gh-Mbed-TLS/TF-PSA-Crypto
Watch
1
0
Fork
You've already forked TF-PSA-Crypto
 0
Code Issues 167 Pull requests 92 Releases 5 Activity

Build broken with TF-M using ATfE in 1.1.0 #754

New issue
Open
opened 2026-04-13 09:51:51 -05:00 by gilles-peskine-arm · 10 comments
gilles-peskine-arm commented 2026-04-13 09:51:51 -05:00 (Migrated from github.com)

TF-PSA-Crypto 1.1.0 breaks the build of TF-M (Trusted Firmware M) when using ATfE (Arm Toolchain for Embedded): after upgrading, they needed a workaround to avoid querying for the presence of C11 Annex K functions. The patch disables our #define __STDC_WANT_LIB_EXT1__ 1.

Goal of this issue: identify the problem and find a solution so that TF-M doesn't need to carry a patch.

TF-PSA-Crypto 1.1.0 breaks the build of TF-M (Trusted Firmware M) when using ATfE (Arm Toolchain for Embedded): after [upgrading](https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/49686), they needed a [workaround](https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/49740) to avoid querying for the presence of C11 Annex K functions. The [patch](https://review.trustedfirmware.org/plugins/gitiles/TF-M/trusted-firmware-m/+/d6e6cdee67c130ec999157baca8e37a52c06cfa7/lib/ext/tf-psa-crypto/0016-Do-not-define-__STDC_WANT_LIB_EXT1__-with-ATfE.patch) disables our `#define __STDC_WANT_LIB_EXT1__ 1`. Goal of this issue: identify the problem and find a solution so that TF-M doesn't need to carry a patch.
gilles-peskine-arm commented 2026-04-13 09:53:28 -05:00 (Migrated from github.com)

I tried building locally with ATfE 21.1.1 and couldn't find a problem, but I'm building on Linux and presumably the problem only arises with a limited libc. TF-M builds with -nostdlib and provide their own copies of some libc functions.

I tried building locally with ATfE 21.1.1 and couldn't find a problem, but I'm building on Linux and presumably the problem only arises with a limited libc. TF-M builds with `-nostdlib` and provide their own copies of some libc functions.
bjwtaylor commented 2026-04-23 06:03:14 -05:00 (Migrated from github.com)

@gilles-peskine-arm, I think I've recreated it. If I've understood the various threads correctly the error is:

[ 11%] Built target platform_bl2
[ 27%] Built target bootutil
[ 34%] Built target bl2_crypto
[ 34%] Built target manifest_tool
[ 35%] Built target bl2_scatter
[ 36%] Linking C executable ../bin/bl2.axf
ld.lld: error: undefined symbol: memset_s

referenced by platform_util.c:93 (/home/bentay03/work/mbedtls/754-tf-m-build-issues/trusted-firmware-m_build/lib/ext/tf-psa-crypto-src/platform/platform_util.c:93)
platform_util.o:(mbedtls_platform_zeroize) in archive libbl2_crypto.a
Memory region Used Size Region Size %age Used
FLASH: 18976 B 512 KB 3.62%
RAM: 25440 B 2 MB 1.21%
clang: error: linker command failed with exit code 1 (use -v to see invocation)
gmake[2]: *** [bl2/CMakeFiles/bl2.dir/build.make:392: bin/bl2.axf] Error 1
gmake[1]: *** [CMakeFiles/Makefile2:810: bl2/CMakeFiles/bl2.dir/all] Error 2
gmake: *** [Makefile:136: all] Error 2

It seems it builds with the patches applied and fails without them. There maybe other issues further down the process once this is resolved, though haven't investigated any further yet.

@gilles-peskine-arm, I think I've recreated it. If I've understood the various threads correctly the error is: [ 11%] Built target platform_bl2 [ 27%] Built target bootutil [ 34%] Built target bl2_crypto [ 34%] Built target manifest_tool [ 35%] Built target bl2_scatter [ 36%] Linking C executable ../bin/bl2.axf ld.lld: error: undefined symbol: memset_s >>> referenced by platform_util.c:93 (/home/bentay03/work/mbedtls/754-tf-m-build-issues/trusted-firmware-m_build/lib/ext/tf-psa-crypto-src/platform/platform_util.c:93) >>> platform_util.o:(mbedtls_platform_zeroize) in archive libbl2_crypto.a Memory region Used Size Region Size %age Used FLASH: 18976 B 512 KB 3.62% RAM: 25440 B 2 MB 1.21% clang: error: linker command failed with exit code 1 (use -v to see invocation) gmake[2]: *** [bl2/CMakeFiles/bl2.dir/build.make:392: bin/bl2.axf] Error 1 gmake[1]: *** [CMakeFiles/Makefile2:810: bl2/CMakeFiles/bl2.dir/all] Error 2 gmake: *** [Makefile:136: all] Error 2 It seems it builds with the patches applied and fails without them. There maybe other issues further down the process once this is resolved, though haven't investigated any further yet.
bjwtaylor commented 2026-04-23 07:00:21 -05:00 (Migrated from github.com)

