@@ -178,6 +178,20 @@ jobs:
       config-file: ./config/examples/lpc55s69-tz.config
       board-name: lpcxpresso55s69
 
+  lpc55s69_tz_psa_test:
+    uses: ./.github/workflows/test-build-mcux-sdk-manifests.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/lpc55s69-tz-psa.config
+      board-name: lpcxpresso55s69
+
+  lpc55s69_benchmark_test:
+    uses: ./.github/workflows/test-build-mcux-sdk-manifests.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/lpc55s69-benchmark.config
+      board-name: lpcxpresso55s69
+
   m2354_test:
     uses: ./.github/workflows/test-build.yml
     with:
 
@@ -168,3 +168,54 @@ jobs:
           ./tools/keytools/otp/otp-keystore-gen
           m33mu tools/keytools/otp/otp-keystore-primer.bin --persist --timeout 10 || true
           m33mu wolfboot.bin test-app/image_v1_signed.bin:0x60000 --uart-stdout --expect-bkpt 0x7f --timeout 600 --persist
+
+      # LPC55S69 DICE attestation + HW PUF. The PUF root key is provisioned
+      # at first boot (WOLFBOOT_HWPUF_PROVISION=1) and used for DICE key
+      # derivation on subsequent boots. Requires m33mu with lpc55s69 PUF/RNG
+      # models (wolfboot-ci >= 1.22).
+      # The lpc55s69 HAL needs MCUXpresso SDK headers (fsl_common.h); same
+      # west-based setup as the lpc55s69 jobs in test-configs.yml.
+      - name: Checkout CMSIS (lpc55s69)
+        uses: actions/checkout@main
+        with:
+          repository: nxp-mcuxpresso/CMSIS_5
+          path: CMSIS_5
+
+      - name: Setup MCUXpresso SDK (lpc55s69)
+        shell: bash
+        run: |
+          python3 -m venv venv
+          source venv/bin/activate
+          pip install west
+          west init -m https://github.com/nxp-mcuxpresso/mcuxsdk-manifests.git mcuxpresso-sdk
+          cd mcuxpresso-sdk
+          sed -i '/se_hostlib\|emwin/d' manifests/boards/lpcxpresso55s69.yml
+          west update_board --set board lpcxpresso55s69
+
+      - name: Clean and build test with DICE attestation + HW PUF (lpc55s69)
+        run: |
+          make clean distclean
+          cp config/examples/lpc55s69-tz-psa.config .config
+          sed -i 's/^HWPUF?=0/HWPUF?=1/' .config
+          sed -i 's/^WOLFBOOT_HWPUF_PROVISION?=0/WOLFBOOT_HWPUF_PROVISION?=1/' .config
+          sed -i 's/^WOLFBOOT_UDS_UID_FALLBACK_FORTEST?=1/WOLFBOOT_UDS_UID_FALLBACK_FORTEST?=0/' .config
+          grep -q '^HWPUF?=1' .config
+          grep -q '^WOLFBOOT_HWPUF_PROVISION?=1' .config
+          grep -q '^WOLFBOOT_UDS_UID_FALLBACK_FORTEST?=0' .config
