Skip to content

nrf_ironside: Move Ironside outside of nrf_security #24862

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+56 −8
Open

nrf_ironside: Move Ironside outside of nrf_security #24862

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
daa9b94
nrf_ironside: Move Ironside outside of nrf_security
Vge0rge Oct 3, 2025
0772bf6
trusted_storage: Forbid usage with NRF_IRONSIDE_CALL
Vge0rge Oct 2, 2025
22b31d2
manifest: Bring Zephyr with PSA RNG for nRF54h20
Vge0rge Oct 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -824,6 +824,7 @@
/subsys/nrf_profiler/ @nrfconnect/ncs-si-bluebagel
/subsys/nrf_rpc/ @nrfconnect/ncs-si-muffin @nrfconnect/ncs-protocols-serialization
/subsys/nrf_security/ @nrfconnect/ncs-aegir
/subsys/nrf_ironside/ @nrfconnect/ncs-aurora
/subsys/partition_manager/ @nordicjm @tejlmand
/subsys/pcd/ @nrfconnect/ncs-pluto
/subsys/secure_storage/ @nrfconnect/ncs-aegir
Expand Down
1 change: 1 addition & 0 deletions subsys/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ add_subdirectory_ifdef(CONFIG_SECURE_BOOT_VALIDATION bootloader/bl_validation)
add_subdirectory_ifdef(CONFIG_SECURE_BOOT_STORAGE bootloader/bl_storage)

add_subdirectory_ifdef(CONFIG_NRF_SECURITY nrf_security)
add_subdirectory_ifdef(CONFIG_NRF_IRONSIDE nrf_ironside)
add_subdirectory_ifdef(CONFIG_TRUSTED_STORAGE trusted_storage)
add_subdirectory_ifdef(CONFIG_SECURE_STORAGE secure_storage)

Expand Down
1 change: 1 addition & 0 deletions subsys/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,4 +41,5 @@ rsource "dult/Kconfig"
rsource "nrf_compress/Kconfig"
rsource "mcuboot_ids/Kconfig"
rsource "settings/Kconfig"
rsource "nrf_ironside/Kconfig"
endmenu
21 changes: 20 additions & 1 deletion ...rf_security/src/ssf_secdom/CMakeLists.txt → subsys/nrf_ironside/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

if(CONFIG_PSA_SSF_CRYPTO_CLIENT)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

and missing indent

zephyr_library()
zephyr_library_sources(
# ironside_psa_ns_api.c provides psa_call, which sends a message over IPC.
Expand All @@ -16,13 +18,30 @@ zephyr_library_sources(
)

zephyr_library_include_directories(
.
${NRF_DIR}/include/tfm
${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}/interface/include
.
# Oberon PSA headers
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/include
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/library
)

if(CONFIG_PSA_SSF_CRYPTO_CLIENT_OUT_BOUNCE_BUFFERS)
zephyr_library_sources(
${CMAKE_CURRENT_LIST_DIR}/bounce_buffers.c
)
endif()

zephyr_include_directories(
.
${NRF_DIR}/include/tfm
${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}/interface/include
# Oberon PSA headers
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/include
${ZEPHYR_OBERON_PSA_CRYPTO_MODULE_DIR}/library
)

zephyr_compile_definitions(MBEDTLS_PSA_CRYPTO_CONFIG_FILE="ironside_config.h")
zephyr_compile_definitions(MBEDTLS_CONFIG_FILE="ironside_config.h")
Comment on lines +44 to +45
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isn't this a Kconfig?


Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

endif()
8 changes: 7 additions & 1 deletion subsys/nrf_security/src/ssf_secdom/Kconfig → subsys/nrf_ironside/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,17 @@ config PSA_SSF_CRYPTO_CLIENT
bool
prompt "PSA crypto provided through SSF"
default y
depends on SOC_NRF54H20 || SOC_SERIES_NRF92X
depends on SOC_NRF54H20_CPUAPP || SOC_NRF54H20_CPURAD || SOC_SERIES_NRF92X
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Presumably 92X should also be split up into CPUAPP and CPUCELL?

