nrf_security: add nrf7120 to CRACEN driver

Add nrf7120 for CRACEN core drivers

Signed-off-by: Travis Lam <[email protected]>

Author: travis3630

dts/common/nordic/nrf7120_enga.dtsi

@@ -79,20 +79,20 @@
 		#size-cells = <1>;
 		ranges;
 
-		nordic_reserved: memory@200ff000{
+		nordic_reserved: memory@200fe000{
 			#address-cells = <1>;
 			#size-cells = <1>;
 			compatible = "mmio-sram";
-			reg = <0x200ff000 0xf00>;
-			ranges = <0x0 0x200ff000 0xf00>;
+			reg = <0x200fe000 0x1000>;
+			ranges = <0x0 0x200fe000 0x1000>;
 		};
 
-		nrf_kmu_reserved_push_area: memory@200fff00{
+		nrf_kmu_cracen_exchange_area: memory@200ff000{
 			#address-cells = <1>;
 			#size-cells = <1>;
-			reg = <0x200fff00 0x0100>;
+			reg = <0x200ff000 0x1000>;
 			compatible = "zephyr,memory-region", "mmio-sram";
-			zephyr,memory-region = "NRF_KMU_RESERVED_PUSH";
+			zephyr,memory-region = "NRF_KMU_CRACEN_EXCHANGE";
 		};
 
 		nrf_mpc_region: memory@50041000 {

lib/hw_unique_key/Kconfig

@@ -18,7 +18,7 @@ config HW_UNIQUE_KEY_LOAD
 	depends on HAS_HW_NRF_CC310
 	depends on NRF_CC3XX_PLATFORM
 	select FPROTECT
-	imply NRFX_NVMC if !SOC_SERIES_NRF54LX
+	imply NRFX_NVMC if !CRACEN_HW_PRESENT
 	help
 	  Use this on devices with no KMU. Enable this in the immutable
 	  bootloader to load the HUK from the allocated flash area
@@ -46,7 +46,7 @@ config HW_UNIQUE_KEY
 	select PSA_WANT_ALG_GCM if CRACEN_HW_PRESENT
 	select PSA_NEED_CRACEN_KMU_DRIVER if CRACEN_HW_PRESENT
 	select FPROTECT if HAS_HW_NRF_ACL
-	imply NRFX_NVMC if !SOC_SERIES_NRF54LX
+	imply NRFX_NVMC if !CRACEN_HW_PRESENT
 	default y if BUILD_WITH_TFM
 	help
 	  This option will load the Hardware Unique Key (HUK) in the KDR

soc/nordic/nrf71/kmu_push_area_section.ld

@@ -1,15 +1,19 @@
-#define NRF_KMU_PUSH_BASE_ADDRESS 0x200FFF00
-
+# This section must be loaded first of all the
+# custom sections because we want it to be placed
+# at the top address of RAM.
 SECTION_PROLOGUE(NRF_KMU_RESERVED_PUSH_SECTION,(NOLOAD) ,)
 {
     __nrf_kmu_reserved_push_area = .;
     *(.nrf_kmu_reserved_push_area)
     __nrf_kmu_reserved_push_area_end = .;
-} GROUP_NOLOAD_LINK_IN(NRF_KMU_RESERVED_PUSH, NRF_KMU_RESERVED_PUSH)
+} GROUP_NOLOAD_LINK_IN(RAMABLE_REGION, RAMABLE_REGION)
 
-/* Check that the section is correctly placed at 0x200F_FF00 */
-ASSERT(__nrf_kmu_reserved_push_area == NRF_KMU_PUSH_BASE_ADDRESS, \
- "Error: The section NRF_KMU_RESERVED_PUSH_SECTION needs to be \
- placed at 0x200F_FF00 but it is not, please edit the\
- device tree to define section NRF_KMU_RESERVED_PUSH at 0x200F_FF00 \
- the to RAM address.")
+# It doesn't seem to be possible to enforce placing a section
+# at a specific address in memory using the Zephyr SECTION macros.
+# So this assert is necessary to avoid accidentatly moving this
+# section to a different address.
+ASSERT(__nrf_kmu_reserved_push_area == RAM_ADDR, "Error:  \
+ The section NRF_KMU_RESERVED_PUSH_SECTION needs to be    \
+ placed on the top RAM address but it is not, please edit \
+ your linker scripts to make sure that it is placed on    \
+ the top RAM address.")

