Skip to content

Commit 2779930

Browse files
MarkusLassilaMarkusLassila
committed
samples: tfm: psa_template: Add support for netcore update
Add support for updating network core with nRF5340. External flash will be used for update images. NCSDK-17920 Signed-off-by: Markus Lassila <[email protected]>
1 parent c83fad1 commit 2779930

File tree

9 files changed

+198
-4
lines changed

9 files changed

+198
-4
lines changed

‎doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -670,6 +670,11 @@ Trusted Firmware-M (TF-M) samples
670670

671671
* Replaced support for the ``nrf54l15pdk/nrf54l15/cpuapp/ns`` board target with ``nrf54l15dk/nrf54l15/cpuapp/ns``.
672672

673+
* :ref:`tfm_psa_template` sample:
674+
675+
* Added support for updating the network core on the nRF5340 DK.
676+
677+
673678
Thread samples
674679
--------------
675680

‎samples/tfm/tfm_psa_template/Kconfig.sysbuild‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#
2+
# Copyright (c) 2024 Nordic Semiconductor
3+
#
4+
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
#
6+
7+
source "${ZEPHYR_BASE}/share/sysbuild/Kconfig"
8+
9+
if BOARD_NRF5340DK_NRF5340_CPUAPP_NS
10+
11+
choice NETCORE
12+
default NETCORE_EMPTY
13+
endchoice
14+
15+
config SECURE_BOOT_NETCORE
16+
default y
17+
18+
config NETCORE_APP_UPDATE
19+
default y
20+
21+
config MCUBOOT_APP_SYNC_UPDATEABLE_IMAGES
22+
default y
23+
24+
config PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY
25+
default y
26+
27+
config MCUBOOT_USE_ALL_AVAILABLE_RAM
28+
default y
29+
30+
endif

‎samples/tfm/tfm_psa_template/README.rst‎

Lines changed: 91 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ This sample uses Trusted Firmware-M, nRF Secure Immutable bootloader and MCUboot
2525
It includes provisioning the device with keys and being able to perform a device firmware update.
2626
The sample prints information about the identity of the device and the firmware versions that are currently running.
2727

28+
On the nRF5340 devices, this sample also includes the :ref:`B0n bootloader <nc_bootloader>` and the :ref:`empty_net_core <nrf5340_empty_net_core>` image for demonstrating the network core firmware update process.
29+
2830
Building and running
2931
********************
3032

@@ -38,7 +40,7 @@ Build and flash the provisioning image sample to provision the device with the P
3840
.. code-block:: console
3941
4042
west build -b nrf5340dk/nrf5340/cpuapp nrf/samples/tfm/provisioning_image -d build_provisioning_image
41-
west flash --erase -d build_provisioning_image
43+
west flash --erase --recover -d build_provisioning_image
4244
4345
Build and flash the TF-M PSA template sample.
4446
Do not flash with ``--erase`` as this will erase the PSA platform security parameters and they will be lost.
@@ -145,6 +147,10 @@ See :ref:`ug_fw_update_keys` for more information on how to generate and use key
145147
The bootloader and the application can be updated using the :file:`mcumgr` command-line tool.
146148
See :zephyr:code-sample:`smp-svr` for installation and usage instructions.
147149

150+
.. note::
151+
152+
Remember to rebuild the sample with the updated keys before proceeding with the firmware update.
153+
148154
Application and TF-M firmware update
149155
====================================
150156

@@ -189,7 +195,7 @@ To upload a new bootloader image, build a bootloader targeting the correct bootl
189195

