Hi Bartlomiej,
(Sorry for confusing your names)
This may not work if your use case introduces another new SP, depending on the existing one.
Priority LOWEST is reserved for idle partitions and therefore only priority LOW is available in your use case. Perhaps you can increase the priority of Crypto/ITS/PS to leave more priority levels to your SPs, but I’m not sure if this is
fully tested before.
Best regards,
David
From: Nicola Mazzucato <Nicola.Mazzucato@arm.com>
Sent: Tuesday, June 3, 2025 8:35 AM
To: Florek, Bartlomiej <bartlomiej.florek@assaabloy.com>; David Hu <David.Hu2@arm.com>; Antonio De Angelis <Antonio.DeAngelis@arm.com>; tf-m@lists.trustedfirmware.org; nd <nd@arm.com>
Subject: Re: [EXT] Re: Order of starting Secure Partitions
Hi Bartlomiej,
Glad to hear.
The sorting of partitions within SPM follows the same grouping order, therefore those with higher priority will be run first when multiple ones are ready to run.
Yes, we encourage to use LTS whenever possible, since they contain bugfixes. If you are on 2.1.0 I suspect it should not be too painful to update to 2.1.2.
And we always welcome contributions :)
Thanks
Best regards
Nicola
From: Florek, Bartlomiej <bartlomiej.florek@assaabloy.com>
Sent: 03 June 2025 07:57
To: Nicola Mazzucato <Nicola.Mazzucato@arm.com>; David Hu <David.Hu2@arm.com>; Antonio De Angelis <Antonio.DeAngelis@arm.com>;
tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.org>; nd <nd@arm.com>
Subject: Re: [EXT] Re: Order of starting Secure Partitions
Hi,
Setting priority to LOW pushed me forward. Thanks a lot for the hints!
Will be other consequences of doing so?
I cannot use CONFIG_TFM_POST_PARTITION_INIT_HOOK in my environment as I'm currently on version 2.1.0 of TF-M. It might be reconsidered to update, but LTS version is preferred.
Best regards,
Bartlomiej
From: Nicola Mazzucato <Nicola.Mazzucato@arm.com>
Sent: Tuesday, June 3, 2025 8:49 AM
To: David Hu <David.Hu2@arm.com>; Florek, Bartlomiej <bartlomiej.florek@assaabloy.com>; Antonio De Angelis <Antonio.DeAngelis@arm.com>;
tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.org>; nd <nd@arm.com>
Subject: Re: [EXT] Re: Order of starting Secure Partitions
|
You don't often get email from
nicola.mazzucato@arm.com. Learn why this is important |
Hi Bartlomiej,
As David correctly pointed out, the order for partitions initialisation is grouped by priority, see "priority" field in the corresponding manifest file.
If you wish to explore the init hook, please search for the CONFIG_TFM_POST_PARTITION_INIT_HOOK which will enable the framework to call the hook.
Hope that helps,
Thanks
Nicola
From: David Hu <David.Hu2@arm.com>
Sent: 02 June 2025 22:42
To: Florek, Bartlomiej <bartlomiej.florek@assaabloy.com>; Antonio De Angelis <Antonio.DeAngelis@arm.com>;
tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.org>; Nicola Mazzucato <Nicola.Mazzucato@arm.com>;
nd <nd@arm.com>
Cc: nd <nd@arm.com>
Subject: RE: [EXT] Re: Order of starting Secure Partitions
Hi Florek,
The `dependencies` in manifest is used by TF-M SPM to check the access permissions. For example, when your new SP asks for a secure service from Crypto SP, TF-M SPM will check if your SP explicitly sets Crypto SP as its dependency. Otherwise, TF-M SPM will
reject the secure request from your SP.
The load sequence of SPs in TF-M, however, is a bit vague. The ordering is usually decided by the priority of SPs.
The higher a SP’s priority is, the earlier it is scheduled/initialized. Meanwhile, IIUC, the ordering of SPs in the same priority is not specified.
Crypto SP’s priority is set to NORMAL by default.
Please can you try to set your SP priority to LOW in its manifest?
"priority": "LOW",
Best regards,
David
From: Florek, Bartlomiej via TF-M <tf-m@lists.trustedfirmware.org>
Sent: Monday, June 2, 2025 1:06 PM
To: Antonio De Angelis <Antonio.DeAngelis@arm.com>;
tf-m@lists.trustedfirmware.org; Nicola Mazzucato <Nicola.Mazzucato@arm.com>; nd <nd@arm.com>
Subject: [TF-M] Re: [EXT] Re: Order of starting Secure Partitions
Hi,
Thank you for your fast answers. You have correctly understood the sequence.
I haven't used tfm_hal_post_partition_init_hook. I will look for it. Can you point me in the right direction?
I already have dependencies in manifest on TFM_CRYPTO, but it doesn't change order.
"dependencies": [
"TFM_CRYPTO"
]
I injected config file expanding
CRYPTO_ENGINE_BUF_SIZE, but I feel error I got is misleading, because crypto partition was not initialized.
set_property(TARGET zephyr_property_target
APPEND PROPERTY TFM_CMAKE_OPTIONS
-DPROJECT_CONFIG_HEADER_FILE=${CMAKE_CURRENT_SOURCE_DIR}/new_sp/config/config_tfm.h
)
Some logs with injected data:
[DBG][NEW] Starting new secure partition
[INF][NEW] version v1.18.0-dirty
[DBG][mbedcrypto] 2:0
[DBG][mbedcrypto] 1:0
[DBG][mbedcrypto] 3:-141
[DBG][NEW] Something went wrong: 9 : CRYPTO_FAILURE
Creating an empty ITS flash layout.
