TF-M NV Counters API

[jeremyherbert]

Hi,

Is it correct that nrf-sdk does not support (or have any implementation for) the "NV Counters" API in TF-M ? (needed for rollback protection in the Protected Storage service).

Thanks,

Jeremy

[dejans]

Hi Jeremy,

Platform Service Integration Guide provides information about non-volatile counters (NVC). Additionally, you could have a look at TF-M NVC interface and PS Service Build definitions. Finally, you can read more about Trusted NVC and rollback protection in Rollback protection in TF-M secure boot.

Best regards,
Dejan

[jeremyherbert]

Hi Dejan,

Yes, I found that documentation, but it says:

"The system integrators may implement this interface based on the target capabilities and set the PS_ROLLBACK_PROTECTION flag to compile in the rollback protection code."

I am wondering if nordic has indeed implemented this interface or not for the nrf91/nrf53, because I can't seem to find the code for it in the TF-M source. (I can find it for the Cypress PSOC64 for example)

[dejans]

Hi Jeremy,

We are using default TF-M implementation which should be usable for development/production. 
In the code, relevant file is ncs/modules/tee/tf-m/trusted-firmware-m/platform/ext/common/template/nv_counters.c (github link).

Best regards,
Dejan

[jeremyherbert]

Thank you! So based on this, is it correct that only 10k writes to the PSS are possible before the device internal flash is considered to be worn out (ie past the guaranteed number of writes)

[dejans]

Hi Jeremy,

jeremyherbert said:

So based on this, is it correct that only 10k writes to the PSS are possible before the device internal flash is considered to be worn out (ie past the guaranteed number of writes)

Based on what?
What do you refer to as PSS?

Best regards,
Dejan

[jeremyherbert]

Hi Dejan,

I ended up checking with the TF-M mailing list and indeed the external protected storage (PS - PSS was a typo sorry) is limited by the flash endurance of a single page in the internal flash regardless of the endurance of external storage, which is 10k writes for the nrf53/nrf91. So after 10k writes, one must assume that the NV counters fail to zero and then the various rollback protections in TF-M will then fail insecure.

Thanks,

Jeremy