Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Replace Mbed PSA with TF-M PSA #12955

Merged
merged 16 commits into from
Jun 18, 2020
Merged

Replace Mbed PSA with TF-M PSA #12955

merged 16 commits into from
Jun 18, 2020

Conversation

Patater
Copy link
Contributor

@Patater Patater commented May 11, 2020 •
edited
Loading

Summary of changes

Replace the Mbed implementation of PSA with the implementation from TrustedFirmware-M (TF-M).

PSA is and continues to be provided as an experimental feature (under FEATURE_EXPERIMENTAL_API). The PSA implementation provided by TF-M is not guaranteed to provide the same functionality or API as the previous Mbed PSA implmementation being replaced.

Impact of changes

v8-M NS targets are now the only v8-M targets supported in Mbed OS for PSA platforms, as the TF-M build system outputs the S binary that Mbed OS consumes as-is. As such, targets like ARM_MUSCA_A1_NS have been renamed to ARM_MUSCA_A1 (although old names are temporarily provided for backwards compatibility).

Migration actions required

How targets enable PSA has changed. Please refer to features/FEATURE_PSA/supporting_psa_in_mbed-os.md for updated instructions on adding PSA to your target as a new target porting person.

Documentation

Porting guide updates for PSA at features/FEATURE_PSA/supporting_psa_in_mbed-os.md

Pull request type 

[] Patch update (Bug fix / Target update / Docs update / Test update / Refactor)
[X] Feature update (New feature / Functionality change / New API)
[] Major update (Breaking change E.g. Return code change / API behaviour change)

Test results 

[] No Tests required for this change (E.g docs only update)
[X] Covered by existing mbed-os tests (Greentea or Unittest)
[] Tests / results supplied as part of this PR

Reviewers

@Devran01 @jainvikas8

@Patater Patater mentioned this pull request May 11, 2020
Closed
@Patater Patater force-pushed the replace-mbed-psa-with-tfm branch from e7f9c22 to 6a2b930 Compare May 11, 2020 16:52
@ciarmcom
Copy link
Member

@Patater, thank you for your changes.
@ashok-rao @Devran01 @jainvikas8 @maclobdell @ARMmbed/mbed-os-crypto @ARMmbed/mbed-os-tls @ARMmbed/mbed-os-maintainers @ARMmbed/mbed-os-hal @ARMmbed/mbed-os-test @ARMmbed/mbed-os-core @ARMmbed/mbed-os-tools please review.

@0xc0170 0xc0170 changed the title WIP Replace Mbed PSA with TF-M PSA WIP: Replace Mbed PSA with TF-M PSA May 12, 2020
@Patater Patater force-pushed the replace-mbed-psa-with-tfm branch from 6a2b930 to fb0c244 Compare May 12, 2020 10:26
@Patater
Copy link
Contributor Author

Patater commented May 12, 2020

Force pushed to update astyle.

@Patater Patater force-pushed the replace-mbed-psa-with-tfm branch 2 times, most recently from 6e3b8a3 to c0a8f2c Compare May 12, 2020 12:46
@Patater
Copy link
Contributor Author

Patater commented May 12, 2020

Rebased to fix Mbed TLS importer script.

@Patater Patater force-pushed the replace-mbed-psa-with-tfm branch from c0a8f2c to b1b74a8 Compare May 13, 2020 09:48
@mergify
Copy link

mergify bot commented May 14, 2020

This PR cannot be merged due to conflicts. Please rebase to resolve them.

@Patater Patater force-pushed the replace-mbed-psa-with-tfm branch from b1b74a8 to 75c03cf Compare May 15, 2020 15:17
@Patater
Copy link
Contributor Author

Patater commented May 15, 2020

Rebased to update the porting guide and to simplify PSA target addition.

@Patater Patater force-pushed the replace-mbed-psa-with-tfm branch from 75c03cf to 3432316 Compare May 15, 2020 16:41
@Patater
Copy link
Contributor Author

Patater commented May 15, 2020

Rebased on latest master

@Patater Patater force-pushed the replace-mbed-psa-with-tfm branch from 3432316 to f6af90a Compare May 15, 2020 16:49
Patater and others added 16 commits June 18, 2020 12:16
@Patater
cypress: psoc64: Add TF-M compatibility (again)
d314a6c 
Partially revert f38e21f ("Update PSoC 6 BSPs to verion 1.2") to
restore TF-M compatibility.

