entropy: Add PSA rng as the entropy provider for the nrf54h20 #17200

Vge0rge · 2024-09-05T11:05:57Z

No description provided.

NordicBuilder · 2024-09-05T11:06:32Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
nrfxlib	nrfconnect/sdk-nrfxlib@`52fe0ba` (`main`)	nrfconnect/sdk-nrfxlib#1593	nrfconnect/sdk-nrfxlib#1593/files
zephyr	nrfconnect/sdk-zephyr@`0aa2141`	nrfconnect/sdk-zephyr#2420	nrfconnect/sdk-zephyr#2420/files

⛔ DNM label due to: 2 projects with PR revision

Note: This message is automatically posted and updated by the Manifest GitHub Action.

NordicBuilder · 2024-09-05T11:07:05Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 113

Inputs:

Sources:

sdk-nrf: PR head: 0fc41390a4c90c9d166f9de685d480624c09d6a8
nrfxlib: PR head: cb9037101267124f0610c9a99c03cc8c0a414122
zephyr: PR head: aafd65a55e3d5ecc202c705810eafb15695c4082

more details

sdk-nrf:

PR head: 0fc41390a4c90c9d166f9de685d480624c09d6a8
merge base: 80cb1ab92d9725a8a8cd1078ed43f8aa06b9743e
target head (main): 80cb1ab92d9725a8a8cd1078ed43f8aa06b9743e
Diff

nrfxlib:

PR head: cb9037101267124f0610c9a99c03cc8c0a414122
merge base: 52fe0ba3d124047d5ce88a0d88a1baaea443fbbe
target head (main): 52fe0ba3d124047d5ce88a0d88a1baaea443fbbe
Diff

zephyr:

PR head: aafd65a55e3d5ecc202c705810eafb15695c4082
merge base: 0aa2141d605f3b39da2b541e2fe4595d58824080
target head (main): 0b58ccd3beb0987e3dd7dccc6e4c78bd0a49c7c8
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
✅	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (33)

applications
│  ├── matter_bridge
│  │  ├── sysbuild
│  │  │  ├── ipc_radio
│  │  │  │  ├── boards
│  │  │  │  │  │ nrf54h20dk_nrf54h20_cpurad.conf
nrfxlib
│  ├── nrf_rpc
│  │  ├── include
│  │  │  │ nrf_rpc.h
│  │  │ nrf_rpc.c
samples
│  ├── suit
│  │  ├── flash_companion
│  │  │  ├── boards
│  │  │  │  │ nrf54h20dk_nrf54h20_cpuapp.overlay
│  │  ├── smp_transfer
│  │  │  ├── sysbuild
│  │  │  │  │ hci_ipc.conf
subsys
│  ├── CMakeLists.txt
│  ├── nrf_rpc
│  │  ├── include
│  │  │  │ nrf_rpc_os.h
│  ├── nrf_security
│  │  ├── CMakeLists.txt
│  │  ├── Kconfig
│  │  ├── Kconfig.psa
│  │  ├── include
│  │  │  │ ssf_crypto_config_empty.h
│  │  ├── src
│  │  │  ├── drivers
│  │  │  │  │ Kconfig
│  │  │  ├── ssf_secdom
│  │  │  │  ├── CMakeLists.txt
│  │  │  │  ├── Kconfig
│  │  │  │  │ ssf_psa_core_compatibility.c
│  ├── sdfw_services
│  │  ├── Kconfig
│  │  ├── os
│  │  │  │ ssf_client_zephyr.c
│  │  ├── transport
│  │  │  ├── nrf_rpc
│  │  │  │  │ ssf_client_nrf_rpc.c
tests
│  ├── benchmarks
│  │  ├── multicore
│  │  │  ├── idle
│  │  │  │  ├── boards
│  │  │  │  │  ├── nrf54h20dk_nrf54h20_cpuapp_ram_high_usage.overlay
│  │  │  │  │  │ nrf54h20dk_nrf54h20_cpurad.overlay
│  ├── subsys
│  │  ├── dfu
│  │  │  ├── dfu_target
│  │  │  │  ├── suit
│  │  │  │  │  ├── boards
│  │  │  │  │  │  │ nrf54h20dk_nrf54h20_cpuapp.overlay
west.yml
zephyr
│  ├── boards
│  │  ├── nordic
│  │  │  ├── nrf54h20dk
│  │  │  │  ├── nrf54h20dk_nrf54h20_cpuapp.dts
│  │  │  │  │ nrf54h20dk_nrf54h20_cpurad.dts
│  ├── drivers
│  │  ├── entropy
│  │  │  │ Kconfig.psa_crypto
│  ├── soc
│  │  ├── nordic
│  │  │  ├── nrf54h
│  │  │  │  │ Kconfig
│  ├── tests
│  │  ├── arch
│  │  │  ├── arm
│  │  │  │  ├── arm_irq_vector_table
│  │  │  │  │  ├── boards
│  │  │  │  │  │  ├── nrf54h20dk_nrf54h20_cpuapp.overlay
│  │  │  │  │  │  ├── nrf54h20dk_nrf54h20_cpurad.overlay
│  │  │  │  │  │  ├── nrf9280pdk_nrf9280_cpuapp.overlay
│  │  │  │  │  │  │ nrf9280pdk_nrf9280_cpurad.overlay
│  │  ├── crypto
│  │  │  ├── mbedtls
│  │  │  │  │ testcase.yaml
│  │  │  ├── mbedtls_psa
│  │  │  │  │ testcase.yaml
│  │  │  ├── secp256r1
│  │  │  │  │ testcase.yaml

