Skip to content

[nrf fromtree] platform: nordic_nrf: Add support for NRFX KMU driver#242

Open
AntonZma wants to merge 239 commits into
nrfconnect:mainfrom
AntonZma:nrfx-kmu-driver-support
Open

[nrf fromtree] platform: nordic_nrf: Add support for NRFX KMU driver#242
AntonZma wants to merge 239 commits into
nrfconnect:mainfrom
AntonZma:nrfx-kmu-driver-support

Conversation

@AntonZma
Copy link
Copy Markdown
Contributor

@AntonZma AntonZma commented Mar 25, 2026

Added support for NRFX KMU driver for Nordic targets to exchange LIB_KMU.

manifest-pr-skip

…al_adi

Add support for Analog Devices MAX32657 platform and fetch
ADI HAL library.

Co-authored-by: Hao Zhang <Hao.Zhang@analog.com>
Co-authored-by: Sadik Ozer <sadik.ozer@analog.com>
Change-Id: If884aa9a35664f6117574b0d4cde363a19e4eca5
Signed-off-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
(cherry picked from commit 54a8a58)
To enable BL2 for MAX32657, this commit
- Enables BL2
- Updates CMakeFile
- Adds gcc linker file,  common/gcc/tfm_bl2_common.ld copied as
  max32657_sla.ld
- Adds system file

Co-authored-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
Co-authored-by: Hao Zhang <Hao.Zhang@analog.com>
Co-authored-by: Tanmaya Mishra <Tanmaya.Mishra@analog.com>
Change-Id: Ifd0379aadd74df8006fad062397c093cab27c560
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit d3036b5)
Update CMakeFile for tf-m integration
Enable tf-m flags in config file

Co-authored-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
Co-authored-by: Hao Zhang <Hao.Zhang@analog.com>
Co-authored-by: Tanmaya Mishra <Tanmaya.Mishra@analog.com>
Change-Id: I67484cdd9c4b8d3c94873a2d1fc8e69ef7eb1d08
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit aa15c18)
Add PPC driver for MAX32657, it is a shim driver that
filled with hal_adi call functions

Co-authored-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
Co-authored-by: Hao Zhang <Hao.Zhang@analog.com>
Co-authored-by: Tanmaya Mishra <Tanmaya.Mishra@analog.com>
Change-Id: I1f16c64263846321f1f156b744af5ac25d0e6d12
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 3599278)
Define secure, non-secure memory and required peripheral address

Co-authored-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
Co-authored-by: Hao Zhang <Hao.Zhang@analog.com>
Co-authored-by: Tanmaya Mishra <Tanmaya.Mishra@analog.com>
Change-Id: I5b6c0335d6e34c55a7a671008848e94cb851b6fb
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 609ef3f)
Set image region for fw and other section, flash devided as below

/* Flash layout on MAX32657 with BL2 (multiple image boot):
 *
 * Secure flash address which 28th bit 1 is logical address
 *
 * 0X0100_0000 BL2 - MCUBoot (64KB)
 * 0x0101_0000 Secure image     primary slot (320KB)
 * 0x0106_0000 Non-secure image primary slot (576KB)
 * 0x010F_0000 Secure image     secondary slot (0KB)
 * 0x010F_0000 Non-secure image secondary slot (0KB)
 * 0x010F_0000 Scratch area (0)
 * 0x010F_0000 Protected Storage Area (0)
 * 0x010F_0000 Internal Trusted Storage Area (16 KB)
 * 0x010F_4000 OTP / NV counters area (16 KB)
 * 0x010F_8000 Unused (32KB)
 *
 * Flash layout on MAX32657 with BL2 (single image boot):
 *
 * 0X0100_0000 BL2 - MCUBoot (64KB)
 * 0x0101_0000 Primary image area (896KB):
 *    0x0101_0000 Secure     image primary
 *    0x0106_0000 Non-secure image primary
 * 0x010F_0000 Secondary image area (0KB):
 *    0x010F_0000 Secure     image secondary
 *    0x010F_0000 Non-secure image secondary
 * 0x010F_0000 Scratch area (0)
 * 0x010F_0000 Protected Storage Area (0)
 * 0x010F_0000 Internal Trusted Storage Area (16 KB)
 * 0x010F_4000 OTP / NV counters area (16 KB)
 * 0x010F_8000 Unused
 *
 * Flash layout on MAX32657, if BL2 not defined:
 *
 * 0X0100_0000 Secure     image (512KB)
 * 0X0108_0000 Non-secure image (512KB)
 */

