subsys nrf_security: add nrf92 devices to security and cracen config #19558

ayla-nordicsemi · 2024-12-16T13:19:08Z

These changes aim to allow using cracen cryptographic features on nrf92 devices.
These changes are required to allow accessing built-in keys using psa over cracen driver.

NordicBuilder · 2024-12-16T13:24:40Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 7

Inputs:

Sources:

sdk-nrf: PR head: 410e31d606e8733399a82a85da667e8556123541

more details

sdk-nrf:

PR head: 410e31d606e8733399a82a85da667e8556123541
merge base: 529429bc90946738df1f2f612a1d9d9a4f27ccd2
target head (main): 0cccc03fa18953e2d9ba7c07c9e0fe42b01af04f
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (3)

subsys
│  ├── nrf_security
│  │  ├── Kconfig
│  │  ├── src
│  │  │  ├── drivers
│  │  │  │  ├── cracen
│  │  │  │  │  │ Kconfig
│  ├── sdfw_services
│  │  ├── services
│  │  │  ├── psa_crypto
│  │  │  │  │ Kconfig

Outputs:

Toolchain

Version:
Build docker image:

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

🟠 Toolchain
🟠 Build twister
🟠 Integration tests
- 🟠 test-fw-nrfconnect-chip
- 🟠 test-fw-nrfconnect-nrf_crypto
- 🟠 test-fw-nrfconnect-tfm
- 🟠 test-sdk-find-my
- 🟠 test-sdk-sidewalk
- 🟠 test-sdk-dfu
- ⚠️ test-fw-nrfconnect-nrf-iot_cloud
- ⚠️ test-sdk-dfu

Disabled integration tests

- desktop52_verification
- doc-internal
- test_ble_nrf_config
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-boot
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_mosh
- test-fw-nrfconnect-nrf-iot_positioning
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_serial_lte_modem
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-ps
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-rs
- test-fw-nrfconnect-thread
- test-fw-nrfconnect-zigbee
- test-low-level
- test-sdk-audio
- test-sdk-mcuboot
- test-sdk-pmic-samples
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

NordicBuilder · 2024-12-16T13:42:27Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publish GitHub Action.

jonathannilsen · 2025-01-14T09:21:27Z

subsys/sdfw_services/services/psa_crypto/Kconfig

@@ -5,7 +5,7 @@
 #

 service_name = PSA_CRYPTO
-service_default_enabled = n
+service_default_enabled = y


Is this change required?

It might be removed as it is not part of this PR changes, I will add it to this one #19561 as it relies on PSA_CRYPTO services to perform the signing of Json Web Tokens.

@jonathannilsen is it possible to activate this flag for an sdk-nrf sample using the prj.conf file ?
you are right about activating this by default actually doesn't make sense.

jonathannilsen · 2025-01-14T09:22:44Z

subsys/nrf_security/src/drivers/cracen/Kconfig

@@ -5,7 +5,7 @@
 #

 config CRACEN_HW_PRESENT
-	def_bool SOC_SERIES_NRF54LX
+	def_bool (SOC_SERIES_NRF54LX || SOC_SERIES_NRF92X)


This addition should not be needed I think - it should already be selected by the board

jonathannilsen · 2025-01-14T09:26:40Z

subsys/nrf_security/src/drivers/cracen/psa_driver.Kconfig

+	depends on SOC_NRF54H20_CPUSEC || \
+				SOC_NRF9280_CPUSEC || \
+				SOC_NRF9230_CPUSEC


this should be sufficient:

Suggested change

depends on SOC_NRF54H20_CPUSEC || \

SOC_NRF9280_CPUSEC || \

SOC_NRF9230_CPUSEC

depends on SOC_NRF54H20_CPUSEC || SOC_NRF9280_CPUSEC

jonathannilsen · 2025-01-14T09:27:36Z

subsys/nrf_security/src/drivers/cracen/Kconfig

+	depends on (SOC_SERIES_NRF54LX && !SOC_NRF54L20) || SOC_SERIES_NRF54HX || \
+				(SOC_SERIES_NRF92X && (SOC_NRF9280_CPUSEC || SOC_NRF9230_CPUSEC))


I would think that this is sufficient:

Suggested change

depends on (SOC_SERIES_NRF54LX && !SOC_NRF54L20) || SOC_SERIES_NRF54HX || \

(SOC_SERIES_NRF92X && (SOC_NRF9280_CPUSEC || SOC_NRF9230_CPUSEC))

depends on (SOC_SERIES_NRF54LX && !SOC_NRF54L20) || SOC_SERIES_NRF54HX || \

SOC_SERIES_NRF92X

jonathannilsen · 2025-01-14T09:28:04Z

subsys/nrf_security/Kconfig

@@ -58,6 +58,7 @@ if NRF_SECURITY

 config MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
 	bool
+	default y if SOC_SERIES_NRF92X && (SOC_NRF9280_CPUSEC || SOC_NRF9230_CPUSEC)


Suggested change

default y if SOC_SERIES_NRF92X && (SOC_NRF9280_CPUSEC || SOC_NRF9230_CPUSEC)

default y if SOC_NRF9280_CPUSEC

CPUSEC should not be referenced in this repo at all

nordicjm · 2025-02-03T10:45:17Z

subsys/nrf_security/Kconfig

@@ -35,7 +35,7 @@ config NRF_SECURITY
 	depends on SOC_FAMILY_NORDIC_NRF
 	default y if BUILD_WITH_TFM


git commit title should have : not ,

nordicjm · 2025-02-03T10:45:45Z

subsys/nrf_security/Kconfig

@@ -58,6 +58,7 @@ if NRF_SECURITY

 config MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
 	bool
+	default y if SOC_SERIES_NRF92X && (SOC_NRF9280_CPUSEC || SOC_NRF9230_CPUSEC)


CPUSEC should not be referenced in this repo at all

nordicjm · 2025-02-03T10:46:07Z

subsys/nrf_security/src/drivers/cracen/psa_driver.Kconfig

-	depends on SOC_NRF54H20_CPUSEC
+	depends on SOC_NRF54H20_CPUSEC || \
+				SOC_NRF9280_CPUSEC || \
+				SOC_NRF9230_CPUSEC


as above, no mention to CPUSEC

Ref: NRFX-6678 Signed-off-by: Aymen LAOUINI <[email protected]>

ayla-nordicsemi · 2025-02-10T06:50:30Z

This pull request is obsolete, the features it aimed to add has been already covered by other pull requests
20107 and secdom/1089.
Closing it.

ayla-nordicsemi requested review from hakonfam, jonathannilsen, parttimaa and mparpala December 16, 2024 13:19

ayla-nordicsemi self-assigned this Dec 16, 2024

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Dec 16, 2024

ayla-nordicsemi force-pushed the add_nrf92_support_to_nrf_security_config branch from 478babb to b9062a2 Compare December 16, 2024 13:22

ayla-nordicsemi mentioned this pull request Dec 16, 2024

lib: app_jwt: add an application core jwt generator and add a sample for usage #19561

Open

ayla-nordicsemi force-pushed the add_nrf92_support_to_nrf_security_config branch from b9062a2 to 02cd81a Compare December 18, 2024 14:55

ayla-nordicsemi force-pushed the add_nrf92_support_to_nrf_security_config branch from 02cd81a to da33b03 Compare January 9, 2025 15:32

jonathannilsen reviewed Jan 14, 2025

View reviewed changes

ayla-nordicsemi force-pushed the add_nrf92_support_to_nrf_security_config branch from da33b03 to f0ad7cd Compare January 29, 2025 08:36

ayla-nordicsemi marked this pull request as ready for review January 30, 2025 13:39

ayla-nordicsemi requested review from a team as code owners January 30, 2025 13:39

nordicjm requested changes Feb 3, 2025

View reviewed changes

ayla-nordicsemi force-pushed the add_nrf92_support_to_nrf_security_config branch from f0ad7cd to 8de8238 Compare February 6, 2025 13:18

subsys nrf_security: add nrf92 devices to security and cracen config

410e31d

Ref: NRFX-6678 Signed-off-by: Aymen LAOUINI <[email protected]>

ayla-nordicsemi force-pushed the add_nrf92_support_to_nrf_security_config branch from 8de8238 to 410e31d Compare February 6, 2025 13:37

ayla-nordicsemi changed the title ~~subsys, nrf_security: add nrf92 devices to security and cracen config~~ subsys nrf_security: add nrf92 devices to security and cracen config Feb 6, 2025

ayla-nordicsemi closed this Feb 10, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

subsys nrf_security: add nrf92 devices to security and cracen config #19558

subsys nrf_security: add nrf92 devices to security and cracen config #19558

ayla-nordicsemi commented Dec 16, 2024

NordicBuilder commented Dec 16, 2024 •

edited

Loading

NordicBuilder commented Dec 16, 2024

jonathannilsen Jan 14, 2025

ayla-nordicsemi Jan 29, 2025

ayla-nordicsemi Feb 7, 2025

jonathannilsen Jan 14, 2025

jonathannilsen Jan 14, 2025

jonathannilsen Jan 14, 2025

jonathannilsen Jan 14, 2025 •

edited

Loading

nordicjm Feb 3, 2025

nordicjm Feb 3, 2025

nordicjm Feb 3, 2025

nordicjm Feb 3, 2025

ayla-nordicsemi commented Feb 10, 2025 •

edited

Loading

		depends on (SOC_SERIES_NRF54LX && !SOC_NRF54L20) \|\| SOC_SERIES_NRF54HX \|\| \
		(SOC_SERIES_NRF92X && (SOC_NRF9280_CPUSEC \|\| SOC_NRF9230_CPUSEC))

	default y if SOC_SERIES_NRF92X && (SOC_NRF9280_CPUSEC \|\| SOC_NRF9230_CPUSEC)
	default y if SOC_NRF9280_CPUSEC

		@@ -35,7 +35,7 @@ config NRF_SECURITY
		depends on SOC_FAMILY_NORDIC_NRF
		default y if BUILD_WITH_TFM

subsys nrf_security: add nrf92 devices to security and cracen config #19558

subsys nrf_security: add nrf92 devices to security and cracen config #19558

Conversation

ayla-nordicsemi commented Dec 16, 2024

NordicBuilder commented Dec 16, 2024 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

NordicBuilder commented Dec 16, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jonathannilsen Jan 14, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ayla-nordicsemi commented Feb 10, 2025 • edited Loading

NordicBuilder commented Dec 16, 2024 •

edited

Loading

jonathannilsen Jan 14, 2025 •

edited

Loading

ayla-nordicsemi commented Feb 10, 2025 •

edited

Loading