Skip to content

[nrf noup] zephyr: Move KMU base slot configuration to Kconfig #570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[nrf noup] zephyr: Move KMU base slot configuration to Kconfig #570

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 1 addition & 6 deletions boot/bootutil/src/ed25519_psa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,12 +27,7 @@ BOOT_LOG_MODULE_REGISTER(ed25519_psa);
/* List of KMU stored key ids available for MCUboot */
#define PSA_KEY_INDEX_SIZE 2

#if CONFIG_MCUBOOT_MCUBOOT_IMAGE_NUMBER != -1 || \
defined(CONFIG_NCS_BOOT_SIGNATURE_KMU_UROT_MAPPING)
#define PSA_KEY_STARTING_ID 226
#else
#define PSA_KEY_STARTING_ID 242
#endif
#define PSA_KEY_STARTING_ID CONFIG_NCS_BOOT_SIGNATURE_KMU_BASE_SLOT

#define MAKE_PSA_KMU_KEY_ID(id) PSA_KEY_HANDLE_FROM_CRACEN_KMU_SLOT(CRACEN_KMU_KEY_USAGE_SCHEME_RAW, id)
static psa_key_id_t key_ids[] = {
Expand Down
9 changes: 9 additions & 0 deletions boot/zephyr/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -446,6 +446,15 @@ config BOOT_KMU_KEYS_REVOCATION
help
Enabling KMU key revocation backend.

config NCS_BOOT_SIGNATURE_KMU_BASE_SLOT
int
depends on BOOT_SIGNATURE_USING_KMU
default 226 if NCS_BOOT_SIGNATURE_KMU_UROT_MAPPING
default 226 if MCUBOOT_MCUBOOT_IMAGE_NUMBER != -1
default 242
help
Base key identifier for KMU.

config NCS_BOOT_SIGNATURE_USING_ITS
bool "Use ITS stored keys for signature verification"
depends on NRF_SECURITY
Expand Down