Allow TF-M v2.2.2 to boot with Secure Debug enabled on Corstone-1000 and
align the driver implementation with the current psa-adac library.
- Add missing DRBG macros to fix the
"Failed to generate challenge!" error during Secure Debug.
- Fix an unintended platform reset occurring immediately after setting
the debug enable bits in the dcu_en register while in SE LCS.
Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Replace inherit deploy with firmware.
Initialize TFM_DEBUG using the FIRMWARE_DEBUG_BUILD variable. Initialize
TFM_PLATFORM with FIRMWARE_PLATFORM.
Refactor do_install to use ${FIRMWARE_DIR} and remove now redundant
configuration.
Refactor corstone1000 config files to use ${FIRMWARE_DIR} and the
base do_install.
Signed-off-by: Peter Hoyes <peter.hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update TF-M to the latest hotfix release and rebase the Corstone1000
patches, and drop
0008-Platform-Corstone1000-Increase-BL1-size-and-align-bi.patch
0009-Platform-CS1K-Adapt-ADAC-enabled-build-to-the-new-BL.patch
as they are in the TF-Mv2.2.2 release
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enable full Corstone‑1000 Cortex‑A320 DSU‑120T platform support in TF‑M:
- Reserve a 4 MiB Host SRAM region at 0x0240_0000 for the
Cortex‑A320 normal world and open it in the CVM firewall
(region 2), gated by `CORSTONE1000_CORTEX_A320``.
- Introduce a DSU‑120T Power-Policy Unit driver plus a
`CORSTONE1000_DSU_120T` CMake option to power on the Cortex‑A320
host cluster with proper secure-enclave firewall and memory-map
setup.
- Add a CMake platform define that auto‑activates when the
`cortexa320` machine feature is present, injecting
DSU‑120T‑specific compile definitions.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The move to Trusted-Firmware-M v2.2.1 makes the BL1 code larger,
while the provisioning bundle can be trimmed. At the same time BL2 and
TF-M binary addresses now need to begin on a 0x100-byte boundary for
Cortex-M0+ based platforms.
Key changes
--------------------------------
- Upgrade Trusted-Firmware-M v2.2.1 for Corstone-1000
- New crypto driver supports ECC instead of RSA.
- Rebase patches
- Add new patches to address the following changes for v2.2.1
- Increase `BL1_1_CODE_SIZE` to 58KB to accommodate the v2.2.1 binaries.
- Reduce `PROVISIONING_DATA_SIZE` to 6KB.
- `BL2_CODE_START` and `S_CODE_START` are aligned to 0x100 byte boundary
so both start addresses are an exact multiple of 0x100.
- Adapt ADAC enabled build to the new BL2 build restructure.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This commit removes the outdated patches of capsule update implementation for the Corstone-1000
platform targeting Trusted-Firmware-M (TF-M). The changes include the removal of
obsolete out-of-tree patches and the rebase of retained patches to align with the
latest upstream TF-M integration.
Key changes:
- Dropped legacy TF-M patches related to old capsule update flow
- Rebasing of remaining TF-M patches for compatibility with current TF-M baseline
This cleanup streamlines the TF-M integration for Corstone-1000 in preparation for
the updated PSA Firmware Update (FWU) aligned capsule update support.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Increase `PS_MAX_ASSET_SIZE` and `CRYPTO_IOVEC_BUFFER_SIZE` for the
Corstone-1000 platform to support large EFI variable storage required
by the UEFI firmware update flow and to pass Arm Architecture Compliance
Suite (ACS) tests.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Introduce Bootloader Abstraction Layer (BAL) support for Corstone-1000 to
enable flexible integration of firmware update including partial capsule
update.
This change includes:
- Enable the firmware update partition for Corstone-1000 and create
placeholder bootloader abstraction layer for Corstone-1000.
- Change the insertion logic of TFM_FWU_BOOTLOADER_LIB to select a new
platform-specific bootloader abstraction layer.
- Use the necessary flags to use the service and resolve any linker
issues that may arise.
- Migration of capsule update logic to a new BAL module under
`platform/ext/target/corstone1000/bootloader/mcuboot/`.
- Implementation of BAL APIs in `tfm_mcuboot_fwu.c` as per the PSA FWU
state machine.
- Removal of `uefi_capsule_parser.c` and `uefi_capsule_parser.h` as capsule
parsing is done in U-Boot.
- Enhancement of `uefi_fmp.c` to handle FMP metadata for multiple images.
- Update of `provisioning.c` and `security_cnt_bl2.c` to handle new BAL
return values.
- Addition of `fwu_config.h.in` with default FWU configuration.
- Metadata layout changes to include size and image GUIDs for U-Boot
compatibility during FWU Accept flow.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add support to permit FWU calls in RSE-COMMS Trusted-Firmware-M for Corstone-1000
This change is required to allow the transmission of PSA FWU related
calls between Cortex A and Cortex M side on Corstone-1000.
