Skip to content

Mcuboot kmu experiments #260

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

Mcuboot kmu experiments #260

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d653580
samples: boot: Adjustments for mcuboot crypto
michalek-no Jul 7, 2025
e4cec36
Revert "sysbuild: Add support for MCUboot hashing algorithm"
Vge0rge Aug 12, 2025
47b00c6
Revert "sysbuild: Add support for ed25519 MCUboot images and make def…
Vge0rge Aug 12, 2025
d2f8f4f
manifest: Bring sdk-nrf with KMU fixes
Vge0rge Aug 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 0 additions & 7 deletions cmake/image_signing_softdevice.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,13 +52,6 @@ function(softdevice_tasks output_hex output_bin)
# set(imgtool_args --security-counter ${CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE})
# endif()

# Set proper hash calculation algorithm for signing
if(CONFIG_BOOT_SIGNATURE_TYPE_PURE)
set(imgtool_args --pure ${imgtool_args})
elseif(CONFIG_BOOT_IMG_HASH_ALG_SHA512)
set(imgtool_args --sha 512 ${imgtool_args})
endif()

if(NOT "${keyfile}" STREQUAL "")
set(imgtool_args -k "${keyfile}" ${imgtool_args})
endif()
Expand Down
7 changes: 0 additions & 7 deletions cmake/sysbuild/image_signing_installer.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,13 +68,6 @@ function(bm_install_tasks output_hex output_bin)
# set(imgtool_args --security-counter ${CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE})
# endif()

# Set proper hash calculation algorithm for signing
if(SB_CONFIG_BM_BOOT_IMG_HASH_ALG_PURE)
set(imgtool_args --pure ${imgtool_args})
elseif(SB_CONFIG_BM_BOOT_IMG_HASH_ALG_SHA512)
set(imgtool_args --sha 512 ${imgtool_args})
endif()

if(NOT "${keyfile}" STREQUAL "")
set(imgtool_args -k "${keyfile}" ${imgtool_args})
endif()
Expand Down
5 changes: 5 additions & 0 deletions samples/boot/mcuboot_recovery_retention/sysbuild.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
SB_CONFIG_BM_BOOTLOADER_MCUBOOT=y
SB_CONFIG_BM_FIRMWARE_LOADER_BT_MCUMGR=y
SB_CONFIG_SOFTDEVICE_S115=y
SB_CONFIG_BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_ED25519=y
SB_CONFIG_MCUBOOT_GENERATE_DEFAULT_KMU_KEYFILE=y
9 changes: 9 additions & 0 deletions samples/boot/mcuboot_recovery_retention/sysbuild/mcuboot.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,12 @@
CONFIG_RETAINED_MEM=y
CONFIG_RETENTION=y
CONFIG_RETENTION_BOOT_MODE=y
CONFIG_BOOT_FIRMWARE_LOADER_BOOT_MODE=y
CONFIG_NRF_SECURITY=y
CONFIG_MBEDTLS_PSA_CRYPTO_C=y
CONFIG_PSA_CORE_LITE=y
CONFIG_PSA_CORE_LITE_NSIB_ED25519_OPTIMIZATIONS=y
CONFIG_CRACEN_IKG=n
CONFIG_BOOT_SIGNATURE_USING_KMU=y
CONFIG_LTO=y
CONFIG_ISR_TABLES_LOCAL_DECLARATION=y
47 changes: 0 additions & 47 deletions sysbuild/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,53 +23,6 @@ function(bm_install_setup)

add_overlay_dts(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} ${CMAKE_CURRENT_SOURCE_DIR}/image_configurations/FIRMWARE_LOADER_image_default.overlay)

