Skip to content

Commit ed157a7

Browse files
nandojvenandojve
committed
boards: st: nucleo_u5a5zj_q: Import TF-M code
Add the TF-M S image code dedicated to the board, which uses an Out-Of-Tree approach. This can be used as example to customers interested in this technology and don't have an initial idea how to do it. This will avoid that customers will try the easy script copy over TF-M folder patch. Signed-off-by: BUDKE Gerson Fernando <[email protected]>
1 parent 736edf8 commit ed157a7

23 files changed

+2062
-0
lines changed

‎boards/st/nucleo_u5a5zj_q/tfm/CMakeLists.txt‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
#-------------------------------------------------------------------------------
2+
# Copyright (c) 2020, Arm Limited. All rights reserved.
3+
#
4+
# SPDX-License-Identifier: BSD-3-Clause
5+
#
6+
#-------------------------------------------------------------------------------
7+
8+
set(NUCLEO_U5A5ZJ_Q_DIR ${CMAKE_CURRENT_LIST_DIR})
9+
set(STM_COMMON_DIR ${PLATFORM_DIR}/ext/target/stm/common)
10+
11+
include(${STM_COMMON_DIR}/stm32u5xx/CMakeLists.txt)
12+
13+
#========================= Platform defs ===============================#
14+
15+
# Specify the location of platform specific build dependencies.
16+
target_sources(tfm_s
17+
PRIVATE
18+
${STM_COMMON_DIR}/stm32u5xx/Device/Source/startup_stm32u5xx_s.c
19+
)
20+
21+
# cpuarch.cmake is used to set things that related to the platform that are both
22+
install(FILES
23+
${TARGET_PLATFORM_PATH}/cpuarch.cmake
24+
DESTINATION ${INSTALL_PLATFORM_NS_DIR}
25+
)
26+
27+
install(FILES
28+
${STM_COMMON_DIR}/stm32u5xx/Device/Source/startup_stm32u5xx_ns.c
29+
DESTINATION ${INSTALL_PLATFORM_NS_DIR}/Device/Source
30+
)
31+
32+
install(DIRECTORY
33+
${TARGET_PLATFORM_PATH}/ns/
34+
DESTINATION ${INSTALL_PLATFORM_NS_DIR}
35+
)
36+
37+
install(DIRECTORY
38+
${TARGET_PLATFORM_PATH}/include
39+
DESTINATION ${INSTALL_PLATFORM_NS_DIR}
40+
)
41+
42+
install(FILES
43+
${TARGET_PLATFORM_PATH}/accelerator/crypto_accelerator_config.h
44+
DESTINATION ${INSTALL_PLATFORM_NS_DIR}/include
45+
)
46+
47+
install(DIRECTORY
48+
${STM_COMMON_DIR}/hal/accelerator/
49+
DESTINATION ${INSTALL_PLATFORM_NS_DIR}/include
50+
FILES_MATCHING PATTERN "*.h"
51+
)
52+
53+
install(FILES
54+
${NUCLEO_U5A5ZJ_Q_DIR}/partition/flash_layout.h
55+
${NUCLEO_U5A5ZJ_Q_DIR}/partition/region_defs.h
56+
DESTINATION ${INSTALL_PLATFORM_NS_DIR}/partition
57+
)
58+
59+
if(BL2)
60+
target_sources(bl2
61+
PRIVATE
62+
${STM_COMMON_DIR}/stm32u5xx/Device/Source/startup_stm32u5xx_bl2.c
63+
${STM_COMMON_DIR}/hal/provision/nvm_init.c
64+
${STM_COMMON_DIR}/hal/provision/nvmcnt_init.c
65+
${NUCLEO_U5A5ZJ_Q_DIR}/keys/otp_provision.c
66+
)
67+
endif()
68+
#install flash layout for postbuild.sh
69+
install(FILES
70+
${NUCLEO_U5A5ZJ_Q_DIR}/partition/flash_layout.h
71+
${NUCLEO_U5A5ZJ_Q_DIR}/partition/region_defs.h
72+
DESTINATION ${CMAKE_INSTALL_PREFIX}
73+
)
74+
set (BL2_FILE_TO_PREPROCESS ${CMAKE_CURRENT_BINARY_DIR}/image_macros_to_preprocess_bl2.c)
75+
file(WRITE ${BL2_FILE_TO_PREPROCESS} ${BL2_PREPROCESSING})
76+
77+
install(FILES
78+
${BL2_FILE_TO_PREPROCESS}
79+
DESTINATION ${CMAKE_INSTALL_PREFIX}
80+
)

‎boards/st/nucleo_u5a5zj_q/tfm/accelerator/CMakeLists.txt‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
#-------------------------------------------------------------------------------
2+
# Copyright (c) 2020-2024, Arm Limited. All rights reserved.
3+
# Copyright (c) 2021 STMicroelectronics. All rights reserved.
4+
#
5+
# SPDX-License-Identifier: BSD-3-Clause
6+
#
7+
#-------------------------------------------------------------------------------
8+
9+
############################ Crypto Service ####################################
10+
11+
if (TFM_PARTITION_CRYPTO)
12+
target_sources(crypto_service_crypto_hw
13+
PRIVATE
14+
${PLATFORM_DIR}/ext/target/stm/common/hal/accelerator/rsa_alt.c
15+
${PLATFORM_DIR}/ext/target/stm/common/hal/accelerator/ecdsa_alt.c
16+
${PLATFORM_DIR}/ext/target/stm/common/hal/accelerator/gcm_alt.c
17+
${PLATFORM_DIR}/ext/target/stm/common/hal/accelerator/aes_alt.c
18+
${PLATFORM_DIR}/ext/target/stm/common/hal/accelerator/ccm_alt.c
19+
${PLATFORM_DIR}/ext/target/stm/common/hal/accelerator/ecp_alt.c
20+
${PLATFORM_DIR}/ext/target/stm/common/hal/accelerator/ecp_curves_alt.c
21+
${PLATFORM_DIR}/ext/target/stm/common/hal/accelerator/sha1_alt.c
22+
${PLATFORM_DIR}/ext/target/stm/common/hal/accelerator/sha256_alt.c
23+
${PLATFORM_DIR}/ext/target/stm/common/hal/accelerator/stm.c
24+
)
25+
26+
target_include_directories(crypto_service_crypto_hw
27+
PRIVATE
28+
${PLATFORM_DIR}/ext/target/${TFM_PLATFORM}/accelerator/
29+
${PLATFORM_DIR}/ext/target/stm/common/hal/accelerator/
30+
${PLATFORM_DIR}/ext/target/${TFM_PLATFORM}/include/
31+
${PLATFORM_DIR}/ext/target/stm/common/stm32u5xx/hal/Inc/
32+
${PLATFORM_DIR}/ext/target/stm/common/stm32u5xx/Device/Include/
33+
${PLATFORM_DIR}/include
34+
${CMAKE_BINARY_DIR}/generated
35+
${CMAKE_SOURCE_DIR}/interface/include
36+
)
37+
target_include_directories(crypto_service_mbedcrypto
38+
PUBLIC
39+
${PLATFORM_DIR}/ext/target/${TFM_PLATFORM}/accelerator/
40+
${PLATFORM_DIR}/ext/target/stm/common/hal/accelerator/
41+
${PLATFORM_DIR}/ext/target/${TFM_PLATFORM}/include/
42+
${PLATFORM_DIR}/ext/target/stm/common/stm32u5xx/hal/Inc/
43+
${PLATFORM_DIR}/ext/target/stm/common/stm32u5xx/Device/Include/
44+
)
45+
46+
target_include_directories(psa_crypto_config
47+
INTERFACE
48+
$<BUILD_INTERFACE:${PLATFORM_DIR}/ext/target/${TFM_PLATFORM}/accelerator/>
49+
)
50+
51+
target_compile_definitions(crypto_service_crypto_hw
52+
PRIVATE
53+
ST_HW_CONTEXT_SAVING
54+
$<$<AND:$<BOOL:${TFM_PARTITION_PROTECTED_STORAGE}>,$<STREQUAL:${PS_CRYPTO_AEAD_ALG},PSA_ALG_GCM>>:BUILD_CRYPTO_TFM>
55+
INTERFACE
56+
$<$<AND:$<BOOL:${TFM_PARTITION_PROTECTED_STORAGE}>,$<STREQUAL:${PS_CRYPTO_AEAD_ALG},PSA_ALG_GCM>>:PSA_WANT_ALG_GCM>
57+
)
58+
59+
target_link_libraries(crypto_service_crypto_hw
60+
PRIVATE
61+
crypto_service_mbedcrypto
62+
platform_s
63+
cmsis
64+
)
65+
66+
target_link_libraries(crypto_service_mbedcrypto
67+
PUBLIC
68+
cmsis
69+
)
70+
71+
target_link_libraries(platform_s
72+
PRIVATE
73+
crypto_service_crypto_hw
74+
)
75+
target_link_libraries(crypto_service_crypto_hw
76+
INTERFACE
77+
tfm_config
78+
)
79+
endif()

‎boards/st/nucleo_u5a5zj_q/tfm/accelerator/crypto_accelerator_config.h‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
/*
2+
* Copyright (c) 2019-2022, Arm Limited. All rights reserved.
3+
* Copyright (c) 2021 STMicroelectronics. All rights reserved.
4+
*
5+
* SPDX-License-Identifier: BSD-3-Clause
6+
*
7+
*/
8+
9+
#ifndef CRYPTO_ACCELERATOR_CONF_H
10+
#define CRYPTO_ACCELERATOR_CONF_H
11+
12+
#ifdef __cplusplus
13+
extern "C" {
14+
#endif /* __cplusplus */
15+
16+
/****************************************************************/
17+
/* Require built-in implementations based on PSA requirements */
18+
/****************************************************************/
19+
#ifdef PSA_USE_SE_ST
20+
/* secure element define */
21+
#define PSA_WANT_KEY_TYPE_AES
22+
#ifdef MBEDTLS_PSA_CRYPTO_C
23+
#define MBEDTLS_PSA_CRYPTO_SE_C
24+
#define MBEDTLS_CMAC_C
25+
#define MBEDTLS_CIPHER_MODE_CBC
26+
#endif
27+
28+
#ifdef PSA_WANT_ALG_SHA_1
29+
#define MBEDTLS_SHA1_ALT
30+
#endif /* PSA_WANT_ALG_SHA_1 */
31+
32+
#ifdef PSA_WANT_ALG_SHA_256
33+
#define MBEDTLS_SHA256_ALT
34+
#endif /* PSA_WANT_ALG_SHA_256 */
35+
36+
#if defined(PSA_WANT_ALG_RSA_OAEP) || \
37+
defined(PSA_WANT_ALG_RSA_PKCS1V15_CRYPT) || \
38+
defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) || \
39+
defined(PSA_WANT_ALG_RSA_PSS) || \
40+
defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) || \
41+
defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY)
42+
#define MBEDTLS_RSA_ALT
43+
#endif
44+
45+
#if defined(PSA_WANT_ALG_ECDH) || \
46+
defined(PSA_WANT_ALG_ECDSA) || \
47+
defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) || \
48+
defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
49+
#define MBEDTLS_ECP_ALT
50+
#undef MBEDTLS_ECP_NIST_OPTIM
51+
#endif
52+
53+
#ifdef PSA_WANT_ALG_CCM
54+
#define MBEDTLS_CCM_ALT
55+
#endif /* PSA_WANT_ALG_CCM */
56+
57+
#ifdef PSA_WANT_KEY_TYPE_AES
58+
#define MBEDTLS_AES_ALT
59+
#endif /* PSA_WANT_KEY_TYPE_AES */
60+
61+
#ifdef PSA_WANT_ALG_GCM
62+
#define MBEDTLS_GCM_ALT
63+
#endif /* PSA_WANT_ALG_GCM */
64+
65+
#if defined(PSA_WANT_ALG_ECDSA) || \
66+
defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA)
67+
#define MBEDTLS_ECDSA_VERIFY_ALT
68+
#define MBEDTLS_ECDSA_SIGN_ALT
69+
#endif
70+
71+
#endif
72+
73+
#ifdef __cplusplus
74+
}
75+
#endif /* __cplusplus */
76+
77+
#endif /* CRYPTO_ACCELERATOR_CONF_H */

‎boards/st/nucleo_u5a5zj_q/tfm/accelerator/mbedtls_accelerator_config.h‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
/*
2+
* Copyright (c) 2019-2022, Arm Limited. All rights reserved.
3+
* Copyright (c) 2021 STMicroelectronics. All rights reserved.
4+
*
5+
* SPDX-License-Identifier: BSD-3-Clause
6+
*
7+
*/
8+
9+
#ifndef MBEDTLS_ACCELERATOR_CONF_H
10+
#define MBEDTLS_ACCELERATOR_CONF_H
11+
12+
#ifdef __cplusplus
13+
extern "C" {
14+
#endif /* __cplusplus */
15+
16+
/* RNG Config */
17+
#undef MBEDTLS_ENTROPY_NV_SEED
18+
#undef MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
19+
#define MBEDTLS_ENTROPY_C
20+
#define MBEDTLS_ENTROPY_HARDWARE_ALT
21+
22+
#undef MBEDTLS_AES_SETKEY_DEC_ALT
23+
#undef MBEDTLS_AES_DECRYPT_ALT
24+
25+
/* specific Define for platform hardware accelerator */
26+
#define GENERATOR_HW_PKA_EXTENDED_API
27+
#define GENERATOR_HW_CRYPTO_DPA_SUPPORTED
28+
#define HW_CRYPTO_DPA_AES
29+
#define HW_CRYPTO_DPA_GCM
30+
31+
/****************************************************************/
32+
/* Infer PSA requirements from Mbed TLS capabilities */
33+
/****************************************************************/
34+
#ifndef MBEDTLS_PSA_CRYPTO_CONFIG
35+
36+
#ifdef MBEDTLS_SHA1_C
37+
#define MBEDTLS_SHA1_ALT
38+
#endif /* MBEDTLS_SHA1_C */
39+
40+
#ifdef MBEDTLS_SHA256_C
41+
#define MBEDTLS_SHA256_ALT
42+
#endif /* MBEDTLS_SHA256_C */
43+
44+
#ifdef MBEDTLS_RSA_C
45+
#define MBEDTLS_RSA_ALT
46+
#endif /* MBEDTLS_RSA_C */
47+
48+
#if defined(MBEDTLS_ECP_C)
49+
#define MBEDTLS_ECP_ALT
50+
#undef MBEDTLS_ECP_NIST_OPTIM
51+
/*#define MBEDTLS_MD5_ALT*/
52+
#endif /* MBEDTLS_ECP_C && MBEDTLS_MD_C */
53+
54+
#ifdef MBEDTLS_CCM_C
55+
#define MBEDTLS_CCM_ALT
56+
#endif /* MBEDTLS_CCM_C */
57+
58+
#ifdef MBEDTLS_AES_C
59+
#define MBEDTLS_AES_ALT
60+
#endif /* MBEDTLS_AES_C */
61+
62+
#ifdef MBEDTLS_GCM_C
63+
#define MBEDTLS_GCM_ALT
64+
#endif /* MBEDTLS_GCM_C */
65+
66+
#ifdef MBEDTLS_ECDSA_C
67+
#define MBEDTLS_ECDSA_VERIFY_ALT
68+
#define MBEDTLS_ECDSA_SIGN_ALT
69+
#endif /* MBEDTLS_ECDSA_C */
70+
71+
/* secure element define */
72+
#ifdef MBEDTLS_PSA_CRYPTO_C
73+
#ifdef PSA_USE_SE_ST
74+
#define MBEDTLS_PSA_CRYPTO_SE_C
75+
#define MBEDTLS_CMAC_C
76+
#define MBEDTLS_CIPHER_MODE_CBC
77+
#endif
78+
#endif
79+
80+
#endif /* MBEDTLS_PSA_CRYPTO_CONFIG */
81+
82+
#ifdef __cplusplus
83+
}
84+
#endif /* __cplusplus */
85+
86+
#endif /* MBEDTLS_ACCELERATOR_CONF_H */

