nrf_security: add initial support for nRF54l20 PDK #19741

tomi-font · 2025-01-03T13:37:42Z

See commits.

NordicBuilder · 2025-01-03T13:38:59Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 25

Inputs:

Sources:

sdk-nrf: PR head: e9278eb1367b81e14d3c1c343c7fb878c787429a

more details

sdk-nrf:

PR head: e9278eb1367b81e14d3c1c343c7fb878c787429a
merge base: 7f8f9f97e1d4ca5d1ed96d9b486a3e776361ad63
target head (main): 3ad58c7812a469f759ad8a1a79ac933c0a497937
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (48)

doc
│  ├── nrf
│  │  ├── includes
│  │  │  │ sample_board_rows.txt
samples
│  ├── crypto
│  │  ├── aes_cbc
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── aes_ccm
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── aes_ctr
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── aes_gcm
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── chachapoly
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── ecdh
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── ecdsa
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── ecjpake
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── eddsa
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── hkdf
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── hmac
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── pbkdf2
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── persistent_key_usage
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── psa_tls
│  │  │  │ sample.yaml
│  │  ├── rng
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── rsa
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── sha256
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
│  │  ├── spake2p
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  ├── sample.yaml
│  │  │  ├── src
│  │  │  │  │ main.c
│  ├── keys
│  │  ├── hw_unique_key
│  │  │  ├── boards
│  │  │  │  │ nrf54l20pdk_nrf54l20_cpuapp.conf
│  │  │  │ sample.yaml
subsys
│  ├── nrf_security
│  │  ├── src
│  │  │  ├── drivers
│  │  │  │  ├── cracen
│  │  │  │  │  ├── Kconfig
│  │  │  │  │  ├── cracenpsa
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  │ common.c
│  │  │  │  │  ├── sicrypto
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  ├── ecdsa.c
│  │  │  │  │  │  │  │ sicrypto.c
│  │  │  │  │  ├── silexpk
│  │  │  │  │  │  ├── include
│  │  │  │  │  │  │  ├── silexpk
│  │  │  │  │  │  │  │  │ iomem.h
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  │ iomem.c
│  │  │  │  │  │  ├── target
│  │  │  │  │  │  │  ├── baremetal_ba414e_with_ik
│  │  │  │  │  │  │  │  │ pk_baremetal.c
│  │  │  │  │  │  │  ├── hw
│  │  │  │  │  │  │  │  ├── ba414
│  │  │  │  │  │  │  │  │  │ pkhardware_ba414e.h
│  │  │  │  │  ├── sxsymcrypt
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  │ hw.h

Outputs:

Toolchain

Version: aedb4c0245
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:aedb4c0245_bece0367df

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister
- sdk-nrf test count: 1743
✅ Integration tests
- ✅ test-fw-nrfconnect-chip
- ✅ test-fw-nrfconnect-nrf_crypto
- ✅ test-fw-nrfconnect-tfm
- ✅ test-sdk-find-my
- ✅ test-sdk-sidewalk
- ✅ test-sdk-dfu
- ⚠️ test-fw-nrfconnect-nrf-iot_cloud

Disabled integration tests

- desktop52_verification
- doc-internal
- test_ble_nrf_config
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-boot
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_mosh
- test-fw-nrfconnect-nrf-iot_positioning
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_serial_lte_modem
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-proprietary_esb
- test-fw-nrfconnect-ps
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-rs
- test-fw-nrfconnect-thread
- test-fw-nrfconnect-zigbee
- test-low-level
- test-sdk-audio
- test-sdk-mcuboot
- test-sdk-pmic-samples
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

NordicBuilder · 2025-01-16T06:39:03Z

You can find the documentation preview for this PR at this link.

