Skip to content

[Backport v3.0-branch] enabled ed25519/KMU for b0 on nrf54l and Cut down configuration for B0 #21551

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Apr 11, 2025
Merged

[Backport v3.0-branch] enabled ed25519/KMU for b0 on nrf54l and Cut down configuration for B0 #21551

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8d983d6
bootloader: Default to ed25519 and KMU for nrf54l b0
de-nordic Apr 4, 2025
aaf0ada
bootloader: bl_crypto: Switch to PSA-Lite for B0
de-nordic Apr 2, 2025
a7a642d
bootloader: Cut banner and events from configuration
de-nordic Apr 2, 2025
8e38321
lib: fprotect: Kconfig disable for B0 on nrf54L
michalek-no Apr 4, 2025
25562f1
tests: bootloader: Temporarily disable nrf54l15 with b0
de-nordic Apr 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions lib/fprotect/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ config FPROTECT_BLOCK_SIZE
menuconfig FPROTECT
bool "Enable FPROTECT"
depends on SOC_FAMILY_NORDIC_NRF
depends on !(SOC_SERIES_NRF54LX && IS_SECURE_BOOTLOADER)
select NRFX_RRAMC if SOC_SERIES_NRF54LX
help
Enable the software library FPROTECT that may or may not be used
Expand Down
6 changes: 6 additions & 0 deletions samples/bootloader/boards/nrf54l15dk_nrf54l15_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
CONFIG_CLOCK_CONTROL_NRF=n
CONFIG_NOTIFY=n
CONFIG_ONOFF=n

CONFIG_BOOT_BANNER=n
CONFIG_NCS_BOOT_BANNER=n
2 changes: 2 additions & 0 deletions samples/bootloader/src/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,10 @@
#if defined(CONFIG_FPROTECT)
#include <fprotect.h>
#else
#ifndef CONFIG_SOC_SERIES_NRF54LX
#warning "FPROTECT not enabled, the bootloader will be unprotected."
#endif
#endif
#include <bl_storage.h>
#include <bl_boot.h>
#include <bl_validation.h>
Expand Down
12 changes: 11 additions & 1 deletion subsys/bootloader/bl_crypto/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,11 +83,12 @@ config SB_CRYPTO_PSA_ED25519
depends on NRF_SECURITY
depends on CRACEN_LIB_KMU
select SB_ED25519
# Below depends on PSA_CORE_LITE
select PSA_CORE_LITE_NSIB_ED25519_OPTIMIZATIONS
select PSA_WANT_ALG_SHA_512
select PSA_WANT_ALG_PURE_EDDSA
select PSA_WANT_ECC_TWISTED_EDWARDS_255
select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
select MBEDTLS_ENABLE_HEAP
help
Use PSA crypto for ed25519 support.

Expand Down Expand Up @@ -116,6 +117,15 @@ config SB_CRYPTO_KMU_KEYS_REVOCATION
help
Automatically revoke previous generation key upon new valid key usage.

choice PSA_CORE
default PSA_CORE_LITE if SB_CRYPTO_PSA_ED25519
help
This is copy of PSA_CORE choice from NRF Security Kconfig, as the
only way to select an element from choice is to override default
for it.

endchoice

choice SB_CRYPTO_HASH
prompt "Hashing Implementation"
default SB_CRYPTO_NONE if SB_CRYPTO_PSA_ED25519
Expand Down
2 changes: 2 additions & 0 deletions sysbuild/Kconfig.secureboot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ config SECURE_BOOT_APPCORE_SUPPORTED_HASH_NONE
config SECURE_BOOT_APPCORE_SUPPORTED_SIGNATURE_HARDWARE
bool
default y if SECURE_BOOT_SIGNATURE_TYPE_ECDSA && (SOC_SERIES_NRF91X || SOC_NRF52840)
default y if SECURE_BOOT_SIGNATURE_TYPE_ED25519 && SOC_SERIES_NRF54LX

config SECURE_BOOT_APPCORE_SUPPORTED_SIGNATURE_SOFTWARE
bool
Expand Down Expand Up @@ -203,6 +204,7 @@ config SECURE_BOOT_SUPPORTED_SIGNATURE_ECDSA

config SECURE_BOOT_SUPPORTED_SIGNATURE_ED25519
bool
default y if SOC_SERIES_NRF54LX

choice SECURE_BOOT_HASH_TYPE
prompt "Hash type"
Expand Down
1 change: 1 addition & 0 deletions tests/subsys/bootloader/b0_lock/testcase.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,5 +6,6 @@ tests:
platform_allow: nrf54l15dk/nrf54l15/cpuapp
integration_platforms:
- nrf54l15dk/nrf54l15/cpuapp
build_only: true
tags:
- b0
2 changes: 0 additions & 2 deletions tests/subsys/bootloader/bl_storage/testcase.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,11 @@ tests:
bootloader.bl_storage:
sysbuild: true
platform_allow:
- nrf54l15dk/nrf54l15/cpuapp
- nrf5340dk/nrf5340/cpuapp
- nrf9151dk/nrf9151
- nrf9160dk/nrf9160
- nrf9161dk/nrf9161
integration_platforms:
- nrf54l15dk/nrf54l15/cpuapp
- nrf5340dk/nrf5340/cpuapp
- nrf9151dk/nrf9151
- nrf9160dk/nrf9160
Expand Down
1 change: 0 additions & 1 deletion tests/subsys/bootloader/boot_chains/testcase.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ common:
# MCUBoot enabled as well
- nrf52840dk/nrf52840
- nrf5340dk/nrf5340/cpuapp
- nrf54l15dk/nrf54l15/cpuapp
harness: console
harness_config:
type: one_line
Expand Down