Re: [TF-M] Feature branch 'feature-isolation-level3' is created for related patches merging
Hi,
Thank Tamas for the scenario, this is a good example.
There were some queries and initial investigations before, which shows that some users want to protect the implementation of their services, and check if there are mechanisms to help on that. I think isolation level 3 is applicable to this scenario.
/Ken
From: TF-M tf-m-bounces@lists.trustedfirmware.org On Behalf Of Tamas Ban via TF-M Sent: Wednesday, October 21, 2020 7:26 PM To: tf-m@lists.trustedfirmware.org Cc: nd nd@arm.com Subject: Re: [TF-M] Feature branch 'feature-isolation-level3' is created for related patches merging
Hi Andrej,
the following scenario comes to my mind:
* There is a product where secure services from different vendors are merged together and these are together make up the ARoT code. * There is a vendor who has a novel algorithm what he wants to protect against reverse engineering. * Image is delivered to the device in encrypted format. But on the device it is decrypted when moved to primary slot. * This secure partition needs the L3 isolation to be hidden from the other secure services within ARoT code.
Tamas
From: TF-M <tf-m-bounces@lists.trustedfirmware.orgmailto:tf-m-bounces@lists.trustedfirmware.org> On Behalf Of Andrej Butok via TF-M Sent: 2020. október 21., szerda 11:53 To: Kevin Peng <Kevin.Peng@arm.commailto:Kevin.Peng@arm.com> Cc: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org Subject: Re: [TF-M] Feature branch 'feature-isolation-level3' is created for related patches merging
Hi Kevin,
Do you know any real (not academic) MCU application where L3 isolation is required? People ask, but I have nothing to tell. Even for L2 is difficult to find something, for most of cases L1 is enough.
Thanks, Andrej
From: TF-M <tf-m-bounces@lists.trustedfirmware.orgmailto:tf-m-bounces@lists.trustedfirmware.org> On Behalf Of Kevin Peng via TF-M Sent: Wednesday, October 21, 2020 11:27 AM To: 'tf-m@lists.trustedfirmware.org' <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Subject: Re: [TF-M] Feature branch 'feature-isolation-level3' is created for related patches merging
Hi all,
We've finished the PoC of isolation level 3 along with the new TFM HAL on the feature branch. And now we are migrating the patches to master branch by cherry-picking, squashing and refining.
Here are the several topics ongoing parallel:
* Linker script changes for isolation L3https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Freview.trustedfirmware.org%2Fq%2Ftopic%3A%2522linker_script_isolation%2522%2B(status%3Aopen%2520OR%2520status%3Amerged)&data=04%7C01%7Candrey.butok%40nxp.com%7Ca3c988dfa7324118930008d875a37d8a%7C686ea1d3bc2b4c6fa92cd99c5c301635%7C0%7C0%7C637388692332718935%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=YiE6KYmbE4lNDHwWazsk76xiPk97Fe6chuBSdgWms%2Bs%3D&reserved=0 * Isolation HAL APIhttps://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Freview.trustedfirmware.org%2Fq%2Ftopic%3A%2522isolation_api_implementation%2522%2B(status%3Aopen%2520OR%2520status%3Amerged)&data=04%7C01%7Candrey.butok%40nxp.com%7Ca3c988dfa7324118930008d875a37d8a%7C686ea1d3bc2b4c6fa92cd99c5c301635%7C0%7C0%7C637388692332718935%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=VlNWDFlK9Q2ZqJP4HyQnwaB0yksjcfeJJ4c%2FBTaI69I%3D&reserved=0 * SPM loghttps://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Freview.trustedfirmware.org%2Fq%2Ftopic%3A%2522SPM_LOG%2522%2B(status%3Aopen%2520OR%2520status%3Amerged)&data=04%7C01%7Candrey.butok%40nxp.com%7Ca3c988dfa7324118930008d875a37d8a%7C686ea1d3bc2b4c6fa92cd99c5c301635%7C0%7C0%7C637388692332728923%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=HpOkAcFGvsWuIUNQnhstgSIJPvkWS8TuCF%2BWwFCkrow%3D&reserved=0 * SP loghttps://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Freview.trustedfirmware.org%2Fq%2Ftopic%3A%2522tfm_sp_log%2522%2B(status%3Aopen%2520OR%2520status%3Amerged)&data=04%7C01%7Candrey.butok%40nxp.com%7Ca3c988dfa7324118930008d875a37d8a%7C686ea1d3bc2b4c6fa92cd99c5c301635%7C0%7C0%7C637388692332728923%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AlEvGfS%2FV1H66SeL4mliMRHDxLD%2FSDFkrTRQdOxpMQ4%3D&reserved=0
And the HAL API docs:
More patches will be coming soon, will keep you update-to-date. Please help on reviews, thanks.
Best Regards, Kevin
From: TF-M <tf-m-bounces@lists.trustedfirmware.orgmailto:tf-m-bounces@lists.trustedfirmware.org> On Behalf Of Ken Liu via TF-M Sent: Wednesday, September 9, 2020 3:21 PM To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org Cc: nd <nd@arm.commailto:nd@arm.com> Subject: [TF-M] Feature branch 'feature-isolation-level3' is created for related patches merging
Hi,
A new branch created for two repos 'TF-M/tf-m-tests' and 'TF-M/trusted-firmware-m', this feature branch is for isolation related patches merging. The POC patches would come in following days, first platform would be AN521. If you want to try this branch, please:
IMPORTANT: Checkout 'feature-isoaltion-level3' branch for both 'TF-M/tf-m-tests' and 'TF-M/trusted-firmware-m'.
BR
/Ken
tf-m@lists.trustedfirmware.org
-
Ken Liu