190196
.. code-block:: console
191197
192-
west build -b nrf5340dk/nrf5340/cpuapp/ns nrf/samples/tfm/tfm_psa_template \
198+
west build -b nrf5340dk/nrf5340/cpuapp/ns nrf/samples/tfm/tfm_psa_template -d build_update \
193199
-Dmcuboot_CONFIG_FW_INFO_FIRMWARE_VERSION=2
194200
195201
List the current firmware images and upload a bootloader image that targets the non-active bootloader slot.
@@ -198,7 +204,7 @@ List the current firmware images and upload a bootloader image that targets the
198204
199205
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 image list
200206
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 image upload \
201-
build/signed_by_mcuboot_and_b0_s1_image.bin
207+
build_update/signed_by_mcuboot_and_b0_s1_image.bin
202208
203209
Once the new bootloader image is uploaded, the hash of the image is shown in the image list.
204210
Flag the image to be tested on next reboot using its hash.
@@ -215,8 +221,90 @@ The verification of the image will happen during the update process.
215221
216222
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 reset
217223
224+
Network core update (nRF5340 only)
225+
==================================
226+
227+
To upload a new network core image, build the empty_net_core image with an updated firmware image version.
228+
229+
.. code-block:: console
230+
231+
west build -b nrf5340dk/nrf5340/cpuapp/ns nrf/samples/tfm/tfm_psa_template -d build_update \
232+
-Dempty_net_core_CONFIG_FW_INFO_FIRMWARE_VERSION=2
233+
234+
Then upload the new network core image to the device.
235+
Note that the image is uploaded to the network core slot.
236+
237+
.. code-block:: console
238+
239+
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 image upload \
240+
build_update/signed_by_mcuboot_and_b0_empty_net_core.bin -e -n 1
241+
242+
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 image list
243+
244+
Once the network core image is uploaded, the hash of the image is shown in the image list as image 1 in slot 1.
245+
Flag the image to be tested on next reboot using its hash.
246+
247+
.. code-block:: console
248+
249+
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 image test <hash>
250+
251+
Trigger the network core update by initiating a reset.
252+
The verification of the image will happen during the update process.
253+
254+
.. code-block:: console
255+
256+
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 reset
257+
258+
Alternatively, you can conduct a manual reset to trigger the network core update.
259+
This allows you to observe the update process in the application and network core console outputs.
260+
261+
Simultaneous application and network core update (nRF5340 only)
262+
===============================================================
263+
264+
When the interface between the application and network core is updated, both the application and network core images must be updated simultaneously.
265+
To do this, build the application image with an updated image version and the network core image with an updated firmware image version.
266+
267+
.. code-block:: console
268+
269+
west build -b nrf5340dk/nrf5340/cpuapp/ns nrf/samples/tfm/tfm_psa_template -d build_update \
270+
-DCONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION=\"1.2.4\" -Dempty_net_core_CONFIG_FW_INFO_FIRMWARE_VERSION=3
271+
272+
Then upload the new application and network core images to the device.
273+
Note that the application image is uploaded to the application slot, and the network core image is uploaded to the network core slot.
274+
275+
.. code-block:: console
276+
277+
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 image upload \
278+
build_update/tfm_psa_template/zephyr/zephyr.signed.bin -e -n 0
279+
280+
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 image upload \
281+
build_update/signed_by_mcuboot_and_b0_empty_net_core.bin -e -n 1
282+
283+
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 image list
284+
285+
Once the images are uploaded, the hash of the images is shown in the image list.
286+
The application image is image 1 in slot 0, and the network core image is image 1 in slot 1.
287+
To allow the application and network core images to be updated simultaneously, first confirm the network core image and then the application image.
288+
289+
.. code-block:: console
290+
291+
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 image confirm <network core image hash>
292+
293+
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 image confirm <application core image hash>
294+
295+
Trigger the core updates by initiating a reset.
296+
The verification of the images will happen during the update process.
297+
298+
.. code-block:: console
299+
300+
mcumgr --conntype serial --connstring dev=/dev/ttyACM1,baud=115200,mtu=512 reset
301+
302+
Alternatively, you can conduct a manual reset to trigger the core updates.
303+
This allows you to observe the update process in the application and network core console outputs.
304+
218305
Dependencies
219306
*************
220307

221308
* This sample uses the TF-M module found in the :file:`modules/tee/tfm/` folder of the |NCS|.
222309
* This sample uses the :ref:`lib_tfm_ioctl_api` library.
310+
* On the nRF5340 devices, this sample uses the :ref:`subsys_pcd` library.

