tf-m: Add Attestation support for nRF54L15 #19040

hellesvik-nordic · 2024-11-22T15:11:12Z

Add support for PSA Attestation to the nRF54L15. Includes noup changes to TF-M repository.

Ref: NCSDK-22598

NordicBuilder · 2024-11-22T15:11:48Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
trusted-firmware-m	nrfconnect/sdk-trusted-firmware-m@`82e7763`	nrfconnect/sdk-trusted-firmware-m#180	nrfconnect/sdk-trusted-firmware-m#180/files

⛔ DNM label due to: 1 project with PR revision

Note: This message is automatically posted and updated by the Manifest GitHub Action.

NordicBuilder · 2024-11-22T15:26:28Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 4

Inputs:

Sources:

trusted-firmware-m: PR head: 9c1a5ad73e1b98a3f50b22743ac7bb848f52c504
sdk-nrf: PR head: 8b0040bd454c293f4506e5ad82e372899b4b4ac1

more details

trusted-firmware-m:

PR head: 9c1a5ad73e1b98a3f50b22743ac7bb848f52c504
merge base: cc9a53fcda91d60ee67297beebbc4daf0fde4e13
target head (main): f2bf78452629355e4180dc36756f6c1becc819fa
Diff

sdk-nrf:

PR head: 8b0040bd454c293f4506e5ad82e372899b4b4ac1
merge base: a07b87c923420fdbfbdbff3698a3d30f5c1c33ee
target head (main): e465c0428b7b2a5105afedac57a0e8f520b55380
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (19)

modules
│  ├── tee
│  │  ├── tf-m
│  │  │  ├── trusted-firmware-m
│  │  │  │  ├── config
│  │  │  │  │  │ config_base.cmake
│  │  │  │  ├── docs
│  │  │  │  │  ├── integration_guide
│  │  │  │  │  │  ├── services
│  │  │  │  │  │  │  │ tfm_attestation_integration_guide.rst
│  │  │  │  ├── lib
│  │  │  │  │  ├── ext
│  │  │  │  │  │  ├── t_cose
│  │  │  │  │  │  │  ├── crypto_adapters
│  │  │  │  │  │  │  │  │ t_cose_psa_crypto.c
│  │  │  │  │  │  │  ├── inc
│  │  │  │  │  │  │  │  │ t_cose_common.h
│  │  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  │  ├── t_cose_crypto.h
│  │  │  │  │  │  │  │  │ t_cose_sign1_sign.c
│  │  │  │  │  │  │  ├── test
│  │  │  │  │  │  │  │  │ t_cose_make_test_messages.c
│  │  │  │  │  │  │  │ tfm_t_cose.cmake
│  │  │  │  ├── secure_fw
│  │  │  │  │  ├── partitions
│  │  │  │  │  │  ├── initial_attestation
│  │  │  │  │  │  │  ├── Kconfig
│  │  │  │  │  │  │  │ attest_token_encode.c
│  ├── trusted-firmware-m
│  │  ├── Kconfig.tfm.defconfig
│  │  ├── tfm_boards
│  │  │  ├── CMakeLists.txt
│  │  │  ├── common
│  │  │  │  │ attest_hal.c
│  │  │  ├── nrf54l15_cpuapp
│  │  │  │  │ config.cmake
│  │  │ tfm_config.h.in
samples
│  ├── tfm
│  │  ├── tfm_psa_template
│  │  │  ├── boards
│  │  │  │  │ nrf54l15dk_nrf54l15_cpuapp_ns.conf
│  │  │  ├── sysbuild
│  │  │  │  ├── mcuboot
│  │  │  │  │  ├── boards
│  │  │  │  │  │  │ nrf54l15dk_nrf54l15_cpuapp.conf
subsys
│  ├── bootloader
│  │  ├── bl_storage
│  │  │  │ Kconfig
west.yml

Outputs:

Toolchain

Version: b77d8c1312
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:b77d8c1312_912848a074

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
❌ Build twister
- sdk-nrf test count: 999
❌ Integration tests
- ❌ test-fw-nrfconnect-boot
- ❌ test-fw-nrfconnect-chip
- ❌ test-fw-nrfconnect-nrf_crypto
- ❌ test-fw-nrfconnect-tfm
- ❌ test-fw-nrfconnect-zigbee
- ❌ test-sdk-find-my
- ❌ test-sdk-sidewalk
- ❌ test-sdk-mcuboot
- ⚠️ test-fw-nrfconnect-fw-update
- ⚠️ test-fw-nrfconnect-nrf-iot_cloud

Disabled integration tests

- desktop52_verification
- doc-internal
- test_ble_nrf_config
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_mosh
- test-fw-nrfconnect-nrf-iot_nrf_provisioning
- test-fw-nrfconnect-nrf-iot_positioning
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_serial_lte_modem
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-ps
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-rs
- test-fw-nrfconnect-thread
- test-low-level
- test-sdk-audio
- test-sdk-dfu
- test-sdk-pmic-samples
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

hellesvik-nordic · 2024-11-22T15:31:28Z

modules/trusted-firmware-m/tfm_boards/CMakeLists.txt

@@ -115,7 +115,7 @@ if (${TFM_PARTITION_CRYPTO})
    tfm_sprt
  )

-  if (${TFM_PARTITION_INITIAL_ATTESTATION})
+  if ((${TFM_PARTITION_INITIAL_ATTESTATION}) AND CONFIG_IDENTITY_KEY)


This will not work for other nRF SoCs.
Would it be better to do "if 5340 or 9160 or etc etc"?
Or to define an TFM_IDENTITY_KEY and then set that inside tfm_boards for each of the boards that use this?

