softdevice_handler: seed SoftDevice RNG when requested

anhmolt · eivindj-nordic · commit 47cb06678176 · 2025-08-15T08:33:34.000+02:00
Seed the SoftDevice RNG with random numbers on SoftDevice
SoC event NRF_EVT_RAND_SEED_REQUEST.

Handling of SoC events from the SoftDevice (nrf_sdh_soc.c)
is from now on a mandatory part of the SoftDevice Handler
subsystem. Kconfig option NRF_SDH_SOC is therefore removed.

Signed-off-by: Andreas Moltumyr &lt;andreas.moltumyr@nordicsemi.no&gt;
diff --git a/samples/bluetooth/ble_cgms/prj.conf b/samples/bluetooth/ble_cgms/prj.conf
@@ -4,6 +4,11 @@ CONFIG_LOG_BACKEND_BM_UARTE=y
 CONFIG_SOFTDEVICE=y
 CONFIG_NRF_SDH=y
 
+# Enable RNG
+CONFIG_NRF_SECURITY=y
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+CONFIG_PSA_WANT_GENERATE_RANDOM=y
+
 CONFIG_BLE_ADV=y
 CONFIG_BLE_ADV_NAME="nRF_BM_CGMS"
 CONFIG_BLE_ADV_EXTENDED_ADVERTISING=n
diff --git a/samples/bluetooth/ble_hrs/prj.conf b/samples/bluetooth/ble_hrs/prj.conf
@@ -4,6 +4,11 @@ CONFIG_LOG_BACKEND_BM_UARTE=y
 CONFIG_SOFTDEVICE=y
 CONFIG_NRF_SDH=y
 
+# Enable RNG
+CONFIG_NRF_SECURITY=y
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+CONFIG_PSA_WANT_GENERATE_RANDOM=y
+
 CONFIG_BLE_ADV=y
 CONFIG_BLE_ADV_NAME="nRF_BM_HRS"
 CONFIG_BLE_ADV_EXTENDED_ADVERTISING=n
diff --git a/samples/bluetooth/ble_lbs/prj.conf b/samples/bluetooth/ble_lbs/prj.conf
@@ -4,6 +4,11 @@ CONFIG_LOG_BACKEND_BM_UARTE=y
 CONFIG_SOFTDEVICE=y
 CONFIG_NRF_SDH=y
 
+# Enable RNG
+CONFIG_NRF_SECURITY=y
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+CONFIG_PSA_WANT_GENERATE_RANDOM=y
+
 CONFIG_BLE_ADV=y
 CONFIG_BLE_ADV_NAME="nRF_BM_LBS"
 CONFIG_BLE_ADV_EXTENDED_ADVERTISING=n
diff --git a/samples/bluetooth/ble_nus/prj.conf b/samples/bluetooth/ble_nus/prj.conf
@@ -9,6 +9,11 @@ CONFIG_BLE_ADV_DIRECTED_ADVERTISING=n
 CONFIG_SOFTDEVICE=y
 CONFIG_NRF_SDH=y
 
+# Enable RNG
+CONFIG_NRF_SECURITY=y
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+CONFIG_PSA_WANT_GENERATE_RANDOM=y
+
 # BLE connection parameter
 CONFIG_BLE_CONN_PARAMS=y
 
diff --git a/samples/bluetooth/ble_pwr_profiling/prj.conf b/samples/bluetooth/ble_pwr_profiling/prj.conf
@@ -7,6 +7,11 @@ CONFIG_CONSOLE=y
 CONFIG_SOFTDEVICE=y
 CONFIG_NRF_SDH=y
 
+# Enable RNG
+CONFIG_NRF_SECURITY=y
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+CONFIG_PSA_WANT_GENERATE_RANDOM=y
+
 # Require storage of a vendor UUID
 CONFIG_NRF_SDH_BLE_VS_UUID_COUNT=1
 
diff --git a/samples/bluetooth/hello_softdevice/prj.conf b/samples/bluetooth/hello_softdevice/prj.conf
@@ -3,3 +3,8 @@ CONFIG_LOG_BACKEND_BM_UARTE=y
 
 CONFIG_SOFTDEVICE=y
 CONFIG_NRF_SDH=y
+
+# Enable RNG
+CONFIG_NRF_SECURITY=y
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+CONFIG_PSA_WANT_GENERATE_RANDOM=y
diff --git a/samples/boot/mcuboot_recovery_entry/prj.conf b/samples/boot/mcuboot_recovery_entry/prj.conf
@@ -15,6 +15,9 @@ CONFIG_BLE_ADV_DIRECTED_ADVERTISING=n
 CONFIG_SOFTDEVICE=y
 CONFIG_NRF_SDH_BLE=y
 CONFIG_NRF_SDH=y
+CONFIG_NRF_SECURITY=y
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+CONFIG_PSA_WANT_GENERATE_RANDOM=y
 CONFIG_BLE_MCUMGR=y
 
