tf-m: Add Attestation support for nRF54L15 #19040

hellesvik-nordic · 2024-11-22T15:11:12Z

Add support for PSA Attestation to the nRF54L15. Includes noup changes to TF-M repository.

Ref: NCSDK-22598

NordicBuilder · 2024-11-22T15:11:48Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

NordicBuilder · 2024-11-22T15:26:28Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 26

Inputs:

Sources:

sdk-nrf: PR head: 1337531253f473f79fa1a4ce72059ab2ed635268

more details

sdk-nrf:

PR head: 1337531253f473f79fa1a4ce72059ab2ed635268
merge base: 6dc332ec93525a1c40c1329c7449df659b9a6104
target head (main): 85bb3179eeda6d4c4aad9b7a3c745d072e38bf42
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (13)

lib
│  ├── identity_key
│  │  │ Kconfig
modules
│  ├── trusted-firmware-m
│  │  ├── CMakeLists.txt
│  │  ├── Kconfig.tfm.defconfig
│  │  ├── tfm_boards
│  │  │  ├── CMakeLists.txt
│  │  │  ├── common
│  │  │  │  │ attest_hal.c
│  │  │  ├── nrf54l15_cpuapp
│  │  │  │  │ config.cmake
samples
│  ├── tfm
│  │  ├── tfm_psa_template
│  │  │  ├── boards
│  │  │  │  │ nrf54l15dk_nrf54l15_cpuapp_ns.conf
│  │  │  ├── prj.conf
│  │  │  ├── sysbuild
│  │  │  │  ├── mcuboot
│  │  │  │  │  ├── boards
│  │  │  │  │  │  │ nrf54l15dk_nrf54l15_cpuapp.conf
subsys
│  ├── bootloader
│  │  ├── bl_storage
│  │  │  │ Kconfig
│  ├── nrf_security
│  │  ├── src
│  │  │  ├── drivers
│  │  │  │  ├── cracen
│  │  │  │  │  ├── sicrypto
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  │ iksig.c
tests
│  ├── tfm
│  │  ├── tfm_psa_test
│  │  │  │ prj.conf
│  │  ├── tfm_regression_test
│  │  │  │ prj.conf

Outputs:

Toolchain

Version: aedb4c0245
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:aedb4c0245_bece0367df

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister
- sdk-nrf test count: 1762
❌ Integration tests
- ✅ test-fw-nrfconnect-boot
- ✅ test-fw-nrfconnect-chip
- ❌ test-fw-nrfconnect-nrf-iot_cloud
- ✅ test-fw-nrfconnect-nrf_crypto
- ✅ test-fw-nrfconnect-tfm
- ✅ test-fw-nrfconnect-zigbee
- ✅ test-sdk-find-my
- ✅ test-sdk-sidewalk
- ✅ test-sdk-mcuboot
- ✅ test-sdk-dfu
- ⚠️ test-fw-nrfconnect-fw-update

Disabled integration tests

- desktop52_verification
- doc-internal
- test_ble_nrf_config
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_mosh
- test-fw-nrfconnect-nrf-iot_positioning
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_serial_lte_modem
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-proprietary_esb
- test-fw-nrfconnect-ps
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-rs
- test-fw-nrfconnect-thread
- test-low-level
- test-sdk-audio
- test-sdk-pmic-samples
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

modules/trusted-firmware-m/tfm_boards/CMakeLists.txt

NordicBuilder · 2024-11-22T15:46:47Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publish GitHub Action.

samples/tfm/tfm_psa_template/boards/nrf54l15dk_nrf54l15_cpuapp_ns.conf

subsys/bootloader/bl_storage/Kconfig

modules/trusted-firmware-m/Kconfig.tfm.defconfig

modules/trusted-firmware-m/tfm_boards/CMakeLists.txt

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

tomi-font · 2024-11-25T09:25:09Z

modules/trusted-firmware-m/tfm_boards/nrf54l15_cpuapp/config.cmake

+set(CONFIG_NRFX_RRAMC                ON          CACHE BOOL      "Enable nrfx drivers for RRAMC")
+add_compile_definitions(CONFIG_NRFX_RRAMC)


Hmm, we are already using a very minimal homemade RRAMC driver in TF-M. What are you doing this for exactly?
(Also the add_compile_definitions() line seems a bit weird, why is it needed?)

CONFIG_NRFX_RRAMC is used in attest_hal.c, which is used in both Zephyr and TF-M. For example here.
If I remove add_compile_definitions(), I get errors such as "CONFIG_NRFX_RRAMC" not defined. I don't know if this is the correct way to add it, I just copied it from cpuarch.cmake.
Do you think I should look for alternative ways to get this config included?

Ahem you are linking to add_compile_definitions(__NRF_TFM__) in cpuarch.cmake?

