nrf_security: cracen: make IKG seed KMU slot configurable #17381

tomi-font · 2024-09-18T13:50:35Z

And set it to 183 by default.

In addition improve some names, replace magic numbers and remove duplicate definitions of values.

NordicBuilder · 2024-09-18T13:54:35Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 12

Inputs:

Sources:

sdk-nrf: PR head: b1871c4e1363f25bfced8971a2a3763627e44ebf

more details

sdk-nrf:

PR head: b1871c4e1363f25bfced8971a2a3763627e44ebf
merge base: cfb2a11d013959f2fa68a1dc9460a1cf1c6fda82
target head (main): e8d2e38f24ea200e3b52424355b80371340a39a0
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (12)

doc
│  ├── nrf
│  │  ├── releases_and_maturity
│  │  │  ├── migration
│  │  │  │  │ migration_guide_2.8.rst
│  │  │  ├── releases
│  │  │  │  │ release-notes-changelog.rst
lib
│  ├── hw_unique_key
│  │  │ hw_unique_key_cracen.c
subsys
│  ├── nrf_security
│  │  ├── src
│  │  │  ├── drivers
│  │  │  │  ├── cracen
│  │  │  │  │  ├── Kconfig
│  │  │  │  │  ├── common
│  │  │  │  │  │  ├── include
│  │  │  │  │  │  │  ├── cracen
│  │  │  │  │  │  │  │  │ lib_kmu.h
│  │  │  │  │  ├── cracenpsa
│  │  │  │  │  │  ├── include
│  │  │  │  │  │  │  │ cracen_psa_kmu.h
│  │  │  │  │  │  ├── src
│  │  │  │  │  │  │  ├── common.c
│  │  │  │  │  │  │  ├── cracen.c
│  │  │  │  │  │  │  ├── kmu.c
│  │  │  │  │  │  │  ├── kmu.h
│  │  │  │  │  │  │  │ lib_kmu.c
│  │  │  │  │  ├── silexpk
│  │  │  │  │  │  ├── target
│  │  │  │  │  │  │  ├── baremetal_ba414e_with_ik
│  │  │  │  │  │  │  │  │ pk_baremetal.c

Outputs:

Toolchain

Version: 2aae60c2f9
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:2aae60c2f9_81ed5a52d6

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister - Skipped: Skipping Build & Test as it succeeded in a previous run: 9
✅ Integration tests
- ✅ test-fw-nrfconnect-chip - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf_crypto - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-tfm - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-find-my - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-sidewalk
- ✅ test-sdk-dfu - Skipped: Job was skipped as it succeeded in a previous run

Disabled integration tests

- desktop52_verification
- doc-internal
- test_ble_nrf_config
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-boot
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_cloud
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_mosh
- test-fw-nrfconnect-nrf-iot_nrf_provisioning
- test-fw-nrfconnect-nrf-iot_positioning
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_serial_lte_modem
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-proprietary_esb
- test-fw-nrfconnect-ps
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-rs
- test-fw-nrfconnect-thread
- test-fw-nrfconnect-zigbee
- test-low-level
- test-sdk-audio
- test-sdk-mcuboot
- test-sdk-pmic-samples
- test-sdk-wifi

Note: This message is automatically posted and updated by the CI

NordicBuilder · 2024-09-18T14:26:10Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publishing GitHub Action.

mia-ko · 2024-09-19T12:07:12Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/include/cracen_psa_kmu.h

-#define CRACEN_KMU_KEY_USAGE_SCHEME_RAW	      3
+enum kmu_metadata_key_usage_scheme {
+	/**
+	 * These keys can only be pushed to Cracen's protected RAM.


Suggested change

* These keys can only be pushed to Cracen's protected RAM.

* These keys can only be pushed to CRACEN's protected RAM.

mia-ko · 2024-09-19T12:09:00Z

subsys/nrf_security/src/drivers/cracen/Kconfig

+	  the one defined here plus the two following it.
+	  This defines the KMU slots location
+	  - to which the IKG seed is provisioned, and
+	  - that are pushed when loading the IKG seed.


that is pushed?

3 KMU slots are provisioned/pushed for the IKG seed. I rephrased the sentence.

mia-ko · 2024-09-19T12:15:06Z

subsys/nrf_security/src/drivers/cracen/Kconfig

+	range 0 183
+	default 183
+	help
+	  The Cracen IKG seed spans over 3 KMU slots:


Suggested change

The Cracen IKG seed spans over 3 KMU slots:

The CRACEN IKG seed spans over 3 KMU slots:

doc/nrf/releases_and_maturity/migration/migration_guide_2.8.rst

mia-ko · 2024-09-19T12:21:05Z

doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst

@@ -97,7 +97,7 @@ Developing with PMICs
 Security
 ========

-|no_changes_yet_note|
+* The :kconfig:option:`CONFIG_CRACEN_IKG_SEED_KMU_SLOT` Kconfig option was added to allow customization of the KMU slot used to store CRACEN's IKG SEED.


