Skip to content

Conversation

@de-nordic
Copy link
Contributor

@de-nordic de-nordic commented Aug 8, 2025

The PR reverts introduction of HMAC-SHA512 selector and adds code that relies on existing Kconfig options and CMake changes to enforce HMAC-SHA512, when X25519 is used, on NR54L series devices.
One of commits is manifest update with required MCUboot changes.

test_sdk_mcuboot: grch_23868_hmac_sha512

@de-nordic de-nordic requested a review from a team as a code owner August 8, 2025 10:57
@github-actions github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Aug 8, 2025
@NordicBuilder
Copy link
Contributor

NordicBuilder commented Aug 8, 2025

CI Information

To view the history of this post, clich the 'edited' button above
Build number: 9

Inputs:

Sources:

more details

Github labels

Enabled Name Description
ci-disabled Disable the ci execution
ci-all-test Run all of ci, no test spec filtering will be done
ci-force-downstream Force execution of downstream even if twister fails
ci-run-twister Force run twister
ci-run-zephyr-twister Force run zephyr twister
List of changed files detected by CI (0)

Outputs:

Toolchain

Version:
Build docker image:

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

  • ❌ Toolchain
  • ❌ Build twister
  • ❌ Integration tests

Note: This message is automatically posted and updated by the CI

@de-nordic de-nordic added this to the 3.1.0 milestone Aug 8, 2025
@NordicBuilder
Copy link
Contributor

NordicBuilder commented Aug 8, 2025

Memory footprint analysis revealed the following potential issues

applications.hpf.gpio.icmsg[nrf54l15dk/nrf54l15/cpuflpr]: High RAM usage: 9090[B] - link (cc: @nrfconnect/ncs-ll-ursus)
applications.hpf.gpio.icmsg[nrf54l15dk/nrf54l15/cpuflpr]: High ROM usage: 5846[B] - link (cc: @nrfconnect/ncs-ll-ursus)
applications.hpf.gpio.icbmsg[nrf54l15dk/nrf54l15/cpuflpr]: High RAM usage: 12430[B] - link (cc: @nrfconnect/ncs-ll-ursus)
applications.hpf.gpio.icbmsg[nrf54l15dk/nrf54l15/cpuflpr]: High ROM usage: 9178[B] - link (cc: @nrfconnect/ncs-ll-ursus)

Note: This message is automatically posted and updated by the CI (latest/sdk-nrf/PR-23868/6)

@de-nordic de-nordic requested review from a team as code owners August 8, 2025 12:01
@NordicBuilder
Copy link
Contributor

NordicBuilder commented Aug 8, 2025

The following west manifest projects have changed revision in this Pull Request:

Name Old Revision New Revision Diff
mcuboot nrfconnect/sdk-mcuboot@09f09c4 nrfconnect/sdk-mcuboot@05a6339 (ncs-v3.1-branch) nrfconnect/[email protected]

All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

@github-actions
Copy link

github-actions bot commented Aug 8, 2025

You can find the documentation preview for this PR here.

@de-nordic de-nordic force-pushed the backport-23527-to-v3.1-branch branch 2 times, most recently from 5a53a56 to 2dbb268 Compare August 8, 2025 12:55
Copy link
Contributor

@gchwier gchwier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

test-sdk-mcuboot will fail on that PR, because release branch on test repo must be rebased. When this PR is merged, I will update test repo.
Tested locally and works ok.

Edit: created branch on test repo to apply changes required for that PR, all tests passed on test-sdk-mcuboot

@nvlsianpu
Copy link
Contributor

nvlsianpu commented Aug 11, 2025

Can be merge (after relevant updates) - see the Verification comment above.

@nordicjm nordicjm force-pushed the backport-23527-to-v3.1-branch branch from 2dbb268 to c844ee9 Compare August 11, 2025 13:15
@NordicBuilder NordicBuilder removed the DNM label Aug 11, 2025
Changes required to fix HMAC-SHA512 usage.

Signed-off-by: Dominik Ermel <[email protected]>
Removing Kconfig for HMAC-SHA512 as currently it can be replaced
with logic in CMake files and Kconfigs, so exposing direct control
over it is not needed; specifically that the HMAC-SHA512 is now
only enabled on NRF54L series with ECIES-X25519 key exchange,
other platforms are left with originally selected HMAC-SHA256.

This reverts commit 293252a.

Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 91d93d0)
Uncommitted changes to image_signing.cmake prevented HMAC-SHA512 usage
with ECIES-X25519, in image signing.

Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit c3e5321)
@nordicjm nordicjm force-pushed the backport-23527-to-v3.1-branch branch from c844ee9 to 4cbeba3 Compare August 11, 2025 13:23
@carlescufi carlescufi merged commit 4db971c into v3.1-branch Aug 11, 2025
9 checks passed
@karhama karhama deleted the backport-23527-to-v3.1-branch branch October 24, 2025 12:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. manifest manifest-mcuboot

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants