Skip to content

Commit 0656ff4

Browse files
mattia-moffadanielinux
mattia-moffa
authored and
danielinux
committed
Nordic nrf54l port (with and without TrustZone)
1 parent b456d0e commit 0656ff4

15 files changed

Lines changed: 1936 additions & 0 deletions

‎CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -395,6 +395,7 @@ if(NOT DEFINED ARM_TARGETS)
395395
nrf52840
396396
nrf5340
397397
nrf5340_net
398+
nrf54l
398399
rp2350
399400
sama5d3
400401
same51

‎arch.mk‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -867,6 +867,12 @@ ifeq ($(TARGET),nrf5340)
867867
endif
868868
endif
869869

870+
ifeq ($(TARGET),nrf54l)
871+
ifneq ($(TZEN), 1)
872+
LSCRIPT_IN=hal/$(TARGET)-ns.ld
873+
endif
874+
endif
875+
870876
ifeq ($(TARGET),nrf5340_net)
871877
# Net core doesn't support DSP and FP
872878
CFLAGS+=-mcpu=cortex-m33+nodsp+nofp

‎config/examples/nrf54l15-wolfcrypt-tz.config‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
ARCH?=ARM
2+
TZEN?=1
3+
TARGET?=nrf54l
4+
SIGN?=ECC384
5+
HASH?=SHA384
6+
WOLFBOOT_VERSION?=1
7+
VTOR?=1
8+
CORTEX_M0?=0
9+
CORTEX_M33?=1
10+
NO_ASM?=0
11+
NO_MPU=1
12+
ALLOW_DOWNGRADE?=0
13+
NVM_FLASH_WRITEONCE?=0
14+
DELTA_UPDATES?=1
15+
16+
SPMATH?=1
17+
RAM_CODE?=1
18+
19+
DUALBANK_SWAP?=0
20+
FLAGS_HOME=0
21+
DISABLE_BACKUP=0
22+
EXT_FLASH?=0
23+
SPI_FLASH?=0
24+
QSPI_FLASH?=0
25+
UART_FLASH?=0
26+
27+
WOLFCRYPT_TZ?=1
28+
WOLFCRYPT_TZ_PKCS11?=1
29+
30+
# 4096 sector size (the RRAM doesn't have an intrinsic page size)
31+
WOLFBOOT_SECTOR_SIZE?=0x1000
32+
33+
# Flash layout
34+
#
35+
# 0x00000000 - 0x0004EFFF wolfBoot (316 KB) secure
36+
# 0x0004F000 - 0x00064FFF Keyvault (88 KB) secure
37+
# 0x00065000 - 0x00065FFF NSC region (4 KB) non-secure callable
38+
# 0x00066000 - 0x000F0FFF Boot partition (556 KB) non-secure
39+
# 0x000F1000 - 0x0017BFFF Update partition (556 KB) secure
40+
# 0x0017C000 - 0x0017CFFF Swap area (4 KB) secure
41+
#
42+
# The update partition is meant to be written to via wolfBoot's NSC veneers
43+
44+
WOLFBOOT_KEYVAULT_ADDRESS?=0x4F000
45+
WOLFBOOT_KEYVAULT_SIZE?=0x16000
46+
47+
WOLFBOOT_NSC_ADDRESS?=0x65000
48+
WOLFBOOT_NSC_SIZE?=0x1000
49+
50+
WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x66000
51+
WOLFBOOT_PARTITION_SIZE?=0x8B000
52+
53+
WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0xF1000
54+
WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x17C000
55+
56+
V?=0
57+
DEBUG?=0
58+
DEBUG_UART?=1
59+
USE_GCC=1
60+
OPTIMIZATION_LEVEL=2
61+
62+
# Use larger block size for swapping sectors (performance improvement)
63+
CFLAGS_EXTRA+=-DFLASHBUFFER_SIZE=0x1000
64+
65+
#CFLAGS_EXTRA+=-DDEBUG_FLASH

