Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[nrf noup] boot: zephyr: let secondary_1 slot be in regular flash #235

Open
wants to merge 89 commits into
base: main
Choose a base branch
from
Open

[nrf noup] boot: zephyr: let secondary_1 slot be in regular flash #235

wants to merge 89 commits into from

Conversation

sigvartmh
Copy link
Contributor

Added support for multi-image DFU for nRF53 from internal flash which requires the region parameter of mcuboot_secondary_1 to be configurable. So that the mcuboot_secondary_1 partition is put into internal flash.

Ref. NCSDK-12809

Signed-off-by: Sigvart Hovland [email protected]

@NordicBuilder NordicBuilder mentioned this pull request Jan 25, 2023
Closed
@sigvartmh sigvartmh added this to the ncs-2.3.0 milestone Jan 30, 2023
@sigvartmh sigvartmh self-assigned this Jan 30, 2023
@sigvartmh sigvartmh force-pushed the feature/multi-image-dfu-without-external-flash branch from 281e98b to 557da9f Compare February 13, 2023 14:40
@sigvartmh
Copy link
Contributor Author

@hakonfam / @nvlsianpu This one needs a review.

@shantha-14 shantha-14 removed this from the ncs-2.3.0 milestone Feb 16, 2023
hakonfam
hakonfam previously requested changes Feb 17, 2023
View reviewed changes
boot/zephyr/pm.yml
size: CONFIG_NRF53_RAM_FLASH_SIZE
placement:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to make sure that the alignment for internal flash is the same as for mcuboot primary. That should be page aligned. Also we need to make this block different between external flash and internal flash configurations.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you know why the flash alignment in external flash is set to 4 by default then?
ref:

sdk-mcuboot/boot/zephyr/pm.yml

Line 24 in ccc7227

align: {start: 4}

This could potentially be a misconfiguration and it should be page aligned regardless.
Also should I look into potentially using

zephyr/dts.cmake:set_target_properties(devicetree_target PROPERTIES "DT_REG|/soc/flash-controller@4001e000|SIZE" "0x1000;")

For setting the alignment requirements so that it would be page aligned regardless of the device used.

@sigvartmh sigvartmh added this to the ncs-2.4.0 milestone Mar 20, 2023
@sigvartmh sigvartmh force-pushed the feature/multi-image-dfu-without-external-flash branch from 557da9f to ccc7227 Compare March 20, 2023 10:53
@sigvartmh sigvartmh requested a review from hakonfam April 4, 2023 05:45
@osaether osaether removed this from the ncs-2.4.0 milestone May 15, 2023
@sigvartmh sigvartmh force-pushed the feature/multi-image-dfu-without-external-flash branch from ccc7227 to c13da8f Compare June 6, 2023 10:01
@sigvartmh sigvartmh force-pushed the feature/multi-image-dfu-without-external-flash branch from c13da8f to 2746b9d Compare July 17, 2023 11:54
@sigvartmh sigvartmh force-pushed the feature/multi-image-dfu-without-external-flash branch 2 times, most recently from b864f97 to b061a18 Compare July 31, 2023 08:50
nvlsianpu
nvlsianpu reviewed Aug 7, 2023
View reviewed changes
boot/zephyr/pm.yml
size: CONFIG_NRF53_RAM_FLASH_SIZE
placement:
after: mcuboot_secondary
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't this unproper for if CONFIG_PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY_1 is selected?

Copy link
Contributor Author

@sigvartmh sigvartmh Aug 9, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why? You have both secondary in external flash and placing the secondary_1 after secondary makes sense.
If secondary is in internal flash it will be allocated to a different region which means this placement requirement will be ignored.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The first sentence was obvious. The second one sentence describes something i could anticipate, but didn't know for sure.

@sigvartmh sigvartmh added this to the ncs-2.5.0 milestone Aug 11, 2023
@sigvartmh sigvartmh force-pushed the feature/multi-image-dfu-without-external-flash branch from b061a18 to 15d17d8 Compare August 23, 2023 10:26
@sigvartmh sigvartmh force-pushed the feature/multi-image-dfu-without-external-flash branch 2 times, most recently from 3204941 to bf74928 Compare September 5, 2023 11:10
SebastianBoe and others added 23 commits December 15, 2023 10:32
@SebastianBoe @de-nordic
[nrf noup] treewide: add NCS partition manager support
71fe2df 
Partition Manager is an nRF Connect SDK component which uses yaml
files to resolve flash partition placement with a holistic view of the
device.

