Hello,
I'm trying to fit a new Secure Partition into Trusted Firmware - M environment. The current working environment consists of Zephyr RTOS 3.7 + TF-M 2.1.0 running under QEMU on MPS2 AN521 platform. General skeleton is in place - manifest with dependencies on TFM_CRYPTO, interface, IPC and handling communication. However, I have problems with using the PSA Crypto from the aforementioned new Service. I need a hash function, so I thought I'd use PSA Crypto API. The problem is that either the hash function or the initialization function (psa_crypto_init) is returning error (PSA_ERROR_INSUFFICIENT_MEMORY). I discovered that logs show PSA Crypto partition is loading after mine. This problem occurs in the entry_point function.
Is it possible to change the order of partitions loading or is there different mechanism advised to synchronize partition loading?
Thank you in advance for your suggestions.
Best regards,
Bartlomiej
Hi Bartlomiej,
I am not sure I understood exactly the sequence you need to perform in your case, but have you perhaps tried to use the "tfm_hal_post_partition_init_hook"? In principle, you need to have the runtime initialization fully completed before you can require a secure service operation. Does your new partition need some crypto operations to initialize itself correctly? Which crypto api have you used exactly?
Best regards, Nicola
________________________________ From: Florek, Bartlomiej via TF-M tf-m@lists.trustedfirmware.org Sent: 02 June 2025 11:48 To: tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org Subject: [TF-M] Order of starting Secure Partitions
Hello,
I'm trying to fit a new Secure Partition into Trusted Firmware - M environment. The current working environment consists of Zephyr RTOS 3.7 + TF-M 2.1.0 running under QEMU on MPS2 AN521 platform. General skeleton is in place - manifest with dependencies on TFM_CRYPTO, interface, IPC and handling communication. However, I have problems with using the PSA Crypto from the aforementioned new Service. I need a hash function, so I thought I'd use PSA Crypto API. The problem is that either the hash function or the initialization function (psa_crypto_init) is returning error (PSA_ERROR_INSUFFICIENT_MEMORY). I discovered that logs show PSA Crypto partition is loading after mine. This problem occurs in the entry_point function.
Is it possible to change the order of partitions loading or is there different mechanism advised to synchronize partition loading?
Thank you in advance for your suggestions.
Best regards,
Bartlomiej
Hi,
The partitions would have to have a list of dependencies, so if your partition requires something from the Crypto one, the Crypto must in the list of deps of your partition and it will be initialised first.
Having said that, I believe the PSA_ERROR_INSUFFICIENT_MEMORY is being returned at some point by the API as Mbed TLS underneath might try to allocate some memory on the static allocator. The allocator is a buffer that is statically allocated in the TF-M Crypto partition and you can control its size by changing CRYPTO_ENGINE_BUF_SIZE at build time, the default is in:
❯ cat config_engine_buf.h /* * Copyright (c) 2023, Arm Limited. All rights reserved. * * SPDX-License-Identifier: BSD-3-Clause * */
#ifndef __CONFIG_ENGINE_BUF_H__ #define __CONFIG_ENGINE_BUF_H__
/* * CRYPTO_ENGINE_BUF_SIZE is decided by multiple components configs. * CRYPTO_ENGINE_BUF_SIZE can be overridden below by other component configs. * It must be guaranteed that this header file is included at last before CRYPTO_ENGINE_BUF_SIZE * is referred in crypto_library.c. * Otherwise, crypto_library.c may include an incorrect definition value. */
/* The CC312 needs at least 0x4000 of heap size to work properly */ #if defined(CRYPTO_HW_ACCELERATOR_CC312) && (CRYPTO_ENGINE_BUF_SIZE < 0x4000) #pragma message("CRYPTO_ENGINE_BUF_SIZE is redefined to 0x4000.") #undef CRYPTO_ENGINE_BUF_SIZE #define CRYPTO_ENGINE_BUF_SIZE 0x4000 #endif
#endif /* __CONFIG_ENGINE_BUF_H__ */
Different TF-M profiles might override this size with smaller (or bigger) sizes.
Hope this helps.
Thanks, Antonio
________________________________ From: Nicola Mazzucato via TF-M tf-m@lists.trustedfirmware.org Sent: Monday, June 02, 2025 12:07 To: tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org; Florek, Bartlomiej bartlomiej.florek@assaabloy.com Subject: [TF-M] Re: Order of starting Secure Partitions
Hi Bartlomiej,
I am not sure I understood exactly the sequence you need to perform in your case, but have you perhaps tried to use the "tfm_hal_post_partition_init_hook"? In principle, you need to have the runtime initialization fully completed before you can require a secure service operation. Does your new partition need some crypto operations to initialize itself correctly? Which crypto api have you used exactly?
Best regards, Nicola
________________________________ From: Florek, Bartlomiej via TF-M tf-m@lists.trustedfirmware.org Sent: 02 June 2025 11:48 To: tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org Subject: [TF-M] Order of starting Secure Partitions
Hello,
I'm trying to fit a new Secure Partition into Trusted Firmware - M environment. The current working environment consists of Zephyr RTOS 3.7 + TF-M 2.1.0 running under QEMU on MPS2 AN521 platform. General skeleton is in place - manifest with dependencies on TFM_CRYPTO, interface, IPC and handling communication. However, I have problems with using the PSA Crypto from the aforementioned new Service. I need a hash function, so I thought I'd use PSA Crypto API. The problem is that either the hash function or the initialization function (psa_crypto_init) is returning error (PSA_ERROR_INSUFFICIENT_MEMORY). I discovered that logs show PSA Crypto partition is loading after mine. This problem occurs in the entry_point function.
Is it possible to change the order of partitions loading or is there different mechanism advised to synchronize partition loading?
Thank you in advance for your suggestions.
Best regards,
Bartlomiej
Hi,
Thank you for your fast answers. You have correctly understood the sequence. I haven't used tfm_hal_post_partition_init_hook. I will look for it. Can you point me in the right direction?
I already have dependencies in manifest on TFM_CRYPTO, but it doesn't change order. "dependencies": [ "TFM_CRYPTO" ]
I injected config file expanding CRYPTO_ENGINE_BUF_SIZE, but I feel error I got is misleading, because crypto partition was not initialized. set_property(TARGET zephyr_property_target APPEND PROPERTY TFM_CMAKE_OPTIONS -DPROJECT_CONFIG_HEADER_FILE=${CMAKE_CURRENT_SOURCE_DIR}/new_sp/config/config_tfm.h )
Some logs with injected data: [DBG][NEW] Starting new secure partition
[INF][NEW] version v1.18.0-dirty [DBG][mbedcrypto] 2:0 [DBG][mbedcrypto] 1:0 [DBG][mbedcrypto] 3:-141 [DBG][NEW] Something went wrong: 9 : CRYPTO_FAILURE Creating an empty ITS flash layout. Creating an empty PS flash layout. [INF][PS] Encryption alg: 0x5500200 [INF][Crypto] Provision entropy seed... [INF][Crypto] Provision entropy seed... complete. [DBG][Crypto] Init Mbed TLS 3.6.0... [DBG][Crypto] Init Mbed TLS 3.6.0... complete. [DBG][mbedcrypto] 2:0 [DBG][mbedcrypto] 1:0 [DBG][mbedcrypto] 3:0 [DBG][mbedcrypto] 4:0
I'm using PSA hash multi-part operation: psa_hash_setup, psa_hash_update, psa_hash_finish. It is true that my partition requires crypto for proper initialization. That is why I'm looking for getting correct sequence or asynchronous approach.
