Harden LPC55S69 TrustZone isolation and add tests, CI and docs

.github/workflows/lpc55s69-emulator-tests.yml

@@ -0,0 +1,81 @@
+name: lpc55s69-emulator-tests
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  # Boot, update and rollback on the m33mu LPC55S69 model, plus a bootloader
+  # self-update on the plain config: the TrustZone wolfBoot does not fit an
+  # update partition, and its non-secure app updates through the NSC veneers.
+  lpc55s69-emulator-tests:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfboot-ci-m33mu:latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - config: lpc55s69
+            scenarios: A,B,C,S
+          - config: lpc55s69-tz
+            scenarios: A,B,C
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Init submodules
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git submodule update --init --single-branch
+
+      - uses: actions/checkout@v4
+        with:
+          repository: nxp-mcuxpresso/CMSIS_5
+          path: CMSIS_5
+
+      - name: Cache MCUXpresso SDK
+        id: cache-mcuxpresso
+        uses: actions/cache@v4
+        with:
+          path: |
+            mcuxpresso-sdk
+            venv
+          key: mcuxpresso-sdk-lpcxpresso55s69-emu-${{ hashFiles('.github/workflows/lpc55s69-emulator-tests.yml') }}
+
+      - name: Setup MCUXpresso SDK
+        if: steps.cache-mcuxpresso.outputs.cache-hit != 'true'
+        run: |
+          python3 -m venv venv
+          . venv/bin/activate
+          pip install west
+          west init -m https://github.com/nxp-mcuxpresso/mcuxsdk-manifests.git mcuxpresso-sdk
+          cd mcuxpresso-sdk
+          sed -i '/se_hostlib\|emwin/d' manifests/boards/lpcxpresso55s69.yml
+          west update_board --set board lpcxpresso55s69
+
+      - name: Use the MCUXpresso SDK for the wolfBoot build
+        run: |
+          echo "MCUXSDK=1" >> "$GITHUB_ENV"
+          echo "MCUXPRESSO=$GITHUB_WORKSPACE/mcuxpresso-sdk/mcuxsdk" >> "$GITHUB_ENV"
+          echo "MCUXPRESSO_CMSIS=$GITHUB_WORKSPACE/CMSIS_5/CMSIS" >> "$GITHUB_ENV"
+
+      - name: Configure ${{ matrix.config }} and build wolfboot
+        run: |
+          cp config/examples/${{ matrix.config }}.config .config
+          make include/target.h
+          make -C tools/keytools
+          make -C tools/bin-assemble
+          make wolfboot.bin
+
+      - name: Run emu test (${{ matrix.config }})
+        working-directory: test-app/emu-test-apps
+        run: |
+          SCENARIOS=${{ matrix.scenarios }} BOOT_TIMEOUT=30 UPDATE_TIMEOUT=60 REBOOT_TIMEOUT=30 ./test.sh
+
+      - name: Upload emulator logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: lpc55s69-emu-logs-${{ matrix.config }}
+          path: test-app/emu-test-apps/lpc55s69/*.log

.github/workflows/test-configs.yml

@@ -185,13 +185,63 @@ jobs:
       config-file: ./config/examples/lpc55s69-tz-psa.config
       board-name: lpcxpresso55s69
 
+  lpc55s69_hwpuf_test:
+    uses: ./.github/workflows/test-build-mcux-sdk-manifests.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/lpc55s69.config
+      board-name: lpcxpresso55s69
+      make-args: HWPUF=1
+
   lpc55s69_benchmark_test:
     uses: ./.github/workflows/test-build-mcux-sdk-manifests.yml
     with:
       arch: arm
       config-file: ./config/examples/lpc55s69-benchmark.config
       board-name: lpcxpresso55s69
 