Steps to recreate roughly:
clone the source tested with 0e725cddc983a9e0ce3c6d661469a5de7abae75a
revert the patch at https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/49740
Install the ATFE toolchain in /opt/
python3 -m venv <WORK_DIR>/trusted-firmware-m/.venv
trusted-firmware-m/.venv/bin/pip install -e ./trusted-firmware-m intelhex

export PATH=<WORK_DIR>/trusted-firmware-m/.venv/bin:/opt/ATfE-22.1.0-Linux-x86_64/bin:$PATH

cmake -G "Unix Makefiles"
-S <WORK_DIR>/trusted-firmware-m
-B <WORK_DIR>/trusted-firmware-m_build
-DTFM_PLATFORM=arm/mps2/an521
-DTFM_TOOLCHAIN_FILE=<WORK_DIR>/trusted-firmware-m/toolchain_ATFE.cmake
-DPython3_EXECUTABLE=<WORK_DIR>/trusted-firmware-m/.venv/bin/python3

cmake --build <WORK_DIR>/trusted-firmware-m_build

Steps to recreate roughly: clone the source tested with 0e725cddc983a9e0ce3c6d661469a5de7abae75a revert the patch at https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/49740 Install the ATFE toolchain in /opt/ python3 -m venv <WORK_DIR>/trusted-firmware-m/.venv trusted-firmware-m/.venv/bin/pip install -e ./trusted-firmware-m intelhex export PATH=<WORK_DIR>/trusted-firmware-m/.venv/bin:/opt/ATfE-22.1.0-Linux-x86_64/bin:$PATH cmake -G "Unix Makefiles" \ -S <WORK_DIR>/trusted-firmware-m \ -B <WORK_DIR>/trusted-firmware-m_build \ -DTFM_PLATFORM=arm/mps2/an521 \ -DTFM_TOOLCHAIN_FILE=<WORK_DIR>/trusted-firmware-m/toolchain_ATFE.cmake \ -DPython3_EXECUTABLE=<WORK_DIR>/trusted-firmware-m/.venv/bin/python3 cmake --build <WORK_DIR>/trusted-firmware-m_build
bjwtaylor commented 2026-04-23 07:50:27 -05:00 (Migrated from github.com)

Have now also managed to recreate it using tf-psa-crypto using the below:
cd /home/bentay03/work/mbedtls/754-tf-m-build-issues

export PATH=<BUILD_DIR>/trusted-firmware-m/.venv/bin:/opt/ATfE-22.1.0-Linux-x86_64/bin:$PATH

cmake -G "Unix Makefiles"
-S<BUILD_DIR>/tf-psa-crypto
-B <BUILD_DIR>/tf-psa-crypto_build
-DCMAKE_C_COMPILER=clang
-DCMAKE_C_FLAGS="--target=arm-none-eabi -mcpu=cortex-m33 -mthumb -Os -Werror -Wasm-operand-widths -Wunused -I../framework/tests/include/spe"
-DCMAKE_C_COMPILER_WORKS=TRUE
-DTF_PSA_CRYPTO_CONFIG_FILE=<BUILD_DIR>/tf-psa-crypto/configs/ext/crypto_config_profile_medium.h
-DENABLE_TESTING=OFF
-DENABLE_PROGRAMS=OFF

Build the upstream library:

cmake --build <BUILD_DIR>/tf-psa-crypto_build -j1

Create the minimal reproducer source:

cat > /<BUILD_DIR>/tf-psa-crypto_build/repro_zeroize.c <<'EOF'
extern void mbedtls_platform_zeroize(void *buf, unsigned long len);

int main(void)
{
char byte = 1;
mbedtls_platform_zeroize(&byte, sizeof(byte));
return 0;
}
EOF

Link it against the upstream-built archive:

clang --target=arm-none-eabi -mcpu=cortex-m33 -mthumb
-nostdlib -Wl,-e,main
<BUILD_DIR>/tf-psa-crypto_build/repro_zeroize.c
<BUILD_DIR>/tf-psa-crypto_build/core/libtfpsacrypto.a
-o <BUILD_DIR>/tf-psa-crypto_build/repro_zeroize.axf

Have now also managed to recreate it using tf-psa-crypto using the below: cd /home/bentay03/work/mbedtls/754-tf-m-build-issues export PATH=<BUILD_DIR>/trusted-firmware-m/.venv/bin:/opt/ATfE-22.1.0-Linux-x86_64/bin:$PATH cmake -G "Unix Makefiles" \ -S<BUILD_DIR>/tf-psa-crypto \ -B <BUILD_DIR>/tf-psa-crypto_build \ -DCMAKE_C_COMPILER=clang \ -DCMAKE_C_FLAGS="--target=arm-none-eabi -mcpu=cortex-m33 -mthumb -Os -Werror -Wasm-operand-widths -Wunused -I../framework/tests/include/spe" \ -DCMAKE_C_COMPILER_WORKS=TRUE \ -DTF_PSA_CRYPTO_CONFIG_FILE=<BUILD_DIR>/tf-psa-crypto/configs/ext/crypto_config_profile_medium.h \ -DENABLE_TESTING=OFF \ -DENABLE_PROGRAMS=OFF Build the upstream library: cmake --build <BUILD_DIR>/tf-psa-crypto_build -j1 Create the minimal reproducer source: cat > /<BUILD_DIR>/tf-psa-crypto_build/repro_zeroize.c <<'EOF' extern void mbedtls_platform_zeroize(void *buf, unsigned long len); int main(void) { char byte = 1; mbedtls_platform_zeroize(&byte, sizeof(byte)); return 0; } EOF Link it against the upstream-built archive: clang --target=arm-none-eabi -mcpu=cortex-m33 -mthumb \ -nostdlib -Wl,-e,main \ <BUILD_DIR>/tf-psa-crypto_build/repro_zeroize.c \ <BUILD_DIR>/tf-psa-crypto_build/core/libtfpsacrypto.a \ -o <BUILD_DIR>/tf-psa-crypto_build/repro_zeroize.axf
bjwtaylor commented 2026-04-23 08:15:44 -05:00 (Migrated from github.com)

I've added a draft fix for the issue based on the TF-M patch.

I've added a draft fix for the issue based on the TF-M patch.
gilles-peskine-arm commented 2026-04-29 12:35:27 -05:00 (Migrated from github.com)

I tried building and I'm getting a compilation error, not a link error. Is that what you get as well?

