kv_config: create an internal TDB to store DeviceKey Root of Trust

[LDong-Arm]

Summary of changes

Fixes: #11788

Without this PR, an internal TDBStore is created for the use of KV Global API only when Rollback Protection (RBP) is enabled, to store CMAC data used for Rollback checks. It's not created when Rollback Protection is disabled, but we still need one in order to store the DeviceKey Root of Trust (RoT) for SecureStore's basic encryption. The lack of an internal TDBStore leads to DEVICEKEY_SAVE_FAILED error in DeviceKey::write_key_to_kvstore():

mbed-os/drivers/device_key/source/DeviceKey.cpp

Lines 127 to 131 in 33a7e66

	KVMap &kv_map = KVMap::get_instance();
	KVStore *inner_store = kv_map.get_internal_kv_instance(NULL);
	if (inner_store == NULL) {
	return DEVICEKEY_SAVE_FAILED;
	}

This happens when storage.storage_type is configured to TDB_EXTERNAL_NO_RBP or FILESYSTEM_NO_RBP, both of which are based on SecureStore. To fix the issue, this PR creates an internal TDBStore of the default/auto-calculated size.

Impact of changes

With storage.storage_type configured to TDB_EXTERNAL_NO_RBP or FILESYSTEM_NO_RBP, generated DeviceKey RoT can now be stored successfully, allowing KV global API (e.g. kv_set()) to function properly.

Migration actions required

None.

Documentation

None.

---

Pull request type

[x] Patch update (Bug fix / Target update / Docs update / Test update / Refactor)
[] Feature update (New feature / Functionality change / New API)
[] Major update (Breaking change E.g. Return code change / API behaviour change)

---

Test results

[] No Tests required for this change (E.g docs only update)
[x] Covered by existing mbed-os tests (Greentea or Unittest)
[] Tests / results supplied as part of this PR

---

Reviewers

@ARMmbed/mbed-os-core

---

[ciarmcom]

@LDong-Arm, thank you for your changes.
@ARMmbed/mbed-os-core @ARMmbed/mbed-os-maintainers please review.

[evedon]

This is a major breaking change.
I think it should be possible to use direct_access_to_devicekey instead of creating an internal TDBStore, see #11788 (comment)

[LDong-Arm]

This is a major breaking change.
I think it should be possible to use direct_access_to_devicekey instead of creating an internal TDBStore, see #11788 (comment)

Please see my comment in #11788. I think the PR doesn't break/alter any behaviours, and direct_access_to_devicekey is only for reading a key, which is still stored in the internal TDB which this PR creates.

[evedon]

Indeed direct_access_to_devicekey is only for reading a key and I was wondering if, similarly, we could have a simple API to directly write device key in internal Flash. It does not feel right to create an internal TDBStore purely for the purpose of storing the device key in kvstore.

We need to fully understand all the dependencies between SecureStore, internal TDBStore and DeviceKey before we propose a solution.

[LDong-Arm]

Closing this PR in favour of deprecating the broken configurations