For every PSA call from A side, the RSE-COMMS at M side validates, if the
call is allowed or not.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Apply TF-M downstream patches in the main TF-M recipe, rather than doing
it in corstone1000 recipe.
Signed-off-by: Hamideh Izadyar <hamideh.izadyar@arm.com>
The PS_NUM_ASSET is duplicated in the cmake.config and the config_tfm_target.h file
under Corstone-1000. The commit removes the one from the cmake.config and keeps the
one in the header file.
The whole rationale behind this is for the vendor to be able to override the
configuration using the cmake file.
Signed-off-by: Yogesh Wani <yogesh.wani@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update trusted-firmware-m to the latest LTS (TF-Mv2.1.1)
Changes between 0c4c99ba33b3e66deea070e149279278dc7647f4 and 02bf279913439a07082dd581df033f370a8fbb92
02bf27991343 docs: Release notes for v2.1.1
7264a32e84a0 docs: rp2350: Minor docs & script improvements
4bad159af017 Docs: Release dates update
a5e02ec0c6a2 Align .gitignore contents to main branch
8fe944a652f5 Platform: RP2350: Fix NV counters in ITS
66bc1fa8eed9 Build: Fix patch formatting for 0001-iar-Add-missing-v8.1m-check.patch
895d44a4eb52 Platform: RP2350: Add NV counters to ITS
e81b741aa6cc tf-m-tests: Step version for rp2350 psa-arch-tests
2be65a027c86 Platform: rp2350: Add rwx linker flag conditionally for GNUARM
a85425417696 Platform: RP2350: Add RP2350 porting
9ed2e7c7f52b Platform/TFM/ITS/Config: Commits required for new platform porting
f12db7c872d5 cc3xx/low-level/pka: SRAM size depends on CC3XX version
c7e0192fab6f cc3xx/low-level/hash: wait for hash engine to be idle
42a4041bdff4 Crypto: Update to Mbed TLS 3.6.2
471c127e7755 Crypto: Add option to enforce ABI compatibility
7da71fd05445 tfm_spe_mailbox: Fix NULL pointer checks
974bc101e0b2 cc3xx/low-level/pka: wait for sw reset to be done before proceeding
89b9c4889c60 Crypto: Enforce MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS on Mbed TLS config
62b1300557c5 Crypto: Additional checks for writes to avoid out-of-bound access
a2cead6a9ef4 tfm_spe_mailbox: Use local vars for local_copy_vects
15afe61d1194 TFMV-8: Fix unchecked user-supplied pointer via mailbox message
22e8e89c8f56 tfm_spe_mailbox: Do not write-back on input vectors checks failure
12a4c5342965 tfm_spe_mailbox: Validate vectors from NSPE
75bbe3fc0240 CC3XX: Relax assert condition in aead_crypt for input
0db7ebf32ba3 Crypto: Protect writes to avoid out-of-bound access
2ecea430fbb4 Crypto: Prevent the scratch allocator from overflowing
fbcdc69b794d SPM: mailbox_agent_api: Free connection if params association fails
2a59580b5809 Crypto: Update to Mbed TLS 3.6.1
6a54ec89f22f Platform: STM32: script all_stm_platfrom
66596b4dae57 Platform: corstone1000: Fix isolation L2 memory protection
7045675209ca stm : fix error on b_u585i_iot02a with TF-Mv2.1.0
Signed-off-by: Jon Mason <jon.mason@arm.com>
Some of the existing patches were submitted and merged to the
upstream TF-M repository.
In this commit, the upstream statuses are updated, and the patches are
reordered so the submitted patches are applied first.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The added TF-M patches:
- Remove unused files from TF-M's BL1
- Remove unecessary duplications in metadata write functions
- Fix compiler switches in metadata handling functions: the runtime TF-M
uses the GPT to get the offsets for the metadata.
- Validate both metadata replica in the beginning by checking the crc32
checksum. If one of the replicas is corrupted then update it using the
other replica.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Application Root of Trust and the PSA Root of Trust was not
isolated in TF-M Isolation Level 2 beacuse of the misconfiguration of
the MPU. The added patch fixes this issue.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Secure Debug functionality can be enabled on MPS3 by using the new
corstone1000-mps3-secure-debug.yml kas file. The kas file adds the new
secure-debug machine feature. The TF-M recipe adds the needed TF-M
build flags and patches in order to make the Secure Debug work.
This way, the Corstone-1000 will only boot fully if a debugger is
connected and a debug authentication is initiated.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
A patch was added to fix the address of the bank erasing and flashing
during the capsule update procedure. Previously the BL2 partition was
not erased properly.
The offset in the corstone1000-flash-firmware.wks.in was updated to
be aligned with the changes.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the preferred version of TrustedFirmware-M for Cortsone-1000
from 2.0.x to 2.1.x to benefit from the latest fixes and improvements
as well as to reduce the number of out-of-tree patches.
