Skip to content

Commit 39a24a8

Browse files
kapi-nokapi-no
committed
samples: bluetooth: fast_pair: locator_tag: HW crypto MCUboot for nRF54L
Updated configurations for the nRF54L build targets in the Fast Pair Locator Tag sample to use HW crypto in the MCUboot bootloader. Aligned the partition layout of the affected targets to fit the MCUboot image into its partition and reserve the appropriate room for the eventual bootloader image growth in future NCS releases. This change breaks the backwards compatibility as it changes the MCUboot signature type from RSA to ED22519 and the layout of the partition map. Ref: NCSDK-30842 Signed-off-by: Kamil Piszczek <[email protected]>
1 parent 54b48c0 commit 39a24a8

File tree

11 files changed

+76
-39
lines changed

11 files changed

+76
-39
lines changed

‎doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -487,6 +487,13 @@ Bluetooth Fast Pair samples
487487
* The partition layout for the ``nrf5340dk/nrf5340/cpuapp/ns`` and ``thingy53/nrf5340/cpuapp/ns`` board targets to accommodate the partitions needed due to a change in the TF-M profile configuration.
488488
* The debug (default) configuration of the main image to enable the Link Time Optimization (LTO) with the :kconfig:option:`CONFIG_LTO` Kconfig option.
489489
This change ensures consistency with the sample release configuration that has the LTO feature enabled by default.
490+
* The ``nrf54l15dk/nrf54l15/cpuapp`` board target configuration to enable hardware cryptography for the MCUboot bootloader.
491+
The application image is verified using a pure ED25519 signature and the public key used by MCUboot for validating the application image is securely stored in the Key Management Unit (KMU) hardware peripheral.
492+
Support for the ``nrf54l15dk/nrf54l05/cpuapp`` and ``nrf54l15dk/nrf54l10/cpuapp`` board targets, which is added to this sample in this release iteration, also includes the same MCUboot bootloader configuration with the hardware cryptography enabled.
493+
494+
The change modifies the memory partition layout for the ``nrf54l15dk/nrf54l15/cpuapp`` board target and changes the MCUboot image signing algorithm.
495+
Because of that, the application images built for the ``nrf54l15dk/nrf54l15/cpuapp`` board target from this |NCS| release are not compatible with the MCUboot bootloader built from previous releases.
496+
It is highly recommended to use hardware cryptography for the nRF54L SoC Series for improved security.
490497

491498
Bluetooth Mesh samples
492499
----------------------

‎samples/bluetooth/fast_pair/locator_tag/configuration/pm_static_nrf54l15dk_nrf54l05_cpuapp_release.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,30 @@
11
mcuboot:
22
address: 0x0
33
region: flash_primary
4-
size: 0x5000
4+
size: 0x6000
55

66
mcuboot_primary:
7-
address: 0x5000
7+
address: 0x6000
88
orig_span: &id001
99
- app
1010
- mcuboot_pad
1111
region: flash_primary
12-
size: 0x3a000
12+
size: 0x39000
1313
span: *id001
1414
mcuboot_pad:
15-
address: 0x5000
15+
address: 0x6000
1616
region: flash_primary
1717
size: 0x800
1818
app:
19-
address: 0x5800
19+
address: 0x6800
2020
region: flash_primary
21-
size: 0x39800
21+
size: 0x38800
2222
mcuboot_primary_app:
23-
address: 0x5800
23+
address: 0x6800
2424
orig_span: &id002
2525
- app
2626
region: flash_primary
27-
size: 0x39800
27+
size: 0x38800
2828
span: *id002
2929

3030
mcuboot_secondary:
@@ -33,7 +33,7 @@ mcuboot_secondary:
3333
- mcuboot_secondary_pad
3434
- mcuboot_secondary_app
3535
region: flash_primary
36-
size: 0x3a000
36+
size: 0x39000
3737
span: *id003
3838
mcuboot_secondary_pad:
3939
region: flash_primary
@@ -42,14 +42,14 @@ mcuboot_secondary_pad:
4242
mcuboot_secondary_app:
4343
region: flash_primary
4444
address: 0x3f800
45-
size: 0x39800
45+
size: 0x38800
4646

