Skip to content

[nrf noup] boards: nordic: Enable PSA RNG for nrf54h20 #3346

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

[nrf noup] boards: nordic: Enable PSA RNG for nrf54h20 #3346

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
bb60716
[nrf noup] boards: nordic: Enable PSA RNG for nrf54h20
Vge0rge Sep 5, 2024
7ed2949
[nrf noup] tests: arm_irq_vector_table: Remove unused SSF client option
Vge0rge Oct 2, 2025
3282d05
[nrf fromlist] secure_storage: Forbid usage with NRF_IRONSIDE
Vge0rge Oct 2, 2025
9c0f1db
[nrf fromlist] modules: openthread: fix dependency for OPENTHREAD_CRY…
valeriosetti Sep 23, 2025
92c4473
[nrf fromlist] drivers: bluetooth: esp32: remove selection of MBEDTLS…
valeriosetti Sep 30, 2025
8ff2b91
[nrf fromlist] drivers: bluetooth: hci: do not select MBEDTLS_ENTROPY…
valeriosetti Sep 30, 2025
78cc584
[nrf fromlist] modules: mbedtls: add new helper Kconfig symbol PSA_CR…
valeriosetti Sep 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion boards/nordic/nrf54h20dk/nrf54h20dk_nrf54h20_cpuapp.dts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
zephyr,bt-hci = &bt_hci_ipc0;
nordic,802154-spinel-ipc = &ipc0;
zephyr,canbus = &can120;
zephyr,entropy = &prng;
zephyr,entropy = &psa_rng;
};

aliases {
Expand Down Expand Up @@ -111,6 +111,11 @@

prng: prng {
compatible = "nordic,entropy-prng";
status = "disabled";
};

psa_rng: psa-rng {
compatible = "zephyr,psa-crypto-rng";
status = "okay";
};
};
Expand Down
16 changes: 11 additions & 5 deletions boards/nordic/nrf54h20dk/nrf54h20dk_nrf54h20_cpurad.dts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,17 +28,23 @@
zephyr,ieee802154 = &cpurad_ieee802154;
zephyr,bt-hci-ipc = &ipc0;
nordic,802154-spinel-ipc = &ipc0;
zephyr,entropy = &prng;
};
prng: prng {
compatible = "nordic,entropy-prng";
status = "okay";
zephyr,entropy = &psa_rng;
};

aliases {
ipc-to-cpusys = &cpurad_cpusys_ipc;
resetinfo = &cpurad_resetinfo;
};

prng: prng {
compatible = "nordic,entropy-prng";
status = "disabled";
};

psa_rng: psa-rng {
compatible = "zephyr,psa-crypto-rng";
status = "okay";
};
};

&cpurad_bellboard {
Expand Down
5 changes: 5 additions & 0 deletions doc/releases/release-notes-4.3.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,11 @@ Deprecated APIs and options
New APIs and options
====================

* :kconfig:option:`CONFIG_PSA_CRYPTO` allows to automatically select a PSA Crypto API
provider based on the configuration. TF-M and Mbed TLS are the only options available
for now, but the user can select :kconfig:option:`CONFIG_PSA_CRYPTO_CUSTOM` to use
a custom solution.

..
Link to new APIs here, in a group if you think it's necessary, no need to get
fancy just list the link, that should contain the documentation. If you feel
Expand Down
4 changes: 1 addition & 3 deletions drivers/bluetooth/hci/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,9 +158,7 @@ config BT_SILABS_EFR32
depends on ZEPHYR_HAL_SILABS_MODULE_BLOBS || BUILD_ONLY_NO_BLOBS
depends on !PM || SOC_GECKO_PM_BACKEND_PMGR
select SOC_GECKO_USE_RAIL
select MBEDTLS
select MBEDTLS_PSA_CRYPTO_C
select MBEDTLS_ENTROPY_C
select PSA_CRYPTO
select HAS_BT_CTLR
select BT_CTLR_PHY_UPDATE_SUPPORT
select BT_CTLR_PER_INIT_FEAT_XCHG_SUPPORT
Expand Down
1 change: 0 additions & 1 deletion drivers/bluetooth/hci/Kconfig.esp32
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -492,7 +492,6 @@ config ESP32_BT_LE_CRYPTO_STACK_MBEDTLS
select MBEDTLS_ECP_DP_SECP256R1_ENABLED
select MBEDTLS_ECDH_C
select MBEDTLS_ENTROPY_C
select MBEDTLS_PSA_CRYPTO_C
help
Use mbedTLS library for BLE cryptographic operations.

