nrf_security: CRACEN: Update hw version configs for ns #25719

degjorva · 2025-11-21T12:12:53Z

Update HW versions to use PSA_NEED configs.
This is to allow the configs to be used in secure when building with TF-m.

Copilot

Pull Request Overview

This PR updates CRACEN hardware version configuration naming from CRACEN_HW_VERSION_* to PSA_NEED_CRACEN_HW_VERSION_* to enable compatibility with TF-m secure builds using PSA_NEED configs.

Renames Kconfig symbols from CRACEN_HW_VERSION_BASE and CRACEN_HW_VERSION_LITE to use PSA_NEED_ prefix
Adds corresponding cmakedefine entries in psa_crypto_config.h.template
Updates cmake configuration to process the new config names

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
subsys/nrf_security/src/drivers/cracen/Kconfig	Renames HW version config symbols to use PSA_NEED prefix and reorders CRACEN_KMU_HW_PRESENT definition
subsys/nrf_security/configs/psa_crypto_config.h.template	Adds cmakedefine entries for the new PSA_NEED_CRACEN_CRACEN_HW_VERSION_* symbols
subsys/nrf_security/cmake/psa_crypto_config.cmake	Adds kconfig_check_and_set_base_to_one calls for the new config symbols

Comments suppressed due to low confidence (1)

subsys/nrf_security/src/drivers/cracen/Kconfig:47

This line references the old config name CRACEN_HW_VERSION_BASE which has been renamed to PSA_NEED_CRACEN_HW_VERSION_BASE in line 13 of this file. This dependency should be updated to depends on PSA_NEED_CRACEN_HW_VERSION_BASE to match the new config name.

	depends on CRACEN_HW_VERSION_BASE

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

NordicBuilder · 2025-11-21T12:15:13Z

CI Information

^{To view the history of this post, click the 'edited' button above}
Build number: 9

Inputs:

Sources:

sdk-nrf: PR head: b3f275857426c52cdbde2bb0ef18c036779ec49a

more details

sdk-nrf:

PR head: b3f275857426c52cdbde2bb0ef18c036779ec49a
merge base: 1e554017358fb437cdf2b16962dfb2646b526956
target head (main): e325e5cc710e393c4ce1ac3dda5c1652a756e3ee
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (8)

subsys
│  ├── nrf_security
│  │  ├── cmake
│  │  │  │ psa_crypto_config.cmake
│  │  ├── configs
│  │  │  │ psa_crypto_config.h.template
│  │  ├── src
│  │  │  ├── drivers
│  │  │  │  ├── cracen
│  │  │  │  │  ├── Kconfig
│  │  │  │  │  ├── cracenpsa
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  │ ctr_drbg.c
│  │  │  │  │  ├── psa_driver.Kconfig
│  │  │  │  │  ├── silexpk
│  │  │  │  │  │  ├── target
│  │  │  │  │  │  │  ├── baremetal_ba414e_with_ik
│  │  │  │  │  │  │  │  │ pk_baremetal.c
│  │  │  │  │  │  │  ├── hw
│  │  │  │  │  │  │  │  ├── ik
│  │  │  │  │  │  │  │  │  │ ikhardware.c
│  │  │  │  │  ├── sxsymcrypt
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  │ trng.c

Outputs:

Toolchain

Version: 964ddb2c70
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:964ddb2c70_5ea73affbf

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister
- sdk-nrf test count: 2563
✅ Integration tests
- ✅ test_ble_nrf_config
- ✅ test-fw-nrfconnect-chip
- ✅ test-fw-nrfconnect-nrf_crypto
- ✅ test-fw-nrfconnect-rs
- ✅ test-fw-nrfconnect-tfm
- ✅ test-sdk-find-my
- ✅ test-sdk-mcuboot
- ✅ test-sdk-dfu
- ⚠️ test-fw-nrfconnect-nrf-iot_cloud

Disabled integration tests

- test-fw-nrfconnect-nrf_lrcs_positioning
- desktop52_verification
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-ps-main
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-thread-main
- test-low-level
- test-sdk-audio
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

github-actions · 2025-11-21T12:52:16Z

You can find the documentation preview for this PR here.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-21T14:47:13Z

subsys/nrf_security/src/drivers/cracen/silexpk/target/baremetal_ba414e_with_ik/pk_baremetal.c

@@ -52,7 +52,7 @@ module with entropy will fail"
 #define PK_BUSY_MASK_BA414EP 0x00010000
 #define PK_BUSY_MASK_IK	     0x00050000

-#define IK_ENTROPY_ERROR     0xc6
+#define IK_ENTROPY_ERROR 0xc6


[nitpick] This whitespace change appears unrelated to the config renaming and introduces inconsistent spacing. Lines 52-53 use multiple spaces to align the hex values, but this change reduces the spacing for line 55. Consider either keeping the original spacing or aligning all three defines consistently.

