enabled ed25519/KMU for b0 on nrf54l and Cut down configuration for B0 #21310

de-nordic · 2025-04-02T11:00:53Z

WARNING: The PR has changed with addition of defaulting ed25519/KMU in b0. That commit was not there previously as the base PR used for this has been enabling such configurations.
The original purpose of the cut down was to fit the PSA hardware crypto, so it would not make sense to keep the PR unless we now enable the ed25519 here.

This configuration allows B0 to use PSA crypto while still being able to fit into FPROTECT area.

Only three top commits.

~~Depends on #20812~~

For CI to test from branch:
test_boot: testing_21310_b0_on_nrf54l

NordicBuilder · 2025-04-02T11:02:11Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

NordicBuilder · 2025-04-02T11:07:14Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 21

Inputs:

Sources:

sdk-nrf: PR head: bc57393e16452f23f89c55edc0b0a3790698ecff

more details

sdk-nrf:

PR head: bc57393e16452f23f89c55edc0b0a3790698ecff
merge base: 578095f45245789ca5e45d29a5f13fc8e0f11e59
target head (main): 58a92a8f382fc6a52813e36508aa1a8c46a2a5e7
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (8)

lib
│  ├── fprotect
│  │  │ Kconfig
samples
│  ├── bootloader
│  │  ├── boards
│  │  │  │ nrf54l15dk_nrf54l15_cpuapp.conf
│  │  ├── src
│  │  │  │ main.c
subsys
│  ├── bootloader
│  │  ├── bl_crypto
│  │  │  │ Kconfig
sysbuild
│  │ Kconfig.secureboot
tests
│  ├── subsys
│  │  ├── bootloader
│  │  │  ├── b0_lock
│  │  │  │  │ testcase.yaml
│  │  │  ├── bl_storage
│  │  │  │  │ testcase.yaml
│  │  │  ├── boot_chains
│  │  │  │  │ testcase.yaml

Outputs:

Toolchain

Version: 7cbc0036f4
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:7cbc0036f4_8bf7ca4353

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister - Skipped: Skipping Build & Test as it succeeded in a previous run: 18
✅ Integration tests
- ✅ test-sdk-audio - Skipped: Job was skipped as it succeeded in a previous run
- ✅ desktop52_verification - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-boot - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-apps - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test_ble_nrf_config - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-ble_mesh - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-ble_samples - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-chip - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nfc - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_cloud - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_libmodem-nrf - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_serial_lte_modem - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_zephyr_lwm2m - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_samples - Skipped: Job was skipped as it succeeded in a previous run
- ✅ doc-internal - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_thingy91 - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf_crypto - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-proprietary_esb - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-rpc - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-rs - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-fem - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-tfm - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-thread - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-find-my - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_mosh - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_positioning - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-wifi - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-low-level - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-pmic-samples - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-mcuboot - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-dfu - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-ps - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-secdom-samples-public - Skipped: Job was skipped as it succeeded in a previous run
- ⚠️ test-fw-nrfconnect-fw-update

Note: This message is automatically posted and updated by the CI

github-actions · 2025-04-02T11:25:27Z

You can find the documentation preview for this PR here.

nvlsianpu

approved pluto's commits

subsys/bootloader/bl_crypto/Kconfig

Vge0rge · 2025-04-03T11:41:34Z

subsys/bootloader/Kconfig

Just for my own shake, why do we set a different size depending on the FPROTECT?

If you disable FPROTECT you can fit more into b0, because fprotect can only protect 31k.
So, for example, if you want to enable a lot of stuff to debug, you may not fit in the FPROTECT area and need to disable it, then it automatically also brings the size of allowed code up.

Vge0rge

This PR basically includes PR 20812. I reviewed the last commits which set the configuration of the PSA_CORE_LITE and they seem OK to me.

de-nordic · 2025-04-03T11:49:32Z

This PR basically includes PR 20812. I reviewed the last commits which set the configuration of the PSA_CORE_LITE and they seem OK to me.

Yes. That PR is required for the change to work.

sysbuild/Kconfig.secureboot

tests/subsys/bootloader/b0_lock/testcase.yaml

nordicjm · 2025-04-07T10:34:04Z

samples/bootloader/prj.conf

should not be applying this for everything, add a boards/<board> Kconfig fragment, and it should have a file suffix because people expect the default one to all act the same way which is with logging

The commit defaults to usage of ed25519 signature with KMU, when building b0 for nrf54l. Signed-off-by: Dominik Ermel <[email protected]>

Configuration options that enable PSA lite with B0 NSIB. Signed-off-by: Dominik Ermel <[email protected]>

