TF-M Isolation Level is 1 with Profile Large

[Maweb]

Dear all

Is CONFIG_TFM_ISOLATION_LEVEL = 2 in general supported by Nordic SDK v2.6.0 on a nRF9160?

If set CONFIG_TFM_ISOLATION_LEVEL = 2 in prj.conf, it's always overwritten to 1 by the default value in /nrf/modules/trusted-firmware-m/Kconfig Related kconfigs set in prj.conf:

• CONFIG_TFM_IPC=1
• CONFIG_TFM_ISOLATION_LEVEL=2
• CONFIG_TFM_PROFILE_TYPE_LARGE=y

Thanks for your support

Manuel

[jeremyherbert]

I was trying to do the same thing but accessing OTP in NS, and I ended up implementing it this way. Here is my patch (for ncs v2.5.2)

diff --git a/modules/tfm/tfm/boards/services/include/tfm_read_ranges.h b/modules/tfm/tfm/boards/services/include/tfm_read_ranges.h
index 2f95b4eb7..56b366211 100644
--- a/modules/tfm/tfm/boards/services/include/tfm_read_ranges.h
+++ b/modules/tfm/tfm/boards/services/include/tfm_read_ranges.h
@@ -41,6 +41,15 @@
 
 #endif /* NRF_FICR_S_BASE */
 
+#ifdef NRF_UICR_S_BASE
+
+#define UICR_BASE              NRF_UICR_S_BASE
+
+#define UICR_OTP_ADDR          (UICR_BASE + offsetof(NRF_UICR_Type, OTP))
+#define UICR_OTP_SIZE          (sizeof(((NRF_UICR_Type *)0)->OTP))
+
+#endif /* NRF_UICR_S_BASE */
+
 static const struct tfm_read_service_range ranges[] = {
 #ifdef PM_MCUBOOT_ADDRESS
        /* Allow reads of mcuboot metadata */
@@ -61,6 +70,9 @@ static const struct tfm_read_service_range ranges[] = {
 #if defined(FICR_SIPINFO_ADDR)
        { .start = FICR_SIPINFO_ADDR, .size = FICR_SIPINFO_SIZE },
 #endif
+#if defined(UICR_OTP_ADDR)
+       { .start = UICR_OTP_ADDR, .size = UICR_OTP_SIZE },
+#endif
 };
 
 #endif /* TFM_READ_RANGES_H__ */

I have no idea if Nordic will support this in their SDK (perhaps hidden behind a Kconfig option?). And I'm not sure if they will accept a PR from a non-employee.

[Amanda Hsieh]

Hi, 

There is no public repository for sdk-modules to pull requests, so I will forward it to the team. Thanks for the nice sharing. 

-Amanda H.