nRF54L15: Add initial TF-M support #14463

Vge0rge · 2024-03-08T13:39:03Z

Add initial support for TF-M in nRF54L15.

This has the DTS files here in this repository until we have more mature support, then we will add upstream TF-M support and we will relocate the files.

Adds support for the tfm_hello_world sample and the following crypto samples:

aes_cbc
aes_ccm
aes_ctr
aes_gcm
chachapoly
ecdh
ecdsa
eddsa
hkdf
hmac
rng
rsa
sha256

test_crypto: PR-614
test_tfm: PR-155

NordicBuilder · 2024-03-08T13:39:36Z

The following west manifest projects have been modified in this Pull Request:

Name	Old Revision	New Revision	Diff
trusted-firmware-m	nrfconnect/sdk-trusted-firmware-m@`d824e94`	nrfconnect/sdk-trusted-firmware-m@`a22fef3` (main)	nrfconnect/[email protected]
zephyr	nrfconnect/sdk-zephyr@`38cf979`	nrfconnect/sdk-zephyr@`05ff843` (main)	nrfconnect/[email protected]

Note: This message is automatically posted and updated by the Manifest GitHub Action.

NordicBuilder · 2024-03-15T21:07:11Z

Test specification

CI/Jenkins/NRF

Integration Platforms

CI/Jenkins/integration

Test Module	File based changes	Manually selected	West overwrite

Detailed information of selected test modules

Note: This message is automatically posted and updated by the CI

NordicBuilder · 2024-03-15T21:41:17Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publishing GitHub Action.

SebastianBoe · 2024-03-18T08:20:22Z

boards/arm/nrf54l15pdk_nrf54l15/Kconfig.defconfig

+	  RAM regions must be aligned to this value due to SPU HW
+	  limitations.
+
+endif #BOARD_NRF54L15PDK_NRF54L15_CPUAPP_NS


missing newling

SebastianBoe · 2024-03-18T08:26:16Z

boards/arm/nrf54l15pdk_nrf54l15/nrf54l15pdk_nrf54l15_cpuapp_ns.dts

+		sw1 = &button1;
+		sw2 = &button2;
+		sw3 = &button3;
+	};


The leds, buttons, and aliases, is there any way of sharing this code with the secure board?

I believe that for nrf53 this code is shared in a file called *_common.dtsi.

This DT code changes quite a lot and will be expensive to maintain, as it is also not well tested, resulting in user bug reports.

I agree that should be in a common file to make our future us more happy, but I'm also fine with creating a follow-up Jira task on this instead of fixing it in this big PR

I fully agree that this is the correct approach but I decided not to put that in scope of this PR.
I created a follow up task: NCSDK-26632 which covers that exact part.

SebastianBoe · 2024-03-18T08:29:19Z

boards/arm/nrf54l15pdk_nrf54l15/nrf54l15pdk_nrf54l15_cpuapp_ns_defconfig

+CONFIG_HW_STACK_PROTECTION=y
+
+# MPU-based null-pointer dereferencing detection cannot
+# be applied as the (0x0 - 0x400) is unmapped for this target.


This isn't true, is it?

When I look at the datasheet it looks like RRAM starts at address 0.

Fair point, this was actually copy pasted by the defconfig file in Zephyr. I also don't see how this can apply for this device so I will remove.

SebastianBoe · 2024-03-18T08:34:15Z

dts/arm/nordic/nrf54l15_cpuapp_peripherals_ns.dtsi

+	reg = <0x10e000 0x1000>;
+	interrupts = <270 NRF_DEFAULT_IRQ_PRIORITY>;
+	status = "disabled";
+};


Same comment as https://github.com/nrfconnect/sdk-nrf/pull/14463/files#r1528056012

SebastianBoe · 2024-03-18T09:13:38Z

subsys/nrf_security/src/drivers/cracen/psa_driver.Kconfig

@@ -1737,7 +1737,7 @@ config PSA_NEED_CRACEN_KEY_DERIVATION_DRIVER

 config PSA_NEED_CRACEN_KMU_DRIVER
 	bool
-	default y
+	default y if !BUILD_WITH_TFM


Let's add a link to the jira for KMU support so the developer doing that jira can easily find all places that need patching.

(and also make it clear that this is a temporary patch)

Sure, I added it.

SebastianBoe · 2024-03-18T09:15:30Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c

@@ -1235,6 +1235,7 @@ psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
 	}
 }

+#if !CONFIG_BUILD_WITH_TFM


same as https://github.com/nrfconnect/sdk-nrf/pull/14463/files#r1528140882

SebastianBoe · 2024-03-18T09:21:59Z

dts/arm/nordic/nrf54l15_cpuapp_peripherals_ns.dtsi

+	port = <0>;
+	gpiote-instance = <&gpiote30>;
+};
+


I see that both watchdog30 and 31 have been removed with the rationale that they are secure-only, but it is only WDT30 that is secure-only.

You are right, I will add the 31 watchdog.

