From patchwork Wed Sep 23 09:53:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ahmed Gomaa X-Patchwork-Id: 99011 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F871C982EA for ; Wed, 23 Sep 2026 09:53:40 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3417.1790157212311375380 for ; Wed, 23 Sep 2026 02:53:32 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@arm.com header.s=foss header.b=hURrZquG; spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ahmed.gomaa@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 3AEDE1576; Wed, 23 Sep 2026 02:53:28 -0700 (PDT) Received: from e142471.cambridge.arm.com (e142471.arm.com [10.2.210.49]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 448E13F86F; Wed, 23 Sep 2026 02:53:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1790157211; bh=37pnmChj9d4B/cja/2+4mHXcS2wE1K/+kJlHAF82OuY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hURrZquGs8DFvhQ9ZzWDVZPLVpI3hcRKe7iM/RyOJSZ/U4BRM6KCXgaZTBlYLuIwL XIEToR0UkNVqSS5MXSbR+UZEYIxZIaMOwePFPttSJLrrwa+OtFxw/lASfGUGAMTIK/ XAYnP8iCo9rvbu9ncimhpc0UopldNzj25QHfQ35M= From: Ahmed Gomaa To: meta-arm@lists.yoctoproject.org Cc: Ahmed Gomaa Subject: [PATCH 1/3] arm/trusted-firmware-m: add TF-M 2.3 signing support Date: Wed, 23 Sep 2026 10:53:12 +0100 Message-ID: <20260923095314.382668-2-ahmed.gomaa@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260923095314.382668-1-ahmed.gomaa@arm.com> References: <20260923095314.382668-1-ahmed.gomaa@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 23 Sep 2026 09:53:40 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-arm/message/7171 TF-M 2.3 packages its image-signing wrapper as the mcuboot_imagesign_wrapper console command. Add the required native Python runtime dependencies and install the bundled MCUboot PEM signing keys in the native sysroot. Install TF-M's patched MCUboot imgtool package, including its imgtool.keys Python modules for loading and handling cryptographic keys. These modules are part of the signing tool implementation, separate from the PEM signing-key files installed above. Prefer this patched package through PYTHONPATH because it supports PSA key IDs and writes them into signed image metadata. Update tfm_sign_image.bbclass to invoke the console command when available, retaining wrapper.py as a fallback for older TF-M versions. Add optional PSA key ID arguments so platforms can provide the identifier expected by BL2 during image verification. Signed-off-by: Ahmed Gomaa --- meta-arm/classes/tfm_sign_image.bbclass | 18 +++++++++++++++- ...trusted-firmware-m-scripts-native_2.3.0.bb | 21 +++++++++++++++++++ 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/meta-arm/classes/tfm_sign_image.bbclass b/meta-arm/classes/tfm_sign_image.bbclass index f7900bb0..adc919a1 100644 --- a/meta-arm/classes/tfm_sign_image.bbclass +++ b/meta-arm/classes/tfm_sign_image.bbclass @@ -17,6 +17,11 @@ TFM_IMAGE_SIGN_DEPLOY_DIR = "${WORKDIR}/deploy-tfm-signed-images" # version by default RE_WRAPPER_SECURITY_COUNTER ?= "auto" +# Optional PSA key IDs to add to the signed image. Multiple IDs may be +# provided as a space-separated list. +TFM_IMAGE_SIGN_PSA_KEY_IDS ?= "" +TFM_IMAGE_SIGN_PSA_KEY_ID_ARGS = "${@' '.join(['--psa-key-ids %s' % key_id for key_id in d.getVar('TFM_IMAGE_SIGN_PSA_KEY_IDS').split()])}" + SSTATETASKS += "do_sign_images" do_sign_images[sstate-inputdirs] = "${TFM_IMAGE_SIGN_DEPLOY_DIR}" do_sign_images[sstate-outputdirs] = "${DEPLOY_DIR_IMAGE}" @@ -47,6 +52,7 @@ TFM_IMAGE_SIGN_ARGS ?