Skip to content

applications: nrf_desktop: nrf54h20: migrate to ironside se #24494

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 22, 2025
Merged

applications: nrf_desktop: nrf54h20: migrate to ironside se #24494

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 16 additions & 14 deletions applications/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/app_common.dtsi
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,11 @@
/*
* Copyright (c) 2024 Nordic Semiconductor ASA
* Copyright (c) 2024-2025 Nordic Semiconductor ASA
*
* SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
*/

#include "memory_map.dtsi"

/ {
/* Redefine leds to fit CAF requirements. */
/delete-node/ leds;
Expand Down Expand Up @@ -51,25 +53,25 @@
label = "Green LED 3";
};
};

aliases {
nrfdesktop-dvfs-clock = &cpuapp_hsfll;
};
};

&cpusec_cpuapp_ipc {
status = "okay";
/* Define the necessary aliases for the MCUboot slots that will be used by the DFU transports.
* Due to the build system limitation, the allowed size of the application image (configured by
* the code partition DTS node) is incorrectly increased by the size allocated for the radio image.
*/
slot0_partition: &cpuapp_slot0_partition {
label = "image-0";
};

&cpusec_bellboard {
status = "okay";
slot1_partition: &cpuapp_slot1_partition {
label = "image-1";
};

/* Shrink ppr partition as ppr core is not used and extend app core code partition. */
&cpuppr_code_partition {
reg = < 0xf8000 DT_SIZE_K(32) >;
/* Remove the undefined property value from the disabled VPR cores to prevent build errors. */
&cpuflpr_vpr {
/delete-property/ source-memory;
};

&cpuapp_slot0_partition {
reg = < 0xa6000 DT_SIZE_K(328) >;
&cpuppr_vpr {
/delete-property/ source-memory;
};
36 changes: 36 additions & 0 deletions applications/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/images/mcuboot/app.overlay
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
/*
* Copyright (c) 2025 Nordic Semiconductor ASA
*
* SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
*/

#include "../../memory_map.dtsi"

/* The nRF54H20 DK defines memory map using DTS.
* Assign the bootloader partition to the MCUboot image.
*/
/ {
chosen {
zephyr,code-partition = &cpuapp_boot_partition;
};
};

/* Define the necessary aliases for the DTS partition nodes that contain the application and
* radio images.
*/
slot0_partition: &cpuapp_slot0_partition {
label = "image-0";
};

slot1_partition: &cpuapp_slot1_partition {
label = "image-1";
};

/* Remove the undefined property value from the disabled VPR cores to prevent build errors. */
&cpuflpr_vpr {
/delete-property/ source-memory;
};

&cpuppr_vpr {
/delete-property/ source-memory;
};
3 changes: 3 additions & 0 deletions ...s/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/images/mcuboot/mcuboot_private.pem
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
-----BEGIN PRIVATE KEY-----
MC4CAQAwBQYDK2VwBCIEIFe3odXpEgmHpGsRmLZkC9FS+DMxKO5yi6BmKTctX05/
-----END PRIVATE KEY-----
51 changes: 51 additions & 0 deletions applications/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/images/mcuboot/prj.conf
View file
Open in desktop
Copy link
Contributor Author

@kapi-no kapi-no Sep 15, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Switch to HW crypto by enabling the nRF Security module with the next PR update operation.
(Currently, the CONFIG_BOOT_USE_TINYCRYPT is enabled).

Apply to other MCUboot configurations.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

addressed

Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
#
# Copyright (c) 2025 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#
CONFIG_SIZE_OPTIMIZATIONS=y

CONFIG_HW_STACK_PROTECTION=y
CONFIG_MAIN_STACK_SIZE=10240
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_FLASH=y
# CONFIG_FPROTECT is not supported yet on the nRF54H20 SoC

# Configure Zephyr system power management
# The Zephyr system power management is used by the MCUboot bootloader to detect wake-up from
# S2RAM and redirect execution to the resume routine of the application image
CONFIG_PM=y
CONFIG_PM_S2RAM=y
CONFIG_PM_S2RAM_CUSTOM_MARKING=y

# Enable HW cryptography in the MCUboot bootloader and its dependencies
# The PSA operations are handled by the SDFW Service Framework (SDFW)
# that is enabled with the CONFIG_PSA_SSF_CRYPTO_CLIENT Kconfig option.
CONFIG_NRF_SECURITY=y
CONFIG_MULTITHREADING=y
CONFIG_PSA_SSF_CRYPTO_CLIENT=y