SebastianBoe · 2024-03-18T09:44:22Z

modules/trusted-firmware-m/tfm_boards/common/tfm_hal_platform.c

 #ifdef CONFIG_HAS_HW_NRF_CC3XX
+	int err = 0;


When we add support for CONFIG_HW_UNIQUE_KEY_RANDOM on 54L we will get an error with this change.

you are right, I will try to refactor a bit.

Update TF-M with required changes for nRF54L15 support. Signed-off-by: Georgios Vasilakis <[email protected]>

Update Zephyr with required changes for nRF54L15 support. Signed-off-by: Georgios Vasilakis <[email protected]>

Add TF-M support for nRF54L15. This includes the DTS files, Kconfig configurations, source files and CMake logic. These are added out of tree (not upstream) until we have more mature support. Ref: NCSDK-26277 Signed-off-by: Sebastian Bøe <[email protected]> Signed-off-by: Georgios Vasilakis <[email protected]>

BUILD_FROM_TFM doesn't exist anymore, it is renamed to BUILD_INSIDE_TFM. Adapt the CRACEN code for this change. Signed-off-by: Georgios Vasilakis <[email protected]>

Through the correct MBEDTLS macro. Signed-off-by: Georgios Vasilakis <[email protected]>

which uses mbedtls_svc_key_id and not the psa one Signed-off-by: Georgios Vasilakis <[email protected]>

KMU is not supported for TF-M yet. Signed-off-by: Georgios Vasilakis <[email protected]>

We don't use any loggin in this file. Signed-off-by: Georgios Vasilakis <[email protected]>

Don't include the builtin function in non-secure builds since this collides with the implementation inside TF-M. Builtin keys are not supported in TF-M with CRACEN at the moment. Ref: NCSDK-26277 Signed-off-by: Georgios Vasilakis <[email protected]>

Add dtsi files for nRF54L15: nrf54l15_cpuapp_ns.dtsi 1) Removes the UICR which is not accesible from the non-secure application 2) Updates the bus address of the peripherals to 0x4xxxxx as they should be for the non-secure app nrf54l15_cpuapp_peripherals_ns.dtsi 1) Removes the watchdog timer 30 which is mapped as secure These filles will placed in Zephyr when we add support for upstream TF-M. Signed-off-by: Georgios Vasilakis <[email protected]>

In order to use the LFXO in nRF5340 we need to setup the PINS XL1 and XL2 but this already done in TF-M so there no reason to do it in this sample. Signed-off-by: Georgios Vasilakis <[email protected]>

Make tfm_hello_world compatible with nRF54L15 1) Choose an NS timer based on the available options 2) Use CPUID for demonstrating a secure memory read when FICR is not secure Ref: NCSDK-26277 Signed-off-by: Georgios Vasilakis <[email protected]>

For devices which don't have CryptoCell the err variable will be unused. This defines it only for CryptoCell devices. Signed-off-by: Georgios Vasilakis <[email protected]>

Allow the output buffer to be NULL when there is no input to process in the PSA cipher driver. This is used by TF-M but in general this restriction doesn't make sense since we will return from this function before we use this buffer. Ref: NCSDK-26277 Signed-off-by: Georgios Vasilakis <[email protected]>

Enable the required PSA_WANT_KEY_TYPE for the HKDF and HMAC samples. Signed-off-by: Georgios Vasilakis <[email protected]>

It is not used by the Nordic platforms. Signed-off-by: Georgios Vasilakis <[email protected]>

This adds the required overlay configuration and the sample.yaml additions for all the crypto samples which are supported by the nRF54L15 with TF-M. Ref: NCSDK-26277 Signed-off-by: Georgios Vasilakis <[email protected]>

Set the CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION option for the bootladers test case. This used to be enabled in the CI and we prefer to have it in the yaml file to be more visible. Signed-off-by: Georgios Vasilakis <[email protected]>

Increase the stack size of the crypto partition when RSA is enabled with keys >= 3072 bits. Signed-off-by: Georgios Vasilakis <[email protected]>

github-actions bot added manifest changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Mar 8, 2024

NordicBuilder added manifest-trusted-firmware-m manifest-zephyr DNM labels Mar 8, 2024

Vge0rge force-pushed the nrf54l_initial_tfm branch 4 times, most recently from ea651f9 to d9ece98 Compare March 15, 2024 20:58

Vge0rge changed the title ~~Not for review - CI only~~ nRF54L15: Add initial TF-M support Mar 15, 2024

Vge0rge marked this pull request as ready for review March 15, 2024 21:00

Vge0rge requested review from frkv, vili-nordic, SebastianBoe, mswarowsky, anangl, tejlmand and carlescufi as code owners March 15, 2024 21:00

Vge0rge force-pushed the nrf54l_initial_tfm branch from d9ece98 to 1de4864 Compare March 15, 2024 21:05

SebastianBoe reviewed Mar 18, 2024

View reviewed changes

Vge0rge removed DNM changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Mar 22, 2024

Vge0rge force-pushed the nrf54l_initial_tfm branch from 04b097d to 249eb51 Compare March 22, 2024 15:17

