bootloader: Enable NSIB SB_CLEANUP_RAM for nRF54L

ahasztag · ahasztag · commit 38c9f32f0b5c · 2025-10-21T09:08:49.000+02:00
The SB_CLEANUP_RAM was being blocked by the EXT_APIs,
which were enabled in the NSIB-s prj.conf

There are currently no use cases for EXT_APIs for nRF54L
and cleanup up RAM after NSIB finishes its work is an important
feature, so the part enabling the EXT_APIs needed to be removed
from the NSIB-s prj.conf

However, backwards compatibility with applications working
on nRF52 and nRF53 needed to be mantained, so the EXT_APIs
are now enabled by default in KConfings for the NSIB image
for these platforms. Note this change aligns with the EXT_APIs
documentation - in the documentation it is not described
how to enable the EXT_APIs in NSIB when adding a new custom
EXT_API. Now, the template will ensure it is enabled in
NSIB.

Signed-off-by: Artur Hadasz &lt;artur.hadasz@nordicsemi.no&gt;
diff --git a/doc/nrf/libraries/security/bootloader/fw_info.rst b/doc/nrf/libraries/security/bootloader/fw_info.rst
@@ -51,6 +51,9 @@ External APIs
 
 The firmware information structure allows for exchange of arbitrary tagged and versioned interfaces called *external APIs* (EXT_APIs).
 
+.. note::
+   The usage of EXT_APIs is currently only supported on nRF52 and nRF53 devices.
+
 An EXT_API structure is a structure consisting of a header followed by arbitrary data.
 The header consists of the following information:
 
diff --git a/samples/bootloader/prj.conf b/samples/bootloader/prj.conf
@@ -17,11 +17,6 @@ CONFIG_LOG_DEFAULT_LEVEL=0
 CONFIG_SECURE_BOOT_VALIDATION=y
 CONFIG_SECURE_BOOT_VALIDATION_LOG_LEVEL_INF=y
 CONFIG_SECURE_BOOT_STORAGE=y
-CONFIG_BL_ROT_VERIFY_EXT_API_ENABLED=y
-CONFIG_BL_SHA256_EXT_API_ENABLED=y
-CONFIG_BL_SECP256R1_EXT_API_ENABLED=y
-CONFIG_BL_VALIDATE_FW_EXT_API_ENABLED=y
-CONFIG_EXT_API_PROVIDE_EXT_API_ENABLED=y
 CONFIG_MAIN_STACK_SIZE=2048
 CONFIG_TIMEOUT_64BIT=n
 
diff --git a/samples/bootloader/prj_minimal.conf b/samples/bootloader/prj_minimal.conf
@@ -5,11 +5,6 @@
 #
 
 CONFIG_B0_MIN_PARTITION_SIZE=y
-CONFIG_BL_ROT_VERIFY_EXT_API_ENABLED=y
-CONFIG_BL_SECP256R1_EXT_API_ENABLED=y
-CONFIG_BL_SHA256_EXT_API_ENABLED=y
-CONFIG_BL_VALIDATE_FW_EXT_API_ENABLED=y
-CONFIG_EXT_API_PROVIDE_EXT_API_ENABLED=y
 CONFIG_FPROTECT=y
 CONFIG_FW_INFO=y
 CONFIG_IS_SECURE_BOOTLOADER=y
diff --git a/subsys/bootloader/Kconfig b/subsys/bootloader/Kconfig
@@ -100,6 +100,7 @@ config SB_BPROT_IN_DEBUG
 
 config SB_CLEANUP_RAM
 	bool "Perform RAM cleanup"
+	default y
 	depends on !FW_INFO_PROVIDE_ENABLE
 	depends on CPU_CORTEX_M4 || CPU_CORTEX_M33
 	help
diff --git a/subsys/bootloader/bl_boot/bl_boot.c b/subsys/bootloader/bl_boot/bl_boot.c
@@ -139,8 +139,8 @@ static void __ramfunc jump_in(uint32_t reset)
 		"   bx   r0\n"
 		:
 		: "r" (reset),
-		  "i" (CONFIG_SRAM_BASE_ADDRESS),
-		  "i" (CONFIG_SRAM_SIZE * 1024),
+		  "r" (CONFIG_SRAM_BASE_ADDRESS),
+		  "r" (CONFIG_SRAM_SIZE * 1024),
 		  "r" (CLEANUP_RAM_GAP_START),
 		  "r" (CLEANUP_RAM_GAP_SIZE),
 		  "i" (0)
diff --git a/subsys/fw_info/Kconfig.template.fw_info_ext_api b/subsys/fw_info/Kconfig.template.fw_info_ext_api
@@ -41,6 +41,7 @@ config $(EXT_API)_EXT_API_AT_LEAST_REQUIRED
 
 config $(EXT_API)_EXT_API_ENABLED
 	bool "Provide the $(EXT_API) EXT_API to other images"
+	default y if IS_SECURE_BOOTLOADER && (SOC_SERIES_NRF52X || SOC_NRF5340_CPUAPP)
 	select FW_INFO_PROVIDE_ENABLE
 	help
 	  Provide this EXT_API to other images.