+          make MCUXSDK=1 MCUXPRESSO="$GITHUB_WORKSPACE/mcuxpresso-sdk/mcuxsdk" MCUXPRESSO_CMSIS="$GITHUB_WORKSPACE/CMSIS_5/CMSIS"
+
+      # Single boot: enroll the PUF, store the record, attest.
+      # TODO: add a second --persist boot checking the stored record is reused
+      # (same UEID) once the CI image ships an m33mu with lpc55s69 --persist
+      # support (m33mu c2d903e, after v1.23).
+      - name: Run DICE attestation + HW PUF (lpc55s69)
+        run: |
+          set -o pipefail
+          m33mu wolfboot.bin test-app/image_v1_signed.bin:0x48000 --cpu lpc55s69 --uart-stdout --expect-bkpt 0x7f --timeout 300 \
+            | tee /tmp/m33mu-lpc55s69-dice-hwpuf.log
+          grep -q "Booting version:" /tmp/m33mu-lpc55s69-dice-hwpuf.log
+          grep -q "Checking integrity...done" /tmp/m33mu-lpc55s69-dice-hwpuf.log
+          grep -q "Verifying signature...done" /tmp/m33mu-lpc55s69-dice-hwpuf.log
+          grep -q "attest: token size" /tmp/m33mu-lpc55s69-dice-hwpuf.log
+          grep -q "state=0x00" /tmp/m33mu-lpc55s69-dice-hwpuf.log
+          grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-lpc55s69-dice-hwpuf.log
@@ -2153,6 +2153,7 @@ ifeq ($(TARGET),lpc55s69)
       -I$(MCUXPRESSO)/drivers/iap1 \
       -I$(MCUXPRESSO)/drivers/lpc_gpio \
       -I$(MCUXPRESSO)/drivers/lpc_iocon \
+      -I$(MCUXPRESSO)/drivers/puf \
       -I$(MCUXPRESSO)/drivers/rng_1 \
       -I$(MCUXPRESSO_CMSIS)/Include \
       -I$(MCUXPRESSO_CMSIS)/Core/Include
@@ -2169,10 +2170,10 @@ ifeq ($(TARGET),lpc55s69)
       $(MCUXPRESSO)/drivers/common/fsl_common_arm.o \
       $(MCUXPRESSO)/drivers/iap1/fsl_iap.o \
       $(MCUXPRESSO)/drivers/lpc_gpio/fsl_gpio.o \
-      $(MCUXPRESSO)/drivers/rng_1/fsl_rng.o
+      $(MCUXPRESSO)/drivers/rng_1/fsl_rng.o \
+      $(MCUXPRESSO_DRIVERS)/drivers/fsl_reset.o
   ifeq ($(DEBUG_UART),1)
     OBJS+=\
-      $(MCUXPRESSO_DRIVERS)/drivers/fsl_reset.o \
       $(MCUXPRESSO)/drivers/flexcomm/fsl_flexcomm.o \
       $(MCUXPRESSO)/drivers/flexcomm/usart/fsl_usart.o
   endif
@@ -2184,6 +2185,12 @@ ifeq ($(TARGET),lpc55s69)
         $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/nxp/casper_port.o \
         $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/nxp/hashcrypt_port.o
   endif
+  ifeq ($(HWPUF),1)
+    CFLAGS+=-DWOLFSSL_NXP_HWPUF
+    OBJS+=\
+        $(MCUXPRESSO)/drivers/puf/fsl_puf.o \
+        $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/nxp/hwpuf_port.o
+  endif
 endif
 
