Update TF-M support to v1.2 #14354

LDong-Arm · 2021-02-25T16:54:39Z

Summary of changes

This PR brings in all the changes to update trusted-firmware-m support from v1.1 to v1.2:

Mbed TLS 2.24.0 as required by TF-M v1.2
TF-M v1.2 targets: PSA APIs from TF-M
Support for ARM_MUSCA_B1 and ARM_MUSCA_S1 (configurations, bootloader binaries, secure binaries and signing scripts, etc.)
Continued availability of psa_set_key_enrollment_algorithm() - deprecated, included for backward-compatibility only, to be removed from future TF-M updates
Miscellaneous fixes to make sure all supported PSA targets work, see the commit history for details
Changes in the trusted-firmware-m (link) and tf-m-tests (link) repositories to enable Mbed OS integration. Note that some of the changes have been upstreamed.

Just as before this update

CYTFM_064B0S2_4343W remains on TF-M v1.0, supporting mbed-os-example-psa but not mbed-os-tf-m-regression-tests. Any updates to this target are maintained by Cypress.
Mbed PSA (non-TF-M) targets (e.g. K64F) continue to support mbed-os-example-psa. Note that Mbed PSA's APIs currently lag behind these of TF-M.

The following have been removed:

ARM_MUSCA_A as an Mbed target
Integration of TF-M v1.1 (replaced by v1.2)
<TARGET>_NS aliases for ARM_MUSCA_B1 and ARM_MUSCA_S1

Not yet included in this PR, to be added in the very near future:

Image signing for ARM_MUSCA_B1 and ARM_MUSCA_S1 with Mbed CLI 2. Until we add this, please use Mbed CLI 1 for now.

Impact of changes

See the PR description for targets that are impacted.

Migration actions required

From the perspective of Mbed OS support, applications for ARM_MUSCA_B1 and ARM_MUSCA_S1 should continue to work as before.

A board running the TF-M v1.1 firmware should be able to update to the v1.2 firmware without resetting data (verified on Musca targets), though downgrading is not possible.

Any references to ARM_MUSCA_B1_NS and ARM_MUSCA_S1_NS as target names should be changed to have _NS removed from the names.

Documentation

The updated steps to build and test TF-M v1.2 are in README.md in mbed-os-tf-m-regression-tests (on the tf-m-v1.2-integration branch currently, to be merged after this PR).

The porting documentation is updated by ARMmbed/mbed-os-5-docs#1416, to be merged after this PR. On the next Mbed OS release, the update will become visible on https://os.mbed.com/docs/mbed-os/latest/porting/porting-security.html

Pull request type

[] Patch update (Bug fix / Target update / Docs update / Test update / Refactor)
[x] Feature update (New feature / Functionality change / New API)
[] Major update (Breaking change E.g. Return code change / API behaviour change)

Test results

[] No Tests required for this change (E.g docs only update)
[x] Covered by existing mbed-os tests (Greentea or Unittest)
[x] Tests / results supplied as part of this PR

Nightly CI passes for the tf-m-v1.2-integration branch of mbed-os-tf-m-regression-tests

Compilation tests of mbed-os-example-psa for other PSA targets including Mbed PSA targets (e.g. K64F) and the TF-M v1.0 target CYTFM_064B0S2_4343W.

Reviewers

@evedon @jainvikas8 @ARMmbed/mbed-os-security

hash_wrappers.c is specific to Mbed OS, moving it into platform as its original directory is for imported Mbed TLS source only.

Note: Now we need to export common.h to the include path, because this header is now also needed by PSA Crypto service.

Files have been automatically imported by setting MBED_TLS_RELEASE to mbedtls-2.24.0 in connectivity/mbedtls/tools/importer/Makefile and running `make` in that directory.

Rather than maintaining a specific `TARGET_TFM_V1_x`, its better to use more generic name `TARGET_TFM_LATEST` to avoid confusion on the latest TFM version supported by Mbed OS * Rename the folder from `TARGET_TFM_V1_1` to `TARGET_TFM_LATEST` * Update the CmakeLists.txt * Change the name of the MUSCA targets to maintain uniformity with TF-M v1.2 * Update target.json for PSA_V8_M to use `TFM_LATEST`

These files have been imported/copied from: * ARMmbed/trusted-firmware-m * ARMmbed/tf-m-tests These are generic files, which are required for TF-M v1.2 integration with Mbed OS for PSA_V8M and PSA_DUAL_CORE targets.

