Update TF-M to v1.3.0 #14582

LDong-Arm · 2021-04-22T17:19:03Z

Summary of changes

This PR updates TF-M to the new v1.3.0 release.

The following have been changed:

Rename ARM_MUSCA_B1's tfm_target_name from musca_b1 to musca_b1/sse_200. This is the new target name for ARM_MUSCA_B1 in TF-M's own build system, and mbed-os-tf-m-regression-tests relies on this entry in targets.json to map the target's Mbed name to TF-M name.
Update bootloader and TF-M secure binaries for ARM_MUSCA_B1 and ARM_MUSCA_S1. The following commands were used:

python3 build_tfm.py -m ARM_MUSCA_B1 -t ARMCLANG --commit
python3 build_tfm.py -m ARM_MUSCA_S1 -t ARMCLANG --commit

and the commits are auto-generated by the script.

Update PSA API files in platform/FEATURE_EXPERIMENTAL_API/FEATURE_PSA/TARGET_TFM/TARGET_TFM_LATEST. The commit is auto-generated by the aforementioned script.
Update VERSION.txt to indicate the TF-M version of the imported files. The commit is auto-generated by the aforementioned script.

Note: psa_set_key_enrollment_algorithm() is no longer supported.

Impact of changes

Standardized PSA APIs in TF-M v1.3.0 are backward compatible with previous versions. Some APIs have been updated, most notably the addition of the new Firmware Update (FWU) API.

Non-standard PSA extensions are not guaranteed to be backwards compatible. Notably, Mbed OS has aligned its PSA support with TF-M and no longer provides psa_set_key_enrollment_algorithm().

Migration actions required

Remove any use of psa_set_key_enrollment_algorithm() in your applications. If enrolling a device in elliptic curve PKI, for e.g. mutually authenticate TLS, is critical to your use case, please reach out to TrustedFirmware-M for support and possible alternative solutions.

Documentation

The Porting PSA targets documentation remains valid and requires no update.

The version number in the README of mbed-os-tf-m-regression-tests needs to be bumped to v1.3.

For TF-M and supported PSA APIs, see its official documentation

Pull request type

[x] Patch update (Bug fix / Target update / Docs update / Test update / Refactor)
[] Feature update (New feature / Functionality change / New API)
[] Major update (Breaking change E.g. Return code change / API behaviour change)

Test results

[] No Tests required for this change (E.g docs only update)
[x] Covered by existing mbed-os tests (Greentea or Unittest)
[] Tests / results supplied as part of this PR

Reviewers

The mbed-os-tf-m-regression-tests build scripts gets a mapping of Mbed OS target names to TF-M target names from `targets.json`. TF-M v1.3 has renamed musca_b1 to musca_b1/sse_200, this commit updates that accordingly to ensure successful build of TF-M and tests for ARM_MUSCA_B1.

ciarmcom · 2021-04-22T17:30:19Z

@LDong-Arm, thank you for your changes.
@ARMmbed/mbed-os-maintainers please review.

…T_TFM/TARGET_TFM_LATEST

Patater · 2021-04-29T10:12:34Z

Removed unnecessary quotes from commit messages.

Patater · 2021-04-29T10:53:56Z

CI started

mbed-ci · 2021-04-29T11:17:49Z

Jenkins CI Test : ❌ FAILED

Build Number: 1 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

CLICK for Detailed Summary

jobs	Status
jenkins-ci/mbed-os-ci_cmake-cloud-example-ARM	✔️
jenkins-ci/mbed-os-ci_build-cloud-example-ARM	✔️
jenkins-ci/mbed-os-ci_unittests	✔️
jenkins-ci/mbed-os-ci_build-cloud-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_cmake-cloud-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-greentea-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-greentea-ARM	❌
jenkins-ci/mbed-os-ci_cmake-example-ARM	✔️
jenkins-ci/mbed-os-ci_cmake-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-example-ARM	❌

Patater · 2021-04-29T12:40:28Z

Looks like some issues with mbedtls_ecc_group_to_psa() on ARMCLANG. Will investigate.

  * ARM_MUSCA_B1::ARMC6::HAL-TESTS-TESTS-MBED_HAL-US_TICKER
        Building project us_ticker (ARM_MUSCA_B1, ARMC6)
        Scan: ARM
        Scan: us_ticker
        Configuration error: Bootloader not supported on this target. ROM start not found in targets.json.
        Configuration error: Bootloader not supported on this target. RAM start not found in targets.json.
        Compile [100.0%]: main.cpp
        [Warning] mbed_power_mgmt.h@241,1: function declared 'noreturn' should not return [-Winvalid-noreturn]
        Link: us_ticker
        [Warning] @0,0: L3912W: Option 'legacyalign' is deprecated.
        [Error] @0,0: L6218E: Undefined symbol mbedtls_ecc_group_to_psa (referred from BUILD/tests/ARM_MUSCA_B1/ARM/connectivity/mbedtls/source/pk.o).
        Warning: L3912W: Option 'legacyalign' is deprecated.
        Error: L6218E: Undefined symbol mbedtls_ecc_group_to_psa (referred from BUILD/tests/ARM_MUSCA_B1/ARM/connectivity/mbedtls/source/pk.o).
        Finished: 0 information, 1 warning and 1 error messages.