4747
bt_fast_pair:
48-
address: 0x79000
48+
address: 0x78000
4949
region: flash_primary
5050
size: 0x1000
5151

5252
settings_storage:
53-
address: 0x7a000
53+
address: 0x79000
5454
region: flash_primary
55-
size: 0x3000
55+
size: 0x4000

‎samples/bluetooth/fast_pair/locator_tag/configuration/pm_static_nrf54l15dk_nrf54l10_cpuapp.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,34 @@
11
mcuboot:
22
address: 0x0
33
region: flash_primary
4-
size: 0x5000
4+
size: 0x6000
55

66
mcuboot_primary:
7-
address: 0x5000
7+
address: 0x6000
88
orig_span: &id001
99
- app
1010
- mcuboot_pad
1111
region: flash_primary
1212
size: 0x7a000
1313
span: *id001
1414
mcuboot_pad:
15-
address: 0x5000
15+
address: 0x6000
1616
region: flash_primary
1717
size: 0x800
1818
app:
19-
address: 0x5800
19+
address: 0x6800
2020
region: flash_primary
2121
size: 0x79800
2222
mcuboot_primary_app:
23-
address: 0x5800
23+
address: 0x6800
2424
orig_span: &id002
2525
- app
2626
region: flash_primary
2727
size: 0x79800
2828
span: *id002
2929

3030
mcuboot_secondary:
31-
address: 0x7f000
31+
address: 0x80000
3232
orig_span: &id003
3333
- mcuboot_secondary_pad
3434
- mcuboot_secondary_app
@@ -37,17 +37,17 @@ mcuboot_secondary:
3737
span: *id003
3838
mcuboot_secondary_pad:
3939
region: flash_primary
40-
address: 0x7f000
40+
address: 0x80000
4141
size: 0x800
4242
mcuboot_secondary_app:
4343
region: flash_primary
44-
address: 0x7f800
44+
address: 0x80800
4545
size: 0x79800
4646

4747
settings_storage:
48-
address: 0xf9000
48+
address: 0xfa000
4949
region: flash_primary
50-
size: 0x6000
50+
size: 0x5000
5151

5252
bt_fast_pair:
5353
address: 0xff000

‎samples/bluetooth/fast_pair/locator_tag/configuration/pm_static_nrf54l15dk_nrf54l15_cpuapp.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,34 @@
11
mcuboot:
22
address: 0x0
33
region: flash_primary
4-
size: 0x5000
4+
size: 0x6000
55

66
mcuboot_primary:
7-
address: 0x5000
7+
address: 0x6000
88
orig_span: &id001
99
- app
1010
- mcuboot_pad
1111
region: flash_primary
1212
size: 0xb8000
1313
span: *id001
1414
mcuboot_pad:
15-
address: 0x5000
15+
address: 0x6000
1616
region: flash_primary
1717
size: 0x800
1818
app:
19-
address: 0x5800
19+
address: 0x6800
2020
region: flash_primary
2121
size: 0xb7800
2222
mcuboot_primary_app:
23-
address: 0x5800
23+
address: 0x6800
2424
orig_span: &id002
2525
- app
2626
region: flash_primary
2727
size: 0xb7800
2828
span: *id002
2929

3030
mcuboot_secondary:
31-
address: 0xbd000
31+
address: 0xbe000
3232
orig_span: &id003
3333
- mcuboot_secondary_pad
3434
- mcuboot_secondary_app
@@ -37,19 +37,19 @@ mcuboot_secondary:
3737
span: *id003
3838
mcuboot_secondary_pad:
3939
region: flash_primary
40-
address: 0xbd000
40+
address: 0xbe000
4141
size: 0x800
4242
mcuboot_secondary_app:
4343
region: flash_primary
44-
address: 0xbd800
44+
address: 0xbe800
4545
size: 0xb7800
4646