# Reduce memory consumption
CONFIG_BOOT_BANNER=n
CONFIG_NCS_BOOT_BANNER=n
CONFIG_CLOCK_CONTROL=n
CONFIG_SPI_NOR=n
CONFIG_GPIO=n
CONFIG_SERIAL=n
CONFIG_CONSOLE=n
CONFIG_UART_CONSOLE=n
CONFIG_PRINTK=n
CONFIG_USE_SEGGER_RTT=n

# Use minimal C library instead of the Picolib
CONFIG_MINIMAL_LIBC=y

# Activate Link Time Optimization (LTO)
CONFIG_LTO=y
CONFIG_ISR_TABLES_LOCAL_DECLARATION=y

# Improve debugging experience by disabling reset on fatal error
CONFIG_RESET_ON_FATAL_ERROR=n
51 changes: 51 additions & 0 deletions ...tions/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/images/mcuboot/prj_dongle.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
#
# Copyright (c) 2025 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#
CONFIG_SIZE_OPTIMIZATIONS=y

CONFIG_HW_STACK_PROTECTION=y
CONFIG_MAIN_STACK_SIZE=10240
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_FLASH=y
# CONFIG_FPROTECT is not supported yet on the nRF54H20 SoC

# Configure Zephyr system power management
# The Zephyr system power management is used by the MCUboot bootloader to detect wake-up from
# S2RAM and redirect execution to the resume routine of the application image
CONFIG_PM=y
CONFIG_PM_S2RAM=y
CONFIG_PM_S2RAM_CUSTOM_MARKING=y

# Enable HW cryptography in the MCUboot bootloader and its dependencies
# The PSA operations are handled by the SDFW Service Framework (SDFW)
# that is enabled with the CONFIG_PSA_SSF_CRYPTO_CLIENT Kconfig option.
CONFIG_NRF_SECURITY=y
CONFIG_MULTITHREADING=y
CONFIG_PSA_SSF_CRYPTO_CLIENT=y

# Reduce memory consumption
CONFIG_BOOT_BANNER=n
CONFIG_NCS_BOOT_BANNER=n
CONFIG_CLOCK_CONTROL=n
CONFIG_SPI_NOR=n
CONFIG_GPIO=n
CONFIG_SERIAL=n
CONFIG_CONSOLE=n
CONFIG_UART_CONSOLE=n
CONFIG_PRINTK=n
CONFIG_USE_SEGGER_RTT=n

# Use minimal C library instead of the Picolib
CONFIG_MINIMAL_LIBC=y

# Activate Link Time Optimization (LTO)
CONFIG_LTO=y
CONFIG_ISR_TABLES_LOCAL_DECLARATION=y

# Improve debugging experience by disabling reset on fatal error
CONFIG_RESET_ON_FATAL_ERROR=n
50 changes: 50 additions & 0 deletions ...ions/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/images/mcuboot/prj_release.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
#
# Copyright (c) 2025 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#
CONFIG_SIZE_OPTIMIZATIONS=y

CONFIG_HW_STACK_PROTECTION=y
CONFIG_MAIN_STACK_SIZE=10240
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_FLASH=y
# CONFIG_FPROTECT is not supported yet on the nRF54H20 SoC

CONFIG_RESET_ON_FATAL_ERROR=y

# Configure Zephyr system power management
# The Zephyr system power management is used by the MCUboot bootloader to detect wake-up from
# S2RAM and redirect execution to the resume routine of the application image
CONFIG_PM=y
CONFIG_PM_S2RAM=y
CONFIG_PM_S2RAM_CUSTOM_MARKING=y

# Enable HW cryptography in the MCUboot bootloader and its dependencies
# The PSA operations are handled by the SDFW Service Framework (SDFW)
# that is enabled with the CONFIG_PSA_SSF_CRYPTO_CLIENT Kconfig option.
CONFIG_NRF_SECURITY=y
CONFIG_MULTITHREADING=y
CONFIG_PSA_SSF_CRYPTO_CLIENT=y

# Reduce memory consumption
CONFIG_BOOT_BANNER=n
CONFIG_NCS_BOOT_BANNER=n
CONFIG_CLOCK_CONTROL=n
CONFIG_SPI_NOR=n
CONFIG_GPIO=n
CONFIG_SERIAL=n
CONFIG_CONSOLE=n
CONFIG_UART_CONSOLE=n
CONFIG_PRINTK=n
CONFIG_USE_SEGGER_RTT=n

# Use minimal C library instead of the Picolib
CONFIG_MINIMAL_LIBC=y

# Activate Link Time Optimization (LTO)
CONFIG_LTO=y
CONFIG_ISR_TABLES_LOCAL_DECLARATION=y
50 changes: 50 additions & 0 deletions ...f_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/images/mcuboot/prj_release_dongle.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
#
# Copyright (c) 2025 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#
CONFIG_SIZE_OPTIMIZATIONS=y

