[SL-UP] Full integration of CTM credentials and migration. #541

lpbeliveau-silabs · 2025-08-06T22:10:15Z

Summary

We are integrating all our matter apps with the CTM by moving all provisioning data to nvm3 to prevent collision with other stack tokens in CMP apps.

Note: Moved the Chip Stack Init after the provisioning init since our migration function needs to use the provisioning manager in an initialized state.

In the future, we might migrate to user data once :

The static secure tokens incorporate features such as user data range protection
We have defined the require space for the post quantum crypto cert sizes.

Related PRs:

matter_support:
SiliconLabsSoftware/matter_support#149
matter_extension:
https://stash.silabs.com/projects/WMN_TOOLS/repos/matter_extension/pull-requests/593/overview

Related issues

https://jira.silabs.com/browse/MATTER-4883
https://jira.silabs.com/browse/MATTER-5195

Testing

Provision -> Build -> Flash -> Read NVM3 to confirm migration.

Readability checklist

The checklist below will help the reviewer finish PR review in time and keep the
code readable:

PR title is
descriptive
Apply the
“When in Rome…”
rule (coding style)
PR size is short
Try to avoid "squashing" and "force-update" in commit history
CI time didn't increase

See: Pull Request Guidelines

Copilot

Pull Request Overview

This PR integrates CTM (Chip Token Manager) credentials and migration by moving all provisioning data to nvm3 to prevent collision with other stack tokens in CMP apps. The PR updates the configuration system to use the new token manager API and implements migration functionality.

Refactored configuration system to use new CTM token manager API instead of direct NVM3 access
Added migration functionality to migrate existing attestation credentials to the new storage format
Updated build files to include new utility functions and moved chip stack initialization after provisioning

Reviewed Changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/platform/silabs/efr32/BUILD.gn	Added SilabsConfigUtils source files to the build
src/platform/silabs/SiWx917/BUILD.gn	Added SilabsConfigUtils source files to the build
src/platform/silabs/SilabsConfigUtils.h	New utility header for NVM3 error mapping
src/platform/silabs/SilabsConfigUtils.cpp	New utility implementation for NVM3 error mapping
src/platform/silabs/SilabsConfigCTM.cpp	Updated to use new token manager API and extracted MapNvm3Error
src/platform/silabs/SilabsConfig.h	Reorganized key definitions and conditionals for CTM support
src/platform/silabs/SilabsConfig.cpp	Removed duplicate MapNvm3Error function
src/platform/silabs/MigrationManager.h	Added MigrateCTM function declaration
src/platform/silabs/MigrationManager.cpp	Added CTM migration to migration table
examples/platform/silabs/provision/ProvisionStorageFlash.cpp	Added stub MigrateAttestationCredentialAPI method
examples/platform/silabs/provision/ProvisionStorageDefault.cpp	Implemented CTM migration and updated credential storage methods
examples/platform/silabs/MatterConfig.cpp	Moved chip stack initialization after provisioning setup

src/platform/silabs/SilabsConfig.h

examples/platform/silabs/provision/ProvisionStorageDefault.cpp

examples/platform/silabs/MatterConfig.cpp

src/platform/silabs/SilabsConfig.h

jmartinez-silabs · 2025-08-18T16:30:11Z

src/platform/silabs/SilabsConfig.h

+    static constexpr Key kConfigKey_Creds_Dac         = SilabsConfigKey(kMatterFactory_KeyBase, 0x31);
+    static constexpr Key kConfigKey_Creds_Pai         = SilabsConfigKey(kMatterFactory_KeyBase, 0x32);
+    static constexpr Key kConfigKey_Creds_CD          = SilabsConfigKey(kMatterFactory_KeyBase, 0x33);


need follow-up/aggrement on where to store does. I don't think nvm3 is the way to go.

NVM3 would have been the easy way to get series 2 on board as well.

jmartinez-silabs · 2025-08-18T16:31:52Z

src/platform/silabs/SilabsConfig.h

-constexpr inline uint32_t SilabsSecureTokenKey(uint8_t keyBaseOffset, uint8_t id)
-{
-    return SL_TOKEN_TYPE_STATIC_SECURE | static_cast<uint32_t>(keyBaseOffset) << 8 | id;
-}


what is the story with this SL_TOKEN_TYPE_STATIC_SECURE and now removal?