To me it makes sense to use a more generic Kconfig option rather than explicitly naming the affected SOCs. The list will likely change over time, so it's nice to not have a bunch of if SOC_X [...] all over.

NordicBuilder · 2024-11-22T15:46:47Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publish GitHub Action.

hellesvik-nordic · 2024-11-25T08:02:11Z

samples/tfm/tfm_psa_template/boards/nrf54l15dk_nrf54l15_cpuapp_ns.conf

@@ -0,0 +1,13 @@
+CONFIG_TFM_NRF_PROVISIONING=n
+CONFIG_TFM_DUMMY_PROVISIONING=y


I should enable nrf_provisioning

tomi-font · 2024-11-25T08:07:11Z

subsys/bootloader/bl_storage/Kconfig

@@ -6,4 +6,4 @@

 config SECURE_BOOT_STORAGE
 	bool "Library for accessing the bootloader storage"
-	select NRFX_RRAMC if SOC_SERIES_NRF54LX
+	select NRFX_RRAMC if SOC_SERIES_NRF54LX && !TRUSTED_EXECUTION_NONSECURE


Is this still needed as you guarded select SECURE_BOOT_STORAGE with if !TRUSTED_EXECUTION_NONSECURE?
(I don't know about this so I can't tell whether or not it makes sense to have this here. Maybe even the whole SECURE_BOOT_STORAGE Kconfig option should depend on !TRUSTED_EXECUTION_NONSECURE?)

tomi-font · 2024-11-25T08:39:55Z

modules/trusted-firmware-m/Kconfig.tfm.defconfig

@@ -66,7 +66,7 @@ config TFM_PARTITION_INITIAL_ATTESTATION
 	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT
 	select PSA_WANT_ALG_ECDSA
 	select PSA_WANT_ECC_SECP_R1_256
-	select SECURE_BOOT_STORAGE
+	select SECURE_BOOT_STORAGE if !TRUSTED_EXECUTION_NONSECURE


Suggested change

select SECURE_BOOT_STORAGE if !TRUSTED_EXECUTION_NONSECURE

select SECURE_BOOT_STORAGE if TRUSTED_EXECUTION_SECURE

?

tomi-font · 2024-11-25T08:41:50Z

modules/trusted-firmware-m/tfm_boards/CMakeLists.txt

@@ -115,7 +115,7 @@ if (${TFM_PARTITION_CRYPTO})
    tfm_sprt
  )

-  if (${TFM_PARTITION_INITIAL_ATTESTATION})
+  if ((${TFM_PARTITION_INITIAL_ATTESTATION}) AND CONFIG_IDENTITY_KEY)


To me it makes sense to use a more generic Kconfig option rather than explicitly naming the affected SOCs. The list will likely change over time, so it's nice to not have a bunch of if SOC_X [...] all over.

tomi-font · 2024-11-25T08:58:06Z

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

 #include <bl_storage.h>

+


Suggested change

tomi-font · 2024-11-25T08:59:29Z

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

@@ -132,7 +143,15 @@ enum tfm_plat_err_t tfm_plat_get_boot_seed(uint32_t size, uint8_t *buf)
 	if (nrf_err != NRF_CC3XX_PLATFORM_SUCCESS) {
 		return TFM_PLAT_ERR_SYSTEM_ERR;
 	}
-
+#elif defined(CONFIG_PSA_NEED_CRACEN_KMU_DRIVER)


Please use the same macro when defining and using the boot_seed variables.

tomi-font · 2024-11-25T09:00:18Z

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

-
+#elif defined(CONFIG_PSA_NEED_CRACEN_KMU_DRIVER)
+	if (!boot_seed_set) {
+		psa_generate_random(boot_seed, 32);


Suggested change

psa_generate_random(boot_seed, 32);

psa_generate_random(boot_seed, sizeof(boot_seed));

tomi-font · 2024-11-25T09:19:34Z

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

+#elif defined(CONFIG_PSA_NEED_CRACEN_KMU_DRIVER)
+	if (!boot_seed_set) {
+		psa_generate_random(boot_seed, 32);
+		boot_seed_set = 1;


Suggested change

boot_seed_set = 1;

boot_seed_set = true;

tomi-font · 2024-11-25T09:21:04Z

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

+		psa_generate_random(boot_seed, 32);
+		boot_seed_set = 1;
+	}
+	memcpy(buf, boot_seed, sizeof(uint8_t) * 32);


Suggested change

memcpy(buf, boot_seed, sizeof(uint8_t) * 32);

memcpy(buf, boot_seed, size);

maybe?

