NSIB support for nRF54LX series #16765

michalek-no · 2024-08-06T12:52:56Z

duplicate of #16079 due to CI failing over contributing author.

NordicBuilder · 2024-08-06T13:03:02Z

Test specification

CI/Jenkins/NRF

Integration Platforms

CI/Jenkins/integration

Test Module	File based changes	Manually selected
desktop52_verification	X
doc-internal	X
test-fw-nrfconnect-apps	X
test-fw-nrfconnect-ble_mesh	X
test-fw-nrfconnect-ble_samples	X
test-fw-nrfconnect-boot	X
test-fw-nrfconnect-chip	X
test-fw-nrfconnect-fem	X
test-fw-nrfconnect-nfc	X
test-fw-nrfconnect-nrf-iot_cloud	X
test-fw-nrfconnect-nrf-iot_libmodem-nrf	X
test-fw-nrfconnect-nrf-iot_lwm2m	X
test-fw-nrfconnect-nrf-iot_mosh	X
test-fw-nrfconnect-nrf-iot_nrf_provisioning	X	X
test-fw-nrfconnect-nrf-iot_positioning	X
test-fw-nrfconnect-nrf-iot_samples	X
test-fw-nrfconnect-nrf-iot_serial_lte_modem	X
test-fw-nrfconnect-nrf-iot_thingy91	X
test-fw-nrfconnect-nrf-iot_zephyr_lwm2m	X
test-fw-nrfconnect-nrf_crypto	X
test-fw-nrfconnect-proprietary_esb	X
test-fw-nrfconnect-ps	X
test-fw-nrfconnect-rpc	X
test-fw-nrfconnect-rs	X
test-fw-nrfconnect-tfm	X
test-fw-nrfconnect-thread	X
test-fw-nrfconnect-zigbee	X
test-low-level	X
test-sdk-audio	X
test-sdk-dfu	X
test-sdk-find-my	X
test-sdk-mcuboot	X
test-sdk-pmic-samples	X
test-sdk-sidewalk	X
test-sdk-wifi	X
test_ble_commit	X

All integration tests: null

Detailed information of selected test modules

Note: This message is automatically posted and updated by the CI

NordicBuilder · 2024-08-06T13:31:49Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publishing GitHub Action.

oyvindronningstad

Addititionally, please add the new platform(s) to tests/subsys/bootloader/bl_storage/testcase.yaml and update tests/subsys/bootloader/bl_storage/src/main.c to use the new typedefs.

oyvindronningstad · 2024-08-09T08:10:38Z

samples/bootloader/src/main.c

+	if (IS_ENABLED(CONFIG_FPROTECT)) {
+		err = fprotect_area(PM_B0_ADDRESS, PM_B0_SIZE);
+	} else {
+		printk("Fprotect disabled. No protection applied.\n\r");


When is this relevant? Is it even a valid configuration, or should if fail more loudly?

nRF54l15 won't use runtime setup for memory overwrite protection.

oyvindronningstad · 2024-08-09T08:12:13Z

scripts/bootloader/provision.py

@@ -132,6 +131,8 @@ def parse_args():
                        help="The MCUBOOT bootloader is used without the NSIB bootloader. Only the provision address, the MCUBOOT counters and the MCUBOOT counters slots arguments will be used.")
    parser.add_argument('--mcuboot-counters-slots', required=False, type=int, default=0,
                        help='Number of monotonic counter slots for every MCUBOOT counter.')
+    parser.add_argument('--lcs-state-size', required=False, type=lambda x: int(x, 0), default=0x8,
+                        help='Number of monotonic counter slots for every MCUBOOT counter.')


helptext needs updating

oyvindronningstad · 2024-08-09T08:15:15Z

scripts/bootloader/provision.py

@@ -153,8 +154,13 @@ def get_hashes(public_key_files, verify_hashes):


 def main():
+    global lcs_state_size


I think this should be refactored to not be a global variable. Making it a parameter to generate_mcuboot_only_provision_hex_file should be enough.

oyvindronningstad · 2024-08-09T08:20:13Z

include/bl_storage.h

-	uint16_t secure;
+	lcs_data_t provisioning;
+	lcs_data_t secure;
+#ifdef CONFIG_NRFX_NVMC


Not sure if it's a good idea to remove the padding. It's not needed for padding purposes, but will be needed if another state is added. Maybe @Vge0rge can chime in.

Maybe worth to add reserved for future usage field for RRAM based device as well then.
Just in case.