Expand Down
2 changes: 1 addition & 1 deletion modules/hostap/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,7 +204,7 @@ endchoice

config WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA
bool "Crypto Platform Secure Architecture support for WiFi"
imply MBEDTLS_PSA_CRYPTO_C
select PSA_CRYPTO
select MBEDTLS_USE_PSA_CRYPTO
select PSA_WANT_ALG_ECDH
select PSA_WANT_ALG_HMAC
Expand Down
31 changes: 29 additions & 2 deletions modules/mbedtls/Kconfig.psa.logic
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,35 @@
# Copyright (c) 2024 BayLibre SAS
# SPDX-License-Identifier: Apache-2.0

# This file extends Kconfig.psa (which is automatically generated) by adding
# some logic between PSA_WANT symbols.
config PSA_CRYPTO
bool "PSA Crypto API"
help
Enable a PSA Crypto API provider in the build. If TF-M is enabled then
it will be used for this scope, otherwise Mbed TLS will be used.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The help text doesn't mention out-of-tree providers.


choice PSA_CRYPTO_PROVIDER
prompt "PSA Crypto API provider"
depends on PSA_CRYPTO

config PSA_CRYPTO_PROVIDER_TFM
bool "Use TF-M"
depends on BUILD_WITH_TFM
select TFM_PARTITION_CRYPTO

config PSA_CRYPTO_PROVIDER_MBEDTLS
bool "Use Mbed TLS"
depends on !BUILD_WITH_TFM
select MBEDTLS
select MBEDTLS_PSA_CRYPTO_C

config PSA_CRYPTO_PROVIDER_CUSTOM
bool "Use an out-of-tree library"
depends on !BUILD_WITH_TFM

endchoice # PSA_CRYPTO_PROVIDER

# The following section extends Kconfig.psa.auto (which is automatically
# generated) by adding some logic between PSA_WANT symbols.

config PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC
bool
Expand Down
2 changes: 1 addition & 1 deletion modules/openthread/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,7 +320,7 @@ config OPENTHREAD_MAC_SOFTWARE_CSMA_BACKOFF_ENABLE

config OPENTHREAD_CRYPTO_PSA
bool "ARM PSA crypto API"
depends on MBEDTLS_PSA_CRYPTO_CLIENT
depends on PSA_CRYPTO_CLIENT
select OPENTHREAD_PLATFORM_KEY_REF if !OPENTHREAD_COPROCESSOR_RCP
imply OPENTHREAD_PLATFORM_KEYS_EXPORTABLE_ENABLE
help
Expand Down
4 changes: 1 addition & 3 deletions modules/uoscore-uedhoc/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ menuconfig UOSCORE
bool "UOSCORE library"
depends on ZCBOR
depends on ZCBOR_CANONICAL
depends on MBEDTLS
select UOSCORE_UEDHOC_CRYPTO_COMMON

help
Expand All @@ -22,7 +21,6 @@ menuconfig UEDHOC
bool "UEDHOC library"
depends on ZCBOR
depends on ZCBOR_CANONICAL
depends on MBEDTLS
select UOSCORE_UEDHOC_CRYPTO_COMMON
help
This option enables the UEDHOC library.
Expand All @@ -38,7 +36,7 @@ if UOSCORE || UEDHOC

config UOSCORE_UEDHOC_CRYPTO_COMMON
bool
imply MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
select PSA_CRYPTO
select PSA_WANT_ALG_ECDH
select PSA_WANT_ALG_ECDSA
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
Expand Down
2 changes: 1 addition & 1 deletion samples/net/sockets/http_server/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ config NET_SAMPLE_HTTP_SERVER_SERVICE_PORT
config NET_SAMPLE_HTTPS_SERVICE
bool "Enable https service"
depends on NET_SOCKETS_SOCKOPT_TLS || TLS_CREDENTIALS
imply MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
select PSA_CRYPTO

