nRF54L15: Add initial TF-M support

drivers/hwinfo/hwinfo_nrf.c

@@ -7,12 +7,17 @@
 #include <soc.h>
 #include <zephyr/drivers/hwinfo.h>
 #include <string.h>
-#include <hal/nrf_ficr.h>
 #include <zephyr/sys/byteorder.h>
 #ifndef CONFIG_BOARD_QEMU_CORTEX_M0
 #include <helpers/nrfx_reset_reason.h>
 #endif
+
+#if defined(CONFIG_TRUSTED_EXECUTION_NONSECURE) && defined(NRF_FICR_S)
 #include <soc_secure.h>
+#else
+#include <hal/nrf_ficr.h>
+#endif
+
 struct nrf_uid {
 	uint32_t id[2];
 };
@@ -22,7 +27,12 @@ ssize_t z_impl_hwinfo_get_device_id(uint8_t *buffer, size_t length)
 	struct nrf_uid dev_id;
 	uint32_t deviceid[2];
 
+#if defined(CONFIG_TRUSTED_EXECUTION_NONSECURE) && defined(NRF_FICR_S)
 	soc_secure_read_deviceid(deviceid);
+#else
+	deviceid[0] = nrf_ficr_deviceid_get(NRF_FICR, 0);
+	deviceid[1] = nrf_ficr_deviceid_get(NRF_FICR, 1);
+#endif
 
 	dev_id.id[0] = sys_cpu_to_be32(deviceid[1]);
 	dev_id.id[1] = sys_cpu_to_be32(deviceid[0]);

drivers/ieee802154/ieee802154_nrf5.c

@@ -25,7 +25,13 @@ LOG_MODULE_REGISTER(LOG_MODULE_NAME);
 #include <zephyr/debug/stack.h>
 
 #include <soc.h>
+
+#if defined(CONFIG_TRUSTED_EXECUTION_NONSECURE) && defined(NRF_FICR_S)
 #include <soc_secure.h>
+#else
+#include <hal/nrf_ficr.h>
+#endif
+
 #include <zephyr/device.h>
 #include <zephyr/init.h>
 #include <zephyr/debug/stack.h>
@@ -120,7 +126,12 @@ static void nrf5_get_eui64(uint8_t *mac)
 	mac[index++] = (IEEE802154_NRF5_VENDOR_OUI >> 8) & 0xff;
 	mac[index++] = IEEE802154_NRF5_VENDOR_OUI & 0xff;
 
+#if defined(CONFIG_TRUSTED_EXECUTION_NONSECURE) && defined(NRF_FICR_S)
 	soc_secure_read_deviceid(deviceid);
+#else
+	deviceid[0] = nrf_ficr_deviceid_get(NRF_FICR, 0);
+	deviceid[1] = nrf_ficr_deviceid_get(NRF_FICR, 1);
+#endif
 
 	factoryAddress = (uint64_t)deviceid[EUI64_ADDR_HIGH] << 32;
 	factoryAddress |= deviceid[EUI64_ADDR_LOW];

modules/hal_nordic/nrfx/CMakeLists.txt

@@ -157,6 +157,8 @@ if(CONFIG_SOC_NRF54L15)
 endif()
 
 zephyr_compile_definitions_ifdef(CONFIG_SOC_NRF54LX_SKIP_CLOCK_CONFIG NRF_SKIP_CLOCK_CONFIGURATION)
+zephyr_compile_definitions_ifdef(CONFIG_SOC_NRF54LX_DISABLE_FICR_TRIMCNF NRF_DISABLE_FICR_TRIMCNF)
+zephyr_compile_definitions_ifdef(CONFIG_SOC_NRF54LX_SKIP_GLITCHDETECTOR_DISABLE NRF_SKIP_GLITCHDETECTOR_DISABLE)
 
 if(CONFIG_SOC_SERIES_NRF54LX AND CONFIG_NRFX_DPPI)
   zephyr_library_sources(${HELPERS_DIR}/nrfx_gppi_dppi_ppib_lumos.c)

modules/mbedtls/Kconfig.psa

@@ -517,8 +517,7 @@ menu "PSA Key agreement support"
 config PSA_HAS_KEY_AGREEMENT
 	bool
 	default y
-	depends on PSA_WANT_ALG_ECDH
-	depends on PSA_WANT_ALG_FFDH
+	depends on PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH
 	help
 	  Promt-less configuration that states that key agreement is supported.
 

soc/arm/nordic_nrf/common/soc_secure.h

@@ -9,63 +9,63 @@
 #include <hal/nrf_ficr.h>
 
 #if defined(CONFIG_TRUSTED_EXECUTION_NONSECURE)
+int soc_secure_mem_read(void *dst, void *src, size_t len);
 #if NRF_GPIO_HAS_SEL
 void soc_secure_gpio_pin_mcu_select(uint32_t pin_number, nrf_gpio_pin_sel_t mcu);
 #endif
 
-int soc_secure_mem_read(void *dst, void *src, size_t len);
+#else /* defined(CONFIG_TRUSTED_EXECUTION_NONSECURE) */
+static inline int soc_secure_mem_read(void *dst, void *src, size_t len)
+{
+	(void)memcpy(dst, src, len);
+	return 0;
+}
+#if NRF_GPIO_HAS_SEL
+static inline void soc_secure_gpio_pin_mcu_select(uint32_t pin_number, nrf_gpio_pin_sel_t mcu)
+{
+	nrf_gpio_pin_control_select(pin_number, mcu);
+}
+#endif /* NRF_GPIO_HAS_SEL */
+
+#endif /* defined CONFIG_TRUSTED_EXECUTION_NONSECURE */
 