The PSA headers imported from TF-M does not contain a declaration of mbedtls_ecc_group_to_psa(), which is expected by pk.c from Mbed TLS. This leads to an "undefined symbol" error when using the ARM toolchain to compile an application for a TF-M target.

* Partition files are synced with TF-M v1.2 * To have uniformity with TF-M v1.2, rename the following: ** image_macros_preprocessed_ns.c to `signing_layout_ns.c` ** image_macros_preprocessed_s.c to `signing_layout_s.c` * `MCUBOOT_IMAGE_NUMBER` is set to 2 by default for TF-M v1.2, therefore it is necessary that Mbed OS compiles the right macros for when linking and using the partition files ** Workaround ** The `region_defs.h` has an explicit definition of `BL2`, even though it is already defined in target.json for `ARM_MUSCA_B1`. This is because of Mbed CLI 1, as it can't seem to use the right macro when linking the files for Mbed OS application when using the ARMCLANG toolchain.

* Remove the old `mcuboot.bin` * Add `bl2.bin` * Update TF-M secure binaries GCC_ARM toolchain used.

The script changes are required with respect to TF-M v1.2 integration for this target. The imgtool.py is been replaced with `wrapper.py` which uses click command to run the signing algorithm. The version `-v` and dependencies `-d` have been updated to resolve upgrade issues from TF-M v1.1 --> v1.2

* Partition files are synced with TF-M v1.2 * To have uniformity with TF-M v1.2, rename the following: ** image_macros_preprocessed_ns.c to `signing_layout_ns.c` ** image_macros_preprocessed_s.c to `signing_layout_s.c` * `MCUBOOT_IMAGE_NUMBER` is set to 2 by default for TF-M v1.2, therefore it is necessary that Mbed OS compiles the right macros for when linking and using the partition files.

* Remove the old `mcuboot.bin` * Add `bl2.bin` * Update TF-M secure binaries GCC_ARM toolchain used.

The script changes are required with respect to TF-M v1.2 integration for this target. The imgtool.py is been replaced with `wrapper.py` which uses click command to run the signing algorithm. The version `-v` and dependencies `-d` have been updated to resolve upgrade issues from TF-M v1.1 --> v1.2

ARM_MUSCA_A1 is not supported since Mbed OS 6.0 Refer: #13165 Therefore remove files from kv_config and TF-M post binary hook script.

Raise an exception if there was an issue with handling any command when signing the binaries for MUSCA targets.

This files are imported and part of: mcu-tools/mcuboot@a8e12da Issue has been raised mcu-tools/mcuboot#930 As these scripts are going to be part of release its important to have licensing information.

Files containing signing layouts are parsed by the post build hook for signing purpose only.

The vector table needs to be copied from ROM to RAM, in order for us to set IRQ handlers at run time. The address in RAM is defined by `NVIC_RAM_VECTOR_ADDRESS` in `cmsis_nvic.h`, but its inclusion was missing from Musca S1's `cmsis.h` and consequently the vector table was not copied. On most targets this results in a memory access error when we set vectors. But Musca S1's ROM is in its MRAM (which can be accessed like any RAMs), and this causes the ROM image to be modified with no error/warning. On the next boot, MCUboot fails the image integrity check. This commit adds the missing include, in the same spirit as 01dd997.

Add `psa_set_key_enrollment_algorithm()` and `psa_get_key_enrollment_algorithm()` for TF-M targets. Note: This is deprecated and for backward compatibility only. Setting an enrollment algorithm is not recommended, because using the same key with different algorithms can allow some attacks based on arithmetic relations between different computations made with the same key, or can escalate harmless side channels into exploitable ones. Use this function only if it is necessary to support a protocol for which it has been verified that the usage of the key with multiple algorithms is safe.

Setting/getting key enrollment algorithm is not recommended and not part of the vanilla PSA or TF-M. For now keep the API just for backward compatibility with existing projects, and this commit adds deprecation warnings.

