sysbuild: Add KMU provisioning and allow KMU usage #357

nordicjm · 2025-09-12T07:52:43Z

Allows usage of KMU in MCUboot for the signature verification and copies the KMU provisioning script from NCS with changes for BM

github-actions · 2025-09-12T07:53:46Z

You can find the documentation preview for this PR here.

nordicjm · 2025-09-22T10:14:15Z

@nvlsianpu @michalek-no please review

nvlsianpu

LGTM, although can't build without patching.

nvlsianpu · 2025-09-23T12:54:52Z

doc/nrf-bm/app_dev/dfu/bootloader_keys.rst

doc is fine - can be tweaked by the writes based on NCS doc content,

nvlsianpu · 2025-09-23T15:30:44Z

sysbuild/Kconfig.bm

+config BM_BOOTLOADER_MCUBOOT_SIGNATURE_USING_KMU
+	bool "Use KMU stored keys for signature verification"
+	depends on SOC_SERIES_NRF54LX
+	depends on BOOT_SIGNATURE_TYPE_ED25519


shouldn't be depend on BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_ED25519 instead?

good shout, yes

nvlsianpu · 2025-09-23T15:37:50Z

sysbuild/Kconfig.bm

+
+config BM_BOOTLOADER_MCUBOOT_GENERATE_DEFAULT_KMU_KEYFILE
+	bool "Generate default keyfile for provisioning during build"
+	depends on MCUBOOT_SIGNATURE_USING_KMU


shouldn't be depend on above property?

nvlsianpu · 2025-09-23T16:13:35Z

With patches this PR will make provisioning working:

-- runners.nrfutil: Flashing file: /home/anpu/BM/nrf-bm/samples/boot/mcuboot_recovery_entry/build/mcuboot/zephyr/zephyr_signed_softdevice_flash_metadata.hex
-- runners.nrfutil: Provisioning key file: /home/anpu/BM/nrf-bm/samples/boot/mcuboot_recovery_entry/build/keyfile.json
-- runners.nrfutil: Erasing non-volatile memory (ERASEALL)
-- runners.nrfutil: Programming image
-- runners.nrfutil: Verifying image
-- runners.nrfutil: KEY Provision
-- runners.nrfutil: Board(s) with serial number(s) 1057721615 flashed successfully.
-- west flash: using runner nrfutil

althought application isn't booted

*** Booting MCUboot v2.1.0-dev-ecc13ac1b033 ***
*** Using nRF Connect SDK Bare Metal v0.8.99-9bd75658ed8d ***
I: Starting bootloader
E: Error: no bootable configuration found
E: Unable to find bootable image

I've used samples/boot/mcuboot_recovery_entry
@michalek-no Can you help with the issue?

nordicjm · 2025-09-24T06:18:56Z

With patches this PR will make provisioning working:

-- runners.nrfutil: Flashing file: /home/anpu/BM/nrf-bm/samples/boot/mcuboot_recovery_entry/build/mcuboot/zephyr/zephyr_signed_softdevice_flash_metadata.hex
-- runners.nrfutil: Provisioning key file: /home/anpu/BM/nrf-bm/samples/boot/mcuboot_recovery_entry/build/keyfile.json
-- runners.nrfutil: Erasing non-volatile memory (ERASEALL)
-- runners.nrfutil: Programming image
-- runners.nrfutil: Verifying image
-- runners.nrfutil: KEY Provision
-- runners.nrfutil: Board(s) with serial number(s) 1057721615 flashed successfully.
-- west flash: using runner nrfutil

althought application isn't booted

*** Booting MCUboot v2.1.0-dev-ecc13ac1b033 ***
*** Using nRF Connect SDK Bare Metal v0.8.99-9bd75658ed8d ***
I: Starting bootloader
E: Error: no bootable configuration found
E: Unable to find bootable image

I've used samples/boot/mcuboot_recovery_entry @michalek-no Can you help with the issue?

It won't boot because it programs UROT key and needs the sdk-mcuboot PR to be usable with the correct slot (think it was BTT or Frank that requested MCUboot use UROT key slots when b0 is not present). Have added manifest update

NordicBuilder · 2025-09-24T06:37:21Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
nrf	nrfconnect/sdk-nrf@`b1f505f`	nrfconnect/sdk-nrf@`f0af8f2`	nrfconnect/[email protected]

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

nvlsianpu · 2025-09-24T07:29:55Z

It won't boot because it programs UROT key and needs the sdk-mcuboot PR to be usable with the correct slot (think it was BTT or Frank that requested MCUboot use UROT key slots when b0 is not present). Have added manifest update

No, I checked that we hardcoded sdk-mcuboot to use URTO_PUBKEY.
BTW.: I did testing with both option BL/UROT_PUBKEY.