I agree that it's better to have a reserve word there in case we want to support another state later.

oyvindronningstad · 2024-08-09T08:23:25Z

include/bl_storage.h

@@ -238,6 +290,87 @@ NRFX_STATIC_INLINE void read_implementation_id_from_otp(uint8_t *buf)
 * This is a temporary solution until TF-M has access to NSIB functions.
 */

+#ifdef CONFIG_NRFX_RRAMC


Most of the added functions are basically internal functions, so I think it's less than ideal to have them in the header file. I guess there's precedent for it in this file though, so maybe not in scope to fix here, but maybe just give it a second thought.

nvlsianpu

checked that requests from original PR were fulfilled.

NordicBuilder · 2024-08-16T09:39:34Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 51

Inputs:

Sources:

sdk-nrf: PR head: 74cce6bc8c325137702fa6207d9aef3f0eb3ef94

more details

sdk-nrf:

PR head: 74cce6bc8c325137702fa6207d9aef3f0eb3ef94
merge base: 9e61aa7cab4435aba07b1eae019f7fb4ae2adaf2
target head (main): b5c963c841111e4ad93b52e05d9755141b03c3af
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (25)

cmake
│  ├── partition_manager.cmake
│  ├── sysbuild
│  │  ├── partition_manager.cmake
│  │  │ provision_hex.cmake
doc
│  ├── nrf
│  │  ├── libraries
│  │  │  ├── security
│  │  │  │  ├── bootloader
│  │  │  │  │  │ fw_info.rst
include
│  ├── bl_storage.h
│  ├── bl_validation.h
│  ├── fw_info.h
│  │ fw_info_bare.h
lib
│  ├── fprotect
│  │  │ Kconfig
│  ├── hw_unique_key
│  │  │ Kconfig
samples
│  ├── bootloader
│  │  ├── prj.conf
│  │  ├── prj_minimal.conf
│  │  ├── src
│  │  │  │ main.c
scripts
│  ├── bootloader
│  │  │ provision.py
subsys
│  ├── bootloader
│  │  ├── Kconfig
│  │  ├── bl_boot
│  │  │  │ bl_boot.c
│  │  ├── bl_storage
│  │  │  ├── Kconfig
│  │  │  │ bl_storage.c
│  │  ├── bl_validation
│  │  │  │ bl_validation.c
│  ├── fw_info
│  │  ├── Kconfig
│  │  │ fw_info.c
│  ├── partition_manager
│  │  │ pm.yml.secure_boot_storage
tests
│  ├── subsys
│  │  ├── bootloader
│  │  │  ├── bl_storage
│  │  │  │  ├── src
│  │  │  │  │  │ main.c
│  │  │  │  │ testcase.yaml
│  │  │  ├── boot_chains
│  │  │  │  │ testcase.yaml

Outputs:

Toolchain

Version: b44b7a08c9
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:b44b7a08c9_912848a074

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister - Skipped: Skipping Build & Test as it succeeded in a previous run: 50
✅ Integration tests
- ✅ test-sdk-audio - Skipped: Job was skipped as it succeeded in a previous run
- ✅ desktop52_verification - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-boot
- ✅ test-fw-nrfconnect-apps - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test_ble_nrf_config - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-ble_mesh
- ✅ test-fw-nrfconnect-ble_samples
- ✅ test-fw-nrfconnect-chip - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nfc - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_cloud - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_libmodem-nrf - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_zephyr_lwm2m - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_samples - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_lwm2m - Skipped: Job was skipped as it succeeded in a previous run
- ✅ doc-internal - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_thingy91 - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf_crypto - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-proprietary_esb - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-rpc - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-rs - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-fem
- ✅ test-fw-nrfconnect-tfm - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-thread - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-zigbee - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-find-my - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_mosh - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_positioning - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-sidewalk - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-wifi - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-low-level - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-fw-nrfconnect-nrf-iot_nrf_provisioning - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-pmic-samples - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-mcuboot - Skipped: Job was skipped as it succeeded in a previous run
- ✅ test-sdk-dfu - Skipped: Job was skipped as it succeeded in a previous run
- ⚠️ test-fw-nrfconnect-fw-update

Note: This message is automatically posted and updated by the CI

nvlsianpu · 2024-08-30T14:28:56Z

@michalek-no Can you rebase?

michalek-no · 2024-09-02T06:06:22Z

rebase

michalek-no · 2024-09-09T10:36:48Z

rebase

Since the vector table of nRF54LX series is larger than before using it is nice to have an offset between `0x400` and `0x800` to store `fw_info` in to ensure you can tightly pack your application together with firmware info. One downside of this is that this new offset is not supported in any older version of NSIB. Signed-off-by: Mateusz Michalek <[email protected]>

Added OTP region in partition manager for `nRF54L15X_ENGA` devices and modified the secure boot storage partition to use OTP for NRF54L15. Ref. NCSDK-25306 Signed-off-by: Mateusz Michalek <[email protected]>

