- TF-M - lists.trustedfirmware.org

Re: [TF-M] [RFC] The code review guideline

by Ken Liu

Hi, I would merge this one as it has been put there review for a while, thanks all the reviewers. This would provide a basic shape while we are creating new features, also could be viewed better after rendered. There would be many points can be updated later, let’s try to use it and see how it works – Create issues at https://developer.trustedfirmware.org/ and assign to me if there are, reply here is also workable. Thanks. /Ken From: TF-M <tf-m-bounces(a)lists.trustedfirmware.org> On Behalf Of Ken Liu via TF-M Sent: Tuesday, September 1, 2020 9:50 AM To: tf-m(a)lists.trustedfirmware.org Cc: nd <nd(a)arm.com> Subject: [TF-M] [RFC] The code review guideline Hi, We are creating one document to describe the code review guidelines: https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/5372 The goal of this document is to introduce the source management level concepts to be followed while reviewing a code – which try to simplify the contribution (but burdens the reviewers? 😉). Difference to the `coding style`: * It focuses more on the source placement, interface definition and including, etc. As this document is keeping evolving in a period, the plan is we merge a simple version as start and adding more contents by new patches, so please give enough comments if you have, and don’t forget the concept: we want to make things rational and simple. Thanks. /Ken

4 years, 3 months

1
0
0 0

TF-M Technical Forum call – October 1

by Anton Komlev

Hello, The next Technical Forum is planned on Thursday, October 1 at 15:00-16:00 UTC (US time zone). Please reply on this email with your proposals for agenda topics. Recording and slides of previous meetings are here: https://www.trustedfirmware.org/meetings/tf-m-technical-forum/ Best regards, Anton

4 years, 3 months

1
0
0 0

Updated invitation: TF-M tech Forum @ Thu 15 Oct 2020 07:00 - 08:00 (BST) (tf-m@lists.trustedfirmware.org)

by Bill Fletcher

This event has been changed. Title: TF-M tech Forum About TF-M Tech forum:This is an open forum for anyone to participate and it is not restricted to Trusted Firmware project members. It will operate under the guidance of the TF TSC.Feel free to forward it to colleagues.Details of previous meetings are here: https://www.trustedfirmware.org/meetings/tf-m-technical-forum/Tr… Firmware is inviting you to a scheduled Zoom meeting.Join Zoom Meetinghttps://zoom.us/j/9159704974Meeting ID: 915 970 4974One tap mobile+16465588656,,9159704974# US (New York)+16699009128,,9159704974# US (San Jose)Dial by your location        +1 646 558 8656 US (New York)        +1 669 900 9128 US (San Jose)        877 853 5247 US Toll-free        888 788 0099 US Toll-freeMeeting ID: 915 970 4974Find your local number: https://zoom.us/u/ad27hc6t7h   When: Thu 15 Oct 2020 07:00 – 08:00 United Kingdom Time Calendar: tf-m(a)lists.trustedfirmware.org Who: * Bill Fletcher- creator * Don Harbin * tf-m(a)lists.trustedfirmware.org Event details: https://www.google.com/calendar/event?action=VIEW&eid=NWRmOTZydWZobWFnZ3RvM… Invitation from Google Calendar: https://www.google.com/calendar/ You are receiving this courtesy email at the account tf-m(a)lists.trustedfirmware.org because you are an attendee of this event. To stop receiving future updates for this event, decline this event. Alternatively, you can sign up for a Google Account at https://www.google.com/calendar/ and control your notification settings for your entire calendar. Forwarding this invitation could allow any recipient to send a response to the organiser and be added to the guest list, invite others regardless of their own invitation status or to modify your RSVP. Learn more at https://support.google.com/calendar/answer/37135#forwarding

4 years, 3 months

1
0
0 0

Invitation: TF-M tech Forum @ Thu 15 Oct 2020 07:00 - 08:00 (BST) (tf-m@lists.trustedfirmware.org)

