sysbuild: Add KMU provisioning and allow KMU usage #357

nordicjm · 2025-09-12T07:52:43Z

Allows usage of KMU in MCUboot for the signature verification and copies the KMU provisioning script from NCS with changes for BM

github-actions · 2025-09-12T07:53:46Z

You can find the documentation preview for this PR here.

nordicjm · 2025-09-22T10:14:15Z

@nvlsianpu @michalek-no please review

nvlsianpu

LGTM, although can't build without patching.

nvlsianpu · 2025-09-23T12:54:52Z

doc/nrf-bm/app_dev/dfu/bootloader_keys.rst

doc is fine - can be tweaked by the writes based on NCS doc content,

nvlsianpu · 2025-09-23T15:30:44Z

sysbuild/Kconfig.bm

+config BM_BOOTLOADER_MCUBOOT_SIGNATURE_USING_KMU
+	bool "Use KMU stored keys for signature verification"
+	depends on SOC_SERIES_NRF54LX
+	depends on BOOT_SIGNATURE_TYPE_ED25519


shouldn't be depend on BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_ED25519 instead?

good shout, yes

nvlsianpu · 2025-09-23T15:37:50Z

sysbuild/Kconfig.bm

+
+config BM_BOOTLOADER_MCUBOOT_GENERATE_DEFAULT_KMU_KEYFILE
+	bool "Generate default keyfile for provisioning during build"
+	depends on MCUBOOT_SIGNATURE_USING_KMU


shouldn't be depend on above property?

nvlsianpu · 2025-09-23T16:13:35Z

With patches this PR will make provisioning working:

-- runners.nrfutil: Flashing file: /home/anpu/BM/nrf-bm/samples/boot/mcuboot_recovery_entry/build/mcuboot/zephyr/zephyr_signed_softdevice_flash_metadata.hex
-- runners.nrfutil: Provisioning key file: /home/anpu/BM/nrf-bm/samples/boot/mcuboot_recovery_entry/build/keyfile.json
-- runners.nrfutil: Erasing non-volatile memory (ERASEALL)
-- runners.nrfutil: Programming image
-- runners.nrfutil: Verifying image
-- runners.nrfutil: KEY Provision
-- runners.nrfutil: Board(s) with serial number(s) 1057721615 flashed successfully.
-- west flash: using runner nrfutil

althought application isn't booted

*** Booting MCUboot v2.1.0-dev-ecc13ac1b033 ***
*** Using nRF Connect SDK Bare Metal v0.8.99-9bd75658ed8d ***
I: Starting bootloader
E: Error: no bootable configuration found
E: Unable to find bootable image

I've used samples/boot/mcuboot_recovery_entry
@michalek-no Can you help with the issue?

nordicjm · 2025-09-24T06:18:56Z

With patches this PR will make provisioning working:

-- runners.nrfutil: Flashing file: /home/anpu/BM/nrf-bm/samples/boot/mcuboot_recovery_entry/build/mcuboot/zephyr/zephyr_signed_softdevice_flash_metadata.hex
-- runners.nrfutil: Provisioning key file: /home/anpu/BM/nrf-bm/samples/boot/mcuboot_recovery_entry/build/keyfile.json
-- runners.nrfutil: Erasing non-volatile memory (ERASEALL)
-- runners.nrfutil: Programming image
-- runners.nrfutil: Verifying image
-- runners.nrfutil: KEY Provision
-- runners.nrfutil: Board(s) with serial number(s) 1057721615 flashed successfully.
-- west flash: using runner nrfutil

althought application isn't booted

*** Booting MCUboot v2.1.0-dev-ecc13ac1b033 ***
*** Using nRF Connect SDK Bare Metal v0.8.99-9bd75658ed8d ***
I: Starting bootloader
E: Error: no bootable configuration found
E: Unable to find bootable image

I've used samples/boot/mcuboot_recovery_entry @michalek-no Can you help with the issue?

It won't boot because it programs UROT key and needs the sdk-mcuboot PR to be usable with the correct slot (think it was BTT or Frank that requested MCUboot use UROT key slots when b0 is not present). Have added manifest update

NordicBuilder · 2025-09-24T06:37:21Z

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff
nrf	nrfconnect/sdk-nrf@`b1f505f`	nrfconnect/sdk-nrf@`f0af8f2`	nrfconnect/[email protected]

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

nvlsianpu · 2025-09-24T07:29:55Z

It won't boot because it programs UROT key and needs the sdk-mcuboot PR to be usable with the correct slot (think it was BTT or Frank that requested MCUboot use UROT key slots when b0 is not present). Have added manifest update

No, I checked that we hardcoded sdk-mcuboot to use URTO_PUBKEY.
BTW.: I did testing with both option BL/UROT_PUBKEY.