Note: This comment is automatically posted by the Documentation Publish GitHub Action.

github-actions · 2025-02-25T00:34:06Z

This pull request has been marked as stale because it has been open (more than) 30 days with no activity. Remove the stale label or add a comment saying that you would like to have the label removed otherwise this pull request will automatically be closed in 7 days. Note, that you can always re-open a closed pull request at any time.

github-actions · 2025-02-25T13:41:26Z

After documentation is built, you will find the preview for this PR here.

Preview links for modified nRF Connect SDK documents:

https://ncsdoc.z6.web.core.windows.net/PR-19741/nrf/dev_model_and_contributions/code_base.html
https://ncsdoc.z6.web.core.windows.net/PR-19741/nrf/installation/install_ncs.html
https://ncsdoc.z6.web.core.windows.net/PR-19741/nrf/releases_and_maturity/release_notes.html
https://ncsdoc.z6.web.core.windows.net/PR-19741/nrf/releases_and_maturity/releases/release-notes-changelog.html

subsys/nrf_security/src/drivers/cracen/Kconfig

samples/crypto/aes_cbc/boards/nrf54l20pdk_nrf54l20_cpuapp.conf

samples/crypto/aes_cbc/sample.yaml

samples/crypto/spake2p/src/main.c

degjorva · 2025-02-25T14:58:07Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/common.c

@@ -42,6 +45,10 @@ static const uint8_t RSA_ALGORITHM_IDENTIFIER[] = {0x06, 0x09, 0x2a, 0x86, 0x48,

 psa_status_t silex_statuscodes_to_psa(int ret)
 {
+	if (ret != SX_OK) {


Should this logging not be wrapped in a "#ifdef CONFIG_LOG_*" variant of some kind?

Why should it be? The LOG_*() macros themselves are #ifdefed based on the log level of the current module.

I just figured that from a new users perspective it would be a bit confusing to run a sample and then get two different error messages. Say as an example:

[00:00:00.433,727] <inf> ecdsa: Signing a message using ECDSA... [00:00:00.434,181] <inf> cracen: SX_ERR 10 [00:00:00.434,193] <inf> ecdsa: psa_sign_hash failed! (Error: -149)

Would bit confusing from someone who is just trying to running a sample, as they now would need to know that there is a difference between the psa status codes and the SX status codes. So having it so you needed to set an option to get this output would make sense as it is only really relevant for people developing nrf and not for the people making applications?

Yeah true. I could turn that into a debug log so it wouldn't be enabled by default. Although CONFIG_CRACEN_LOG_LEVEL_DBG=y can be a bit verbose due to logging all the power on/offs. (Maybe we can do something about this if it's annoying.)
Thoughts?

That seems like the simplest option yeah. I haven't done much with the debug levels so don't know how much is logged on the debug level.

tomi-font · 2025-02-27T12:20:58Z

@nrfconnect/ncs-doc-leads @nrfconnect/ncs-aegir-doc please review

umapraseeda · 2025-02-28T08:06:16Z

doc/nrf/includes/sample_board_rows.txt

+
+.. nrf54l20pdk_nrf54l20_cpuapp
+
+| nRF54L20 PDK | - | :ref:`nrf54l20pdk <zephyr:nrf54l20pdk_nrf54l20>` | ``nrf54l20pdk/nrf54l20/cpuapp`` |


Add the nrf54l20pdk/nrf54l20/cpuapp board target to the crypto samples. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

^ Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

- Remove leftover Oberon-only test scenarios (not a supported configuration). - Add nrf54l15dk/nrf54l10/cpuapp to the CRACEN + Oberon test scenarios. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

- Improve CRACEN memory read/write logging. Now the macro that enables the logging is prefixed with SX_ and some non-word-aligned reads/writes are logged. - Some minor cleanups. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

Make the sx_*pkmem*() functions perform word-aligned and word-sized writes on 54L20, which requires that. Also, turn sx_rdpkmem() into an inline memcpy() as that's what the implementation was basically doing. Other than that, the original implementation is left untouched on other board targets to avoid potential breakages. ref: DLT-3873 Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