 ifeq ($(TARGET),psoc6)
 
@@ -30,16 +30,16 @@ FLASH_MULTI_SECTOR_ERASE?=1
 
 # Turn on or off hw acceleration of crypto algs in the lpc55s69
 PKA?=0
+# Turn on or off hw puf
+HWPUF?=0
 
-# use 1024-byte sector to accommodate RSA4096 signature
-# WOLFBOOT_SECTOR_SIZE?=0x400
 WOLFBOOT_SECTOR_SIZE?=0x200
 
 # use these for test/benchmark
-WOLFBOOT_PARTITION_SIZE?=0x2b000
+WOLFBOOT_PARTITION_SIZE?=0x30000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x10000
-WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x3b000
-WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x66000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x40000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x70000
 
 WOLFCRYPT_TEST?=1
 WOLFCRYPT_BENCHMARK?=1
@@ -0,0 +1,52 @@
+ARCH?=ARM
+TZEN?=1
+TARGET?=lpc55s69
+SIGN?=ECC384
+HASH?=SHA256
+MCUXSDK?=1
+MCUXPRESSO?=$(PWD)/../NXP/mcuxpresso-sdk/mcuxsdk
+MCUXPRESSO_CMSIS?=$(PWD)/../NXP/CMSIS_5/CMSIS
+MCUXPRESSO_CPU?=LPC55S69JBD100_cm33_core0
+MCUXPRESSO_DRIVERS?=$(MCUXPRESSO)/devices/LPC/LPC5500/LPC55S69
+MCUXPRESSO_PROJECT_TEMPLATE?=$(MCUXPRESSO)/examples/_boards/lpcxpresso55s69/project_template
+DEBUG?=0
+DEBUG_UART?=1
+VTOR?=1
+CORTEX_M0?=0
+CORTEX_M33?=1
+NO_ASM?=0
+NO_MPU=1
+EXT_FLASH?=0
+SPI_FLASH?=0
+ALLOW_DOWNGRADE?=0
+NVM_FLASH_WRITEONCE?=1
+NO_ARM_ASM=1
+WOLFBOOT_VERSION?=0
+V?=0
+SPMATH?=1
+RAM_CODE?=1
+DUALBANK_SWAP?=0
+FLASH_MULTI_SECTOR_ERASE?=1
+WOLFCRYPT_TZ?=1
+WOLFCRYPT_TZ_PSA?=1
+
+WOLFBOOT_ATTESTATION_TEST?=1
+WOLFBOOT_UDS_UID_FALLBACK_FORTEST?=1
+
+# Turn on or off hw acceleration of crypto algs in the lpc55s69
+PKA?=0
+# Turn on or off hw puf
+HWPUF?=0
+WOLFBOOT_HWPUF_PROVISION?=0
+
+WOLFBOOT_SECTOR_SIZE?=0x200
+
+# 200KB boot, 80KB keyvault, 8KB NSC, 56KB partitions, 512 swap
+WOLFBOOT_KEYVAULT_ADDRESS?=0x10032000
+WOLFBOOT_KEYVAULT_SIZE?=0x14000
+WOLFBOOT_NSC_ADDRESS?=0x10046000
+WOLFBOOT_NSC_SIZE?=0x2000
+WOLFBOOT_PARTITION_SIZE?=0xE000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x00048000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x00056000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x00064000
@@ -32,12 +32,12 @@ WOLFCRYPT_TZ_PKCS11?=1
 
 # Turn on or off hw acceleration of crypto algs in the lpc55s69
 PKA?=0
+# Turn on or off hw puf
+HWPUF?=0
 
-# use 1024-byte sector to accommodate RSA4096 signature
-# WOLFBOOT_SECTOR_SIZE?=0x400
 WOLFBOOT_SECTOR_SIZE?=0x200
 
-# 200KB boot, 80KB keyvault, 8KB NSC, 56KB partitions, 512/1024 swap
+# 200KB boot, 80KB keyvault, 8KB NSC, 56KB partitions, 512 swap
 WOLFBOOT_KEYVAULT_ADDRESS?=0x10032000
 WOLFBOOT_KEYVAULT_SIZE?=0x14000
 WOLFBOOT_NSC_ADDRESS?=0x10046000
 
@@ -30,13 +30,13 @@ FLASH_MULTI_SECTOR_ERASE?=1
 
 # Turn on or off hw acceleration of crypto algs in the lpc55s69
 PKA?=0
+# Turn on or off hw puf
+HWPUF?=0
 
-# use 1024-byte sector to accommodate RSA4096 signature
-# WOLFBOOT_SECTOR_SIZE?=0x400
 WOLFBOOT_SECTOR_SIZE?=0x200
 
 # Default configuration
-# 44KB boot, 52KB partitions, 512/1024 swap
+# 44KB boot, 52KB partitions, 512 swap
 WOLFBOOT_PARTITION_SIZE?=0xB000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0xD000
 WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x18000
 
@@ -3428,14 +3428,74 @@ Basic hardware acceleration supported:
 - AES-ECB (128, 192, 256 key sizes)
 - AES-CBC (128, 192, 256 key sizes)
 - AES-OFB (128, 192, 256 key sizes)
-  - Only supports full 16-byte blocks
 - AES-CFB (128, 192, 256 key sizes)
-  - Only supports full 16-byte blocks
 - AES-CTR (128, 192, 256 key sizes)
   - User must avoid counter wrap of all ff's to 0, as this fails in the hardware
 
 See [Test and Benchmark](#lpc55s69-test-and-benchmark) for a comparison with and without hardware acceleration.
 