In targets.json, ARM_MUSCA_B1 and ARM_MUSCA_S1 have alias target names suffixed with `_NS`. They are identical to targets without `_NS` and exist purely for compatibility with the old naming convention we had. The CI builds them as separate targets and uses extra resources. As we are upgrading Musca targets to TF-M v1.2, it's time to clean up the aliases.

The directory `mbed-tls-lib` previously in `.gitignore` no longer exists. Instead, we can simply ignore the entire TARGET_IGNORE.

The Mbed TLS importer accidentally imports Makefile and .gitignore from Mbed TLS's `library/` directory. This commit restricts the pattern to .h and .c files only, and removes the unnecessary files.

Mbed TLS 2.24.0 has added a new function mbedtls_ecp_write_key() which is the reverse of the existing mbedtls_ecp_read_key(). This function should be platform agnostic, but needs to be copied into Cypress's hardware-accelerated ECP driver as part of the updated API.

…ET_TFM/TARGET_TFM_LATEST "

Mbed TLS 2.24.0 requires a few new macros and an inline function in the PSA Crypto header. This PR adds them to make sure the TF-M v1.0 target (specifically CYTFM_064B0S2_4343W) continues to compile with the new Mbed TLS. Note: Support for older versions of TF-M than v1.2 will be dropped, so existing TF-M targets should migrate to TF-M v1.2 as soon as possible.

LDong-Arm · 2021-02-25T17:15:51Z

@Patater
From Travis:

Failure: Frozen files were modified
tools/targets/ARM_MUSCA.py
tools/targets/__init__.py
tools/targets/musca_b1-root-rsa-3072.md
tools/targets/musca_s1-root-rsa-3072.md

Is it possible to modify the rules to not check tools/targets where the post-binary hooks are located?

LDong-Arm · 2021-03-01T11:00:57Z

@ARMmbed/mbed-b-tools
~~I've created #14356 to allow updating the signing script for Musca targets~~
Update: Removed that PR, as the check is necessary for the online compiler support. Instead, the usual strategy is to merge PRs without passing "Frozen tools check" if a change in tools/targets is really required.

evedon · 2021-03-01T11:36:21Z

targets/targets.json

@@ -144,7 +144,7 @@
        ],
        "extra_labels": [
            "TFM",
-            "TFM_V1_1",
+            "TFM_LATEST",


I agree that using a generic name like TFM_LATEST simplifies the maintenance but it is less explicit than before. Since you explained in your documentation PR how to map TFM_LATEST to the actual TFM release that is supported, this should be fine.

LDong-Arm · 2021-03-01T13:59:14Z

"Travis CI - Branch" passed, so the Travis coverage is already complete, even though "Travis CI - Pull Request" did not finish due to the frozen tools check.

LDong-Arm · 2021-03-01T14:16:46Z

@evedon Thanks for the review.
@0xc0170 Shall we run CI on this please? As for the Travis failure, please see the explanation above - it's a special case where we need to ignore the failure instead of changing the scripts.

mbed-ci · 2021-03-01T17:23:22Z

Jenkins CI Test : ✔️ SUCCESS

Build Number: 1 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

CLICK for Detailed Summary

jobs	Status
jenkins-ci/mbed-os-ci_unittests	✔️
jenkins-ci/mbed-os-ci_cmake-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_cmake-example-ARM	✔️
jenkins-ci/mbed-os-ci_build-greentea-ARM	✔️
jenkins-ci/mbed-os-ci_build-greentea-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-example-ARM	✔️
jenkins-ci/mbed-os-ci_build-cloud-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-cloud-example-ARM	✔️
jenkins-ci/mbed-os-ci_cmake-example-test	✔️
jenkins-ci/mbed-os-ci_greentea-test	✔️

LDong-Arm · 2021-03-02T11:07:33Z

@0xc0170 @adbridge The Core team have done the review. Now only a maintainer's review/approval is left.
(The "release-type" label needs to be manually changed from "major" to "feature" - the PR description is up to date.)