Suggested change

* The :kconfig:option:`CONFIG_CRACEN_IKG_SEED_KMU_SLOT` Kconfig option was added to allow customization of the KMU slot used to store CRACEN's IKG SEED.

* The :kconfig:option:`CONFIG_CRACEN_IKG_SEED_KMU_SLOT` Kconfig option was added to allow customization of the KMU slot used to store CRACEN's Isolated Key Generator (IKG) seed.

mia-ko · 2024-09-19T12:29:58Z

subsys/nrf_security/src/drivers/cracen/Kconfig

+	  - to which the IKG seed is provisioned, and
+	  - that are pushed when loading the IKG seed.


Not sure if this renders as bullet points or just as continued text

And set it to 183 by default. In addition improve some names, replace magic numbers and remove duplicate definitions of values. Signed-off-by: Tomi Fontanilles <[email protected]>

Changed from 64 to 128 bits. Signed-off-by: Tomi Fontanilles <[email protected]>

mia-ko · 2024-09-24T06:00:38Z

doc/nrf/releases_and_maturity/migration/migration_guide_2.8.rst

-To send logs over RTT instead of UART, apply the following settings:
+.. toggle::
+
+   Custom printing has been dropped in favor of using the logging subsystem, with output printed out to the default logging device.


Suggested change

Custom printing has been dropped in favor of using the logging subsystem, with output printed out to the default logging device.

Custom printing is replaced by the logging subsystem, with output printed out to the default logging device.

This is not something I wrote. All I did here was add the toggle...

This was reviewed and approved by Anna in #17079

mia-ko · 2024-09-24T06:11:47Z

doc/nrf/releases_and_maturity/migration/migration_guide_2.8.rst

+       * Enable the :kconfig:option:`CONFIG_USE_SEGGER_RTT` and :kconfig:option:`CONFIG_RTT_CONSOLE` Kconfig options.
+       * Disable the :kconfig:option:`CONFIG_UART_CONSOLE` and :kconfig:option:`CONFIG_SERIAL` Kconfig options.


Is there a reason why these two got indented?

Yes. I put everything in here under a toggle, so everything needs to be indented one level more.

mia-ko · 2024-09-24T06:19:29Z

subsys/nrf_security/src/drivers/cracen/Kconfig

+	default 183
+	help
+	  The Cracen IKG seed spans over 3 KMU slots:
+	  the one defined here plus the two following it.


Would it be better to say "and the two subsequent ones" instead?

Fine to me.

tomi-font · 2024-09-25T09:38:45Z

ping for reviewers

Vge0rge · 2024-09-25T13:27:56Z

subsys/nrf_security/src/drivers/cracen/cracenpsa/include/cracen_psa_kmu.h

+	 */
+	KMU_METADATA_SCHEME_PROTECTED,
+	/**
+	 * These keys use 3 key slots. Pushed to the seed register.


These are not exactly keys though, we can maybe rename it to seed material/data or something?

This is only something I copy-pasted from subsys/nrf_security/src/drivers/cracen/cracenpsa/src/kmu.h to be able to get rid of duplicate macros that were here. But true, so I'll change the naming.

subsys/nrf_security/src/drivers/cracen/cracenpsa/src/lib_kmu.c

So that everything is as it should be. Signed-off-by: Tomi Fontanilles <[email protected]>

Vge0rge · 2024-09-26T08:14:11Z

subsys/nrf_security/src/drivers/cracen/common/include/cracen/lib_kmu.h

@@ -64,9 +64,9 @@ struct kmu_src_t {
 	/** Revocation policy. */
 	uint32_t rpolicy;
 	/** 32-bit destination address. Cannot point to SICR and must be on a
-	 * 64-bit boundary.
+	 * 128-bit boundary.


I guess here we can say that is 64 bit boundary for the pdk and 128 for the dk, right?

I expect the alignment requirement to be 128 bits starting from now, so that's why I only mentioned that. And anyway support for PDK will be removed soon.

tomi-font requested review from frkv and Vge0rge as code owners September 18, 2024 13:50