Creating an empty PS flash layout.
[INF][PS] Encryption alg: 0x5500200
[INF][Crypto] Provision entropy seed...
[INF][Crypto] Provision entropy seed... complete.
[DBG][Crypto] Init Mbed TLS 3.6.0...
[DBG][Crypto] Init Mbed TLS 3.6.0... complete.
[DBG][mbedcrypto] 2:0
[DBG][mbedcrypto] 1:0
[DBG][mbedcrypto] 3:0
[DBG][mbedcrypto] 4:0
I'm using PSA hash multi-part operation: psa_hash_setup, psa_hash_update, psa_hash_finish.
It is true that my partition requires crypto for proper initialization. That is why I'm looking for getting correct sequence or asynchronous approach.
Best regards,
Bartlomiej
From: Antonio De Angelis <Antonio.DeAngelis@arm.com>
Sent: Monday, June 2, 2025 1:47 PM
To: tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.org>;
Florek, Bartlomiej <bartlomiej.florek@assaabloy.com>; Nicola Mazzucato
<Nicola.Mazzucato@arm.com>; nd <nd@arm.com>
Subject: [EXT] Re: Order of starting Secure Partitions
|
You don't often get email from
antonio.deangelis@arm.com.
Learn why this is important |
CAUTION: This email is external. Do not click links or attachments that are unexpected or from unknown senders. If unsure,
click the Report Phishing Button in Outlook.
Hi,
The partitions would have to have a list of dependencies, so if your partition requires something from the Crypto one, the Crypto must in the list of deps of your partition and it will be initialised first.
Having said that, I believe the PSA_ERROR_INSUFFICIENT_MEMORY is being returned at some point by the API as Mbed TLS underneath might try to allocate some memory on the static allocator. The allocator is a buffer
that is statically allocated in the TF-M Crypto partition and you can control its size by changing CRYPTO_ENGINE_BUF_SIZE at build time, the default is in:
❯ cat config_engine_buf.h
/*
* Copyright (c) 2023, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*
*/
#ifndef __CONFIG_ENGINE_BUF_H__
#define __CONFIG_ENGINE_BUF_H__
/*
* CRYPTO_ENGINE_BUF_SIZE is decided by multiple components configs.
* CRYPTO_ENGINE_BUF_SIZE can be overridden below by other component configs.
* It must be guaranteed that this header file is included at last before CRYPTO_ENGINE_BUF_SIZE
* is referred in crypto_library.c.
* Otherwise, crypto_library.c may include an incorrect definition value.
*/
/* The CC312 needs at least 0x4000 of heap size to work properly */
#if defined(CRYPTO_HW_ACCELERATOR_CC312) && (CRYPTO_ENGINE_BUF_SIZE < 0x4000)
#pragma message("CRYPTO_ENGINE_BUF_SIZE is redefined to 0x4000.")
#undef CRYPTO_ENGINE_BUF_SIZE
#define CRYPTO_ENGINE_BUF_SIZE 0x4000
#endif
#endif /* __CONFIG_ENGINE_BUF_H__ */
Different TF-M profiles might override this size with smaller (or bigger) sizes.
Hope this helps.
Thanks,
Antonio
From: Nicola Mazzucato via TF-M <tf-m@lists.trustedfirmware.org>
Sent: Monday, June 02, 2025 12:07
To: tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.org>;
Florek, Bartlomiej <bartlomiej.florek@assaabloy.com>
Subject: [TF-M] Re: Order of starting Secure Partitions
Hi Bartlomiej,
I am not sure I understood exactly the sequence you need to perform in your case, but have you perhaps tried to use the
"tfm_hal_post_partition_init_hook"?
In principle, you need to have the runtime initialization fully completed before you can require a secure service operation.
Does your new partition need some crypto operations to initialize itself correctly? Which crypto api have you used exactly?
Best regards,
Nicola
From: Florek, Bartlomiej via TF-M <tf-m@lists.trustedfirmware.org>
Sent: 02 June 2025 11:48
To: tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.org>
Subject: [TF-M] Order of starting Secure Partitions
Hello,
I'm trying to fit a new Secure Partition into Trusted Firmware - M environment. The current working environment consists of Zephyr RTOS 3.7 + TF-M 2.1.0 running under QEMU on MPS2 AN521 platform. General skeleton
is in place - manifest with dependencies on TFM_CRYPTO, interface, IPC and handling communication.
However, I have problems with using the PSA Crypto from the aforementioned new Service. I need a hash function, so I thought I'd use PSA Crypto API. The problem is that either the hash function or the initialization
function (psa_crypto_init) is returning error (PSA_ERROR_INSUFFICIENT_MEMORY). I discovered that logs show PSA Crypto partition is loading after mine.
This problem occurs in the entry_point function.
Is it possible to change the order of partitions loading or is there different mechanism advised to synchronize partition loading?
Thank you in advance for your suggestions.
Best regards,
Bartlomiej