tf-m: Add Attestation support for nRF54L15 #19040

hellesvik-nordic · 2024-11-22T15:11:12Z

Add support for PSA Attestation to the nRF54L15. Includes noup changes to TF-M repository.

Ref: NCSDK-22598

NordicBuilder · 2024-11-22T15:11:48Z

The following west manifest projects have been modified in this Pull Request:

Name	Old Revision	New Revision	Diff
trusted-firmware-m	nrfconnect/sdk-trusted-firmware-m@`82e7763` (main)	nrfconnect/sdk-trusted-firmware-m#180	nrfconnect/sdk-trusted-firmware-m#180/files

Note: This message is automatically posted and updated by the Manifest GitHub Action.

NordicBuilder · 2024-11-22T15:26:28Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 3

Inputs:

Sources:

trusted-firmware-m: PR head: 9c1a5ad73e1b98a3f50b22743ac7bb848f52c504
sdk-nrf: PR head: fce97d0ff1b58bc1d0809642a770ce5bbce6b259

more details

trusted-firmware-m:

PR head: 9c1a5ad73e1b98a3f50b22743ac7bb848f52c504
merge base: cc9a53fcda91d60ee67297beebbc4daf0fde4e13
target head (main): 82e7763eba112a350d58dd52dc39f340a291ffd0
Diff

sdk-nrf:

PR head: fce97d0ff1b58bc1d0809642a770ce5bbce6b259
merge base: a07b87c923420fdbfbdbff3698a3d30f5c1c33ee
target head (main): a07b87c923420fdbfbdbff3698a3d30f5c1c33ee
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (19)

modules
│  ├── tee
│  │  ├── tf-m
│  │  │  ├── trusted-firmware-m
│  │  │  │  ├── config
│  │  │  │  │  │ config_base.cmake
│  │  │  │  ├── docs
│  │  │  │  │  ├── integration_guide
│  │  │  │  │  │  ├── services
│  │  │  │  │  │  │  │ tfm_attestation_integration_guide.rst
│  │  │  │  ├── lib
│  │  │  │  │  ├── ext
│  │  │  │  │  │  ├── t_cose
│  │  │  │  │  │  │  ├── crypto_adapters
│  │  │  │  │  │  │  │  │ t_cose_psa_crypto.c
│  │  │  │  │  │  │  ├── inc
│  │  │  │  │  │  │  │  │ t_cose_common.h
│  │  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  │  ├── t_cose_crypto.h
│  │  │  │  │  │  │  │  │ t_cose_sign1_sign.c
│  │  │  │  │  │  │  ├── test
│  │  │  │  │  │  │  │  │ t_cose_make_test_messages.c
│  │  │  │  │  │  │  │ tfm_t_cose.cmake
│  │  │  │  ├── secure_fw
│  │  │  │  │  ├── partitions
│  │  │  │  │  │  ├── initial_attestation
│  │  │  │  │  │  │  ├── Kconfig
│  │  │  │  │  │  │  │ attest_token_encode.c
│  ├── trusted-firmware-m
│  │  ├── Kconfig.tfm.defconfig
│  │  ├── tfm_boards
│  │  │  ├── CMakeLists.txt
│  │  │  ├── common
│  │  │  │  │ attest_hal.c
│  │  │  ├── nrf54l15_cpuapp
│  │  │  │  │ config.cmake
│  │  │ tfm_config.h.in
samples
│  ├── tfm
│  │  ├── tfm_psa_template
│  │  │  ├── boards
│  │  │  │  │ nrf54l15dk_nrf54l15_cpuapp_ns.conf
│  │  │  ├── sysbuild
│  │  │  │  ├── mcuboot
│  │  │  │  │  ├── boards
│  │  │  │  │  │  │ nrf54l15dk_nrf54l15_cpuapp.conf
subsys
│  ├── bootloader
│  │  ├── bl_storage
│  │  │  │ Kconfig
west.yml

Outputs:

Toolchain

Version:
Build docker image:

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

🟠 Toolchain
🟠 Build twister
🟠 Integration tests
- 🟠 test-fw-nrfconnect-boot
- 🟠 test-fw-nrfconnect-chip
- 🟠 test-fw-nrfconnect-nrf_crypto
- 🟠 test-fw-nrfconnect-tfm
- 🟠 test-fw-nrfconnect-zigbee
- 🟠 test-sdk-find-my
- 🟠 test-sdk-sidewalk
- 🟠 test-sdk-mcuboot
- ⚠️ test-fw-nrfconnect-fw-update
- ⚠️ test-fw-nrfconnect-nrf-iot_cloud