Outputs:

Toolchain

Version: aedb4c0245
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:aedb4c0245_bece0367df

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
❌ Build twister
❌ Integration tests
- ❌ test-sdk-audio
- ❌ desktop52_verification
- ❌ test-fw-nrfconnect-boot
- ❌ test-fw-nrfconnect-apps
- ❌ test_ble_nrf_config
- ❌ test-fw-nrfconnect-ble_mesh
- ❌ test-fw-nrfconnect-ble_samples
- ❌ test-fw-nrfconnect-chip
- ❌ test-fw-nrfconnect-nfc
- ❌ test-fw-nrfconnect-nrf-iot_cloud
- ❌ test-fw-nrfconnect-nrf-iot_libmodem-nrf
- ❌ test-fw-nrfconnect-nrf-iot_serial_lte_modem
- ❌ test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- ❌ test-fw-nrfconnect-nrf-iot_samples
- ❌ test-fw-nrfconnect-nrf-iot_lwm2m
- ❌ doc-internal
- ❌ test-fw-nrfconnect-nrf-iot_thingy91
- ❌ test-fw-nrfconnect-nrf_crypto
- ❌ test-fw-nrfconnect-proprietary_esb
- ❌ test-fw-nrfconnect-rpc
- ❌ test-fw-nrfconnect-rs
- ❌ test-fw-nrfconnect-fem
- ❌ test-fw-nrfconnect-tfm
- ❌ test-fw-nrfconnect-thread
- ❌ test-fw-nrfconnect-zigbee
- ❌ test-sdk-find-my
- ❌ test-fw-nrfconnect-nrf-iot_mosh
- ❌ test-fw-nrfconnect-nrf-iot_positioning
- ❌ test-sdk-sidewalk
- ❌ test-sdk-wifi
- ❌ test-low-level
- ❌ test-sdk-pmic-samples
- ❌ test-sdk-mcuboot
- ❌ test-sdk-dfu
- ❌ test-fw-nrfconnect-ps
- ❌ test-secdom-samples-public
- ⚠️ test-fw-nrfconnect-fw-update
- ⚠️ test-sdk-dfu

Note: This message is automatically posted and updated by the CI

NordicBuilder · 2024-09-24T11:15:56Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publishing GitHub Action.

tomi-font

Again in this PR you have a commit that is later reverted (nrf_security: Enabled by default for nRF54H20)?

subsys/nrf_security/Kconfig

subsys/nrf_security/CMakeLists.txt

frkv

There are lots of complex additions in this PR that seem to be tailored towards a special case without PSA crypto which is the default enabled and default supported in nRF54H20 devices

krish2718

Since wifi relies on the mbedTLS legacy crypto functionality
we need to make sure that it continues to work as before.

This was broken a while back, on 54H20 Wi-Fi uses PSA only crypto (restricted to WPA2), so, we can go ahead and enable PSA RNG for Wi-Fi samples too.

Vge0rge · 2025-01-17T09:48:22Z

Since wifi relies on the mbedTLS legacy crypto functionality
we need to make sure that it continues to work as before.

This was broken a while back, on 54H20 Wi-Fi uses PSA only crypto (restricted to WPA2), so, we can go ahead and enable PSA RNG for Wi-Fi samples too.

That seems like my mistake then, sorry, I was not aware of that.
I am going to remove this commit then.

krish2718

OK, after removing Wi-Fi samples changes.

github-actions · 2025-02-21T13:42:57Z

After documentation is built, you will find the preview for this PR here.