Ah ups. Edited to change file name.

Hmm okay, you are still linking to the example of __NRF_TFM__, I thought you'd have an example with CONFIG_NRFX_RRAMC. (After grepping I see there is none).
I am not sure, but it seems like this add_compile_definitions() could be unconditionally adding CONFIG_NRFX_RRAMC as a define? Or does it somehow get its value from the set() line above? Do you know how it works?
I'm wondering why don't we do this via Kconfig, as this is a Kconfig option.
This doesn't seem like a natural (or proper) way to do that, but I'm not sure.
What is this needed for exactly? Where do you get errors from?

What Im trying to do:
attest_hal.c is a file that can be ran either from zephyr or from TF-M.
This file depends on the correct Kconfig options being set. (CONFIG_NRFX_RRAMC in this case)
add_compile_definitions() is the way I found to make sure that TF-M has CONFIG_NRFX_RRAMC defined.
What is the best way to do this?

Where do you get errors from?

My errors were pretty much "CONFIG_NRFX_RRAMC not defined".
I will spend some more time looking into this.

I talked to Tomi and added a check around the add_compile_definitions(), so it is only included for attestation.

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

lib/identity_key/Kconfig

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c

modules/trusted-firmware-m/tfm_boards/nrf54l15_cpuapp/config.cmake

samples/tfm/tfm_psa_template/boards/nrf54l15dk_nrf54l15_cpuapp_ns.conf

hellesvik-nordic · 2024-12-19T08:50:44Z

Rebase

hellesvik-nordic · 2024-12-19T13:13:05Z

Rebase

subsys/nrf_security/src/drivers/cracen/sicrypto/src/iksig.c

tomi-font · 2024-12-23T07:48:30Z

modules/trusted-firmware-m/tfm_boards/nrf54l15_cpuapp/config.cmake

@@ -13,3 +13,12 @@ include(${PLATFORM_PATH}/common/${NRF_SOC_VARIANT}/config.cmake)

 # Override PS_CRYPTO_KDF_ALG
 set(PS_CRYPTO_KDF_ALG                  PSA_ALG_SP800_108_COUNTER_CMAC CACHE STRING    "KDF Algorithm to use")
+
+


Suggested change

tomi-font · 2024-12-23T08:24:47Z

subsys/nrf_security/src/drivers/cracen/sicrypto/src/iksig.c

+	t->params.ik.privkey = privkey;
+	t->params.ik.signature = signature;
+}
+


Suggested change

magnev · 2025-01-22T13:34:59Z

subsys/nrf_security/src/drivers/cracen/sicrypto/src/iksig.c

@@ -114,17 +115,12 @@ static int finish_ecdsa_ik_sign(struct sitask *t, struct siwq *wq)
 	return exit_ikg(t);
 }

-static int start_ecdsa_ik_sign(struct sitask *t, struct siwq *wq)
+static int start_ecdsa_ik_sign(struct sitask *t)
 {
 	struct sx_pk_acq_req pkreq;
 	struct sx_pk_inops_ik_ecdsa_sign inputs;
 	int opsz;
 	size_t digestsz = sx_hash_get_digestsz(&t->u.h);


Getting digest size from this hash context won't work when calling psa_sign_hash(). This is because the hash context is never created since sx_hash_create() is not needed and therefore not called. Changing this line to:
size_t digestsz = sx_hash_get_alg_digestsz(t->params.ik.privkey->hashalg);
makes my tests pass

nordicjm · 2025-01-27T09:51:27Z

lib/identity_key/Kconfig

+	  This option adds support for an identity key stored in the KMU to TF-M.
+	  The key is stored in an encrypted form and is decrypted
+	  by the identity key library.
+	  The identity key is an ECC secp256r1 key pair.


column is 100 chars so more text can be on each line

nordicjm · 2025-01-27T09:52:13Z

modules/trusted-firmware-m/tfm_boards/CMakeLists.txt

@@ -115,7 +115,7 @@ if (${TFM_PARTITION_CRYPTO})
    tfm_sprt
  )

-  if (${TFM_PARTITION_INITIAL_ATTESTATION})
+  if ((${TFM_PARTITION_INITIAL_ATTESTATION}) AND CONFIG_IDENTITY_KEY_TFM)


Suggested change

if ((${TFM_PARTITION_INITIAL_ATTESTATION}) AND CONFIG_IDENTITY_KEY_TFM)

if((${TFM_PARTITION_INITIAL_ATTESTATION}) AND CONFIG_IDENTITY_KEY_TFM)

nordicjm · 2025-01-27T09:52:52Z

modules/trusted-firmware-m/tfm_boards/nrf54l15_cpuapp/config.cmake

+# This is because bl_storage is a lib intended to be run from either the bootloader (Zephyr) or from TF-M.
+# This is independent from the NS image's CONFIG_NRFX_RRAMC, which must be disabled, so we can not inherit
+# this from app Kconfig.
+if (TFM_PARTITION_INITIAL_ATTESTATION)


