Enable KMU reserved area with DTS #23870

Vge0rge · 2025-08-08T11:02:54Z

See commits.

test_crypto: PR-833

NordicBuilder · 2025-08-08T11:03:44Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
mcuboot	nrfconnect/sdk-mcuboot@`c72ed15`	nrfconnect/sdk-mcuboot@`6c096b8` (`main`)	nrfconnect/[email protected]
zephyr	nrfconnect/sdk-zephyr@`a922397`	nrfconnect/sdk-zephyr@`793e93e` (`main`)	nrfconnect/[email protected]

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

NordicBuilder · 2025-08-08T11:09:03Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 17

Inputs:

Sources:

sdk-nrf: PR head: a2d7956224d27c8c0662da2214851956513e7a1e
mcuboot: PR head: 6c096b8ed7bfddf044b20dfb512c4c1fd06c2ef6
zephyr: PR head: 793e93e14667c87968d75c1666a9a99b44a054c9

more details

sdk-nrf:

PR head: a2d7956224d27c8c0662da2214851956513e7a1e
merge base: 94d0ffef5bf0268d9702fd076ee63e4401a6ab73
target head (main): 94d0ffef5bf0268d9702fd076ee63e4401a6ab73
Diff

mcuboot:

PR head: 6c096b8ed7bfddf044b20dfb512c4c1fd06c2ef6
merge base: c72ed153fb924203975c38dfea2853ae612e0a9a
Diff

zephyr:

PR head: 793e93e14667c87968d75c1666a9a99b44a054c9
merge base: a922397417e49858aa7a6fd98d8ef79f6dee3666
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (11)

bootloader
│  ├── mcuboot
│  │  ├── boot
│  │  │  ├── bootutil
│  │  │  │  ├── src
│  │  │  │  │  │ swap_scratch.c
│  │  │  ├── zephyr
│  │  │  │  │ Kconfig
subsys
│  ├── nrf_security
│  │  ├── src
│  │  │  ├── drivers
│  │  │  │  ├── cracen
│  │  │  │  │  ├── cracenpsa
│  │  │  │  │  │  ├── cracenpsa.cmake
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  ├── common.c
│  │  │  │  │  │  │  ├── common.h
│  │  │  │  │  │  │  ├── key_management.c
│  │  │  │  │  │  │  ├── kmu.c
│  │  │  │  │  │  │  ├── platform_keys
│  │  │  │  │  │  │  │  │ platform_keys.c
│  │  │  │  │  │  │  │ spake2p.c
west.yml
zephyr
│  ├── soc
│  │  ├── nordic
│  │  │  ├── nrf54l
│  │  │  │  │ CMakeLists.txt

Outputs:

Toolchain

Version: c5be9c56c7
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:c5be9c56c7_bba2ea5f2e

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister
- sdk-nrf test count: 30
- sdk-zephyr test count: 687
✅ Integration tests
- ✅ test-sdk-audio
- ✅ test_ble_nrf_config
- ✅ test-fw-nrfconnect-chip
- ✅ test-fw-nrfconnect-nfc
- ✅ test-fw-nrfconnect-nrf-iot_cloud
- ✅ test-fw-nrfconnect-nrf_crypto
- ✅ test-fw-nrfconnect-rs
- ✅ test-fw-nrfconnect-fem
- ✅ test-fw-nrfconnect-tfm
- ✅ test-sdk-find-my
- ✅ test-sdk-mcuboot
- ✅ test-sdk-dfu
- ⚠️ test-fw-nrfconnect-thread-main

Disabled integration tests

- test-fw-nrfconnect-nrf_lrcs_mosh
- test-fw-nrfconnect-nrf_lrcs_positioning
- desktop52_verification
- doc-internal
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_serial_lte_modem
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-proprietary_esb
- test-fw-nrfconnect-ps-main
- test-fw-nrfconnect-rpc
- test-low-level
- test-sdk-pmic-samples
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

github-actions · 2025-08-08T11:30:15Z

You can find the documentation preview for this PR here.

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/kmu.c

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/platform_keys/platform_keys.c

de-nordic · 2025-08-14T10:48:32Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/cracenpsa.cmake

  ${CMAKE_CURRENT_LIST_DIR}/src/prng_pool.c
 )

+if(NOT CONFIG_PSA_CRYPTO_DRIVER_ALG_PRNG_TEST)
+list(APPEND cracen_driver_sources


Alignment seems to be not ok.

Vge0rge · 2025-08-15T08:28:05Z

The compliance failure here is not related to the PR. There are some commits in Zephyr which got merged before my commits but their manifest was not merged so this makes compliance fail.