/home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/clang --target=arm-none-eabi -DBL2 -DBL2_HEADER_SIZE=0x400 -DBL2_TRAILER_SIZE=0x10400 -DDAUTH_CHIP_DEFAULT -DLOG_LEVEL=LOG_LEVEL_NONE -DLOG_LEVEL_UNPRIV=LOG_LEVEL_NONE -DMAX_KEYS_PER_IMAGE=1 -DMCUBOOT_BUILTIN_KEY -DMCUBOOT_FIH_PROFILE_OFF -DMCUBOOT_IMAGE_NUMBER=2 -DMCUBOOT_OVERWRITE_ONLY -DMCUBOOT_ROTPK_HASH_ALG=RSE_ROTPK_HASH_ALG_SHA256 -DMCUBOOT_SIGN_EC256 -DMCUBOOT_USE_PSA_CRYPTO -DOTP_WRITEABLE -DPLATFORM_DEFAULT_BL1 -DPLATFORM_DEFAULT_MEASUREMENT_SLOTS -DPLATFORM_DEFAULT_NV_COUNTERS -DPLATFORM_DEFAULT_OTP -DPLATFORM_DEFAULT_ROTPK -DPLATFORM_NS_NV_COUNTERS=0 -DPS_AES_KEY_USAGE_LIMIT=0 -DPS_CRYPTO_AEAD_ALG_GCM -DPS_ENCRYPTION -DPS_ROLLBACK_PROTECTION=1 -DTFM_DUMMY_PROVISIONING -DTFM_PARTITION_NS_AGENT_TZ -DTF_PSA_CRYPTO_CONFIG_FILE=\"/home/gilpes01/z/dev/os/trusted-firmware-m/bl2/ext/mcuboot/config/mcuboot_crypto_config.h\" -I/home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core -I/home/gilpes01/z/dev/crypto/TF-PSA-Crypto/include -I/home/gilpes01/z/dev/crypto/TF-PSA-Crypto/dispatch -I/home/gilpes01/z/dev/crypto/TF-PSA-Crypto/utilities -I/home/gilpes01/z/dev/crypto/TF-PSA-Crypto/drivers/builtin/include -I/home/gilpes01/z/dev/crypto/TF-PSA-Crypto/drivers/builtin/src -I/home/gilpes01/z/dev/os/trusted-firmware-m/bl2/ext/mcuboot/include -I/home/gilpes01/_/os/mcuboot/boot/bootutil/include -I/home/gilpes01/z/dev/os/trusted-firmware-m/bl2/ext/mcuboot/config -I/home/gilpes01/z/dev/os/trusted-firmware-m/build-an521-atfe/bl2/ext/mcuboot -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/ext/target/arm/mps2/an521/partition -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/ext/target/arm/mps2/an521/cmsis_core -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/ext/target/arm/mps2/an521/retarget -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/ext -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/ext/common -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/ext/driver -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/include -I/home/gilpes01/z/dev/os/trusted-firmware-m/lib/fih/inc -I/home/gilpes01/z/dev/os/trusted-firmware-m/config -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/include -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/partitions/crypto -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/partitions/firmware_update -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/partitions/initial_attestation -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/partitions/internal_trusted_storage -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/partitions/platform -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/partitions/protected_storage -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/spm/include -I/home/gilpes01/z/dev/os/trusted-firmware-m/build-an521-atfe/generated/interface/include -I/home/gilpes01/_/dev/c/CMSIS_6/CMSIS/Core/Include -I/home/gilpes01/_/dev/c/CMSIS_6/CMSIS/Core/Include/m-profile -I/home/gilpes01/_/dev/c/CMSIS_6/CMSIS/Driver/Include -I/home/gilpes01/z/dev/os/trusted-firmware-m/lib/tfm_log/inc -I/home/gilpes01/z/dev/os/trusted-firmware-m/lib/tfm_vprintf/inc -I/home/gilpes01/z/dev/os/trusted-firmware-m/lib/tfm_helper_lib/. -I/home/gilpes01/z/dev/os/trusted-firmware-m/interface/include -Os -DNDEBUG -std=gnu11 -mcpu=cortex-m33+nodsp+nofp -fdiagnostics-color=always -Wno-ignored-optimization-argument -Wno-unused-command-line-argument -Wall -Wno-error=cpp -fdata-sections -ffunction-sections -fno-builtin -funsigned-char -fno-exceptions -fno-rtti -fmacro-prefix-map=/home/gilpes01/z/dev/os/= -fmacro-prefix-map=/home/gilpes01/z/dev/os/trusted-firmware-m/= -meabi gnu -g -mfloat-abi=soft -mfpu=none -Wno-unused-value -include /home/gilpes01/z/dev/os/trusted-firmware-m/platform/include/cmsis_override.h -MD -MT bl2/CMakeFiles/bl2_crypto.dir/__/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.o -MF bl2/CMakeFiles/bl2_crypto.dir/__/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.o.d -o bl2/CMakeFiles/bl2_crypto.dir/__/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.o -c /home/gilpes01/z/dev/os/trusted-firmware-m/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.c
In file included from /home/gilpes01/z/dev/os/trusted-firmware-m/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.c:21:
In file included from /home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core/psa_crypto_driver_wrappers.h:12:
In file included from /home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core/tf_psa_crypto_common.h:33:
In file included from /home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core/alignment.h:16:
/home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:415:9: error: unknown type name '__errno_t'; did you mean '__ino_t'?
  415 | typedef __errno_t errno_t;
      |         ^
/home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/sys/_types.h:126:24: note: '__ino_t' declared here
  126 | typedef unsigned short __ino_t;
      |                        ^
In file included from /home/gilpes01/z/dev/os/trusted-firmware-m/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.c:21:
In file included from /home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core/psa_crypto_driver_wrappers.h:12:
In file included from /home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core/tf_psa_crypto_common.h:33:
In file included from /home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core/alignment.h:16:
/home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:420:9: error: unknown type name '__rsize_t'
  420 | typedef __rsize_t rsize_t;
      |         ^
/home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:425:60: error: unknown type name '__errno_t'; did you mean 'errno_t'?
  425 |                                      void *__restrict ptr, __errno_t error);
      |                                                            ^
/home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:415:19: note: 'errno_t' declared here
  415 | typedef __errno_t errno_t;
      |                   ^
/home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:429:22: error: unknown type name '__errno_t'; did you mean 'errno_t'?
  429 |                      __errno_t error);
      |                      ^
/home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:415:19: note: 'errno_t' declared here
  415 | typedef __errno_t errno_t;
      |                   ^
/home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:431:22: error: unknown type name '__errno_t'; did you mean 'errno_t'?
  431 |                      __errno_t error);
      |                      ^
/home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:415:19: note: 'errno_t' declared here
  415 | typedef __errno_t errno_t;
      |                   ^
/home/gilpes01/z/dev/os/trusted-firmware-m/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.c:648:13: warning: variable 'operation_mac_size' set but not used [-Wunused-but-set-variable]
  648 |     uint8_t operation_mac_size = 0;
      |             ^
1 warning and 5 errors generated.