Suggested change

if (TFM_PARTITION_INITIAL_ATTESTATION)

if(TFM_PARTITION_INITIAL_ATTESTATION)

hellesvik-nordic · 2025-02-17T09:03:13Z

Rebase

nordicjm · 2025-02-18T10:14:22Z

lib/identity_key/Kconfig

+	bool "Identity key support in TF-M"
+	depends on HAS_HW_NRF_CC3XX
+	depends on TRUSTED_EXECUTION_NONSECURE
+	default y if SOC_NRF5340_CPUAPP || SOC_SERIES_NRF91X


why is this defaulting to y? This will default to on when someone builds hello world

Good point. I removed the default

outdated

Add support for PSA Attestation to the nRF54L15. Ref: NCSDK-22598 Signed-off-by: Sigurd Hellesvik <sigurd.hellesvik@nordicsemi.no>

Add support for sign_digest support to silex sicrypto drivers for iksign.c, making it possible to sign_digest for the IKG. Signed-off-by: Sigurd Hellesvik <sigurd.hellesvik@nordicsemi.no>

github-actions · 2025-02-24T11:43:14Z

After documentation is built, you will find the preview for this PR here.

Preview links for modified nRF Connect SDK documents:

sonarqubecloud · 2025-02-24T11:47:56Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

hellesvik-nordic requested review from a team as code owners November 22, 2024 15:11

NordicBuilder added manifest manifest-trusted-firmware-m DNM labels Nov 22, 2024

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Nov 22, 2024

hellesvik-nordic force-pushed the nrf54l15_attestation branch from 2235121 to 716c951 Compare November 22, 2024 15:15

hellesvik-nordic force-pushed the nrf54l15_attestation branch from 716c951 to fce97d0 Compare November 22, 2024 15:27

hellesvik-nordic commented Nov 22, 2024

View reviewed changes

modules/trusted-firmware-m/tfm_boards/common/attest_hal.c Show resolved Hide resolved

modules/trusted-firmware-m/tfm_boards/CMakeLists.txt Outdated Show resolved Hide resolved

hellesvik-nordic commented Nov 25, 2024

View reviewed changes

samples/tfm/tfm_psa_template/boards/nrf54l15dk_nrf54l15_cpuapp_ns.conf Show resolved Hide resolved

tomi-font reviewed Nov 25, 2024

View reviewed changes

hellesvik-nordic force-pushed the nrf54l15_attestation branch from fce97d0 to 8b0040b Compare November 29, 2024 14:24

hellesvik-nordic force-pushed the nrf54l15_attestation branch from 8b0040b to 6bedc93 Compare December 12, 2024 12:22

tomi-font reviewed Dec 12, 2024

View reviewed changes

hellesvik-nordic force-pushed the nrf54l15_attestation branch from 6bedc93 to 4b60d5e Compare December 17, 2024 14:05

github-actions bot removed the manifest label Dec 17, 2024

NordicBuilder removed manifest-trusted-firmware-m DNM labels Dec 17, 2024

hellesvik-nordic force-pushed the nrf54l15_attestation branch 4 times, most recently from eff9ee2 to 44c4367 Compare December 18, 2024 08:07

hellesvik-nordic requested a review from tomi-font December 18, 2024 08:09

frkv requested a review from a team December 18, 2024 08:13

hellesvik-nordic force-pushed the nrf54l15_attestation branch from 44c4367 to 54f5d6c Compare December 18, 2024 08:15

tomi-font reviewed Dec 18, 2024

View reviewed changes

hellesvik-nordic force-pushed the nrf54l15_attestation branch 2 times, most recently from edc363c to 5b35e9a Compare December 19, 2024 13:12

hellesvik-nordic requested review from tomi-font and degjorva December 19, 2024 14:48

degjorva requested changes Dec 20, 2024

View reviewed changes

subsys/nrf_security/src/drivers/cracen/sicrypto/src/iksig.c Outdated Show resolved Hide resolved

subsys/nrf_security/src/drivers/cracen/sicrypto/src/iksig.c Show resolved Hide resolved

tomi-font previously approved these changes Dec 23, 2024

View reviewed changes

magnev reviewed Jan 22, 2025

View reviewed changes

nordicjm reviewed Jan 27, 2025

View reviewed changes

hellesvik-nordic force-pushed the nrf54l15_attestation branch from 5b35e9a to 4dbab51 Compare February 17, 2025 09:02