Make silex_statuscodes_to_psa() log the SX error it translates to psa_status_t. This helps being aware of and debugging erros happening in the Silex drivers. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

Introduce the CRACEN_HW_VERSION Kconfig choice to indicate what CRACEN IP is present. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

Remove a step that is not needed and that was not performed properly. It showed up as an error on CRACEN Lite because the IP returns a different error code. ref: DLT-3834 Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

Ensure that the memory pointing to the internal octet remains valid and untouched until the task's execution is complete as si_task_consume() says. This provoked issues in certain cases on CRACEN Lite because it's slower and takes more time to retrieve the data through DMA. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

sonarqubecloud · 2025-02-28T08:29:33Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Jan 3, 2025

tomi-font force-pushed the security_cracen_support_54l20 branch from 07ab575 to ea227cc Compare January 7, 2025 10:22

github-actions bot added the doc-required PR must not be merged without tech writer approval. label Jan 7, 2025

tomi-font force-pushed the security_cracen_support_54l20 branch from ea227cc to b93bdca Compare January 16, 2025 06:22

tomi-font force-pushed the security_cracen_support_54l20 branch from b93bdca to dc2178a Compare January 17, 2025 10:49

tomi-font changed the title ~~samples: crypto: add nRF54l20 PDK~~ nrf_security: add initial support for nRF54l20 PDK Jan 17, 2025

tomi-font force-pushed the security_cracen_support_54l20 branch from dc2178a to 7e3f3fe Compare January 24, 2025 09:35

github-actions bot added the Stale label Feb 25, 2025

tomi-font removed the Stale label Feb 25, 2025

tomi-font force-pushed the security_cracen_support_54l20 branch from 7e3f3fe to 8ec08c2 Compare February 25, 2025 13:41

tomi-font marked this pull request as ready for review February 25, 2025 13:42

tomi-font requested review from a team as code owners February 25, 2025 13:42

tomi-font removed the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Feb 25, 2025

tomi-font force-pushed the security_cracen_support_54l20 branch from 8ec08c2 to 1ef31d0 Compare February 25, 2025 13:44

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Feb 25, 2025

tomi-font removed the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Feb 25, 2025

nordicjm reviewed Feb 25, 2025

View reviewed changes

subsys/nrf_security/src/drivers/cracen/Kconfig Outdated Show resolved Hide resolved

nordicjm reviewed Feb 25, 2025

View reviewed changes

subsys/nrf_security/src/drivers/cracen/Kconfig Outdated Show resolved Hide resolved

degjorva reviewed Feb 25, 2025

View reviewed changes

tomi-font force-pushed the security_cracen_support_54l20 branch from 1ef31d0 to 626cdd3 Compare February 26, 2025 08:46

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Feb 26, 2025

nordicjm approved these changes Feb 26, 2025

View reviewed changes

tomi-font force-pushed the security_cracen_support_54l20 branch from 626cdd3 to 70bc035 Compare February 26, 2025 09:06

tomi-font requested a review from degjorva February 26, 2025 09:06

tomi-font marked this pull request as draft February 27, 2025 09:01

tomi-font force-pushed the security_cracen_support_54l20 branch 2 times, most recently from eadc57a to 12c7d77 Compare February 27, 2025 12:20

tomi-font marked this pull request as ready for review February 27, 2025 12:20

tomi-font requested a review from degjorva February 27, 2025 12:20

tomi-font removed DNM changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Feb 27, 2025

tomi-font added the DNM label Feb 27, 2025

degjorva approved these changes Feb 27, 2025

View reviewed changes

tomi-font force-pushed the security_cracen_support_54l20 branch from 12c7d77 to 3e47769 Compare February 28, 2025 07:16