This looks like a bug in the headers provided by the toolchain. Although it could be due to TF-M overriding some header with a local version, I don't know if this is happening.

I tried building and I'm getting a **compilation** error, not a link error. Is that what you get as well? ``` /home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/clang --target=arm-none-eabi -DBL2 -DBL2_HEADER_SIZE=0x400 -DBL2_TRAILER_SIZE=0x10400 -DDAUTH_CHIP_DEFAULT -DLOG_LEVEL=LOG_LEVEL_NONE -DLOG_LEVEL_UNPRIV=LOG_LEVEL_NONE -DMAX_KEYS_PER_IMAGE=1 -DMCUBOOT_BUILTIN_KEY -DMCUBOOT_FIH_PROFILE_OFF -DMCUBOOT_IMAGE_NUMBER=2 -DMCUBOOT_OVERWRITE_ONLY -DMCUBOOT_ROTPK_HASH_ALG=RSE_ROTPK_HASH_ALG_SHA256 -DMCUBOOT_SIGN_EC256 -DMCUBOOT_USE_PSA_CRYPTO -DOTP_WRITEABLE -DPLATFORM_DEFAULT_BL1 -DPLATFORM_DEFAULT_MEASUREMENT_SLOTS -DPLATFORM_DEFAULT_NV_COUNTERS -DPLATFORM_DEFAULT_OTP -DPLATFORM_DEFAULT_ROTPK -DPLATFORM_NS_NV_COUNTERS=0 -DPS_AES_KEY_USAGE_LIMIT=0 -DPS_CRYPTO_AEAD_ALG_GCM -DPS_ENCRYPTION -DPS_ROLLBACK_PROTECTION=1 -DTFM_DUMMY_PROVISIONING -DTFM_PARTITION_NS_AGENT_TZ -DTF_PSA_CRYPTO_CONFIG_FILE=\"/home/gilpes01/z/dev/os/trusted-firmware-m/bl2/ext/mcuboot/config/mcuboot_crypto_config.h\" -I/home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core -I/home/gilpes01/z/dev/crypto/TF-PSA-Crypto/include -I/home/gilpes01/z/dev/crypto/TF-PSA-Crypto/dispatch -I/home/gilpes01/z/dev/crypto/TF-PSA-Crypto/utilities -I/home/gilpes01/z/dev/crypto/TF-PSA-Crypto/drivers/builtin/include -I/home/gilpes01/z/dev/crypto/TF-PSA-Crypto/drivers/builtin/src -I/home/gilpes01/z/dev/os/trusted-firmware-m/bl2/ext/mcuboot/include -I/home/gilpes01/_/os/mcuboot/boot/bootutil/include -I/home/gilpes01/z/dev/os/trusted-firmware-m/bl2/ext/mcuboot/config -I/home/gilpes01/z/dev/os/trusted-firmware-m/build-an521-atfe/bl2/ext/mcuboot -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/ext/target/arm/mps2/an521/partition -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/ext/target/arm/mps2/an521/cmsis_core -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/ext/target/arm/mps2/an521/retarget -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/ext -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/ext/common -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/ext/driver -I/home/gilpes01/z/dev/os/trusted-firmware-m/platform/include -I/home/gilpes01/z/dev/os/trusted-firmware-m/lib/fih/inc -I/home/gilpes01/z/dev/os/trusted-firmware-m/config -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/include -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/partitions/crypto -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/partitions/firmware_update -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/partitions/initial_attestation -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/partitions/internal_trusted_storage -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/partitions/platform -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/partitions/protected_storage -I/home/gilpes01/z/dev/os/trusted-firmware-m/secure_fw/spm/include -I/home/gilpes01/z/dev/os/trusted-firmware-m/build-an521-atfe/generated/interface/include -I/home/gilpes01/_/dev/c/CMSIS_6/CMSIS/Core/Include -I/home/gilpes01/_/dev/c/CMSIS_6/CMSIS/Core/Include/m-profile -I/home/gilpes01/_/dev/c/CMSIS_6/CMSIS/Driver/Include -I/home/gilpes01/z/dev/os/trusted-firmware-m/lib/tfm_log/inc -I/home/gilpes01/z/dev/os/trusted-firmware-m/lib/tfm_vprintf/inc -I/home/gilpes01/z/dev/os/trusted-firmware-m/lib/tfm_helper_lib/. -I/home/gilpes01/z/dev/os/trusted-firmware-m/interface/include -Os -DNDEBUG -std=gnu11 -mcpu=cortex-m33+nodsp+nofp -fdiagnostics-color=always -Wno-ignored-optimization-argument -Wno-unused-command-line-argument -Wall -Wno-error=cpp -fdata-sections -ffunction-sections -fno-builtin -funsigned-char -fno-exceptions -fno-rtti -fmacro-prefix-map=/home/gilpes01/z/dev/os/= -fmacro-prefix-map=/home/gilpes01/z/dev/os/trusted-firmware-m/= -meabi gnu -g -mfloat-abi=soft -mfpu=none -Wno-unused-value -include /home/gilpes01/z/dev/os/trusted-firmware-m/platform/include/cmsis_override.h -MD -MT bl2/CMakeFiles/bl2_crypto.dir/__/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.o -MF bl2/CMakeFiles/bl2_crypto.dir/__/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.o.d -o bl2/CMakeFiles/bl2_crypto.dir/__/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.o -c /home/gilpes01/z/dev/os/trusted-firmware-m/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.c In file included from /home/gilpes01/z/dev/os/trusted-firmware-m/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.c:21: In file included from /home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core/psa_crypto_driver_wrappers.h:12: In file included from /home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core/tf_psa_crypto_common.h:33: In file included from /home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core/alignment.h:16: /home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:415:9: error: unknown type name '__errno_t'; did you mean '__ino_t'? 415 | typedef __errno_t errno_t; | ^ /home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/sys/_types.h:126:24: note: '__ino_t' declared here 126 | typedef unsigned short __ino_t; | ^ In file included from /home/gilpes01/z/dev/os/trusted-firmware-m/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.c:21: In file included from /home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core/psa_crypto_driver_wrappers.h:12: In file included from /home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core/tf_psa_crypto_common.h:33: In file included from /home/gilpes01/z/dev/crypto/TF-PSA-Crypto/core/alignment.h:16: /home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:420:9: error: unknown type name '__rsize_t' 420 | typedef __rsize_t rsize_t; | ^ /home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:425:60: error: unknown type name '__errno_t'; did you mean 'errno_t'? 425 | void *__restrict ptr, __errno_t error); | ^ /home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:415:19: note: 'errno_t' declared here 415 | typedef __errno_t errno_t; | ^ /home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:429:22: error: unknown type name '__errno_t'; did you mean 'errno_t'? 429 | __errno_t error); | ^ /home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:415:19: note: 'errno_t' declared here 415 | typedef __errno_t errno_t; | ^ /home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:431:22: error: unknown type name '__errno_t'; did you mean 'errno_t'? 431 | __errno_t error); | ^ /home/gilpes01/Packages/ATfE-21.1.1-Linux-x86_64/bin/../lib/clang-runtimes/arm-none-eabi/include/stdlib.h:415:19: note: 'errno_t' declared here 415 | typedef __errno_t errno_t; | ^ /home/gilpes01/z/dev/os/trusted-firmware-m/lib/ext/thin-psa-crypto-core/thin_psa_crypto_core.c:648:13: warning: variable 'operation_mac_size' set but not used [-Wunused-but-set-variable] 648 | uint8_t operation_mac_size = 0; | ^ 1 warning and 5 errors generated. ``` This looks like a bug in the headers provided by the toolchain. Although it could be due to TF-M overriding some header with a local version, I don't know if this is happening.
bjwtaylor commented 2026-04-30 02:14:56 -05:00 (Migrated from github.com)