by Bill Fletcher

You have been invited to the following event. Title: TF-M tech Forum About TF-M Tech forum:This is an open forum for anyone to participate and it is not restricted to Trusted Firmware project members. It will operate under the guidance of the TF TSC.Feel free to forward it to colleagues.Details of previous meetings are here: https://www.trustedfirmware.org/meetings/tf-m-technical-forum/Tr… Firmware is inviting you to a scheduled Zoom meeting.Join Zoom Meetinghttps://zoom.us/j/9159704974Meeting ID: 915 970 4974One tap mobile+16465588656,,9159704974# US (New York)+16699009128,,9159704974# US (San Jose)Dial by your location        +1 646 558 8656 US (New York)        +1 669 900 9128 US (San Jose)        877 853 5247 US Toll-free        888 788 0099 US Toll-freeMeeting ID: 915 970 4974Find your local number: https://zoom.us/u/ad27hc6t7h   When: Thu 15 Oct 2020 07:00 – 08:00 United Kingdom Time Calendar: tf-m(a)lists.trustedfirmware.org Who: * Bill Fletcher- organiser * Don Harbin * tf-m(a)lists.trustedfirmware.org Event details: https://www.google.com/calendar/event?action=VIEW&eid=NWRmOTZydWZobWFnZ3RvM… Invitation from Google Calendar: https://www.google.com/calendar/ You are receiving this courtesy email at the account tf-m(a)lists.trustedfirmware.org because you are an attendee of this event. To stop receiving future updates for this event, decline this event. Alternatively, you can sign up for a Google Account at https://www.google.com/calendar/ and control your notification settings for your entire calendar. Forwarding this invitation could allow any recipient to send a response to the organiser and be added to the guest list, invite others regardless of their own invitation status or to modify your RSVP. Learn more at https://support.google.com/calendar/answer/37135#forwarding

4 years, 3 months

1
0
0 0

Cancelled event with note: TF-M Tech Forum @ Thu 15 Oct 2020 16:00 - 17:00 (BST) (tf-m@lists.trustedfirmware.org)

by Bill Fletcher

This event has been cancelled with this note: "This will be rescheduled with the time corrected" Title: TF-M Tech Forum About TF-M Tech forum:This is an open forum for anyone to participate and it is not restricted to Trusted Firmware project members. It will operate under the guidance of the TF TSC.Feel free to forward it to colleagues.Details of previous meetings are here: https://www.trustedfirmware.org/meetings/tf-m-technical-forum/Tr… Firmware is inviting you to a scheduled Zoom meeting.Join Zoom Meetinghttps://zoom.us/j/9159704974Meeting ID: 915 970 4974One tap mobile+16465588656,,9159704974# US (New York)+16699009128,,9159704974# US (San Jose)Dial by your location        +1 646 558 8656 US (New York)        +1 669 900 9128 US (San Jose)        877 853 5247 US Toll-free        888 788 0099 US Toll-freeMeeting ID: 915 970 4974Find your local number: https://zoom.us/u/ad27hc6t7h   When: Thu 15 Oct 2020 16:00 – 17:00 United Kingdom Time Calendar: tf-m(a)lists.trustedfirmware.org Who: * Bill Fletcher- creator * Don Harbin * tf-m(a)lists.trustedfirmware.org Invitation from Google Calendar: https://www.google.com/calendar/ You are receiving this courtesy email at the account tf-m(a)lists.trustedfirmware.org because you are an attendee of this event. To stop receiving future updates for this event, decline this event. Alternatively, you can sign up for a Google Account at https://www.google.com/calendar/ and control your notification settings for your entire calendar. Forwarding this invitation could allow any recipient to send a response to the organiser and be added to the guest list, invite others regardless of their own invitation status or to modify your RSVP. Learn more at https://support.google.com/calendar/answer/37135#forwarding

4 years, 3 months

1
0
0 0

Invitation: TF-M Tech forum @ Thu 1 Oct 2020 16:00 - 17:00 (BST) (tf-m@lists.trustedfirmware.org)

by Bill Fletcher

You have been invited to the following event. Title: TF-M Tech forum About TF-M Tech forum:This is an open forum for anyone to participate and it is not restricted to Trusted Firmware project members. It will operate under the guidance of the TF TSC.Feel free to forward it to colleagues.Details of previous meetings are here: https://www.trustedfirmware.org/meetings/tf-m-technical-forum/Tr… Firmware is inviting you to a scheduled Zoom meeting.Join Zoom Meetinghttps://zoom.us/j/9159704974Meeting ID: 915 970 4974One tap mobile+16465588656,,9159704974# US (New York)+16699009128,,9159704974# US (San Jose)Dial by your location        +1 646 558 8656 US (New York)        +1 669 900 9128 US (San Jose)        877 853 5247 US Toll-free        888 788 0099 US Toll-freeMeeting ID: 915 970 4974Find your local number: https://zoom.us/u/ad27hc6t7h   When: Thu 1 Oct 2020 16:00 – 17:00 United Kingdom Time Calendar: tf-m(a)lists.trustedfirmware.org Who: * Bill Fletcher- creator * Don Harbin * tf-m(a)lists.trustedfirmware.org Event details: https://www.google.com/calendar/event?action=VIEW&eid=N29mbm1qN2prOXBxMDhpd… Invitation from Google Calendar: https://www.google.com/calendar/ You are receiving this courtesy email at the account tf-m(a)lists.trustedfirmware.org because you are an attendee of this event. To stop receiving future updates for this event, decline this event. Alternatively, you can sign up for a Google Account at https://www.google.com/calendar/ and control your notification settings for your entire calendar. Forwarding this invitation could allow any recipient to send a response to the organiser and be added to the guest list, invite others regardless of their own invitation status or to modify your RSVP. Learn more at https://support.google.com/calendar/answer/37135#forwarding