4747
bt_fast_pair:
48-
address: 0x175000
48+
address: 0x176000
4949
region: flash_primary
5050
size: 0x1000
5151

5252
settings_storage:
53-
address: 0x176000
53+
address: 0x177000
5454
region: flash_primary
55-
size: 0x7000
55+
size: 0x6000

‎samples/bluetooth/fast_pair/locator_tag/sysbuild/CMakeLists.txt‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#
2-
# Copyright (c) 2024 Nordic Semiconductor
2+
# Copyright (c) 2024-2025 Nordic Semiconductor
33
#
44
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
55
#
@@ -11,3 +11,15 @@ set(SB_APPLICATION_CONFIG_DIR
1111
find_package(Sysbuild REQUIRED HINTS $ENV{ZEPHYR_BASE})
1212

1313
project(sysbuild LANGUAGES)
14+
15+
if(SB_CONFIG_MCUBOOT_SIGNATURE_USING_KMU)
16+
message(WARNING "
17+
------------------------------------------------------------------------------
18+
--- WARNING: MCUboot uses KMU stored keys for signature verification. Make ---
19+
--- sure to use `west ncs-provision` to manually provision the bootloader. ---
20+
--- Application would fail to boot if MCUboot is not provisioned. For more ---
21+
--- details, see the `Building and running` section from the Fast Pair ---
22+
--- Locator Tag Readme documentation. ---
23+
------------------------------------------------------------------------------
24+
")
25+
endif()

‎samples/bluetooth/fast_pair/locator_tag/sysbuild/configuration/nrf54l15dk_nrf54l05_cpuapp/boot_signature_key_file_ed25519.pem‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MC4CAQAwBQYDK2VwBCIEIEcuFYDHAHi5JE6PC8QVuREnCsrjJbX7L4EEnhLbsWbi
3+
-----END PRIVATE KEY-----

‎samples/bluetooth/fast_pair/locator_tag/sysbuild/configuration/nrf54l15dk_nrf54l05_cpuapp/sysbuild_release.conf‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,7 @@
66

77
SB_CONFIG_BOOTLOADER_MCUBOOT=y
88
SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP=y
9-
SB_CONFIG_BOOT_SIGNATURE_TYPE_RSA=y
9+
SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y
10+
SB_CONFIG_BOOT_SIGNATURE_TYPE_PURE=y
11+
SB_CONFIG_MCUBOOT_SIGNATURE_USING_KMU=y
12+
SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${SB_APPLICATION_CONFIG_DIR}/boot_signature_key_file_ed25519.pem"

‎samples/bluetooth/fast_pair/locator_tag/sysbuild/configuration/nrf54l15dk_nrf54l10_cpuapp/boot_signature_key_file_ed25519.pem‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MC4CAQAwBQYDK2VwBCIEIIOCRnU1f9KZzfITcihTytZaJgTP1XU/NCbVpElBm5m5
3+
-----END PRIVATE KEY-----

‎samples/bluetooth/fast_pair/locator_tag/sysbuild/configuration/nrf54l15dk_nrf54l10_cpuapp/sysbuild.conf‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,7 @@
66

77
SB_CONFIG_BOOTLOADER_MCUBOOT=y
88
SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP=y
9-
SB_CONFIG_BOOT_SIGNATURE_TYPE_RSA=y
9+
SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y
10+
SB_CONFIG_BOOT_SIGNATURE_TYPE_PURE=y
11+
SB_CONFIG_MCUBOOT_SIGNATURE_USING_KMU=y
12+
SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${SB_APPLICATION_CONFIG_DIR}/boot_signature_key_file_ed25519.pem"

‎samples/bluetooth/fast_pair/locator_tag/sysbuild/configuration/nrf54l15dk_nrf54l15_cpuapp/boot_signature_key_file_ed25519.pem‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MC4CAQAwBQYDK2VwBCIEIFjCntMdjT+ZREsWd4lxtVeCPBca2/+lGTXrU/CwgOhQ
3+
-----END PRIVATE KEY-----

0 commit comments

Comments
 (0)