As a result of updating the version:
* Remove no longer required out-of-tree patches
* Rebase and update the numbering of the remaining out-of-tree patches
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Increase the size of PS storage in Secure Flash.
The SecureBoot and Security Interface Extension (SIE) tests for MPS3
are failing when the Secure Flash runs out of memory. The frequency
of the errors is at least 50-60%. The aim of this is to increase
the size of PS storage in Secure Flash, so as to minimize
the possibilities of it to run out of memory.
FLASH_PS_AREA_SIZE is increased.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upgrades metadata structs in secure-enclave from v1 to v2 as described
in psa-fwu spec: https://developer.arm.com/documentation/den0118/latest/
The TrustedFirmware-A v2.11 release supports only the metadata v2. The
structs in TF-M side had to be aligned to keep the compatibility.
Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Introduce `corstone1000_fvp_smp` as a value of the `MACHINE_FEATURES`
variable to support Corstone-1000 FVP Symmetric Multiprocessing.
A new YAML file is created to add this new machine only for the FVP
variant of the target platform.
The multicore feature is enabled in TrustedFirmware-A,
TrustedFirmware-M, and OP-TEE based on this machine feature.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
The reset has to be removed from the TF-M side after capsule update
because it caused data abort exceptions on the host side.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
The buffer size has to be increased to fit the EFI variables which got
increased metadata sizes.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The private authenticated variable changes increased the variables
metadata. The PS max asset size and related buffer sizes have to be
increased because of this.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Crypto-AEAD-APIs tests fails on mps3. Configures CC312 mps3 model
same as predefined cc312 FVP configuration while keeping debug
ports closed.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Corstone-1000 no longer uses OpenAMP, and it was the only platform
which needed this library.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
A patch was dropped when trusted-firmware-m was updated to 2.0 but it
had not yet been merged upstream (2.0 or master).
Restore the patch to fix regression on Corstone-1000
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enables host firewall and mpu setup for FVP. It also fixes secure-ram
configuration and disable access rights to secure ram from both normal world
for both mps3 and fvp.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The TF-M configuration step can fail if the doxygen executable is found.
This commit disables the doc generation until this is fixed in the
upstream repos.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
The SHAs for both libmetal and open-amp are intermediate SHAs, which are
only a few patches behind the v2021.04.0 tags. Update to those tags and make
the necessary changes to get them working.
Signed-off-by: Jon Mason <jon.mason@arm.com>
This fixes a race that is observed rarely in the FVP. It occurs in FVP
when tfm sends the notication ack in openamp, and then reset the access
request which resets the mhu registers before received by the host
processor. It implements the fix both in SE and the host processor openamp
wrapper. This solution enables polling on the status register of mhu until
the notificaiton is read by the host processor. (Inspired by
signal_and_wait_for_signal function in mhu_wrapper_v2_x.c in trusted-firmware-m
https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/platform/ext/target/arm/rss/common/native_drivers/mhu_wrapper_v2_x.c#n61)
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
U-boot mkefitool creates capsule image without packed and byte-aligned structs.
This patch aligns the capsule-update structures and avoids crashes in case of
unaligned pointer access.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This support is for Cassini distro using Corstone-1000 platform.
When running parsec test, it reports an error
`PSA_ERROR_DATA_INVALID (-153)`.
This is related to `ITS_MAX_ASSET_SIZE` configuration which is been
set to 512 on the secure enclave (TF-M), which defines the max asset
size and it overflows when running the parsec tests.
The key is generated, but when it is asked to store via `psa_its_set`
it returns `PSA_ERROR_INVALID_ARGUMENT (-135)`, which then propagates
to `PSA_ERROR_DATA_INVALID (-153)`
Increasing the `ITS_MAX_ASSET_SIZE` to 2048 solves this issue.
Signed-off-by: Vikas Katariya <vikas.katariya@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enables authenticated capsule update and makes necessary changes to
align with new capsule generation tool (mkeficapsule in u-boot).
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add new Corstone-1000 firmware GUID and remove previous u-boot GUID to be updated into ESRT table.
SR-IR 2.0 requires the capsule GUID to be unique.
Signed-off-by: Anusmita Dutta Mazumder <anusmita.duttamazumder@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enabling ESRT in trusted services increased the need for more
assets at protected storage level, since we now save FMP data
, capsule update, like Image Info as non volatile EFI
variables.
So, just change the default configuration for the corstone1000
to handle this.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Instead of checking out code through internal cmake,
the patch explicitly checkout the psa-adac code.
Signed-off-by: Satish Kumar <satish.kumar01@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The patch corrects the source dir for libmetal and openamp.
Devtool modify on tf-m will work after this fix.
Signed-off-by: Satish Kumar <satish.kumar01@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The patch bumps the tfm SHA to
b065a6b28cc6c692b99e4f7e9387d96f51bf4d07
Signed-off-by: Satish Kumar <satish.kumar01@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
