Repository navigation
disable TZ for SBL on boot since no config. included - #57
Merged
JamesHuard merged 3 commits intoOct 23, 2026
Merged
JamesHuard merged 3 commits into
JamesHuard merged 3 commits into
Conversation
JamesHuard
approved these changes
Oct 22, 2026
JamesHuard
enabled auto-merge (squash)
October 22, 2026 15:05
jerrysxie
requested review from
JamesHuard and
felipebalbi
and
a balanced review from Copilot
October 22, 2026 15:35
JamesHuard
previously approved these changes
Oct 22, 2026
There was a problem hiding this comment.
🟢 Approval recommended
The single-field change matches the intended boot behavior, with successful secure-boot testing on EVK reported and no unresolved findings.
No open issues 🎉
What changed in this PR
Disables TrustZone preset enforcement in the MCXA provisioner’s CMPA configuration so the boot ROM can boot SBL without a supplied TrustZone configuration.
Changes:
- Sets
enf_tzm_presetto false while leaving the surrounding security settings unchanged.
| File | Description |
|---|---|
| libs/mcxa-security-provisioning/src/lib.rs | Disables TrustZone preset enforcement in CMPA. |
Review effort: Balanced
felipebalbi
requested changes
Oct 22, 2026
auto-merge was automatically disabled
October 22, 2026 18:11
Head branch was pushed to by a user without write access
felipebalbi
previously approved these changes
Oct 22, 2026
Author
|
@felipebalbi Sorry fmt issues, should be fixed. |
felipebalbi
approved these changes
Oct 22, 2026
JamesHuard
approved these changes
Oct 22, 2026
Contributor
ready to merge |
JamesHuard
merged commit Oct 23, 2026
54cc113
into
OpenDevicePartnership:mcxa-secure-boot
9 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One line changed in MCXA-SECURE-PROVISIONER
TZM was originally meant to be configured for SBL, which is why I had added it as "enforce" but we are not doing that. Which means on boot ROM looks for the config and then refuses to boot since we don't provide one.
Disable the TZ enforcement setting on CMPA.
Tested on EVK, boots fine with SB turned on when TZ disabled, no boot otherwise.