Best regards, Bartlomiej
________________________________ From: Antonio De Angelis Antonio.DeAngelis@arm.com Sent: Monday, June 2, 2025 1:47 PM To: tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org; Florek, Bartlomiej bartlomiej.florek@assaabloy.com; Nicola Mazzucato Nicola.Mazzucato@arm.com; nd nd@arm.com Subject: [EXT] Re: Order of starting Secure Partitions
You don't often get email from antonio.deangelis@arm.com. Learn why this is importanthttps://aka.ms/LearnAboutSenderIdentification CAUTION: This email is external. Do not click links or attachments that are unexpected or from unknown senders. If unsure, click the Report Phishing Button in Outlook. Hi,
The partitions would have to have a list of dependencies, so if your partition requires something from the Crypto one, the Crypto must in the list of deps of your partition and it will be initialised first.
Having said that, I believe the PSA_ERROR_INSUFFICIENT_MEMORY is being returned at some point by the API as Mbed TLS underneath might try to allocate some memory on the static allocator. The allocator is a buffer that is statically allocated in the TF-M Crypto partition and you can control its size by changing CRYPTO_ENGINE_BUF_SIZE at build time, the default is in:
❯ cat config_engine_buf.h /* * Copyright (c) 2023, Arm Limited. All rights reserved. * * SPDX-License-Identifier: BSD-3-Clause * */
#ifndef __CONFIG_ENGINE_BUF_H__ #define __CONFIG_ENGINE_BUF_H__
/* * CRYPTO_ENGINE_BUF_SIZE is decided by multiple components configs. * CRYPTO_ENGINE_BUF_SIZE can be overridden below by other component configs. * It must be guaranteed that this header file is included at last before CRYPTO_ENGINE_BUF_SIZE * is referred in crypto_library.c. * Otherwise, crypto_library.c may include an incorrect definition value. */
/* The CC312 needs at least 0x4000 of heap size to work properly */ #if defined(CRYPTO_HW_ACCELERATOR_CC312) && (CRYPTO_ENGINE_BUF_SIZE < 0x4000) #pragma message("CRYPTO_ENGINE_BUF_SIZE is redefined to 0x4000.") #undef CRYPTO_ENGINE_BUF_SIZE #define CRYPTO_ENGINE_BUF_SIZE 0x4000 #endif
#endif /* __CONFIG_ENGINE_BUF_H__ */
Different TF-M profiles might override this size with smaller (or bigger) sizes.
Hope this helps.
Thanks, Antonio
________________________________ From: Nicola Mazzucato via TF-M tf-m@lists.trustedfirmware.org Sent: Monday, June 02, 2025 12:07 To: tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org; Florek, Bartlomiej bartlomiej.florek@assaabloy.com Subject: [TF-M] Re: Order of starting Secure Partitions
Hi Bartlomiej,
I am not sure I understood exactly the sequence you need to perform in your case, but have you perhaps tried to use the "tfm_hal_post_partition_init_hook"? In principle, you need to have the runtime initialization fully completed before you can require a secure service operation. Does your new partition need some crypto operations to initialize itself correctly? Which crypto api have you used exactly?
Best regards, Nicola
________________________________ From: Florek, Bartlomiej via TF-M tf-m@lists.trustedfirmware.org Sent: 02 June 2025 11:48 To: tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org Subject: [TF-M] Order of starting Secure Partitions
Hello,
I'm trying to fit a new Secure Partition into Trusted Firmware - M environment. The current working environment consists of Zephyr RTOS 3.7 + TF-M 2.1.0 running under QEMU on MPS2 AN521 platform. General skeleton is in place - manifest with dependencies on TFM_CRYPTO, interface, IPC and handling communication. However, I have problems with using the PSA Crypto from the aforementioned new Service. I need a hash function, so I thought I'd use PSA Crypto API. The problem is that either the hash function or the initialization function (psa_crypto_init) is returning error (PSA_ERROR_INSUFFICIENT_MEMORY). I discovered that logs show PSA Crypto partition is loading after mine. This problem occurs in the entry_point function.
Is it possible to change the order of partitions loading or is there different mechanism advised to synchronize partition loading?
Thank you in advance for your suggestions.
Best regards,
Bartlomiej
Hi Florek,
The `dependencies` in manifest is used by TF-M SPM to check the access permissions. For example, when your new SP asks for a secure service from Crypto SP, TF-M SPM will check if your SP explicitly sets Crypto SP as its dependency. Otherwise, TF-M SPM will reject the secure request from your SP.
The load sequence of SPs in TF-M, however, is a bit vague. The ordering is usually decided by the priority of SPs. The higher a SP’s priority is, the earlier it is scheduled/initialized. Meanwhile, IIUC, the ordering of SPs in the same priority is not specified. Crypto SP’s priority is set to NORMAL by default. Please can you try to set your SP priority to LOW in its manifest? "priority": "LOW",
Best regards, David
From: Florek, Bartlomiej via TF-M tf-m@lists.trustedfirmware.org Sent: Monday, June 2, 2025 1:06 PM To: Antonio De Angelis Antonio.DeAngelis@arm.com; tf-m@lists.trustedfirmware.org; Nicola Mazzucato Nicola.Mazzucato@arm.com; nd nd@arm.com Subject: [TF-M] Re: [EXT] Re: Order of starting Secure Partitions
Hi,
Thank you for your fast answers. You have correctly understood the sequence. I haven't used tfm_hal_post_partition_init_hook. I will look for it. Can you point me in the right direction?
I already have dependencies in manifest on TFM_CRYPTO, but it doesn't change order. "dependencies": [ "TFM_CRYPTO" ]
I injected config file expanding CRYPTO_ENGINE_BUF_SIZE, but I feel error I got is misleading, because crypto partition was not initialized. set_property(TARGET zephyr_property_target APPEND PROPERTY TFM_CMAKE_OPTIONS -DPROJECT_CONFIG_HEADER_FILE=${CMAKE_CURRENT_SOURCE_DIR}/new_sp/config/config_tfm.h )
Some logs with injected data: [DBG][NEW] Starting new secure partition
[INF][NEW] version v1.18.0-dirty [DBG][mbedcrypto] 2:0 [DBG][mbedcrypto] 1:0 [DBG][mbedcrypto] 3:-141 [DBG][NEW] Something went wrong: 9 : CRYPTO_FAILURE Creating an empty ITS flash layout. Creating an empty PS flash layout. [INF][PS] Encryption alg: 0x5500200 [INF][Crypto] Provision entropy seed... [INF][Crypto] Provision entropy seed... complete. [DBG][Crypto] Init Mbed TLS 3.6.0... [DBG][Crypto] Init Mbed TLS 3.6.0... complete. [DBG][mbedcrypto] 2:0 [DBG][mbedcrypto] 1:0 [DBG][mbedcrypto] 3:0 [DBG][mbedcrypto] 4:0
I'm using PSA hash multi-part operation: psa_hash_setup, psa_hash_update, psa_hash_finish. It is true that my partition requires crypto for proper initialization. That is why I'm looking for getting correct sequence or asynchronous approach.