‎samples/tfm/tfm_psa_template/boards/nrf5340dk_nrf5340_cpuapp_ns.conf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#
2+
# Copyright (c) 2024 Nordic Semiconductor ASA
3+
#
4+
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
#
6+
7+
CONFIG_FPU=y
8+
CONFIG_BOARD_ENABLE_CPUNET=y
9+
CONFIG_PM_PARTITION_SIZE_TFM_SRAM=0x16000

‎samples/tfm/tfm_psa_template/boards/nrf5340dk_nrf5340_cpuapp_ns.overlay‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
/*
2+
* Copyright (c) 2024 Nordic Semiconductor ASA
3+
*
4+
* SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
*/
6+
7+
/ {
8+
chosen {
9+
nordic,pm-ext-flash = &mx25r64;
10+
};
11+
};

‎samples/tfm/tfm_psa_template/sysbuild.conf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,3 @@ SB_CONFIG_SECURE_BOOT_APPCORE=y
99
SB_CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y
1010
SB_CONFIG_MCUBOOT_MODE_OVERWRITE_ONLY=y
1111
SB_CONFIG_MCUBOOT_UPDATEABLE_IMAGES=2
12-
SB_CONFIG_MCUBOOT_APP_SYNC_UPDATEABLE_IMAGES=n

‎samples/tfm/tfm_psa_template/sysbuild/b0n/prj.conf‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#
2+
# Copyright (c) 2024 Nordic Semiconductor ASA
3+
#
4+
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
#
6+
CONFIG_NCS_SAMPLES_DEFAULTS=y
7+
8+
CONFIG_IS_SECURE_BOOTLOADER=y
9+
CONFIG_MULTITHREADING=n
10+
CONFIG_GPIO=n
11+
CONFIG_ARM_MPU=n
12+
CONFIG_TICKLESS_KERNEL=n
13+
CONFIG_ERRNO=n
14+
CONFIG_SYS_CLOCK_EXISTS=y
15+
CONFIG_FPROTECT=y
16+
CONFIG_FW_INFO=y
17+
CONFIG_SECURE_BOOT_CRYPTO=y
18+
CONFIG_SECURE_BOOT_VALIDATION=y
19+
CONFIG_SECURE_BOOT_STORAGE=y
20+
CONFIG_PCD_NET=y
21+
CONFIG_FLASH=y
22+
CONFIG_FLASH_PAGE_LAYOUT=y
23+
CONFIG_LOG=y
24+
25+
# To build with a minimal configuration, use the overlay file
26+
# '-DOVERLAY_CONFIG=overlay-minimal-size.conf'
27+
28+
# Enable locking the network core for debugging
29+
CONFIG_PCD_LOCK_NETCORE_DEBUG=y
30+
31+
# Prevent downgrade to older version of the network core.
32+
CONFIG_PCD_READ_NETCORE_APP_VERSION=y

‎samples/tfm/tfm_psa_template/sysbuild/mcuboot/boards/nrf5340dk_nrf5340_cpuapp.conf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#
2+
# Copyright (c) 2024 Nordic Semiconductor ASA
3+
#
4+
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
#
6+
7+
CONFIG_BOOT_MAX_IMG_SECTORS=256
8+
9+
CONFIG_PCD_READ_NETCORE_APP_VERSION=y

‎samples/tfm/tfm_psa_template/sysbuild/mcuboot/boards/nrf5340dk_nrf5340_cpuapp.overlay‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
/*
2+
* Copyright (c) 2024 Nordic Semiconductor ASA
3+
*
4+
* SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
*/
6+
7+
/ {
8+
chosen {
9+
nordic,pm-ext-flash = &mx25r64;
10+
};
11+
};

0 commit comments

Comments
 (0)