Make the CY8CKIT_064S2_4343W target TF-M compatible by addding flash and
region definitions from TF-M (at c4f37c18c4a0) and by updating the
CY8CKIT_064S2_4343W linker script to create a flash image compatible
with TF-M.

Fixes: f38e21f ("Update PSoC 6 BSPs to verion 1.2")

Signed-off-by: Jaeden Amero <jaeden.amero@arm.com>
@Patater
psa: Fix style in psa_hrng.c
f4b676b
@jainvikas8 @Patater
psa: Add TF-M utility scripts to python path
8252f3e 
When python3 is enforced to build the ARM_MUSCA_A1 or ARM_MUSCA_B1
targets, it is unable to find binary utility tool scripts which are
imported from TF-M.

The reason to use the python3 environment is as follows: Mbed OS + TFM
contained a faulty boot record TLV, which failed the attestation test
(TF-M regression). The data in the boot record TLV will be included in
the generated attestation token as 1 item in the SW_COMPONENTS claim.

This data (in the boot record TLV) is pre-encoded in CBOR format at
build time and appended to the image during the image signing process
(done by the imgtool Python3 script).

Signed-off-by: Vikas Katariya <vikas.katariya@arm.com>
@Patater
musca_b1: Remove device-specific virtual NVIC
dc22d89 
Use instead the general TF-M v8-M virtual NVIC which will be added in
the commit that replaces Mbed PSA with TF-M PSA:
features/FEATURE_PSA/TARGET_TFM/TARGET_TFM_V8M/src/cmsis_nvic_virtual.c
@urutva @Patater
tools: Musca B1 signing strategy
e2af612 
Currently, the final binary (TF-M + Mbed OS) is signed after
concatenating TF-M and Mbed OS binaries. But TF-M signs the images
separately and then concatenates them. Update the Musca B1 signing
strategy to match TF-M.

Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
@urutva @Patater
target: Add BL2 macro to MUSCA B target config
db67302 
BL2 macro is used in `region_defs.h` to define the `BL2_HEADER_SIZE`.
Without BL2 macro, `BL2_HEADER_SIZE` is set to 0. This leads to
incorrect start address (Reset_Handler of Mbed OS) derived by TF-M based
on `region_defs.h` and BL2 macro.

BL2 macro is set for MUSCA B in TF-M.

Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
@urutva @Patater
target: Include missing cmsis_nvic.h
01dd997 
The header `cmsis_nvic.h` defines vector start address in RAM
`NVIC_RAM_VECTOR_ADDRESS` which is used in
`mbed_boot.c:mbed_cpy_nvic()`. But `mbed_boot.c` only includes
`cmsis.h`. Due to this `mbed_cpy_nvic` becomes an empty function and the
vectors don't get relocated to RAM. This causes BusFault error when Mbed
OS tries to update any of the IRQ handlers.

Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
@urutva @Patater
psa: Replace Mbed PSA with TF-M
76e911c 
Add TF-M to Mbed OS, replacing the previous PSA implementation for
TF-M-capable targets. This commit adds files imported from TF-M, without
modification. The version of TF-M imported can be found in
`features/FEATURE_PSA/TARGET_TFM/VERSION.txt`.

These changes switch to TF-M as the sole PSA implementation for v8-M and
dual core targets, with TF-M running on the secure side and Mbed OS
running on the non-secure side. Single core v7-M targets will continue
to have PSA implemented via PSA emulation, implemented by Mbed OS.

Move or remove many PSA-implementing files, as PSA will be provided by
TF-M on non-single-v7-M targets. Delete any files that are not relevant
for PSA emulation mode.
 - Remove imported TF-M SPM
 - Remove Mbed SPM and tests
 - Remove Mbed-implemented PSA services and tests
 - Remove PSA_SRV_IMPL, PSA_SRV_IPC, PSA_SRV_EMUL and NSPE.
 - Replace PSA_SRV_EMUL and PSA_SRV_IMPL with MBED_PSA_SRV
 - Remove any files autogenerated by
   "tools/psa/generate_partition_code.py", which no longer exists.

Add new feature `PSA` to support PSA in Mbed OS.

Move the Mbed OS implementation of PSA services for v7-M targets (which
employ PSA emulation, and don't yet use TF-M) to
features/FEATURE_PSA/TARGET_MBED_PSA_SRV. Update the `requires`
attribute in TESTS/configs/baremetal.json to avoid breaking baremetal
testing builds.

