PSA Bring Your Own Service #10447

alzix · 2019-04-21T13:34:52Z

Description

Add support for application developers to specify their custom PSA secure partitions.
Custom PSA Secure partition sources expected to be placed under COMPONENT_SPE directory as shown below:

.
├── actuator_control
│   ├── COMPONENT_SPE
│   │   └── control_partition.cpp        <-- secure partition files
│   └── control_manifest_psa.json        <-- PSA manifest
├── mbed-os/
├── mbed-os.lib
└── src
    ├── actuator.c                       <-- library APIs 
    ├── actuator.h
    └── main.cpp                         <-- nonsecure main

Note: When building an application secure images with custom secure partitions use mbed-cli instead of tools/psa/release.py.
Do not forget to add --app-config <mbed-os-root>/tools/psa/tfm/mbed_app.json for TF-M based platforms (e.g. LPC55S69_S)

Targets 5.12.3 patch release. There is a customer waiting for it.

Tested with following compilations:

mbed test --compile -m CY8CKIT_062_WIFI_BT_M0_PSA -t GCC_ARM -n tests-psa-spm_smoke -DUSE_PSA_TEST_PARTITIONS -DUSE_SMOKE_TESTS_PART1
mbed test --compile -m CY8CKIT_062_WIFI_BT_PSA -t GCC_ARM -n tests-psa-spm_smoke -DUSE_PSA_TEST_PARTITIONS -DUSE_SMOKE_TESTS_PART1
mbed compile -m CY8CKIT_062_WIFI_BT_M0_PSA -t GCC_ARM --library
mbed compile -m CY8CKIT_062_WIFI_BT_PSA -t GCC_ARM --library
mbed export -m CY8CKIT_062_WIFI_BT_M0_PSA -i make_gcc_arm
mbed export -m CY8CKIT_062_WIFI_BT_PSA -i make_gcc_arm

mbed test --compile -m K64F -t GCC_ARM -n tests-mbed_hal-rtc
mbed compile -m K64F -t GCC_ARM --library
mbed export -m K64F -i make_gcc_arm


mbed test --compile -m LPC55S69_S -t ARM -n tests-psa-spm_smoke -DUSE_PSA_TEST_PARTITIONS -DUSE_SMOKE_TESTS_PART1 --app-config tools/psa/tfm/mbed_app.json
mbed test --compile -m LPC55S69_NS -t ARM -n tests-psa-spm_smoke -DUSE_PSA_TEST_PARTITIONS -DUSE_SMOKE_TESTS_PART1

mbed compile -m LPC55S69_S -t ARM --app-config mbed-os/tools/psa/tfm/mbed_app.json
mbed export -m LPC55S69_S --app-config mbed-os/tools/psa/tfm/mbed_app.json -i make_armc6

mbed compile -m LPC55S69_NS -t ARM --library
mbed compile -m LPC55S69_NS -t ARM

Pull request type

[ ] Fix
[ ] Refactor
[ ] Target update
[x] Functionality change
[ ] Docs update
[ ] Test update
[ ] Breaking change

Reviewers

@theotherjimmy @bridadan @ndevillard

Release Notes

alzix · 2019-04-21T14:53:27Z

fixed astyle

ciarmcom · 2019-04-21T15:00:24Z

@alzix, thank you for your changes.
@bridadan @theotherjimmy @ndevillard @ARMmbed/mbed-os-tools @ARMmbed/mbed-os-maintainers please review.

adbridge · 2019-04-23T09:59:54Z

CI started

mbed-ci · 2019-04-23T10:48:43Z

Test run: FAILED

Summary: 3 of 7 test jobs failed
Build number : 1
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_build-ARM
jenkins-ci/mbed-os-ci_build-GCC_ARM
jenkins-ci/mbed-os-ci_build-IAR

adbridge · 2019-04-24T09:04:11Z

CI restarted

mbed-ci · 2019-04-24T10:00:54Z

Test run: FAILED

Summary: 3 of 7 test jobs failed
Build number : 2
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_build-ARM
jenkins-ci/mbed-os-ci_build-GCC_ARM
jenkins-ci/mbed-os-ci_build-IAR

adbridge · 2019-04-24T10:05:07Z

CI restarted

mbed-ci · 2019-04-24T10:54:50Z

Test run: FAILED

Summary: 1 of 7 test jobs failed
Build number : 3
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_build-ARM

bulislaw

@bridadan please review

tools/psa/mbed_spm_tfm_common.py

tools/psa/__init__.py

tools/build_api.py

bridadan

The last thing I would ask for before this comes in is documentation. I understand that all of the generation steps are necessary for this feature, however this is atypical for the rest of the targets. I'm worried that future work on the tools will break the generation step unintentionally.

I think having a document inside the tools/psa folder or the docs folder would be fine. Just something that describes the extra scanning and generation steps.

alzix · 2019-04-28T14:37:00Z

Updated commit message to align with the final version of the changes

alzix · 2019-04-28T17:37:20Z

@bridadan,

The last thing I would ask for before this comes in is documentation. I understand that all of the generation steps are necessary for this feature, however this is atypical for the rest of the targets. I'm worried that future work on the tools will break the generation step unintentionally.

I think having a document inside the tools/psa folder or the docs folder would be fine. Just something that describes the extra scanning and generation steps.

Done in b69e67d

bridadan

Thanks for the docs!