‎config/examples/nrf54l15.config‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
ARCH?=ARM
2+
TZEN?=0
3+
TARGET?=nrf54l
4+
SIGN?=ECC384
5+
HASH?=SHA384
6+
WOLFBOOT_VERSION?=1
7+
VTOR?=1
8+
CORTEX_M0?=0
9+
CORTEX_M33?=1
10+
NO_ASM?=0
11+
NO_MPU=1
12+
ALLOW_DOWNGRADE?=0
13+
NVM_FLASH_WRITEONCE?=0
14+
DELTA_UPDATES?=1
15+
16+
SPMATH?=1
17+
RAM_CODE?=1
18+
19+
DUALBANK_SWAP?=0
20+
FLAGS_HOME=0
21+
DISABLE_BACKUP=0
22+
EXT_FLASH?=0
23+
SPI_FLASH?=0
24+
QSPI_FLASH?=0
25+
UART_FLASH?=0
26+
27+
# 4096 sector size (the RRAM doesn't have an intrinsic page size)
28+
WOLFBOOT_SECTOR_SIZE?=0x1000
29+
30+
# Reserve the first 64KB of internal flash for wolfBoot itself
31+
WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x10000
32+
33+
# Application partition spans the remainder of the 1524K internal flash
34+
# (1524K - 64K - 4K) / 2 = 728K = 0xB6000
35+
WOLFBOOT_PARTITION_SIZE?=0xB6000
36+
37+
# Flash offset for application update image
38+
# (64K + 728K) = 792K = 0xC6000
39+
WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0xC6000
40+
41+
# Flash offset for swap area
42+
# (1524K - 4K) = 1520K = 0x17C000
43+
WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x17C000
44+
45+
V?=0
46+
DEBUG?=0
47+
DEBUG_UART?=1
48+
USE_GCC=1
49+
OPTIMIZATION_LEVEL=2
50+
51+
# Use larger block size for swapping sectors (performance improvement)
52+
CFLAGS_EXTRA+=-DFLASHBUFFER_SIZE=0x1000
53+
54+
# SPI flash hookup for the DK radio shield
55+
#CFLAGS_EXTRA+=-DSPI_CS_PORT=0 -DSPI_CS_PIN=25
56+
#CFLAGS_EXTRA+=-DSPI_SCK_PORT=0 -DSPI_SCK_PIN=29
57+
#CFLAGS_EXTRA+=-DSPI_MOSI_PORT=0 -DSPI_MOSI_PIN=28
58+
#CFLAGS_EXTRA+=-DSPI_MISO_PORT=0 -DSPI_MISO_PIN=27
59+
60+
#CFLAGS_EXTRA+=-DDEBUG_FLASH

