sysbuild: Add support for MCUboot hashing algorithm

Allows selecting what hashing algorithm is used, and propagates
this information to images. Uses SHA512 by default with ed25519

Signed-off-by: Jamie McCrae <[email protected]>

Author: nordicjm

cmake/image_signing_softdevice.cmake

@@ -52,6 +52,13 @@ function(softdevice_tasks output_hex output_bin)
 #    set(imgtool_args --security-counter ${CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE})
 #  endif()
 
+  # Set proper hash calculation algorithm for signing
+  if(CONFIG_BOOT_SIGNATURE_TYPE_PURE)
+    set(imgtool_args --pure ${imgtool_args})
+  elseif(CONFIG_BOOT_IMG_HASH_ALG_SHA512)
+    set(imgtool_args --sha 512 ${imgtool_args})
+  endif()
+
   if(NOT "${keyfile}" STREQUAL "")
     set(imgtool_args -k "${keyfile}" ${imgtool_args})
   endif()

cmake/sysbuild/image_signing_installer.cmake

@@ -68,6 +68,13 @@ function(bm_install_tasks output_hex output_bin)
 #    set(imgtool_args --security-counter ${CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE})
 #  endif()
 
+  # Set proper hash calculation algorithm for signing
+  if(SB_CONFIG_BM_BOOT_IMG_HASH_ALG_PURE)
+    set(imgtool_args --pure ${imgtool_args})
+  elseif(SB_CONFIG_BM_BOOT_IMG_HASH_ALG_SHA512)
+    set(imgtool_args --sha 512 ${imgtool_args})
+  endif()
+
   if(NOT "${keyfile}" STREQUAL "")
     set(imgtool_args -k "${keyfile}" ${imgtool_args})
   endif()

sysbuild/CMakeLists.txt

@@ -26,6 +26,30 @@ function(bm_install_setup)
       # Enable LTO on MCUboot image
       add_overlay_config(mcuboot ${CMAKE_CURRENT_SOURCE_DIR}/image_configurations/lto.conf)
 
+      # Set up hash algorithm for MCUboot and images
+      if(SB_CONFIG_BM_BOOT_IMG_HASH_ALG_SHA256)
+        set_config_bool(mcuboot CONFIG_BOOT_SIGNATURE_TYPE_PURE n)
+        set_config_bool(mcuboot CONFIG_BOOT_IMG_HASH_ALG_SHA512 n)
+        set_config_bool(${DEFAULT_IMAGE} CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE n)
+        set_config_bool(${DEFAULT_IMAGE} CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 n)
+        set_config_bool(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE n)
+        set_config_bool(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 n)
+      elseif(SB_CONFIG_BM_BOOT_IMG_HASH_ALG_SHA512)
+        set_config_bool(mcuboot CONFIG_BOOT_SIGNATURE_TYPE_PURE n)
+        set_config_bool(mcuboot CONFIG_BOOT_IMG_HASH_ALG_SHA512 y)
+        set_config_bool(${DEFAULT_IMAGE} CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE n)
+        set_config_bool(${DEFAULT_IMAGE} CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 y)
+        set_config_bool(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE n)
+        set_config_bool(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 y)
+      elseif(SB_CONFIG_BM_BOOT_IMG_HASH_ALG_PURE)
+        set_config_bool(mcuboot CONFIG_BOOT_SIGNATURE_TYPE_PURE y)
+        set_config_bool(mcuboot CONFIG_BOOT_IMG_HASH_ALG_SHA512 n)
+        set_config_bool(${DEFAULT_IMAGE} CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE y)
+        set_config_bool(${DEFAULT_IMAGE} CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 n)
+        set_config_bool(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE y)
+        set_config_bool(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 n)
+      endif()
+
       if(SB_CONFIG_SOC_SERIES_NRF54LX)
         if(SB_CONFIG_BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_NONE)
           set_config_bool(mcuboot CONFIG_NRF_SECURITY y)

sysbuild/Kconfig.bm

@@ -67,6 +67,24 @@ config BM_BOOTLOADER_MCUBOOT_FIRMWARE_LOADER_ENTRANCE_BOOT_MODE
 
 endmenu
 
+choice BM_BOOTLOADER_MCUBOOT_IMG_HASH_ALG
+	prompt "Hashing algorithm"
+	default BM_BOOT_IMG_HASH_ALG_SHA512 if BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_ED25519 && SOC_SERIES_NRF54LX
+	default BM_BOOT_IMG_HASH_ALG_SHA256
+
+config BM_BOOT_IMG_HASH_ALG_SHA256
+	bool "SHA256"
+
+config BM_BOOT_IMG_HASH_ALG_SHA512
+	bool "SHA512"
+	depends on SOC_SERIES_NRF54LX
+
+config BM_BOOT_IMG_HASH_ALG_PURE
+	bool "Pure (hash of data directly without hash)"
+	depends on BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_ED25519 && SOC_SERIES_NRF54LX
+
+endchoice
+
 endmenu
 
 endif # BM_BOOTLOADER_MCUBOOT