Cryptocell and usb

RE: Cryptocell and usb

AintMina — Tue, 08 Oct 2024 08:15:15 GMT

Welp, I found the problem... Cryptocell HAS to be enabled in bootloader stage in order to have it enabled in app. So if you have mcuboot running without cryptocell you can only run apps without CC enabled in them.

RE: Cryptocell and usb

Einar Thorsrud — Tue, 10 Sep 2024 10:33:35 GMT

Hi,

I double checked when I build with your board files, and both the bootloader and application are configured to use the LFRC (boards without crystals is also very common and as long as the LFRC is configured that should not cause problems).

Regardign this being a HW issue I don't see anythign indicating it, but on the other hand it is difficult to understand this issue, so it could be worth while taking a look if you can shere your schematics (and perhaps also the layout).

RE: Cryptocell and usb

AintMina — Wed, 04 Sep 2024 09:08:31 GMT

Would you be able to test it without 32k clock CONNECTED to mcu?

The nrf52dk doesnt have full CC and the only difference I can figure out is that you DK board has external 32k clock connected.

Also I did figure out that the app breaks before EARLY, PRE_KERNEL_1 and PRE_KERNEL_2. I used LEDs as debug in those states.

I also tried to enable usb logging in APPLICATION state and it worked, but when I enabled it in PRE or POST kernel, then my PRE kernel LED debug flashed really fast. So confirming that the app with CC enabled does not even reach kernel.

Do you have any ideas if this could be a schematic problem?

RE: Cryptocell and usb

Einar Thorsrud — Thu, 29 Aug 2024 11:39:49 GMT

Hi,

I see. I misunderstood this to be about USB and CryptoCell (I did not see any samples failing with your your board files, withou or without CryptoCell or debugging or not). But this is related to your MCUBoot configuration it seems? To test that, I took the zephy blinkyt sample from nRF Connect SDK 2.6.1 and did the following changes:

Added to prj.conf:

CONFIG_BOOTLOADER_MCUBOOT=y

made a child_image/mcuboot.conf where I copy-pasted all configs from your last post. And as I am testing on the nRF52840 DK I modified nrf52840_qalmari.dts so that led0 is gpio P0.14 as that is a LED on the DK.

So this is your board files (with the led0 pin changed) and your mcuboot configuration. However, the applciation is startd and works as expected. So I am unfortunately still not able to reproduce the issue.

Can you explain more, and perhaps attach the application (all files including config files, CMakeLists.txt etc) that you are using?

RE: Cryptocell and usb

AintMina — Thu, 29 Aug 2024 09:33:02 GMT

[quote userid="7377" url="~/f/nordic-q-a/112743/cryptocell-and-usb/500388"]I thought the problem was running the usb console sample with CryptoCell defined in your board files?[/quote]

No, the problem is that CC breaks ANY sample code. I remembered that I tested the bluetooth function to work WITH debugger not without.

[quote userid="7377" url="~/f/nordic-q-a/112743/cryptocell-and-usb/500388"]And if so, can we start with if you are using MCUboot, NSIB, both, or some custom bootloader?[/quote]

Im using MCUboot from the SDK with this config and CC disabled:

CONFIG_PM=n

CONFIG_MAIN_STACK_SIZE=10240
CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"

CONFIG_BOOT_SWAP_SAVE_ENCTLV=n
CONFIG_BOOT_ENCRYPT_IMAGE=n

CONFIG_BOOT_UPGRADE_ONLY=n
CONFIG_BOOT_BOOTSTRAP=n

### mbedTLS has its own heap
# CONFIG_HEAP_MEM_POOL_SIZE is not set

### We never want Zephyr's copy of tinycrypt.  If tinycrypt is needed,
### MCUboot has its own copy in tree.
# CONFIG_TINYCRYPT is not set
# CONFIG_TINYCRYPT_ECC_DSA is not set
# CONFIG_TINYCRYPT_SHA256 is not set

CONFIG_FLASH=y
CONFIG_FPROTECT=y

### Various Zephyr boards enable features that we don't want.
# CONFIG_BT is not set
# CONFIG_BT_CTLR is not set
# CONFIG_I2C is not set

