Dumb HTTP Server with TF-M

[frederikfunk]

Hi,

I am trying to use ethernet on an stm32h573i_dk board with TF-M enabled. I am taking the dumb_http_server example, add CONFIG_BUILD_WITH_TFM=y to the prj.conf and chose the ns version of the board. Then I run the regression script to set the option bytes of the board and flash it.

Overall steps are:

1. Add CONFIG_BUILD_WITH_TFM=y to samples/net/sockets/dumb_http_server/prj.conf
2. Run west build -p -b stm32h573i_dk/stm32h573xx/ns samples/net/sockets/dumb_http_server
3. Run ./build/tfm/api_ns/regression.sh
4. west flash

The problem is that the network does not come up. Console output is:

[INF] BANK 1 secure flash [0, 67] : OB [0, 127]
[ERR] Unexpected value for secure flash protection: set wmsec1
[INF] BANK 2 secure flash [127, 0] : OB [0, 127]
[INF] BANK 1 flash write protection group 0x1c: OB 0x0
[ERR] Unexpected value for write protection : set wrp1
[INF] BANK 1 hide protection [0, 19] : OB [1, 0]
[ERR] Unexpected value for hide protection : set hdp1
[INF] Starting bootloader
[WRN] This device was provisioned with dummy keys. This device is NOT SECURE
[INF] Primary image: magic=good, swap_type=0x1, copy_done=0x3, image_ok=0x1
[INF] Scratch: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
[INF] Boot source: primary slot
[INF] Image index: 1, Swap type: none
[INF] Primary image: magic=good, swap_type=0x1, copy_done=0x3, image_ok=0x1
[INF] Scratch: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
[INF] Boot source: primary slot
[INF] Image index: 0, Swap type: none
[INF] Bootloader chainload address offset: 0x38000
[INF] Image version: v0.0.0
[INF] Jumping to the first image slot
Booting TF-M v2.2.2+g6788687e0
[WRN] This device was provisioned with dummy keys. This device is NOT SECURE
[Sec Thread] Secure image initializing!
Creating an empty ITS flash layout.
Creating an empty PS flash layout.
[INF][PS] Encryption alg: 0x5500200
[INF][Crypto] Init HW accelerator...
[INF][Crypto] Init HW accelerator... complete.
[00:00:00.050,000] <inf> phy_mii: PHY (0) ID 7C131
*** Booting Zephyr OS build v4.3.0-4998-g42396f0e8fcd ***
[00:00:00.051,000] <inf> net_config: Initializing network
[00:00:00.051,000] <inf> net_config: Waiting interface 1 (0x20000df8) to be up...
[00:00:30.052,000] <inf> net_config: IPv4 address: 192.0.2.1
[00:00:30.052,000] <err> net_config: Timeout while waiting network interface
[00:00:30.052,000] <err> net_config: Network initialization failed (-115)

Does anyone have expierience with the combination of TF-M and peripherals? Do I have the make ethernet available to the non-secure application somehow? Or is there any problems with memory/dma/IRQs?

Thank you very much!

[jukkar]

I cannot comment on TF-M but for networking issue, I see that you have a network interface there in the system

[00:00:00.051,000] <inf> net_config: Waiting interface 1 (0x20000df8) to be up...

It is just that the interface does not come up (I assume you have the Ethernet cable connected here)

[00:00:30.052,000] <inf> net_config: IPv4 address: 192.0.2.1
[00:00:30.052,000] <err> net_config: Timeout while waiting network interface
[00:00:30.052,000] <err> net_config: Network initialization failed (-115)

If you have network shell enabled, you can try to do that manually net iface up 1. If that does not bring up the interface, then the issue is probably in the Ethernet driver or board itself.

[frederikfunk]

Thanks for your input!

I am not so sure about that. The project works fine when built without TF-M (network comes up and I can access the server).
So the problem must lie somewhere in using TF-M or something that comes along with it (using the non-secure version of the board or setting the option bytes).

It might be that TrustZone is messing with the ethernet driver, but the question would be how exactly.

[jukkar]

If you are missing Ethernet driver (so that it is not compiled in), then you would not see network interface at all and the output message would say There is no network interface to work with!. It is possible that the Ethernet driver is not working correctly if TF-M is enabled, you could try to ask more help for example in #stm32 channel in Discord.

[tpambor]

I submitted a fix, can you check if this solves your problem? #103228

[frederikfunk]

Thank you very much for the quick fix! This indeed solves the problem.
But what is used as source of entropy in the end when disabling the RNG?

I tried to follow the hint with CONFIG_ENTROPY_PSA_CRYPTO_RNG which then should use the PSA API for getting random numbers. I made that work by adding an overlay to the board:

/ {
    chosen {
        zephyr,entropy = &psa_rng;
    };

    psa_rng: psa-rng {
        compatible = "zephyr,psa-crypto-rng";
        status = "okay";
    };
};

[tpambor]

Thanks for the feedback. I updated the PR to activate PSA RNG by default for stm32h573i_dk/stm32h573xx/ns so that a board overlay should not be necessary.

[frederikfunk]

@jukkar, you were right, the network interface not coming up was just a mistake from my side (using the wrong rj45 port on my laptop...)

Still, I never got it working with TF-M and I found that the underlying problem is the RNG. When creating the socket, some random numbers are used here. The underlying implementation for stm32h573dk tries to use the hardware RNG which is marked as secure by the TF-M and thus cannot be used.