MirkoCovizzi · 2025-09-29T08:34:25Z

sysbuild/Kconfig.bm

+	bool "Use KMU stored keys for signature verification"
+	depends on SOC_SERIES_NRF54LX && BM_BOOTLOADER_MCUBOOT_SIGNATURE_TYPE_ED25519
+	help
+	  The device needs to be provisioned with proper set of keys.


Suggested change

The device needs to be provisioned with proper set of keys.

The device needs to be provisioned with the proper set of keys.

This is now needed by sdk-zephyr Signed-off-by: Jamie McCrae <[email protected]>

Includes an sdk-mcuboot update to fix the slot IDs for KMU usage Signed-off-by: Jamie McCrae <[email protected]>

eivindj-nordic · 2025-10-08T06:04:55Z

boards/nordic/bm_nrf54l15dk/bm_nrf54l15dk_nrf54l05_cpuapp_s115_softdevice_mcuboot.dts

+		slot0_partition: partition@a000 {
 			label = "slot0";
-			reg = <0x0000b000 DT_SIZE_K(282)>;
+			reg = <0x000a000 DT_SIZE_K(286)>;


The board yaml files must be updated.

eivindj-nordic · 2025-10-08T06:20:52Z

Changelog entry?

eivindj-nordic · 2025-10-08T06:58:43Z

~~What about the non-MCUboot board variants?~~
Never mind...

b-gent · 2025-10-09T07:29:51Z

doc/nrf-bm/app_dev/dfu/bootloader_keys.rst

 .. _ug_bootloader_keys_using:

 Using a key in a project
 ------------------------


Can you please change this and previous header underlines to asterisks (except for the main title of course)

Suggested change

------------------------

*************************

doc/nrf-bm/app_dev/dfu/bootloader_keys.rst

doc/nrf-bm/release_notes/release_notes_changelog.rst

doc/nrf-bm/app_dev/dfu/ug_dfu.rst

doc/nrf-bm/release_notes/release_notes_changelog.rst

Allows usage of KMU in MCUboot for the signature verification and copies the KMU provisioning script from NCS with changes for BM Signed-off-by: Jamie McCrae <[email protected]>

Enables storing the key in KMU. This means existing images from previous versions of BM are not compatible with the new configuration and must be manually changed to be compatile by using the built-in key instead, but KMU offers much greater protection of the key data and enhances security Signed-off-by: Jamie McCrae <[email protected]>

Adds a non-KMU (built-in key) build of this sample, which used to be the default in previous versions of BM Signed-off-by: Jamie McCrae <[email protected]>

Adds a section on how to use the KMU Signed-off-by: Jamie McCrae <[email protected]>

Disables some options including system clock support for MCUboot to reduce the size of the application as they are not needed Signed-off-by: Jamie McCrae <[email protected]>

Due to optimisations applied to MCUboot configuration, the size of the partition can be reduced to 31KiB which allows memory protection to be applied to the section using a single protection region, and even with logs enabled there is still spare space available in the slot Signed-off-by: Jamie McCrae <[email protected]>

The minimum sizes for release builds are now smaller Signed-off-by: Jamie McCrae <[email protected]>

Adds the recent changes to DFU to the documentation Signed-off-by: Jamie McCrae <[email protected]>

nordicjm requested review from bjorn-tore-taraldsen, michalek-no and nvlsianpu September 12, 2025 07:52

nordicjm requested review from a team as code owners September 12, 2025 07:52

nordicjm added the DNM Do not merge label Sep 12, 2025

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Sep 12, 2025

nordicjm requested a review from a team September 15, 2025 10:25

nordicjm requested a review from a team as a code owner September 15, 2025 10:25

github-actions bot added the doc-required PR must not be merged without tech writer approval. label Sep 15, 2025

nordicjm removed the DNM Do not merge label Sep 22, 2025

nvlsianpu requested changes Sep 23, 2025

View reviewed changes

nordicjm force-pushed the kmuprovision branch from 9bd7565 to a2a3ed9 Compare September 24, 2025 06:36

github-actions bot added the manifest label Sep 24, 2025

nordicjm requested a review from nvlsianpu September 24, 2025 06:37

NordicBuilder added manifest-nrf DNM Do not merge labels Sep 24, 2025

nordicjm force-pushed the kmuprovision branch from a2a3ed9 to 9d573f8 Compare September 24, 2025 06:40

michalek-no approved these changes Sep 24, 2025

View reviewed changes

nordicjm force-pushed the kmuprovision branch from 9d573f8 to cc69fcd Compare September 24, 2025 08:55

nordicjm requested a review from a team as a code owner September 24, 2025 08:55

nordicjm force-pushed the kmuprovision branch from cd9d115 to 5e19161 Compare September 24, 2025 09:36