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Mar 22, 2024

NordicBuilder added the DNM label Mar 22, 2024

Vge0rge and others added 19 commits March 22, 2024 16:20

manifest: Update tf-m

6ec3947

Update TF-M with required changes for nRF54L15 support. Signed-off-by: Georgios Vasilakis <[email protected]>

manifest: update Zephyr

2e6c8da

Update Zephyr with required changes for nRF54L15 support. Signed-off-by: Georgios Vasilakis <[email protected]>

nrf_security: cracen: Fix macro guard

6304239

BUILD_FROM_TFM doesn't exist anymore, it is renamed to BUILD_INSIDE_TFM. Adapt the CRACEN code for this change. Signed-off-by: Georgios Vasilakis <[email protected]>

nrf_security: cracen: Always access the PSA key ID

be3aa95

Through the correct MBEDTLS macro. Signed-off-by: Georgios Vasilakis <[email protected]>

nrf_security: cracen: Change KEY_ID definitions to support TF-M

b973613

which uses mbedtls_svc_key_id and not the psa one Signed-off-by: Georgios Vasilakis <[email protected]>

nrf_security: cracen: Disable KMU support for TF-M

d73e3ed

KMU is not supported for TF-M yet. Signed-off-by: Georgios Vasilakis <[email protected]>

cracen: spake2p: Removed unused include

8307098

We don't use any loggin in this file. Signed-off-by: Georgios Vasilakis <[email protected]>

samples: tfm_hello_world: Remove LFXO config

7d12d29

In order to use the LFXO in nRF5340 we need to setup the PINS XL1 and XL2 but this already done in TF-M so there no reason to do it in this sample. Signed-off-by: Georgios Vasilakis <[email protected]>

modules: tf-m: Fix minor unused variable issue

43b5397

For devices which don't have CryptoCell the err variable will be unused. This defines it only for CryptoCell devices. Signed-off-by: Georgios Vasilakis <[email protected]>

samples: crypto: Add PSA_WANT_KEY_TYPE for HKDF+HMAC

b10afbb

Enable the required PSA_WANT_KEY_TYPE for the HKDF and HMAC samples. Signed-off-by: Georgios Vasilakis <[email protected]>

modules: tf-m: Remove non-volatile seed option

118eb8f

It is not used by the Nordic platforms. Signed-off-by: Georgios Vasilakis <[email protected]>

samples: crypto: Add support for nRF54L15 with TF-M

43d37f5

This adds the required overlay configuration and the sample.yaml additions for all the crypto samples which are supported by the nRF54L15 with TF-M. Ref: NCSDK-26277 Signed-off-by: Georgios Vasilakis <[email protected]>

modules: tf-m: Increase stack size for RSA keys

50bb0ce

Increase the stack size of the crypto partition when RSA is enabled with keys >= 3072 bits. Signed-off-by: Georgios Vasilakis <[email protected]>

Vge0rge force-pushed the nrf54l_initial_tfm branch from 249eb51 to 50bb0ce Compare March 22, 2024 15:20

NordicBuilder removed the DNM label Mar 22, 2024

mswarowsky mentioned this pull request Mar 22, 2024

Misc. TF-M+54L support #14586

Closed

Vge0rge removed the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Mar 22, 2024

rlubos merged commit 87d76a9 into nrfconnect:main Mar 22, 2024
14 of 15 checks passed

SebastianBoe mentioned this pull request Apr 24, 2024

Fix ns dt #15031

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nRF54L15: Add initial TF-M support #14463

nRF54L15: Add initial TF-M support #14463

Vge0rge commented Mar 8, 2024 •

edited by stephen-nordic

Loading

NordicBuilder commented Mar 8, 2024 •

edited

Loading

NordicBuilder commented Mar 15, 2024 •

edited

Loading

NordicBuilder commented Mar 15, 2024

SebastianBoe Mar 18, 2024

SebastianBoe Mar 18, 2024

mswarowsky Mar 18, 2024

Vge0rge Mar 18, 2024

SebastianBoe Mar 18, 2024

Vge0rge Mar 18, 2024

SebastianBoe Mar 18, 2024

SebastianBoe Mar 18, 2024

Vge0rge Mar 18, 2024

SebastianBoe Mar 18, 2024

SebastianBoe Mar 18, 2024

Vge0rge Mar 18, 2024

SebastianBoe Mar 18, 2024

Vge0rge Mar 18, 2024

nRF54L15: Add initial TF-M support #14463

nRF54L15: Add initial TF-M support #14463

Conversation

Vge0rge commented Mar 8, 2024 • edited by stephen-nordic Loading

NordicBuilder commented Mar 8, 2024 • edited Loading

NordicBuilder commented Mar 15, 2024 • edited Loading

Test specification

NordicBuilder commented Mar 15, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Vge0rge commented Mar 8, 2024 •

edited by stephen-nordic

Loading

NordicBuilder commented Mar 8, 2024 •

edited

Loading

NordicBuilder commented Mar 15, 2024 •

edited

Loading