+  lpc55s69_no_uart_test:
+    uses: ./.github/workflows/test-build-mcux-sdk-manifests.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/lpc55s69.config
+      board-name: lpcxpresso55s69
+      make-args: DEBUG_UART=0
+
+  lpc55s69_boot_benchmark_test:
+    uses: ./.github/workflows/test-build-mcux-sdk-manifests.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/lpc55s69.config
+      board-name: lpcxpresso55s69
+      make-args: BOOT_BENCHMARK=1
+
+  lpc55s69_pka_test:
+    uses: ./.github/workflows/test-build-mcux-sdk-manifests.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/lpc55s69.config
+      board-name: lpcxpresso55s69
+      make-args: PKA=1
+
+  # TrustZone without the wolfCrypt NSC API
+  lpc55s69_tz_no_wolfcrypt_test:
+    uses: ./.github/workflows/test-build-mcux-sdk-manifests.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/lpc55s69-tz.config
+      board-name: lpcxpresso55s69
+      make-args: "WOLFCRYPT_TZ=0 WOLFCRYPT_TZ_PKCS11=0"
+
+  # Without the console the secure RNG still needs the reset driver linked in
+  lpc55s69_tz_no_uart_test:
+    uses: ./.github/workflows/test-build-mcux-sdk-manifests.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/lpc55s69-tz.config
+      board-name: lpcxpresso55s69
+      make-args: DEBUG_UART=0
+
   m2354_test:
     uses: ./.github/workflows/test-build.yml
     with:

.github/workflows/trustzone-emulator-tests.yml

@@ -169,10 +169,10 @@ jobs:
           m33mu tools/keytools/otp/otp-keystore-primer.bin --persist --timeout 10 || true
           m33mu wolfboot.bin test-app/image_v1_signed.bin:0x60000 --uart-stdout --expect-bkpt 0x7f --timeout 600 --persist
 
-      # LPC55S69 DICE attestation + HW PUF. The PUF root key is provisioned
-      # at first boot (WOLFBOOT_HWPUF_PROVISION=1) and used for DICE key
-      # derivation on subsequent boots. Requires m33mu with lpc55s69 PUF/RNG
-      # models (wolfboot-ci >= 1.22).
+      # LPC55S69 DICE attestation + HW PUF. The first boot enrolls the PUF
+      # and stores the record (WOLFBOOT_HWPUF_PROVISION=1); the second boot
+      # must reuse it and report the same UEID. Needs the m33mu lpc55s69
+      # PUF/RNG models and --persist (m33mu c2d903e, wolfboot-ci >= 1.28).
       # The lpc55s69 HAL needs MCUXpresso SDK headers (fsl_common.h); same
       # west-based setup as the lpc55s69 jobs in test-configs.yml.
       - name: Checkout CMSIS (lpc55s69)
@@ -192,8 +192,9 @@ jobs:
           sed -i '/se_hostlib\|emwin/d' manifests/boards/lpcxpresso55s69.yml
           west update_board --set board lpcxpresso55s69
 
