This event has been canceled with a note:
"Hi, Cancelling as no topic. Regards, Olivier. "
TF-A Tech Forum
Thursday Oct 1, 2026 ⋅ 5pm – 6pm
Central European Time - Paris
Location
https://linaro-org.zoom.us/j/93557863987?pwd=56a1l8cBnetDTZ6eazHGaE1Ctk4W34…https://www.google.com/url?q=https%3A%2F%2Flinaro-org.zoom.us%2Fj%2F9355786…
Trusted Firmware is inviting you to a scheduled Zoom meeting.
Topic: TF-A Tech Forum
Time: May 15, 2025 02:00 PM London
Every 2 weeks on Thu, 78 occurrence(s)
Please download and import the following iCalendar (.ics) files to your
calendar system.
Weekly:
https://linaro-org.zoom.us/meeting/tJcocu6gqDgjEtOkyBhSQauR1sUyFwIcNKLa/ics…
Join Zoom Meeting
https://linaro-org.zoom.us/j/93557863987?pwd=56a1l8cBnetDTZ6eazHGaE1Ctk4W34…
Meeting ID: 935 5786 3987
Passcode: 939141
---
One tap mobile
+12532158782,,93557863987# US (Tacoma)
+13017158592,,93557863987# US (Washington DC)
---
Dial by your location
• +1 253 215 8782 US (Tacoma)
• +1 301 715 8592 US (Washington DC)
• +1 305 224 1968 US
• +1 309 205 3325 US
• +1 312 626 6799 US (Chicago)
• +1 346 248 7799 US (Houston)
• +1 360 209 5623 US
• +1 386 347 5053 US
• +1 507 473 4847 US
• +1 564 217 2000 US
• +1 646 558 8656 US (New York)
• +1 646 931 3860 US
• +1 669 444 9171 US
• +1 669 900 9128 US (San Jose)
• +1 689 278 1000 US
• +1 719 359 4580 US
• +1 253 205 0468 US
• 833 548 0276 US Toll-free
• 833 548 0282 US Toll-free
• 833 928 4608 US Toll-free
• 833 928 4609 US Toll-free
• 833 928 4610 US Toll-free
• 877 853 5247 US Toll-free
• 888 788 0099 US Toll-free
Meeting ID: 935 5786 3987
Find your local number: https://linaro-org.zoom.us/u/adoz9mILli
Guests
d82620130(a)gmail.com
namyoon(a)google.com
shaikadnanafrid(a)gmail.com
tf-a(a)lists.trustedfirmware.org
~~//~~
Sent by Google Calendar: https://calendar.google.com/calendar/
You are receiving this email because you are an attendee on the event.
Forwarding this invitation could allow any recipient to send a response to
the organizer, be added to the guest list, invite others regardless of
their own invitation status, or modify your RSVP.
Learn more https://support.google.com/calendar/answer/37135#forwarding
Hello,
I was planning to upstream the code to support Trusted Board Boot on
STM32MP2.
But I came to an issue with the OID we have chosen.
Our first implementation was done back in 2023, and based on TF-A v2.8.
We needed an OID for the DDR PHY firmware, almost the same way it was
done by NXP with this patch:
https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/6155
So I ended up doing this patch:
https://github.com/STMicroelectronics/arm-trusted-firmware/commit/c7f0e2eb6…
But now that I want to upstream that code, I see that this OID has been
chosen between TF-A v2.8 and TF-A v2.9 for
ETHOSN_NPU_FW_CONTENT_CERT_PK_OID.
As I think OIDs should be unique, I then cannot re-use the same one.
But then I will have some issues with customers that already made
products with with our software based either on either v2.8 or v2.10.
If they need to update their version to a newer one, they will need to
regenerate the certificates for this DDR firmware if the software is
updated.
For the update procedure, only the FIP may be updated, so if the
cert_create tool uses a new OID, it won't match the one used in BL2 DT.