‎boards/st/nucleo_u5a5zj_q/tfm/config.cmake‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#-------------------------------------------------------------------------------
2+
# Copyright (c) 2020-2023, Arm Limited. All rights reserved.
3+
# Copyright (c) 2021 STMicroelectronics. All rights reserved.
4+
# Copyright (c) 2022 Cypress Semiconductor Corporation (an Infineon company)
5+
# or an affiliate of Cypress Semiconductor Corporation. All rights reserved.
6+
#
7+
# SPDX-License-Identifier: BSD-3-Clause
8+
#
9+
#-------------------------------------------------------------------------------
10+
11+
################################## BL2 #########################################################################################################
12+
set(MCUBOOT_IMAGE_NUMBER 2 CACHE STRING "Whether to combine S and NS into either 1 image, or sign each separately")
13+
set(BL2_TRAILER_SIZE 0x9000 CACHE STRING "Trailer size")
14+
set(MCUBOOT_ALIGN_VAL 16 CACHE STRING "Align option to build image with imgtool")
15+
set(MCUBOOT_UPGRADE_STRATEGY "SWAP_USING_SCRATCH" CACHE STRING "Upgrade strategy for images")
16+
set(TFM_PARTITION_PLATFORM ON CACHE BOOL "Enable platform partition")
17+
set(MCUBOOT_CONFIRM_IMAGE ON CACHE BOOL "Whether to confirm the image if REVERT is supported in MCUboot")
18+
set(MCUBOOT_BOOTSTRAP ON CACHE BOOL "Allow initial state with images in secondary slots(empty primary slots)")
19+
set(MCUBOOT_ENC_IMAGES ON CACHE BOOL "Enable encrypted image upgrade support")
20+
set(MCUBOOT_ENCRYPT_RSA ON CACHE BOOL "Use RSA for encrypted image upgrade support")
21+
set(MCUBOOT_DATA_SHARING ON CACHE BOOL "Enable Data Sharing")
22+
cmake_path(NORMAL_PATH MCUBOOT_KEY_S)
23+
cmake_path(NORMAL_PATH MCUBOOT_KEY_NS)
24+
cmake_path(GET MCUBOOT_KEY_S PARENT_PATH MCUBOOT_KEY_PATH)
25+
set(MCUBOOT_KEY_ENC "${MCUBOOT_KEY_PATH}/rsa-2048-public-bl2.pem" CACHE FILEPATH "Path to key with which to encrypt binary")
26+
27+
################################## Dependencies ################################################################################################
28+
set(TFM_PARTITION_INTERNAL_TRUSTED_STORAGE ON CACHE BOOL "Enable Internal Trusted Storage partition")
29+
set(TFM_PARTITION_CRYPTO ON CACHE BOOL "Enable Crypto partition")
30+
set(CRYPTO_HW_ACCELERATOR ON CACHE BOOL "Whether to enable the crypto hardware accelerator on supported platforms")
31+
set(MBEDCRYPTO_BUILD_TYPE minsizerel CACHE STRING "Build type of Mbed Crypto library")
32+
set(TFM_DUMMY_PROVISIONING OFF CACHE BOOL "Provision with dummy values. NOT to be used in production")
33+
set(PLATFORM_DEFAULT_OTP_WRITEABLE OFF CACHE BOOL "Use on chip flash with write support")
34+
set(PLATFORM_DEFAULT_NV_COUNTERS OFF CACHE BOOL "Use default nv counter implementation.")
35+
set(PS_CRYPTO_AEAD_ALG PSA_ALG_GCM CACHE STRING "The AEAD algorithm to use for authenticated encryption in Protected Storage")
36+
set(MCUBOOT_FIH_PROFILE LOW CACHE STRING "Fault injection hardening profile [OFF, LOW, MEDIUM, HIGH]")
37+
38+
################################## Platform-specific configurations ############################################################################
39+
set(CONFIG_TFM_USE_TRUSTZONE ON CACHE BOOL "Use TrustZone")
40+
set(TFM_MULTI_CORE_TOPOLOGY OFF CACHE BOOL "Platform has multi core")
41+
set(PLATFORM_HAS_FIRMWARE_UPDATE_SUPPORT ON CACHE BOOL "Whether the platform has firmware update support")
42+
set(STSAFEA OFF CACHE BOOL "Activate ST SAFE SUPPORT")
43+
44+
################################## FIRMWARE_UPDATE #############################################################################################
45+
set(TFM_PARTITION_FIRMWARE_UPDATE ON CACHE BOOL "Enable firmware update partition")
46+
set(MCUBOOT_HW_ROLLBACK_PROT ON CACHE BOOL "Security counter validation against non-volatile HW counters")
47+
set(TFM_FWU_BOOTLOADER_LIB "mcuboot" CACHE STRING "Bootloader configure file for Firmware Update partition")
48+
set(TFM_CONFIG_FWU_MAX_WRITE_SIZE 8192 CACHE STRING "The maximum permitted size for block in psa_fwu_write, in bytes.")
49+
set(TFM_CONFIG_FWU_MAX_MANIFEST_SIZE 0 CACHE STRING "The maximum permitted size for manifest in psa_fwu_start(), in bytes.")
50+
set(FWU_DEVICE_CONFIG_FILE "" CACHE STRING "The device configuration file for Firmware Update partition")
51+
set(FWU_SUPPORT_TRIAL_STATE ON CACHE BOOL "Device support TRIAL component state.")
52+
set(DMCUBOOT_UPGRADE_STRATEGY SWAP_USING_MOVE)
53+
set(DEFAULT_MCUBOOT_FLASH_MAP ON CACHE BOOL "Whether to use the default flash map defined by TF-M project")

0 commit comments

Comments
 (0)