hellesvik-nordic force-pushed the nrf54l15_attestation branch 2 times, most recently from 834e149 to 56a214b Compare February 17, 2025 14:29

degjorva approved these changes Feb 18, 2025

View reviewed changes

hellesvik-nordic requested review from nordicjm and magnev February 18, 2025 09:02

nordicjm reviewed Feb 18, 2025

View reviewed changes

hellesvik-nordic force-pushed the nrf54l15_attestation branch 4 times, most recently from 83feae5 to 121be49 Compare February 19, 2025 09:24

magnev approved these changes Feb 20, 2025

View reviewed changes

hellesvik-nordic added 2 commits February 24, 2025 12:42

tf-m: Add Attestation support for nRF54L15

311b24f

Add support for PSA Attestation to the nRF54L15. Ref: NCSDK-22598 Signed-off-by: Sigurd Hellesvik <sigurd.hellesvik@nordicsemi.no>

nrf_security: cracen: Add sign_digest support to sicrypto iksign

1337531

Add support for sign_digest support to silex sicrypto drivers for iksign.c, making it possible to sign_digest for the IKG. Signed-off-by: Sigurd Hellesvik <sigurd.hellesvik@nordicsemi.no>

hellesvik-nordic force-pushed the nrf54l15_attestation branch from 121be49 to 1337531 Compare February 24, 2025 11:42

hellesvik-nordic requested a review from stephen-nordic as a code owner February 24, 2025 11:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tf-m: Add Attestation support for nRF54L15 #19040

tf-m: Add Attestation support for nRF54L15 #19040

hellesvik-nordic commented Nov 22, 2024

NordicBuilder commented Nov 22, 2024 •

edited

Loading

NordicBuilder commented Nov 22, 2024 •

edited

Loading

NordicBuilder commented Nov 22, 2024

tomi-font Nov 25, 2024

hellesvik-nordic Nov 29, 2024 •

edited

Loading

tomi-font Nov 29, 2024

hellesvik-nordic Nov 29, 2024

tomi-font Nov 29, 2024

hellesvik-nordic Dec 17, 2024

hellesvik-nordic Dec 17, 2024 •

edited

Loading

hellesvik-nordic Dec 18, 2024

hellesvik-nordic commented Dec 19, 2024

hellesvik-nordic commented Dec 19, 2024

tomi-font Dec 23, 2024

tomi-font Dec 23, 2024

magnev Jan 22, 2025

nordicjm Jan 27, 2025

nordicjm Jan 27, 2025

nordicjm Jan 27, 2025

hellesvik-nordic commented Feb 17, 2025

nordicjm Feb 18, 2025

hellesvik-nordic Feb 18, 2025

github-actions bot commented Feb 24, 2025

sonarqubecloud bot commented Feb 24, 2025

		set(CONFIG_NRFX_RRAMC ON CACHE BOOL "Enable nrfx drivers for RRAMC")
		add_compile_definitions(CONFIG_NRFX_RRAMC)

		@@ -13,3 +13,12 @@ include(${PLATFORM_PATH}/common/${NRF_SOC_VARIANT}/config.cmake)

		# Override PS_CRYPTO_KDF_ALG
		set(PS_CRYPTO_KDF_ALG PSA_ALG_SP800_108_COUNTER_CMAC CACHE STRING "KDF Algorithm to use")

	if ((${TFM_PARTITION_INITIAL_ATTESTATION}) AND CONFIG_IDENTITY_KEY_TFM)
	if((${TFM_PARTITION_INITIAL_ATTESTATION}) AND CONFIG_IDENTITY_KEY_TFM)

	if (TFM_PARTITION_INITIAL_ATTESTATION)
	if(TFM_PARTITION_INITIAL_ATTESTATION)

tf-m: Add Attestation support for nRF54L15 #19040

Are you sure you want to change the base?

tf-m: Add Attestation support for nRF54L15 #19040

Conversation

hellesvik-nordic commented Nov 22, 2024

NordicBuilder commented Nov 22, 2024 • edited Loading

NordicBuilder commented Nov 22, 2024 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

NordicBuilder commented Nov 22, 2024

Choose a reason for hiding this comment

hellesvik-nordic Nov 29, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hellesvik-nordic Dec 17, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hellesvik-nordic commented Dec 19, 2024

hellesvik-nordic commented Dec 19, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hellesvik-nordic commented Feb 17, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Feb 24, 2025

sonarqubecloud bot commented Feb 24, 2025

Quality Gate passed

NordicBuilder commented Nov 22, 2024 •

edited

Loading

NordicBuilder commented Nov 22, 2024 •

edited

Loading

hellesvik-nordic Nov 29, 2024 •

edited

Loading

hellesvik-nordic Dec 17, 2024 •

edited

Loading