Add support for configuring UICR.SECONDARY.PROCESSOR and UICR.PROTECTEDMEM #95733

SebastianBoe · 2025-09-09T13:05:39Z

Add support for PROTECTEDMEM.

Add support for uicr.SECONDARY.PROCESSOR.

samples/boards/nordic/nrf_ironside/secondary_boot_corruption/src/main.c

soc/nordic/common/uicr/gen_uicr.py

hakonfam · 2025-09-12T08:11:53Z

soc/nordic/common/uicr/gen_uicr.py


+        # Handle protected memory configuration
+        if args.protectedmem:
+            if args.protectedmem_size_bytes % 4096 != 0:


nit: Some variable named KB_4 would make this easier to read IMO.

soc/nordic/common/uicr/gen_uicr.py

soc/nordic/common/uicr/gen_uicr/Kconfig

hakonfam · 2025-09-12T08:14:43Z

samples/boards/nordic/nrf_ironside/secondary_boot_corruption/README.rst

+The sample uses UICR (User Information Configuration Registers) to configure
+secondary boot and protected memory regions, then intentionally corrupts the


Should we state explicitly that we enable the secondary boot? Not only configure it, some users might assume that it is enabled by default.

hakonfam · 2025-09-12T08:16:07Z

samples/boards/nordic/nrf_ironside/secondary_boot_corruption/README.rst

+************
+
+* nRF54H20DK board
+* Zephyr SDK 0.17.0 or later


Do we need to state this?

hakonfam · 2025-09-12T08:17:15Z

samples/boards/nordic/nrf_ironside/secondary_boot_corruption/README.rst

+* ``CONFIG_ARM_MPU=n``: Disables the MPU to allow memory corruption
+* ``CONFIG_GEN_UICR_SECONDARY=y``: Enables secondary boot in UICR
+* ``CONFIG_GEN_UICR_PROTECTEDMEM=y``: Enables protected memory in UICR
+* ``CONFIG_FLASH_LOAD_OFFSET=0x1b0000``: Places secondary image at correct address


For which sample? Does both set all of these?

Removed docs.

The config is most easily understood by reading the config files.

hakonfam · 2025-09-12T08:17:55Z

samples/boards/nordic/nrf_ironside/secondary_boot_corruption/README.rst

+
+* **Primary Image**: Located at ``0xe030000`` (default slot0_partition)
+* **Secondary Image**: Located at ``0xe1b0000`` (secondary_partition)
+* **UICR Configuration**: Generated and placed at ``0xfff8000``


Should we have this here? Isn't that part of the nRF54H20 architecture and not set by this sample? Does it give any value to present it here?

hakonfam · 2025-09-12T08:21:55Z

samples/boards/nordic/nrf_ironside/secondary_boot_corruption/src/main.c

+	/* Corrupt the protected memory (This is only possible because we
+	 * have disabled CONFIG_ARM_MPU).
+	 */
+	*((volatile uint32_t *)0xe030000) = 0x5EB0;


Reading this its not clear that 0xe0300000 is covered by PROTECTEDMEM.

The docs states that PROTECTEDMEM starts from the end of RSLOT, so at the start of this image, but its not clear that this is 0xe0300000.

would it be better to use the symbols in linker_defs.h (or similar) and CONFIG_GEN_UICR_PROTECTEDMEM_SIZE_BYTES directly?

Using linker_defs.h

samples/boards/nordic/nrf_ironside/secondary_boot_corruption/secondary/CMakeLists.txt

hakonfam · 2025-09-12T08:31:16Z

samples/boards/nordic/nrf_ironside/secondary_boot_corruption/src/main.c

+	*((volatile uint32_t *)0xe030008) = 0x5EB0;
+	*((volatile uint32_t *)0xe030010) = 0x5EB0;
+
+	printk("Rebooting\n");


The sample output would be much more self-explanatory if we printed something like "Corrupting memory" as well.

carlescufi · 2025-09-25T09:23:10Z

Added @hakonfam as maintainer since

zephyr/MAINTAINERS.yml

Line 6127 in 54916c7

- hakonfam

kartben · 2025-09-25T09:28:51Z

scripts/ci/check_compliance.py

        "GEN_UICR_SECONDARY", # Used in specialized build tool, not part of main Kconfig
        "GEN_UICR_SECONDARY_GENERATE_PERIPHCONF", # Used in specialized build tool, not part of main Kconfig
        "GEN_UICR_SECURESTORAGE", # Used in specialized build tool, not part of main Kconfig
+        "GEN_UICR_SECONDARY_PROCESSOR_VALUE", # Used in specialized build tool, not part of main Kconfig


Need to fix the order to pass compliance check

Thanks!

Fixed.