This component's MCUboot portions began life as upstream mcuboot
PR#430. This added support for being built as a sub image from the
downstream Nordic patch set for a zephyr multi image build
system (mcuboot 430 was combined with effor submitted to upstream
zephyr as PR#13672, which was ultimately reworked after being rejected
for mainline at the ELCE 2019 conference in Lyon).

It has since evolved over time. This is the version that will go into
NCS v1.3. It features:

- page size aligned partitions for all partitions used by mcuboot.
- image swaps without scratch partitions

Add support for configurations where there exists two primary slots
but only one secondary slot, which is shared. These two primary slots
are the regular application and B1. B1 can be either S0 or S1
depending on the state of the device.

Decide where an upgrade should be stored by looking at the vector
table.

Provide update candidates for both s0 and s1. These candidates must be
signed with mcuboot after being signed by b0.

Additional notes:

- we make update.hex without trailer data

  This is needed for serial recovery to work using hex files.
  Prior to this the update.hex got TLV data at the end of the
  partition, which caused many blank pages to be included,
  which made it hard to use in a serial recovery scheme.

  Instead, make update.hex without TLV data at the end,
  and provide a new file test_update.hex which contains
  the TLV data, and can be directly flashed to test the
  upgrade procedure.

- we use a function for signing the application as future-proofing
  for when other components must be signed as well

- this includes an update to single image applications that enables
  support for partition manager; when single image DFU is used, a
  scratch partition is not needed.

- In NCS, image 1 primary slot is the upgrade bank for mcuboot (IE S0 or
  S1 depending on the active slot). It is not required that this slot
  contains any valid data.

- The nRF boards all have a single flash page size, and partition
  manager deals with the size of the update partitions and so on, so we
  must skip a boot_slots_compatible() check to avoid getting an error.

- There is no need to verify the target when using partition manager.

- We lock mcuboot using fprotect before jumping, to enable the secure
  boot property of the system.

- Call fw_info_ext_api_provide() before booting if EXT_API_PROVIDE
  EXT_API is enabled. This is relevant only when the immutable
  bootloader has booted mcuboot.

Signed-off-by: Håkon Øye Amundsen <[email protected]>
Signed-off-by: Øyvind Rønningstad <[email protected]>
Signed-off-by: Sebastian Bøe <[email protected]>
Signed-off-by: Sigvart Hovland <[email protected]>
Signed-off-by: Martí Bolívar <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Andrzej Głąbek <[email protected]>
Signed-off-by: Robert Lubos <[email protected]>
Signed-off-by: Andrzej Puzdrowski <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
Signed-off-by: Emil Obalski <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Pawel Dunaj <[email protected]>
Signed-off-by: Ioannis Glaropoulos <[email protected]>
Signed-off-by: Johann Fischer <[email protected]>
Signed-off-by: Vidar Berg <[email protected]>
Signed-off-by: Draus, Sebastian <[email protected]>
Signed-off-by: Trond Einar Snekvik <[email protected]>
Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Joakim Andersson <[email protected]>
Signed-off-by: Georgios Vasilakis <[email protected]>
(cherry picked from commit ed5f069)
(cherry picked from commit d2cac70)
(cherry picked from commit 1630628)
(cherry picked from commit 349361e)
(cherry picked from commit 16fd63c)
Signed-off-by: Dominik Ermel <[email protected]>
@sigvartmh @de-nordic
[nrf noup] boot: nrf53-specific customizations
2bbd3b1 
- Add network core bootloader implementation

  Enables network core updates of nrf53 using MCUBoot by identifying
  images through their start addresses. Also implements the control and
  transfer using the PCD module.

- Add support for multi image DFU using partition manager.

- Add check for netcore addr if NSIB is enabled so netcore updates works

- boot: zephyr: move thingy53_nrf5340_cpuapp.conf downstream

  Moved the board configuration for Thingy:53 Application Core to the
  nRF Connect SDK MCUboot downstream repository. The configuration file
  contains references to the Kconfig modules that are only available in
  the nRF Connect SDK. The current configuration is set up to work in the
  nRF Connect SDK environment and cannot be used upstream.