‎docs/Targets.md‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ This README describes configuration of supported targets.
1717
* [Microchip SAME51](#microchip-same51)
1818
* [Nordic nRF52840](#nordic-nrf52840)
1919
* [Nordic nRF5340](#nordic-nrf5340)
20+
* [Nordic nRF54L15](#nordic-nrf54l15)
2021
* [NXP iMX-RT](#nxp-imx-rt)
2122
* [NXP Kinetis](#nxp-kinetis)
2223
* [NXP LPC54xxx](#nxp-lpc54xxx)
@@ -4582,6 +4583,120 @@ c
45824583
```
45834584

45844585

4586+
## Nordic nRF54L15
4587+
4588+
Tested with the Nordic nRF54L15-DK. This device features a 128MHz Arm Cortex-M33 application
4589+
processor with TrustZone support, a 128MHz RISC-V coprocessor (VPR) used as a SoftPeripheral,
4590+
1524KB of RRAM (Resistive RAM), and 256KB of RAM. wolfBoot runs on the Cortex-M33 only and does
4591+
not interact with the RISC-V coprocessor.
4592+
4593+
Two configurations are available at `config/examples`:
4594+
4595+
- `nrf54l15.config`: TrustZone disabled; wolfBoot and the application always run in secure mode.
4596+
Delta updates are enabled.
4597+
4598+
- `nrf54l15-wolfcrypt-tz.config`: TrustZone enabled; wolfBoot runs in secure mode and boots the
4599+
application as non-secure code. Includes a non-secure callable (NSC) wolfPKCS11 API for
4600+
cryptographic operations via wolfCrypt, and a secure keyvault managed by wolfBoot. The update
4601+
partition is in secure memory and is intended to be written via wolfBoot's NSC veneers from the
4602+
non-secure application. See the "NSC API" section in `docs/API.md`.
4603+
4604+
### Flash Memory Layout
4605+
4606+
#### nrf54l15.config
4607+
4608+
```
4609+
0x00000000 - 0x0000FFFF wolfBoot (64 KB)
4610+
0x00010000 - 0x000C5FFF Boot partition (728 KB)
4611+
0x000C6000 - 0x0017BFFF Update partition (728 KB)
4612+
0x0017C000 - 0x0017CFFF Swap area (4 KB)
4613+
```
4614+
4615+
#### nrf54l15-wolfcrypt-tz.config
4616+
4617+
```
4618+
0x00000000 - 0x0004EFFF wolfBoot (316 KB) secure
4619+
0x0004F000 - 0x00064FFF Keyvault (88 KB) secure
4620+
0x00065000 - 0x00065FFF NSC region (4 KB) non-secure callable
4621+
0x00066000 - 0x000F0FFF Boot partition (556 KB) non-secure
4622+
0x000F1000 - 0x0017BFFF Update partition (556 KB) secure
4623+
0x0017C000 - 0x0017CFFF Swap area (4 KB) secure
4624+
```
4625+
4626+
### UART
4627+
4628+
Debug output is available on UART20, connected to the J-Link VCOM port (TX=P1.4, RX=P1.5).
4629+
A secondary UART (UART30, TX=P0.0, RX=P0.1) is reserved for the `UART_FLASH` feature.
4630+
4631+
### Building
4632+
4633+
```sh
4634+
cp config/examples/nrf54l15.config .config
4635+
make clean
4636+
make
4637+
```
4638+
4639+
Or, for the TrustZone + wolfCrypt variant:
4640+
4641+
```sh
4642+
cp config/examples/nrf54l15-wolfcrypt-tz.config .config
4643+
make clean
4644+
make
4645+
```
4646+
4647+
### Flashing
4648+
4649+
Flash the factory image using JLink:
4650+
4651+
```
4652+
JLinkExe -device nRF54L15_xxAA -if SWD -speed 4000 -autoconnect 1
4653+
loadbin factory.bin 0x0
4654+
rnh
4655+
```
4656+
4657+
### Testing an Update
4658+
4659+
Sign the test application as version 2, then write the update trigger magic (`pBOOT`)
4660+
at the end of the partition.
4661+
4662+
#### nrf54l15.config (partition size 0xB6000)
4663+
4664+
```sh
4665+
tools/keytools/sign --ecc384 --sha384 test-app/image.bin wolfboot_signing_private_key.der 2
4666+
echo -n "pBOOT" > trigger_magic.bin
4667+
./tools/bin-assemble/bin-assemble \
4668+
update.bin \
4669+
0x0 test-app/image_v2_signed.bin \
4670+
0xB5FFB trigger_magic.bin
4671+
```
4672+
4673+
Flash the assembled image to the update partition:
4674+
4675+
```
4676+
JLinkExe -device nRF54L15_xxAA -if SWD -speed 4000 -autoconnect 1
4677+
loadbin update.bin 0xC6000
4678+
rnh
4679+
```
4680+
4681+
#### nrf54l15-wolfcrypt-tz.config (partition size 0x8B000)
4682+
4683+
```sh
4684+
tools/keytools/sign --ecc384 --sha384 test-app/image.bin wolfboot_signing_private_key.der 2
4685+
echo -n "pBOOT" > trigger_magic.bin
4686+
./tools/bin-assemble/bin-assemble \
4687+
update.bin \
4688+
0x0 test-app/image_v2_signed.bin \
4689+
0x8AFFB trigger_magic.bin
4690+
```
4691+
4692+
Flash the assembled image to the update partition:
4693+
4694+
```
4695+
JLinkExe -device nRF54L15_xxAA -if SWD -speed 4000 -autoconnect 1
4696+
loadbin update.bin 0xF1000
4697+
rnh
4698+
```
4699+
45854700
## Simulated
45864701

45874702
You can create a simulated target that uses files to mimic an internal and

‎hal/nrf54l-ns.ld‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
MEMORY
2+
{
3+
FLASH (rx) : ORIGIN = @ARCH_FLASH_OFFSET@, LENGTH = @BOOTLOADER_PARTITION_SIZE@
4+
RAM (rwx) : ORIGIN = 0x20000000, LENGTH = 256K
5+
}
6+
7+
SECTIONS
8+
{
9+
.text :
10+
{
11+
_start_text = .;
12+
KEEP(*(.isr_vector))
13+
*(.boot*)
14+
*(.text*)
15+
*(.rodata*)
16+
*(.init*)
17+
*(.fini*)
18+
. = ALIGN(4);
19+
_end_text = .;
20+
} > FLASH
21+
22+
.edidx :
23+
{
24+
. = ALIGN(4);
25+
*(.ARM.exidx*)
26+
} > FLASH
27+
28+
_stored_data = .;
29+
30+
.data : AT (_stored_data)
31+
{
32+
_start_data = .;
33+
KEEP(*(.data*))
34+
. = ALIGN(4);
35+
_end_data = .;
36+
} > RAM
37+
38+
.bss (NOLOAD) :
39+
{
40+
_start_bss = .;
41+
__bss_start__ = .;
42+
*(.bss*)
43+
*(COMMON)
44+
. = ALIGN(4);
45+
_end_bss = .;
46+
__bss_end__ = .;
47+
_end = .;
48+
} > RAM
49+
. = ALIGN(4);
50+
}
51+
52+
END_STACK = ORIGIN(RAM) + LENGTH(RAM);

0 commit comments

Comments
 (0)