Best regards, Bartlomiej
________________________________ From: Antonio De Angelis <Antonio.DeAngelis@arm.commailto:Antonio.DeAngelis@arm.com> Sent: Monday, June 2, 2025 1:47 PM To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com>; Nicola Mazzucato <Nicola.Mazzucato@arm.commailto:Nicola.Mazzucato@arm.com>; nd <nd@arm.commailto:nd@arm.com> Subject: [EXT] Re: Order of starting Secure Partitions
You don't often get email from antonio.deangelis@arm.commailto:antonio.deangelis@arm.com. Learn why this is importanthttps://aka.ms/LearnAboutSenderIdentification CAUTION: This email is external. Do not click links or attachments that are unexpected or from unknown senders. If unsure, click the Report Phishing Button in Outlook. Hi,
The partitions would have to have a list of dependencies, so if your partition requires something from the Crypto one, the Crypto must in the list of deps of your partition and it will be initialised first.
Having said that, I believe the PSA_ERROR_INSUFFICIENT_MEMORY is being returned at some point by the API as Mbed TLS underneath might try to allocate some memory on the static allocator. The allocator is a buffer that is statically allocated in the TF-M Crypto partition and you can control its size by changing CRYPTO_ENGINE_BUF_SIZE at build time, the default is in:
❯ cat config_engine_buf.h /* * Copyright (c) 2023, Arm Limited. All rights reserved. * * SPDX-License-Identifier: BSD-3-Clause * */
#ifndef __CONFIG_ENGINE_BUF_H__ #define __CONFIG_ENGINE_BUF_H__
/* * CRYPTO_ENGINE_BUF_SIZE is decided by multiple components configs. * CRYPTO_ENGINE_BUF_SIZE can be overridden below by other component configs. * It must be guaranteed that this header file is included at last before CRYPTO_ENGINE_BUF_SIZE * is referred in crypto_library.c. * Otherwise, crypto_library.c may include an incorrect definition value. */
/* The CC312 needs at least 0x4000 of heap size to work properly */ #if defined(CRYPTO_HW_ACCELERATOR_CC312) && (CRYPTO_ENGINE_BUF_SIZE < 0x4000) #pragma message("CRYPTO_ENGINE_BUF_SIZE is redefined to 0x4000.") #undef CRYPTO_ENGINE_BUF_SIZE #define CRYPTO_ENGINE_BUF_SIZE 0x4000 #endif
#endif /* __CONFIG_ENGINE_BUF_H__ */
Different TF-M profiles might override this size with smaller (or bigger) sizes.
Hope this helps.
Thanks, Antonio
________________________________ From: Nicola Mazzucato via TF-M <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Sent: Monday, June 02, 2025 12:07 To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com> Subject: [TF-M] Re: Order of starting Secure Partitions
Hi Bartlomiej,
I am not sure I understood exactly the sequence you need to perform in your case, but have you perhaps tried to use the "tfm_hal_post_partition_init_hook"? In principle, you need to have the runtime initialization fully completed before you can require a secure service operation. Does your new partition need some crypto operations to initialize itself correctly? Which crypto api have you used exactly?
Best regards, Nicola
________________________________ From: Florek, Bartlomiej via TF-M <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Sent: 02 June 2025 11:48 To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Subject: [TF-M] Order of starting Secure Partitions
Hello,
I'm trying to fit a new Secure Partition into Trusted Firmware - M environment. The current working environment consists of Zephyr RTOS 3.7 + TF-M 2.1.0 running under QEMU on MPS2 AN521 platform. General skeleton is in place - manifest with dependencies on TFM_CRYPTO, interface, IPC and handling communication. However, I have problems with using the PSA Crypto from the aforementioned new Service. I need a hash function, so I thought I'd use PSA Crypto API. The problem is that either the hash function or the initialization function (psa_crypto_init) is returning error (PSA_ERROR_INSUFFICIENT_MEMORY). I discovered that logs show PSA Crypto partition is loading after mine. This problem occurs in the entry_point function.
Is it possible to change the order of partitions loading or is there different mechanism advised to synchronize partition loading?
Thank you in advance for your suggestions.
Best regards,
Bartlomiej
Hi Bartlomiej,
As David correctly pointed out, the order for partitions initialisation is grouped by priority, see "priority" field in the corresponding manifest file. If you wish to explore the init hook, please search for the CONFIG_TFM_POST_PARTITION_INIT_HOOK which will enable the framework to call the hook.
Hope that helps, Thanks Nicola
________________________________ From: David Hu David.Hu2@arm.com Sent: 02 June 2025 22:42 To: Florek, Bartlomiej bartlomiej.florek@assaabloy.com; Antonio De Angelis Antonio.DeAngelis@arm.com; tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org; Nicola Mazzucato Nicola.Mazzucato@arm.com; nd nd@arm.com Cc: nd nd@arm.com Subject: RE: [EXT] Re: Order of starting Secure Partitions
Hi Florek,
The `dependencies` in manifest is used by TF-M SPM to check the access permissions. For example, when your new SP asks for a secure service from Crypto SP, TF-M SPM will check if your SP explicitly sets Crypto SP as its dependency. Otherwise, TF-M SPM will reject the secure request from your SP.
The load sequence of SPs in TF-M, however, is a bit vague. The ordering is usually decided by the priority of SPs.
The higher a SP’s priority is, the earlier it is scheduled/initialized. Meanwhile, IIUC, the ordering of SPs in the same priority is not specified.
Crypto SP’s priority is set to NORMAL by default.
Please can you try to set your SP priority to LOW in its manifest? "priority": "LOW",
Best regards,
David
From: Florek, Bartlomiej via TF-M tf-m@lists.trustedfirmware.org Sent: Monday, June 2, 2025 1:06 PM To: Antonio De Angelis Antonio.DeAngelis@arm.com; tf-m@lists.trustedfirmware.org; Nicola Mazzucato Nicola.Mazzucato@arm.com; nd nd@arm.com Subject: [TF-M] Re: [EXT] Re: Order of starting Secure Partitions
Hi,
Thank you for your fast answers. You have correctly understood the sequence.
I haven't used tfm_hal_post_partition_init_hook. I will look for it. Can you point me in the right direction?
I already have dependencies in manifest on TFM_CRYPTO, but it doesn't change order.
