Skip to content

Commit 6e69d1a

Browse files
mattia-moffamattia-moffa
committed
Nordic nrf54l port (with and without TrustZone)
1 parent 2277dfa commit 6e69d1a

15 files changed

Lines changed: 1936 additions & 0 deletions

‎CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -395,6 +395,7 @@ if(NOT DEFINED ARM_TARGETS)
395395
nrf52840
396396
nrf5340
397397
nrf5340_net
398+
nrf54l
398399
rp2350
399400
sama5d3
400401
same51

‎arch.mk‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -805,6 +805,12 @@ ifeq ($(TARGET),nrf5340)
805805
endif
806806
endif
807807

808+
ifeq ($(TARGET),nrf54l)
809+
ifneq ($(TZEN), 1)
810+
LSCRIPT_IN=hal/$(TARGET)-ns.ld
811+
endif
812+
endif
813+
808814
ifeq ($(TARGET),nrf5340_net)
809815
# Net core doesn't support DSP and FP
810816
CFLAGS+=-mcpu=cortex-m33+nodsp+nofp

‎config/examples/nrf54l15-wolfcrypt-tz.config‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
ARCH?=ARM
2+
TZEN?=1
3+
TARGET?=nrf54l
4+
SIGN?=ECC384
5+
HASH?=SHA384
6+
WOLFBOOT_VERSION?=1
7+
VTOR?=1
8+
CORTEX_M0?=0
9+
CORTEX_M33?=1
10+
NO_ASM?=0
11+
NO_MPU=1
12+
ALLOW_DOWNGRADE?=0
13+
NVM_FLASH_WRITEONCE?=0
14+
DELTA_UPDATES?=1
15+
16+
SPMATH?=1
17+
RAM_CODE?=1
18+
19+
DUALBANK_SWAP?=0
20+
FLAGS_HOME=0
21+
DISABLE_BACKUP=0
22+
EXT_FLASH?=0
23+
SPI_FLASH?=0
24+
QSPI_FLASH?=0
25+
UART_FLASH?=0
26+
27+
WOLFCRYPT_TZ?=1
28+
WOLFCRYPT_TZ_PKCS11?=1
29+
30+
# 4096 sector size (the RRAM doesn't have an intrinsic page size)
31+
WOLFBOOT_SECTOR_SIZE?=0x1000
32+
33+
# Flash layout
34+
#
35+
# 0x00000000 - 0x0004EFFF wolfBoot (316 KB) secure
36+
# 0x0004F000 - 0x00064FFF Keyvault (88 KB) secure
37+
# 0x00065000 - 0x00065FFF NSC region (4 KB) non-secure callable
38+
# 0x00066000 - 0x000F0FFF Boot partition (556 KB) non-secure
39+
# 0x000F1000 - 0x0017BFFF Update partition (556 KB) secure
40+
# 0x0017C000 - 0x0017CFFF Swap area (4 KB) secure
41+
#
42+
# The update partition is meant to be written to via wolfBoot's NSC veneers
43+
44+
WOLFBOOT_KEYVAULT_ADDRESS?=0x4F000
45+
WOLFBOOT_KEYVAULT_SIZE?=0x16000
46+
47+
WOLFBOOT_NSC_ADDRESS?=0x65000
48+
WOLFBOOT_NSC_SIZE?=0x1000
49+
50+
WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x66000
51+
WOLFBOOT_PARTITION_SIZE?=0x8B000
52+
53+
WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0xF1000
54+
WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x17C000
55+
56+
V?=0
57+
DEBUG?=0
58+
DEBUG_UART?=1
59+
USE_GCC=1
60+
OPTIMIZATION_LEVEL=2
61+
62+
# Use larger block size for swapping sectors (performance improvement)
63+
CFLAGS_EXTRA+=-DFLASHBUFFER_SIZE=0x1000
64+
65+
#CFLAGS_EXTRA+=-DDEBUG_FLASH

