_request);
+}
+
+/**
+ * \brief The ADAC partition's entry function.
+ */
+psa_status_t tfm_adac_init(void)
+{
+ return adac_sp_init(&is_service_enabled);
+}
+
+psa_status_t tfm_adac_service_sfn(const psa_msg_t *msg)
+{
+ if (!is_service_enabled) {
+ return PSA_ERROR_NOT_PERMITTED;
+ }
+
+ /* Process the message type */
+ switch (msg->type) {
+ case 0:
+ return adac_service(msg);
+ default:
+ /* Invalid message type */
+ return PSA_ERROR_NOT_SUPPORTED;
+ }
+}
diff --git a/partitions/adac/interface/include/tfm_adac_api.h b/partitions/adac/interface/include/tfm_adac_api.h
new file mode 100644
index 0000000..906c6f9
--- /dev/null
+++ b/partitions/adac/interface/include/tfm_adac_api.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) 2022-2023, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ */
+
+#ifndef __TFM_ADAC_API_H__
+#define __TFM_ADAC_API_H__
+
+#include <stdint.h>
+#include "psa/error.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+ * \brief Authenticates and process input debug request.
+ *
+ * \param[in] debug_request Request identifier for the debug zone
+ * (valid values vary based on the
+ * platform). Each bit of the
+ * \p debug_request represents
+ * request for corresponding zone.
+ *
+ * \return A status indicating the success/failure of the operation
+ *
+ * \retval #PSA_SUCCESS The operation completed successfully
+ * \retval #PSA_ERROR_PROGRAMMER_ERROR The operation failed because failure
+ * to provided arguments are incorrect
+ * \retval #PSA_ERROR_INVALID_ARGUMENT The operation failed because debug
+ * request identifier is invalid
+ * \retval #PSA_ERROR_NOT_PERMITTED The operation failed because the
+ * conditions for providing secure
+ * debug service are not valid.
+ * for e.g. if the LCS is not in
+ * required state OR the service failed
+ * to authenticate the host.
+ */
+psa_status_t tfm_adac_service(uint32_t debug_request);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __TFM_ADAC_API_H__ */
diff --git a/partitions/adac/interface/src/tfm_adac_api.c b/partitions/adac/interface/src/tfm_adac_api.c
new file mode 100644
index 0000000..0517e66
--- /dev/null
+++ b/partitions/adac/interface/src/tfm_adac_api.c
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2022-2023, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ */
+
+#include "tfm_adac_api.h"
+#include <stddef.h>
+#include "psa/client.h"
+#include "psa/error.h"
+#include "psa_manifest/sid.h"
+
+psa_status_t tfm_adac_service(uint32_t debug_request)
+{
+ psa_invec in_vec[] = {
+ { .base = &debug_request, .len = sizeof(debug_request) }
+ };
+
+ return psa_call(TFM_ADAC_SERVICE_HANDLE,
+ 0,
+ in_vec,
+ IOVEC_LEN(in_vec),
+ NULL,
+ 0);
+}
\ No newline at end of file
diff --git a/partitions/adac/tfm_adac.yaml b/partitions/adac/tfm_adac.yaml
new file mode 100644
index 0000000..4e4f32d
--- /dev/null
+++ b/partitions/adac/tfm_adac.yaml
@@ -0,0 +1,29 @@
+#-------------------------------------------------------------------------------
+# Copyright (c) 2022-2023, Arm Limited. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-3-Clause
+#
+#-------------------------------------------------------------------------------
+{
+ "psa_framework_version": 1.1,
+ "name": "TFM_SP_ADAC",
+ "type": "PSA-ROT",
+ "priority": "NORMAL",
+ "model": "SFN",
+ "entry_init": "tfm_adac_init",
+ "stack_size": "0x0800",
+ "services" : [
+ {
+ "name": "TFM_ADAC_SERVICE",
+ "sid": "0x00000160",
+ "non_secure_clients": true,
+ "connection_based": false,
+ "stateless_handle": auto,
+ "version": 1,
+ "version_policy": "STRICT"
+ }
+ ],
+ "dependencies": [
+ "TFM_PLATFORM_SERVICE"
+ ]
+}
\ No newline at end of file