We'd like to enable Mbed TLS's PK module in using TF-M's PSA implementation, even if it doesn't expose the same set of PSA extensions as Mbed TLS's PSA implementation. To do this, we add mbedtls_ecc_group_to_psa() in its own header available when using the latest TF-M. Add mbedtls_ecc_group_to_psa(), one of Mbed TLS's PSA compatibility helpers, for internal use by the Mbed TLS PK module. Without this conversion function, the Mbed TLS PK module is unable to use any PSA implementation other than one which provides a compatible set of PSA extensions.

Pull request has been modified.

Patater · 2021-04-30T08:20:42Z

Added mbedtls_ecc_group_to_psa() to TF-M's PSA implementation so that Mbed TLS's PK module could use TF-M's PSA implementation. Untested yet, given this issue only appeared on ARMCLANG so far.

Patater · 2021-04-30T09:17:34Z

CI started

mbed-ci · 2021-04-30T09:47:35Z

Jenkins CI Test : ❌ FAILED

Build Number: 2 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

CLICK for Detailed Summary

jobs	Status
jenkins-ci/mbed-os-ci_unittests	✔️
jenkins-ci/mbed-os-ci_cmake-cloud-example-ARM	✔️
jenkins-ci/mbed-os-ci_build-cloud-example-ARM	✔️
jenkins-ci/mbed-os-ci_cmake-cloud-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-cloud-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-greentea-ARM	✔️
jenkins-ci/mbed-os-ci_cmake-example-ARM	✔️
jenkins-ci/mbed-os-ci_build-greentea-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_cmake-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-example-ARM	✔️
jenkins-ci/mbed-os-ci_build-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_greentea-test	✔️
jenkins-ci/mbed-os-ci_tfm-integration	❌

Include mbedtls_ecc_group_to_psa.h from crypto_extra.h so that clients of PSA within Mbed OS do not need to behave differently depending on which PSA implementation they are using. This solution is not ideal as it makes it more difficult to update the TF-M-provided psa/crypto_extra.h. We'll have to see what other options we have for including additional headers based on the Mbed OS configuration.

Patater · 2021-04-30T10:36:04Z

CI used the new Musca B1 name with the old TF-M included from master of mbed-os-tf-m-regression-tests. CI started without B1 testing, so we can coordinate updating both mbed-os and mbed-os-tf-m-regression-tests together.

mbed-ci · 2021-04-30T11:04:02Z

Jenkins CI Test : ✔️ SUCCESS

Build Number: 3 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

CLICK for Detailed Summary

jobs	Status
jenkins-ci/mbed-os-ci_unittests	✔️
jenkins-ci/mbed-os-ci_build-cloud-example-ARM	✔️
jenkins-ci/mbed-os-ci_cmake-cloud-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_cmake-cloud-example-ARM	✔️
jenkins-ci/mbed-os-ci_build-cloud-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-greentea-ARM	✔️
jenkins-ci/mbed-os-ci_build-greentea-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_cmake-example-ARM	✔️
jenkins-ci/mbed-os-ci_cmake-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-example-GCC_ARM	✔️
jenkins-ci/mbed-os-ci_build-example-ARM	✔️
jenkins-ci/mbed-os-ci_greentea-test	✔️
jenkins-ci/mbed-os-ci_tfm-integration	✔️

mergify bot added the do not merge label Apr 22, 2021

ciarmcom added the release-type: patch Indentifies a PR as containing just a patch label Apr 22, 2021

ciarmcom requested a review from a team April 22, 2021 17:30

ciarmcom added needs: review component: security devices: arm component: core labels Apr 22, 2021

LDong-Arm changed the title ~~WIP: Update TF-M to v1.3~~ Update TF-M to v1.3 Apr 23, 2021

LDong-Arm mentioned this pull request Apr 23, 2021

Update TF-M to v1.3.0 ARMmbed/mbed-os-tf-m-regression-tests#101

Merged

LDong-Arm added a commit to LDong-Arm/mbed-os-tf-m-regression-tests that referenced this pull request Apr 23, 2021

TEMPORARY: use ARMmbed/mbed-os#14582

a220e31

LDong-Arm added a commit to LDong-Arm/mbed-os-tf-m-regression-tests that referenced this pull request Apr 23, 2021

TEMPORARY: use ARMmbed/mbed-os#14582

cf52cff

LDong-Arm changed the title ~~Update TF-M to v1.3~~ Update TF-M to v1.3.0 Apr 23, 2021

LDong-Arm added a commit to LDong-Arm/mbed-os-tf-m-regression-tests that referenced this pull request Apr 23, 2021

TEMPORARY: use ARMmbed/mbed-os#14582

95090da

LDong-Arm added a commit to LDong-Arm/mbed-os-tf-m-regression-tests that referenced this pull request Apr 23, 2021

TEMPORARY: use ARMmbed/mbed-os#14582

59daeeb

Patater pushed a commit to LDong-Arm/mbed-os-tf-m-regression-tests that referenced this pull request Apr 28, 2021

TEMPORARY: use ARMmbed/mbed-os#14582

06e2bde

Patater pushed a commit to LDong-Arm/mbed-os-tf-m-regression-tests that referenced this pull request Apr 28, 2021

TEMPORARY: use ARMmbed/mbed-os#14582

c79282e

Patater pushed a commit to LDong-Arm/mbed-os-tf-m-regression-tests that referenced this pull request Apr 28, 2021

TEMPORARY: use ARMmbed/mbed-os#14582

4799167

Patater pushed a commit to LDong-Arm/mbed-os-tf-m-regression-tests that referenced this pull request Apr 28, 2021

TEMPORARY: use ARMmbed/mbed-os#14582

4267835

Patater pushed a commit to LDong-Arm/mbed-os-tf-m-regression-tests that referenced this pull request Apr 28, 2021

TEMPORARY: use ARMmbed/mbed-os#14582

edca942

Patater pushed a commit to LDong-Arm/mbed-os-tf-m-regression-tests that referenced this pull request Apr 29, 2021

TEMPORARY: use ARMmbed/mbed-os#14582

a7a5a4a

LDong-Arm added 4 commits April 29, 2021 11:09

Updated directory platform/FEATURE_EXPERIMENTAL_API/FEATURE_PSA/TARGE…

23824b4

…T_TFM/TARGET_TFM_LATEST

Updated secure binaries for [('ARM_MUSCA_B1', 'ARMCLANG')]

68f8501

Updated directory platform/FEATURE_EXPERIMENTAL_API/FEATURE_PSA/TARGE…

b8969e0

…T_TFM/TARGET_TFM_LATEST

Updated secure binaries for [('ARM_MUSCA_S1', 'ARMCLANG')]

5434722

Patater force-pushed the TF-Mv1.3.0_update branch from cfaf291 to 5434722 Compare April 29, 2021 10:11

mergify bot removed the needs: review label Apr 29, 2021

mergify bot added needs: work and removed needs: CI labels Apr 29, 2021

Patater force-pushed the TF-Mv1.3.0_update branch from 464e80d to 032fe4a Compare April 30, 2021 10:29

Patater approved these changes Apr 30, 2021

View reviewed changes

0xc0170 approved these changes Apr 30, 2021

View reviewed changes

0xc0170 merged commit 9f35f29 into ARMmbed:master Apr 30, 2021

0xc0170 added ready for merge and removed do not merge needs: work labels Apr 30, 2021

mergify bot removed the ready for merge label Apr 30, 2021

ccli8 mentioned this pull request May 3, 2021

M2354: Support Nuvoton's new target #14441

Merged

mbedmain added release-version: 6.11.0 Release-pending labels May 17, 2021

mbedmain removed release-type: patch Indentifies a PR as containing just a patch Release-pending labels May 24, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update TF-M to v1.3.0 #14582

Update TF-M to v1.3.0 #14582

LDong-Arm commented Apr 22, 2021 •

edited by Patater

Loading

ciarmcom commented Apr 22, 2021

Patater commented Apr 29, 2021

Patater commented Apr 29, 2021

mbed-ci commented Apr 29, 2021

Patater commented Apr 29, 2021

Patater commented Apr 30, 2021

Patater commented Apr 30, 2021

mbed-ci commented Apr 30, 2021

Patater commented Apr 30, 2021

mbed-ci commented Apr 30, 2021

Update TF-M to v1.3.0 #14582

Update TF-M to v1.3.0 #14582

Conversation

LDong-Arm commented Apr 22, 2021 • edited by Patater Loading

Summary of changes

Impact of changes

Migration actions required

Documentation

Pull request type

Test results

Reviewers

ciarmcom commented Apr 22, 2021

Patater commented Apr 29, 2021

Patater commented Apr 29, 2021

mbed-ci commented Apr 29, 2021

Jenkins CI Test : ❌ FAILED

Build Number: 1 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

Patater commented Apr 29, 2021

Patater commented Apr 30, 2021

Patater commented Apr 30, 2021

mbed-ci commented Apr 30, 2021

Jenkins CI Test : ❌ FAILED

Build Number: 2 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

Patater commented Apr 30, 2021

mbed-ci commented Apr 30, 2021

Jenkins CI Test : ✔️ SUCCESS

Build Number: 3 | 🔒 Jenkins CI Job | 🌐 Logs & Artifacts

LDong-Arm commented Apr 22, 2021 •

edited by Patater

Loading