= "\ -s ${RE_WRAPPER_SECURITY_COUNTER} \ --layout "${TFM_IMAGE_SIGN_DIR}/${host_binary_layout}" \ --public-key-format full \ + ${TFM_IMAGE_SIGN_PSA_KEY_ID_ARGS} \ --align 1 \ --pad \ --pad-header \ @@ -86,7 +92,17 @@ EOF host_binary_signed="${TFM_IMAGE_SIGN_DEPLOY_DIR}/signed_$(basename "${1}")" - ${PYTHON} "${STAGING_LIBDIR_NATIVE}/tfm-scripts/wrapper/wrapper.py" \ + # TF-M 2.3 installs the wrapper as a console script. Older releases use + # the Python script under tfm-scripts, so retain that as a fallback. + if [ -x "${STAGING_BINDIR_NATIVE}/mcuboot_imagesign_wrapper" ]; then + tfm_sign_wrapper="${STAGING_BINDIR_NATIVE}/mcuboot_imagesign_wrapper" + else + tfm_sign_wrapper="${PYTHON} ${STAGING_LIBDIR_NATIVE}/tfm-scripts/wrapper/wrapper.py" + fi + + # TF-M's patched imgtool contains IMAGE_TLV_KEYID support required to add + # PSA key IDs to image metadata; prefer it over python3-imgtool-native. + PYTHONPATH="${STAGING_LIBDIR_NATIVE}/tfm-scripts" ${tfm_sign_wrapper} \ ${TFM_IMAGE_SIGN_ARGS} \ -k "${signing_key_path}" \ "${1}" \ diff --git a/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m-scripts-native_2.3.0.bb b/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m-scripts-native_2.3.0.bb index b5220934..d1fa266f 100644 --- a/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m-scripts-native_2.3.0.bb +++ b/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m-scripts-native_2.3.0.bb @@ -3,7 +3,28 @@ require recipes-bsp/trusted-firmware-m/trusted-firmware-m-${PV}-src.inc inherit native python_setuptools_build_meta RDEPENDS:${PN} = "\ + python3-cryptography-native \ + python3-pyasn1-native \ + python3-pyyaml-native \ + python3-cbor2-native \ + python3-imgtool-native \ + python3-click-native \ python3-pyelftools-native \ python3-rich-native \ clang-native \ " + +do_install:append() { + install -d ${D}${libdir}/tfm-scripts + install -m 0644 ${S}/bl2/ext/mcuboot/*.pem ${D}${libdir}/tfm-scripts/ + + # TF-M applies additional patches to its bundled MCUboot imgtool. Install + # that copy privately so the signing wrapper can emit TF-M-specific TLVs. + install -d ${D}${libdir}/tfm-scripts/imgtool/keys + install -m 0644 ${S}/external/mcuboot/scripts/imgtool/*.py \ + ${D}${libdir}/tfm-scripts/imgtool/ + install -m 0644 ${S}/external/mcuboot/scripts/imgtool/keys/*.py \ + ${D}${libdir}/tfm-scripts/imgtool/keys/ +} + +FILES:${PN} += "${libdir}/tfm-scripts" From patchwork Wed Sep 23 09:53:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ahmed Gomaa X-Patchwork-Id: 99012 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67292C982FA for ; Wed, 23 Sep 2026 09:53:40 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3420.1790157219907041836 for ; Wed, 23 Sep 2026 02:53:40 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@arm.com header.s=foss header.b=UfuufuRF; spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ahmed.gomaa@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id E7CA4152B; Wed, 23 Sep 2026 02:53:35 -0700 (PDT) Received: from e142471.cambridge.arm.com (e142471.arm.com [10.2.210.49]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id EED413F86F; Wed, 23 Sep 2026 02:53:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1790157219; bh=ZuKMB0j+halyC1Pa5sza99bRi2CXuGss90/8bh2xUcQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UfuufuRF/r85qp56whz1+xlUOCfq41s7+DVD1tTGChHD287WhncGZQDu1NuR1HFri E5sjcBUc3tAjs1jO8mIkaB09NjdBqABk0oL/NZYQedenb0hb5UNg1Xwcw2/iXbtKkJ LJq2V/0IqAbH7IBKCcjOgpTxDc/33hdp6jN+9m3o= From: Ahmed Gomaa To: meta-arm@lists.yoctoproject.org Cc: Ahmed Gomaa Subject: [PATCH 3/3] arm-bsp/trusted-firmware-m: corstone1000: avoid provisioning reset Date: Wed, 23 Sep 2026 10:53:14 +0100 Message-ID: <20260923095314.382668-4-ahmed.gomaa@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260923095314.382668-1-ahmed.gomaa@arm.com> References: <20260923095314.382668-1-ahmed.gomaa@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 23 Sep 2026 09:53:40 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-arm/message/7173 Corstone-1000 performs PSA ADAC authentication while the device is in CM. TF-M runtime provisioning then changes the lifecycle state and resets the