diff --git a/meta-arm-bsp/documentation/corstone1000/user-guide.rst b/meta-arm-bsp/documentation/corstone1000/user-guide.rst index a0d7b23b..a20571b1 100644 --- a/meta-arm-bsp/documentation/corstone1000/user-guide.rst +++ b/meta-arm-bsp/documentation/corstone1000/user-guide.rst @@ -2129,35 +2129,75 @@ For more information about this, see the following resources: - `Authenticated Debug Access Control Specification `__ - `Arm Corstone-1000 for MPS3 Application Note AN550, Chapter 7 `__ -The Secure Debug Manager API is implemented in the `Secure Debug Manager (PSA-ADAC / SDC-600) `__ repository. -This repository also contains the necessary files for the Arm Development Studio support. -The build and integration instructions can be found in its `README `__. +#. Install `Arm Development Studio `__ 2026.1, or Arm + Development Studio Platinum 2026.b. These releases contain a built-in + PSA-ADAC Secure Debug Manager. -The `Secure Debug Manager (PSA-ADAC / SDC-600)` repository also contains the private key and chain certificate to be used during the tests. -The private key's public pair is provisioned into the One-Time Programmable memory in TrustedFirmware-M. -These are dummy keys that should not be used in production. - -To test the Secure Debug feature, you'll need a debug probe from the `Arm ULINKpro family `__ -and `Arm Development Studio `__ versions 2022.2, 2022.c, or 2023.a. - - -#. Clone the `Secure Debug Manager (PSA-ADAC / SDC-600)` repository to your workspace. +#. Clone the `Secure Debug Manager + `__ + repository to obtain the dummy test credentials. .. code-block:: console cd ${WORKSPACE} git clone https://github.com/ARM-software/secure-debug-manager.git -#. Navigate into the repository directory and checkout the specific commit in the listing below. + Only the example private key and certificate chain are needed from this + repository. + + The public key corresponding to these credentials is provisioned into the + TrustedFirmware-M One-Time Programmable memory. The supplied credentials + are test credentials and must not be used in production. + +#. Create a user configuration database based on the Arm Development Studio + Corstone-1000 database. The following example assumes that Arm Development + Studio Platinum 2026.b is installed in ``/opt/arm``: .. code-block:: console - cd ${WORKSPACE}/secure-debug-manager - git checkout b30d6496ca749123e86b39b161b9f70ef76106d6 - git submodule update --init + export ARMDS_INSTALL_DIR=/opt/arm/developmentstudio_platinum-2026.b + export CS1000_ADAC_DB=${WORKSPACE}/armds-cs1000-adac611 + + mkdir -p "${CS1000_ADAC_DB}/Boards/Arm_Development_Boards" + cp -a \ + "${ARMDS_INSTALL_DIR}/sw/debugger/configdb/Boards/Arm Development Boards/MPS3_Corstone_1000" \ + "${CS1000_ADAC_DB}/Boards/Arm_Development_Boards/MPS3_Corstone_1000_ADAC_611" + cp -a "${ARMDS_INSTALL_DIR}/sw/debugger/configdb/Include" "${CS1000_ADAC_DB}/" + cp -a "${ARMDS_INSTALL_DIR}/sw/debugger/configdb/Schemas" "${CS1000_ADAC_DB}/" + cp -a "${ARMDS_INSTALL_DIR}/sw/debugger/configdb/ATP" "${CS1000_ADAC_DB}/" + + If Arm Development Studio is installed elsewhere, change + ``ARMDS_INSTALL_DIR`` accordingly. + +#. Enable the built-in PSA-ADAC Secure Debug Manager in the copied database. + In + ``${CS1000_ADAC_DB}/Boards/Arm_Development_Boards/MPS3_Corstone_1000_ADAC_611/project_types.xml``, + add the following element alongside the existing ``dtsl_config`` parameter: + + .. code-block:: xml + + + + This selects the built-in PSA-ADAC implementation, its authentication-token + provider, the SDC-600 communication device, and the board reset signal. + +#. Describe