Co-authored-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
Co-authored-by: Hao Zhang <Hao.Zhang@analog.com>
Co-authored-by: Tanmaya Mishra <Tanmaya.Mishra@analog.com>
Change-Id: I0f7021ed6f06e56b5549bf5edfefc86adb12b604
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 098c6bd)
Set the flag that required by the tf-m project
- BL2
- RAM and Code size
- Shared section size

Co-authored-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
Co-authored-by: Hao Zhang <Hao.Zhang@analog.com>
Co-authored-by: Tanmaya Mishra <Tanmaya.Mishra@analog.com>
Change-Id: Ia3b343d3a3e363dd7b259580d7f1ad284ff29f1d
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 8e0d63a)
Add flash driver for MAX32657, it is a shim driver that
filled with hal_adi call functions

Co-authored-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
Co-authored-by: Hao Zhang <Hao.Zhang@analog.com>
Co-authored-by: Tanmaya Mishra <Tanmaya.Mishra@analog.com>
Change-Id: I2a3691e2bb0946df8bf1f4fa57bb25a3dad4b5f4
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit dd40134)
- Disable PLATFORM_DEFAULT_OTP to implement MAX32657 OTP
- Add read, write, get size functions
- Before writing and after reading OTP cell bits are reverted
due to default values not match with tfm expectation.
On default tfm expect otp cell be 0x00 and bit can be transceived from 0
to 1 but MAX32657 OTP default value is 0xff and bits can be converted
from 1 to 0. So that before write and after read bits are reverted.
- Set  bl2_rotpk_X size as 100 (max value) to get fix otp layout

Change-Id: I325f2934a78633d6add6592dc9fdf1c3dcd852ba
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 258b8fd)
Enable ioctl service to NS app (Zephyr) able to read
- USN
- LDO_TRIM_BB/RF
- DBB_SETTINGS

Co-authored-by: Sadik Ozer <sadik.ozer@analog.com>
Change-Id: Ie3f5bf60cba2b68e255dc602b3c5dc55d570c4df
Signed-off-by: Hao Zhang <Hao.Zhang@analog.com>
(cherry picked from commit 9509e1b)
Use PSA crpyto for MCUBoot, this commit enable this feture

Change-Id: I289f03ac88fea4ca4fbafe8607d4dc5c6e8fe1fb
Signed-off-by: Gowri Ramshankar <Gowri.Ramshankar@analog.com>
(cherry picked from commit 6afbbd8)
Enable the initial attestation partition in the configuration file for
the ADI MAX32657 target.

Boot measurements are needed for initial attestation. Measurements are
part of the shared data between boot and runtime.

The static buffer size used by mbedtls for its allocations has been
increased - to resolve the attestation testcase failure due to
insufficient memory. Note: This configuration could not be changed from
zephyr or within the TF-M platform configurations.
The size might be an issue upstream. The issue has been notified to
the TF-M community.

Increase MBEDTLS static buffer size within platform directory

The static buffer size used by MBEDTLS is increased from within
the platform directory instead of altering the small profile
configuration.

Co-authored-by: Sadik Ozer <sadik.ozer@analog.com>
Change-Id: I3ed73ca6df52bd8d4655b1ca2e5ee09ba223c6e0
Signed-off-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
(cherry picked from commit 9089b67)
Add UART driver for MAX32657, it is a shim driver that
filled with hal_adi call functions

Co-authored-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
Co-authored-by: Hao Zhang <Hao.Zhang@analog.com>
Co-authored-by: Tanmaya Mishra <Tanmaya.Mishra@analog.com>
Change-Id: I651058f11288efdcabbb7a7ae46ea0530dd47ed5
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit d014530)
Add MPC driver for MAX32657, it is referred to arm mpc sie200 driver

Co-authored-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
Co-authored-by: Tanmaya Mishra <Tanmaya.Mishra@analog.com>
Co-authored-by: Sadik Ozer <sadik.ozer@analog.com>
Change-Id: I5834c0414bbcc1eff5c7d249b2d412fc3f8c85bc
Signed-off-by: Hao Zhang <Hao.Zhang@analog.com>
(cherry picked from commit eb55261)
This commit defines secure non-secure peripheral & memory regions

Co-authored-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
Co-authored-by: Hao Zhang <Hao.Zhang@analog.com>
Co-authored-by: Tanmaya Mishra <Tanmaya.Mishra@analog.com>
Change-Id: I26f9fc9d9e7ae4474c62f03ad5a0e40fd3bb0089
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 37abe21)
This commit added NS support to able to execute
zephyr regression tests.