magnev · 2025-11-24T08:15:56Z

subsys/nrf_security/src/drivers/cracen/silexpk/target/hw/ik/ikhardware.c

@@ -51,7 +51,7 @@ int sx_pk_list_ik_inslots(sx_pk_req *req, unsigned int key, struct sx_pk_slot *i
 	const struct sx_pk_capabilities *caps;

 	if (req->cmd->cmdcode == PK_OP_IK_EXIT) {
-#ifdef CONFIG_CRACEN_HW_VERSION_LITE


Compilation of this file fails for 54LM20 and 54LV10 since the ifdef at line 21 does not include the header-file.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

subsys/nrf_security/configs/psa_crypto_config.h.template

subsys/nrf_security/cmake/psa_crypto_config.cmake

subsys/nrf_security/configs/psa_crypto_config.h.template

subsys/nrf_security/src/drivers/cracen/Kconfig

Update HW versions to use PSA_ configs. This is to allow the configs to be used in secure when building with TF-m. This fixes some issues with settings not being correct for some versions of CRACEN. Signed-off-by: Dag Erik Gjørvad <[email protected]>

tomi-font

Don't you mean to use PSA_CRACEN_HW_VERSION_* and not CONFIG_PSA_CRACEN_HW_VERSION_* in the source files?

tomi-font · 2025-11-28T11:48:50Z

subsys/nrf_security/configs/psa_crypto_config.h.template

+#cmakedefine PSA_CRACEN_HW_VERSION_BASE             @PSA_CRACEN_HW_VERSION_BASE@
+#cmakedefine PSA_CRACEN_HW_VERSION_LITE             @PSA_CRACEN_HW_VERSION_LITE@


alignment is off

Copilot AI review requested due to automatic review settings November 21, 2025 12:12

NordicBuilder added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Nov 21, 2025

Copilot started reviewing on behalf of degjorva November 21, 2025 12:13 View session

Copilot finished reviewing on behalf of degjorva November 21, 2025 12:14

Copilot AI reviewed Nov 21, 2025

View reviewed changes

degjorva force-pushed the ikg-ns-fix branch from e8151fc to 05c1f18 Compare November 21, 2025 14:38

Copilot AI review requested due to automatic review settings November 21, 2025 14:44

degjorva force-pushed the ikg-ns-fix branch from 05c1f18 to 41c9620 Compare November 21, 2025 14:44

Copilot started reviewing on behalf of degjorva November 21, 2025 14:45 View session

Copilot finished reviewing on behalf of degjorva November 21, 2025 14:46

Copilot AI reviewed Nov 21, 2025

View reviewed changes

magnev reviewed Nov 24, 2025

View reviewed changes

degjorva force-pushed the ikg-ns-fix branch from 41c9620 to ba49070 Compare November 24, 2025 09:39

Copilot AI review requested due to automatic review settings November 24, 2025 11:22

degjorva force-pushed the ikg-ns-fix branch from ba49070 to 84cd06b Compare November 24, 2025 11:22

Copilot started reviewing on behalf of degjorva November 24, 2025 11:23 View session

Copilot finished reviewing on behalf of degjorva November 24, 2025 11:24

Copilot AI reviewed Nov 24, 2025

View reviewed changes

degjorva force-pushed the ikg-ns-fix branch from 84cd06b to 09d0e02 Compare November 26, 2025 08:39

degjorva marked this pull request as ready for review November 26, 2025 15:11

degjorva requested a review from a team as a code owner November 26, 2025 15:11

Copilot AI review requested due to automatic review settings November 26, 2025 15:11

degjorva requested a review from a team as a code owner November 26, 2025 15:11

Copilot started reviewing on behalf of degjorva November 26, 2025 15:11 View session

Copilot finished reviewing on behalf of degjorva November 26, 2025 15:13

Copilot AI reviewed Nov 26, 2025

View reviewed changes

tomi-font reviewed Nov 27, 2025

View reviewed changes

subsys/nrf_security/src/drivers/cracen/Kconfig Outdated Show resolved Hide resolved

degjorva force-pushed the ikg-ns-fix branch from 09d0e02 to b3f2758 Compare November 27, 2025 12:08

degjorva added bugfix Fixes a known bug and removed changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Nov 27, 2025

tomi-font reviewed Nov 28, 2025

View reviewed changes

		#cmakedefine PSA_CRACEN_HW_VERSION_BASE @PSA_CRACEN_HW_VERSION_BASE@
		#cmakedefine PSA_CRACEN_HW_VERSION_LITE @PSA_CRACEN_HW_VERSION_LITE@

nrf_security: CRACEN: Update hw version configs for ns #25719

Are you sure you want to change the base?

nrf_security: CRACEN: Update hw version configs for ns #25719

Uh oh!

Conversation

degjorva commented Nov 21, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

NordicBuilder commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Uh oh!

github-actions bot commented Nov 21, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

magnev Nov 24, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tomi-font left a comment

Choose a reason for hiding this comment

Uh oh!

tomi-font Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

NordicBuilder commented Nov 21, 2025 •

edited

Loading