Re: [TF-M] Feature branch 'feature-isolation-level3' is created for related patches merging

Hi,

Thank Tamas for the scenario, this is a good example.

There were some queries and initial investigations before, which shows that some users want to protect the implementation of their services, and check if there are mechanisms to help on that. I think isolation level 3 is applicable to this scenario.

/Ken

From: TF-M tf-m-bounces@lists.trustedfirmware.org On Behalf Of Tamas Ban via TF-M Sent: Wednesday, October 21, 2020 7:26 PM To: tf-m@lists.trustedfirmware.org Cc: nd nd@arm.com Subject: Re: [TF-M] Feature branch 'feature-isolation-level3' is created for related patches merging

Hi Andrej,

the following scenario comes to my mind:

* There is a product where secure services from different vendors are merged together and these are together make up the ARoT code. * There is a vendor who has a novel algorithm what he wants to protect against reverse engineering. * Image is delivered to the device in encrypted format. But on the device it is decrypted when moved to primary slot. * This secure partition needs the L3 isolation to be hidden from the other secure services within ARoT code.

Tamas

From: TF-M <tf-m-bounces@lists.trustedfirmware.orgmailto:tf-m-bounces@lists.trustedfirmware.org> On Behalf Of Andrej Butok via TF-M Sent: 2020. október 21., szerda 11:53 To: Kevin Peng <Kevin.Peng@arm.commailto:Kevin.Peng@arm.com> Cc: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org Subject: Re: [TF-M] Feature branch 'feature-isolation-level3' is created for related patches merging

Hi Kevin,

Do you know any real (not academic) MCU application where L3 isolation is required? People ask, but I have nothing to tell. Even for L2 is difficult to find something, for most of cases L1 is enough.

Thanks, Andrej

From: TF-M <tf-m-bounces@lists.trustedfirmware.orgmailto:tf-m-bounces@lists.trustedfirmware.org> On Behalf Of Kevin Peng via TF-M Sent: Wednesday, October 21, 2020 11:27 AM To: 'tf-m@lists.trustedfirmware.org' <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Subject: Re: [TF-M] Feature branch 'feature-isolation-level3' is created for related patches merging

Hi all,

We've finished the PoC of isolation level 3 along with the new TFM HAL on the feature branch. And now we are migrating the patches to master branch by cherry-picking, squashing and refining.

Here are the several topics ongoing parallel:

* Linker script changes for isolation L3https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Freview.trustedfirmware.org%2Fq%2Ftopic%3A%2522linker_script_isolation%2522%2B(status%3Aopen%2520OR%2520status%3Amerged)&data=04%7C01%7Candrey.butok%40nxp.com%7Ca3c988dfa7324118930008d875a37d8a%7C686ea1d3bc2b4c6fa92cd99c5c301635%7C0%7C0%7C637388692332718935%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=YiE6KYmbE4lNDHwWazsk76xiPk97Fe6chuBSdgWms%2Bs%3D&reserved=0 * Isolation HAL APIhttps://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Freview.trustedfirmware.org%2Fq%2Ftopic%3A%2522isolation_api_implementation%2522%2B(status%3Aopen%2520OR%2520status%3Amerged)&data=04%7C01%7Candrey.butok%40nxp.com%7Ca3c988dfa7324118930008d875a37d8a%7C686ea1d3bc2b4c6fa92cd99c5c301635%7C0%7C0%7C637388692332718935%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=VlNWDFlK9Q2ZqJP4HyQnwaB0yksjcfeJJ4c%2FBTaI69I%3D&reserved=0 * SPM loghttps://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Freview.trustedfirmware.org%2Fq%2Ftopic%3A%2522SPM_LOG%2522%2B(status%3Aopen%2520OR%2520status%3Amerged)&data=04%7C01%7Candrey.butok%40nxp.com%7Ca3c988dfa7324118930008d875a37d8a%7C686ea1d3bc2b4c6fa92cd99c5c301635%7C0%7C0%7C637388692332728923%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=HpOkAcFGvsWuIUNQnhstgSIJPvkWS8TuCF%2BWwFCkrow%3D&reserved=0 * SP loghttps://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Freview.trustedfirmware.org%2Fq%2Ftopic%3A%2522tfm_sp_log%2522%2B(status%3Aopen%2520OR%2520status%3Amerged)&data=04%7C01%7Candrey.butok%40nxp.com%7Ca3c988dfa7324118930008d875a37d8a%7C686ea1d3bc2b4c6fa92cd99c5c301635%7C0%7C0%7C637388692332728923%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AlEvGfS%2FV1H66SeL4mliMRHDxLD%2FSDFkrTRQdOxpMQ4%3D&reserved=0

And the HAL API docs:

* Docs: Design of the TF-M isolation HALhttps://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Freview.trustedfirmware.org%2Fc%2FTF-M%2Ftrusted-firmware-m%2F%2B%2F4829&data=04%7C01%7Candrey.butok%40nxp.com%7Ca3c988dfa7324118930008d875a37d8a%7C686ea1d3bc2b4c6fa92cd99c5c301635%7C0%7C0%7C637388692332738919%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=40edypPvyDK8b62XJB3UGHii8iS9%2FfI3uoUJJm3J4So%3D&reserved=0

More patches will be coming soon, will keep you update-to-date. Please help on reviews, thanks.

Best Regards, Kevin

From: TF-M <tf-m-bounces@lists.trustedfirmware.orgmailto:tf-m-bounces@lists.trustedfirmware.org> On Behalf Of Ken Liu via TF-M Sent: Wednesday, September 9, 2020 3:21 PM To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org Cc: nd <nd@arm.commailto:nd@arm.com> Subject: [TF-M] Feature branch 'feature-isolation-level3' is created for related patches merging

Hi,

A new branch created for two repos 'TF-M/tf-m-tests' and 'TF-M/trusted-firmware-m', this feature branch is for isolation related patches merging. The POC patches would come in following days, first platform would be AN521. If you want to try this branch, please:

IMPORTANT: Checkout 'feature-isoaltion-level3' branch for both 'TF-M/tf-m-tests' and 'TF-M/trusted-firmware-m'.

BR

/Ken