MirkoCovizzi reviewed Sep 29, 2025

View reviewed changes

nordicjm mentioned this pull request Oct 2, 2025

treewide: add support for S145 SoftDevice #408

Merged

nordicjm added 2 commits October 7, 2025 14:44

scripts: requirements: Add python-dotenv to required python pacakges

4d470f2

This is now needed by sdk-zephyr Signed-off-by: Jamie McCrae <[email protected]>

manifest: Update sdk-nrf

ffa7618

Includes an sdk-mcuboot update to fix the slot IDs for KMU usage Signed-off-by: Jamie McCrae <[email protected]>

nordicjm force-pushed the kmuprovision branch from 0836419 to 08945ba Compare October 7, 2025 13:52

NordicBuilder removed the DNM Do not merge label Oct 7, 2025

nordicjm requested review from anhmolt and eivindj-nordic October 7, 2025 13:57

eivindj-nordic reviewed Oct 8, 2025

View reviewed changes

nordicjm force-pushed the kmuprovision branch 2 times, most recently from c555c2a to 0ac9ddd Compare October 9, 2025 06:32

nordicjm requested review from MirkoCovizzi and eivindj-nordic October 9, 2025 06:33

eivindj-nordic approved these changes Oct 9, 2025

View reviewed changes

b-gent requested changes Oct 9, 2025

View reviewed changes

nordicjm added 3 commits October 9, 2025 09:16

sysbuild: Add KMU provisioning and allow KMU usage

2b5ac89

Allows usage of KMU in MCUboot for the signature verification and copies the KMU provisioning script from NCS with changes for BM Signed-off-by: Jamie McCrae <[email protected]>

samples: boot: mcuboot_recovery_retention: Add non-KMU build

131ea28

Adds a non-KMU (built-in key) build of this sample, which used to be the default in previous versions of BM Signed-off-by: Jamie McCrae <[email protected]>

nordicjm force-pushed the kmuprovision branch from 0ac9ddd to f06edbf Compare October 9, 2025 08:33

nordicjm added 5 commits October 9, 2025 09:52

doc: app_dev: dfu: bootloader_keys: Add section on KMU

64793be

Adds a section on how to use the KMU Signed-off-by: Jamie McCrae <[email protected]>

sysbuild: Add default (overridable) MCUboot Kconfigs without clock

fdd5ccd

Disables some options including system clock support for MCUboot to reduce the size of the application as they are not needed Signed-off-by: Jamie McCrae <[email protected]>

doc: app_dev: dfu: Update minimum sizes for bootloader

2daeadf

The minimum sizes for release builds are now smaller Signed-off-by: Jamie McCrae <[email protected]>

doc: release_notes: Add changes on DFU

78fc8a3

Adds the recent changes to DFU to the documentation Signed-off-by: Jamie McCrae <[email protected]>

nordicjm force-pushed the kmuprovision branch from f06edbf to 78fc8a3 Compare October 9, 2025 08:53

nordicjm requested a review from b-gent October 9, 2025 08:54

nvlsianpu approved these changes Oct 9, 2025

View reviewed changes

b-gent approved these changes Oct 9, 2025

View reviewed changes

eivindj-nordic merged commit fe98516 into nrfconnect:main Oct 9, 2025
10 checks passed

nordicjm deleted the kmuprovision branch October 13, 2025 10:34

	The device needs to be provisioned with proper set of keys.
	The device needs to be provisioned with the proper set of keys.

sysbuild: Add KMU provisioning and allow KMU usage #357

sysbuild: Add KMU provisioning and allow KMU usage #357

Uh oh!

Conversation

nordicjm commented Sep 12, 2025

Uh oh!

github-actions bot commented Sep 12, 2025

Uh oh!

nordicjm commented Sep 22, 2025

Uh oh!

nvlsianpu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nvlsianpu commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nordicjm commented Sep 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NordicBuilder commented Sep 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nvlsianpu commented Sep 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eivindj-nordic commented Oct 8, 2025

Uh oh!

eivindj-nordic commented Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

nvlsianpu commented Sep 23, 2025 •

edited

Loading

nordicjm commented Sep 24, 2025 •

edited

Loading

NordicBuilder commented Sep 24, 2025 •

edited

Loading

nvlsianpu commented Sep 24, 2025 •

edited

Loading

eivindj-nordic commented Oct 8, 2025 •

edited

Loading