Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Not ready for review: TF-M support for building without PSA ITS #19036

Closed
wants to merge 6 commits into from
Closed

Not ready for review: TF-M support for building without PSA ITS #19036

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
add4d1e
TF-M: Avoid enabling OTP and NV if CRYPTO_STORAGE_DISABLED is set
frkv Nov 22, 2024
6c22b49
TF-M: Made TFM_PLATFORM_NV_CONTER_MODULE_DISABLE generic
frkv Nov 22, 2024
3d2a8d5
TF-M: Adjusting the workaround for MBEDTLS_PSA_CRYPTO_STORAGE_C unset
frkv Nov 22, 2024
39cbab7
TF-M: Adding more dependencies for TFM_ITS_ENCRYPTED
frkv Nov 22, 2024
0812bc7
mbedtls: Fix ependency of MBEDTLS_PSA_CRYPTO_STORAGE_C for TF-M
frkv Nov 22, 2024
bcfdf30
manifest: Update TF-M to support building without without ITS
frkv Nov 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions modules/trusted-firmware-m/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,6 +200,10 @@ if(NOT CONFIG_MBEDTLS_PSA_CRYPTO_STORAGE_C)
set_property(TARGET zephyr_property_target
APPEND PROPERTY TFM_CMAKE_OPTIONS
-DCRYPTO_STORAGE_DISABLED=TRUE
-DTFM_PARTITION_INTERNAL_TRUSTED_STORAGE=OFF
-DPLATFORM_DEFAULT_OTP=OFF
-DPLATFORM_DEFAULT_OTP_WRITEABLE=OFF
-DPLATFORM_DEFAULT_NV_COUNTERS=OFF
)
endif()

Expand Down
4 changes: 3 additions & 1 deletion modules/trusted-firmware-m/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ config TFM_PLATFORM_SP_STACK_SIZE

config TFM_PLATFORM_NV_COUNTER_MODULE_DISABLED
bool "Disable Non-volatile counter module"
default y if TFM_PROFILE_TYPE_MINIMAL
default y if !TFM_PARTITION_INTERNAL_TRUSTED_STORAGE

endmenu

Expand Down Expand Up @@ -201,6 +201,8 @@ config TFM_ITS_ENCRYPTED
bool
prompt "PSA Internal Trusted Storage with encryption"
default y if SOC_SERIES_NRF54LX
depends on MBEDTLS_PSA_CRYPTO_STORAGE_C
depends on TFM_PARTITION_INTERNAL_TRUSTED_STORAGE
select PSA_ITS_ENCRYPTED
select PSA_WANT_GENERATE_RANDOM
help
Expand Down
2 changes: 2 additions & 0 deletions modules/trusted-firmware-m/Kconfig.tfm.defconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,8 @@ config TFM_PARTITION_PROTECTED_STORAGE
config TFM_ITS_ENCRYPTED
bool
select PSA_WANT_ALG_CHACHA20_POLY1305 if SOC_SERIES_NRF54LX
depends on MBEDTLS_PSA_CRYPTO_STORAGE_C
depends on TFM_PARTITION_INTERNAL_TRUSTED_STORAGE

config BOOTLOADER_MCUBOOT
bool
Expand Down
10 changes: 4 additions & 6 deletions modules/trusted-firmware-m/tfm_boards/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,13 +160,11 @@ if (CONFIG_NRF_SECURE_APPROTECT_LOCK)
endif()

if (CRYPTO_STORAGE_DISABLED AND TFM_PARTITION_CRYPTO AND NOT TFM_PARTITION_INTERNAL_TRUSTED_STORAGE)
# Added here to satisfy the following requirement from tfm_crypto.yaml:
#
# "dependencies": [
# "TFM_INTERNAL_TRUSTED_STORAGE_SERVICE"
# ]
# Ensure OTP and NV counter support is also disabled when ITS is not enabled
target_compile_definitions(platform_s PUBLIC
TFM_INTERNAL_TRUSTED_STORAGE_SERVICE_SID=0x00000070)
-DPLATFORM_DEFAULT_OTP=OFF
-DPLATFORM_DEFAULT_OTP_WRITEABLE=OFF
-DPLATFORM_DEFAULT_NV_COUNTERS=OFF)
endif()

if(BL2)
Expand Down
3 changes: 2 additions & 1 deletion subsys/nrf_security/Kconfig.psa
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ config MBEDTLS_PSA_CRYPTO_SPM

config MBEDTLS_PSA_CRYPTO_STORAGE_C
bool "PSA storage for persistent keys" if !BUILD_WITH_TFM
default y if BUILD_WITH_TFM
default y if BUILD_WITH_TFM && TFM_PARTITION_INTERNAL_TRUSTED_STORAGE
help
Corresponds to MBEDTLS_PSA_CRYPTO_STORAGE_C setting in mbed TLS config file.

Expand All @@ -73,6 +73,7 @@ config MBEDTLS_PSA_KEY_SLOT_COUNT
config PSA_ITS_ENCRYPTED
bool
depends on MBEDTLS_PSA_CRYPTO_STORAGE_C
depends on TFM_PARTITION_INTERNAL_TRUSTED_STORAGE
help
Enables authenticated encryption for PSA Internal Trusted Storage files

Expand Down
2 changes: 1 addition & 1 deletion west.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,7 @@ manifest:
- name: trusted-firmware-m
repo-path: sdk-trusted-firmware-m
path: modules/tee/tf-m/trusted-firmware-m
revision: 82e7763eba112a350d58dd52dc39f340a291ffd0
revision: pull/181/head
- name: psa-arch-tests
repo-path: sdk-psa-arch-tests
path: modules/tee/tf-m/psa-arch-tests
Expand Down
Loading