Changed the implementation of bl_storage to be compatible with RRAMC and FLASH/NVMC. Due to the limitations in the RRAM controller OTP can only be written to by words not half-words as it can be in NVMC. This means we need to change the way we handle certain cases in `bl_storage.c`, `bl_validation.c` and `fw_info.c`. This commit moves some of the abstractions into two separate files `bl_storage_nvmc.c` and `bl_storage_rramc.c`. However there are multiple other changes needed which are done by using `#ifdef`'s. Ref. NCSDK-25306 Signed-off-by: Mateusz Michalek <[email protected]>

Changed the provisioning script to account for larger Life Cycle State structures. Since we can only do word writes in nRF54LX life cycle states needs to be stored in words. This increased the LCS struct by 1 word requiring us to change the way the provisioning script works. This change adds the LCS size as a value to the CMake file which uses the SOC to decide which size the LCS struct is which is then passed to the python script through the `--lcs-state-size` argument. Ref. NCSDK-25306 Signed-off-by: Mateusz Michalek <[email protected]> Signed-off-by: Sigurd Hellesvik <[email protected]>

Instead of just failing on compilation this commit changes fprotect requirements so that it prints out a warning and error in log. Signed-off-by: Mateusz Michalek <[email protected]>

Selects NRFX_RRAMC symbol required by fprotect RRAM backend on 54L15 platform. Signed-off-by: Mateusz Michalek <[email protected]>

Adds bl_storage tests. Signed-off-by: Mateusz Michalek <[email protected]>

Add nrf54l15dk to boot_chains configurations. Signed-off-by: Grzegorz Chwierut <[email protected]>

adds another UART's uninit call. Signed-off-by: Mateusz Michalek <[email protected]>

NRFX_NVMC is being selected conditionally as it is not the one and only memory backend anymore. Signed-off-by: Mateusz Michalek <[email protected]>

annwoj · 2024-11-05T07:34:09Z

release notes tba to the #18192 PR

frkv · 2024-11-05T13:38:52Z

samples/bootloader/src/main.c

-	int err = fprotect_area(PM_B0_ADDRESS, PM_B0_SIZE);
+	int err = 0;
+
+	if (IS_ENABLED(CONFIG_FPROTECT)) {


Why isn't this a ifdef?

frkv · 2024-11-05T13:39:28Z

subsys/bootloader/bl_boot/bl_boot.c

-	int err = fprotect_area(PM_PROVISION_ADDRESS, PM_PROVISION_SIZE);
+	int err = 0;
+
+	if (IS_ENABLED(CONFIG_FPROTECT)) {


Why isn't this an ifdef?

hellesvik-nordic

LGTM
I also tested dual bootloaders and MCUboot upgrade with this. That worked as expected.

nvlsianpu · 2024-11-05T14:39:40Z

@frkv We need to merge that ASAP. #Ifdefry can be improved later.

ns-tolu · 2024-11-05T14:47:22Z

agreed with @nvlsianpu to merge this PR to main only.

michalek-no requested review from nvlsianpu, de-nordic and gchwier August 6, 2024 12:52

michalek-no requested review from hakonfam, oyvindronningstad, anangl, rlubos, carlescufi, tejlmand and nordicjm as code owners August 6, 2024 12:52

github-actions bot added the doc-required PR must not be merged without tech writer approval. label Aug 6, 2024

michalek-no force-pushed the nsib_nrf54 branch from ccbb381 to 45acac7 Compare August 6, 2024 14:05

michalek-no requested review from frkv, Vge0rge and vili-nordic as code owners August 7, 2024 07:50

oyvindronningstad requested changes Aug 9, 2024

View reviewed changes

nvlsianpu mentioned this pull request Aug 9, 2024

NSIB support for nRF54LX series #16079

Closed

nvlsianpu reviewed Aug 9, 2024

View reviewed changes

michalek-no force-pushed the nsib_nrf54 branch from 43e2278 to a619902 Compare August 16, 2024 09:38

michalek-no force-pushed the nsib_nrf54 branch 3 times, most recently from ea131cb to f2c25e9 Compare August 20, 2024 07:49

michalek-no force-pushed the nsib_nrf54 branch from f2c25e9 to 3ba346d Compare September 2, 2024 06:06

michalek-no force-pushed the nsib_nrf54 branch from 3ba346d to c168216 Compare September 9, 2024 10:36

michalek-no force-pushed the nsib_nrf54 branch from a098069 to b043360 Compare November 4, 2024 12:55

michalek-no requested a review from nordicjm November 4, 2024 12:55

michalek-no force-pushed the nsib_nrf54 branch from b043360 to 3d66ec5 Compare November 4, 2024 14:24