Add support for uicr.SECONDARY.PROCESSOR. Signed-off-by: Sebastian Bøe <[email protected]>

Add support for PROTECTEDMEM. Signed-off-by: Sebastian Bøe <[email protected]>

sonarqubecloud · 2025-09-29T10:37:05Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

zephyrbot added area: Samples Samples platform: nRF Nordic nRFx labels Sep 9, 2025

zephyrbot requested review from anangl, JarmouniA, jaz1-nordic, kartben, kl-cruz, magp-nordic, masz-nordic, nashif and nika-nordic September 9, 2025 13:06

zephyrbot assigned anangl and masz-nordic Sep 9, 2025

JarmouniA reviewed Sep 9, 2025

View reviewed changes

samples/boards/nordic/nrf_ironside/secondary_boot_corruption/src/main.c Outdated Show resolved Hide resolved

SebastianBoe force-pushed the protected_mem branch from 43e9550 to 5e71661 Compare September 9, 2025 14:16

zephyrbot added area: Continuous Integration area: Coding Guidelines Coding guidelines and style labels Sep 9, 2025

zephyrbot requested review from carlescufi, fabiobaltieri, jfischer-no, keith-zephyr, simhein and stephanosio September 9, 2025 14:17

SebastianBoe force-pushed the protected_mem branch from 5e71661 to 1b1544f Compare September 10, 2025 10:06

nika-nordic previously approved these changes Sep 11, 2025

View reviewed changes

hakonfam requested changes Sep 12, 2025

View reviewed changes

hakonfam reviewed Sep 12, 2025

View reviewed changes

SebastianBoe dismissed nika-nordic’s stale review via 63d2296 September 15, 2025 08:37

SebastianBoe force-pushed the protected_mem branch 2 times, most recently from 63d2296 to 61040fd Compare September 15, 2025 08:44

SebastianBoe dismissed hakonfam’s stale review via 6e740f7 September 22, 2025 13:51

SebastianBoe force-pushed the protected_mem branch from c7110b2 to 6e740f7 Compare September 22, 2025 13:51

SebastianBoe changed the title ~~Add support for configuring UICR.SECONDARY.PROCESSOR, UICR.PROTECTEDMEM, and a sample to demonstrate usage~~ Add support for configuring UICR.SECONDARY.PROCESSOR and UICR.PROTECTEDMEM Sep 22, 2025

zephyrbot requested review from bjarki-andreasen and hakonfam September 22, 2025 13:52

bjarki-andreasen previously approved these changes Sep 22, 2025

View reviewed changes

SebastianBoe force-pushed the protected_mem branch from 6e740f7 to 2153f20 Compare September 22, 2025 14:47

zephyrbot requested a review from bjarki-andreasen September 22, 2025 14:49

hakonfam dismissed bjarki-andreasen’s stale review via 57486a5 September 23, 2025 07:08

hakonfam force-pushed the protected_mem branch from 2153f20 to 57486a5 Compare September 23, 2025 07:08

carlescufi assigned hakonfam Sep 25, 2025

carlescufi unassigned anangl, masz-nordic and bjarki-andreasen Sep 25, 2025

kartben reviewed Sep 25, 2025

View reviewed changes

SebastianBoe force-pushed the protected_mem branch from 57486a5 to 058c94c Compare September 29, 2025 09:41

zephyrbot added area: Linters area: Boards/SoCs labels Sep 29, 2025

hakonfam approved these changes Sep 29, 2025

View reviewed changes

SebastianBoe added 2 commits September 29, 2025 12:33

soc: nordic: uicr: Add support for uicr.SECONDARY.PROCESSOR

f1eff2a

Add support for uicr.SECONDARY.PROCESSOR. Signed-off-by: Sebastian Bøe <[email protected]>

soc: nordic: uicr: Add support for uicr.PROTECTEDMEM

556f2da

Add support for PROTECTEDMEM. Signed-off-by: Sebastian Bøe <[email protected]>

SebastianBoe force-pushed the protected_mem branch from 058c94c to 556f2da Compare September 29, 2025 10:33

zephyrbot requested a review from hakonfam September 29, 2025 10:35

SebastianBoe requested a review from kartben September 29, 2025 11:34

bjarki-andreasen approved these changes Sep 29, 2025

View reviewed changes

hakonfam approved these changes Sep 29, 2025

View reviewed changes

cfriedt merged commit 7c9275c into zephyrproject-rtos:main Sep 29, 2025
31 checks passed

SebastianBoe deleted the protected_mem branch October 8, 2025 13:55

		The sample uses UICR (User Information Configuration Registers) to configure
		secondary boot and protected memory regions, then intentionally corrupts the

Add support for configuring UICR.SECONDARY.PROCESSOR and UICR.PROTECTEDMEM #95733

Add support for configuring UICR.SECONDARY.PROCESSOR and UICR.PROTECTEDMEM #95733

Conversation

SebastianBoe commented Sep 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SebastianBoe Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

carlescufi commented Sep 25, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Sep 29, 2025

Quality Gate passed

Uh oh!

Uh oh!

Uh oh!

SebastianBoe commented Sep 9, 2025 •

edited

Loading

SebastianBoe Sep 15, 2025 •

edited

Loading