CONFIG_LOG=y
CONFIG_LOG_MODE_MINIMAL=y # former CONFIG_MODE_MINIMAL
### Ensure Zephyr logging changes don't use more resources
CONFIG_LOG_DEFAULT_LEVEL=0
### Use info log level by default
CONFIG_MCUBOOT_LOG_LEVEL_INF=y
### Decrease footprint by ~4 KB in comparison to CBPRINTF_COMPLETE=y
CONFIG_CBPRINTF_NANO=y
### Use the minimal C library to reduce flash usage
CONFIG_MINIMAL_LIBC=y
CONFIG_NRF_RTC_TIMER_USER_CHAN_COUNT=0



# IS BOOTLOADER?
CONFIG_IS_BOOTLOADER=y
CONFIG_BOOTLOADER_SRAM_SIZE=256
CONFIG_MCUBOOT_INDICATION_LED=y

# Required by USB
CONFIG_MULTITHREADING=y

# USB
CONFIG_USB_DEVICE_STACK=y
CONFIG_USB_DFU_CLASS=y
CONFIG_USB_DEVICE_REMOTE_WAKEUP=n

#### MAY FUCK UP YOUR DAY 
#CONFIG_USB_DFU_REBOOT=y

CONFIG_USB_DEVICE_PRODUCT="MCUBOOT"
CONFIG_USB_DEVICE_VID=0x1915
CONFIG_USB_DEVICE_PID=0x520F

CONFIG_BOOT_USB_DFU_GPIO=y
CONFIG_BOOT_SERIAL_PIN_RESET=y


# Serial
CONFIG_CONSOLE=n
CONFIG_SERIAL=y
CONFIG_UART_INTERRUPT_DRIVEN=y
CONFIG_UART_LINE_CTRL=y

# MCUBoot serial
CONFIG_GPIO=y
CONFIG_MCUBOOT_SERIAL=y
CONFIG_BOOT_SERIAL_CDC_ACM=y
CONFIG_NORDIC_QSPI_NOR=n

Also to add here, the same code works with CC disabled and uploaded through MCUboot.

RE: Cryptocell and usb

Einar Thorsrud — Thu, 29 Aug 2024 09:14:52 GMT

Hi,

I thought the problem was running the usb console sample with CryptoCell defined in your board files? I tested that with nRF Connect SDK v2.6.1 as that is what you descibed. (So that is using the saple from sdk-zephyr in that nRF Connect SDK release).

[quote user="AintMina"]Is there some specific config I need in the mcuboot to upload CC software? though it did also break the bootloader when CC was enabled...[/quote]

No. But as the bootloader normally does crypto operations (validating images on activation and on boot), there may be a difference depending on if CryptoCell is enabled or not if you configure the bootloder to use cryptocell fro crypto operations. Is the issue here in the bootloader? If so we need to look into that. And if so, can we start with if you are using MCUboot, NSIB, both, or some custom bootloader? And also if using the bootloaders we provide in the SDK, which changes have you made and can you share the configuration etc?

RE: Cryptocell and usb

AintMina — Thu, 29 Aug 2024 08:36:15 GMT

I though we already established this that it's not USB and CryptoCell, it's just CryptoCell.

There is no need to trigger anything and no, CC(CryptoCell) is the only change.

Hmm...

Are there some HW requirements for CC?

Does it require external 32k clock?

Did you use sdk-zephyr or zephyr? the board files do differ between these. I used sdk-zephyr since thats what vscode automatically uses.

Is there some specific config I need in the mcuboot to upload CC software? though it did also break the bootloader when CC was enabled...

RE: Cryptocell and usb

Einar Thorsrud — Wed, 28 Aug 2024 14:18:17 GMT

Hi,

I built the console sample (zephyr/samples/subsys/usb/console/) using your unmodified board files (which include cryptocell in the device tree), and the sample works as expected when I test on a DK also when I am not debugging (I even power-cycled the device). I get the expected output in the CDC terminal.

Do you need to do anything else to trigger the issue? As mentionned before I am not able to see a link between USB and CryptoCell so honestly I am not very suprised about this result. Could it be that you have also made other changes at the same time, and that the problem was something else?