nvlsianpu approved these changes Nov 4, 2024

View reviewed changes

michalek-no and others added 10 commits November 5, 2024 08:30

cmake: partition_manager: Add OTP region in partition manager for nRF54L

8f51ae6

Added OTP region in partition manager for `nRF54L15X_ENGA` devices and modified the secure boot storage partition to use OTP for NRF54L15. Ref. NCSDK-25306 Signed-off-by: Mateusz Michalek <[email protected]>

bootloader: Fix up lacking fprotect guards

3a2a8bd

Instead of just failing on compilation this commit changes fprotect requirements so that it prints out a warning and error in log. Signed-off-by: Mateusz Michalek <[email protected]>

lib: fprotect: enable RRAMC low level backend

95dccfa

Selects NRFX_RRAMC symbol required by fprotect RRAM backend on 54L15 platform. Signed-off-by: Mateusz Michalek <[email protected]>

tests: bl_storage: nrf54l15

187f9e7

Adds bl_storage tests. Signed-off-by: Mateusz Michalek <[email protected]>

tests: boot_chains: enable nrf54l15dk

c5844e7

Add nrf54l15dk to boot_chains configurations. Signed-off-by: Grzegorz Chwierut <[email protected]>

bootloader: bl_boot: uninit of UARTE20

2e423d8

adds another UART's uninit call. Signed-off-by: Mateusz Michalek <[email protected]>

Kconfigs: adjust selection of NRFX_NVMC

74cce6b

NRFX_NVMC is being selected conditionally as it is not the one and only memory backend anymore. Signed-off-by: Mateusz Michalek <[email protected]>

michalek-no force-pushed the nsib_nrf54 branch from 3d66ec5 to 74cce6b Compare November 5, 2024 07:30

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Nov 5, 2024

annwoj added this to the 2.8.0 milestone Nov 5, 2024

nordicjm approved these changes Nov 5, 2024

View reviewed changes

annwoj approved these changes Nov 5, 2024

View reviewed changes

divipillai added the backport v2.8-branch auto-create a PR with same commits to v2.8-branch label Nov 5, 2024

frkv reviewed Nov 5, 2024

View reviewed changes

hellesvik-nordic approved these changes Nov 5, 2024

View reviewed changes

rlubos removed the backport v2.8-branch auto-create a PR with same commits to v2.8-branch label Nov 5, 2024

rlubos removed this from the 2.8.0 milestone Nov 5, 2024

rlubos merged commit f27f49d into nrfconnect:main Nov 5, 2024
16 checks passed

divipillai mentioned this pull request Nov 5, 2024

doc: Add release notes for 2.8 release #18192

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

NSIB support for nRF54LX series #16765

NSIB support for nRF54LX series #16765

michalek-no commented Aug 6, 2024

NordicBuilder commented Aug 6, 2024 •

edited

Loading

NordicBuilder commented Aug 6, 2024

oyvindronningstad left a comment •

edited

Loading

oyvindronningstad Aug 9, 2024

nvlsianpu Aug 9, 2024

oyvindronningstad Aug 9, 2024

oyvindronningstad Aug 9, 2024

oyvindronningstad Aug 9, 2024

nvlsianpu Aug 9, 2024

Vge0rge Aug 14, 2024

oyvindronningstad Aug 9, 2024

nvlsianpu left a comment

NordicBuilder commented Aug 16, 2024 •

edited

Loading

nvlsianpu commented Aug 30, 2024

michalek-no commented Sep 2, 2024

michalek-no commented Sep 9, 2024

annwoj commented Nov 5, 2024

frkv Nov 5, 2024

frkv Nov 5, 2024

hellesvik-nordic left a comment

nvlsianpu commented Nov 5, 2024

ns-tolu commented Nov 5, 2024

		@@ -153,8 +154,13 @@ def get_hashes(public_key_files, verify_hashes):


		def main():
		global lcs_state_size

NSIB support for nRF54LX series #16765

NSIB support for nRF54LX series #16765

Conversation

michalek-no commented Aug 6, 2024

NordicBuilder commented Aug 6, 2024 • edited Loading

Test specification

NordicBuilder commented Aug 6, 2024

oyvindronningstad left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nvlsianpu left a comment

Choose a reason for hiding this comment

NordicBuilder commented Aug 16, 2024 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

nvlsianpu commented Aug 30, 2024

michalek-no commented Sep 2, 2024

michalek-no commented Sep 9, 2024

annwoj commented Nov 5, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hellesvik-nordic left a comment

Choose a reason for hiding this comment

nvlsianpu commented Nov 5, 2024

ns-tolu commented Nov 5, 2024

NordicBuilder commented Aug 6, 2024 •

edited

Loading

oyvindronningstad left a comment •

edited

Loading

NordicBuilder commented Aug 16, 2024 •

edited

Loading