Make all PSA drivers depend on the OBERON_PSA_CORE since we cannot use the drivers without it. Signed-off-by: Georgios Vasilakis <[email protected]>

Brings Zephyr changes which automatically enable the PSA crypto as the entropy generator for Zephyr. Signed-off-by: Georgios Vasilakis <[email protected]>

Add configuration to allow enabling the SSF PSA client when nrf_security is not enabled. This is particularly useful for the applications that only want to use the PSA rng and no other crypto. Enabling nrf_security in these applications will result to an increased application footprint and configuration complexity without any reason. This configuration provides the PSA implementation from the secure domain through the SSF client and it has no configurability yet. So there is no need to enforce NRF_SECURITY with this configuration. Signed-off-by: Georgios Vasilakis <[email protected]>

Add overlay to reduce the footprint of the matter_bridge application. Signed-off-by: Georgios Vasilakis <[email protected]>

Remove prng dts node since this is removed from the nrf54h20 board file. Signed-off-by: Georgios Vasilakis <[email protected]>

Disable the IPC and bellboard nodes since these tests don't use communication between domains. Signed-off-by: Georgios Vasilakis <[email protected]>

Initialize the ssf_client earlier during the boot process during post kernel. ssf_client needs to be initialized before the CONFIG_NRF_802154_SER_RADIO_INIT_PRIO since it is used by the "nRF IEEE 802.15.4" protocol. It also needs to be initialied after the IPC IPC_SERVICE_REG_BACKEND_PRIORITY since the IPC expects the protocol to be initialized. Failing to do that will also trigger an assertion in Zephyr. Signed-off-by: Georgios Vasilakis <[email protected]>

Use nrf_rpc_init_group when ssf_client is being initalized since it will happen before other nrf_rpc groups are initialized. Signed-off-by: Georgios Vasilakis <[email protected]>

Disable the cpusec related nodes in the multicore benchmark since it increases power consumption and IPC communication with secure domain is not needed for this test. Signed-off-by: Georgios Vasilakis <[email protected]>

Updates the nrf_rpc library to allow initialization of single nrf_rpc groups. Signed-off-by: Georgios Vasilakis <[email protected]>

Enabling real entropy for the radio core through the ssf_client and the secure domain increased the stack requirements of the hci_ipc used in this sample. I couldn't run THREAD_ANALYZER in this application because of flash overflows and other issues. I did practical tests with 50 byte intervals and I know that 900 bytes is the least memory that could boot the radio core. I updated this to have the same configuration as the ipc_radio (2048 bytes) application since the usage of the hci_ipc here will be replaced with the ipc_radio later. Signed-off-by: Georgios Vasilakis <[email protected]>

Add function nrf_rpc_os_fatal_error function to handle fatal_errors using the Zephyr's fatal error hanlding. Signed-off-by: Georgios Vasilakis <[email protected]>

There are two functions which are defined in the psa_crypto_core.h and are implemented in psa_crypto.c which are used by the TLS library. These functions are: psa_can_do_hash psa_can_do_cipher These functions just check if the drivers are initialized before the relevant PSA crypto functions can be used. In the case of SSF there is no initialization needed because the PSA initialization happens inside the secure domain firmware before the application boots. These functions are added in a separate file since they only exist to maintain compatibility with the PSA core from Oberon/mbedTLS and they have don't need to forward any call to the secure domain. Signed-off-by: Georgios Vasilakis <[email protected]>

sonarqubecloud · 2025-02-25T11:37:22Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions bot added manifest changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Sep 5, 2024

NordicBuilder added manifest-zephyr DNM labels Sep 5, 2024

Vge0rge force-pushed the 54h20_psa_rng branch from 387c99f to 1a1154a Compare September 24, 2024 10:48

Vge0rge marked this pull request as ready for review September 24, 2024 10:48

Vge0rge requested review from a team as code owners September 24, 2024 10:48

Vge0rge force-pushed the 54h20_psa_rng branch 7 times, most recently from 114059e to 6ed58b2 Compare September 27, 2024 12:24

Vge0rge requested a review from a team as a code owner October 1, 2024 07:43

endre-nordic approved these changes Oct 1, 2024

View reviewed changes

Vge0rge force-pushed the 54h20_psa_rng branch from be24ea7 to 8ad341c Compare October 1, 2024 11:20

Vge0rge requested a review from a team as a code owner October 1, 2024 12:40

tomi-font previously requested changes Oct 3, 2024

View reviewed changes

subsys/nrf_security/Kconfig Show resolved Hide resolved

subsys/nrf_security/Kconfig Outdated Show resolved Hide resolved

subsys/nrf_security/CMakeLists.txt Outdated Show resolved Hide resolved

endre-nordic added this to the 2.8.0 milestone Oct 18, 2024

frkv self-requested a review October 18, 2024 08:08

frkv requested changes Oct 18, 2024

View reviewed changes

Vge0rge force-pushed the 54h20_psa_rng branch 4 times, most recently from b8fb7cd to 7e9300c Compare October 21, 2024 10:32

rlubos approved these changes Jan 16, 2025

View reviewed changes

kapbh approved these changes Jan 16, 2025

View reviewed changes

krish2718 reviewed Jan 16, 2025

View reviewed changes

Vge0rge force-pushed the 54h20_psa_rng branch 3 times, most recently from c464501 to 7c7f4ee Compare January 17, 2025 13:43

krish2718 approved these changes Jan 17, 2025

View reviewed changes

D-Triveni approved these changes Jan 20, 2025

View reviewed changes

rlubos removed this from the 2.9.0-nRF54H20-2 milestone Feb 14, 2025

Vge0rge force-pushed the 54h20_psa_rng branch from 7c7f4ee to 87881d3 Compare February 18, 2025 09:07