@ayla-nordicsemi ?

select NRF_IRONSIDE_CALL
select PSA_CRYPTO_CLIENT
select PSA_CRYPTO

if PSA_SSF_CRYPTO_CLIENT

choice PSA_CRYPTO_PROVIDER
default PSA_CRYPTO_PROVIDER_CUSTOM
endchoice

config PSA_SSF_CRYPTO_CLIENT_OUT_BOUNCE_BUFFERS
bool "Support PSA crypto with output buffers that are not cache-safe"
default y
Expand Down
0 ..._security/src/ssf_secdom/bounce_buffers.c → subsys/nrf_ironside/bounce_buffers.c
View file
Open in desktop
File renamed without changes.
0 ..._security/src/ssf_secdom/bounce_buffers.h → subsys/nrf_ironside/bounce_buffers.h
View file
Open in desktop
File renamed without changes.
7 changes: 7 additions & 0 deletions subsys/nrf_ironside/ironside_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
/*
* Copyright (c) 2025 Nordic Semiconductor ASA
*
* SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
*/

#define MBEDTLS_PSA_CRYPTO_CLIENT
0 ...y/src/ssf_secdom/ironside_se_psa_ns_api.c → subsys/nrf_ironside/ironside_se_psa_ns_api.c
View file
Open in desktop
File renamed without changes.
16 changes: 16 additions & 0 deletions subsys/nrf_ironside/psa/crypto_driver_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2025 Nordic Semiconductor ASA
*
* SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
*/

#ifndef PSA_CRYPTO_DRIVER_CONFIG_H
#define PSA_CRYPTO_DRIVER_CONFIG_H

#if defined(MBEDTLS_PSA_CRYPTO_CONFIG_FILE)
#include MBEDTLS_PSA_CRYPTO_CONFIG_FILE
#else
#include "psa/crypto_config.h"
#endif

#endif /* PSA_CRYPTO_DRIVER_CONFIG_H */
0 ...ecurity/src/ssf_secdom/psa_manifest/sid.h → subsys/nrf_ironside/psa_manifest/sid.h
View file
Open in desktop
File renamed without changes.
1 change: 1 addition & 0 deletions subsys/nrf_security/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ config NRF_SECURITY
bool
prompt "nRF Security" if !PSA_PROMPTLESS
depends on SOC_FAMILY_NORDIC_NRF
depends on !NRF_IRONSIDE_CALL
Copy link
Contributor

@karstenkoenig karstenkoenig Oct 3, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will this break if someone wants to use some software crypto on nrf54h20? You aren't really incompatible with NRF_IRONSIDE_CALL I'd say

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

software crypto on nrf54h20 is not supported. So if it does break, then that is intended behaviour :)

Copy link
Contributor Author

@Vge0rge Vge0rge Oct 3, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If they want to use it along with the hardware crypto yes. But it should break because at the moment no-one worked on this use case. If it worked by accident before it is better to break so that someone can think how to properly support this use case.

Edit: Sebastians comment didn't show up before I sent this. But we are saying the exact same thing basically :)

default y if BUILD_WITH_TFM
# entropy is provided by PSA and NRF_SECURITY on NRF54LX and NRF71X
default y if DT_HAS_ZEPHYR_PSA_CRYPTO_RNG_ENABLED && SOC_SERIES_NRF54LX && !IS_BOOTLOADER_IMG && GEN_ISR_TABLES
Expand Down
1 change: 0 additions & 1 deletion subsys/nrf_security/Kconfig.psa
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@ osource "modules/mbedtls/Kconfig.psa"

rsource "src/core/Kconfig"

rsource "src/ssf_secdom/Kconfig"

comment "PSA Driver Support"

Expand Down
4 changes: 0 additions & 4 deletions subsys/nrf_security/src/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,10 +104,6 @@ target_link_libraries(${mbedcrypto_target}
psa_interface
)

if(CONFIG_PSA_SSF_CRYPTO_CLIENT)
add_subdirectory(ssf_secdom)
endif()

nrf_security_add_zephyr_options(${mbedcrypto_target})

# Base mbed TLS files (not in drivers or builtin's)
Expand Down
1 change: 1 addition & 0 deletions subsys/trusted_storage/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
menuconfig TRUSTED_STORAGE
bool "Trusted Storage"
depends on !BUILD_WITH_TFM
depends on !NRF_IRONSIDE_CALL
help
The secure storage subsystem allows its users to store data in a
secure way, ensuring data integrity and confidentiality by using AEAD
Expand Down
2 changes: 1 addition & 1 deletion west.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ manifest:
# https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/zephyr/guides/modules.html
- name: zephyr
repo-path: sdk-zephyr
revision: 05b8b21aa9779fb1cb19ad59e7443ebec460aeee
revision: pull/3346/head
import:
# In addition to the zephyr repository itself, NCS also
# imports the contents of zephyr/west.yml at the above
Expand Down