MirkoCovizzi · 2025-09-29T08:34:25Z

sysbuild/Kconfig.bm

+	bool "Use KMU stored keys for signature verification"
+	depends on SOC_SERIES_NRF54LX && BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_ED25519
+	help
+	  The device needs to be provisioned with proper set of keys.


Suggested change

The device needs to be provisioned with proper set of keys.

The device needs to be provisioned with the proper set of keys.

anhmolt · 2025-10-02T11:04:38Z

boards/nordic/bm_nrf54l15dk/bm_nrf54l15dk_nrf54l15_cpuapp_s115_softdevice_mcuboot.dts

 		};

-		slot0_partition: partition@b000 {
+		slot0_partition: partition@9c00 {


I'm not able to boot the application with this partition address. If I change the address to 0xa000 it starts fine.

I think the problem is that 0x9c00 is not 2KiB aligned. So assuming an image header of 2KiB, the interrupt table at the start of application is not properly aligned.

Same for L05 and L10.

Ah that might explain a problem then, I must have not rebuild and ran after reducing the sizes, will fix

anhmolt · 2025-10-02T11:13:22Z

doc/nrf-bm/app_dev/dfu/bootloader_keys.rst

+*************************
+
+The nRF54L series of SoCs contain a KMU - key management unit, this on-die peripheral can be used by CRACEN to securely store and use keys without allowing the contents to be read out.
+In order to boot images when the KMU feature is enabled, the MCUboot singing key must be programmed to the KMU prior to loading the firmware or the device will be unable to boot.


Suggested change

In order to boot images when the KMU feature is enabled, the MCUboot singing key must be programmed to the KMU prior to loading the firmware or the device will be unable to boot.

In order to boot images when the KMU feature is enabled, the MCUboot signing key must be programmed to the KMU prior to loading the firmware or the device will be unable to boot.

eivindj-nordic · 2025-10-02T12:26:12Z

boards/nordic/bm_nrf54l15dk/bm_nrf54l15dk_nrf54l05_cpuapp_s115_softdevice_mcuboot.dts

 		};

-		slot0_partition: partition@b000 {
+		/* Area from 0x9c00 to 0xa000 is unused due to alignment */


Should we add this to storage? E.g. as a 1k storage1_partition?
Or is there no point as we expect the boot_partition size to be further reduced?

It can be added to storage but will leave that to a future PR (the partitions might also be reworked in future to better utilise size)

This is now needed by sdk-zephyr Signed-off-by: Jamie McCrae <[email protected]>

Includes an sdk-mcuboot update to fix the slot IDs for KMU usage Signed-off-by: Jamie McCrae <[email protected]>

Allows usage of KMU in MCUboot for the signature verification and copies the KMU provisioning script from NCS with changes for BM Signed-off-by: Jamie McCrae <[email protected]>

Adds a KMU build of this sample Signed-off-by: Jamie McCrae <[email protected]>

Adds a section on how to use the KMU Signed-off-by: Jamie McCrae <[email protected]>

Disables some options including system clock support for MCUboot to reduce the size of the application as they are not needed Signed-off-by: Jamie McCrae <[email protected]>

Due to optimisations applied to MCUboot configuration, the size of the partition can be reduced to 31KiB which allows memory protection to be applied to the section using a single protection region, and even with logs enabled there is still spare space available in the slot Signed-off-by: Jamie McCrae <[email protected]>