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

tomi-font · 2024-11-25T09:25:09Z

modules/trusted-firmware-m/tfm_boards/nrf54l15_cpuapp/config.cmake

+set(CONFIG_NRFX_RRAMC                ON          CACHE BOOL      "Enable nrfx drivers for RRAMC")
+add_compile_definitions(CONFIG_NRFX_RRAMC)


Hmm, we are already using a very minimal homemade RRAMC driver in TF-M. What are you doing this for exactly?
(Also the add_compile_definitions() line seems a bit weird, why is it needed?)

CONFIG_NRFX_RRAMC is used in attest_hal.c, which is used in both Zephyr and TF-M. For example here.
If I remove add_compile_definitions(), I get errors such as "CONFIG_NRFX_RRAMC" not defined. I don't know if this is the correct way to add it, I just copied it from cpuarch.cmake.
Do you think I should look for alternative ways to get this config included?

Ahem you are linking to add_compile_definitions(__NRF_TFM__) in cpuarch.cmake?

Ah ups. Edited to change file name.

Hmm okay, you are still linking to the example of __NRF_TFM__, I thought you'd have an example with CONFIG_NRFX_RRAMC. (After grepping I see there is none).
I am not sure, but it seems like this add_compile_definitions() could be unconditionally adding CONFIG_NRFX_RRAMC as a define? Or does it somehow get its value from the set() line above? Do you know how it works?
I'm wondering why don't we do this via Kconfig, as this is a Kconfig option.
This doesn't seem like a natural (or proper) way to do that, but I'm not sure.
What is this needed for exactly? Where do you get errors from?

Add support for PSA Attestation to the nRF54L15. Includes noup changes to TF-M repository. Ref: NCSDK-22598 Signed-off-by: Sigurd Hellesvik <[email protected]>

hellesvik-nordic requested review from a team as code owners November 22, 2024 15:11

NordicBuilder added manifest manifest-trusted-firmware-m DNM labels Nov 22, 2024

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Nov 22, 2024

hellesvik-nordic force-pushed the nrf54l15_attestation branch from 2235121 to 716c951 Compare November 22, 2024 15:15

hellesvik-nordic force-pushed the nrf54l15_attestation branch from 716c951 to fce97d0 Compare November 22, 2024 15:27

hellesvik-nordic commented Nov 22, 2024

View reviewed changes

hellesvik-nordic commented Nov 25, 2024

View reviewed changes

tomi-font reviewed Nov 25, 2024

View reviewed changes

tf-m: Add Attestation support for nRF54L15

8b0040b

Add support for PSA Attestation to the nRF54L15. Includes noup changes to TF-M repository. Ref: NCSDK-22598 Signed-off-by: Sigurd Hellesvik <[email protected]>

hellesvik-nordic force-pushed the nrf54l15_attestation branch from fce97d0 to 8b0040b Compare November 29, 2024 14:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tf-m: Add Attestation support for nRF54L15 #19040

tf-m: Add Attestation support for nRF54L15 #19040

hellesvik-nordic commented Nov 22, 2024

NordicBuilder commented Nov 22, 2024 •

edited

Loading

NordicBuilder commented Nov 22, 2024 •

edited

Loading

hellesvik-nordic Nov 22, 2024

tomi-font Nov 25, 2024

NordicBuilder commented Nov 22, 2024

hellesvik-nordic Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

tomi-font Nov 25, 2024

hellesvik-nordic Nov 29, 2024 •

edited

Loading

tomi-font Nov 29, 2024

hellesvik-nordic Nov 29, 2024

tomi-font Nov 29, 2024

		@@ -0,0 +1,13 @@
		CONFIG_TFM_NRF_PROVISIONING=n
		CONFIG_TFM_DUMMY_PROVISIONING=y

	select SECURE_BOOT_STORAGE if !TRUSTED_EXECUTION_NONSECURE
	select SECURE_BOOT_STORAGE if TRUSTED_EXECUTION_SECURE

	psa_generate_random(boot_seed, 32);
	psa_generate_random(boot_seed, sizeof(boot_seed));

	memcpy(buf, boot_seed, sizeof(uint8_t) * 32);
	memcpy(buf, boot_seed, size);

		set(CONFIG_NRFX_RRAMC ON CACHE BOOL "Enable nrfx drivers for RRAMC")
		add_compile_definitions(CONFIG_NRFX_RRAMC)

tf-m: Add Attestation support for nRF54L15 #19040

Are you sure you want to change the base?

tf-m: Add Attestation support for nRF54L15 #19040

Conversation

hellesvik-nordic commented Nov 22, 2024

NordicBuilder commented Nov 22, 2024 • edited Loading

NordicBuilder commented Nov 22, 2024 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Choose a reason for hiding this comment

Choose a reason for hiding this comment

NordicBuilder commented Nov 22, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hellesvik-nordic Nov 29, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

NordicBuilder commented Nov 22, 2024 •

edited

Loading

NordicBuilder commented Nov 22, 2024 •

edited

Loading

hellesvik-nordic Nov 29, 2024 •

edited

Loading