Morning, no I didn't see this error. It seems it could be related to the same problem, though it's difficult to tell for sure as I can't reproduce it. There are a few differences in our builds, I'm not using the external tf-psa-crypto. Instead I'm using the internal one, with the patch removed. It's also possible and even likely it's down to the toolchain version, I'm using 22.1.0. Which was the latest when I built it. Whereas you're using 21.1.1, maybe try upgrading and see if it gets further?

Morning, no I didn't see this error. It seems it could be related to the same problem, though it's difficult to tell for sure as I can't reproduce it. There are a few differences in our builds, I'm not using the external tf-psa-crypto. Instead I'm using the internal one, with the patch removed. It's also possible and even likely it's down to the toolchain version, I'm using 22.1.0. Which was the latest when I built it. Whereas you're using 21.1.1, maybe try upgrading and see if it gets further?
bjwtaylor commented 2026-05-01 05:25:07 -05:00 (Migrated from github.com)

@gilles-peskine-arm for when you get a minute, as far as I can see there are two potentially useful ways to solve this issue in addition to the current TF-M approach
of removing the function, which I think we've agreed to discount.

  1. TF-M could use the libc provided by ATfE, or another libc library, when linking tf-psa-crypto.

    This is probably technically the better solution, as it should be more future-proof: libc changes would be maintained upstream rather than in TF-M. The issue is
    that the ATfE libc is likely too large for TF-M, which is presumably why it was avoided in the first place. It may be possible to find another smaller libc
    implementation, though that would require some additional research.

    Reinstating the original libc is a fairly simple patch:

    diff --git a/bl2/CMakeLists.txt b/bl2/CMakeLists.txt
index e18044b9b..b71071b74 100644
--- a/bl2/CMakeLists.txt
+++ b/bl2/CMakeLists.txt
@@ -133,6 +133,23 @@ target_link_libraries(bl2_crypto
         bl2_crypto_config
 )

+if (CMAKE_C_COMPILER_ID STREQUAL "Clang" AND NOT CONFIG_TFM_INCLUDE_STDLIBC)
+    # ATfE's libc provides memset_s(), which TF-PSA-Crypto uses when the
+    # toolchain advertises C11 bounds-checking interfaces. The BL2 link still
+    # keeps -nostdlib, so add libc explicitly and keep the existing TF-M stubs
+    # for allocator/exit symbols that also exist in libc.
+    target_link_libraries(bl2_crypto
+        INTERFACE
+            c
+    )
+
+    target_link_options(bl2_crypto
+        INTERFACE
+            LINKER:--allow-multiple-definition
+            LINKER:--defsym,_exit=exit
+    )
+endif()
+
 string(TOLOWER "${CMAKE_BUILD_TYPE}" BUILD_TYPE_LOWER)
 # IAR only allows 1 optimization option for the compilation unit
 if (${BUILD_TYPE_LOWER} STREQUAL "debug" AND NOT ${CMAKE_C_COMPILER_ID} STREQUAL "IAR")

  2. TF-M is already stubbing out a number of libc functions in bl2/src/mbedcrypto_stubs.c and linking this with tf-psa-crypto.