4 years, 3 months

1
0
0 0

Cancelled event with note: TF-M Tech Forum @ Thu 1 Oct 2020 07:00 - 08:00 (BST) (tf-m@lists.trustedfirmware.org)

by Bill Fletcher

This event has been cancelled with this note: "To be rescheduled with the time corrected" Title: TF-M Tech Forum About TF-M Tech forum:This is an open forum for anyone to participate and it is not restricted to Trusted Firmware project members. It will operate under the guidance of the TF TSC.Feel free to forward it to colleagues.Details of previous meetings are here: https://www.trustedfirmware.org/meetings/tf-m-technical-forum/Tr… Firmware is inviting you to a scheduled Zoom meeting.Join Zoom Meetinghttps://zoom.us/j/9159704974Meeting ID: 915 970 4974One tap mobile+16465588656,,9159704974# US (New York)+16699009128,,9159704974# US (San Jose)Dial by your location        +1 646 558 8656 US (New York)        +1 669 900 9128 US (San Jose)        877 853 5247 US Toll-free        888 788 0099 US Toll-freeMeeting ID: 915 970 4974Find your local number: https://zoom.us/u/ad27hc6t7h   When: Thu 1 Oct 2020 07:00 – 08:00 United Kingdom Time Calendar: tf-m(a)lists.trustedfirmware.org Who: * Bill Fletcher- creator * Don Harbin * tf-m(a)lists.trustedfirmware.org Invitation from Google Calendar: https://www.google.com/calendar/ You are receiving this courtesy email at the account tf-m(a)lists.trustedfirmware.org because you are an attendee of this event. To stop receiving future updates for this event, decline this event. Alternatively, you can sign up for a Google Account at https://www.google.com/calendar/ and control your notification settings for your entire calendar. Forwarding this invitation could allow any recipient to send a response to the organiser and be added to the guest list, invite others regardless of their own invitation status or to modify your RSVP. Learn more at https://support.google.com/calendar/answer/37135#forwarding