# Enable LTO on MCUboot image
add_overlay_config(mcuboot ${CMAKE_CURRENT_SOURCE_DIR}/image_configurations/lto.conf)

# Set up hash algorithm for MCUboot and images
if(SB_CONFIG_BM_BOOT_IMG_HASH_ALG_SHA256)
set_config_bool(mcuboot CONFIG_BOOT_SIGNATURE_TYPE_PURE n)
set_config_bool(mcuboot CONFIG_BOOT_IMG_HASH_ALG_SHA512 n)
set_config_bool(${DEFAULT_IMAGE} CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE n)
set_config_bool(${DEFAULT_IMAGE} CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 n)
set_config_bool(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE n)
set_config_bool(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 n)
elseif(SB_CONFIG_BM_BOOT_IMG_HASH_ALG_SHA512)
set_config_bool(mcuboot CONFIG_BOOT_SIGNATURE_TYPE_PURE n)
set_config_bool(mcuboot CONFIG_BOOT_IMG_HASH_ALG_SHA512 y)
set_config_bool(${DEFAULT_IMAGE} CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE n)
set_config_bool(${DEFAULT_IMAGE} CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 y)
set_config_bool(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE n)
set_config_bool(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 y)
elseif(SB_CONFIG_BM_BOOT_IMG_HASH_ALG_PURE)
set_config_bool(mcuboot CONFIG_BOOT_SIGNATURE_TYPE_PURE y)
set_config_bool(mcuboot CONFIG_BOOT_IMG_HASH_ALG_SHA512 n)
set_config_bool(${DEFAULT_IMAGE} CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE y)
set_config_bool(${DEFAULT_IMAGE} CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 n)
set_config_bool(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} CONFIG_MCUBOOT_BOOTLOADER_SIGNATURE_TYPE_PURE y)
set_config_bool(${SB_CONFIG_BM_FIRMWARE_LOADER_IMAGE_NAME} CONFIG_MCUBOOT_BOOTLOADER_USES_SHA512 n)
endif()

if(SB_CONFIG_SOC_SERIES_NRF54LX)
if(SB_CONFIG_BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_NONE)
set_config_bool(mcuboot CONFIG_NRF_SECURITY y)
elseif(SB_CONFIG_BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_ED25519)
set_config_bool(mcuboot CONFIG_NRF_SECURITY y)

# We are sure that ED25519 signature on MCUboot does not need these
set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_AEAD_DRIVER n)
set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_PAKE_DRIVER n)
set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_CIPHER_DRIVER n)
set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_MAC_DRIVER n)
set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_KEY_AGREEMENT_DRIVER n)
set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_KEY_DERIVATION_DRIVER n)
set_config_bool(mcuboot CONFIG_BOOT_HMAC_SHA512 n)
set_config_bool(mcuboot CONFIG_BOOT_SIGNATURE_USING_KMU n)
set_config_bool(mcuboot CONFIG_BOOT_KEY_IMPORT_BYPASS_ASN y)
set_config_bool(mcuboot CONFIG_PSA_USE_CRACEN_HASH_DRIVER y)
endif()
endif()

ExternalZephyrProject_Add(
APPLICATION installer
SOURCE_DIR ${ZEPHYR_NRF_BM_MODULE_DIR}/applications/installer
Expand Down
19 changes: 0 additions & 19 deletions sysbuild/Kconfig.bm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@ menu "MCUboot configuration"

choice BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE
prompt "Signature type"
default BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_ED25519 if SOC_SERIES_NRF54LX
default BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_RSA

config BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_NONE
Expand Down Expand Up @@ -67,24 +66,6 @@ config BM_BOOTLOADER_MCUBOOT_FIRMWARE_LOADER_ENTRANCE_BOOT_MODE

endmenu

choice BM_BOOTLOADER_MCUBOOT_IMG_HASH_ALG
prompt "Hashing algorithm"
default BM_BOOT_IMG_HASH_ALG_SHA512 if BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_ED25519 && SOC_SERIES_NRF54LX
default BM_BOOT_IMG_HASH_ALG_SHA256

config BM_BOOT_IMG_HASH_ALG_SHA256
bool "SHA256"

config BM_BOOT_IMG_HASH_ALG_SHA512
bool "SHA512"
depends on SOC_SERIES_NRF54LX

config BM_BOOT_IMG_HASH_ALG_PURE
bool "Pure (hash of data directly without hash)"
depends on BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_ED25519 && SOC_SERIES_NRF54LX

endchoice

endmenu

endif # BM_BOOTLOADER_MCUBOOT
Expand Down
2 changes: 0 additions & 2 deletions sysbuild/image_configurations/lto.conf
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion west.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ manifest:
projects:
- name: nrf
repo-path: sdk-nrf
revision: e9101127fc24a4bd5bf1b3067c78093182038d02
revision: pull/23870/head
import:
name-allowlist:
- cmsis_6
Expand Down
Loading