RE: Cryptocell and usb

AintMina — Wed, 28 Aug 2024 08:44:46 GMT

Don't mind the mess, it's a work in progress still.

devzone.nordicsemi.com/.../6747.boards.zip

RE: Cryptocell and usb

Einar Thorsrud — Wed, 28 Aug 2024 07:50:50 GMT

Hi,

[quote user="AintMina"]The problem is that in vscode the "flash", "erase and flash" and "debug" all use "merged.hex" and not the APP. Meaning everytime I flash my app with the debugger I replace my working bootloader with the non working one. This is a terrible way of doing things if bootloader and app are developed by different people or departments. This means I HAVE to have the bootloader on my computer when I want to debug an app for it.[/quote]

That is a good point. The reason we do it like this is that it makes the most common use case working out of the box. Whenever you try to flash or debug, you will get all images in case of multi image projects. But this is not always wat you want. An alternative could be to get the hex file you want to use, and point to that using CONFIG_MCUBOOT_BUILD_STRATEGY_USE_HEX_FILE. See here for more details on that.

[quote user="AintMina"] the problem is that cryptocell doesn't work without debugger attached. This was the same problem which "deleted" my bootloader since the APP also enabled cryptocell in the bootloader and overwrote it and thus bootloader didn't work anymore. [/quote]

I see. This is what we must focus on. However, I have not been able to reproduce this which is why I have been asking for more information.

[quote user="AintMina"]And why would I need DK to run the sample codes? I still havent been able to start writing the actual FW to this, because theres still something wrong with the config and that's what Im trying to figure out.[/quote]

There are a few good reasons for having a DK. First of all, it is a known good piece of hardware, and as such a good platform for prototying and debugging specific issues. It is also a platform we in Nordic tech support has access to, so if you were able to reproduce the issue on that, you could let us know how we can reproduce on our end. It can also be used to debug your custom board (which you described early on that you did not want to do or were not able to do).

[quote user="AintMina"]

So, why is cryptocell only working with debugger?

Without debugger, the cryptocell app doesnt even reach main.

Im running the board in normal mode and DCDC is NOT enabled.

[/quote]

That what we need to figure out. Can you share your full set of board files in a zip so that I get the full picure and have better hops of being able to reproduce the issue? (I want to start with simply building for your board and running that on my DK as that seems like the best option at this point).

RE: Cryptocell and usb

AintMina — Tue, 27 Aug 2024 09:13:35 GMT

To the first part:

The problem is that in vscode the "flash", "erase and flash" and "debug" all use "merged.hex" and not the APP. Meaning everytime I flash my app with the debugger I replace my working bootloader with the non working one. This is a terrible way of doing things if bootloader and app are developed by different people or departments. This means I HAVE to have the bootloader on my computer when I want to debug an app for it.

The second part:

I consider the device bricked when it does not show up in the programming app. The weird part about it was that vscode and nrf connect app did not find the device, but JLinkExe did. And after connecting through JLinkExe, vscode and nrf connect app found it.

And yes, the problem is that cryptocell doesn't work without debugger attached. This was the same problem which "deleted" my bootloader since the APP also enabled cryptocell in the bootloader and overwrote it and thus bootloader didn't work anymore. This is the jankiest MCU I've ever used...

And why would I need DK to run the sample codes? I still havent been able to start writing the actual FW to this, because theres still something wrong with the config and that's what Im trying to figure out.

So, why is cryptocell only working with debugger?

Without debugger, the cryptocell app doesnt even reach main.

Im running the board in normal mode and DCDC is NOT enabled.

RE: Cryptocell and usb

Einar Thorsrud — Mon, 26 Aug 2024 08:45:16 GMT

Hi,

Regarding "1. Why did the debugger erase my bootloader even though the app was built for it?", I do not know how you used it, but if you do a full erase / erase all (which you often do when programming or debugging), that will erase the whole flash, includign any bootlaoders and the UICR. If you just want to re-flash the application you can seelct to use sector erase. If you are using nRF Connect for VS code for programming you can select if you want to do a full erase or not when flashing, as explaind in this post.