‎config/examples/nrf54l15.config‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
ARCH?=ARM
2+
TZEN?=0
3+
TARGET?=nrf54l
4+
SIGN?=ECC384
5+
HASH?=SHA384
6+
WOLFBOOT_VERSION?=1
7+
VTOR?=1
8+
CORTEX_M0?=0
9+
CORTEX_M33?=1
10+
NO_ASM?=0
11+
NO_MPU=1
12+
ALLOW_DOWNGRADE?=0
13+
NVM_FLASH_WRITEONCE?=0
14+
DELTA_UPDATES?=1
15+
16+
SPMATH?=1
17+
RAM_CODE?=1
18+
19+
DUALBANK_SWAP?=0
20+
FLAGS_HOME=0
21+
DISABLE_BACKUP=0
22+
EXT_FLASH?=0
23+
SPI_FLASH?=0
24+
QSPI_FLASH?=0
25+
UART_FLASH?=0
26+
27+
# 4096 sector size (the RRAM doesn't have an intrinsic page size)
28+
WOLFBOOT_SECTOR_SIZE?=0x1000
29+
30+
# Reserve the first 64KB of internal flash for wolfBoot itself
31+
WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x10000
32+
33+
# Application partition spans the remainder of the 1524K internal flash
34+
# (1524K - 64K - 4K) / 2 = 728K = 0xB6000
35+
WOLFBOOT_PARTITION_SIZE?=0xB6000
36+
37+
# Flash offset for application update image
38+
# (64K + 728K) = 792K = 0xC6000
39+
WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0xC6000
40+
41+
# Flash offset for swap area
42+
# (1524K - 4K) = 1520K = 0x17C000
43+
WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x17C000
44+
45+
V?=0
46+
DEBUG?=0
47+
DEBUG_UART?=1
48+
USE_GCC=1
49+
OPTIMIZATION_LEVEL=2
50+
51+
# Use larger block size for swapping sectors (performance improvement)
52+
CFLAGS_EXTRA+=-DFLASHBUFFER_SIZE=0x1000
53+
54+
# SPI flash hookup for the DK radio shield
55+
#CFLAGS_EXTRA+=-DSPI_CS_PORT=0 -DSPI_CS_PIN=25
56+
#CFLAGS_EXTRA+=-DSPI_SCK_PORT=0 -DSPI_SCK_PIN=29
57+
#CFLAGS_EXTRA+=-DSPI_MOSI_PORT=0 -DSPI_MOSI_PIN=28
58+
#CFLAGS_EXTRA+=-DSPI_MISO_PORT=0 -DSPI_MISO_PIN=27
59+
60+
#CFLAGS_EXTRA+=-DDEBUG_FLASH