platform, which loses the authenticated debug permissions. Add a Secure Debug build option that skips TF-M runtime provisioning. This keeps the device in CM and avoids the provisioning reset until a reset-safe design can preserve DCU_EN across reset and apply it from BL2. Update the Secure Debug guide to use Arm Development Studio's built-in PSA-ADAC manager and obtain test credentials without building the external SDM library. Document the connection setup and verify that the system boots after authentication. Signed-off-by: Ahmed Gomaa --- .../documentation/corstone1000/user-guide.rst | 141 +++++++++++++----- ...one1000-Optionally-skip-provisioning.patch | 68 +++++++++ .../trusted-firmware-m-corstone1000.inc | 4 + 3 files changed, 174 insertions(+), 39 deletions(-) create mode 100644 meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0016-platform-corstone1000-Optionally-skip-provisioning.patch diff --git a/meta-arm-bsp/documentation/corstone1000/user-guide.rst b/meta-arm-bsp/documentation/corstone1000/user-guide.rst index a0d7b23b..a20571b1 100644 --- a/meta-arm-bsp/documentation/corstone1000/user-guide.rst +++ b/meta-arm-bsp/documentation/corstone1000/user-guide.rst @@ -2129,35 +2129,75 @@ For more information about this, see the following resources: - `Authenticated Debug Access Control Specification `__ - `Arm Corstone-1000 for MPS3 Application Note AN550, Chapter 7 `__ -The Secure Debug Manager API is implemented in the `Secure Debug Manager (PSA-ADAC / SDC-600) `__ repository. -This repository also contains the necessary files for the Arm Development Studio support. -The build and integration instructions can be found in its `README `__. +#. Install `Arm Development Studio `__ 2026.1, or Arm + Development Studio Platinum 2026.b. These releases contain a built-in + PSA-ADAC Secure Debug Manager. -The `Secure Debug Manager (PSA-ADAC / SDC-600)` repository also contains the private key and chain certificate to be used during the tests. -The private key's public pair is provisioned into the One-Time Programmable memory in TrustedFirmware-M. -These are dummy keys that should not be used in production. - -To test the Secure Debug feature, you'll need a debug probe from the `Arm ULINKpro family `__ -and `Arm Development Studio `__ versions 2022.2, 2022.c, or 2023.a. - - -#. Clone the `Secure Debug Manager (PSA-ADAC / SDC-600)` repository to your workspace. +#. Clone the `Secure Debug Manager + `__ + repository to obtain the dummy test credentials. .. code-block:: console cd ${WORKSPACE} git clone https://github.com/ARM-software/secure-debug-manager.git -#. Navigate into the repository directory and checkout the specific commit in the listing below. + Only the example private key and certificate chain are needed from this + repository. + + The public key corresponding to these credentials is provisioned into the + TrustedFirmware-M One-Time Programmable memory. The supplied credentials + are test credentials and must not be used in production. + +#. Create a user configuration database based on the Arm Development Studio + Corstone-1000 database. The following example assumes that Arm Development + Studio Platinum 2026.b is installed in ``/opt/arm``: .. code-block:: console - cd ${WORKSPACE}/secure-debug-manager - git checkout b30d6496ca749123e86b39b161b9f70ef76106d6 - git submodule update --init + export ARMDS_INSTALL_DIR=/opt/arm/developmentstudio_platinum-2026.b + export CS1000_ADAC_DB=${WORKSPACE}/armds-cs1000-adac611 + + mkdir -p "${CS1000_ADAC_DB}/Boards/Arm_Development_Boards" + cp -a \ + "${ARMDS_INSTALL_DIR}/sw/debugger/configdb/Boards/Arm Development Boards/MPS3_Corstone_1000" \ + "${CS1000_ADAC_DB}/Boards/Arm_Development_Boards/MPS3_Corstone_1000_ADAC_611" + cp -a "${ARMDS_INSTALL_DIR}/sw/debugger/configdb/Include" "${CS1000_ADAC_DB}/" + cp -a "${ARMDS_INSTALL_DIR}/sw/debugger/configdb/Schemas" "${CS1000_ADAC_DB}/" + cp -a "${ARMDS_INSTALL_DIR}/sw/debugger/configdb/ATP" "${CS1000_ADAC_DB}/" + + If Arm Development Studio is installed elsewhere, change + ``ARMDS_INSTALL_DIR`` accordingly. + +#. Enable the built-in PSA-ADAC Secure Debug Manager in the copied database. + In + ``${CS1000_ADAC_DB}/Boards/Arm_Development_Boards/MPS3_Corstone_1000_ADAC_611/project_types.xml``, + add the following element alongside the existing ``dtsl_config`` parameter: + + .. code-block:: xml + + + + This selects the built-in PSA-ADAC implementation, its authentication-token + provider, the SDC-600 communication device, and the board reset signal. + +#. Describe the Corstone-1000 debug port as DPv3. In + ``${CS1000_ADAC_DB}/Boards/Arm_Development_Boards/MPS3_Corstone_1000_ADAC_611/MPS3_Corstone_1000.sdf``, + add the following item to the ```` block of the ``ARMCS-DP`` + device: + + .. code-block:: xml -#. Follow the instructions in the `Secure Debug Manager (PSA-ADAC / SDC-600)'s README `__ for the development machine setup. - This setup must include building the Secure Debug Manager because the built library completes the Arm Development Studio configuration. + DPv3 + + DPv3 is required so that Arm Development Studio uses the ADIv6 debug-port + addressing needed to reach ``CSAPBCOM``. + + In the same file, give the copied platform a unique title: + + .. code-block:: xml + + #. Rebuild the software stack with Secure Debug. @@ -2177,16 +2217,15 @@ and `Arm Development Studio `__ versions 2022.2, 2022.c, or 202 IComPortInit : 383 : warn : init : IComPortInit: Blocked reading LPH2RA -#. Connect the debug probe to the MPS3 using the 20-pin 1.27mm connector with the ``CS_20W_1.27MM silkscreen`` label. - -#. Open a new Arm Development Studio IDE window and add the Secure Debug Manager configuration database. +#. Open a new Arm Development Studio IDE window and add the user configuration + database. #. Select ``Window`` > ``Preferences``. #. Expand ``Arm DS`` and select ``Configuration Database``. #. Select ``Add``. #. Enter a descriptive name, such as ``Corstone-1000 Secure Debug``. The name does not affect the connection. - #. Set ``Location`` to ``${WORKSPACE}/secure-debug-manager/arm_ds/DB``. + #. Set ``Location`` to ``${WORKSPACE}/armds-cs1000-adac611``. #. Select ``OK`` to close the ``Add configuration database location`` dialog. #. Select ``Rebuild database``. #. Select ``Apply and Close``. @@ -2197,16 +2236,41 @@ and `Arm Development Studio `__ versions 2022.2, 2022.c, or 202 #. Select ``Hardware Connection``, then select ``Next``. #. Enter a descriptive debug connection name, then select ``Next``. The name does not affect the connection. - #. In ``Target Selection``, select ``MPS3_Corstone-1000_ADAC``. + #. In ``Target Selection``, select ``MPS3_Corstone_1000_ADAC_611``. #. Select ``Finish``. -#. Configure and start the debug connection. +#. Configure one of the following external debug connections. + + To use an external `ULINKpro D `__ probe: - #. Select ``Arm`` > ``MPS3_Corstone-1000_ADAC`` > ``Bare Metal Debug`` > ``Cortex-A35``. - #. For ``Target Connection``, select ``ULINKpro``. - #. Select ``Browse...``. - #. In the ``Connection Browser``, select the name of the connected ULINKpro probe, then select ``Select``. - #. Select ``Debug``. + #. Connect the ULINKpro D probe to the MPS3 connector labelled + ``CS_20W_1.27MM``. + #. Select ``Arm`` > ``MPS3_Corstone_1000_ADAC_611`` > + ``Bare Metal Debug`` > ``Cortex-M0+``. + #. For ``Target Connection``, select ``ULINKpro D``. + #. Select ``Browse...``, select the detected ULINKpro D probe, and then + select ``Select``. + #. Select ``JTAG/SWJ``, set the debug clock to ``500 kHz``, and select + ``Connect only``. + + To use an external `DSTREAM `__ probe: + + #. Connect the DSTREAM probe to the MPS3 connector labelled + ``CS_20W_1.27MM``. + #. Select ``Arm`` > ``MPS3_Corstone_1000_ADAC_611`` > + ``Bare Metal Debug`` > ``Cortex-M0+``. + #. For ``Target Connection``, select ``DSTREAM``. + #. Select ``Browse...