Cuts NCS banner and events/notifications to further reduce size. Signed-off-by: Dominik Ermel <[email protected]>

temporarily diabled Signed-off-by: Mateusz Michalek <[email protected]>

Testing requires upload of KMU keys, which is currently not available. Signed-off-by: Dominik Ermel <[email protected]>

frkv

LGTM

de-nordic requested review from a team as code owners April 2, 2025 11:00

de-nordic requested review from frkv and nvlsianpu April 2, 2025 11:01

github-actions bot added the manifest label Apr 2, 2025

NordicBuilder added manifest-zephyr DNM labels Apr 2, 2025

nvlsianpu added this to the 3.0.0 milestone Apr 2, 2025

de-nordic requested a review from a team April 2, 2025 15:09

nvlsianpu approved these changes Apr 2, 2025

View reviewed changes

de-nordic force-pushed the optimus branch from 3e91495 to 668faea Compare April 3, 2025 08:03

nordicjm reviewed Apr 3, 2025

View reviewed changes

subsys/bootloader/bl_crypto/Kconfig Outdated Show resolved Hide resolved

subsys/bootloader/bl_crypto/Kconfig Outdated Show resolved Hide resolved

de-nordic force-pushed the optimus branch 2 times, most recently from 38e5b4a to ee93a8a Compare April 3, 2025 11:24

github-actions bot removed the manifest label Apr 3, 2025

NordicBuilder removed manifest-zephyr DNM labels Apr 3, 2025

Vge0rge reviewed Apr 3, 2025

View reviewed changes

Vge0rge self-requested a review April 3, 2025 11:42

Vge0rge approved these changes Apr 3, 2025

View reviewed changes

de-nordic force-pushed the optimus branch 2 times, most recently from 5072008 to edb8b76 Compare April 3, 2025 13:33

de-nordic requested a review from nordicjm April 3, 2025 13:35

de-nordic force-pushed the optimus branch from 578dfe9 to 314a0d3 Compare April 3, 2025 20:29

de-nordic force-pushed the optimus branch from 314a0d3 to ec3a569 Compare April 4, 2025 13:46

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Apr 4, 2025

de-nordic force-pushed the optimus branch 3 times, most recently from f9d2fd5 to 8c6640e Compare April 4, 2025 16:47

de-nordic changed the title ~~Cut down configuration for B0~~ enabled ed25519/KMU for b0 on nrf54l and Cut down configuration for B0 Apr 4, 2025

de-nordic requested review from Vge0rge and nvlsianpu April 4, 2025 16:50

nvlsianpu reviewed Apr 4, 2025

View reviewed changes

sysbuild/Kconfig.secureboot Outdated Show resolved Hide resolved

michalek-no mentioned this pull request Apr 4, 2025

lib: fprotect: Kconfig disable for B0 on nrf54L #21428

Closed

gchwier reviewed Apr 7, 2025

View reviewed changes

tests/subsys/bootloader/b0_lock/testcase.yaml Outdated Show resolved Hide resolved

michalek-no force-pushed the optimus branch from 8c6640e to 3bd50f1 Compare April 7, 2025 08:56

nordicjm reviewed Apr 7, 2025

View reviewed changes

de-nordic and others added 5 commits April 7, 2025 13:59

bootloader: Default to ed25519 and KMU for nrf54l b0

509df7d

The commit defaults to usage of ed25519 signature with KMU, when building b0 for nrf54l. Signed-off-by: Dominik Ermel <[email protected]>

bootloader: bl_crypto: Switch to PSA-Lite for B0

bb69dd8

Configuration options that enable PSA lite with B0 NSIB. Signed-off-by: Dominik Ermel <[email protected]>

bootloader: Cut banner and events from configuration

28aa5b3

Cuts NCS banner and events/notifications to further reduce size. Signed-off-by: Dominik Ermel <[email protected]>

lib: fprotect: Kconfig disable for B0 on nrf54L

ee5f354

temporarily diabled Signed-off-by: Mateusz Michalek <[email protected]>

tests: bootloader: Temporarily disable nrf54l15 with b0

bc57393

Testing requires upload of KMU keys, which is currently not available. Signed-off-by: Dominik Ermel <[email protected]>

michalek-no force-pushed the optimus branch from 3bd50f1 to bc57393 Compare April 7, 2025 11:59

gchwier approved these changes Apr 8, 2025

View reviewed changes

nvlsianpu added the backport v3.0-branch label Apr 8, 2025

frkv approved these changes Apr 8, 2025

View reviewed changes

de-nordic requested a review from nordicjm April 8, 2025 14:21

Vge0rge approved these changes Apr 8, 2025

View reviewed changes

carlescufi merged commit f4c0cc0 into nrfconnect:main Apr 8, 2025
16 checks passed

NordicBuilder mentioned this pull request Apr 8, 2025

[Backport v3.0-branch] enabled ed25519/KMU for b0 on nrf54l and Cut down configuration for B0 #21551

Merged

enabled ed25519/KMU for b0 on nrf54l and Cut down configuration for B0 #21310

enabled ed25519/KMU for b0 on nrf54l and Cut down configuration for B0 #21310

Uh oh!

Conversation

de-nordic commented Apr 2, 2025 • edited by gchwier Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NordicBuilder commented Apr 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NordicBuilder commented Apr 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Uh oh!

github-actions bot commented Apr 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nvlsianpu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Vge0rge Apr 3, 2025

Choose a reason for hiding this comment

Uh oh!

de-nordic Apr 3, 2025

Choose a reason for hiding this comment

Uh oh!

Vge0rge left a comment

Choose a reason for hiding this comment

Uh oh!

de-nordic commented Apr 3, 2025

Uh oh!

Uh oh!

Uh oh!

nordicjm Apr 7, 2025

Choose a reason for hiding this comment

Uh oh!

frkv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

de-nordic commented Apr 2, 2025 •

edited by gchwier

Loading

NordicBuilder commented Apr 2, 2025 •

edited

Loading

NordicBuilder commented Apr 2, 2025 •

edited

Loading

github-actions bot commented Apr 2, 2025 •

edited

Loading