4 years, 3 months

1
0
0 0

Re: [TF-M] X.509 Certificate Chain Support in TF-M

by Ronald Cron

Hi, I haven't dug into the details here but just wanted to point out that there is an x509 library in Mbed TLS. Thanks, Ronald. -----Original Message----- From: TF-M <tf-m-bounces(a)lists.trustedfirmware.org> On Behalf Of Abhishek Pandit via TF-M Sent: 28 September 2020 11:42 To: Soby Mathew <Soby.Mathew(a)arm.com>; David Brown <david.brown(a)linaro.org>; tf-m(a)lists.trustedfirmware.org Subject: Re: [TF-M] X.509 Certificate Chain Support in TF-M Adding TF-M mailing list, in case anyone is interested in the topic. -----Original Message----- From: Soby Mathew <Soby.Mathew(a)arm.com> Sent: 24 September 2020 15:02 To: David Brown <david.brown(a)linaro.org> Cc: Abhishek Pandit <Abhishek.Pandit(a)arm.com>; Kevin Townsend <kevin.townsend(a)linaro.org>; Anton Komlev <Anton.Komlev(a)arm.com>; David Wang <David.Wang(a)arm.com>; Tamas Ban <Tamas.Ban(a)arm.com>; Shebu Varghese Kuriakose <Shebu.VargheseKuriakose(a)arm.com>; Adrian Shaw <Adrian.Shaw(a)arm.com> Subject: RE: X.509 Certificate Chain Support in TF-M [+Adrian] Hi David > To me, what might make some sense would be to have some kind of > restrictions on what can be done with the private key stored on the > secure side. If all operations are done through an extended API, > those would be the only operations permissible, whereas a generic > private key storage could allow rogue non-secure code to make use of > signing of other things, including signing non-resident data (one > device using another for attestation. At least the risks and costs of this should be considered. Thanks for the clarification. This would mean that given the current PSA Crypto design, the only way to achieve this would be to implement a custom RoT service in SPE. Hence the NSPE cannot make use of the key for arbitrary signing operation. > My primary concern with this solution at this point, is that we > haven't consider securing the protocol necessary to associate a > certificate/key pair with a particular device. Maybe we should be looking into SDO? Yes, that does seem like a good candidate. From my reading, several aspects of provisioning seem to be outside TF-M realm. > Having roots of trust instead of public keys (or certs) for direct > signing keys would give OEMs and other parties involved in the > firmware upgrade process more flexibility. > I see, thanks. We use certificate chains when firmware images need from different vendors need to be deployed in different privilege levels or multiple boot stages are present in A-profile. The Platform boot guide document https://developer.arm.com/documentation/den0072/0101/ mentions this as well. Possibly this is an enhancement to MCUBoot (Boot loader for TF-M). After talking with Adrian, I think there is consensus that certificate chain is a useful feature to have. So from my point of view, if there is some collaborative effort to develop such a service as TF-M specific extension, I think it would be very useful to the community. Best Regards Soby Mathew > -----Original Message----- > From: David Brown <david.brown(a)linaro.org> > Sent: 23 September 2020 19:12 > To: Soby Mathew <Soby.Mathew(a)arm.com> > Cc: Abhishek Pandit <Abhishek.Pandit(a)arm.com>; Kevin Townsend > <kevin.townsend(a)linaro.org>; Anton Komlev <Anton.Komlev(a)arm.com>; > David Wang <David.Wang(a)arm.com>; Tamas Ban <Tamas.Ban(a)arm.com>; Shebu > Varghese Kuriakose <Shebu.VargheseKuriakose(a)arm.com> > Subject: Re: X.509 Certificate Chain Support in TF-M > > On Wed, Sep 23, 2020 at 04:52:13PM +0000, Soby Mathew wrote: > > > I had a review and thanks for the excellent proposal, and it does > > make sense to me to add this support but some questions from my side: > > > > 1. Do you envisage the new CSR API and ability to store certificate blobs in > > secure world as an extension to PSA Attestation API ? > > 2. I know it is desirable to add this functionality to secure world, but to > > clear my mind, Is it possible to provide the same functionality from Non > > Secure side but making use of PSA crypto APIs ? For example the > > PSA > Crypto > > could export the public key and sign necessary data to create > > the CSR > from > > NS side. Similarly new keys can be imported to Crypto by NS > > world while > the > > certificate chains are maintained in NS world for non IAT services. I may > > have missed some key point. > > I agree that there is little reason to store the certificates > themselves on the secure side. If they were modified or tampered > with, there would no longer be a private key to make use of them. > > > My primary concern with this solution at this point, is that we > haven't consider securing the protocol necessary to associate a > certificate/key pair with a particular device. Maybe we should be looking into SDO? > > > 3. I understood how we can make use of certificate chains for > > attestation, > but > > it is less clear how this can be made use of while booting firmware images. > > Could you elaborate more ? > > Only in the sense of allowing a signed firmware image to have a > certificate chain with it. Having roots of trust instead of public > keys (or certs) for direct signing keys would give OEMs and other > parties involved in the firmware upgrade process more flexibility. > > David -- TF-M mailing list TF-M(a)lists.trustedfirmware.org https://lists.trustedfirmware.org/mailman/listinfo/tf-m