MAX32657 supports small profile for now.
CONFIG_TFM_PROFILE_TYPE_SMALL=y

-- -------- NS TEST Configuration --------------------
-- TEST_NS_ATTESTATION                       OFF
-- TEST_NS_CRYPTO                            ON
-- TEST_NS_ITS                               ON
-- TEST_NS_PS                                OFF
-- TEST_NS_QCBOR                             OFF
-- TEST_NS_T_COSE                            OFF
-- TEST_NS_PLATFORM                          OFF
-- TEST_NS_FWU                               OFF
-- TEST_NS_IPC                               OFF
-- TEST_NS_FLIH_IRQ                          OFF
-- TEST_NS_MULTI_CORE                        OFF
-- TEST_NS_MANAGE_NSID                       OFF
-- TEST_NS_SFN_BACKEND                       ON
-- TEST_NS_FPU                               OFF
-- ---------------------------------------------------

Added UART here to get test output.

To build it, tf-m-tests shall be added in west file:
west config manifest.project-filter -- +tf-m-tests
west update

Change-Id: Ie60b62e83c59cec00f1ad197b3249ee7c7d89205
Signed-off-by: Hao Zhang <Hao.Zhang@analog.com>
(cherry picked from commit 4ae67f6)
Hal platform file requires to get ns entry point, vtor
and code start address. This commit add these features.

Co-authored-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
Co-authored-by: Hao Zhang <Hao.Zhang@analog.com>
Change-Id: Ib45a0562c42730efb91a94b528b2e83bb8596dba
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 8877329)
Enable ICC for MAX32657
ICC cache only accessibly by secure world.

Change-Id: I11b2e25bec3a46bed68b96e1d9a5888fbaf869aa
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit cfdc11b)
Implement hal isolation layer as per of existing implementation
and tfm requirement

Co-authored-by: Jayashree Srinivasan <Jayashree.Srinivasan@analog.com>
Co-authored-by: Hao Zhang <Hao.Zhang@analog.com>
Co-authored-by: Tanmaya Mishra <Tanmaya.Mishra@analog.com>
Change-Id: I8c8d5a6ecdfb8eeb1fb7dd21a830b46eea1dceb3
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 915c0c9)
We intend to use FP in our own NSPE application but the
TF-M SPE services that we enable do not require FP.

CONFIG_TFM_ENABLE_CP10CP11 detail:

Make FPU and MVE operational when SPE and/or NSPE require FPU or MVE usage.
This alone only enables the coprocessors CP10-CP11, whereas CONFIG_TFM_FLOAT_ABI=hard
along with CONFIG_TFM_ENABLE_FP, CONFIG_TFM_ENABLE_MVE or CONFIG_TFM_ENABLE_MVE_FP
compiles the code with hardware FP or MVE instructions and ABI.

Change-Id: Ifb8cdefcc05fb2a856593d2fb128a95f1c6f66ec
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit fab0109)
There is one UART on MAX32657, it is need to be used
by NS and S world depend on the test.
This commit adds related flag to switch UART between
S and NS world

Change-Id: I990866c846ffa0aa7d2100dbb2f09172ff454dc4
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 881f7e3)
Enable system reset request only to the secure world that
triggered via NVIC_SystemReset function.

Change-Id: I53457fba66a7c3aaec7524bda58f588f2f68fad3
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 037bcfd)
To enable ER_CODE_SRAM section in linker file define
SRAM_CODE_START and SIZE. Size set as 1KB, this allow to store
ramfunctions in SRAM
Flash driver function stored in .flashprog in hal layer so that
S_RAM_CODE_EXTRA_SECTION_NAME defined.

.map output
.ER_CODE_SRAM   0x000000003000fc00      0x3b8 load address 0x0000000011012a20
 *libflash_drivers*:(SORT_BY_ALIGNMENT(.text*))
 *libflash_drivers*:(SORT_BY_ALIGNMENT(.rodata*))
 *(.ramfunc)
 *(.flashprog)
 .flashprog     0x000000003000fc00       0x58 platform/libplatform_s.a(flc_me30.o)
                0x000000003000fc00                MXC_FLC_Busy
                0x000000003000fc04                MXC_FLC_PageErase
                0x000000003000fc28                MXC_FLC_Write128
 .flashprog     0x000000003000fc58      0x11c platform/libplatform_s.a(flc_common.o)
                0x000000003000fc58                MXC_FLC_Com_VerifyData
                0x000000003000fc7c                MXC_FLC_Com_Write
                0x000000003000fd6a                MXC_FLC_Com_Read
 .flashprog     0x000000003000fd74      0x218 platform/libplatform_s.a(flc_reva.o)
                0x000000003000fdb4                MXC_FLC_RevA_Busy
                0x000000003000fdc4                MXC_FLC_RevA_MassErase
                0x000000003000fe04                MXC_FLC_RevA_PageErase
                0x000000003000fe46                MXC_FLC_RevA_Write32
                0x000000003000fea4                MXC_FLC_RevA_Write32Using128
                0x000000003000ff2c                MXC_FLC_RevA_Write128

Change-Id: I9bc4b99602dc3b13c19faaec52c2e23211b8e959
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit b21f209)
ADI BootRom secure mode currently uses floating point registers and set
FPCA bit. ADI TF-M would ensure FPCA bit is cleared before jumping to NS

Change-Id: Ibe3c2adfe54cb13353c77b4827b279816d9e19bc
Signed-off-by: Hao Zhang <Hao.Zhang@analog.com>
(cherry picked from commit cc6354c)
MAX32657 firmware need to have a header and signature section to
it be interpreted and validated by BootROM

Change-Id: I1d96deda795048ec96b5028c352a6078afde5d79
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 574cf79)
…32657

By using PLATFORM_DEFAULT_PROVISIONING user can provision device by its secret key
If PLATFORM_DEFAULT_PROVISIONING flag been OFF
platform/ext/common/provision_bundle will be build
that include test key, user can set related item with their private values.
This bundle can be loaded to SRAM and executed there.

If -DPLATFORM_DEFAULT_PROVISIONING=OFF and -DTFM_DUMMY_PROVISIONING=ON then the keys in
the tf-m/platform/ext/target/common/provisioning/provisioning_config.cmake and the
default MCUBoot signing keys will be used for provisioning.

If -DPLATFORM_DEFAULT_PROVISIONING=OFF and -DTFM_DUMMY_PROVISIONING=OFF are set
then unique values can be used for provisioning. The keys and seeds can be changed by
passing the new values to the build command, or by setting the -DPROVISIONING_KEYS_CONFIG flag
to a .cmake file that contains the keys. An example config cmake file can be seen at
tf-m/platform/ext/target/common/provisioning/provisioning_config.cmake.
Otherwise new random values are going to be generated and used. For the image signing
the ${MCUBOOT_KEY_S} and ${MCUBOOT_KEY_NS} will be used. These variables should point to
.pem files that contain the code signing private keys. The public keys are going to be generated
from these private keys and will be used for provisioning. The hash of the public key is going to
be written into the provisioning_data.c automatically.

Change-Id: I9d54c76ccc3e1adc20ecf4047351d9c19b3d256f
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 5c0ffdb)
This commit adds/updates related file for MAX32657 documentations

Change-Id: I5ff357ef35b0a3e7e31b0ae127f90803d3c6f397
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 89f8f96)
TESA stands for Trusted Edge Security Architecture.
This commit download ADI TESA-Toolkit repository which includes
binaries (that used to sign image) provisioning scripts and keys.

MAX32657 has Secure Boot ROM which used to authenticite user
second layer firmware for TF-M case second layer is MCUBoot.

If SecureBoot ROM been activated MCUBoot need to be signed to be validated
by ADI Secure BootROM.

Set BL1=ON if you would like to enable Secure Boot ROM on device
The MCUBoot will be signed during build if BL1 be ON

bin2hex.py scripts is used to convert bl2_signed.bin to bl2_signed.hex
it comes from https://github.com/python-intelhex/intelhex

Change-Id: Ibb858515397ffc1d649f1cdc2c4660eba597d702
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit b6d24df)
Move HAL layer files under hal_adi.cmake to simplify maintanence

Change-Id: I511549147cbb05f926073710466fc4f2ed8dd057
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit b3025d0)
Add configuration flags to define peripherals ownerships
either secure or non-secure
Remove ICE_IRQn and ECC_IRQn fron NS due to this peripherals
not accessible by NS world

User can configure peripheral ownership over s_ns_access_overlay.cmake
file. This file need to be defined in the project folder root folder.

On default NS world control all peripheral.
As an example to transfer gpio and timer0 on the secure world
write below lines in the overlay file.

...
set(ADI_NS_PRPH_GPIO0       OFF)
set(ADI_NS_PRPH_TIMER0      OFF)
...

s_ns_access_overlay.cmake file must be defined in the
project workspace root folder.

Change-Id: I37ab37ef600043707cc88aac046e4c3ce8ff903f
Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
(cherry picked from commit 1bd0c2d)
rob-robinson-14 and others added 13 commits February 5, 2026 08:06
Align to nrfx 4.0: Remove reference to nrf_erratas.h

Change-Id: I0b8c806ff89cee67c6207e3ce8ef079d573e4bde
Signed-off-by: Robert Robinson <robert.robinson@nordicsemi.no>
(cherry picked from commit e754c18)
…dic platforms

Resolve formatting of flash_layout.h to match other Nordic platforms.
Update values for MRAM and SRAM size to correct values for nRF7120.

Change-Id: I0b451c9fd1416173676e1155a60030ba2fe89aa6
Signed-off-by: Robert Robinson <robert.robinson@nordicsemi.no>
(cherry picked from commit 7bfdd5b)
…mon folder

Add support for TF-M builds from Zephyr

When TF-M is built with Zephyr it now requires to have the platform
user memory ranges header.

This copies the memory range header into the common folder because
Zephyr builds from the common folder.

Change-Id: I0193a8992d3a58fb012970150db4a85fa04d24bb
Signed-off-by: Robert Robinson <robert.robinson@nordicsemi.no>
(cherry picked from commit 2af3e82)
…common folder

Since tfm_platform_user_memory_ranges.h has moved from board definition
to soc definition, to align with other platforms. The new file location
must be included in the CMakeLists.txt.

Change-Id: I4666e945d6aae5103ef090b5548554bf1c37aa85
Signed-off-by: Robert Robinson <robert.robinson@nordicsemi.no>
(cherry picked from commit 0d3f534)
Align nrfx error type align to nrfx4.0
Remove mpc configuration for WiFi registers since
it is done by NRF_MPC region configuration

Change-Id: I515cce6ec1e42c99018ec0e5c0d227d654bee0b8
Signed-off-by: Travis Lam <travis.lam@nordicsemi.no>
(cherry picked from commit db7778d)
Added support for nRF54LM20B SoC on nRF54LM20 DK board.
Content identical to nRF54LM20A with name change.

Change-Id: Ibc1130594d4472c84116464c035434b5e423fb6b
Signed-off-by: Michał Stasiak <michal.stasiak@nordicsemi.no>
(cherry picked from commit 6f564f2)
Removed Eng A naming from nRF54LM20A and nRF54LV10A.

Change-Id: Id5539232e6a7e57dbc109bd7fa591c283b07ff66
Signed-off-by: Michał Stasiak <michal.stasiak@nordicsemi.no>
(cherry picked from commit 401f167)
…RATEGY

CMake 4.2 adds CMAKE_INTERMEDIATE_DIR_STRATEGY as a string cache
variable specifying the strategy to use for target intermediate
directories and their contents.

This should allow Windows users to get around the long path issues.

NOTE: This patch is a cherry-pick from:
nrfconnect@e21be23

Signed-off-by: Andrei Urs-Hadadea <andrei.hadadea@nordicsemi.no>
Signed-off-by: Nicola Mazzucato <nicola.mazzucato@arm.com>
Change-Id: I110ae40fa320ec38ea2239b0e50b8ea668218fbc
(cherry picked from commit 8df5c30)
Added key wrap support according to PSA Crypto spec v1.4

This commit is noup since upstream TF-M relies on PSA core
that does not support key wrap APIs now.

This commit can be up streamed or removed in future.

Ref: NCSDK-29189
Ref: NCSDK-28740

Change-Id: Id814e9a7b3610ef1ba941afbaf056c1652144999
Signed-off-by: Anton Zyma <anton.zyma@nordicsemi.no>
Add CONFIG_SOC_NRF71_WIFI_BOOT, so that ns sample does not
start Wi-Fi, this is because wicr and lmac is initialised to
some gibberish value when it is not loaded.

Update nrf71_init.c to be the same with zephyr upstream.

Change-Id: I74ab06bf54b6f7e7d41a6f7b3991b0db3b425ee6
Signed-off-by: Travis Lam <travis.lam@nordicsemi.no>
(cherry picked from commit e2812b6)
This fixes build issue of nordic_nrf/nrf7120dk_nrf7120_cpuapp
on tf-m upstream. The fix also aligns consistent with nrf54l
series.

Change-Id: I74a551accc6ee2d62b8dbeed193346bc1d7fd000
Signed-off-by: Travis Lam <travis.lam@nordicsemi.no>
(cherry picked from commit 553f21c)
- Bump manual fallback version to v2.2.2**
- Refine version fallback mechanism to append '**' when Git tags are
  unavailable, indicating uncertainty in the exact TF-M version

Signed-off-by: Anton Komlev <anton.komlev@arm.com>
Change-Id: I8d5d38a19a43db5981e64ecdc7379ec0906f6d5e
(cherry picked from commit a151f86)
nrf-squash! [nrf noup] crypto: Add PAKE support

Fixes the build time error stating that PAKE is enabled,
but not all prerequisites if WPA3 is the only activated
PAKE algorithm.

Ref: NCSDK-38330

Signed-off-by: Anton Zyma <anton.zyma@nordicsemi.no>
@AntonZma AntonZma force-pushed the nrfx-kmu-driver-support branch 2 times, most recently from 8291da8 to e817682 Compare March 30, 2026 08:50
degjorva and others added 6 commits April 13, 2026 12:22
nrf-squash! [nrf noup] secure_fw: Add option to log output on a shared UART instance.

UART instances would be locked permanently even when
TFM_SHARED_INSTANCE was set.
Update to allow shared instance for UART on
54L and 71 series devices.
TFM_SHARED_INSTANCE is a NCS config
which is why this is a noup.

Signed-off-by: Dag Erik Gjørvad <dag.erik.gjorvad@nordicsemi.no>
…ALLOC_C

This commit disables initialization of Mbed TLS heap in the
crypto library when MBEDTLS_MEMORY_BUFFER_ALLOC_C is not enabled.
Before this commit Mbed TLS heap was always required.

Note that this cherry-pick is not clean as the code is changed
from TF-M 2.2 to main (2.3) around logging. This fromlist
is taken from a commit to main.

Change-Id: Id6f3fc4dee2c2512ba8bcd346b38bac69b890a73
Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no>
(cherry picked from commit 3776100)
This fixes:
warning: control reaches end of non-void function [-Wreturn-type].

Signed-off-by: Nicola Mazzucato <nicola.mazzucato@arm.com>
Change-Id: I0f8fc5d118b216b04b157eaef97c3a48856a3d82
(cherry picked from commit 2e1e202)
…rom NRF_SECURE_UART_INSTANCE

TFM_PERIPHERAL_STD_UART was hardcoded to TFM_PERIPHERAL_UARTE30, which
breaks nrf54lv10a (NRF_SECURE_UART_INSTANCE=20) since tfm_peripheral_uarte30
is not compiled in, causing an undefined reference at link time. Select the
right peripheral from NRF_SECURE_UART_INSTANCE, matching how target_cfg_54l.c
and target_cfg.h already use it.

Change-Id: I5aa90808a0592a6da3ecef6073ad06814ab609d5
Signed-off-by: Dag Erik Gjørvad <dag.erik.gjorvad@nordicsemi.no>
(cherry picked from commit d404a04)
This can be very useful for this repo as well so lets
enable it.

Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
Added support for NRFX KMU driver for Nordic targets
to exchange LIB_KMU.

Change-Id: I0e8e7e40611374f1fe5a8c183cf40200e2aec999
Signed-off-by: Anton Zyma <anton.zyma@nordicsemi.no>
(cherry picked from commit 8eef667)
@AntonZma AntonZma force-pushed the nrfx-kmu-driver-support branch from e817682 to 4a8b058 Compare May 13, 2026 08:50
@AntonZma
Copy link
Copy Markdown
Contributor Author

Rebased

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.