Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tfm: Move TF-M attestation data to provisioned OTP region #17522

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

tfm: Move TF-M attestation data to provisioned OTP region #17522

wants to merge 2 commits into from

Commits on Nov 14, 2024

  1. tfm: Include bl_storage.c 

    Add bl_storage.c to TF-M to reduce complexity on bl_storage.h.

Signed-off-by: Markus Lassila <[email protected]>
    @MarkusLassila
    MarkusLassila committed Nov 14, 2024
    Configuration menu
    Copy the full SHA
    fb2aa2e View commit details
    Browse the repository at this point in the history

  2. tfm: Move TF-M attestation data to provisioned OTP region 

    Optional fields to TF-M attestation were previously stored in
tfm_otp_nv_counters region, which we were not able to provision.
This moves the psa_certification_reference to the provisioned
OTP-region and adds support for accessing the variable data in
bl_storage.h.

Verification service URL and profile may change with device
upgrades, for this reason they are added as Kconfigs.

Note that we still need to keep the tfm_otp_nv_counters region
when TFM_PARTITION_PROTECTED_STORAGE and
TFM_PS_ROLLBACK_PROTECTION are enabled. TF-M will increase
monotonic counters every time new data is written and given the
limited size of our OTP-region it would not support many updates.

NCSDK-17932

Signed-off-by: Markus Lassila <[email protected]>
    @MarkusLassila
    MarkusLassila committed Nov 14, 2024
    Configuration menu
    Copy the full SHA
    9e47ba2 View commit details
    Browse the repository at this point in the history