"dependencies": [
"TFM_CRYPTO"
]
I injected config file expanding CRYPTO_ENGINE_BUF_SIZE, but I feel error I got is misleading, because crypto partition was not initialized.
set_property(TARGET zephyr_property_target
APPEND PROPERTY TFM_CMAKE_OPTIONS
-DPROJECT_CONFIG_HEADER_FILE=${CMAKE_CURRENT_SOURCE_DIR}/new_sp/config/config_tfm.h
)
Some logs with injected data:
[DBG][NEW] Starting new secure partition
[INF][NEW] version v1.18.0-dirty
[DBG][mbedcrypto] 2:0
[DBG][mbedcrypto] 1:0
[DBG][mbedcrypto] 3:-141
[DBG][NEW] Something went wrong: 9 : CRYPTO_FAILURE
Creating an empty ITS flash layout.
Creating an empty PS flash layout.
[INF][PS] Encryption alg: 0x5500200
[INF][Crypto] Provision entropy seed...
[INF][Crypto] Provision entropy seed... complete.
[DBG][Crypto] Init Mbed TLS 3.6.0...
[DBG][Crypto] Init Mbed TLS 3.6.0... complete.
[DBG][mbedcrypto] 2:0
[DBG][mbedcrypto] 1:0
[DBG][mbedcrypto] 3:0
[DBG][mbedcrypto] 4:0
I'm using PSA hash multi-part operation: psa_hash_setup, psa_hash_update, psa_hash_finish.
It is true that my partition requires crypto for proper initialization. That is why I'm looking for getting correct sequence or asynchronous approach.
Best regards,
Bartlomiej
________________________________
From: Antonio De Angelis <Antonio.DeAngelis@arm.commailto:Antonio.DeAngelis@arm.com> Sent: Monday, June 2, 2025 1:47 PM To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com>; Nicola Mazzucato <Nicola.Mazzucato@arm.commailto:Nicola.Mazzucato@arm.com>; nd <nd@arm.commailto:nd@arm.com> Subject: [EXT] Re: Order of starting Secure Partitions
You don't often get email from antonio.deangelis@arm.commailto:antonio.deangelis@arm.com. Learn why this is importanthttps://aka.ms/LearnAboutSenderIdentification
CAUTION: This email is external. Do not click links or attachments that are unexpected or from unknown senders. If unsure, click the Report Phishing Button in Outlook.
Hi,
The partitions would have to have a list of dependencies, so if your partition requires something from the Crypto one, the Crypto must in the list of deps of your partition and it will be initialised first.
Having said that, I believe the PSA_ERROR_INSUFFICIENT_MEMORY is being returned at some point by the API as Mbed TLS underneath might try to allocate some memory on the static allocator. The allocator is a buffer that is statically allocated in the TF-M Crypto partition and you can control its size by changing CRYPTO_ENGINE_BUF_SIZE at build time, the default is in:
❯ cat config_engine_buf.h
/*
* Copyright (c) 2023, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*
*/
#ifndef __CONFIG_ENGINE_BUF_H__
#define __CONFIG_ENGINE_BUF_H__
/*
* CRYPTO_ENGINE_BUF_SIZE is decided by multiple components configs.
* CRYPTO_ENGINE_BUF_SIZE can be overridden below by other component configs.
* It must be guaranteed that this header file is included at last before CRYPTO_ENGINE_BUF_SIZE
* is referred in crypto_library.c.
* Otherwise, crypto_library.c may include an incorrect definition value.
*/
/* The CC312 needs at least 0x4000 of heap size to work properly */
#if defined(CRYPTO_HW_ACCELERATOR_CC312) && (CRYPTO_ENGINE_BUF_SIZE < 0x4000)
#pragma message("CRYPTO_ENGINE_BUF_SIZE is redefined to 0x4000.")
#undef CRYPTO_ENGINE_BUF_SIZE
#define CRYPTO_ENGINE_BUF_SIZE 0x4000
#endif
#endif /* __CONFIG_ENGINE_BUF_H__ */
Different TF-M profiles might override this size with smaller (or bigger) sizes.
Hope this helps.
Thanks,
Antonio
________________________________
From: Nicola Mazzucato via TF-M <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Sent: Monday, June 02, 2025 12:07 To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com> Subject: [TF-M] Re: Order of starting Secure Partitions
Hi Bartlomiej,
I am not sure I understood exactly the sequence you need to perform in your case, but have you perhaps tried to use the
"tfm_hal_post_partition_init_hook"?
In principle, you need to have the runtime initialization fully completed before you can require a secure service operation.
Does your new partition need some crypto operations to initialize itself correctly? Which crypto api have you used exactly?
Best regards,
Nicola
________________________________
From: Florek, Bartlomiej via TF-M <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Sent: 02 June 2025 11:48 To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Subject: [TF-M] Order of starting Secure Partitions
Hello,
I'm trying to fit a new Secure Partition into Trusted Firmware - M environment. The current working environment consists of Zephyr RTOS 3.7 + TF-M 2.1.0 running under QEMU on MPS2 AN521 platform. General skeleton is in place - manifest with dependencies on TFM_CRYPTO, interface, IPC and handling communication.
However, I have problems with using the PSA Crypto from the aforementioned new Service. I need a hash function, so I thought I'd use PSA Crypto API. The problem is that either the hash function or the initialization function (psa_crypto_init) is returning error (PSA_ERROR_INSUFFICIENT_MEMORY). I discovered that logs show PSA Crypto partition is loading after mine.
This problem occurs in the entry_point function.
Is it possible to change the order of partitions loading or is there different mechanism advised to synchronize partition loading?
Thank you in advance for your suggestions.
Best regards,
Bartlomiej
Hi,
Setting priority to LOW pushed me forward. Thanks a lot for the hints! Will be other consequences of doing so?
I cannot use CONFIG_TFM_POST_PARTITION_INIT_HOOK in my environment as I'm currently on version 2.1.0 of TF-M. It might be reconsidered to update, but LTS version is preferred.
Best regards,
Bartlomiej
________________________________ From: Nicola Mazzucato Nicola.Mazzucato@arm.com Sent: Tuesday, June 3, 2025 8:49 AM To: David Hu David.Hu2@arm.com; Florek, Bartlomiej bartlomiej.florek@assaabloy.com; Antonio De Angelis Antonio.DeAngelis@arm.com; tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org; nd nd@arm.com Subject: Re: [EXT] Re: Order of starting Secure Partitions
You don't often get email from nicola.mazzucato@arm.com. Learn why this is importanthttps://aka.ms/LearnAboutSenderIdentification Hi Bartlomiej,
As David correctly pointed out, the order for partitions initialisation is grouped by priority, see "priority" field in the corresponding manifest file. If you wish to explore the init hook, please search for the CONFIG_TFM_POST_PARTITION_INIT_HOOK which will enable the framework to call the hook.