+### LPC55S69: Hardware PUF (HWPUF)
+
+wolfBoot / wolfCrypt provide support for the LPC55S69's SRAM PUF (Physically
+Unclonable Function), which provides root of trust, identity, and key
+generation & storage, without the need to expose keys during manufacturing.
+Keys of size 128, 192, and 256 bits are supported.
+To turn on HWPUF, set HWPUF=1 in the config file (see below).
+
+### LPC55S69: Example Configurations
+
+#### The following example configurations are provided:
+
+- [lpc55s69.config](/config/examples/lpc55s69.config):
+  - Both wolfBoot and the test-app live in the non-secure realm
+  - Set PKA=1 in the config file to turn on hardware acceleration
+  (off by default)
+
+- [lpc55s69-benchmark.config](/config/examples/lpc55s69-benchmark.config):
+  - Same as `lpc55s69.config`, but turns on test and benchmark code
+  - Set PKA=1 in the config file to turn on hardware acceleration
+  (off by default)
+
+- [lpc55s69-tz.config](/config/examples/lpc55s69-tz.config):
+  - wolfBoot lives in the secure realm, test-app lives in the non-secure realm
+  - Provides a standard PKCS #11 api to interface with crypto algs in the secure
+  realm
+
+- [lpc55s69-tz-psa.config](/config/examples/lpc55s69-tz-psa.config):
+  - wolfBoot lives in the secure realm, test-app lives in the non-secure realm
+  - Provides a standard PSA api to interface with crypto algs in the secure
+  realm
+  - Provides an example of PSA Attestation
+  - To turn on HWPUF for use with attestation, set the following in the config
+  file:
+    - WOLFBOOT_UDS_UID_FALLBACK_FORTEST=0
+    - HWPUF=1
+    - WOLFBOOT_HWPUF_PROVISION=1
+
+#### Summary of configurables applicable to all lpc55s69 example configurations:
+- `PKA` : Turn on/off hardware acceleration of crypto algs
+- `HWPUF` : Turn on/off support for the hardware PUF
+- `WOLFBOOT_HWPUF_PROVISION` : Turn on/off auto-provisioning of the HWPUF on
+first boot.  Performs PUF enrollment and generates a UDS key for device
+attestation.  Stores PUF keycodes in a known flash location and uses them when
+necessary.
+- `WOLFBOOT_HWPUF_PROV_ADDRESS` : Flash address of the 4 KB PUF provisioning
+record (default `0x80000`, page aligned).  The build fails if it overlaps the
+boot, update or swap partition or the protected flash region (`0x9DE00` and
+up), or if it lies below the boot partition (wolfBoot, keyvault and NSC).
+The activation code and key code are written first and verified, then a
+commit word is written in the last page of the record.  Provisioning only
+runs when that commit page is erased (or all `0xFF`), so a provisioning
+interrupted before the commit is redone on the next boot.  A record in any
+other state is never silently replaced, because that would change the device
+identity: attestation fails until the region is erased.  This includes the
+rare case where power is lost while the commit page itself is being erased or
+programmed.
+
+`HWPUF=1` cannot be combined with `WOLFBOOT_UDS_UID_FALLBACK_FORTEST=1`.  With
+`TZEN=1` the PUF is reachable only from the secure world (it is excluded from
+the non-secure SAU regions and is not linked into the non-secure test-app).
+
 ### LPC55S69: Configuring and compiling
 
 Copy the example configuration file and build with make:
@@ -3445,9 +3505,6 @@ cp config/examples/lpc55s69.config .config
 make
 ```
 
-We also provide a TrustZone configuration at `config/examples/lpc55s69-tz.config`
-and a benchmarking configuration at `config/examples/lpc55s69-benchmark.config`.
-
 ### LPC55S69: Loading the firmware
 
 Download and install the LinkServer tool: