drivers: kmu: soc: Add custom section for KMU

Add a custom section in the linker which should always
be placed in the top of RAM. This will be used by the
KMU to push keys into it. Since when you provision a key
into the KMU you need to set specific a memory location
for the PUSH operation we need to keep this memory location
static across images/dfus.

The linker script inclusion which places the KMU reserved
buffer on the top of RAM doesn't work for non-XIP builds.
The Zephyr linker script will firstly load the code for
an non-XIP build in RAM and then include this KMU related
linker script which results in an unpredictable placement
of the KMU reserved area and a failed build.

In order to support non-XIP builds the linker file is not
included and the a DTS reserved-memory entry should be used.

To limit the scope, the DTS reserved memory region
is currently only supported for non-XIP builds.

KMU is not supported upstream and so defined in sdk-nrf

Signed-off-by: Robert Robinson <robert.robinson@nordicsemi.no>

Author: rob-robinson-14

CODEOWNERS

@@ -282,6 +282,7 @@
 /drivers/flash/                           @nrfconnect/ncs-co-drivers
 /drivers/gpio/                            @nrfconnect/ncs-co-drivers @nrfconnect/ncs-ll-ursus
 /drivers/hw_cc3xx/                        @nrfconnect/ncs-co-drivers @nrfconnect/ncs-aegir
+/drivers/kmu/                             @nrfconnect/ncs-co-drivers @nrfconnect/ncs-aegir
 /drivers/mpsl/                            @nrfconnect/ncs-co-drivers @nrfconnect/ncs-dragoon
 /drivers/mspi/                            @nrfconnect/ncs-co-drivers @nrfconnect/ncs-ll-ursus
 /drivers/net/                             @nrfconnect/ncs-co-drivers @doki-nordic

drivers/CMakeLists.txt

@@ -8,6 +8,9 @@ add_subdirectory(entropy)
 add_subdirectory(flash)
 add_subdirectory(gpio)
 add_subdirectory(hw_cc3xx)
+if(CONFIG_SOC_NRF7120)
+  add_subdirectory_ifdef(CONFIG_PSA_NEED_CRACEN_KMU_DRIVER kmu)
+endif()
 if(NOT CONFIG_MPSL_FEM_ONLY)
   add_subdirectory(mpsl)
 endif()

drivers/kmu/CMakeLists.txt

@@ -0,0 +1,15 @@
+# Copyright (c) 2026 Nordic Semiconductor ASA
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+#
+
+dt_nodelabel(kmu_push_area_node NODELABEL nrf_kmu_reserved_push_area)
+
+# We need a buffer in memory in a static location which can be used by
+# the KMU peripheral. The KMU has a static destination address,for nRF7120
+# this address is defined as 0x20000000, which is the first address in the SRAM.
+if(NOT CONFIG_BUILD_WITH_TFM AND CONFIG_PSA_NEED_CRACEN_KMU_DRIVER AND NOT kmu_push_area_node)
+  # Exclamation mark is printable character with the lowest number in ASCII table.
+  # We are sure that this file will be included first.
+  zephyr_linker_sources(RAM_SECTIONS SORT_KEY ! kmu_push_area_section.ld)
+  zephyr_linker_section(NAME ".nrf_kmu_reserved_push_area" ADDRESS "${RAM_ADDR}" GROUP RAM_REGION NOINIT)
+endif()

drivers/kmu/kmu_push_area_section.ld

@@ -0,0 +1,19 @@
+# This section must be loaded first of all the
+# custom sections because we want it to be placed
+# at the top address of RAM.
+SECTION_PROLOGUE(NRF_KMU_RESERVED_PUSH_SECTION,(NOLOAD) ,)
+{
+    __nrf_kmu_reserved_push_area = .;
+    *(.nrf_kmu_reserved_push_area)
+    __nrf_kmu_reserved_push_area_end = .;
+} GROUP_NOLOAD_LINK_IN(RAMABLE_REGION, RAMABLE_REGION)
+
+# It doesn't seem to be possible to enforce placing a section
+# at a specific address in memory using the Zephyr SECTION macros.
+# So this assert is necessary to avoid accidentally moving this
+# section to a different address.
+ASSERT(__nrf_kmu_reserved_push_area == RAM_ADDR, "Error:  \
+ The section NRF_KMU_RESERVED_PUSH_SECTION needs to be    \
+ placed on the top RAM address but it is not, please edit \
+ your linker scripts to make sure that it is placed on    \
+ the top RAM address.")