    They could extend this file with something like:

    diff --git a/bl2/src/mbedcrypto_stubs.c b/bl2/src/mbedcrypto_stubs.c
index 391e36b40..01dc1281e 100644
--- a/bl2/src/mbedcrypto_stubs.c
+++ b/bl2/src/mbedcrypto_stubs.c
@@ -11,6 +11,21 @@
 #include <assert.h>
 #include <stdlib.h>

+int memset_s(void *s, size_t smax, int c, size_t n)
+{
+    volatile unsigned char *p = (volatile unsigned char *)s;
+
+    if (s == NULL || n > smax) {
+        return 1;
+    }
+
+    while (n--) {
+        *p++ = (unsigned char)c;
+    }
+
+    return 0;
+}
+
 void *calloc(size_t nmemb, size_t size)
 {
     assert(!"not implemented");

    This would provide an internal implementation of the missing function. It is a fairly simple change and should maintain the current code size. The downside is
    that the long-term maintenance burden would then be on TF-M. They could also link in another internal version of memset_s if they already have one.

This assumes that we keep the TF-PSA-Crypto code as-is and do not remove use of the relevant functions. Since I think we are leaning towards rejecting the original
proposal, I think that is a reasonable assumption.

@gilles-peskine-arm for when you get a minute, as far as I can see there are two potentially useful ways to solve this issue in addition to the current TF-M approach of removing the function, which I think we've agreed to discount. 1. TF-M could use the libc provided by ATfE, or another libc library, when linking `tf-psa-crypto`. This is probably technically the better solution, as it should be more future-proof: libc changes would be maintained upstream rather than in TF-M. The issue is that the ATfE libc is likely too large for TF-M, which is presumably why it was avoided in the first place. It may be possible to find another smaller libc implementation, though that would require some additional research. Reinstating the original libc is a fairly simple patch: ```diff diff --git a/bl2/CMakeLists.txt b/bl2/CMakeLists.txt index e18044b9b..b71071b74 100644 --- a/bl2/CMakeLists.txt +++ b/bl2/CMakeLists.txt @@ -133,6 +133,23 @@ target_link_libraries(bl2_crypto bl2_crypto_config ) +if (CMAKE_C_COMPILER_ID STREQUAL "Clang" AND NOT CONFIG_TFM_INCLUDE_STDLIBC) + # ATfE's libc provides memset_s(), which TF-PSA-Crypto uses when the + # toolchain advertises C11 bounds-checking interfaces. The BL2 link still + # keeps -nostdlib, so add libc explicitly and keep the existing TF-M stubs + # for allocator/exit symbols that also exist in libc. + target_link_libraries(bl2_crypto + INTERFACE + c + ) + + target_link_options(bl2_crypto + INTERFACE + LINKER:--allow-multiple-definition + LINKER:--defsym,_exit=exit + ) +endif() + string(TOLOWER "${CMAKE_BUILD_TYPE}" BUILD_TYPE_LOWER) # IAR only allows 1 optimization option for the compilation unit if (${BUILD_TYPE_LOWER} STREQUAL "debug" AND NOT ${CMAKE_C_COMPILER_ID} STREQUAL "IAR") ``` 2. TF-M is already stubbing out a number of libc functions in `bl2/src/mbedcrypto_stubs.c` and linking this with `tf-psa-crypto`. They could extend this file with something like: ```diff diff --git a/bl2/src/mbedcrypto_stubs.c b/bl2/src/mbedcrypto_stubs.c index 391e36b40..01dc1281e 100644 --- a/bl2/src/mbedcrypto_stubs.c +++ b/bl2/src/mbedcrypto_stubs.c @@ -11,6 +11,21 @@ #include <assert.h> #include <stdlib.h> +int memset_s(void *s, size_t smax, int c, size_t n) +{ + volatile unsigned char *p = (volatile unsigned char *)s; + + if (s == NULL || n > smax) { + return 1; + } + + while (n--) { + *p++ = (unsigned char)c; + } + + return 0; +} + void *calloc(size_t nmemb, size_t size) { assert(!"not implemented"); ``` This would provide an internal implementation of the missing function. It is a fairly simple change and should maintain the current code size. The downside is that the long-term maintenance burden would then be on TF-M. They could also link in another internal version of `memset_s` if they already have one. This assumes that we keep the TF-PSA-Crypto code as-is and do not remove use of the relevant functions. Since I think we are leaning towards rejecting the original proposal, I think that is a reasonable assumption.
bjwtaylor commented 2026-06-04 03:48:23 -05:00 (Migrated from github.com)

@bensze01 did you get a chance to talk to the RSE team in Budpest about this one?

@bensze01 did you get a chance to talk to the RSE team in Budpest about this one?
bensze01 commented 2026-06-04 03:50:59 -05:00 (Migrated from github.com)

Yes, there was some discussion on slack about how to proceed with fixing this bug.