subsys/nrf_security/Kconfig

@@ -60,7 +60,7 @@ if NRF_SECURITY
 
 config MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
 	bool
-	default y if SOC_SERIES_NRF54LX && PSA_CRYPTO_DRIVER_CRACEN
+	default y if CRACEN_HW_PRESENT && PSA_CRYPTO_DRIVER_CRACEN
 	default y if PSA_WANT_PLATFORM_KEYS
 	help
 	  Promptless option used to control if the PSA Crypto core should have support for builtin keys or not.

subsys/nrf_security/include/nrf_security_api_structure.h

@@ -21,7 +21,7 @@
  * with hardware acceleration or alternative implementations. The supported drivers include:
  *   - Arm CryptoCell cc3xx (hardware acceleration for nRF52840, nRF91 Series, and nRF5340)
  *   - nrf_oberon (optimized cryptographic algorithms)
- *   - CRACEN (hardware acceleration for nRF54L Series)
+ *   - CRACEN (hardware acceleration for nRF54L and nRF71 Series)
  *
  * For detailed documentation on these drivers, see the nRF Connect SDK documentation:
  * https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/libraries/security/nrf_security/index.html

subsys/nrf_security/src/drivers/cracen/Kconfig

@@ -5,19 +5,19 @@
 #
 
 config CRACEN_HW_PRESENT
-	def_bool SOC_SERIES_NRF54LX || SOC_SERIES_NRF92X
+	def_bool SOC_SERIES_NRF54LX || SOC_SERIES_NRF92X || SOC_SERIES_NRF71X
 
 config CRACEN_HW_VERSION_BASE
 	def_bool SOC_SERIES_NRF54HX || SOC_NRF54L15 || SOC_NRF54L10 || SOC_NRF54L05
 
 config CRACEN_HW_VERSION_LITE
-	def_bool SOC_NRF54LM20A || SOC_NRF54LV10A
+	def_bool SOC_NRF54LM20A || SOC_NRF54LV10A || SOC_NRF7120_ENGA
 
 config CRACEN_NEED_MULTIPART_WORKAROUNDS
 	def_bool SOC_NRF54LM20A
 
 config CRACEN_NEED_IKG_INTERRUPT_WORKAROUND
-	def_bool SOC_NRF54LM20A || SOC_NRF54LV10A
+	def_bool SOC_NRF54LM20A || SOC_NRF54LV10A || SOC_NRF7120_ENGA
 
 # Configure CRACEN_LOG_LEVEL
 module = CRACEN
@@ -37,8 +37,9 @@ config CRACEN_LOAD_MICROCODE
 
 config CRACEN_LIB_KMU
 	bool "CRACEN KMU library"
-	depends on SOC_SERIES_NRF54LX
-	select NRFX_RRAMC if !BUILD_WITH_TFM
+	depends on CRACEN_HW_PRESENT
+	select NRFX_RRAMC if !BUILD_WITH_TFM && SOC_SERIES_NRF54LX
+	select NRFX_MRAMC if !BUILD_WITH_TFM && SOC_SERIES_NRF71X
 	default y
 	help
 	  The CRACEN KMU library.

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/lib_kmu.c

@@ -12,7 +12,15 @@
 
 #include <nrf.h>
 
+#if defined(CONFIG_SOC_SERIES_NRF54LX)
 #include <nrfx_rramc.h>
+#elif defined(CONFIG_SOC_SERIES_NRF71X)
+#include <nrfx_mramc.h>
+
+#define REG_MRAMC_CONFIGNVR_PAGE_3    (uint32_t *)((uint32_t)NRF_MRAMC + 0x58C)
+#define MRAM_SICR_ENABLE_WRITE_ERASE  0xFFF00022
+#define MRAM_SICR_DISABLE_WRITE_ERASE 0x0
+#endif
 
 #include <cracen/lib_kmu.h>
 
@@ -34,6 +42,35 @@ void lib_kmu_clear_all_events(void)
 #endif
 }
 
+#if defined(CONFIG_SOC_SERIES_NRF71X)
+static void mram_enable_kmu_write_erase_to_sicr(bool permission)
+{
+	/* CONFIGNVR.PAGE[3] contain the SICR info block
+	 * setting info block write and erase permission to
+	 * allow KMU to write to SICR in MRAM.
+	 *
+	 * Register not available on hal_nordic this version, need
+	 * to update this when it is available, WZN-5799.
+	 */
+	static nrf_mramc_readynext_timeout_t prev_readynext_timeout;
+
+	if (permission) {
+		/* Save previous readynext timeout value */
+		nrf_mramc_readynext_timeout_get(NRF_MRAMC, &prev_readynext_timeout);
+		nrf_mramc_readynext_timeout_t readynext_timeout = {
+			.value        = NRF_MRAMC_READYNEXTTIMEOUT_DEFAULT,
+			.direct_write = true,
+		};
+		nrf_mramc_readynext_timeout_set(NRF_MRAMC, &readynext_timeout);
+	} else {
+		nrf_mramc_readynext_timeout_set(NRF_MRAMC, &prev_readynext_timeout);
+	}
+
+	*REG_MRAMC_CONFIGNVR_PAGE_3 = permission ?
+		MRAM_SICR_ENABLE_WRITE_ERASE : MRAM_SICR_DISABLE_WRITE_ERASE;
+}
+#endif
+
 static int trigger_task_and_wait_for_event_or_error(volatile uint32_t *task,
 						    volatile uint32_t *event)
 {
@@ -80,7 +117,7 @@ int lib_kmu_provision_slot(int slot_id, struct kmu_src *kmu_src)
 	__ASSERT(IS_PTR_ALIGNED_BYTES(kmu_src->dest, 16), "DEST misaligned");
 
 	int result = 1;
-
+#if defined(CONFIG_SOC_SERIES_NRF54LX)
 #if defined(__NRF_TFM__)
 	nrf_rramc_config_t rramc_config;
 
@@ -92,19 +129,28 @@ int lib_kmu_provision_slot(int slot_id, struct kmu_src *kmu_src)
 #else
 	nrfx_rramc_write_enable_set(true, 0);
 #endif
+#elif defined(CONFIG_SOC_SERIES_NRF71X)
+	/* Enable write and erase from KMU to SICR in MRAM */
+	mram_enable_kmu_write_erase_to_sicr(true);
+#endif
 
 	NRF_KMU_S->KEYSLOT = slot_id;
 	NRF_KMU_S->SRC = (uint32_t)kmu_src;
 
 	result = trigger_task_and_wait_for_event_or_error(&(NRF_KMU_S->TASKS_PROVISION),
 							  &(NRF_KMU_S->EVENTS_PROVISIONED));
 
+#if defined(CONFIG_SOC_SERIES_NRF54LX)
 #if defined(__NRF_TFM__)
 	rramc_config.write_buff_size = orig_write_buf_size;
 	nrf_rramc_config_set(NRF_RRAMC_S, &rramc_config);
 #else
 	nrfx_rramc_write_enable_set(false, 0);
 #endif
+#elif defined(CONFIG_SOC_SERIES_NRF71X)
+	/* Disable write and erase from KMU to SICR in MRAM */
+	mram_enable_kmu_write_erase_to_sicr(false);
+#endif
 
 	return result;
 }
@@ -145,17 +191,23 @@ int lib_kmu_block_slot_range(int slot_id, unsigned int slot_count)
 
 int lib_kmu_revoke_slot(int slot_id)
 {
-#if !defined(__NRF_TFM__)
+#if !defined(__NRF_TFM__) && defined(CONFIG_SOC_SERIES_NRF54LX)
 	nrfx_rramc_write_enable_set(true, 0);
+#elif defined(CONFIG_SOC_SERIES_NRF71X)
+	/* Enable write and erase from KMU to SICR in MRAM */
+	mram_enable_kmu_write_erase_to_sicr(true);
 #endif
 
 	NRF_KMU_S->KEYSLOT = slot_id;
 
 	int result = trigger_task_and_wait_for_event_or_error(&(NRF_KMU_S->TASKS_REVOKE),
 							      &(NRF_KMU_S->EVENTS_REVOKED));
 
-#if !defined(__NRF_TFM__)
+#if !defined(__NRF_TFM__) && defined(CONFIG_SOC_SERIES_NRF54LX)
 	nrfx_rramc_write_enable_set(false, 0);
+#elif defined(CONFIG_SOC_SERIES_NRF71X)
+	/* Disable write and erase from KMU to SICR in MRAM */
+	mram_enable_kmu_write_erase_to_sicr(false);
 #endif
 
 	return result;

subsys/nrf_security/src/drivers/cracen/silexpk/target/baremetal_ba414e_with_ik/pk_baremetal.c

@@ -23,7 +23,7 @@
 #include <security/cracen.h>
 #include <nrf_security_mutexes.h>
 
-#if CONFIG_CRACEN_HW_VERSION_LITE && !CONFIG_SOC_NRF54LM20A && !CONFIG_SOC_NRF54LV10A
+#if defined(CONFIG_CRACEN_HW_VERSION_LITE) && !defined(CONFIG_CRACEN_NEED_IKG_INTERRUPT_WORKAROUND)
 #error Check to see if the current board needs the IKG-PKE interrupt workaround or not, \
 then update this error
 #endif