- pm: enable ram flash partition using common flag

  This patch makes mcuboot_primary_1 ram-flash partition
  selectable using CONFIG_NRF53_MCUBOOT_PRIMARY_1_RAM_FLASH
  property. This is needed since CONFIG_NRF53_MULTI_IMAGE_UPDATE
  become not only configuration which requires that partition.

- MCUBoot configures USB CDC by its own. There is no need for
  BOARD_SERIAL_BACKEND_CDC_ACM option to configure anything which is
  later overwritten anyway.

  Jira: NCSDK-18596

Signed-off-by: Andrzej Puzdrowski <[email protected]>
Signed-off-by: Emil Obalski <[email protected]>
Signed-off-by: Håkon Øye Amundsen <[email protected]>
Signed-off-by: Ioannis Glaropoulos <[email protected]>
Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Johann Fischer <[email protected]>
Signed-off-by: Kamil Piszczek <[email protected]>
Signed-off-by: Ole Sæther <[email protected]>
Signed-off-by: Sigvart Hovland <[email protected]>
Signed-off-by: Simon Iversen <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Trond Einar Snekvik <[email protected]>
Signed-off-by: Mateusz Kapala <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit b96bed8)
(cherry picked from commit 4302a91)
(cherry picked from commit e52481a)
(cherry picked from commit 8642c39)
(cherry picked from commit 0030544)
Signed-off-by: Dominik Ermel <[email protected]>
@nvlsianpu @de-nordic
[nrf noup] do_boot: clean peripherals state before boot
4c8e041 
Do some cleanup of nRF peripherals. This is necessary since Zephyr
doesn't have any driver deinitialization functionality, and we'd like
to leave peripherals in a more predictable state before booting the
Zephyr image. This should be re-worked when the zephyr driver model
allows us to deinitialize devices cleanly before jumping to the
chain-loaded image.

Signed-off-by: Andrzej Puzdrowski <[email protected]>
Signed-off-by: Robert Lubos <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Øyvind Rønningstad <[email protected]>
Signed-off-by: Martí Bolívar <[email protected]>
Signed-off-by: Håkon Øye Amundsen <[email protected]>
Signed-off-by: Ioannis Glaropoulos <[email protected]>
Signed-off-by: Johann Fischer <[email protected]>
Signed-off-by: Trond Einar Snekvik <[email protected]>
Signed-off-by: Torsten Rasmussen <[email protected]>
Signed-off-by: Jamie McCrae <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 0a4da3a)
(cherry picked from commit e56136a)
(cherry picked from commit 05405d4)
(cherry picked from commit 0eacb35)
(cherry picked from commit 1f14ccb)
Signed-off-by: Dominik Ermel <[email protected]>
@sigvartmh @de-nordic
[nrf noup] zephyr: Clean up non-secure RAM if enabled
b8a544d 
To ensure that MCUBoot does not leak keys or other material through
memory to non-secure side we clear the memory before jumping to the next
image.

Signed-off-by: Sigvart Hovland <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit ff95e7b)
(cherry picked from commit d584ea0)
(cherry picked from commit 2394b5b)
(cherry picked from commit 3266b99)
(cherry picked from commit a47c9c4)
Signed-off-by: Dominik Ermel <[email protected]>
@chrta @de-nordic
[nrf noup] loader: Fix reading reset addr to support ext flash
9403865 
When mcuboot_secondary is on external flash, the image header cannot
dircetly be accessed via secondary_fa->fa_off. Instead the provided
function boot_img_hdr() is used now.
Additionally a similar issue is present when trying to read the address
of the reset handler. For this flash_area_read() is used now.

With this patch is possible to have the update partiton
mcuboot_secondary on external flash and update a updatable
bootloader (mcuboot) in s0 and/or s1.

Signed-off-by: Christian Taedcke <[email protected]>
Signed-off-by: Ole Sæther <[email protected]>
Signed-off-by: Sigvart Hovland <[email protected]>
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit d6c6170)
(cherry picked from commit 4d30b55)
(cherry picked from commit 7af56df)
(cherry picked from commit a49b83e)
(cherry picked from commit 48ad055)
Signed-off-by: Dominik Ermel <[email protected]>
@osaether @de-nordic
[nrf noup] bootloader: mcuboot: Fix wrong use of if defined
7f2386f 
The file nrf_cleanup.c has
"#if defined(USE_PARTITION_MANAGER)"
Which is true even if USE_PARTITION_MANAGER=n.
This must be changed to "#if USE_PARTITION_MANAGER" for correct
behaviour.