@ARMmbed/team-cypress @ifyall
FYI, all the changes for TF-M v1.2 update are in this PR. CYTFM_064B0S2_4343W remains on TF-M v1.0.

0xc0170

2 files permission change, otherwise LGTM

0xc0170 · 2021-03-03T08:56:47Z

tools/psa/tfm/bin_utils/assemble.py

@@ -3,6 +3,8 @@
 # Copyright 2017 Linaro Limited
 # Copyright (c) 2017-2019, Arm Limited.
 #
+# SPDX-License-Identifier: Apache-2.0


100644 → 100755 - can you revert the permission change for this and file below

755 (executable bit) is the latest permission in the upstream project: https://github.com/ARMmbed/trusted-firmware-m/tree/mbed-tfm-1.2/bl2/ext/mcuboot/scripts
and those files are imported. Can we keep them as they are?

OK, interesting they changed it.

Yea it was changed between TF-M v1.1 -> v1.2

LDong-Arm and others added 29 commits February 25, 2021 14:02

Add copyright header to hash_wrappers.c

9e48b78

Move hash_wrappers.c to platform subdirectory

e364157

hash_wrappers.c is specific to Mbed OS, moving it into platform as its original directory is for imported Mbed TLS source only.

Fix paths in Mbed TLS importer

e0d2c3d

Note: Now we need to export common.h to the include path, because this header is now also needed by PSA Crypto service.

Import mbedtls-2.24 and Mbed PSA Service (non-TFM)

410a1ba

Files have been automatically imported by setting MBED_TLS_RELEASE to mbedtls-2.24.0 in connectivity/mbedtls/tools/importer/Makefile and running `make` in that directory.

core: Upgrade TFM v1.2 related files

260a335

These files have been imported/copied from: * ARMmbed/trusted-firmware-m * ARMmbed/tf-m-tests These are generic files, which are required for TF-M v1.2 integration with Mbed OS for PSA_V8M and PSA_DUAL_CORE targets.

Update target ARM_MUSCA_B1 TF-M V1.2 binaries

65e2d45

* Remove the old `mcuboot.bin` * Add `bl2.bin` * Update TF-M secure binaries GCC_ARM toolchain used.

Update target ARM_MUSCA_S1 TF-M V1.2 binaries

39e226b

* Remove the old `mcuboot.bin` * Add `bl2.bin` * Update TF-M secure binaries GCC_ARM toolchain used.

Remove: ARM_MUSCA_A1 support

8648e4f

ARM_MUSCA_A1 is not supported since Mbed OS 6.0 Refer: #13165 Therefore remove files from kv_config and TF-M post binary hook script.

Remove old binary signing scripts of TF-M 1.1

308ffe9

Refactor: MUSCA targets post binary hook scripts

1a8386a

Raise an exception if there was an issue with handling any command when signing the binaries for MUSCA targets.

Add missing license header and SPDX identifier

79755ea

This files are imported and part of: mcu-tools/mcuboot@a8e12da Issue has been raised mcu-tools/mcuboot#930 As these scripts are going to be part of release its important to have licensing information.

Exclude Musca signing layouts from compilation

ac4533a

Files containing signing layouts are parsed by the post build hook for signing purpose only.

Deprecation warnings for key enrollment algorithm

eb0ac59

Setting/getting key enrollment algorithm is not recommended and not part of the vanilla PSA or TF-M. For now keep the API just for backward compatibility with existing projects, and this commit adds deprecation warnings.

Update .gitignore for Mbed TLS importer

241b062

The directory `mbed-tls-lib` previously in `.gitignore` no longer exists. Instead, we can simply ignore the entire TARGET_IGNORE.

Mbed TLS importer: don't import unnecessary files

1f4f6dd

The Mbed TLS importer accidentally imports Makefile and .gitignore from Mbed TLS's `library/` directory. This commit restricts the pattern to .h and .c files only, and removes the unnecessary files.