 CONFIG_MCUBOOT_BOOTUTIL_LIB=y
diff --git a/samples/mcumgr/ble_mcumgr/prj.conf b/samples/mcumgr/ble_mcumgr/prj.conf
@@ -39,6 +39,9 @@ CONFIG_MCUMGR_GRP_OS_MCUMGR_PARAMS=y
 CONFIG_MCUMGR_GRP_OS_BOOTLOADER_INFO=y
 CONFIG_NRF_SDH_BLE=y
 CONFIG_NRF_SDH=y
+CONFIG_NRF_SECURITY=y
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+CONFIG_PSA_WANT_GENERATE_RANDOM=y
 CONFIG_BLE_MCUMGR=y
 
 CONFIG_LOG=y
diff --git a/subsys/softdevice_handler/CMakeLists.txt b/subsys/softdevice_handler/CMakeLists.txt
@@ -7,6 +7,7 @@ zephyr_library()
 zephyr_linker_sources(SECTIONS sdh.ld)
 zephyr_library_sources(
   nrf_sdh.c
+  nrf_sdh_soc.c
   irq_connect.c
 )
 
@@ -22,9 +23,6 @@ if(CONFIG_SOFTDEVICE_S115)
   target_link_options(app PUBLIC "-Wl,--defsym=z_arm_svc=SVC_Handler")
 endif()
 
-if(CONFIG_NRF_SDH_SOC)
-  zephyr_library_sources(nrf_sdh_soc.c)
-endif()
 if(CONFIG_NRF_SDH_BLE)
   zephyr_library_sources(nrf_sdh_ble.c)
 endif()
diff --git a/subsys/softdevice_handler/Kconfig b/subsys/softdevice_handler/Kconfig
@@ -6,13 +6,12 @@
 menuconfig NRF_SDH
 	bool "Softdevice handler"
 	depends on SOFTDEVICE
+	depends on NRF_SECURITY
+	depends on MBEDTLS_PSA_CRYPTO_C
+	depends on PSA_WANT_GENERATE_RANDOM
 
 if NRF_SDH
 
-config NRF_SDH_SOC
-	bool "SoC events"
-	default y
-
 config NRF_SDH_BLE
 	bool "BLE events"
 	default y
diff --git a/subsys/softdevice_handler/nrf_sdh_soc.c b/subsys/softdevice_handler/nrf_sdh_soc.c
@@ -9,6 +9,7 @@
 #include <nrf_sdh.h>
 #include <nrf_sdh_soc.h>
 #include <nrf_soc.h>
+#include <psa/crypto.h>
 #include <zephyr/logging/log.h>
 
 LOG_MODULE_DECLARE(nrf_sdh, CONFIG_NRF_SDH_LOG_LEVEL);
@@ -34,11 +35,38 @@ static const char *tostr(uint32_t evt)
 		return "A radio timeslot session is idle";
 	case NRF_EVT_RADIO_SESSION_CLOSED:
 		return "A radio timeslot session is closed";
+	case NRF_EVT_RAND_SEED_REQUEST:
+		return "SoftDevice RNG needs to be seeded";
 	default:
 		return "Unknown";
 	}
 }
 
+static void softdevice_rng_seed(void)
+{
+/* Temporary until SoftDevice exposes SD_RAND_SEED_SIZE. */
+#ifndef SD_RAND_SEED_SIZE
+#define SD_RAND_SEED_SIZE 48
+#endif
+	uint32_t err = NRF_ERROR_INVALID_DATA;
+	psa_status_t status;
+	uint8_t seed[SD_RAND_SEED_SIZE];
+
+	status = psa_generate_random(seed, sizeof(seed));
+	if (status == PSA_SUCCESS) {
+		err = sd_rand_seed_set(seed);
+		memset(seed, 0, sizeof(seed));
+		if (err == NRF_SUCCESS) {
+			LOG_DBG("SoftDevice RNG seeded");
+			return;
+		}
+	} else {
+		LOG_ERR("Generate random failed, psa status %d", status);
+	}
+
+	LOG_ERR("Failed to seed SoftDevice RNG, nrf_error %#x", err);
+}
+
 static void soc_evt_poll(void *context)
 {
 	uint32_t err;
@@ -56,6 +84,10 @@ static void soc_evt_poll(void *context)
 			LOG_DBG("SoC event: 0x%x", evt_id);
 		}
 
+		if (evt_id == NRF_EVT_RAND_SEED_REQUEST) {
+			softdevice_rng_seed();
+		}
+
 		/* Forward the event to SoC observers. */
 		TYPE_SECTION_FOREACH(
 			struct nrf_sdh_soc_evt_observer, nrf_sdh_soc_evt_observers, obs) {