the Corstone-1000 debug port as DPv3. In + ``${CS1000_ADAC_DB}/Boards/Arm_Development_Boards/MPS3_Corstone_1000_ADAC_611/MPS3_Corstone_1000.sdf``, + add the following item to the ```` block of the ``ARMCS-DP`` + device: + + .. code-block:: xml -#. Follow the instructions in the `Secure Debug Manager (PSA-ADAC / SDC-600)'s README `__ for the development machine setup. - This setup must include building the Secure Debug Manager because the built library completes the Arm Development Studio configuration. + DPv3 + + DPv3 is required so that Arm Development Studio uses the ADIv6 debug-port + addressing needed to reach ``CSAPBCOM``. + + In the same file, give the copied platform a unique title: + + .. code-block:: xml + + #. Rebuild the software stack with Secure Debug. @@ -2177,16 +2217,15 @@ and `Arm Development Studio `__ versions 2022.2, 2022.c, or 202 IComPortInit : 383 : warn : init : IComPortInit: Blocked reading LPH2RA -#. Connect the debug probe to the MPS3 using the 20-pin 1.27mm connector with the ``CS_20W_1.27MM silkscreen`` label. - -#. Open a new Arm Development Studio IDE window and add the Secure Debug Manager configuration database. +#. Open a new Arm Development Studio IDE window and add the user configuration + database. #. Select ``Window`` > ``Preferences``. #. Expand ``Arm DS`` and select ``Configuration Database``. #. Select ``Add``. #. Enter a descriptive name, such as ``Corstone-1000 Secure Debug``. The name does not affect the connection. - #. Set ``Location`` to ``${WORKSPACE}/secure-debug-manager/arm_ds/DB``. + #. Set ``Location`` to ``${WORKSPACE}/armds-cs1000-adac611``. #. Select ``OK`` to close the ``Add configuration database location`` dialog. #. Select ``Rebuild database``. #. Select ``Apply and Close``. @@ -2197,16 +2236,41 @@ and `Arm Development Studio `__ versions 2022.2, 2022.c, or 202 #. Select ``Hardware Connection``, then select ``Next``. #. Enter a descriptive debug connection name, then select ``Next``. The name does not affect the connection. - #. In ``Target Selection``, select ``MPS3_Corstone-1000_ADAC``. + #. In ``Target Selection``, select ``MPS3_Corstone_1000_ADAC_611``. #. Select ``Finish``. -#. Configure and start the debug connection. +#. Configure one of the following external debug connections. + + To use an external `ULINKpro D `__ probe: - #. Select ``Arm`` > ``MPS3_Corstone-1000_ADAC`` > ``Bare Metal Debug`` > ``Cortex-A35``. - #. For ``Target Connection``, select ``ULINKpro``. - #. Select ``Browse...``. - #. In the ``Connection Browser``, select the name of the connected ULINKpro probe, then select ``Select``. - #. Select ``Debug``. + #. Connect the ULINKpro D probe to the MPS3 connector labelled + ``CS_20W_1.27MM``. + #. Select ``Arm`` > ``MPS3_Corstone_1000_ADAC_611`` > + ``Bare Metal Debug`` > ``Cortex-M0+``. + #. For ``Target Connection``, select ``ULINKpro D``. + #. Select ``Browse...``, select the detected ULINKpro D probe, and then + select ``Select``. + #. Select ``JTAG/SWJ``, set the debug clock to ``500 kHz``, and select + ``Connect only``. + + To use an external `DSTREAM `__ probe: + + #. Connect the DSTREAM probe to the MPS3 connector labelled + ``CS_20W_1.27MM``. + #. Select ``Arm`` > ``MPS3_Corstone_1000_ADAC_611`` > + ``Bare Metal Debug`` > ``Cortex-M0+``. + #. For ``Target Connection``, select ``DSTREAM``. + #. Select ``Browse...