4 years, 3 months

1
0
0 0

Re: [TF-M] X.509 Certificate Chain Support in TF-M

by Abhishek Pandit

Adding TF-M mailing list, in case anyone is interested in the topic. -----Original Message----- From: Soby Mathew <Soby.Mathew(a)arm.com> Sent: 24 September 2020 15:02 To: David Brown <david.brown(a)linaro.org> Cc: Abhishek Pandit <Abhishek.Pandit(a)arm.com>; Kevin Townsend <kevin.townsend(a)linaro.org>; Anton Komlev <Anton.Komlev(a)arm.com>; David Wang <David.Wang(a)arm.com>; Tamas Ban <Tamas.Ban(a)arm.com>; Shebu Varghese Kuriakose <Shebu.VargheseKuriakose(a)arm.com>; Adrian Shaw <Adrian.Shaw(a)arm.com> Subject: RE: X.509 Certificate Chain Support in TF-M [+Adrian] Hi David > To me, what might make some sense would be to have some kind of > restrictions on what can be done with the private key stored on the > secure side. If all operations are done through an extended API, > those would be the only operations permissible, whereas a generic > private key storage could allow rogue non-secure code to make use of > signing of other things, including signing non-resident data (one > device using another for attestation. At least the risks and costs of this should be considered. Thanks for the clarification. This would mean that given the current PSA Crypto design, the only way to achieve this would be to implement a custom RoT service in SPE. Hence the NSPE cannot make use of the key for arbitrary signing operation. > My primary concern with this solution at this point, is that we > haven't consider securing the protocol necessary to associate a > certificate/key pair with a particular device. Maybe we should be looking into SDO? Yes, that does seem like a good candidate. From my reading, several aspects of provisioning seem to be outside TF-M realm. > Having roots of trust instead of public keys (or certs) for direct > signing keys would give OEMs and other parties involved in the > firmware upgrade process more flexibility. > I see, thanks. We use certificate chains when firmware images need from different vendors need to be deployed in different privilege levels or multiple boot stages are present in A-profile. The Platform boot guide document https://developer.arm.com/documentation/den0072/0101/ mentions this as well. Possibly this is an enhancement to MCUBoot (Boot loader for TF-M). After talking with Adrian, I think there is consensus that certificate chain is a useful feature to have. So from my point of view, if there is some collaborative effort to develop such a service as TF-M specific extension, I think it would be very useful to the community. Best Regards Soby Mathew > -----Original Message----- > From: David Brown <david.brown(a)linaro.org> > Sent: 23 September 2020 19:12 > To: Soby Mathew <Soby.Mathew(a)arm.com> > Cc: Abhishek Pandit <Abhishek.Pandit(a)arm.com>; Kevin Townsend > <kevin.townsend(a)linaro.org>; Anton Komlev <Anton.Komlev(a)arm.com>; > David Wang <David.Wang(a)arm.com>; Tamas Ban <Tamas.Ban(a)arm.com>; Shebu > Varghese Kuriakose <Shebu.VargheseKuriakose(a)arm.com> > Subject: Re: X.509 Certificate Chain Support in TF-M > > On Wed, Sep 23, 2020 at 04:52:13PM +0000, Soby Mathew wrote: > > > I had a review and thanks for the excellent proposal, and it does > > make sense to me to add this support but some questions from my side: > > > > 1. Do you envisage the new CSR API and ability to store certificate blobs in > > secure world as an extension to PSA Attestation API ? > > 2. I know it is desirable to add this functionality to secure world, but to > > clear my mind, Is it possible to provide the same functionality from Non > > Secure side but making use of PSA crypto APIs ? For example the > > PSA > Crypto > > could export the public key and sign necessary data to create > > the CSR > from > > NS side. Similarly new keys can be imported to Crypto by NS > > world while > the > > certificate chains are maintained in NS world for non IAT services. I may > > have missed some key point. > > I agree that there is little reason to store the certificates > themselves on the secure side. If they were modified or tampered > with, there would no longer be a private key to make use of them. > > > My primary concern with this solution at this point, is that we > haven't consider securing the protocol necessary to associate a > certificate/key pair with a particular device. Maybe we should be looking into SDO? > > > 3. I understood how we can make use of certificate chains for > > attestation, > but > > it is less clear how this can be made use of while booting firmware images. > > Could you elaborate more ? > > Only in the sense of allowing a signed firmware image to have a > certificate chain with it. Having roots of trust instead of public > keys (or certs) for direct signing keys would give OEMs and other > parties involved in the firmware upgrade process more flexibility. > > David

4 years, 3 months

1
0
0 0

Cypress PSoC64 support update

by Andrei Narkevitch

Hi all, Just to let you know, some time ago Cypress has officially released the PSoC64 platform. With this, we are planning to stop supporting old PSoC64 development kits and move our focus on the new release boards. This is mainly because the old boards were programmed with an old firmware which is not compatible with the changes we do to the TFM code and it would be an unnecessary overhead to support both versions. Please let us know if it causes any issues. The new PSoC64 kit: https://www.cypress.com/documentation/development-kitsboards/psoc-64-standa… Thanks, Andrei Narkevitch Cypress Semiconductor Corp. An Infineon Technologies Company This message and any attachments may contain confidential information from Cypress or its subsidiaries. If it has been received in error, please advise the sender and immediately delete this message.

4 years, 3 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

TF-M