entropy: 54h20 PSA RNG fixes

subsys/nrf_rpc/include/nrf_rpc_os.h

@@ -86,6 +86,11 @@ static inline void nrf_rpc_os_tls_set(void *data)
 	k_thread_custom_data_set(data);
 }
 
+static inline void nrf_rpc_os_fatal_error(void)
+{
+	k_oops();
+}
+
 uint32_t nrf_rpc_os_ctx_pool_reserve(void);
 void nrf_rpc_os_ctx_pool_release(uint32_t number);
 

subsys/nrf_security/src/ssf_secdom/CMakeLists.txt

@@ -7,4 +7,5 @@
 target_sources(${mbedcrypto_target}
   PRIVATE
     ${CMAKE_CURRENT_LIST_DIR}/ssf_crypto.c
+    ${CMAKE_CURRENT_LIST_DIR}/ssf_psa_core_compatibility.c
 )

subsys/nrf_security/src/ssf_secdom/ssf_psa_core_compatibility.c

@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2025 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+ */
+
+#include <psa/crypto.h>
+
+/* This define exists in the psa_crypto.c file, I kept the same
+ * name here so that it can be searched the same way.
+ * In the psa_crypto.c file this define is the concatenation of
+ * PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED (=0x1)|
+ * PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED       (=0x2)|
+ * PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED     (=0x4)
+ * Just for conformity I kept the same value here.
+ */
+#define PSA_CRYPTO_SUBSYSTEM_ALL_INITIALISED (0x7)
+
+/* This function is declared in psa_crypto_core.h */
+int psa_can_do_hash(psa_algorithm_t hash_alg)
+{
+	(void)hash_alg;
+	/* No initialization is needed when SSF is used, so just return the
+	 * expected value here.
+	 */
+	return PSA_CRYPTO_SUBSYSTEM_ALL_INITIALISED;
+}
+
+/* This function is declared in psa_crypto_core.h */
+int psa_can_do_cipher(psa_key_type_t key_type, psa_algorithm_t cipher_alg)
+{
+	(void)key_type;
+	(void)cipher_alg;
+	/* No initialization is needed when SSF is used, so just return the
+	 * expected value here.
+	 */
+	return PSA_CRYPTO_SUBSYSTEM_ALL_INITIALISED;
+}

subsys/sdfw_services/Kconfig

@@ -38,6 +38,11 @@ config SSF_CLIENT_SYS_INIT
 	bool "Start SDFW Service Framework client on boot"
 	default y
 
+config SSF_CLIENT_SYS_INIT_PRIORITY
+	int
+	default 47
+	depends on SSF_CLIENT_SYS_INIT
+
 config SSF_CLIENT_REGISTERED_LISTENERS_MAX
 	int "Maximum number of simultaneous registered listeners"
 	default 1

subsys/sdfw_services/os/ssf_client_zephyr.c

@@ -45,10 +45,25 @@ void ssf_client_sem_give(struct ssf_client_sem *sem)
 }
 
 #if CONFIG_SSF_CLIENT_SYS_INIT
+
+#ifdef CONFIG_IPC_SERVICE_REG_BACKEND_PRIORITY
+BUILD_ASSERT(CONFIG_SSF_CLIENT_SYS_INIT_PRIORITY > CONFIG_IPC_SERVICE_REG_BACKEND_PRIORITY,
+	     "SSF_CLIENT_SYS_INIT_PRIORITY must be higher than IPC_SERVICE_REG_BACKEND_PRIORITY");
+#endif
+
+#ifdef CONFIG_NRF_802154_SER_RADIO_INIT_PRIO
+BUILD_ASSERT(CONFIG_SSF_CLIENT_SYS_INIT_PRIORITY < CONFIG_NRF_802154_SER_RADIO_INIT_PRIO,
+	     "SSF_CLIENT_SYS_INIT_PRIORITY must be lower than NRF_802154_SER_RADIO_INIT_PRIO");
+#endif
+
+BUILD_ASSERT(
+	CONFIG_SSF_CLIENT_SYS_INIT_PRIORITY > CONFIG_KERNEL_INIT_PRIORITY_DEFAULT,
+	"SSF_CLIENT_SYS_INIT_PRIORITY must be higher than the IPC ICMSG initialization priority");
+
 static int client_init(void)
 {
 	return ssf_client_init();
 }
 
-SYS_INIT(client_init, POST_KERNEL, CONFIG_APPLICATION_INIT_PRIORITY);
+SYS_INIT(client_init, POST_KERNEL, CONFIG_SSF_CLIENT_SYS_INIT_PRIORITY);
 #endif

subsys/sdfw_services/transport/nrf_rpc/ssf_client_nrf_rpc.c

@@ -44,12 +44,6 @@ static void ssf_notification_handler(const struct nrf_rpc_group *group, const ui
 NRF_RPC_EVT_DECODER(ssf_group, ssf_notif_decoder, CONFIG_SSF_NRF_RPC_NOTIF_ID,
 		    ssf_notification_handler, NULL);
 
-static void err_handler(const struct nrf_rpc_err_report *report)
-{
-	SSF_CLIENT_LOG_ERR("nRF RPC error %d ocurred. See nRF RPC logs for more details.",
-			   report->code);
-}
-
 int ssf_client_transport_init(ssf_client_transport_notif_handler handler)
 {
 	int err;
@@ -61,8 +55,12 @@ int ssf_client_transport_init(ssf_client_transport_notif_handler handler)
 
 	transport_initialized = false;
 
-	err = nrf_rpc_init(err_handler);
-	if (err != 0) {
+	/* We ignore the nrf_rpc_init on purpose here, the nrf_rpc_init
+	 * will try to initialize all the transports/groups, but we only
+	 * want to check that the ssf_group is initialized.
+	 */
+	err = nrf_rpc_init_group(&ssf_group);
+	if (err < 0) {
 		return -SSF_EINVAL;
 	}
 

west.yml

@@ -144,7 +144,7 @@ manifest:
     - name: nrfxlib
       repo-path: sdk-nrfxlib
       path: nrfxlib
-      revision: 2251371286d4aeeb35cdd87531cc14162158b014
+      revision: pull/1593/head
     - name: trusted-firmware-m
       repo-path: sdk-trusted-firmware-m
       path: modules/tee/tf-m/trusted-firmware-m