-      - name: Clean and build test with DICE attestation + HW PUF (lpc55s69)
+      - name: Build and run DICE attestation + HW PUF across two boots (lpc55s69)
         run: |
+          set -o pipefail
           make clean distclean
           cp config/examples/lpc55s69-tz-psa.config .config
           sed -i 's/^HWPUF?=0/HWPUF?=1/' .config
@@ -203,19 +204,42 @@ jobs:
           grep -q '^WOLFBOOT_HWPUF_PROVISION?=1' .config
           grep -q '^WOLFBOOT_UDS_UID_FALLBACK_FORTEST?=0' .config
           make MCUXSDK=1 MCUXPRESSO="$GITHUB_WORKSPACE/mcuxpresso-sdk/mcuxsdk" MCUXPRESSO_CMSIS="$GITHUB_WORKSPACE/CMSIS_5/CMSIS"
-
-      # Single boot: enroll the PUF, store the record, attest.
-      # TODO: add a second --persist boot checking the stored record is reused
-      # (same UEID) once the CI image ships an m33mu with lpc55s69 --persist
-      # support (m33mu c2d903e, after v1.23).
-      - name: Run DICE attestation + HW PUF (lpc55s69)
+          BOOT_ADDR=$(sed -n 's/^WOLFBOOT_PARTITION_BOOT_ADDRESS?*=//p' .config)
+          rm -rf /tmp/m33mu-lpc55s69-hwpuf-persist
+          mkdir -p /tmp/m33mu-lpc55s69-hwpuf-persist
+          cp wolfboot.bin test-app/image_v1_signed.bin /tmp/m33mu-lpc55s69-hwpuf-persist/
+          cd /tmp/m33mu-lpc55s69-hwpuf-persist
+          for boot in first second; do
+            m33mu wolfboot.bin image_v1_signed.bin:$BOOT_ADDR --cpu lpc55s69 --persist --uart-stdout --expect-bkpt 0x7f --timeout 300 \
+              | tee /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
+            grep -q "Booting version:" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
+            grep -q "Checking integrity...done" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
+            grep -q "Verifying signature...done" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
+            grep -q "attest: token size" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
+            grep -q "state=0x00" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
+            grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log
+          done
+          # The second boot starts confirmed, so it attested from the stored record
+          grep -q "boot:   ver=0x1 state=0x00" /tmp/m33mu-lpc55s69-dice-hwpuf-second.log
+          first=$(python3 $GITHUB_WORKSPACE/tools/scripts/eat_ueid.py /tmp/m33mu-lpc55s69-dice-hwpuf-first.log)
+          second=$(python3 $GITHUB_WORKSPACE/tools/scripts/eat_ueid.py /tmp/m33mu-lpc55s69-dice-hwpuf-second.log)
+          echo "UEID first boot:  $first"
+          echo "UEID second boot: $second"
+          test -n "$first"
+          test "$first" = "$second"
+
+      - name: Build and run persistent PKCS11 test (lpc55s69)
         run: |
           set -o pipefail
-          m33mu wolfboot.bin test-app/image_v1_signed.bin:0x48000 --cpu lpc55s69 --uart-stdout --expect-bkpt 0x7f --timeout 300 \
-            | tee /tmp/m33mu-lpc55s69-dice-hwpuf.log
-          grep -q "Booting version:" /tmp/m33mu-lpc55s69-dice-hwpuf.log
-          grep -q "Checking integrity...done" /tmp/m33mu-lpc55s69-dice-hwpuf.log
-          grep -q "Verifying signature...done" /tmp/m33mu-lpc55s69-dice-hwpuf.log
-          grep -q "attest: token size" /tmp/m33mu-lpc55s69-dice-hwpuf.log
-          grep -q "state=0x00" /tmp/m33mu-lpc55s69-dice-hwpuf.log
-          grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-lpc55s69-dice-hwpuf.log
+          make clean distclean
+          cp config/examples/lpc55s69-tz.config .config
+          make MCUXSDK=1 MCUXPRESSO="$GITHUB_WORKSPACE/mcuxpresso-sdk/mcuxsdk" MCUXPRESSO_CMSIS="$GITHUB_WORKSPACE/CMSIS_5/CMSIS" PKCS11_TESTAPP=1
+          BOOT_ADDR=$(sed -n 's/^WOLFBOOT_PARTITION_BOOT_ADDRESS?*=//p' .config)
+          m33mu wolfboot.bin test-app/image_v1_signed.bin:$BOOT_ADDR --cpu lpc55s69 --persist --uart-stdout --timeout 300 --expect-bkpt 0x7d \
+            | tee /tmp/m33mu-lpc55s69-pkcs11-first.log
+          grep -q "pkcs11: created persistent PKCS11 objects" /tmp/m33mu-lpc55s69-pkcs11-first.log
+          grep -q "pkcs11: success" /tmp/m33mu-lpc55s69-pkcs11-first.log
+          m33mu wolfboot.bin test-app/image_v1_signed.bin:$BOOT_ADDR --cpu lpc55s69 --persist --uart-stdout --timeout 300 --expect-bkpt 0x7f \
+            | tee /tmp/m33mu-lpc55s69-pkcs11-second.log
+          grep -q "pkcs11: restored persistent PKCS11 objects" /tmp/m33mu-lpc55s69-pkcs11-second.log
+          grep -q "pkcs11: success" /tmp/m33mu-lpc55s69-pkcs11-second.log