Regarding "2. How did the debugger(NRF52dk) brick the board even though the code was running before bricking it?" I do not know which state it what in when you refer to it as "bricked" nor how it got there. If you can share details about how it behaved when you define it as "bricked", how it ended up in that state and hwo it receoverd, we may be able to understand more.

Generally, there is no need to use a debugger to get CrytpoCell to work, and also no conflict between CryptoCell and USB. So I suspect there are other more fundamental issues with your device or setup. I am also not able to understand the comments about debugger bricking your device. I kindly ask that you elaborate much more and provide exact details if you want specific feedback.

It seems to me that you are seeing a significant number of seemingly unrelated issues that are difficult to explain. I would suggest that you try to reduce the numer fo unkowns in the beginning by obtaining a DK so tha that you have known good hardware and test parts of your firmware on that. Then you can gradually move to your custom HW. Alternatively, there is an absolute requierment that you are able to debug your hardware.

RE: Cryptocell and usb

AintMina — Sat, 24 Aug 2024 10:54:38 GMT

Great, this place removes posts...

and now the ****** board is bricked...

1. Why did the debugger erase my bootloader even though the app was built for it?

2. How did the debugger(NRF52dk) brick the board even though the code was running before bricking it?

Well, I managed to get it unbricked by messing around with gpio registers from JLinkExe. Apparently it needs to be connected with JLinkExe every time it disappears. So theres something funky going on with nrfutil...

But now I can't get the mcuboot to work and I don't have the original mcuboot config which we managed to get to work after a long battle...

RE: Cryptocell and usb

AintMina — Fri, 23 Aug 2024 15:02:48 GMT

Apparently cryptocell only works with debugger attached. Whats up with that?

RE: Cryptocell and usb

AintMina — Thu, 22 Aug 2024 10:44:49 GMT

Clearly you didnt read ***. I have stated that I DO NOT have access to any DK board which has USB connected to the MCU.

[quote userid="134745" url="~/f/nordic-q-a/112743/cryptocell-and-usb/492631"]

1. Installed fresh ubuntu 22.04 virtual machine

2. Installed vscode

3. Installed nrf extension pack for vscode

4. Installed 2.6.1 toolchain and SDK from vscode extension

[/quote]

5. Build "console" sample code for my custom boarddevzone.nordicsemi.com/.../nrf52840_5F00_custom.dts

6. Opened any serial terminal and saw the hello world message

7. Enable cryptocell in board files OR app overlay, delete build folder and build again

8. Serial terminal cannot connect to it anymore nor does lsusb find the device anymore

RE: Cryptocell and usb

Einar Thorsrud — Thu, 22 Aug 2024 07:11:40 GMT

Hi,

I have read this thread again and I am unfrortunately not able to understand what the issue is and what you want us to do. Please provide a detailed set of step by step instructions of how to reproduce this issue on a DK if you want us to look more into this. Also please note that I do not try to be difficult, it is just that I am simply not able to understand the issue from reading this thread.

RE: Cryptocell and usb

AintMina — Wed, 21 Aug 2024 18:04:48 GMT

...Im tired of explaining this already, read the posts... Build "console", *** works, enable cryptocell, *** no work!

if you have more questions you have to be more specific

RE: Cryptocell and usb

Einar Thorsrud — Fri, 09 Aug 2024 14:29:48 GMT

Hi,

Dejan is out office so I have taken over this case. Reading through this case I have problems understanding the issue. Can you please explain from the beginning the exact issue and how to reproduce it?

PS: Regarding not having a debugger, that is essential for embedded development. I assume you have at least one as you are able to program it? And using the DK as a debugger should not brick your custom board in any way. If that was the case I suggest a separate thread about that (my guess would be a that you power the board before attacking the debugger with a common ground, but this would then be an issue regardless of which debugger you connected).

RE: Cryptocell and usb

AintMina — Tue, 06 Aug 2024 11:58:16 GMT

As I said, I don't have access to proper debugger, so the first test would be to figure out why you got the same ish problem and try to see if it's the same.

Notify when you find a solution to the problem.

RE: Cryptocell and usb

dejans — Fri, 26 Jul 2024 10:31:39 GMT

Hi,

[quote user="AintMina"]I have already told you these things...[/quote]

Yes, this is correct. You said that your device no longer gets recognized as a usb serial device and it is not found with NRF Connect or any other serial terminal software. I might have hoped for additional information.
Did you get any console output from the sample when cryptocell was disabled and when it was enabled?