Disabled integration tests

- desktop52_verification
- doc-internal
- test_ble_nrf_config
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_mosh
- test-fw-nrfconnect-nrf-iot_nrf_provisioning
- test-fw-nrfconnect-nrf-iot_positioning
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_serial_lte_modem
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-ps
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-rs
- test-fw-nrfconnect-thread
- test-low-level
- test-sdk-audio
- test-sdk-dfu
- test-sdk-pmic-samples
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

Add support for PSA Attestation to the nRF54L15. Includes noup changes to TF-M repository. Ref: NCSDK-22598 Signed-off-by: Sigurd Hellesvik <[email protected]>

hellesvik-nordic · 2024-11-22T15:18:16Z

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

+	memcpy(buf,boot_seed, sizeof(uint8_t) * 32);
+#else
+	return TFM_PLAT_ERR_SYSTEM_ERR;
+#endif


My gut feeling says there must be a better way to do this. @frkv do you have any thoughts?

Build failure. #error

hellesvik-nordic · 2024-11-22T15:31:28Z

modules/trusted-firmware-m/tfm_boards/CMakeLists.txt

@@ -115,7 +115,7 @@ if (${TFM_PARTITION_CRYPTO})
    tfm_sprt
  )

-  if (${TFM_PARTITION_INITIAL_ATTESTATION})
+  if ((${TFM_PARTITION_INITIAL_ATTESTATION}) AND CONFIG_IDENTITY_KEY)


This will not work for other nRF SoCs.
Would it be better to do "if 5340 or 9160 or etc etc"?
Or to define an TFM_IDENTITY_KEY and then set that inside tfm_boards for each of the boards that use this?

To me it makes sense to use a more generic Kconfig option rather than explicitly naming the affected SOCs. The list will likely change over time, so it's nice to not have a bunch of if SOC_X [...] all over.

NordicBuilder · 2024-11-22T15:46:47Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publish GitHub Action.

hellesvik-nordic · 2024-11-25T08:02:11Z

samples/tfm/tfm_psa_template/boards/nrf54l15dk_nrf54l15_cpuapp_ns.conf

@@ -0,0 +1,13 @@
+CONFIG_TFM_NRF_PROVISIONING=n
+CONFIG_TFM_DUMMY_PROVISIONING=y


I should enable nrf_provisioning

tomi-font · 2024-11-25T08:07:11Z

subsys/bootloader/bl_storage/Kconfig

@@ -6,4 +6,4 @@

 config SECURE_BOOT_STORAGE
 	bool "Library for accessing the bootloader storage"
-	select NRFX_RRAMC if SOC_SERIES_NRF54LX
+	select NRFX_RRAMC if SOC_SERIES_NRF54LX && !TRUSTED_EXECUTION_NONSECURE


Is this still needed as you guarded select SECURE_BOOT_STORAGE with if !TRUSTED_EXECUTION_NONSECURE?
(I don't know about this so I can't tell whether or not it makes sense to have this here. Maybe even the whole SECURE_BOOT_STORAGE Kconfig option should depend on !TRUSTED_EXECUTION_NONSECURE?)

tomi-font · 2024-11-25T08:39:55Z

modules/trusted-firmware-m/Kconfig.tfm.defconfig

@@ -66,7 +66,7 @@ config TFM_PARTITION_INITIAL_ATTESTATION
 	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT
 	select PSA_WANT_ALG_ECDSA
 	select PSA_WANT_ECC_SECP_R1_256
-	select SECURE_BOOT_STORAGE
+	select SECURE_BOOT_STORAGE if !TRUSTED_EXECUTION_NONSECURE


Suggested change

select SECURE_BOOT_STORAGE if !TRUSTED_EXECUTION_NONSECURE

select SECURE_BOOT_STORAGE if TRUSTED_EXECUTION_SECURE

?

tomi-font · 2024-11-25T08:41:50Z

modules/trusted-firmware-m/tfm_boards/CMakeLists.txt

@@ -115,7 +115,7 @@ if (${TFM_PARTITION_CRYPTO})
    tfm_sprt
  )

-  if (${TFM_PARTITION_INITIAL_ATTESTATION})
+  if ((${TFM_PARTITION_INITIAL_ATTESTATION}) AND CONFIG_IDENTITY_KEY)


To me it makes sense to use a more generic Kconfig option rather than explicitly naming the affected SOCs. The list will likely change over time, so it's nice to not have a bunch of if SOC_X [...] all over.

tomi-font · 2024-11-25T08:58:06Z

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

 #include <bl_storage.h>

+


Suggested change

tomi-font · 2024-11-25T08:59:29Z

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

@@ -132,7 +143,15 @@ enum tfm_plat_err_t tfm_plat_get_boot_seed(uint32_t size, uint8_t *buf)
 	if (nrf_err != NRF_CC3XX_PLATFORM_SUCCESS) {
 		return TFM_PLAT_ERR_SYSTEM_ERR;
 	}
-
+#elif defined(CONFIG_PSA_NEED_CRACEN_KMU_DRIVER)