.gitignore

@@ -252,6 +252,10 @@ tools/unit-tests/unit-flash-write-mcxa
 tools/unit-tests/unit-rw612-flash
 tools/unit-tests/unit-rw612-tz
 tools/unit-tests/unit-rw612-uart
+tools/unit-tests/unit-lpc55s69-flash
+tools/unit-tests/unit-lpc55s69-tz
+tools/unit-tests/unit-lpc55s69-uart
+tools/unit-tests/unit-lpc55s69-puf
 tools/unit-tests/unit-flash-write-nrf52
 tools/unit-tests/unit-flash-write-same51
 tools/unit-tests/unit-flash-write-samr21

arch.mk

@@ -2161,7 +2161,7 @@ ifeq ($(TARGET),lpc55s69)
   CFLAGS+=-DCPU_$(MCUXPRESSO_CPU)
   CFLAGS+=-DFSL_SDK_DISABLE_DRIVER_CLOCK_CONTROL=1
   CFLAGS+=-DFSL_SDK_DISABLE_DRIVER_RESET_CONTROL=1
-  CFLAGS+=-mcpu=cortex-m33 -DCORTEX_M33 -U__ARM_FEATURE_DSP
+  CFLAGS+=-mcpu=cortex-m33 -DCORTEX_M33
   LDFLAGS+=-mcpu=cortex-m33 -Wl,--no-warn-rwx-segments
   OBJS+=\
       $(MCUXPRESSO_PROJECT_TEMPLATE)/clock_config.o \

config/examples/lpc55s69-benchmark.config

@@ -3,6 +3,7 @@ TZEN?=0
 TARGET?=lpc55s69
 SIGN?=ECC384
 HASH?=SHA256
+IMAGE_HEADER_SIZE?=512
 MCUXSDK?=1
 MCUXPRESSO?=$(PWD)/../NXP/mcuxpresso-sdk/mcuxsdk
 MCUXPRESSO_CMSIS?=$(PWD)/../NXP/CMSIS_5/CMSIS
@@ -20,7 +21,8 @@ EXT_FLASH?=0
 SPI_FLASH?=0
 ALLOW_DOWNGRADE?=0
 NVM_FLASH_WRITEONCE?=1
-NO_ARM_ASM=1
+# The Thumb-2 SHA assembly is slower than C on this part; the SP math uses DSP
+NO_ARM_ASM?=1
 WOLFBOOT_VERSION?=0
 V?=0
 SPMATH?=1

config/examples/lpc55s69-tz-psa.config

@@ -3,6 +3,7 @@ TZEN?=1
 TARGET?=lpc55s69
 SIGN?=ECC384
 HASH?=SHA256
+IMAGE_HEADER_SIZE?=512
 MCUXSDK?=1
 MCUXPRESSO?=$(PWD)/../NXP/mcuxpresso-sdk/mcuxsdk
 MCUXPRESSO_CMSIS?=$(PWD)/../NXP/CMSIS_5/CMSIS
@@ -20,7 +21,8 @@ EXT_FLASH?=0
 SPI_FLASH?=0
 ALLOW_DOWNGRADE?=0
 NVM_FLASH_WRITEONCE?=1
-NO_ARM_ASM=1
+# The Thumb-2 SHA assembly is slower than C on this part; the SP math uses DSP
+NO_ARM_ASM?=1
 WOLFBOOT_VERSION?=0
 V?=0
 SPMATH?=1
@@ -41,12 +43,13 @@ WOLFBOOT_HWPUF_PROVISION?=0
 
 WOLFBOOT_SECTOR_SIZE?=0x200
 
-# 200KB boot, 80KB keyvault, 8KB NSC, 56KB partitions, 512 swap
-WOLFBOOT_KEYVAULT_ADDRESS?=0x10032000
-WOLFBOOT_KEYVAULT_SIZE?=0x14000
-WOLFBOOT_NSC_ADDRESS?=0x10046000
+# 248KB wolfBoot, 8KB NSC, 128KB partitions on the 32KB AHB secure rule grid,
+# 0x80000-0x80FFF free for the HWPUF record, 512B swap, 88KB keyvault
+WOLFBOOT_NSC_ADDRESS?=0x1003E000
 WOLFBOOT_NSC_SIZE?=0x2000
-WOLFBOOT_PARTITION_SIZE?=0xE000
-WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x00048000
-WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x00056000
-WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x00064000
+WOLFBOOT_PARTITION_SIZE?=0x20000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x00040000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x00060000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x00081000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x10082000
+WOLFBOOT_KEYVAULT_SIZE?=0x16000

