tests: zephyr: extend secure_storage test coverage

Extend the test scenarios found under
tests/subsys/secure_storage/psa/its with configurations tailored to NCS.
CONFIG_NRF_SECURITY and other relevant Kconfig options are enabled.

The primary intent is to test the backward-compatible implementation,
so all test scenarios except the ZMS one use it.

Signed-off-by: Tomi Fontanilles <[email protected]>

Author: tomi-font

CODEOWNERS

@@ -946,6 +946,7 @@
 /tests/subsys/pcd/                        @nrfconnect/ncs-pluto
 /tests/subsys/sdfw_services/              @nrfconnect/ncs-aurora
 /tests/subsys/suit/                       @nrfconnect/ncs-charon
+/tests/subsys/usb/negotiated_speed/       @nrfconnect/ncs-low-level-test
 /tests/tfm/                               @nrfconnect/ncs-aegir @magnev
 /tests/unity/                             @nordic-krch
 /tests/zephyr/boards/nrf/                 @nrfconnect/ncs-low-level-test
@@ -969,7 +970,7 @@
 /tests/zephyr/drivers/uart/               @nrfconnect/ncs-low-level-test
 /tests/zephyr/drivers/watchdog/           @nrfconnect/ncs-low-level-test
 /tests/zephyr/kernel/timer/timer_behavior/ @nrfconnect/ncs-low-level-test
-/tests/subsys/usb/negotiated_speed/       @nrfconnect/ncs-low-level-test
+/tests/zephyr/subsys/secure_storage/      @nrfconnect/ncs-aegir
 /tests/zephyr/subsys/settings/performance/ @nrfconnect/ncs-pluto @rghaddab
 
 /tests/benchmarks/multicore/idle/*.rst    @nrfconnect/ncs-si-bluebagel-doc

scripts/ci/tags.yaml

@@ -224,8 +224,11 @@ ci_samples_crypto: &ci_crypto
     - nrf/samples/crypto/
     - nrf/subsys/nrf_security/
     - nrf/subsys/partition_manager/
+    - nrf/subsys/secure_storage/
+    - nrf/subsys/trusted_storage/
     - nrf/sysbuild/
     - nrf/tests/crypto/
+    - nrf/tests/zephyr/subsys/secure_storage/
     - zephyr/cmake/
     - zephyr/drivers/entropy/
     - zephyr/drivers/serial/
@@ -1359,6 +1362,7 @@ ci_applications_protocols_serialization:
     - nrf/subsys/net/openthread/
     - nrf/subsys/nrf_rpc/
     - nrf/subsys/nrf_security/
+    - nrf/subsys/secure_storage/
     - nrf/subsys/trusted_storage/
     - nrfxlib/crypto/
     - nrfxlib/nrf_802154/

tests/zephyr/subsys/secure_storage/psa/its/CMakeLists.txt

@@ -0,0 +1,11 @@
+cmake_minimum_required(VERSION 3.20.0)
+find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
+project(app)
+
+target_sources(app PRIVATE ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/src/main.c)
+
+zephyr_sources_ifdef(CONFIG_SECURE_STORAGE_ITS_TRANSFORM_IMPLEMENTATION_CUSTOM
+  ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/src/custom_transform.c)
+
+zephyr_sources_ifdef(CONFIG_SECURE_STORAGE_ITS_STORE_IMPLEMENTATION_CUSTOM
+  ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/src/custom_store.c)

tests/zephyr/subsys/secure_storage/psa/its/prj.conf

@@ -0,0 +1,9 @@
+CONFIG_ZTEST=y
+
+CONFIG_SECURE_STORAGE_TRUSTED_STORAGE_COMPATIBILITY=y
+
+CONFIG_NRF_SECURITY=y
+CONFIG_PSA_WANT_GENERATE_RANDOM=y
+
+CONFIG_MPU_ALLOW_FLASH_WRITE=y
+CONFIG_HW_UNIQUE_KEY_WRITE_ON_CRYPTO_INIT=y

tests/zephyr/subsys/secure_storage/psa/its/testcase.yaml

@@ -0,0 +1,58 @@
+common:
+  sysbuild: true
+  tags:
+    - sysbuild
+    - psa
+    - crypto
+    - ci_tests_crypto
+  platform_allow:
+    - native_sim
+    - nrf54l15dk/nrf54l15/cpuapp
+    - nrf9151dk/nrf9151
+    - nrf52840dk/nrf52840
+  integration_platforms:
+    - native_sim
+    - nrf54l15dk/nrf54l15/cpuapp
+    - nrf9151dk/nrf9151
+    - nrf52840dk/nrf52840
+
+tests:
+  nrf.extended.secure_storage.psa.its.secure_storage.store.zms:
+    filter: not CONFIG_SOC_NRF52840
+    extra_args:
+      - SB_CONFIG_PARTITION_MANAGER=n
+      - EXTRA_DTC_OVERLAY_FILE=${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/zms.overlay
+      - EXTRA_CONF_FILE=\
+        ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-secure_storage.conf;\
+        ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-store_zms.conf;\
+        ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-transform_default.conf
+
+  nrf.extended.secure_storage.backward_compatibility.psa.its.secure_storage.store.settings:
+    extra_args: "EXTRA_CONF_FILE=\
+      ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-secure_storage.conf;\
+      ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-transform_default.conf;\
+      ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-store_settings.conf"
+    extra_configs:
+      - CONFIG_NVS=n
+      - CONFIG_ZMS=y
+
+  nrf.extended.secure_storage.backward_compatibility.psa.its.secure_storage.custom.transform:
+    extra_args: "EXTRA_CONF_FILE=\
+      ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-secure_storage.conf;\
+      ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-transform_custom.conf;\
+      ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-store_settings.conf"
+    extra_configs:
+      - CONFIG_NVS=n
+      - CONFIG_ZMS=y
+
+  nrf.extended.secure_storage.backward_compatibility.psa.its.secure_storage.custom.store:
+    extra_args: "EXTRA_CONF_FILE=\
+      ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-secure_storage.conf;\
+      ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-transform_default.conf;\
+      ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-store_custom.conf"
+
+  nrf.extended.secure_storage.backward_compatibility.psa.its.secure_storage.custom.both:
+    extra_args: "EXTRA_CONF_FILE=\
+      ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-secure_storage.conf;\
+      ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-transform_custom.conf;\
+      ${ZEPHYR_BASE}/tests/subsys/secure_storage/psa/its/overlay-store_custom.conf"