A possible solution would be this one:
#if STM32MP_LEGACY_DDR_FW_OID
#define DDR_FW_HASH_OID "1.3.6.1.4.1.4128.2300.1"
#else
#define DDR_FW_HASH_OID "1.3.6.1.4.1.4128.2400.1"
#endif
But we'd still have the same OID as ETHOSN_NPU_FW_CONTENT_CERT_PK_OID if
STM32MP_LEGACY_DDR_FW_OID is selected.
Another one is just to keep the new value and set the patch as a
breaking change, and then inform our customers through the release notes
that they should take care of this new version.
A third one would be to change ETHOSN_NPU_FW_CONTENT_CERT_PK_OID. But
then you'll face the same issues about such a change, and the
dependencies with other tools or pieces of software that would need update.
In your opinion what would be the better solution?
Another question I have is about the OID entreprise number? Should I
keep Arm one (4128), or use the STMicroelectronics' (7616)? But that
would differ from what NXP has done.
Thanks,
Yann
Hi all,
We’re going to trial a new approach for platform contributions that require both TF-A and CI changes.
This is intended to address synchronisation issues that can arise when TF-A and corresponding CI patches are merged at the same time. In some cases, the CI configuration can take effect before other in-flight patches have had an opportunity to rebase onto the associated TF-A change, causing unrelated patches to fail CI.
For the time being, we’re asking contributors to:
* Submit the Coverity configuration and build configuration as separate CI patches.
* Test both CI patches together with the corresponding TF-A change.
* Submit the Coverity configuration alongside the TF-A change, but hold back the build configuration for one week.
* After the one-week period, the maintainer should return to the CI change and submit the build configuration.
The one-week delay is intended to give the TF-A change time to propagate through other in-flight patches before the new build configuration becomes active.
We’ll trial this approach for now and review how well it works in practice.
Thanks,
Harrison
Hi Vikrant,
This makes sense to me.
Today cert_create effectively treats the registered key set as global: even if only a subset of certificates is requested, it still walks the full key list for load/create/save,
and -k can fail on filenames for keys that are not actually needed by the requested outputs.
Your proposed approach seems like the right direction. At a high level, the tool should first derive the required key set from the certificates that were actually requested, then use that set consistently for validation, key load/create, and key save. That would make requesting only a subset of certificates work the way users would expect, without needing to provide or generate unrelated keys.
One thing I would suggest is to make sure the filtering is applied consistently across all three places:
*
command-line validation
*
key load/create
*
key save
If that is what your change does, then the approach looks good to me. Please upload it to Gerrit and it can go through the usual review process and CI validation.
Thanks,
Manish Badarkhe
________________________________
From: Vikrant Yadav <vikrantyadav4802(a)gmail.com>
Sent: 29 September 2026 07:14
To: tf-a(a)lists.trustedfirmware.org <tf-a(a)lists.trustedfirmware.org>
Cc: Sandrine Bailleux <Sandrine.Afsa(a)arm.com>; Manish Badarkhe <Manish.Badarkhe(a)arm.com>
Subject: [RFC] cert_create: only generate/save keys needed by requested certs
Hi all,
I'd like to propose a small change to cert_create (tools/cert_create) and get your feedback before uploading to Gerrit.
What it does today:
When generating certificates, cert_create unconditionally generates all keys in the Chain of Trust (CoT), and with the -k option it requires filenames for every key - even when only a subset of certificates is requested.
Why this is a problem:
Keys that no requested certificate needs are still generated, and -k errors out on missing filenames for keys that are never used. Requesting a single certificate shouldn't require dealing with keys it doesn't depend on.
Proposed fix:
Add a "bool required" field to the key struct. For each requested certificate, mark as required the keys it depends on:
- the certificate's own key
- its issuer's signing key
- keys referenced by its extensions
The key generation and save loops then act only on keys marked required.
Does this approach make sense? If so, I'll upload the change to Gerrit.
Thanks,
Vikrant