Hope that helps, Thanks Nicola
________________________________ From: David Hu David.Hu2@arm.com Sent: 02 June 2025 22:42 To: Florek, Bartlomiej bartlomiej.florek@assaabloy.com; Antonio De Angelis Antonio.DeAngelis@arm.com; tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org; Nicola Mazzucato Nicola.Mazzucato@arm.com; nd nd@arm.com Cc: nd nd@arm.com Subject: RE: [EXT] Re: Order of starting Secure Partitions
Hi Florek,
The `dependencies` in manifest is used by TF-M SPM to check the access permissions. For example, when your new SP asks for a secure service from Crypto SP, TF-M SPM will check if your SP explicitly sets Crypto SP as its dependency. Otherwise, TF-M SPM will reject the secure request from your SP.
The load sequence of SPs in TF-M, however, is a bit vague. The ordering is usually decided by the priority of SPs.
The higher a SP’s priority is, the earlier it is scheduled/initialized. Meanwhile, IIUC, the ordering of SPs in the same priority is not specified.
Crypto SP’s priority is set to NORMAL by default.
Please can you try to set your SP priority to LOW in its manifest? "priority": "LOW",
Best regards,
David
From: Florek, Bartlomiej via TF-M tf-m@lists.trustedfirmware.org Sent: Monday, June 2, 2025 1:06 PM To: Antonio De Angelis Antonio.DeAngelis@arm.com; tf-m@lists.trustedfirmware.org; Nicola Mazzucato Nicola.Mazzucato@arm.com; nd nd@arm.com Subject: [TF-M] Re: [EXT] Re: Order of starting Secure Partitions
Hi,
Thank you for your fast answers. You have correctly understood the sequence.
I haven't used tfm_hal_post_partition_init_hook. I will look for it. Can you point me in the right direction?
I already have dependencies in manifest on TFM_CRYPTO, but it doesn't change order.
"dependencies": [
"TFM_CRYPTO"
]
I injected config file expanding CRYPTO_ENGINE_BUF_SIZE, but I feel error I got is misleading, because crypto partition was not initialized.
set_property(TARGET zephyr_property_target
APPEND PROPERTY TFM_CMAKE_OPTIONS
-DPROJECT_CONFIG_HEADER_FILE=${CMAKE_CURRENT_SOURCE_DIR}/new_sp/config/config_tfm.h
)
Some logs with injected data:
[DBG][NEW] Starting new secure partition
[INF][NEW] version v1.18.0-dirty
[DBG][mbedcrypto] 2:0
[DBG][mbedcrypto] 1:0
[DBG][mbedcrypto] 3:-141
[DBG][NEW] Something went wrong: 9 : CRYPTO_FAILURE
Creating an empty ITS flash layout.
Creating an empty PS flash layout.
[INF][PS] Encryption alg: 0x5500200
[INF][Crypto] Provision entropy seed...
[INF][Crypto] Provision entropy seed... complete.
[DBG][Crypto] Init Mbed TLS 3.6.0...
[DBG][Crypto] Init Mbed TLS 3.6.0... complete.
[DBG][mbedcrypto] 2:0
[DBG][mbedcrypto] 1:0
[DBG][mbedcrypto] 3:0
[DBG][mbedcrypto] 4:0
I'm using PSA hash multi-part operation: psa_hash_setup, psa_hash_update, psa_hash_finish.
It is true that my partition requires crypto for proper initialization. That is why I'm looking for getting correct sequence or asynchronous approach.
Best regards,
Bartlomiej
________________________________
From: Antonio De Angelis <Antonio.DeAngelis@arm.commailto:Antonio.DeAngelis@arm.com> Sent: Monday, June 2, 2025 1:47 PM To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com>; Nicola Mazzucato <Nicola.Mazzucato@arm.commailto:Nicola.Mazzucato@arm.com>; nd <nd@arm.commailto:nd@arm.com> Subject: [EXT] Re: Order of starting Secure Partitions
You don't often get email from antonio.deangelis@arm.commailto:antonio.deangelis@arm.com. Learn why this is importanthttps://aka.ms/LearnAboutSenderIdentification
CAUTION: This email is external. Do not click links or attachments that are unexpected or from unknown senders. If unsure, click the Report Phishing Button in Outlook.
Hi,
The partitions would have to have a list of dependencies, so if your partition requires something from the Crypto one, the Crypto must in the list of deps of your partition and it will be initialised first.
Having said that, I believe the PSA_ERROR_INSUFFICIENT_MEMORY is being returned at some point by the API as Mbed TLS underneath might try to allocate some memory on the static allocator. The allocator is a buffer that is statically allocated in the TF-M Crypto partition and you can control its size by changing CRYPTO_ENGINE_BUF_SIZE at build time, the default is in:
❯ cat config_engine_buf.h
/*
* Copyright (c) 2023, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*
*/
#ifndef __CONFIG_ENGINE_BUF_H__
#define __CONFIG_ENGINE_BUF_H__
/*
* CRYPTO_ENGINE_BUF_SIZE is decided by multiple components configs.
* CRYPTO_ENGINE_BUF_SIZE can be overridden below by other component configs.
* It must be guaranteed that this header file is included at last before CRYPTO_ENGINE_BUF_SIZE
* is referred in crypto_library.c.
* Otherwise, crypto_library.c may include an incorrect definition value.
*/
/* The CC312 needs at least 0x4000 of heap size to work properly */
#if defined(CRYPTO_HW_ACCELERATOR_CC312) && (CRYPTO_ENGINE_BUF_SIZE < 0x4000)
#pragma message("CRYPTO_ENGINE_BUF_SIZE is redefined to 0x4000.")
#undef CRYPTO_ENGINE_BUF_SIZE
#define CRYPTO_ENGINE_BUF_SIZE 0x4000
#endif
#endif /* __CONFIG_ENGINE_BUF_H__ */
Different TF-M profiles might override this size with smaller (or bigger) sizes.
Hope this helps.
Thanks,
Antonio
________________________________
From: Nicola Mazzucato via TF-M <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Sent: Monday, June 02, 2025 12:07 To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com> Subject: [TF-M] Re: Order of starting Secure Partitions
Hi Bartlomiej,
I am not sure I understood exactly the sequence you need to perform in your case, but have you perhaps tried to use the
"tfm_hal_post_partition_init_hook"?
In principle, you need to have the runtime initialization fully completed before you can require a secure service operation.
Does your new partition need some crypto operations to initialize itself correctly? Which crypto api have you used exactly?
Best regards,
Nicola
________________________________
From: Florek, Bartlomiej via TF-M <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Sent: 02 June 2025 11:48 To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Subject: [TF-M] Order of starting Secure Partitions
Hello,
I'm trying to fit a new Secure Partition into Trusted Firmware - M environment. The current working environment consists of Zephyr RTOS 3.7 + TF-M 2.1.0 running under QEMU on MPS2 AN521 platform. General skeleton is in place - manifest with dependencies on TFM_CRYPTO, interface, IPC and handling communication.
However, I have problems with using the PSA Crypto from the aforementioned new Service. I need a hash function, so I thought I'd use PSA Crypto API. The problem is that either the hash function or the initialization function (psa_crypto_init) is returning error (PSA_ERROR_INSUFFICIENT_MEMORY). I discovered that logs show PSA Crypto partition is loading after mine.