config/examples/lpc55s69-tz.config

@@ -3,6 +3,7 @@ TZEN?=1
 TARGET?=lpc55s69
 SIGN?=ECC384
 HASH?=SHA256
+IMAGE_HEADER_SIZE?=512
 MCUXSDK?=1
 MCUXPRESSO?=$(PWD)/../NXP/mcuxpresso-sdk/mcuxsdk
 MCUXPRESSO_CMSIS?=$(PWD)/../NXP/CMSIS_5/CMSIS
@@ -20,7 +21,8 @@ EXT_FLASH?=0
 SPI_FLASH?=0
 ALLOW_DOWNGRADE?=0
 NVM_FLASH_WRITEONCE?=1
-NO_ARM_ASM=1
+# The Thumb-2 SHA assembly is slower than C on this part; the SP math uses DSP
+NO_ARM_ASM?=1
 WOLFBOOT_VERSION?=0
 V?=0
 SPMATH?=1
@@ -37,12 +39,13 @@ HWPUF?=0
 
 WOLFBOOT_SECTOR_SIZE?=0x200
 
-# 200KB boot, 80KB keyvault, 8KB NSC, 56KB partitions, 512 swap
-WOLFBOOT_KEYVAULT_ADDRESS?=0x10032000
-WOLFBOOT_KEYVAULT_SIZE?=0x14000
-WOLFBOOT_NSC_ADDRESS?=0x10046000
+# 248KB wolfBoot, 8KB NSC, 128KB partitions on the 32KB AHB secure rule grid,
+# 0x80000-0x80FFF free for the HWPUF record, 512B swap, 88KB keyvault
+WOLFBOOT_NSC_ADDRESS?=0x1003E000
 WOLFBOOT_NSC_SIZE?=0x2000
-WOLFBOOT_PARTITION_SIZE?=0xE000
-WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x00048000
-WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x00056000
-WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x00064000
+WOLFBOOT_PARTITION_SIZE?=0x20000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x00040000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x00060000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x00081000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x10082000
+WOLFBOOT_KEYVAULT_SIZE?=0x16000

config/examples/lpc55s69.config

@@ -3,6 +3,7 @@ TZEN?=0
 TARGET?=lpc55s69
 SIGN?=ECC384
 HASH?=SHA256
+IMAGE_HEADER_SIZE?=512
 MCUXSDK?=1
 MCUXPRESSO?=$(PWD)/../NXP/mcuxpresso-sdk/mcuxsdk
 MCUXPRESSO_CMSIS?=$(PWD)/../NXP/CMSIS_5/CMSIS
@@ -20,7 +21,8 @@ EXT_FLASH?=0
 SPI_FLASH?=0
 ALLOW_DOWNGRADE?=0
 NVM_FLASH_WRITEONCE?=1
-NO_ARM_ASM=1
+# The Thumb-2 SHA assembly is slower than C on this part; the SP math uses DSP
+NO_ARM_ASM?=1
 WOLFBOOT_VERSION?=0
 V?=0
 SPMATH?=1
@@ -35,9 +37,9 @@ HWPUF?=0
 
 WOLFBOOT_SECTOR_SIZE?=0x200
 
-# Default configuration
-# 44KB boot, 52KB partitions, 512 swap
-WOLFBOOT_PARTITION_SIZE?=0xB000
-WOLFBOOT_PARTITION_BOOT_ADDRESS?=0xD000
-WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x18000
-WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x23000
+# 64KB wolfBoot, 192KB partitions, 512B swap; 0x80000-0x80FFF stays free
+# for the HWPUF provisioning record
+WOLFBOOT_PARTITION_SIZE?=0x30000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x10000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x40000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x70000