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Feb 28, 2025

greg-fer approved these changes Feb 28, 2025

View reviewed changes

umapraseeda reviewed Feb 28, 2025

View reviewed changes

tomi-font added 9 commits February 28, 2025 10:23

samples: crypto: add nRF54l20 PDK

32ecc70

Add the nrf54l20pdk/nrf54l20/cpuapp board target to the crypto samples. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

samples: hw_unique_key: add nRF54L20 PDK

d0864de

^ Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

samples: crypto: psa_tls: fix sample.yaml

1d9df7f

- Remove leftover Oberon-only test scenarios (not a supported configuration). - Add nrf54l15dk/nrf54l10/cpuapp to the CRACEN + Oberon test scenarios. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

nrf_security: drivers: cracen: log SX errors

83de17c

Make silex_statuscodes_to_psa() log the SX error it translates to psa_status_t. This helps being aware of and debugging erros happening in the Silex drivers. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

nrf_security: drivers: cracen: add CRACEN HW version Kconfig options

41688b6

Introduce the CRACEN_HW_VERSION Kconfig choice to indicate what CRACEN IP is present. Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>

tomi-font force-pushed the security_cracen_support_54l20 branch from 3e47769 to e9278eb Compare February 28, 2025 08:24

tomi-font requested a review from a team February 28, 2025 08:24

tomi-font removed DNM changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Feb 28, 2025

umapraseeda approved these changes Feb 28, 2025

View reviewed changes

endre-nordic merged commit e3b426a into nrfconnect:main Feb 28, 2025
15 of 16 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nrf_security: add initial support for nRF54l20 PDK #19741

nrf_security: add initial support for nRF54l20 PDK #19741

tomi-font commented Jan 3, 2025

NordicBuilder commented Jan 3, 2025 •

edited

Loading

NordicBuilder commented Jan 16, 2025

github-actions bot commented Feb 25, 2025

github-actions bot commented Feb 25, 2025

degjorva Feb 25, 2025 •

edited

Loading

tomi-font Feb 26, 2025

degjorva Feb 26, 2025

tomi-font Feb 26, 2025

degjorva Feb 26, 2025

tomi-font commented Feb 27, 2025

umapraseeda Feb 28, 2025

sonarqubecloud bot commented Feb 28, 2025


		.. nrf54l20pdk_nrf54l20_cpuapp

		\| nRF54L20 PDK \| - \| :ref:`nrf54l20pdk <zephyr:nrf54l20pdk_nrf54l20>` \| ``nrf54l20pdk/nrf54l20/cpuapp`` \|

	\| nRF54L20 PDK \| - \| :ref:`nrf54l20pdk <zephyr:nrf54l20pdk_nrf54l20>` \| ``nrf54l20pdk/nrf54l20/cpuapp`` \|
	\| nRF54L20 PDK \| \| :ref:`nrf54l20pdk <zephyr:nrf54l20pdk_nrf54l20>` \| ``nrf54l20pdk/nrf54l20/cpuapp`` \|

nrf_security: add initial support for nRF54l20 PDK #19741

nrf_security: add initial support for nRF54l20 PDK #19741

Conversation

tomi-font commented Jan 3, 2025

NordicBuilder commented Jan 3, 2025 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

NordicBuilder commented Jan 16, 2025

github-actions bot commented Feb 25, 2025

github-actions bot commented Feb 25, 2025

degjorva Feb 25, 2025 • edited Loading

Choose a reason for hiding this comment

tomi-font Feb 26, 2025

Choose a reason for hiding this comment

degjorva Feb 26, 2025

Choose a reason for hiding this comment

tomi-font Feb 26, 2025

Choose a reason for hiding this comment

degjorva Feb 26, 2025

Choose a reason for hiding this comment

tomi-font commented Feb 27, 2025

umapraseeda Feb 28, 2025

Choose a reason for hiding this comment

sonarqubecloud bot commented Feb 28, 2025

Quality Gate passed

NordicBuilder commented Jan 3, 2025 •

edited

Loading

degjorva Feb 25, 2025 •

edited

Loading