This problem occurs in the entry_point function.
Is it possible to change the order of partitions loading or is there different mechanism advised to synchronize partition loading?
Thank you in advance for your suggestions.
Best regards,
Bartlomiej
Hi Bartlomiej,
Glad to hear. The sorting of partitions within SPM follows the same grouping order, therefore those with higher priority will be run first when multiple ones are ready to run. Yes, we encourage to use LTS whenever possible, since they contain bugfixes. If you are on 2.1.0 I suspect it should not be too painful to update to 2.1.2.
And we always welcome contributions :)
Thanks Best regards Nicola
________________________________ From: Florek, Bartlomiej bartlomiej.florek@assaabloy.com Sent: 03 June 2025 07:57 To: Nicola Mazzucato Nicola.Mazzucato@arm.com; David Hu David.Hu2@arm.com; Antonio De Angelis Antonio.DeAngelis@arm.com; tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org; nd nd@arm.com Subject: Re: [EXT] Re: Order of starting Secure Partitions
Hi,
Setting priority to LOW pushed me forward. Thanks a lot for the hints! Will be other consequences of doing so?
I cannot use CONFIG_TFM_POST_PARTITION_INIT_HOOK in my environment as I'm currently on version 2.1.0 of TF-M. It might be reconsidered to update, but LTS version is preferred.
Best regards,
Bartlomiej
________________________________ From: Nicola Mazzucato Nicola.Mazzucato@arm.com Sent: Tuesday, June 3, 2025 8:49 AM To: David Hu David.Hu2@arm.com; Florek, Bartlomiej bartlomiej.florek@assaabloy.com; Antonio De Angelis Antonio.DeAngelis@arm.com; tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org; nd nd@arm.com Subject: Re: [EXT] Re: Order of starting Secure Partitions
You don't often get email from nicola.mazzucato@arm.com. Learn why this is importanthttps://aka.ms/LearnAboutSenderIdentification Hi Bartlomiej,
As David correctly pointed out, the order for partitions initialisation is grouped by priority, see "priority" field in the corresponding manifest file. If you wish to explore the init hook, please search for the CONFIG_TFM_POST_PARTITION_INIT_HOOK which will enable the framework to call the hook.
Hope that helps, Thanks Nicola
________________________________ From: David Hu David.Hu2@arm.com Sent: 02 June 2025 22:42 To: Florek, Bartlomiej bartlomiej.florek@assaabloy.com; Antonio De Angelis Antonio.DeAngelis@arm.com; tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org; Nicola Mazzucato Nicola.Mazzucato@arm.com; nd nd@arm.com Cc: nd nd@arm.com Subject: RE: [EXT] Re: Order of starting Secure Partitions
Hi Florek,
The `dependencies` in manifest is used by TF-M SPM to check the access permissions. For example, when your new SP asks for a secure service from Crypto SP, TF-M SPM will check if your SP explicitly sets Crypto SP as its dependency. Otherwise, TF-M SPM will reject the secure request from your SP.
The load sequence of SPs in TF-M, however, is a bit vague. The ordering is usually decided by the priority of SPs.
The higher a SP’s priority is, the earlier it is scheduled/initialized. Meanwhile, IIUC, the ordering of SPs in the same priority is not specified.
Crypto SP’s priority is set to NORMAL by default.
Please can you try to set your SP priority to LOW in its manifest? "priority": "LOW",
Best regards,
David
From: Florek, Bartlomiej via TF-M tf-m@lists.trustedfirmware.org Sent: Monday, June 2, 2025 1:06 PM To: Antonio De Angelis Antonio.DeAngelis@arm.com; tf-m@lists.trustedfirmware.org; Nicola Mazzucato Nicola.Mazzucato@arm.com; nd nd@arm.com Subject: [TF-M] Re: [EXT] Re: Order of starting Secure Partitions
Hi,
Thank you for your fast answers. You have correctly understood the sequence.
I haven't used tfm_hal_post_partition_init_hook. I will look for it. Can you point me in the right direction?
I already have dependencies in manifest on TFM_CRYPTO, but it doesn't change order.
"dependencies": [
"TFM_CRYPTO"
]
I injected config file expanding CRYPTO_ENGINE_BUF_SIZE, but I feel error I got is misleading, because crypto partition was not initialized.
set_property(TARGET zephyr_property_target
APPEND PROPERTY TFM_CMAKE_OPTIONS
-DPROJECT_CONFIG_HEADER_FILE=${CMAKE_CURRENT_SOURCE_DIR}/new_sp/config/config_tfm.h
)
Some logs with injected data:
[DBG][NEW] Starting new secure partition
[INF][NEW] version v1.18.0-dirty
[DBG][mbedcrypto] 2:0
[DBG][mbedcrypto] 1:0
[DBG][mbedcrypto] 3:-141
[DBG][NEW] Something went wrong: 9 : CRYPTO_FAILURE
Creating an empty ITS flash layout.
Creating an empty PS flash layout.
[INF][PS] Encryption alg: 0x5500200
[INF][Crypto] Provision entropy seed...
[INF][Crypto] Provision entropy seed... complete.
[DBG][Crypto] Init Mbed TLS 3.6.0...
[DBG][Crypto] Init Mbed TLS 3.6.0... complete.
[DBG][mbedcrypto] 2:0
[DBG][mbedcrypto] 1:0
[DBG][mbedcrypto] 3:0
[DBG][mbedcrypto] 4:0
I'm using PSA hash multi-part operation: psa_hash_setup, psa_hash_update, psa_hash_finish.
It is true that my partition requires crypto for proper initialization. That is why I'm looking for getting correct sequence or asynchronous approach.
Best regards,
Bartlomiej
________________________________
From: Antonio De Angelis <Antonio.DeAngelis@arm.commailto:Antonio.DeAngelis@arm.com> Sent: Monday, June 2, 2025 1:47 PM To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com>; Nicola Mazzucato <Nicola.Mazzucato@arm.commailto:Nicola.Mazzucato@arm.com>; nd <nd@arm.commailto:nd@arm.com> Subject: [EXT] Re: Order of starting Secure Partitions
You don't often get email from antonio.deangelis@arm.commailto:antonio.deangelis@arm.com. Learn why this is importanthttps://aka.ms/LearnAboutSenderIdentification
CAUTION: This email is external. Do not click links or attachments that are unexpected or from unknown senders. If unsure, click the Report Phishing Button in Outlook.
Hi,
The partitions would have to have a list of dependencies, so if your partition requires something from the Crypto one, the Crypto must in the list of deps of your partition and it will be initialised first.
Having said that, I believe the PSA_ERROR_INSUFFICIENT_MEMORY is being returned at some point by the API as Mbed TLS underneath might try to allocate some memory on the static allocator. The allocator is a buffer that is statically allocated in the TF-M Crypto partition and you can control its size by changing CRYPTO_ENGINE_BUF_SIZE at build time, the default is in:
❯ cat config_engine_buf.h
/*
* Copyright (c) 2023, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*
*/
#ifndef __CONFIG_ENGINE_BUF_H__
#define __CONFIG_ENGINE_BUF_H__
/*
* CRYPTO_ENGINE_BUF_SIZE is decided by multiple components configs.