The PR which blocks this PR is here: #23858

Change all the psa_generate_random calls to call the driver directly (cracen_get_random). This makes it more consistent with the rest of the driver. It is also a better practice to stay on the same levels of APIs and avoid calling APIs in higher levels. Signed-off-by: Georgios Vasilakis <[email protected]>

The kmu_push_area was only allowed to be set with dts for the ram images. Now more images will use it and hence the dependency on RAM images is removed. Also create a Kconfig which depends on the dts entry so that it can be used in the build system. Signed-off-by: Georgios Vasilakis <[email protected]>

Don't add the file ctr_drbg.c when you build the tests. While testing a modified version of this file is used which implements the same symbols so this file cannot be included. Signed-off-by: Georgios Vasilakis <[email protected]>

In one case inside the KMU Cracen driver a call to get a random value was not checked, this check is now added. Signed-off-by: Georgios Vasilakis <[email protected]>

Bring change in mcuboot which fixes dependencies with the PSA_CORE_LITE. Bring Zephyr with new logic for including the KMU reserved area. Signed-off-by: Georgios Vasilakis <[email protected]>

Vge0rge requested review from a team as code owners August 8, 2025 11:02

github-actions bot added manifest changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Aug 8, 2025

NordicBuilder added manifest-mcuboot manifest-zephyr DNM labels Aug 8, 2025

nordicjm approved these changes Aug 11, 2025

View reviewed changes

Vge0rge force-pushed the kmu_reserved_dts branch 3 times, most recently from a200b90 to 74976a0 Compare August 11, 2025 12:20

tomi-font reviewed Aug 12, 2025

View reviewed changes

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/kmu.c Show resolved Hide resolved

Vge0rge force-pushed the kmu_reserved_dts branch from 74976a0 to dcc8177 Compare August 12, 2025 11:38

NordicBuilder mentioned this pull request Aug 12, 2025

boards: dts: Update memory layout for nRF54L nrfconnect/sdk-nrf-bm#200

Merged

shanthanordic requested a review from magnev August 13, 2025 06:10

Vge0rge force-pushed the kmu_reserved_dts branch from dcc8177 to 27ea2b6 Compare August 13, 2025 12:17

tomi-font approved these changes Aug 14, 2025

View reviewed changes

magnev reviewed Aug 14, 2025

View reviewed changes

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/kmu.c Show resolved Hide resolved

Vge0rge force-pushed the kmu_reserved_dts branch 2 times, most recently from 901bb2d to 095b6b3 Compare August 14, 2025 10:02

tomi-font reviewed Aug 14, 2025

View reviewed changes

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/platform_keys/platform_keys.c Outdated Show resolved Hide resolved

Vge0rge force-pushed the kmu_reserved_dts branch from 65ee796 to 5492d93 Compare August 14, 2025 10:24

de-nordic reviewed Aug 14, 2025

View reviewed changes

magnev approved these changes Aug 14, 2025

View reviewed changes

Vge0rge force-pushed the kmu_reserved_dts branch from 5492d93 to 2c20e4d Compare August 14, 2025 14:04

Vge0rge force-pushed the kmu_reserved_dts branch 2 times, most recently from 0e8e874 to 2f7ebe8 Compare August 14, 2025 14:18

eivindj-nordic force-pushed the kmu_reserved_dts branch from 2f7ebe8 to b26ad22 Compare August 15, 2025 07:11

NordicBuilder removed the DNM label Aug 15, 2025

Vge0rge removed the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Aug 15, 2025

Vge0rge added 5 commits August 15, 2025 11:20

nrf_security: Avoid adding Cracen ctr_drbg for tests

01bd0cb

Don't add the file ctr_drbg.c when you build the tests. While testing a modified version of this file is used which implements the same symbols so this file cannot be included. Signed-off-by: Georgios Vasilakis <[email protected]>

nrf_security: Fix error code check in Cracen PSA

6420a77

In one case inside the KMU Cracen driver a call to get a random value was not checked, this check is now added. Signed-off-by: Georgios Vasilakis <[email protected]>

manifest: Update mcuboot and zephyr

a2d7956

Bring change in mcuboot which fixes dependencies with the PSA_CORE_LITE. Bring Zephyr with new logic for including the KMU reserved area. Signed-off-by: Georgios Vasilakis <[email protected]>

Vge0rge force-pushed the kmu_reserved_dts branch from b26ad22 to a2d7956 Compare August 15, 2025 09:22

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Aug 15, 2025

NordicBuilder mentioned this pull request Aug 15, 2025

Mcuboot kmu experiments nrfconnect/sdk-nrf-bm#260

Draft

Vge0rge removed the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Aug 15, 2025

NordicBuilder mentioned this pull request Aug 15, 2025

manifest: update NCS to latest nrfconnect/sdk-nrf-bm#263

Merged

hermabe merged commit c1e8d75 into nrfconnect:main Aug 15, 2025
15 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Enable KMU reserved area with DTS #23870

Enable KMU reserved area with DTS #23870

Vge0rge commented Aug 8, 2025 •

edited

Loading

Uh oh!

NordicBuilder commented Aug 8, 2025 •

edited

Loading

Uh oh!

NordicBuilder commented Aug 8, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Aug 8, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

de-nordic Aug 14, 2025

Uh oh!

Vge0rge Aug 14, 2025

Uh oh!

Vge0rge commented Aug 15, 2025

Uh oh!

Uh oh!

Uh oh!

Enable KMU reserved area with DTS #23870

Enable KMU reserved area with DTS #23870

Conversation

Vge0rge commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NordicBuilder commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NordicBuilder commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Uh oh!

github-actions bot commented Aug 8, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

de-nordic Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

Vge0rge Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

Vge0rge commented Aug 15, 2025

Uh oh!

Uh oh!

Uh oh!

Vge0rge commented Aug 8, 2025 •

edited

Loading

NordicBuilder commented Aug 8, 2025 •

edited

Loading

NordicBuilder commented Aug 8, 2025 •

edited

Loading