Ref: NCSIDB-987

Signed-off-by: Ole Sæther <[email protected]>
(cherry picked from commit 823fd36)
(cherry picked from commit 09bad48)
Signed-off-by: Dominik Ermel <[email protected]>
@nordicjm @de-nordic
[nrf noup] Fix path variables
be3e7c6 
Fixes path variables to use the proper Zephyr module variables

Signed-off-by: Jamie McCrae <[email protected]>
(cherry picked from commit fecfb1e)
(cherry picked from commit 5777337)
Signed-off-by: Dominik Ermel <[email protected]>
@nordicjm @de-nordic
[nrf noup] bootutil: Fix missing PCD define check
5932630 
Fixes a missing PCD define check, an image might have the
network core partition layout set but if PCD support is not
enabled then it should not assume that PCD support is part
of mcuboot.

Signed-off-by: Jamie McCrae <[email protected]>
(cherry picked from commit 71ec266)
(cherry picked from commit 815fa3a)
Signed-off-by: Dominik Ermel <[email protected]>
@nordicjm @de-nordic
[nrf noup] boot: zephyr: Add ifdef protection for RAM locking
0098451 
This adds an ifdef check so that RAM is only protected if PCD is
enabled, whereas previously this would cause a build failure.

Signed-off-by: Jamie McCrae <[email protected]>
(cherry picked from commit 4ec411c)
(cherry picked from commit 52997e1)
Signed-off-by: Dominik Ermel <[email protected]>
@sigvartmh @de-nordic
[nrf noup] booutil: loader: Add support for NSIB and multi-image
03af90f 
This adds support for using both NSIB and the multi-image configuration
in MCUboot. Before this was not possible due to upgradable bootloader
support through NSIB was using the `UPDATEABLE_IMAGE_NUMBER`
configuration to update the updateable bootloader.

In this commit we change from using `FLASH_AREA_IMAGE_PRIMARY` to get
the flash area ID to using the bootloader state where we set the flash
area ID of the free updatable bootloader slot if the image is intended
for this slot.

Ref. NCSDK-19223

Signed-off-by: Sigvart Hovland <[email protected]>
(cherry picked from commit 8fe7070)
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 037f4da)
(cherry picked from commit b518e13)
Signed-off-by: Dominik Ermel <[email protected]>
@de-nordic
[nrf noup] zephyr: Move partition manager definitions to pm_sysflash.h
c3b33eb 
Making sysflash.h and pm_sysflash.h more readable.

(cherry picked from commit eafdae9)
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 99001d0)
(cherry picked from commit 0383b7c)
Signed-off-by: Dominik Ermel <[email protected]>
@sigvartmh @de-nordic
[nrf noup] booutil: loader: Fixup for NSIB and multi-image
0d43674 
Commit 8fe7070 broke bootloader updates
for nRF91 and non-multi image builds. This commit is fixing this by
restoring the previous functionality and `ifdef` out the new logic
needed for multi-image.

Ref. NCSDK-23305

Signed-off-by: Sigvart Hovland <[email protected]>
(cherry picked from commit 7429a98)
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 8c5b560)
(cherry picked from commit 745cf4e)
Signed-off-by: Dominik Ermel <[email protected]>
@de-nordic
[nrf noup] zephyr: Add support for three images
77c7e25 
The commit modifies pm_sysflash.h to add support for three
application images.

(cherry picked from commit 8fba4db)
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit a7f6ccb)
(cherry picked from commit 5822244)
Signed-off-by: Dominik Ermel <[email protected]>
@de-nordic
[nrf noup] booutil: loader: Do not check reset vector for XIP image
30181d8 
The XIP image, 2, does not have reset vector.

Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 568d62c)
Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit c6349b9)
(cherry picked from commit 4fe70b6)
Signed-off-by: Dominik Ermel <[email protected]>
@nordicjm @de-nordic
[nrf noup] zephyr: Add RAM flash configuration to cache for sysbuild
c19337f 
Puts the flash simulation configurtion into cache variables that can
be used by other applications and CMake code to know specifics on
the simulated flash details

Signed-off-by: Jamie McCrae <[email protected]>
(cherry picked from commit c28768e)
(cherry picked from commit 9cd1de1)
Signed-off-by: Dominik Ermel <[email protected]>
@sigvartmh @de-nordic
[nrf noup] sysflash: pm_sysflash: Fix incorrect define exclude for NSIB
d700515 
A mismatch in defines was made for `_image_1_primary_slot_id` resulting
in some configurations not working. This fixes that the linker variable
is exposed for mcuboot so that it knows which slot is running an which
slot a bootloader upgrade is to be put into.