``, select the detected DSTREAM probe, and then select + ``Select``. + #. Select ``JTAG/SWJ``, set the debug clock to ``500 kHz``, and select + ``Connect only``. + + In both cases, use ``Cortex-M0+`` because Secure Debug runs in the Secure + Enclave. Do not select the host ``Cortex-A35`` connection. + +#. Select ``Debug``. Arm Development Studio resets the target using ``nSRST`` + and the built-in Secure Debug Manager communicates with ``CSAPBCOM`` to + perform authentication. #. Provide the paths to the private key and trust chain certificate when asked by Arm Development Studio Console. @@ -2215,21 +2279,21 @@ and `Arm Development Studio `__ versions 2022.2, 2022.c, or 202 ... Please provide private key file path: - Enter file path > ${WORKSPACE}\secure-debug-manager\example\data\keys\EcdsaP256Key-3.pem + Enter file path > ${WORKSPACE}/secure-debug-manager/example/data/keys/EcdsaP256Key-3.pem Please provide trust chain file path: - Enter file path > ${WORKSPACE}\secure-debug-manager\example\data\chains\chain.EcdsaP256-3 + Enter file path > ${WORKSPACE}/secure-debug-manager/example/data/chains/chain.EcdsaP256-3 ... -#. When successful authenticated, Arm Development Studio will connect to the running MPS3 and the debug features can be used. - The following prompt should appear in the Secure Enclave terminal (``ttyUSB1``): +#. After authentication succeeds, verify that the image continues booting and + is not left waiting inside the Secure Debug authentication flow. + Authentication alone is not sufficient to pass the test. Confirm that the + Host terminal reaches the Linux login prompt: .. code-block:: console - ... - boot_platform_init: Corstone-1000 Secure Debug is a success. - ... + corstone1000-mps3 login: -------------- @@ -2237,9 +2301,8 @@ and `Arm Development Studio `__ versions 2022.2, 2022.c, or 202 *Copyright (c) 2022-2026, Arm Limited. All rights reserved.* .. _arm-developer-fvp: https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps -.. _secure-debug-manager-repo-readme: https://github.com/ARM-software/secure-debug-manager/tree/master?tab=readme-ov-file#secure-debug-manager-psa-adac--sdc-600 -.. _secure-debug-manager-armds-integration: https://github.com/ARM-software/secure-debug-manager?tab=readme-ov-file#arm-development-studio-integration .. _meta-arm-repository-release-branch: https://docs.yoctoproject.org/next/migration-guides/migration-6.0.html -.. _arm-ulink-pro-website: https://www.arm.com/products/development-tools/debug-probes/ulink-pro .. _arm-ds-website: https://www.arm.com/products/development-tools/embedded-and-software/arm-development-studio +.. _arm-ulink-pro-d-website: https://www.arm.com/products/development-tools/debug-probes/ulink-pro +.. _arm-dstream-website: https://www.arm.com/products/development-tools/debug-probes/dstream-st .. _edk2-repository: https://github.com/tianocore/edk2 diff --git a/meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0016-platform-corstone1000-Optionally-skip-provisioning.patch b/meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0016-platform-corstone1000-Optionally-skip-provisioning.patch new file mode 100644 index 00000000..da808b9a --- /dev/null +++ b/meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0016-platform-corstone1000-Optionally-skip-provisioning.patch @@ -0,0 +1,68 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Ahmed Gomaa +Date: Wed, 2 Sep 2026 12:00:00 +0100 +Subject: [PATCH] platform: corstone1000: keep CM during secure debug + +Add a temporary Corstone-1000 Secure Debug workaround that skips runtime +TF-M provisioning when Secure Debug is enabled. This keeps the