Yes, there was some discussion on slack about how to proceed with fixing this bug.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
development
tf-psa-crypto-1.1
archive/20261005T153337Z-force/pull/927
archive/20261001T141055Z-force/pull/927
archive/20261005T153337Z-force/pull/931
archive/20261001T083616Z-force/pull/927
archive/20260930T232327Z-force/pull/927
archive/20260930T154618Z-force/pull/927
archive/20260929T231919Z-rescue/rohankl-arm/mldsa-pubkey-899
archive/20260929T231919Z-rescue/sigvartmh/pr/spake2p-9342-public-key-import-export
archive/20260929T231919Z-rescue/ManoharPaturi/fix-pem-ct-padding
archive/20260929T231919Z-rescue/ManoharPaturi/fix-asn1write-null-guard
archive/20260929T231919Z-rescue/ManoharPaturi/fix-pbes2-params-validation
archive/20260929T231919Z-rescue/valeriosetti/blake2
archive/20260929T231919Z-rescue/jfdev001/v1.1.1_bump-cmake-minimum-version
archive/20260929T231919Z-rescue/jfdev001/bump-cmake-minimum-version
archive/20260929T231919Z-rescue/ronald-cron-arm/sm3-base
archive/20260929T231919Z-rescue/valeriosetti/blake2-hmac
archive/20260929T231919Z-rescue/v1rtu3x/enforce-hash-length-sign-verify
archive/20260929T231919Z-rescue/bjwtaylor/file-backed-keystore-doc
archive/20260929T231919Z-rescue/sigvartmh/pr/spake2p-9344-set-context
archive/20260929T231919Z-rescue/sigvartmh/pr/spake2p-9343-key-pair-import-export-depends-on-9342
archive/20260929T231919Z-rescue/romart/development
archive/20260929T231919Z-rescue/sweetlilmre/constant-time-embedded-perf
archive/20260929T231919Z-rescue/JulioLoayzaM/add-wycheproof-rsa-pss
archive/20260929T231919Z-rescue/JulioLoayzaM/add-wycheproof-ecdsa
archive/20260929T231919Z-rescue/JulioLoayzaM/add-wycheproof-tests
archive/20260929T231919Z-rescue/oubaid-a/dev_psa_driver_wrapper
archive/20260929T231919Z-rescue/gilles-peskine-arm/keystoreless-prototype-1
archive/20260929T231919Z-rescue/valeriosetti/issue9580
archive/20260929T231919Z-rescue/LeonieReichertABB/hpke-functionality
archive/20260929T231919Z-rescue/gilles-peskine-arm/psa-hash-no-buffer-copy-1.1
archive/20260929T231919Z-rescue/vanhauser-thc/development
archive/20260929T231919Z-rescue/tpambor/key-wrap
archive/20260929T231919Z-rescue/ruiliio/psa_xts
archive/20261011T063515Z-force/pull/538
archive/20260929T231919Z-rescue/gilles-peskine-arm/fix-broken-links-1.1
archive/20260929T231919Z-rescue/valeriosetti/issue669
archive/20260929T231919Z-rescue/gilles-peskine-arm/prepare-release-test
archive/20260929T231919Z-rescue/krish2718/wpa3-sae-design-note
archive/20260929T231919Z-rescue/nzzlinh/fix_iar_endianness_1.1
archive/20260929T231919Z-rescue/nzzlinh/fix-iar-endianness
archive/20260929T231919Z-rescue/abtom87/fix-pbkdf2-iter-count
archive/20260929T231919Z-rescue/minosgalanakis/tools/prepare_release_lite
archive/20260929T231919Z-rescue/Harshal5/fix/aes-xts-in-place-cts
archive/20260929T231919Z-rescue/sigvartmh/pr/spake2p-9347-prover-depends-on-9342-9343-9344
archive/20260929T231919Z-rescue/crabel99/async-hardware-support-c35df962
tf-psa-crypto-1.2.0_mergeback
tf-psa-crypto-1.1.1_mergeback
archive/20260929T231919Z-rescue/asmellby/feature/dispatch-library
tf-psa-crypto-release-sync
archive/20260929T231919Z-rescue/ChakshuGupta13/fix/ecdsa-zeroize-stack-key
archive/20260929T231919Z-rescue/gilles-peskine-arm/security-md-option-names
archive/20260929T231919Z-rescue/parmi93/patch-2
archive/20260929T231919Z-rescue/bjwtaylor/remove-mldsa-sign-from-build
archive/20260929T231919Z-rescue/bjwtaylor/tf-m-build-issues
archive/20260929T231919Z-rescue/bjwtaylor/test-context-population
archive/20260929T231919Z-rescue/gilles-peskine-arm/iar-1.1.0
archive/20260929T231919Z-rescue/gilles-peskine-arm/fork-helper-unit-tests-create-crypto
archive/20260929T231919Z-rescue/bjwtaylor/redundant-declarations
archive/20260929T231919Z-rescue/hasheddan/docs/fix-broken-links
main
archive/20260929T231919Z-rescue/bjwtaylor/reintroduce-dh
archive/20260929T231919Z-rescue/bjwtaylor/cipher-update-incorrect-error
archive/20260929T231919Z-rescue/Marandil/fix/mbedtls-4314-parse-explicit-curve
archive/20260929T231919Z-rescue/schneider-electric/dev/plaj-se/parse-rsassa-pss
archive/20260929T231919Z-rescue/minosgalanakis/bugfix/program-fuzz-mscv
archive/20260929T231919Z-rescue/daverodgman/aesgcm
archive/20260929T231919Z-rescue/gilles-peskine-arm/sha3-coverity-20260224
archive/20260929T231919Z-rescue/bensze01/undef
archive/20260929T231919Z-rescue/valeriosetti/issue523
archive/20260929T231919Z-rescue/dannytsen/ppc-dev
archive/20260929T231919Z-rescue/daverodgman/aes12
archive/20260929T231919Z-rescue/gilles-peskine-arm/ascon-prototype
archive/20260929T231919Z-rescue/daverodgman/chacha10
archive/20260929T231919Z-rescue/kusumitg/implement_psa_pake_set_context_for_spake2p
archive/20260929T231919Z-rescue/davidhorstmann-arm/add-code-size-target
archive/20260929T231919Z-rescue/bjwtaylor/simplify-sign_func
archive/20260929T231919Z-rescue/mfil/feature/aes_ni_parallel
archive/20260929T231919Z-rescue/ivv19041994/patch-1
archive/20260929T231919Z-rescue/gilles-peskine-arm/psa-verify-policy-relax
public_2/main
archive/20260929T231919Z-rescue/mpg/pk-sign-proto
release/tf-psa-crypto1.0.0-documentation
archive/20260929T231919Z-rescue/gilles-peskine-arm/0e-plans-july-updates
archive/20260929T231919Z-rescue/davidhorstmann-arm/guard-context-types-in-client-only
archive/20260929T231919Z-rescue/gilles-peskine-arm/psa-driver-interface-spec-remove
archive/20260929T231919Z-rescue/gilles-peskine-arm/ecp-self-test-race-crypto
archive/20260929T231919Z-rescue/KiruthikPrakash/feature/9342_add-support-for-spake2p-public-key-import-export
archive/20260929T231919Z-rescue/ruiliio/chacha20_16
archive/20260929T231919Z-rescue/irwir/winsock2
archive/20260929T231919Z-rescue/aphroteus/development
archive/20260929T231919Z-rescue/amjoul01/amjoul01/psa-mac-out-of-bound-fix
archive/20260929T231919Z-rescue/gilles-peskine-arm/everest-submodule-crypto
archive/20260929T231919Z-rescue/yamt/xtensa-ccount
archive/20260929T231919Z-rescue/gilles-peskine-arm/all.sh-generate-only-before-checks-crypto
archive/20260929T231919Z-rescue/Harshal5/feat/builtin_cmac_driver_use_psa_crypto_interface
archive/20260929T231919Z-rescue/gilles-peskine-arm/test-data_t-empty_is_empty-crypto
archive/20260929T231919Z-rescue/jean-baptisteboric-eaton/oids-pkcs7-authenticated-attributes
dev/bensze01/public-only-commit
archive/20260929T231919Z-rescue/waleed-elmelegy-arm/psa-key-wrap-aes-kw
archive/20260929T231919Z-rescue/tfloch/psa_add_xts_algorithm
archive/20260929T231919Z-rescue/gilles-peskine-arm/msancf-clang16-crypto
archive/20260929T231919Z-rescue/DemiMarie/document-unexpected-tags
archive/20260929T231919Z-rescue/DemiMarie/strict-len
archive/20260929T231919Z-rescue/valeriosetti/issue9255-tfpsacrypto
archive/20260929T231919Z-rescue/daantimmer/use-compiler-frontend
archive/20260929T231919Z-rescue/benmcollins/enable-rsassa-pss-pkparse
dev/paul-elliott-arm/add_iop_key_agreement_negative_tests
add-iop-export-pub-key-get-num-ops
dev/rc/new-2-d635ea1
dev/bensze01/jenkins
v1.2.0
tf-psa-crypto-1.2.0
v1.1.1
tf-psa-crypto-1.1.1
v1.1.0
tf-psa-crypto-1.1.0
v1.0.0
tf-psa-crypto-1.0.0
v1.0.0-beta
tf-psa-crypto-1.0.0-beta
Labels
Clear labels   
api-break
This issue/PR breaks the API and must wait for a new major version