* CRYPTO_ENGINE_BUF_SIZE can be overridden below by other component configs.
* It must be guaranteed that this header file is included at last before CRYPTO_ENGINE_BUF_SIZE
* is referred in crypto_library.c.
* Otherwise, crypto_library.c may include an incorrect definition value.
*/
/* The CC312 needs at least 0x4000 of heap size to work properly */
#if defined(CRYPTO_HW_ACCELERATOR_CC312) && (CRYPTO_ENGINE_BUF_SIZE < 0x4000)
#pragma message("CRYPTO_ENGINE_BUF_SIZE is redefined to 0x4000.")
#undef CRYPTO_ENGINE_BUF_SIZE
#define CRYPTO_ENGINE_BUF_SIZE 0x4000
#endif
#endif /* __CONFIG_ENGINE_BUF_H__ */
Different TF-M profiles might override this size with smaller (or bigger) sizes.
Hope this helps.
Thanks,
Antonio
________________________________
From: Nicola Mazzucato via TF-M <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Sent: Monday, June 02, 2025 12:07 To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com> Subject: [TF-M] Re: Order of starting Secure Partitions
Hi Bartlomiej,
I am not sure I understood exactly the sequence you need to perform in your case, but have you perhaps tried to use the
"tfm_hal_post_partition_init_hook"?
In principle, you need to have the runtime initialization fully completed before you can require a secure service operation.
Does your new partition need some crypto operations to initialize itself correctly? Which crypto api have you used exactly?
Best regards,
Nicola
________________________________
From: Florek, Bartlomiej via TF-M <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Sent: 02 June 2025 11:48 To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Subject: [TF-M] Order of starting Secure Partitions
Hello,
I'm trying to fit a new Secure Partition into Trusted Firmware - M environment. The current working environment consists of Zephyr RTOS 3.7 + TF-M 2.1.0 running under QEMU on MPS2 AN521 platform. General skeleton is in place - manifest with dependencies on TFM_CRYPTO, interface, IPC and handling communication.
However, I have problems with using the PSA Crypto from the aforementioned new Service. I need a hash function, so I thought I'd use PSA Crypto API. The problem is that either the hash function or the initialization function (psa_crypto_init) is returning error (PSA_ERROR_INSUFFICIENT_MEMORY). I discovered that logs show PSA Crypto partition is loading after mine.
This problem occurs in the entry_point function.
Is it possible to change the order of partitions loading or is there different mechanism advised to synchronize partition loading?
Thank you in advance for your suggestions.
Best regards,
Bartlomiej
Hi Bartlomiej,
(Sorry for confusing your names)
This may not work if your use case introduces another new SP, depending on the existing one. Priority LOWEST is reserved for idle partitions and therefore only priority LOW is available in your use case. Perhaps you can increase the priority of Crypto/ITS/PS to leave more priority levels to your SPs, but I’m not sure if this is fully tested before.
Best regards, David
From: Nicola Mazzucato Nicola.Mazzucato@arm.com Sent: Tuesday, June 3, 2025 8:35 AM To: Florek, Bartlomiej bartlomiej.florek@assaabloy.com; David Hu David.Hu2@arm.com; Antonio De Angelis Antonio.DeAngelis@arm.com; tf-m@lists.trustedfirmware.org; nd nd@arm.com Subject: Re: [EXT] Re: Order of starting Secure Partitions
Hi Bartlomiej,
Glad to hear. The sorting of partitions within SPM follows the same grouping order, therefore those with higher priority will be run first when multiple ones are ready to run. Yes, we encourage to use LTS whenever possible, since they contain bugfixes. If you are on 2.1.0 I suspect it should not be too painful to update to 2.1.2.
And we always welcome contributions :)
Thanks Best regards Nicola
________________________________ From: Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com> Sent: 03 June 2025 07:57 To: Nicola Mazzucato <Nicola.Mazzucato@arm.commailto:Nicola.Mazzucato@arm.com>; David Hu <David.Hu2@arm.commailto:David.Hu2@arm.com>; Antonio De Angelis <Antonio.DeAngelis@arm.commailto:Antonio.DeAngelis@arm.com>; tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; nd <nd@arm.commailto:nd@arm.com> Subject: Re: [EXT] Re: Order of starting Secure Partitions
Hi,
Setting priority to LOW pushed me forward. Thanks a lot for the hints! Will be other consequences of doing so?
I cannot use CONFIG_TFM_POST_PARTITION_INIT_HOOK in my environment as I'm currently on version 2.1.0 of TF-M. It might be reconsidered to update, but LTS version is preferred.
Best regards,
Bartlomiej
________________________________ From: Nicola Mazzucato <Nicola.Mazzucato@arm.commailto:Nicola.Mazzucato@arm.com> Sent: Tuesday, June 3, 2025 8:49 AM To: David Hu <David.Hu2@arm.commailto:David.Hu2@arm.com>; Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com>; Antonio De Angelis <Antonio.DeAngelis@arm.commailto:Antonio.DeAngelis@arm.com>; tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; nd <nd@arm.commailto:nd@arm.com> Subject: Re: [EXT] Re: Order of starting Secure Partitions
You don't often get email from nicola.mazzucato@arm.commailto:nicola.mazzucato@arm.com. Learn why this is importanthttps://aka.ms/LearnAboutSenderIdentification Hi Bartlomiej,
As David correctly pointed out, the order for partitions initialisation is grouped by priority, see "priority" field in the corresponding manifest file. If you wish to explore the init hook, please search for the CONFIG_TFM_POST_PARTITION_INIT_HOOK which will enable the framework to call the hook.
Hope that helps, Thanks Nicola
________________________________ From: David Hu <David.Hu2@arm.commailto:David.Hu2@arm.com> Sent: 02 June 2025 22:42 To: Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com>; Antonio De Angelis <Antonio.DeAngelis@arm.commailto:Antonio.DeAngelis@arm.com>; tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; Nicola Mazzucato <Nicola.Mazzucato@arm.commailto:Nicola.Mazzucato@arm.com>; nd <nd@arm.commailto:nd@arm.com> Cc: nd <nd@arm.commailto:nd@arm.com> Subject: RE: [EXT] Re: Order of starting Secure Partitions
Hi Florek,
The `dependencies` in manifest is used by TF-M SPM to check the access permissions. For example, when your new SP asks for a secure service from Crypto SP, TF-M SPM will check if your SP explicitly sets Crypto SP as its dependency. Otherwise, TF-M SPM will reject the secure request from your SP.
The load sequence of SPs in TF-M, however, is a bit vague. The ordering is usually decided by the priority of SPs.
The higher a SP’s priority is, the earlier it is scheduled/initialized. Meanwhile, IIUC, the ordering of SPs in the same priority is not specified.