if NET_SAMPLE_HTTPS_SERVICE

Expand Down
3 changes: 1 addition & 2 deletions samples/subsys/mgmt/updatehub/overlay-psa.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,2 @@
CONFIG_FLASH_AREA_CHECK_INTEGRITY_PSA=y
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
CONFIG_PSA_CRYPTO=y
3 changes: 1 addition & 2 deletions subsys/bluetooth/crypto/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,7 @@

config BT_CRYPTO
bool
select MBEDTLS if !BUILD_WITH_TFM
select MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
select PSA_CRYPTO
select PSA_WANT_KEY_TYPE_AES
select PSA_WANT_ALG_CMAC
select PSA_WANT_ALG_ECB_NO_PADDING
Expand Down
6 changes: 2 additions & 4 deletions subsys/bluetooth/host/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,8 +200,7 @@ config BT_BUF_EVT_DISCARDABLE_COUNT
config BT_HOST_CRYPTO
bool "Use crypto functionality implemented in the Bluetooth host"
default y if !BT_CTLR_CRYPTO
select MBEDTLS if !BUILD_WITH_TFM
select MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
select PSA_CRYPTO
select PSA_WANT_KEY_TYPE_AES
select PSA_WANT_ALG_ECB_NO_PADDING
help
Expand Down Expand Up @@ -1041,8 +1040,7 @@ endif # BT_DF

config BT_ECC
bool
select MBEDTLS if !BUILD_WITH_TFM
select MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
select PSA_CRYPTO
select PSA_WANT_ALG_ECDH
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
Expand Down
3 changes: 1 addition & 2 deletions subsys/bluetooth/mesh/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1511,8 +1511,7 @@ choice BT_MESH_CRYPTO_LIB

config BT_MESH_USES_MBEDTLS_PSA
bool "mbed TLS PSA"
select MBEDTLS
select MBEDTLS_PSA_CRYPTO_C
select PSA_CRYPTO
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE
Expand Down
6 changes: 2 additions & 4 deletions subsys/jwt/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,17 +28,15 @@ config JWT_SIGN_RSA_LEGACY

config JWT_SIGN_RSA_PSA
bool "Use RSA signature (RS-256). Use PSA Crypto API."
select MBEDTLS if !BUILD_WITH_TFM
select MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
select PSA_CRYPTO
select PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT
select PSA_WANT_ALG_RSA_PKCS1V15_SIGN
select PSA_WANT_ALG_SHA_256

config JWT_SIGN_ECDSA_PSA
bool "Use ECDSA signature (ES-256). Use PSA Crypto API."
select MBEDTLS if !BUILD_WITH_TFM
select MBEDTLS_PSA_CRYPTO_C if !BUILD_WITH_TFM
select PSA_CRYPTO
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
select PSA_WANT_ALG_ECDSA
select PSA_WANT_ECC_SECP_R1_256
Expand Down
1 change: 1 addition & 0 deletions subsys/secure_storage/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
menuconfig SECURE_STORAGE
bool "Secure storage subsystem"
depends on !BUILD_WITH_TFM
depends on !NRF_IRONSIDE
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missing # in Upstream PR #

select MBEDTLS_PSA_CRYPTO_STORAGE_C if MBEDTLS_PSA_CRYPTO_C
select EXPERIMENTAL
help
Expand Down
1 change: 0 additions & 1 deletion tests/arch/arm/arm_irq_vector_table/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,3 @@
# SPDX-License-Identifier: Apache-2.0

CONFIG_POWER_DOMAIN=n
CONFIG_SSF_CLIENT_SYS_INIT=n
1 change: 0 additions & 1 deletion tests/arch/arm/arm_irq_vector_table/boards/nrf54h20dk_nrf54h20_cpurad.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,3 @@
# SPDX-License-Identifier: Apache-2.0

CONFIG_POWER_DOMAIN=n
CONFIG_SSF_CLIENT_SYS_INIT=n
3 changes: 1 addition & 2 deletions tests/bsim/bluetooth/host/gatt/caching/psa_overlay.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,2 @@
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
CONFIG_PSA_CRYPTO=y
CONFIG_PSA_CRYPTO_ENABLE_ALL=y
3 changes: 1 addition & 2 deletions tests/bsim/bluetooth/ll/conn/psa_overlay.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,2 @@
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
CONFIG_PSA_CRYPTO=y
CONFIG_PSA_CRYPTO_ENABLE_ALL=y
Loading