Please use the same macro when defining and using the boot_seed variables.

tomi-font · 2024-11-25T09:00:18Z

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

-
+#elif defined(CONFIG_PSA_NEED_CRACEN_KMU_DRIVER)
+	if (!boot_seed_set) {
+		psa_generate_random(boot_seed, 32);


Suggested change

psa_generate_random(boot_seed, 32);

psa_generate_random(boot_seed, sizeof(boot_seed));

tomi-font · 2024-11-25T09:19:34Z

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

+#elif defined(CONFIG_PSA_NEED_CRACEN_KMU_DRIVER)
+	if (!boot_seed_set) {
+		psa_generate_random(boot_seed, 32);
+		boot_seed_set = 1;


Suggested change

boot_seed_set = 1;

boot_seed_set = true;

tomi-font · 2024-11-25T09:21:04Z

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

+		psa_generate_random(boot_seed, 32);
+		boot_seed_set = 1;
+	}
+	memcpy(buf, boot_seed, sizeof(uint8_t) * 32);


Suggested change

memcpy(buf, boot_seed, sizeof(uint8_t) * 32);

memcpy(buf, boot_seed, size);

maybe?

tomi-font · 2024-11-25T09:21:35Z

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

+	memcpy(buf,boot_seed, sizeof(uint8_t) * 32);
+#else
+	return TFM_PLAT_ERR_SYSTEM_ERR;
+#endif


Build failure. #error

tomi-font · 2024-11-25T09:25:09Z

modules/trusted-firmware-m/tfm_boards/nrf54l15_cpuapp/config.cmake

+set(CONFIG_NRFX_RRAMC                ON          CACHE BOOL      "Enable nrfx drivers for RRAMC")
+add_compile_definitions(CONFIG_NRFX_RRAMC)


Hmm, we are already using a very minimal homemade RRAMC driver in TF-M. What are you doing this for exactly?
(Also the add_compile_definitions() line seems a bit weird, why is it needed?)

hellesvik-nordic requested review from a team as code owners November 22, 2024 15:11

NordicBuilder added manifest manifest-trusted-firmware-m DNM labels Nov 22, 2024

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Nov 22, 2024

hellesvik-nordic force-pushed the nrf54l15_attestation branch from 2235121 to 716c951 Compare November 22, 2024 15:15

tf-m: Add Attestation support for nRF54L15

fce97d0

Add support for PSA Attestation to the nRF54L15. Includes noup changes to TF-M repository. Ref: NCSDK-22598 Signed-off-by: Sigurd Hellesvik <[email protected]>

hellesvik-nordic force-pushed the nrf54l15_attestation branch from 716c951 to fce97d0 Compare November 22, 2024 15:27

hellesvik-nordic commented Nov 22, 2024

View reviewed changes

hellesvik-nordic commented Nov 25, 2024

View reviewed changes

tomi-font reviewed Nov 25, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tf-m: Add Attestation support for nRF54L15 #19040

tf-m: Add Attestation support for nRF54L15 #19040

hellesvik-nordic commented Nov 22, 2024

NordicBuilder commented Nov 22, 2024

NordicBuilder commented Nov 22, 2024 •

edited

Loading

hellesvik-nordic Nov 22, 2024

tomi-font Nov 25, 2024

hellesvik-nordic Nov 22, 2024

tomi-font Nov 25, 2024

NordicBuilder commented Nov 22, 2024

hellesvik-nordic Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

		@@ -0,0 +1,13 @@
		CONFIG_TFM_NRF_PROVISIONING=n
		CONFIG_TFM_DUMMY_PROVISIONING=y

	select SECURE_BOOT_STORAGE if !TRUSTED_EXECUTION_NONSECURE
	select SECURE_BOOT_STORAGE if TRUSTED_EXECUTION_SECURE

	psa_generate_random(boot_seed, 32);
	psa_generate_random(boot_seed, sizeof(boot_seed));

	memcpy(buf, boot_seed, sizeof(uint8_t) * 32);
	memcpy(buf, boot_seed, size);

		set(CONFIG_NRFX_RRAMC ON CACHE BOOL "Enable nrfx drivers for RRAMC")
		add_compile_definitions(CONFIG_NRFX_RRAMC)

tf-m: Add Attestation support for nRF54L15 #19040

Are you sure you want to change the base?

tf-m: Add Attestation support for nRF54L15 #19040

Conversation

hellesvik-nordic commented Nov 22, 2024

NordicBuilder commented Nov 22, 2024

NordicBuilder commented Nov 22, 2024 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

NordicBuilder commented Nov 22, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

NordicBuilder commented Nov 22, 2024 •

edited

Loading