nrf_ironside: Move Ironside outside of nrf_security #24862

Vge0rge · 2025-10-03T11:27:12Z

Create a separate subsystem called nrf_ironside instead of having the logic in nrf_security. Ironside is completely separate from nrf_security and it should not be placed there.

Make sure that nrf_security cannot be enabled at the same time as nrf_ironside as their configurations might collide.

NordicBuilder · 2025-10-03T11:29:27Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 12

Inputs:

Sources:

sdk-nrf: PR head: 22b31d279b8d4645b5621b2638be530069668b3c
zephyr: PR head: 78cc58432b43214654b9b53edb41bf278aa69d2c

more details

sdk-nrf:

PR head: 22b31d279b8d4645b5621b2638be530069668b3c
merge base: 9002fe1c0798c2895356b8513d561761ac30ef20
target head (main): a694b33a40d18551f4de20599100b6779eea8417
Diff

zephyr:

PR head: 78cc58432b43214654b9b53edb41bf278aa69d2c
merge base: 6aa26eed633353a8d18d85440e73db7e330bf41d
target head (main): 1365e9d83071aad735d7ef42385430fb462fe611
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (36)

CODEOWNERS
subsys
│  ├── CMakeLists.txt
│  ├── Kconfig
│  ├── nrf_ironside
│  │  ├── CMakeLists.txt
│  │  ├── Kconfig
│  │  ├── bounce_buffers.c
│  │  ├── bounce_buffers.h
│  │  ├── ironside_config.h
│  │  ├── ironside_se_psa_ns_api.c
│  │  ├── psa
│  │  │  │ crypto_driver_config.h
│  │  ├── psa_manifest
│  │  │  │ sid.h
│  ├── nrf_security
│  │  ├── Kconfig
│  │  ├── Kconfig.psa
│  │  ├── src
│  │  │  │ CMakeLists.txt
│  ├── trusted_storage
│  │  │ Kconfig
west.yml
zephyr
│  ├── boards
│  │  ├── nordic
│  │  │  ├── nrf54h20dk
│  │  │  │  ├── nrf54h20dk_nrf54h20_cpuapp.dts
│  │  │  │  │ nrf54h20dk_nrf54h20_cpurad.dts
│  ├── doc
│  │  ├── releases
│  │  │  │ release-notes-4.3.rst
│  ├── drivers
│  │  ├── bluetooth
│  │  │  ├── hci
│  │  │  │  ├── Kconfig
│  │  │  │  │ Kconfig.esp32
│  ├── modules
│  │  ├── hostap
│  │  │  │ Kconfig
│  │  ├── mbedtls
│  │  │  │ Kconfig.psa.logic
│  │  ├── openthread
│  │  │  │ Kconfig
│  │  ├── uoscore-uedhoc
│  │  │  │ Kconfig
│  ├── samples
│  │  ├── net
│  │  │  ├── sockets
│  │  │  │  ├── http_server
│  │  │  │  │  │ Kconfig
│  │  ├── subsys
│  │  │  ├── mgmt
│  │  │  │  ├── updatehub
│  │  │  │  │  │ overlay-psa.conf
│  ├── subsys
│  │  ├── bluetooth
│  │  │  ├── crypto
│  │  │  │  │ Kconfig
│  │  │  ├── host
│  │  │  │  │ Kconfig
│  │  │  ├── mesh
│  │  │  │  │ Kconfig
│  │  ├── jwt
│  │  │  │ Kconfig
│  │  ├── secure_storage
│  │  │  │ Kconfig
│  ├── tests
│  │  ├── arch
│  │  │  ├── arm
│  │  │  │  ├── arm_irq_vector_table
│  │  │  │  │  ├── boards
│  │  │  │  │  │  ├── nrf54h20dk_nrf54h20_cpuapp.conf
│  │  │  │  │  │  │ nrf54h20dk_nrf54h20_cpurad.conf
│  │  ├── bsim
│  │  │  ├── bluetooth
│  │  │  │  ├── host
│  │  │  │  │  ├── gatt
│  │  │  │  │  │  ├── caching
│  │  │  │  │  │  │  │ psa_overlay.conf
│  │  │  │  ├── ll
│  │  │  │  │  ├── conn
│  │  │  │  │  │  │ psa_overlay.conf

Outputs:

Toolchain

Version: f66cf421f3
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:f66cf421f3_bba2ea5f2e