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Sep 18, 2024

tomi-font force-pushed the security_cracen_IKG_seed_slot branch 2 times, most recently from 0b14d76 to 3ae08db Compare September 18, 2024 14:02

tomi-font force-pushed the security_cracen_IKG_seed_slot branch from 3ae08db to 3473ab5 Compare September 19, 2024 09:12

tomi-font requested a review from carlescufi as a code owner September 19, 2024 09:12

github-actions bot added doc-required PR must not be merged without tech writer approval. and removed changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Sep 19, 2024

tomi-font requested a review from mia-ko September 19, 2024 09:13

tomi-font force-pushed the security_cracen_IKG_seed_slot branch from 3473ab5 to 5f947aa Compare September 19, 2024 10:19

mia-ko requested changes Sep 19, 2024

View reviewed changes

tomi-font added 2 commits September 23, 2024 12:43

nrf_security: cracen: make IKG seed KMU slot configurable

a7f799b

And set it to 183 by default. In addition improve some names, replace magic numbers and remove duplicate definitions of values. Signed-off-by: Tomi Fontanilles <[email protected]>

nrf_security: cracen: lib_kmu: update KMU slot alignment requirement

9102e5e

Changed from 64 to 128 bits. Signed-off-by: Tomi Fontanilles <[email protected]>

tomi-font force-pushed the security_cracen_IKG_seed_slot branch from 5f947aa to 6521c40 Compare September 23, 2024 12:04

tomi-font requested review from a team as code owners September 23, 2024 12:04

tomi-font requested a review from mia-ko September 23, 2024 12:05

mia-ko requested changes Sep 24, 2024

View reviewed changes

tomi-font force-pushed the security_cracen_IKG_seed_slot branch from 6521c40 to 62dbff1 Compare September 24, 2024 06:32

tomi-font requested a review from mia-ko September 24, 2024 06:32

mia-ko approved these changes Sep 24, 2024

View reviewed changes

Vge0rge reviewed Sep 25, 2024

View reviewed changes

doc: migration guide: add missing toggles

b1871c4

So that everything is as it should be. Signed-off-by: Tomi Fontanilles <[email protected]>

tomi-font force-pushed the security_cracen_IKG_seed_slot branch from 62dbff1 to b1871c4 Compare September 26, 2024 06:52

tomi-font requested a review from a team as a code owner September 26, 2024 06:52

tomi-font requested a review from Vge0rge September 26, 2024 06:52

Vge0rge reviewed Sep 26, 2024

View reviewed changes

tomi-font requested review from Vge0rge and removed request for Vge0rge September 27, 2024 13:08

Vge0rge approved these changes Sep 30, 2024

View reviewed changes

nordicjm approved these changes Sep 30, 2024

View reviewed changes

rlubos merged commit 3a50c5e into nrfconnect:main Oct 4, 2024
13 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nrf_security: cracen: make IKG seed KMU slot configurable #17381

nrf_security: cracen: make IKG seed KMU slot configurable #17381

tomi-font commented Sep 18, 2024

NordicBuilder commented Sep 18, 2024 •

edited

Loading

NordicBuilder commented Sep 18, 2024

mia-ko Sep 19, 2024

mia-ko Sep 19, 2024

tomi-font Sep 23, 2024

mia-ko Sep 19, 2024

mia-ko Sep 19, 2024

mia-ko Sep 19, 2024

mia-ko Sep 24, 2024

tomi-font Sep 24, 2024

nordicjm Sep 30, 2024

mia-ko Sep 24, 2024

tomi-font Sep 24, 2024

mia-ko Sep 24, 2024

tomi-font Sep 24, 2024

tomi-font commented Sep 25, 2024

Vge0rge Sep 25, 2024

tomi-font Sep 26, 2024

Vge0rge Sep 26, 2024

tomi-font Sep 26, 2024

	* These keys can only be pushed to Cracen's protected RAM.
	* These keys can only be pushed to CRACEN's protected RAM.

	The Cracen IKG seed spans over 3 KMU slots:
	The CRACEN IKG seed spans over 3 KMU slots:

	* The :kconfig:option:`CONFIG_CRACEN_IKG_SEED_KMU_SLOT` Kconfig option was added to allow customization of the KMU slot used to store CRACEN's IKG SEED.
	* The :kconfig:option:`CONFIG_CRACEN_IKG_SEED_KMU_SLOT` Kconfig option was added to allow customization of the KMU slot used to store CRACEN's Isolated Key Generator (IKG) seed.

		- to which the IKG seed is provisioned, and
		- that are pushed when loading the IKG seed.

	Custom printing has been dropped in favor of using the logging subsystem, with output printed out to the default logging device.
	Custom printing is replaced by the logging subsystem, with output printed out to the default logging device.

		* Enable the :kconfig:option:`CONFIG_USE_SEGGER_RTT` and :kconfig:option:`CONFIG_RTT_CONSOLE` Kconfig options.
		* Disable the :kconfig:option:`CONFIG_UART_CONSOLE` and :kconfig:option:`CONFIG_SERIAL` Kconfig options.

nrf_security: cracen: make IKG seed KMU slot configurable #17381

nrf_security: cracen: make IKG seed KMU slot configurable #17381

Conversation

tomi-font commented Sep 18, 2024

NordicBuilder commented Sep 18, 2024 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

NordicBuilder commented Sep 18, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tomi-font commented Sep 25, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

NordicBuilder commented Sep 18, 2024 •

edited

Loading