Crypto SP’s priority is set to NORMAL by default.
Please can you try to set your SP priority to LOW in its manifest? "priority": "LOW",
Best regards,
David
From: Florek, Bartlomiej via TF-M <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Sent: Monday, June 2, 2025 1:06 PM To: Antonio De Angelis <Antonio.DeAngelis@arm.commailto:Antonio.DeAngelis@arm.com>; tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org; Nicola Mazzucato <Nicola.Mazzucato@arm.commailto:Nicola.Mazzucato@arm.com>; nd <nd@arm.commailto:nd@arm.com> Subject: [TF-M] Re: [EXT] Re: Order of starting Secure Partitions
Hi,
Thank you for your fast answers. You have correctly understood the sequence.
I haven't used tfm_hal_post_partition_init_hook. I will look for it. Can you point me in the right direction?
I already have dependencies in manifest on TFM_CRYPTO, but it doesn't change order.
"dependencies": [
"TFM_CRYPTO"
]
I injected config file expanding CRYPTO_ENGINE_BUF_SIZE, but I feel error I got is misleading, because crypto partition was not initialized.
set_property(TARGET zephyr_property_target
APPEND PROPERTY TFM_CMAKE_OPTIONS
-DPROJECT_CONFIG_HEADER_FILE=${CMAKE_CURRENT_SOURCE_DIR}/new_sp/config/config_tfm.h
)
Some logs with injected data:
[DBG][NEW] Starting new secure partition
[INF][NEW] version v1.18.0-dirty
[DBG][mbedcrypto] 2:0
[DBG][mbedcrypto] 1:0
[DBG][mbedcrypto] 3:-141
[DBG][NEW] Something went wrong: 9 : CRYPTO_FAILURE
Creating an empty ITS flash layout.
Creating an empty PS flash layout.
[INF][PS] Encryption alg: 0x5500200
[INF][Crypto] Provision entropy seed...
[INF][Crypto] Provision entropy seed... complete.
[DBG][Crypto] Init Mbed TLS 3.6.0...
[DBG][Crypto] Init Mbed TLS 3.6.0... complete.
[DBG][mbedcrypto] 2:0
[DBG][mbedcrypto] 1:0
[DBG][mbedcrypto] 3:0
[DBG][mbedcrypto] 4:0
I'm using PSA hash multi-part operation: psa_hash_setup, psa_hash_update, psa_hash_finish.
It is true that my partition requires crypto for proper initialization. That is why I'm looking for getting correct sequence or asynchronous approach.
Best regards,
Bartlomiej
________________________________
From: Antonio De Angelis <Antonio.DeAngelis@arm.commailto:Antonio.DeAngelis@arm.com> Sent: Monday, June 2, 2025 1:47 PM To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com>; Nicola Mazzucato <Nicola.Mazzucato@arm.commailto:Nicola.Mazzucato@arm.com>; nd <nd@arm.commailto:nd@arm.com> Subject: [EXT] Re: Order of starting Secure Partitions
You don't often get email from antonio.deangelis@arm.commailto:antonio.deangelis@arm.com. Learn why this is importanthttps://aka.ms/LearnAboutSenderIdentification
CAUTION: This email is external. Do not click links or attachments that are unexpected or from unknown senders. If unsure, click the Report Phishing Button in Outlook.
Hi,
The partitions would have to have a list of dependencies, so if your partition requires something from the Crypto one, the Crypto must in the list of deps of your partition and it will be initialised first.
Having said that, I believe the PSA_ERROR_INSUFFICIENT_MEMORY is being returned at some point by the API as Mbed TLS underneath might try to allocate some memory on the static allocator. The allocator is a buffer that is statically allocated in the TF-M Crypto partition and you can control its size by changing CRYPTO_ENGINE_BUF_SIZE at build time, the default is in:
❯ cat config_engine_buf.h
/*
* Copyright (c) 2023, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*
*/
#ifndef __CONFIG_ENGINE_BUF_H__
#define __CONFIG_ENGINE_BUF_H__
/*
* CRYPTO_ENGINE_BUF_SIZE is decided by multiple components configs.
* CRYPTO_ENGINE_BUF_SIZE can be overridden below by other component configs.
* It must be guaranteed that this header file is included at last before CRYPTO_ENGINE_BUF_SIZE
* is referred in crypto_library.c.
* Otherwise, crypto_library.c may include an incorrect definition value.
*/
/* The CC312 needs at least 0x4000 of heap size to work properly */
#if defined(CRYPTO_HW_ACCELERATOR_CC312) && (CRYPTO_ENGINE_BUF_SIZE < 0x4000)
#pragma message("CRYPTO_ENGINE_BUF_SIZE is redefined to 0x4000.")
#undef CRYPTO_ENGINE_BUF_SIZE
#define CRYPTO_ENGINE_BUF_SIZE 0x4000
#endif
#endif /* __CONFIG_ENGINE_BUF_H__ */
Different TF-M profiles might override this size with smaller (or bigger) sizes.
Hope this helps.
Thanks,
Antonio
________________________________
From: Nicola Mazzucato via TF-M <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Sent: Monday, June 02, 2025 12:07 To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org>; Florek, Bartlomiej <bartlomiej.florek@assaabloy.commailto:bartlomiej.florek@assaabloy.com> Subject: [TF-M] Re: Order of starting Secure Partitions
Hi Bartlomiej,
I am not sure I understood exactly the sequence you need to perform in your case, but have you perhaps tried to use the
"tfm_hal_post_partition_init_hook"?
In principle, you need to have the runtime initialization fully completed before you can require a secure service operation.
Does your new partition need some crypto operations to initialize itself correctly? Which crypto api have you used exactly?
Best regards,
Nicola
________________________________
From: Florek, Bartlomiej via TF-M <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Sent: 02 June 2025 11:48 To: tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org <tf-m@lists.trustedfirmware.orgmailto:tf-m@lists.trustedfirmware.org> Subject: [TF-M] Order of starting Secure Partitions
Hello,
I'm trying to fit a new Secure Partition into Trusted Firmware - M environment. The current working environment consists of Zephyr RTOS 3.7 + TF-M 2.1.0 running under QEMU on MPS2 AN521 platform. General skeleton is in place - manifest with dependencies on TFM_CRYPTO, interface, IPC and handling communication.
However, I have problems with using the PSA Crypto from the aforementioned new Service. I need a hash function, so I thought I'd use PSA Crypto API. The problem is that either the hash function or the initialization function (psa_crypto_init) is returning error (PSA_ERROR_INSUFFICIENT_MEMORY). I discovered that logs show PSA Crypto partition is loading after mine.
This problem occurs in the entry_point function.
Is it possible to change the order of partitions loading or is there different mechanism advised to synchronize partition loading?
Thank you in advance for your suggestions.
Best regards,
Bartlomiej
tf-m@lists.trustedfirmware.org
-
Antonio De Angelis -
David Hu -
Florek, Bartlomiej -
Nicola Mazzucato