CONFIG_HW_STACK_PROTECTION=y
CONFIG_MAIN_STACK_SIZE=10240
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_FLASH=y
# CONFIG_FPROTECT is not supported yet on the nRF54H20 SoC

CONFIG_RESET_ON_FATAL_ERROR=y

# Configure Zephyr system power management
# The Zephyr system power management is used by the MCUboot bootloader to detect wake-up from
# S2RAM and redirect execution to the resume routine of the application image
CONFIG_PM=y
CONFIG_PM_S2RAM=y
CONFIG_PM_S2RAM_CUSTOM_MARKING=y

# Enable HW cryptography in the MCUboot bootloader and its dependencies
# The PSA operations are handled by the SDFW Service Framework (SDFW)
# that is enabled with the CONFIG_PSA_SSF_CRYPTO_CLIENT Kconfig option.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would consider explicitly enabling the CONFIG_PSA_SSF_CRYPTO_CLIENT instead of commenting on that (to ensure it's actually set here). I also wonder if we actually need keep the CONFIG_PSA_CRYPTO_DRIVER_OBERON enabled. Do we actually use the driver?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, we don't need it. However, disabling this Kconfig option doesn't change the memory footprint of the mcuboot image, so I think this Kconfig option is not even used for the nRF54H20 platform.

I would leave the default configuration and let the bootloader team optimize the Kconfig set and get rid of unnecessary Kconfigs.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Contacting bootloader team regarding this might be a good idea. It would be great if the configuration could be improved here.

CONFIG_NRF_SECURITY=y
CONFIG_MULTITHREADING=y
CONFIG_PSA_SSF_CRYPTO_CLIENT=y

# Reduce memory consumption
CONFIG_BOOT_BANNER=n
CONFIG_NCS_BOOT_BANNER=n
CONFIG_CLOCK_CONTROL=n
CONFIG_SPI_NOR=n
CONFIG_GPIO=n
CONFIG_SERIAL=n
CONFIG_CONSOLE=n
CONFIG_UART_CONSOLE=n
CONFIG_PRINTK=n
CONFIG_USE_SEGGER_RTT=n

# Use minimal C library instead of the Picolib
CONFIG_MINIMAL_LIBC=y

# Activate Link Time Optimization (LTO)
CONFIG_LTO=y
CONFIG_ISR_TABLES_LOCAL_DECLARATION=y
60 changes: 60 additions & 0 deletions applications/nrf_desktop/configuration/nrf54h20dk_nrf54h20_cpuapp/memory_map.dtsi
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
/*
* Copyright (c) 2025 Nordic Semiconductor ASA
*
* SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
*/

&mram1x {
/delete-node/ partitions;

/* Redefine the "partitions" DTS node. */
partitions {
compatible = "fixed-partitions";
#address-cells = <1>;
#size-cells = <1>;

/* Partitions belonging to the MRAM_10 memory block.
* The start of the MRAM_10 memory is reserved for internal IronSide SE firmware.
*/

cpuapp_boot_partition: partition@30000 {
reg = <0x30000 DT_SIZE_K(24)>;
};

/* Due to the build system limitation, the allowed size of the application image
* (configured by the code partition DTS node) is incorrectly increased by the size
* allocated for the radio image.
*/
cpuapp_slot0_partition: partition@36000 {
reg = <0x36000 DT_SIZE_K(808)>;
};

cpurad_slot0_partition: partition@c9000 {
reg = <0xc9000 DT_SIZE_K(220)>;
};

/* Partitions belonging to the MRAM_11 memory block. */

/* Due to the build system limitation, the allowed size of the application image
* (configured by the code partition DTS node) is incorrectly increased by the size
* allocated for the radio image.
*/
cpuapp_slot1_partition: partition@100000 {
reg = <0x100000 DT_SIZE_K(808)>;
};

cpurad_slot1_partition: partition@193000 {
reg = <0x193000 DT_SIZE_K(220)>;
};

storage_partition: partition@1ca000 {
reg = <0x1ca000 DT_SIZE_K(40)>;
};

periphconf_partition: partition@1d4000 {
reg = <0x1d4000 DT_SIZE_K(8)>;
};

/* The end of the MRAM_11 memory is left unallocated. */
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that in some future - there might be an allocation here for the SDFW recovery logic.
The draft default values are:

  • 0x1b0000 - 0x1c0000: the secondary_partition for the code
  • 0x1c0000 - 0x1c2000: the secondary_periphconf_partition for the alternative periphconf

};
};
Loading