We were going to use NVM3, then we weren't, now we are going to use it again.

jmartinez-silabs · 2025-08-18T16:33:55Z

src/platform/silabs/MigrationManager.cpp

    { .migrationGroup = 2, .migrationFunc = MigrateDacProvider },
    { .migrationGroup = 3, .migrationFunc = MigrateCounterConfigs },
    { .migrationGroup = 4, .migrationFunc = MigrateHardwareVersion },
+    { .migrationGroup = 5, .migrationFunc = MigrateCTM },


Warning !!!
I think this migration group is in use in CSA for doorlock credentials.
We need to CP the migration PR before adding this migration.

There is also a catch22 here. Once this is merged, all apps must use CTM by default, else Migration will be done when CTM is not in use and will never be called again.

IF CTM implementation can become default, then we shouldn't keep SilabsConfig and SilabsConfigCTM. Does the Mig also work for 917?

We are keeping it since Series 2 cannot move to CTM right now because in series 2 the token interface relies on zigbee or embernet.

Regarding 917, I do not think the CTM supports it but I have to confirm.

Regarding the catch 22, the nvm location will be the same for all, however since Series2 cannot use the CTM API currently, we need to keep the SilabsConfig.

The final version of the DoorLock migration do not use the MigrationManager. It required to move the migrations later on on the initialization, which I deemed too risky, so the DoorLock migration end up being a standalone process.

jmartinez-silabs · 2025-08-18T16:40:22Z

examples/platform/silabs/provision/ProvisionStorageDefault.cpp

+#ifdef SL_TOKEN_MANAGER_DEFINES_H
+    sl_status_t status = sl_token_manager_set_data(token_key, const_cast<uint8_t *>(value.data()), value.size());
+#else
+    sl_status_t status = nvm3_writeData(nvm3_defaultHandle, token_key, const_cast<uint8_t *>(value.data()), value.size());


shouldn't that be using SilabsConfig.h API that abstracts this already?

jmartinez-silabs · 2025-08-18T16:40:53Z

examples/platform/silabs/provision/ProvisionStorageDefault.cpp

+#ifdef SL_TOKEN_MANAGER_DEFINES_H
+    sl_status_t status = sl_token_manager_get_data(token_key, value.data(), key_size);
+#else
+    sl_status_t status = nvm3_readData(nvm3_defaultHandle, token_key, value.data(), key_size);
+#endif // SL_TOKEN_MANAGER_DEFINES_H


same comment about the SilabsConfig API

examples/platform/silabs/provision/ProvisionStorageDefault.cpp

lpbeliveau-silabs requested review from a team and Copilot August 6, 2025 22:10

Copilot AI reviewed Aug 6, 2025

View reviewed changes

src/platform/silabs/SilabsConfig.h Outdated Show resolved Hide resolved

examples/platform/silabs/provision/ProvisionStorageDefault.cpp Show resolved Hide resolved

examples/platform/silabs/provision/ProvisionStorageDefault.cpp Show resolved Hide resolved

Full integration of CTM credentials and migration.

0f7800d

lpbeliveau-silabs force-pushed the feature/full-ctm-support branch from e65bdcf to 0f7800d Compare August 6, 2025 22:11

lpbeliveau-silabs added the changing-git-submodules-on-purpose label Aug 6, 2025

lpbeliveau-silabs added 2 commits August 6, 2025 18:18

Removed unused static address key

7b9aa8f

Added the matter_support bump for the new API

ba88056

jmartinez-silabs reviewed Aug 18, 2025

View reviewed changes

jmartinez-silabs changed the base branch from release_2.6-1.4 to release_2.7-1.4 September 17, 2025 14:13

[SL-UP] Full integration of CTM credentials and migration. #541

Are you sure you want to change the base?

[SL-UP] Full integration of CTM credentials and migration. #541

Uh oh!

Conversation

lpbeliveau-silabs commented Aug 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related PRs:

Related issues

Testing

Readability checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

lpbeliveau-silabs commented Aug 6, 2025 •

edited

Loading