From d43f0e05f9a804b8a291efc26ae13181be18e386 Mon Sep 17 00:00:00 2001 From: Farjad Alam Date: Wed, 21 Oct 2026 22:54:17 -0700 Subject: [PATCH 1/3] disable TZ for SBL on boot since no config. included --- libs/mcxa-security-provisioning/src/lib.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libs/mcxa-security-provisioning/src/lib.rs b/libs/mcxa-security-provisioning/src/lib.rs index 56322ce..56bec75 100644 --- a/libs/mcxa-security-provisioning/src/lib.rs +++ b/libs/mcxa-security-provisioning/src/lib.rs @@ -368,7 +368,7 @@ impl Provisioner { .with_lp_sec_boot(mcxa_ifr::LpSecBoot::Cold) .with_dice_csr_key_type(DiceCsrKeyType::Sha384AndMLDSA) .with_enf_cnsa(mcxa_ifr::EnfCnsa::CNSA2) - .with_enf_tzm_preset(true.into()) + .with_enf_tzm_preset(false.into()) .with_fast_boot_en(mcxa_ifr::InverseBigBool::False) .with_active_img_prot(mcxa_ifr::ActiveImgProt::GLBAC4) .with_fips_sha_sten(mcxa_ifr::SelfTestEnable::NotIncluded) From f71c4bb45c489a066b64646a170d9a706e8b2fec Mon Sep 17 00:00:00 2001 From: Farjad Alam Date: Thu, 22 Oct 2026 11:09:27 -0700 Subject: [PATCH 2/3] do not allow silent override of TZM settings --- libs/mcxa-security-provisioning/src/lib.rs | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/libs/mcxa-security-provisioning/src/lib.rs b/libs/mcxa-security-provisioning/src/lib.rs index 56bec75..4832473 100644 --- a/libs/mcxa-security-provisioning/src/lib.rs +++ b/libs/mcxa-security-provisioning/src/lib.rs @@ -361,8 +361,20 @@ impl Provisioner { } } - /// Enables secure boot policies in CMPA - pub fn with_secure_boot_policies(&mut self) -> &mut Self { + /// Enables secure boot policies in CMPA. + /// Note that this function is a specific policy setup for production and is not intended for DEV or factory use. + /// Use [Self::with_default_secure_cmpa_config] for standard use. + /// + /// Errors with [ProvisionError::TzmPresetEnforced] if TZM preset enforcement is already enabled, + /// rather than silently disabling it. Sets strict security policies (apart from TZM enforcement) + pub fn with_secure_boot_policies(&mut self) -> Result<&mut Self, ProvisionError> { + if !matches!( + self.ifr.cmpa.secure_boot_cfg.enf_tzm_preset(), + mcxa_ifr::BigBool::False + ) { + return Err(ProvisionError::TzmPresetEnforced); + } + self.ifr.cmpa.secure_boot_cfg = SecureBootCfg::builder() .with_sec_boot_en(mcxa_ifr::SecBootEn::OnlyPki) .with_lp_sec_boot(mcxa_ifr::LpSecBoot::Cold) @@ -382,7 +394,7 @@ impl Provisioner { self.cmpa_updated = true; - self + Ok(self) } pub fn ifr(&self) -> &IFR { @@ -399,6 +411,7 @@ pub enum ProvisionError { RotkhDeriveError(DeriveError), RotkhMismatch, NoImages, + TzmPresetEnforced, } impl From for ProvisionError { From afb681483f07ced038034a819f043b01595981aa Mon Sep 17 00:00:00 2001 From: Farjad Alam Date: Thu, 22 Oct 2026 11:17:58 -0700 Subject: [PATCH 3/3] cargo fmt --- libs/mcxa-security-provisioning/src/lib.rs | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/libs/mcxa-security-provisioning/src/lib.rs b/libs/mcxa-security-provisioning/src/lib.rs index 4832473..0bd0ef9 100644 --- a/libs/mcxa-security-provisioning/src/lib.rs +++ b/libs/mcxa-security-provisioning/src/lib.rs @@ -368,10 +368,7 @@ impl Provisioner { /// Errors with [ProvisionError::TzmPresetEnforced] if TZM preset enforcement is already enabled, /// rather than silently disabling it. Sets strict security policies (apart from TZM enforcement) pub fn with_secure_boot_policies(&mut self) -> Result<&mut Self, ProvisionError> { - if !matches!( - self.ifr.cmpa.secure_boot_cfg.enf_tzm_preset(), - mcxa_ifr::BigBool::False - ) { + if !matches!(self.ifr.cmpa.secure_boot_cfg.enf_tzm_preset(), mcxa_ifr::BigBool::False) { return Err(ProvisionError::TzmPresetEnforced); }