  
approved
Design and code approved - may be waiting for CI or backports

  
bug
Something isn't working

  
component-docs
Docs / website issues filed here for tracking

  
component-platform
Portability layer and build scripts

  
component-test
Test framework and CI scripts

  
dependencies
Pull requests that update a dependency file

  
deprecation
needs deprecation announcement

  
DO-NOT-MERGE

   
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
This issue is not being actively worked on, but PRs welcome.

  
needs-adoption
stalled PR that someone should pick up and complete

  
needs-backports
Backports are missing or are pending review and approval.

  
needs-ci
Needs to pass CI tests

  
needs-design-approval
Needs design discussion / approval

  
needs-info
An issue or PR which needs further info from the reporter / author

  
needs-preceding-pr
Requires another PR to be merged first

  
needs-review
Every commit must be reviewed by at least two team members

  
needs-reviewer
This PR needs someone to pick it up for review

  
needs-work

   
priority-high
High priority - will be reviewed soon

  
priority-low
Low priority - this may not receive review soon

  
priority-medium
Medium priority - this can be reviewed as time permits

  
priority-scheduled
This PR is big - it will require time to be scheduled for review

  
priority-very-high
Highest priority - prioritise this over other review work

  
resolved-after-1.1
The issue is resolved in development, but still present in 1.1 LTS.

  
single-reviewer
This PR qualifies for having only one reviewer

  
size-l
Estimated task size: large (2w+)

  
size-m
Estimated task size: medium (~1w)

  
size-optimisation

   
size-s
Estimated task size: small (~2d)

  
size-xs
Estimated task size: extra small (a few hours at most)

No labels
api-break
approved
bug
component-docs
component-platform
component-test
dependencies
deprecation
DO-NOT-MERGE
enhancement
good first issue
help wanted
needs-adoption
needs-backports
needs-ci
needs-design-approval
needs-info
needs-preceding-pr
needs-review
needs-reviewer
needs-work
priority-high
priority-low
priority-medium
priority-scheduled
priority-very-high
resolved-after-1.1
single-reviewer
size-l
size-m
size-optimisation
size-s
size-xs
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
gh-Mbed-TLS/TF-PSA-Crypto#754
No description provided.