How to enable cryptocell on nrf5340

RE: How to enable cryptocell on nrf5340

ByteChesser — Tue, 01 Aug 2023 18:52:09 GMT

Thank you sigurd for your answer. I figured out the second question myself. I would kindly ask if you could close the question. Thanks again!

RE: How to enable cryptocell on nrf5340

Sigurd Hellesvik — Mon, 24 Jul 2023 08:51:05 GMT

[quote user="ByteChesser"]I saw CC_LibInit function, but it cannot be stepped into with gdb and its source file doesn't seem available. Is it because the CC_LibInit is a nrf implementation that is not available to us.[/quote]

Yep. Parts of our CryptoCell libraries are not public.

[quote user="ByteChesser"]2. I am confused that as shown in backtrace, why is CC_LibInit not calling all arm cryptocell internal function but called nrf_cc3xx_platform_ctr_drbg_init (). So when nordic integrates cryptocell to tf-m, it is not as easy as calling an arm provided CC_LibInit and is done with the work for initalization?[/quote]

I do not understand the questions.
Can you try to rephrase it?

RE: How to enable cryptocell on nrf5340

ByteChesser — Fri, 21 Jul 2023 14:44:29 GMT

Thank you! I am able to use cryptocell. Now I have two more questions.

1. When I run gdb for image built by

west build -p always -b nrf5340dk_nrf5340_cpuapp_ns samples/tfm_integration/tfm_psa_test -- -DCONFIG_TFM_PSA_TEST_CRYPTO=y

I saw CC_LibInit function, but it cannot be stepped into with gdb and its source file doesn't seem available. Is it because the CC_LibInit is a nrf implementation that is not available to us.

(gdb) bt
#0  0x00013e80 in cc_mbedtls_sha256_init ()
#1  0x000127c8 in cc_mbedtls_entropy_func ()
#2  0x0001205c in mbedtls_ctr_drbg_reseed_internal ()
#3  0x000121a4 in cc_mbedtls_ctr_drbg_seed ()
#4  0x00010ff8 in nrf_cc3xx_platform_ctr_drbg_init ()
#5  0x0001291e in CC_LibInit ()
#6  0x00010f56 in nrf_cc3xx_platform_init ()
#7  0x00004c7e in crypto_platform_init ()
    at /home/zephyr/nrf-sdk/nrf/modules/tfm/tfm/boards/common/tfm_hal_platform.c:35
#8  tfm_hal_platform_init ()
    at /home/zephyr/nrf-sdk/nrf/modules/tfm/tfm/boards/common/tfm_hal_platform.c:91
#9  0x00006184 in tfm_core_init ()
    at /home/zephyr/nrf-sdk/modules/tee/tf-m/trusted-firmware-m/secure_fw/spm/cmsis_psa/main.c:44
#10 main ()
    at /home/zephyr/nrf-sdk/modules/tee/tf-m/trusted-firmware-m/secure_fw/spm/cmsis_psa/main.c:95

2. I am confused that as shown in backtrace, why is CC_LibInit not calling all arm cryptocell internal function but called nrf_cc3xx_platform_ctr_drbg_init (). So when nordic integrates cryptocell to tf-m, it is not as easy as calling an arm provided CC_LibInit and is done with the work for initalization?

RE: How to enable cryptocell on nrf5340

Sigurd Hellesvik — Tue, 18 Jul 2023 07:44:32 GMT

TF-M support on nRF devices are in the nRF Connect SDK, not zephyr. The zephyr one has limitations, and we do not support it for production.

You seem to be using Vanilla Zephyr.
To sum up the advantages you get from using the nRF Connect SDK instead of vanilla Zephyr:

The nRF Connect SDK has support for hardware acceleration for crypto using CryptoCell.
The nRF Connect SDK has a higher granularity of Kconfig options for crypto
The nRF Connect SDK has more integration towards nRF devices for bootup(e.g. to set up Root of Trust)

The nRF Connect SDK contains an almost identical version of Zephyr. So you can do most things you can do with Zephyr with the nRF Connect SDK.
If you would like to use the nRF Connect SDK, we have a good getting started guide at https://academy.nordicsemi.com/courses/nrf-connect-sdk-fundamentals/.

[quote user="ByteChesser"]As you were suggesting to check Nordic Security Module Configuration, how do we do so for Zephyr?[/quote]

You can not do so with vanilla Zephyr.

[quote user="ByteChesser"]Also, I do not know how to determine what is the nrfconnect SDK version if that is used by Zephyr underneath/eventually by the build system.[/quote]

It goes the other way. If you use the vanilla Zephyr, you do not get the nRF Connect SDK.
However, if you get the nRF Connect SDK, you also get Zephyr.

[quote user=""] figured cryptocell-312 accelerator is not enabled by default. I would like to know how I could enable it. [/quote]

Hardware acceleration is not supported for vanilla Zephyr.

Let me know if you have any questions

RE: How to enable cryptocell on nrf5340

ByteChesser — Mon, 17 Jul 2023 14:37:31 GMT

Hi Sigurd,

I am building with Zephyr using west build with tfm library included. I don't know if it uses some sdk behind the scene.

I am using nrf5340dk.

After checking DTSI file, there is one line difference between yours and my setting, which is

diff nrf5340_cpuapp.dtsi.orig nrf5340_cpuapp.dtsi.new
36c36
< zephyr,entropy = &rng_hci;
---
> zephyr,entropy = &cryptocell;

My zephyr version is the mainline/latest.

As you were suggesting to check Nordic Security Module Configuration, how do we do so for Zephyr?

Also, I do not know how to determine what is the nrfconnect SDK version if that is used by Zephyr underneath/eventually by the build system.

Thank you!

RE: How to enable cryptocell on nrf5340

Sigurd Hellesvik — Mon, 17 Jul 2023 08:10:14 GMT

Hi,

Which version of the SDK do you use?

Do you use a custom PCB or Developement kit?

For a start:
You can see Nordic Security Module: Configuration for how to configure PSA.

Also, you need cryptocell to be enabled in your DeviceTree. You can check this in your build/zephyr/zephyr.dts .

Regards,
Sigurd Hellesvik