+/* Include these soc_secure_* functions only when the FICR is mapped as secure only */
+#if defined(NRF_FICR_S)
+#if defined(CONFIG_TRUSTED_EXECUTION_NONSECURE)
+static inline void soc_secure_read_deviceid(uint32_t deviceid[2])
+{
+	int err;
+
+	err = soc_secure_mem_read(deviceid, (void *)&NRF_FICR_S->INFO.DEVICEID,
+				  2 * sizeof(uint32_t));
+	__ASSERT(err == 0, "Secure read error (%d)", err);
+}
 #if defined(CONFIG_SOC_HFXO_CAP_INTERNAL)
 static inline uint32_t soc_secure_read_xosc32mtrim(void)
 {
 	uint32_t xosc32mtrim;
 	int err;
 
-	err = soc_secure_mem_read(&xosc32mtrim,
-				  (void *)&NRF_FICR_S->XOSC32MTRIM,
+	err = soc_secure_mem_read(&xosc32mtrim, (void *)&NRF_FICR_S->XOSC32MTRIM,
 				  sizeof(xosc32mtrim));
 	__ASSERT(err == 0, "Secure read error (%d)", err);
 
 	return xosc32mtrim;
 }
 #endif /* defined(CONFIG_SOC_HFXO_CAP_INTERNAL) */
 
-static inline void soc_secure_read_deviceid(uint32_t deviceid[2])
-{
-	int err;
-
-	err = soc_secure_mem_read(deviceid,
-				 (void *)&NRF_FICR_S->INFO.DEVICEID,
-				 2 * sizeof(uint32_t));
-	__ASSERT(err == 0, "Secure read error (%d)", err);
-}
-
 #else /* defined(CONFIG_TRUSTED_EXECUTION_NONSECURE) */
-
-static inline int soc_secure_mem_read(void *dst, void *src, size_t len)
-{
-	(void)memcpy(dst, src, len);
-	return 0;
-}
-
-#if NRF_GPIO_HAS_SEL
-static inline void soc_secure_gpio_pin_mcu_select(uint32_t pin_number,
-						  nrf_gpio_pin_sel_t mcu)
+static inline void soc_secure_read_deviceid(uint32_t deviceid[2])
 {
-	nrf_gpio_pin_control_select(pin_number, mcu);
+	deviceid[0] = nrf_ficr_deviceid_get(NRF_FICR_S, 0);
+	deviceid[1] = nrf_ficr_deviceid_get(NRF_FICR_S, 1);
 }
-#endif /* NRF_GPIO_HAS_SEL */
-
 #if defined(CONFIG_SOC_HFXO_CAP_INTERNAL)
 static inline uint32_t soc_secure_read_xosc32mtrim(void)
 {
-	return NRF_FICR->XOSC32MTRIM;
+	return NRF_FICR_S->XOSC32MTRIM;
 }
 #endif /* defined(CONFIG_SOC_HFXO_CAP_INTERNAL) */
 
-static inline void soc_secure_read_deviceid(uint32_t deviceid[2])
-{
-	deviceid[0] = nrf_ficr_deviceid_get(NRF_FICR, 0);
-	deviceid[1] = nrf_ficr_deviceid_get(NRF_FICR, 1);
-}
 #endif /* defined CONFIG_TRUSTED_EXECUTION_NONSECURE */
+#endif /* defined(NRF_FICR_S) */

soc/arm/nordic_nrf/nrf54l/Kconfig.soc

@@ -31,6 +31,21 @@ config SOC_NRF54LX_SKIP_CLOCK_CONFIG
 	  With this option, the CPU clock frequency is not set during system initialization.
 	  The CPU runs with the default, hardware-selected frequency.
 
+config SOC_NRF54LX_DISABLE_FICR_TRIMCNF
+	bool "Disable trimming of the device"
+	default y if TRUSTED_EXECUTION_NONSECURE
+	help
+	  Disable trimming of the device. When the device is trimmed it
+	  will copy all the trimming values from FICR into the target
+	  addresses.
+
+config SOC_NRF54LX_SKIP_GLITCHDETECTOR_DISABLE
+	bool "Skip disabling glitch detector"
+	default y if TRUSTED_EXECUTION_NONSECURE
+	help
+	  With this option, the glitch detector is not disabled during system initialization.
+	  The CPU runs with the default state of glitch detector.
+
 config SOC_NRF_FORCE_CONSTLAT
 	bool "Force constant-latency mode"
 	help
@@ -47,12 +62,6 @@ config SOC_NRF54L_VREG_MAIN_DCDC
 config SOC_NRF54L_NORMAL_VOLTAGE_MODE
 	bool "NRF54L Normal Voltage Mode."
 
-config SOC_NRF54L_GLITCHDET_WORKAROUND
-	bool "Workaround that disables glitch detector"
-	default y
-	help
-	  Temporary workaround - disabling glitch detector to limit power consumption.
-
 if NRF_GRTC_TIMER
 
 config ELV_GRTC_LFXO_ALLOWED

soc/arm/nordic_nrf/nrf54l/soc.c

@@ -42,10 +42,6 @@ static int nordicsemi_nrf54l_init(void)
 	/* Enable ICACHE */
 	sys_cache_instr_enable();
 
-	if (IS_ENABLED(CONFIG_SOC_NRF54L_GLITCHDET_WORKAROUND)) {
-		nrf_glitchdet_enable_set(NRF_GLITCHDET, false);
-	}
-
 #if DT_ENUM_HAS_VALUE(LFXO_NODE, load_capacitors, internal)
 	uint32_t xosc32ktrim = NRF_FICR->XOSC32KTRIM;