device in +the CM lifecycle state and avoids the provisioning reset, allowing the +authenticated debug session to remain active. + +Keep this workaround until a reset-safe architecture is implemented to +preserve the authenticated DCU_EN value across reset and apply it from BL2. + +Upstream-Status: Inappropriate [temporary platform workaround] +Signed-off-by: Ahmed Gomaa +--- + secure_fw/spm/CMakeLists.txt | 1 + + secure_fw/spm/core/main.c | 10 ++++++++++ + 2 files changed, 11 insertions(+) + +diff --git a/secure_fw/spm/CMakeLists.txt b/secure_fw/spm/CMakeLists.txt +--- a/secure_fw/spm/CMakeLists.txt ++++ b/secure_fw/spm/CMakeLists.txt +@@ -111,6 +111,7 @@ target_compile_definitions(tfm_spm + $<$:BRANCH_PROTECTION_CONTROL=2> + $<$:BRANCH_PROTECTION_CONTROL=3> + $<$:PLATFORM_PSA_ADAC_SECURE_DEBUG> ++ $<$:CORSTONE1000_SKIP_PROVISIONING_FOR_DEBUG> + $<$:CONFIG_TFM_REUSE_COPY_AREA_FOR_SP_STACKS> + $<$:TFM_TZ_REENTRANCY_CHECK> + ) +diff --git a/secure_fw/spm/core/main.c b/secure_fw/spm/core/main.c +--- a/secure_fw/spm/core/main.c ++++ b/secure_fw/spm/core/main.c +@@ -31,7 +31,9 @@ static fih_ret tfm_core_init(void) + { + enum tfm_plat_err_t plat_err = TFM_PLAT_ERR_SYSTEM_ERR; + FIH_DECLARE(fih_rc, FIH_FAILURE); ++#ifndef CORSTONE1000_SKIP_PROVISIONING_FOR_DEBUG + bool provisioning_required; ++#endif + + /* + * Access to any peripheral should be performed after programming +@@ -65,6 +67,7 @@ static fih_ret tfm_core_init(void) + FIH_RET(SPM_ERROR_GENERIC); + } + ++#ifndef CORSTONE1000_SKIP_PROVISIONING_FOR_DEBUG + /* Perform provisioning. */ + plat_err = tfm_plat_provisioning_is_required(&provisioning_required); + if (plat_err != TFM_PLAT_ERR_SUCCESS) { +@@ -77,6 +80,12 @@ static fih_ret tfm_core_init(void) + FIH_RET(SPM_ERROR_GENERIC); + } + } ++#else ++ /* Temporary workaround: retain CM and avoid the provisioning reset. */ ++ WARN("Skipping TF-M provisioning for Secure Debug workaround. " ++ "Device remains unprovisioned and must not be used in " ++ "production.\n"); ++#endif + + TFM_COVERITY_DEVIATE_LINE(MISRA_C_2023_Rule_2_2, "Parameters can be changed by user and this code will make effect") + tfm_plat_provisioning_check_for_dummy_keys(); +-- +2.43.0 + diff --git a/meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m-corstone1000.inc b/meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m-corstone1000.inc index 0ecb75a2..3422163d 100644 --- a/meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m-corstone1000.inc +++ b/meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m-corstone1000.inc @@ -28,6 +28,9 @@ EXTRA_OECMAKE += "-DPLATFORM_IS_FVP=${TFM_PLATFORM_IS_FVP}" EXTRA_OECMAKE += "-DCC312_LEGACY_DRIVER_API_ENABLED=OFF" EXTRA_OECMAKE:append = " -DENABLE_MULTICORE=${@bb.utils.contains('MACHINE_FEATURES', 'corstone1000_smp', 'TRUE', 'FALSE', d)}" EXTRA_OECMAKE:append:corstone1000-mps3 = " -DPLATFORM_PSA_ADAC_SECURE_DEBUG=${@bb.utils.contains('MACHINE_FEATURES', 'secure-debug', 'ON', 'OFF', d)}" +# Keep the device in CM until authenticated DCU_EN can be preserved across +# reset and applied from BL2. +EXTRA_OECMAKE:append:corstone1000-mps3 = " -DCORSTONE1000_SKIP_PROVISIONING_FOR_DEBUG=${@bb.utils.contains('MACHINE_FEATURES', 'secure-debug', 'ON', 'OFF', d)}" EXTRA_OECMAKE:append:corstone1000-mps3 = " -DPLATFORM_PSA_ADAC_SOURCE_PATH=${S}/external/tfm-psa-adac -DPLATFORM_PSA_ADAC_BUILD_PATH=${B}/tfm-psa-adac-build" FILESEXTRAPATHS:prepend := "${THISDIR}/files:" @@ -47,6 +50,7 @@ SRC_URI:append:corstone1000 = " \ file://0013-plat-cs1k-Remove-unused-FWU-partitions-upon-version-.patch \ file://0014-plat-cs1k-Duplicate-old-images-in-FWU.patch \ file://0015-platform-corstone1000-Increase-FIP-partition-size.patch \ + file://0016-platform-corstone1000-Optionally-skip-provisioning.patch \ " FILESEXTRAPATHS:prepend:corstone1000-mps3 := "${THISDIR}/files/corstone1000/psa-adac:"