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
❌ Build twister
- sdk-nrf test count: 30
- sdk-zephyr test count: 1638
❌ Integration tests
- ❌ test-sdk-audio
- ❌ test_ble_nrf_config
- ❌ test-fw-nrfconnect-ble_mesh
- ❌ test-fw-nrfconnect-ble_samples
- ❌ test-fw-nrfconnect-chip
- ❌ test-fw-nrfconnect-nfc
- ❌ test-fw-nrfconnect-nrf-iot_cloud
- ❌ test-fw-nrfconnect-nrf-iot_thingy91
- ❌ test-fw-nrfconnect-nrf_crypto
- ❌ test-fw-nrfconnect-rs
- ❌ test-fw-nrfconnect-fem
- ❌ test-fw-nrfconnect-tfm
- ❌ test-fw-nrfconnect-thread-main
- ❌ test-sdk-find-my
- ❌ test-low-level
- ❌ test-sdk-mcuboot
- ❌ test-sdk-dfu

Disabled integration tests

- test-fw-nrfconnect-nrf_lrcs_mosh
- test-fw-nrfconnect-nrf_lrcs_positioning
- desktop52_verification
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_serial_lte_modem
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-proprietary_esb
- test-fw-nrfconnect-ps-main
- test-fw-nrfconnect-rpc
- test-sdk-pmic-samples
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

github-actions · 2025-10-03T12:30:24Z

You can find the documentation preview for this PR here.

karstenkoenig · 2025-10-03T13:16:50Z

subsys/nrf_security/Kconfig

 	bool
 	prompt "nRF Security" if !PSA_PROMPTLESS
 	depends on SOC_FAMILY_NORDIC_NRF
+	depends on !NRF_IRONSIDE_CALL


Will this break if someone wants to use some software crypto on nrf54h20? You aren't really incompatible with NRF_IRONSIDE_CALL I'd say

software crypto on nrf54h20 is not supported. So if it does break, then that is intended behaviour :)

If they want to use it along with the hardware crypto yes. But it should break because at the moment no-one worked on this use case. If it worked by accident before it is better to break so that someone can think how to properly support this use case.

Edit: Sebastians comment didn't show up before I sent this. But we are saying the exact same thing basically :)

NordicBuilder · 2025-10-03T22:06:06Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
zephyr	nrfconnect/sdk-zephyr@`05b8b21`	nrfconnect/sdk-zephyr#3346	nrfconnect/sdk-zephyr#3346/files

⛔ DNM label due to: 1 project with PR revision

Note: This message is automatically posted and updated by the Manifest GitHub Action.

SebastianBoe · 2025-10-06T13:28:23Z

subsys/nrf_ironside/Kconfig

 	prompt "PSA crypto provided through SSF"
 	default y
-	depends on SOC_NRF54H20 || SOC_SERIES_NRF92X
+	depends on SOC_NRF54H20_CPUAPP || SOC_NRF54H20_CPURAD || SOC_SERIES_NRF92X


Presumably 92X should also be split up into CPUAPP and CPUCELL?

@ayla-nordicsemi ?

nordicjm · 2025-10-06T13:50:19Z

subsys/nrf_ironside/CMakeLists.txt

 #

+if(CONFIG_PSA_SSF_CRYPTO_CLIENT)
+


Suggested change

and missing indent

nordicjm · 2025-10-06T13:50:29Z

subsys/nrf_ironside/CMakeLists.txt

+
+zephyr_compile_definitions(MBEDTLS_PSA_CRYPTO_CONFIG_FILE="ironside_config.h")
+zephyr_compile_definitions(MBEDTLS_CONFIG_FILE="ironside_config.h")
+


Suggested change

nordicjm · 2025-10-06T13:50:42Z

subsys/nrf_ironside/CMakeLists.txt

+zephyr_compile_definitions(MBEDTLS_PSA_CRYPTO_CONFIG_FILE="ironside_config.h")
+zephyr_compile_definitions(MBEDTLS_CONFIG_FILE="ironside_config.h")


isn't this a Kconfig?