Ref. NCSDK-19223

Signed-off-by: Sigvart Hovland <[email protected]>
(cherry picked from commit 1f38eb8)
(cherry picked from commit 862bca5)
Signed-off-by: Dominik Ermel <[email protected]>
@sigvartmh @de-nordic
[nrf noup] boot: zephyr: Boot even if EXT_ABI is not provided
e6e72a0 
This removes the `return;` to ensure that the application is booted even
if EXT_ABI is not provided to the application because it does not
include `FW_INFO`.

Added a bit more description to the error messages when FW_INFO is not
found and EXT_ABI is not able to be provided to the next image.

Ref. NCSDK-24132

Signed-off-by: Sigvart Hovland <[email protected]>
(cherry picked from commit b80046d)
(cherry picked from commit 01f17eb)
Signed-off-by: Dominik Ermel <[email protected]>
@sigvartmh @de-nordic
[nrf noup] loader: Add firmware version check downgrade prevention
4441695 
For nRF53, the only existing version number metadata is stored in the
`firmware_info` structure in the network core. This utilizes PCD to read
out the version number and compares it against the version number found
in the secondary slot for the network core.

Ref. NCSDK-21379

Signed-off-by: Sigvart Hovland <[email protected]>
(cherry picked from commit 1b6571d)
(cherry picked from commit 4d9859a)
Signed-off-by: Dominik Ermel <[email protected]>
@sigvartmh @de-nordic
[nrf noup] crypto: ecdsa: Fix shared crypto MCUBoot EXT_ABI
4015754 
After the upmerge using external crypto from NSIB in MCUBoot resulted in
build failures. This commit fixes the build failures but also fixes a
change in the API call which resulted in `-102` error when calling the
verify function.

Ref. NCSDK-23994

Signed-off-by: Sigvart Hovland <[email protected]>
(cherry picked from commit dc0b692)
(cherry picked from commit 2891664)
Signed-off-by: Dominik Ermel <[email protected]>
@nika-nordic @de-nordic
[nrf noup] boards: thingy53: disable GPIO ISR support
69805fa 
Change disables GPIO interrupt support in Zephyr GPIO driver,
which is not obligatory for MCUboot.
This is needed to reduce memory footprint.

Signed-off-by: Nikodem Kastelik <[email protected]>
(cherry picked from commit adab597)
Signed-off-by: Dominik Ermel <[email protected]>
@nordicjm
[nrf noup] bootutil: crypto: sha: Fix external crypto defines
beebb23 
Fixes the names of external crypto defines due to a rename in
MCUboot

Signed-off-by: Jamie McCrae <[email protected]>
@maxd-nordic @rlubos
[nrf noup] boards: thingy91x: add board config
a9d5fa7 
This patch adds board configuration for the Thingy:91 X.

Signed-off-by: Maximilian Deubel <[email protected]>
@sigvartmh
[nrf noup] boot: zephyr: let secondary_1 slot be in regular flash
18135b8 
Added support for multi-image DFU for nRF53 from internal flash which
requires the region parameter of `mcuboot_secondary_1` to be
configurable. So that the `mcuboot_secondary_1` partition is put into
internal flash.

Ref. NCSDK-12809

Signed-off-by: Sigvart Hovland <[email protected]>
@sigvartmh sigvartmh force-pushed the feature/multi-image-dfu-without-external-flash branch from 2ff6ae8 to 18135b8 Compare February 8, 2024 13:15
@shanthanordic shanthanordic modified the milestones: ncs-2.6.0, ncs-2.7.0 Mar 15, 2024
@nvlsianpu nvlsianpu removed this from the ncs-2.7.0 milestone Jun 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nvlsianpu nvlsianpu nvlsianpu approved these changes

@nordicjm nordicjm nordicjm approved these changes

@de-nordic de-nordic de-nordic approved these changes

@hakonfam hakonfam Awaiting requested review from hakonfam

Assignees

@sigvartmh sigvartmh

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.