Vge0rge requested a review from a team as a code owner February 18, 2025 09:07

Vge0rge force-pushed the 54h20_psa_rng branch from 87881d3 to 8d2fc9e Compare February 21, 2025 13:42

Vge0rge force-pushed the 54h20_psa_rng branch from 8d2fc9e to 3029e28 Compare February 21, 2025 13:50

Vge0rge added 13 commits February 25, 2025 12:30

nrf_security: Make PSA drivers depend on PSA core

d0f98bd

Make all PSA drivers depend on the OBERON_PSA_CORE since we cannot use the drivers without it. Signed-off-by: Georgios Vasilakis <[email protected]>

manifest: Bring Zephyr with PSA RNG for NRF54H20

fb042cf

Brings Zephyr changes which automatically enable the PSA crypto as the entropy generator for Zephyr. Signed-off-by: Georgios Vasilakis <[email protected]>

application: matter_bridge: Add overlay for 54h20

742e25a

Add overlay to reduce the footprint of the matter_bridge application. Signed-off-by: Georgios Vasilakis <[email protected]>

samples: suit: flash_compantion: Remove prng

a87d15d

Remove prng dts node since this is removed from the nrf54h20 board file. Signed-off-by: Georgios Vasilakis <[email protected]>

tests: suit: Disable cpusec IPC and bellboard

aed90dc

Disable the IPC and bellboard nodes since these tests don't use communication between domains. Signed-off-by: Georgios Vasilakis <[email protected]>

sdfw_services: Use nrf_rpc_init_group in ssf_client init

6d2b472

Use nrf_rpc_init_group when ssf_client is being initalized since it will happen before other nrf_rpc groups are initialized. Signed-off-by: Georgios Vasilakis <[email protected]>

test: benchmarks: Disable cpusec nodes for multicore test

d31662d

Disable the cpusec related nodes in the multicore benchmark since it increases power consumption and IPC communication with secure domain is not needed for this test. Signed-off-by: Georgios Vasilakis <[email protected]>

manifest: Update nrfxlib

fa4046f

Updates the nrf_rpc library to allow initialization of single nrf_rpc groups. Signed-off-by: Georgios Vasilakis <[email protected]>

nrf_rpc: Add nrf_rpc_os_fatal_error

ba25e36

Add function nrf_rpc_os_fatal_error function to handle fatal_errors using the Zephyr's fatal error hanlding. Signed-off-by: Georgios Vasilakis <[email protected]>

Vge0rge force-pushed the 54h20_psa_rng branch from 3029e28 to 0fc4139 Compare February 25, 2025 11:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

entropy: Add PSA rng as the entropy provider for the nrf54h20 #17200

entropy: Add PSA rng as the entropy provider for the nrf54h20 #17200

Vge0rge commented Sep 5, 2024 •

edited

Loading

NordicBuilder commented Sep 5, 2024 •

edited

Loading

NordicBuilder commented Sep 5, 2024 •

edited

Loading

NordicBuilder commented Sep 24, 2024

tomi-font left a comment

frkv left a comment

krish2718 left a comment

Vge0rge commented Jan 17, 2025

krish2718 left a comment

github-actions bot commented Feb 21, 2025 •

edited

Loading

sonarqubecloud bot commented Feb 25, 2025

entropy: Add PSA rng as the entropy provider for the nrf54h20 #17200

Are you sure you want to change the base?

entropy: Add PSA rng as the entropy provider for the nrf54h20 #17200

Conversation

Vge0rge commented Sep 5, 2024 • edited Loading

NordicBuilder commented Sep 5, 2024 • edited Loading

NordicBuilder commented Sep 5, 2024 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

NordicBuilder commented Sep 24, 2024

tomi-font left a comment

Choose a reason for hiding this comment

frkv left a comment

Choose a reason for hiding this comment

krish2718 left a comment

Choose a reason for hiding this comment

Vge0rge commented Jan 17, 2025

krish2718 left a comment

Choose a reason for hiding this comment

github-actions bot commented Feb 21, 2025 • edited Loading

sonarqubecloud bot commented Feb 25, 2025

Quality Gate passed

Vge0rge commented Sep 5, 2024 •

edited

Loading

NordicBuilder commented Sep 5, 2024 •

edited

Loading

NordicBuilder commented Sep 5, 2024 •

edited

Loading

github-actions bot commented Feb 21, 2025 •

edited

Loading