Create a separate subsystem called nrf_ironside instead of having the logic in nrf_security. Ironside is completely separate from nrf_security and it should not be placed there. Make sure that nrf_security cannot be enabled at the same time as nrf_ironside as their configurations might collide. Signed-off-by: Georgios Vasilakis <[email protected]>

The NRF_IRONSIDE is a provider of PSA services (including storage) so it cannot be used along with the truested storage subsystem which provides PSA storage APIs. Signed-off-by: Georgios Vasilakis <[email protected]>

Brings Zephyr with PSA RNG as the default entropy provider for the nRF54h20. Signed-off-by: Georgios Vasilakis <[email protected]>

Vge0rge force-pushed the new_nrf_ironside branch 3 times, most recently from ad3ff8d to fb6ad87 Compare October 3, 2025 11:48

Vge0rge marked this pull request as ready for review October 3, 2025 12:56

Vge0rge requested review from a team as code owners October 3, 2025 12:56

Vge0rge requested a review from a team October 3, 2025 12:57

Vge0rge force-pushed the new_nrf_ironside branch from fb6ad87 to ddbf7ac Compare October 3, 2025 13:00

SebastianBoe approved these changes Oct 3, 2025

View reviewed changes

jonathannilsen approved these changes Oct 3, 2025

View reviewed changes

karstenkoenig reviewed Oct 3, 2025

View reviewed changes

degjorva approved these changes Oct 3, 2025

View reviewed changes

Vge0rge force-pushed the new_nrf_ironside branch 2 times, most recently from 23fd200 to 9783e81 Compare October 3, 2025 21:14

Vge0rge requested a review from a team as a code owner October 3, 2025 22:05

NordicBuilder added the manifest label Oct 3, 2025

NordicBuilder added manifest-zephyr DNM labels Oct 3, 2025

Vge0rge mentioned this pull request Oct 3, 2025

manifest: sdk-zephyr: [nrf noup] boards: nordic: Enable PSA RNG for nrf54h20 #24818

Closed

Vge0rge force-pushed the new_nrf_ironside branch 3 times, most recently from 54a5725 to cc45945 Compare October 6, 2025 13:20

SebastianBoe reviewed Oct 6, 2025

View reviewed changes

nordicjm reviewed Oct 6, 2025

View reviewed changes

Vge0rge added 2 commits October 7, 2025 16:24

trusted_storage: Forbid usage with NRF_IRONSIDE_CALL

0772bf6

The NRF_IRONSIDE is a provider of PSA services (including storage) so it cannot be used along with the truested storage subsystem which provides PSA storage APIs. Signed-off-by: Georgios Vasilakis <[email protected]>

manifest: Bring Zephyr with PSA RNG for nRF54h20

22b31d2

Brings Zephyr with PSA RNG as the default entropy provider for the nRF54h20. Signed-off-by: Georgios Vasilakis <[email protected]>

Vge0rge force-pushed the new_nrf_ironside branch from cc45945 to 22b31d2 Compare October 7, 2025 14:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

nrf_ironside: Move Ironside outside of nrf_security #24862

nrf_ironside: Move Ironside outside of nrf_security #24862

Uh oh!

Vge0rge commented Oct 3, 2025

Uh oh!

NordicBuilder commented Oct 3, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 3, 2025

Uh oh!

karstenkoenig Oct 3, 2025 •

edited

Loading

Uh oh!

SebastianBoe Oct 3, 2025

Uh oh!

Vge0rge Oct 3, 2025 •

edited

Loading

Uh oh!

NordicBuilder commented Oct 3, 2025 •

edited

Loading

Uh oh!

SebastianBoe Oct 6, 2025

Uh oh!

nordicjm Oct 6, 2025

Uh oh!

nordicjm Oct 6, 2025

Uh oh!

nordicjm Oct 6, 2025

Uh oh!

Uh oh!


		zephyr_compile_definitions(MBEDTLS_PSA_CRYPTO_CONFIG_FILE="ironside_config.h")
		zephyr_compile_definitions(MBEDTLS_CONFIG_FILE="ironside_config.h")

		#

		if(CONFIG_PSA_SSF_CRYPTO_CLIENT)

nrf_ironside: Move Ironside outside of nrf_security #24862

Are you sure you want to change the base?

nrf_ironside: Move Ironside outside of nrf_security #24862

Uh oh!

Conversation

Vge0rge commented Oct 3, 2025

Uh oh!

NordicBuilder commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Uh oh!

github-actions bot commented Oct 3, 2025

Uh oh!

karstenkoenig Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SebastianBoe Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

Vge0rge Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NordicBuilder commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SebastianBoe Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

nordicjm Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

nordicjm Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

nordicjm Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

NordicBuilder commented Oct 3, 2025 •

edited

Loading

karstenkoenig Oct 3, 2025 •

edited

Loading

Vge0rge Oct 3, 2025 •

edited

Loading

NordicBuilder commented Oct 3, 2025 •

edited

Loading