``, select the detected DSTREAM probe, and then select + ``Select``. + #. Select ``JTAG/SWJ``, set the debug clock to ``500 kHz``, and select + ``Connect only``. + + In both cases, use ``Cortex-M0+`` because Secure Debug runs in the Secure + Enclave. Do not select the host ``Cortex-A35`` connection. + +#. Select ``Debug``. Arm Development Studio resets the target using ``nSRST`` + and the built-in Secure Debug Manager communicates with ``CSAPBCOM`` to + perform authentication. #. Provide the paths to the private key and trust chain certificate when asked by Arm Development Studio Console. @@ -2215,21 +2279,21 @@ and `Arm Development Studio `__ versions 2022.2, 2022.c, or 202 ... Please provide private key file path: - Enter file path > ${WORKSPACE}\secure-debug-manager\example\data\keys\EcdsaP256Key-3.pem + Enter file path > ${WORKSPACE}/secure-debug-manager/example/data/keys/EcdsaP256Key-3.pem Please provide trust chain file path: - Enter file path > ${WORKSPACE}\secure-debug-manager\example\data\chains\chain.EcdsaP256-3 + Enter file path > ${WORKSPACE}/secure-debug-manager/example/data/chains/chain.EcdsaP256-3 ... -#. When successful authenticated, Arm Development Studio will connect to the running MPS3 and the debug features can be used. - The following prompt should appear in the Secure Enclave terminal (``ttyUSB1``): +#. After authentication succeeds, verify that the image continues booting and + is not left waiting inside the Secure Debug authentication flow. + Authentication alone is not sufficient to pass the test. Confirm that the + Host terminal reaches the Linux login prompt: .. code-block:: console - ... - boot_platform_init: Corstone-1000 Secure Debug is a success. - ... + corstone1000-mps3 login: -------------- @@ -2237,9 +2301,8 @@ and `Arm Development Studio `__ versions 2022.2, 2022.c, or 202 *Copyright (c) 2022-2026, Arm Limited. All rights reserved.* .. _arm-developer-fvp: https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps -.. _secure-debug-manager-repo-readme: https://github.com/ARM-software/secure-debug-manager/tree/master?tab=readme-ov-file#secure-debug-manager-psa-adac--sdc-600 -.. _secure-debug-manager-armds-integration: https://github.com/ARM-software/secure-debug-manager?tab=readme-ov-file#arm-development-studio-integration .. _meta-arm-repository-release-branch: https://docs.yoctoproject.org/next/migration-guides/migration-6.0.html -.. _arm-ulink-pro-website: https://www.arm.com/products/development-tools/debug-probes/ulink-pro .. _arm-ds-website: https://www.arm.com/products/development-tools/embedded-and-software/arm-development-studio +.. _arm-ulink-pro-d-website: https://www.arm.com/products/development-tools/debug-probes/ulink-pro +.. _arm-dstream-website: https://www.arm.com/products/development-tools/debug-probes/dstream-st .. _edk2-repository: https://github.com/tianocore/edk2 diff --git a/meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0016-platform-corstone1000-Optionally-skip-provisioning.patch b/meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0016-platform-corstone1000-Optionally-skip-provisioning.patch new file mode 100644 index 00000000..da808b9a --- /dev/null +++ b/meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0016-platform-corstone1000-Optionally-skip-provisioning.patch @@ -0,0 +1,68 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Ahmed Gomaa +Date: Wed, 2 Sep 2026 12:00:00 +0100 +Subject: [PATCH] platform: corstone1000: keep CM during secure debug + +Add a temporary Corstone-1000 Secure Debug workaround that skips runtime +TF-M provisioning when Secure Debug is enabled. This keeps the device in +the CM lifecycle state and avoids the provisioning reset, allowing the +authenticated debug session to remain active. + +Keep this workaround until a reset-safe architecture is implemented to +preserve the authenticated DCU_EN value across reset and apply it from BL2. + +Upstream-Status: Inappropriate [temporary platform workaround] +Signed-off-by: Ahmed Gomaa +--- + secure_fw/spm/CMakeLists.txt | 1 + + secure_fw/spm/core/main.c | 10 ++++++++++ + 2 files changed, 11 insertions(+) + +diff --git a/secure_fw/spm/CMakeLists.txt b/secure_fw/spm/CMakeLists.txt +--- a/secure_fw/spm/CMakeLists.txt ++++ b/secure_fw/spm/CMakeLists.txt +@@ -111,6 +111,7 @@ target_compile_definitions(tfm_spm + $<$:BRANCH_PROTECTION_CONTROL=2> + $<$:BRANCH_PROTECTION_CONTROL=3> + $<$:PLATFORM_PSA_ADAC_SECURE_DEBUG> ++ $<$:CORSTONE1000_SKIP_PROVISIONING_FOR_DEBUG> + $<$:CONFIG_TFM_REUSE_COPY_AREA_FOR_SP_STACKS> + $<$:TFM_TZ_REENTRANCY_CHECK> + ) +diff --git a/secure_fw/spm/core/main.c b/secure_fw/spm/core/main.c +--- a/secure_fw/spm/core/main.c ++++ b/secure_fw/spm/core/main.c +@@ -31,7 +31,9 @@ static fih_ret tfm_core_init(void) + { + enum tfm_plat_err_t plat_err = TFM_PLAT_ERR_SYSTEM_ERR; + FIH_DECLARE(fih_rc, FIH_FAILURE); ++#ifndef CORSTONE1000_SKIP_PROVISIONING_FOR_DEBUG + bool provisioning_required; ++#endif + + /* + * Access to any peripheral should be performed after programming +@@ -65,6 +67,7 @@ static fih_ret tfm_core_init(void) + FIH_RET(SPM_ERROR_GENERIC); + } + ++#ifndef CORSTONE1000_SKIP_PROVISIONING_FOR_DEBUG + /* Perform provisioning. */ + plat_err = tfm_plat_provisioning_is_required(&provisioning_required); + if (plat_err != TFM_PLAT_ERR_SUCCESS) { +@@ -77,6 +80,12 @@ static fih_ret tfm_core_init(void) + FIH_RET(SPM_ERROR_GENERIC); + } + } ++#else ++ /* Temporary workaround: retain CM and avoid the provisioning reset. */ ++ WARN("Skipping TF-M provisioning for Secure Debug workaround. " ++ "Device remains unprovisioned and must not be used in " ++ "production.\n"); ++#endif + + TFM_COVERITY_DEVIATE_LINE(MISRA_C_2023_Rule_2_2, "Parameters can be changed by user and this code will make effect") + tfm_plat_provisioning_check_for_dummy_keys(); +-- +2.43.0 + diff --git a/meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m-corstone1000.inc b/meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m-corstone1000.inc index 0ecb75a2..3422163d 100644 --- a/meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m-corstone1000.inc +++ b/meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m-corstone1000.inc @@ -28,6 +28,9 @@ EXTRA_OECMAKE += "-DPLATFORM_IS_FVP=${TFM_PLATFORM_IS_FVP}" EXTRA_OECMAKE += "-DCC312_LEGACY_DRIVER_API_ENABLED=OFF" EXTRA_OECMAKE:append = " -DENABLE_MULTICORE=${@bb.utils.contains('MACHINE_FEATURES', 'corstone1000_smp', 'TRUE', 'FALSE', d)}" EXTRA_OECMAKE:append:corstone1000-mps3 = " -DPLATFORM_PSA_ADAC_SECURE_DEBUG=${@bb.utils.contains('MACHINE_FEATURES', 'secure-debug', 'ON', 'OFF', d)}" +# Keep the device in CM until authenticated DCU_EN can be preserved across +# reset and applied from BL2. +EXTRA_OECMAKE:append:corstone1000-mps3 = " -DCORSTONE1000_SKIP_PROVISIONING_FOR_DEBUG=${@bb.utils.contains('MACHINE_FEATURES', 'secure-debug', 'ON', 'OFF', d)}" EXTRA_OECMAKE:append:corstone1000-mps3 = " -DPLATFORM_PSA_ADAC_SOURCE_PATH=${S}/external/tfm-psa-adac -DPLATFORM_PSA_ADAC_BUILD_PATH=${B}/tfm-psa-adac-build" FILESEXTRAPATHS:prepend := "${THISDIR}/files:" @@ -47,6 +50,7 @@ SRC_URI:append:corstone1000 = " \ file://0013-plat-cs1k-Remove-unused-FWU-partitions-upon-version-.patch \ file://0014-plat-cs1k-Duplicate-old-images-in-FWU.patch \ file://0015-platform-corstone1000-Increase-FIP-partition-size.patch \ + file://0016-platform-corstone1000-Optionally-skip-provisioning.patch \ " FILESEXTRAPATHS:prepend:corstone1000-mps3 := "${THISDIR}/files/corstone1000/psa-adac:"