The minimum sizes for release builds are now smaller Signed-off-by: Jamie McCrae <[email protected]>

nordicjm requested review from bjorn-tore-taraldsen, nvlsianpu and michalek-no September 12, 2025 07:52

nordicjm requested review from a team as code owners September 12, 2025 07:52

nordicjm added the DNM Do not merge label Sep 12, 2025

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Sep 12, 2025

nordicjm requested review from a team as code owners September 15, 2025 10:25

github-actions bot added the doc-required PR must not be merged without tech writer approval. label Sep 15, 2025

nordicjm removed the DNM Do not merge label Sep 22, 2025

nvlsianpu requested changes Sep 23, 2025

View reviewed changes

nordicjm force-pushed the kmuprovision branch from 9bd7565 to a2a3ed9 Compare September 24, 2025 06:36

github-actions bot added the manifest label Sep 24, 2025

nordicjm requested a review from nvlsianpu September 24, 2025 06:37

NordicBuilder added manifest-nrf DNM Do not merge labels Sep 24, 2025

nordicjm force-pushed the kmuprovision branch from a2a3ed9 to 9d573f8 Compare September 24, 2025 06:40

michalek-no approved these changes Sep 24, 2025

View reviewed changes

nordicjm force-pushed the kmuprovision branch from 9d573f8 to cc69fcd Compare September 24, 2025 08:55

nordicjm requested a review from a team as a code owner September 24, 2025 08:55

nordicjm force-pushed the kmuprovision branch from cd9d115 to 5e19161 Compare September 24, 2025 09:36

MirkoCovizzi reviewed Sep 29, 2025

View reviewed changes

nordicjm mentioned this pull request Oct 2, 2025

treewide: add support for S145 SoftDevice #408

Open

anhmolt reviewed Oct 2, 2025

View reviewed changes

nordicjm force-pushed the kmuprovision branch from 5e19161 to 0836419 Compare October 2, 2025 11:40

eivindj-nordic reviewed Oct 2, 2025

View reviewed changes

nordicjm added 8 commits October 7, 2025 14:44

scripts: requirements: Add python-dotenv to required python pacakges

4d470f2

This is now needed by sdk-zephyr Signed-off-by: Jamie McCrae <[email protected]>

manifest: Update sdk-nrf

ffa7618

Includes an sdk-mcuboot update to fix the slot IDs for KMU usage Signed-off-by: Jamie McCrae <[email protected]>

sysbuild: Add KMU provisioning and allow KMU usage

93aee28

Allows usage of KMU in MCUboot for the signature verification and copies the KMU provisioning script from NCS with changes for BM Signed-off-by: Jamie McCrae <[email protected]>

samples: boot: mcuboot_recovery_retention: Add KMU build

71e1c0b

Adds a KMU build of this sample Signed-off-by: Jamie McCrae <[email protected]>

doc: app_dev: dfu: bootloader_keys: Add section on KMU

b124956

Adds a section on how to use the KMU Signed-off-by: Jamie McCrae <[email protected]>

sysbuild: Add default (overridable) MCUboot Kconfigs without clock

f081eff

Disables some options including system clock support for MCUboot to reduce the size of the application as they are not needed Signed-off-by: Jamie McCrae <[email protected]>

doc: app_dev: dfu: Update minimum sizes for bootloader

08945ba

The minimum sizes for release builds are now smaller Signed-off-by: Jamie McCrae <[email protected]>

nordicjm force-pushed the kmuprovision branch from 0836419 to 08945ba Compare October 7, 2025 13:52

NordicBuilder removed the DNM Do not merge label Oct 7, 2025

nordicjm requested review from anhmolt and eivindj-nordic October 7, 2025 13:57

	The device needs to be provisioned with proper set of keys.
	The device needs to be provisioned with the proper set of keys.

	In order to boot images when the KMU feature is enabled, the MCUboot singing key must be programmed to the KMU prior to loading the firmware or the device will be unable to boot.
	In order to boot images when the KMU feature is enabled, the MCUboot signing key must be programmed to the KMU prior to loading the firmware or the device will be unable to boot.

sysbuild: Add KMU provisioning and allow KMU usage #357

Are you sure you want to change the base?

sysbuild: Add KMU provisioning and allow KMU usage #357

Uh oh!

Conversation

nordicjm commented Sep 12, 2025

Uh oh!

github-actions bot commented Sep 12, 2025

Uh oh!

nordicjm commented Sep 22, 2025

Uh oh!

nvlsianpu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nvlsianpu commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nordicjm commented Sep 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NordicBuilder commented Sep 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nvlsianpu commented Sep 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nvlsianpu commented Sep 23, 2025 •

edited

Loading

nordicjm commented Sep 24, 2025 •

edited

Loading

NordicBuilder commented Sep 24, 2025 •

edited

Loading

nvlsianpu commented Sep 24, 2025 •

edited

Loading