Update .astyleignore to match new directory structure

Update Mbed TLS importer to place files into FEATURE_PSA

Create the following generic PSA targets:

* `PSA_Target` (Root level PSA generic target)
* `PSA_V7_M` (Single v7-M PSA generic target)
* `PSA_DUAL_CORE` (Dual-core PSA generic target)
* `PSA_V8_M` (v8-M PSA generic target)

Flatten MUSCA_NS and private MUSCA targets into public MUSCA targets.

Move mcuboot.bin to flat location (removing prebuilt folder)

Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
Signed-off-by: Jaeden Amero <jaeden.amero@arm.com>
@urutva @Patater
psa: Import latest image signing scripts from TF-M
abccf97 
Import the latest image signing scripts from TF-M version
TF-Mv1.0-85-g3b7cc95a042c.

Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
@Patater
psa: Add stubbed PSA client implementation
908c33b 
Add a stubbed PSA Client API implementation for application
compatibility. The interface is non-functional, but provides sane error
codes.
@Patater
Make PSA util compatible with Mbed Crypto 3.0.1
0961f31 
Mbed Crypto 3.0.1 ships with TF-M. To make Mbed TLS 2.22.0 compatible
with Mbed Crypto 3.0.1, changes are needed in psa_util.h (which
abstracts some portions of the PSA Crypto API for use with TLS) to deal
with new ECC curve define changes.

Signed-off-by: Jaeden Amero <jaeden.amero@arm.com>
Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
@urutva @Patater
tools: Improve PSA target identification logic
939ed69 
Current logic `is_TFM_target` relies on the availability of attribute
`tfm_target_name` to identify PSA targets. The API `is_TFM_target` is
used in pytest to validate PSA target configuration which again checks
the availability of `tfm_target_name`. If a target doesn't contain the
attribute `tfm_target_name` then this check will fail instead of
catching it. Therefore, we now check for `TFM` config option in `labels`
attribute.

The API `is_TFM_target()` returns true for Mbed OS PSA targets which are
supported by TF-M also.

Add a new API `is_PSA_target()` which returns true for all Mbed OS PSA
targets.

Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
@urutva @Patater
tools: Remove obsolete API
c9c593f 
The API is_PSA_non_secure_target() uses obsolete labels to detect if a
target is PSA non-secure target and is not needed anymore.

Mbed OS depends on TF-M for PSA SPM and services. TF-M is built using
it's own build system. Therefore, we don't need to differentiate secure
and non-secure targets anymore in Mbed OS as all PSA targets in Mbed OS
are non-secure targets.

Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
@urutva @Patater
psa: Add a script to validate PSA targets
cd88e72 
Add a script to parse `targets.json` to identify PSA targets and ensure
mandatory parameters are configured correctly for all PSA targets.

Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
@Patater
examples: Add PSA example to list of examples
b38c5ed
@Patater
psa: Configure Mbed TLS to use PSA as needed
4961d4a 
Configure Mbed TLS to automatically enable PSA as needed. When Mbed OS
is configured to use PSA, configure Mbed TLS to use PSA. This prevents
leaking of the "how to make Mbed TLS use PSA" knowledge up into
targets.json, and thus makes porting simpler. There is now one place
where "how to make TLS use PSA" exists rather than repeated throughout
targets.json for each target that can't inherit from PSA_Target.
@Patater
Copy link
Contributor Author

Patater commented Jun 18, 2020

Rebased on latest master to resolve conflicts in adjust-config.h

@mbed-ci
Copy link

mbed-ci commented Jun 18, 2020

Test run: SUCCESS

Summary: 6 of 6 test jobs passed
Build number : 4
Build artifacts

@0xc0170 0xc0170 merged commit 847807e into ARMmbed:master Jun 18, 2020
@mergify mergify bot removed the ready for merge label Jun 18, 2020
@jeromecoutant jeromecoutant mentioned this pull request Jun 22, 2020
Closed
@LDong-Arm LDong-Arm mentioned this pull request Dec 10, 2020
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@0xc0170 0xc0170 0xc0170 approved these changes

@urutva urutva urutva approved these changes

@ashok-rao ashok-rao Awaiting requested review from ashok-rao

@maclobdell maclobdell Awaiting requested review from maclobdell

@jamesbeyond jamesbeyond Awaiting requested review from jamesbeyond

@rwalton-arm rwalton-arm Awaiting requested review from rwalton-arm

@jainvikas8 jainvikas8 Awaiting requested review from jainvikas8

Assignees
No one assigned
Labels
priority: high release-version: 6.1.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
10 participants
@Patater @ciarmcom @0xc0170 @adbridge @mbed-ci @dgreen-arm @urutva @jamesbeyond @jainvikas8 @rwalton-arm