Btw, @theotherjimmy is unavailable for the next week or so.

alzix · 2019-04-29T15:46:44Z

Btw, @theotherjimmy is unavailable for the next week or so.

so lets merge this PR before he returns :)

0xc0170

Please provide details to "Update PSA code generator" - the largest commit missing details what this update brings - this one is the functional changes - what is it changing and why? (some details are shared above)

Unify TF-M and Mbed-SPM code generators: - Unify SPM initialization logic: - All partitions are registered at once - Test partitions are guarded by #ifndef - Introduce single template list - Beatify template files and add "Autogen-do not modify" notice Prepare for integration with mbed-os build system: - Generate all the files in a single place Simplify tools/psa/release.py script

PSA code generation will be called automatically upon mbed invocation. The autogenerated files will be created under <mbed-os-root>/PSA_AUTOGEN directory.

alzix · 2019-04-30T11:59:05Z

@0xc0170,

Please provide details to "Update PSA code generator" - the largest commit missing details what this update brings - this one is the functional changes - what is it changing and why? (some details are shared above)

Done

0xc0170 · 2019-04-30T12:56:40Z

CI restarted

mbed-ci · 2019-04-30T15:45:19Z

Test run: FAILED

Summary: 1 of 7 test jobs failed
Build number : 4
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_mbed2-build-GCC_ARM

orenc17 · 2019-05-01T13:38:06Z

@ARMmbed/mbed-os-maintainers can someone run the mbed2-build-GCC_ARM again?

adbridge · 2019-05-01T16:13:07Z

@orenc17 the ci seems to think GCC_ARM actually passed so not sure why it is reporting a failure. I've questioned this with the ci guys

adbridge · 2019-05-01T16:17:07Z

OK have restarted GCC_ARM, actually looks like it timed out trying to propagate the results :(

mbed-ci · 2019-05-01T19:07:01Z

Test run: SUCCESS

Summary: 11 of 11 test jobs passed
Build number : 5
Build artifacts

orenc17 approved these changes Apr 21, 2019

View reviewed changes

ciarmcom requested review from bridadan, ndevillard, theotherjimmy and a team April 21, 2019 15:00

ciarmcom added the needs: review label Apr 21, 2019

adbridge added the release-version: 5.12.3 label Apr 24, 2019

bulislaw approved these changes Apr 24, 2019

View reviewed changes

bridadan reviewed Apr 24, 2019

View reviewed changes

tools/psa/mbed_spm_tfm_common.py Show resolved Hide resolved

tools/psa/__init__.py Show resolved Hide resolved

tools/build_api.py Show resolved Hide resolved

bridadan reviewed Apr 25, 2019

View reviewed changes

adbridge added component: connectivity needs: work and removed needs: review component: connectivity labels Apr 25, 2019

bridadan approved these changes Apr 29, 2019

View reviewed changes

0xc0170 added needs: review and removed needs: work labels Apr 30, 2019

0xc0170 requested changes Apr 30, 2019

View reviewed changes

alzix added 2 commits April 30, 2019 14:10

Delete autogenerated files

ab01bea

0xc0170 added needs: work and removed needs: review labels Apr 30, 2019

alzix and others added 3 commits April 30, 2019 14:41

Update PSA includes to autogenerated files

117e3e8

Integrate with mbeb-cli build system

9150518

PSA code generation will be called automatically upon mbed invocation. The autogenerated files will be created under <mbed-os-root>/PSA_AUTOGEN directory.

Update PSA tools Readme

fe9eac7

0xc0170 removed the needs: work label Apr 30, 2019

0xc0170 approved these changes Apr 30, 2019

View reviewed changes

adbridge added the needs: CI label May 1, 2019

0xc0170 added ready for merge and removed needs: CI labels May 2, 2019

0xc0170 merged commit 00f461e into ARMmbed:master May 2, 2019

0xc0170 removed the ready for merge label May 2, 2019

adbridge added Manually Patch release-version: 5.12.3 and removed release-version: 5.12.3 Manually Patch labels May 3, 2019

adbridge added release-version: 5.12.3 and removed Manually Patch labels May 17, 2019

PSA Bring Your Own Service #10447

PSA Bring Your Own Service #10447

Uh oh!

Conversation

alzix commented Apr 21, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Pull request type

Reviewers

Release Notes

Uh oh!

alzix commented Apr 21, 2019

Uh oh!

ciarmcom commented Apr 21, 2019

Uh oh!

adbridge commented Apr 23, 2019

Uh oh!

mbed-ci commented Apr 23, 2019

Test run: FAILED

Uh oh!

adbridge commented Apr 24, 2019

Uh oh!

mbed-ci commented Apr 24, 2019

Test run: FAILED

Uh oh!

adbridge commented Apr 24, 2019

Uh oh!

mbed-ci commented Apr 24, 2019

Test run: FAILED

Uh oh!

bulislaw left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bridadan left a comment

Choose a reason for hiding this comment

Uh oh!

alzix commented Apr 28, 2019

Uh oh!

alzix commented Apr 28, 2019

Uh oh!

bridadan left a comment

Choose a reason for hiding this comment

Uh oh!

alzix commented Apr 29, 2019

Uh oh!

0xc0170 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alzix commented Apr 30, 2019

Uh oh!

0xc0170 commented Apr 30, 2019

Uh oh!

mbed-ci commented Apr 30, 2019

Test run: FAILED

Uh oh!

orenc17 commented May 1, 2019

Uh oh!

adbridge commented May 1, 2019

Uh oh!

adbridge commented May 1, 2019

Uh oh!

mbed-ci commented May 1, 2019

Test run: SUCCESS

Uh oh!

Uh oh!

alzix commented Apr 21, 2019 •

edited

Loading

0xc0170 left a comment •

edited

Loading