‎docs/Targets.md‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ This README describes configuration of supported targets.
1717
* [Microchip SAME51](#microchip-same51)
1818
* [Nordic nRF52840](#nordic-nrf52840)
1919
* [Nordic nRF5340](#nordic-nrf5340)
20+
* [Nordic nRF54L15](#nordic-nrf54l15)
2021
* [NXP iMX-RT](#nxp-imx-rt)
2122
* [NXP Kinetis](#nxp-kinetis)
2223
* [NXP LPC54xxx](#nxp-lpc54xxx)
@@ -4060,6 +4061,120 @@ c
40604061
```
40614062

40624063

4064+
## Nordic nRF54L15
4065+
4066+
Tested with the Nordic nRF54L15-DK. This device features a 128MHz Arm Cortex-M33 application
4067+
processor with TrustZone support, a 128MHz RISC-V coprocessor (VPR) used as a SoftPeripheral,
4068+
1524KB of RRAM (Resistive RAM), and 256KB of RAM. wolfBoot runs on the Cortex-M33 only and does
4069+
not interact with the RISC-V coprocessor.
4070+
4071+
Two configurations are available at `config/examples`:
4072+
4073+
- `nrf54l15.config`: TrustZone disabled; wolfBoot and the application always run in secure mode.
4074+
Delta updates are enabled.
4075+
4076+
- `nrf54l15-wolfcrypt-tz.config`: TrustZone enabled; wolfBoot runs in secure mode and boots the
4077+
application as non-secure code. Includes a non-secure callable (NSC) wolfPKCS11 API for
4078+
cryptographic operations via wolfCrypt, and a secure keyvault managed by wolfBoot. The update
4079+
partition is in secure memory and is intended to be written via wolfBoot's NSC veneers from the
4080+
non-secure application. See the "NSC API" section in `docs/API.md`.
4081+
4082+
### Flash Memory Layout
4083+
4084+
#### nrf54l15.config
4085+
4086+
```
4087+
0x00000000 - 0x0000FFFF wolfBoot (64 KB)
4088+
0x00010000 - 0x000C5FFF Boot partition (728 KB)
4089+
0x000C6000 - 0x0017BFFF Update partition (728 KB)
4090+
0x0017C000 - 0x0017CFFF Swap area (4 KB)
4091+
```
4092+
4093+
#### nrf54l15-wolfcrypt-tz.config
4094+
4095+
```
4096+
0x00000000 - 0x0004EFFF wolfBoot (316 KB) secure
4097+
0x0004F000 - 0x00064FFF Keyvault (88 KB) secure
4098+
0x00065000 - 0x00065FFF NSC region (4 KB) non-secure callable
4099+
0x00066000 - 0x000F0FFF Boot partition (556 KB) non-secure
4100+
0x000F1000 - 0x0017BFFF Update partition (556 KB) secure
4101+
0x0017C000 - 0x0017CFFF Swap area (4 KB) secure
4102+
```
4103+
4104+
### UART
4105+
4106+
Debug output is available on UART20, connected to the J-Link VCOM port (TX=P1.4, RX=P1.5).
4107+
A secondary UART (UART30, TX=P0.0, RX=P0.1) is reserved for the `UART_FLASH` feature.
4108+
4109+
### Building
4110+
4111+
```sh
4112+
cp config/examples/nrf54l15.config .config
4113+
make clean
4114+
make
4115+
```
4116+
4117+
Or, for the TrustZone + wolfCrypt variant:
4118+
4119+
```sh
4120+
cp config/examples/nrf54l15-wolfcrypt-tz.config .config
4121+
make clean
4122+
make
4123+
```
4124+
4125+
### Flashing
4126+
4127+
Flash the factory image using JLink:
4128+
4129+
```
4130+
JLinkExe -device nRF54L15_xxAA -if SWD -speed 4000 -autoconnect 1
4131+
loadbin factory.bin 0x0
4132+
rnh
4133+
```
4134+
4135+
### Testing an Update
4136+
4137+
Sign the test application as version 2, then write the update trigger magic (`pBOOT`)
4138+
at the end of the partition.
4139+
4140+
#### nrf54l15.config (partition size 0xB6000)
4141+
4142+
```sh
4143+
tools/keytools/sign --ecc384 --sha384 test-app/image.bin wolfboot_signing_private_key.der 2
4144+
echo -n "pBOOT" > trigger_magic.bin
4145+
./tools/bin-assemble/bin-assemble \
4146+
update.bin \
4147+
0x0 test-app/image_v2_signed.bin \
4148+
0xB5FFB trigger_magic.bin
4149+
```
4150+
4151+
Flash the assembled image to the update partition:
4152+
4153+
```
4154+
JLinkExe -device nRF54L15_xxAA -if SWD -speed 4000 -autoconnect 1
4155+
loadbin update.bin 0xC6000
4156+
rnh
4157+
```
4158+
4159+
#### nrf54l15-wolfcrypt-tz.config (partition size 0x8B000)
4160+
4161+
```sh
4162+
tools/keytools/sign --ecc384 --sha384 test-app/image.bin wolfboot_signing_private_key.der 2
4163+
echo -n "pBOOT" > trigger_magic.bin
4164+
./tools/bin-assemble/bin-assemble \
4165+
update.bin \
4166+
0x0 test-app/image_v2_signed.bin \
4167+
0x8AFFB trigger_magic.bin
4168+
```
4169+
4170+
Flash the assembled image to the update partition:
4171+
4172+
```
4173+
JLinkExe -device nRF54L15_xxAA -if SWD -speed 4000 -autoconnect 1
4174+
loadbin update.bin 0xF1000
4175+
rnh
4176+
```
4177+
40634178
## Simulated
40644179

40654180
You can create a simulated target that uses files to mimic an internal and

‎hal/nrf54l-ns.ld‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
MEMORY
2+
{
3+
FLASH (rx) : ORIGIN = @ARCH_FLASH_OFFSET@, LENGTH = @BOOTLOADER_PARTITION_SIZE@
4+
RAM (rwx) : ORIGIN = 0x20000000, LENGTH = 256K
5+
}
6+
7+
SECTIONS
8+
{
9+
.text :
10+
{
11+
_start_text = .;
12+
KEEP(*(.isr_vector))
13+
*(.boot*)
14+
*(.text*)
15+
*(.rodata*)
16+
*(.init*)
17+
*(.fini*)
18+
. = ALIGN(4);
19+
_end_text = .;
20+
} > FLASH
21+
22+
.edidx :
23+
{
24+
. = ALIGN(4);
25+
*(.ARM.exidx*)
26+
} > FLASH
27+
28+
_stored_data = .;
29+
30+
.data : AT (_stored_data)
31+
{
32+
_start_data = .;
33+
KEEP(*(.data*))
34+
. = ALIGN(4);
35+
_end_data = .;
36+
} > RAM
37+
38+
.bss (NOLOAD) :
39+
{
40+
_start_bss = .;
41+
__bss_start__ = .;
42+
*(.bss*)
43+
*(COMMON)
44+
. = ALIGN(4);
45+
_end_bss = .;
46+
__bss_end__ = .;
47+
_end = .;
48+
} > RAM
49+
. = ALIGN(4);
50+
}
51+
52+
END_STACK = ORIGIN(RAM) + LENGTH(RAM);

0 commit comments

Comments
 (0)