"Updated directory platform/FEATURE_EXPERIMENTAL_API/FEATURE_PSA/TARG…

2807a01

…ET_TFM/TARGET_TFM_LATEST "

"Updated secure binaries for [('ARM_MUSCA_B1', 'ARMCLANG')]"

29f7f9f

"Updated secure binaries for [('ARM_MUSCA_S1', 'ARMCLANG')]"

6ab4b1c

ciarmcom added the release-type: major label Feb 25, 2021

This was referenced Feb 25, 2021

Support Mbed CLI 2 ARMmbed/mbed-os-tf-m-regression-tests#88

Merged

Exclude tools/targets from frozen tools check #14356

Closed

evedon approved these changes Mar 1, 2021

View reviewed changes

This was referenced Mar 1, 2021

CMake: support signing TF-M targets with post binary hooks #14361

Merged

Fix imgtool import for CYTFM_064B0S2_4343W signing #14362

Merged

0xc0170 added needs: review release-type: feature and removed needs: work release-type: major labels Mar 2, 2021

0xc0170 requested changes Mar 3, 2021

View reviewed changes

LDong-Arm requested a review from 0xc0170 March 3, 2021 09:27

0xc0170 approved these changes Mar 3, 2021

View reviewed changes

0xc0170 added ready for merge and removed needs: review labels Mar 3, 2021

0xc0170 merged commit 76b2902 into master Mar 3, 2021

This was referenced Mar 3, 2021

.travis.yml: use the master branch of mbed-os ARMmbed/mbed-os-tf-m-regression-tests#90

Merged

TF-M v1.2 support ARMmbed/mbed-os-tf-m-regression-tests#91

Merged

mbedmain added release-version: 6.9.0 Release-pending and removed release-type: feature Release-pending labels Mar 15, 2021

gilles-peskine-arm mentioned this pull request Apr 27, 2021

Header name is too common in #include "common.h" Mbed-TLS/mbedtls#4425

Closed

adbridge removed the ready for merge label May 13, 2021

0xc0170 deleted the feature-tf-m-1.2-integration branch October 5, 2021 08:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update TF-M support to v1.2 #14354

Update TF-M support to v1.2 #14354

LDong-Arm commented Feb 25, 2021 •

edited

Loading

LDong-Arm commented Feb 25, 2021

LDong-Arm commented Mar 1, 2021 •

edited

Loading

evedon Mar 1, 2021

LDong-Arm commented Mar 1, 2021 •

edited

Loading

LDong-Arm commented Mar 1, 2021 •

edited

Loading

mbed-ci commented Mar 1, 2021

LDong-Arm commented Mar 2, 2021 •

edited

Loading

0xc0170 left a comment

0xc0170 Mar 3, 2021

LDong-Arm Mar 3, 2021

0xc0170 Mar 3, 2021 •

edited

Loading

LDong-Arm Mar 3, 2021

Update TF-M support to v1.2 #14354

Update TF-M support to v1.2 #14354

Conversation

LDong-Arm commented Feb 25, 2021 • edited Loading

Summary of changes

Impact of changes

Migration actions required

Documentation

Pull request type

Test results

Reviewers

LDong-Arm commented Feb 25, 2021

LDong-Arm commented Mar 1, 2021 • edited Loading

evedon Mar 1, 2021

Choose a reason for hiding this comment

LDong-Arm commented Mar 1, 2021 • edited Loading

LDong-Arm commented Mar 1, 2021 • edited Loading

mbed-ci commented Mar 1, 2021

Jenkins CI Test : ✔️ SUCCESS

Build Number: 1 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

LDong-Arm commented Mar 2, 2021 • edited Loading

0xc0170 left a comment

Choose a reason for hiding this comment

0xc0170 Mar 3, 2021

Choose a reason for hiding this comment

LDong-Arm Mar 3, 2021

Choose a reason for hiding this comment

0xc0170 Mar 3, 2021 • edited Loading

Choose a reason for hiding this comment

LDong-Arm Mar 3, 2021

Choose a reason for hiding this comment

LDong-Arm commented Feb 25, 2021 •

edited

Loading

LDong-Arm commented Mar 1, 2021 •

edited

Loading

LDong-Arm commented Mar 1, 2021 •

edited

Loading

LDong-Arm commented Mar 1, 2021 •

edited

Loading

LDong-Arm commented Mar 2, 2021 •

edited

Loading

0xc0170 Mar 3, 2021 •

edited

Loading