[quote user="AintMina"]You replicated the same problem as I got and still refuse to help on it...[/quote]

I am not sure if the cause of the problem in our testing is the same. I am not refusing to help you. On the contrary, I am doing further testing and having internal discussion trying to assist you. Are you able to send a software which can be run on nrf52840-dongle that would verify the behavior?

Best regards,
Dejan

RE: Cryptocell and usb

AintMina — Thu, 25 Jul 2024 12:20:01 GMT

Is this question simulator?? I have already told you these things...

You replicated the same problem as I got and still refuse to help on it...

RE: Cryptocell and usb

dejans — Wed, 24 Jul 2024 10:56:31 GMT

Hi,

Regarding the warnings, they should be supressed in the build system pre_dt_board.cmake but probably not in VS Code.

How did you test on your board that USB communication breaks when cryptocell is enabled?

Best regards,
Dejan

RE: Cryptocell and usb

AintMina — Tue, 23 Jul 2024 06:28:24 GMT

Hi,

[quote userid="111786" url="~/f/nordic-q-a/112743/cryptocell-and-usb/493372"]This can be fixed by adding following lines to the app.overlay file[/quote]

This is more of workaround than a fix, but anyway this wasn't the actual problem.

[quote userid="111786" url="~/f/nordic-q-a/112743/cryptocell-and-usb/493372"]Is USB communication broken when you disable cryptocell in app.overlay?[/quote]

I have said that the software works when cryptocell is disabled in the board files, meaning theres something wrong with it when enabled. The question is what?

You got the possible same error as I got so could you help?

RE: Cryptocell and usb

dejans — Thu, 11 Jul 2024 10:56:05 GMT

Hi,

I have tested building part of the USB console sample in NCS v2.6.1 on nrf52840-dk. I have seen ACL, cryptocell, clock and power warnings. There were address collisions between ACL and flash-controller as well as between power and clock. Did you see the same warnings on nrf52840-dk?

[quote user=""]

Q1: Why doesn't the devicetree find "nordic,cryptocell"? I get a warning like this: Unknown node type "nordic,cryptocell"

- This also applies to nrf52840 Dongle and DK.

[/quote]

This can be fixed by adding following lines to the app.overlay file

&cryptocell {
	compatible = "arm,cryptocell-310";
	status = "okay";
};

[quote user=""]Q2: Cryptocell is enabled by default in nrf52840 devicetree which gets applied to all the boards (like nrf52840dongle and nrf52840dk and my custom board which uses nrf52840dongle as template). But this breaks the usb communication with the "console" sample on my custom board (It does build though).[/quote]

Is USB communication broken when you disable cryptocell in app.overlay?

&cryptocell {
	status = "disabled";
};

[quote user=""]

Q3: The acl node has also a warning: Address range collides with flash-controller@4001e000 (both start at 0x4001e000)

- But it still works with it enabled.

[/quote]

This is the same address collision warning that I have seen on the nrf52840-dk. Can you elaborate on "But it still works with it enabled"?

Best regards,
Dejan

RE: Cryptocell and usb

AintMina — Tue, 09 Jul 2024 06:58:40 GMT

Hi,

[quote userid="111786" url="~/f/nordic-q-a/112743/cryptocell-and-usb/492797"]

Can you elaborate on step 6?

[/quote]

By clicking "devicetree" button in the vscode extension.

[quote userid="111786" url="~/f/nordic-q-a/112743/cryptocell-and-usb/492797"]Device could not be recognized as USB device. I have tested with cryptocell added to the app.overlay. Which modules specifically are you referring to and how did you disable them?[/quote]

So you got the same type of error as I got. Did you manage to figure out why? Did you istall the SDK from vscode extension? Which repo did you use? I noticed that the zephyr and the nrf-zephyr differ and especially with cryptocell. All my methods are by using the vscode extension and to replicate these you should use it too.

Why did you add cryptocell to app.overlay? It should have been enabled by default.

The modules seen in the devicetree picture! Did uou use the vscode method or cli? You can disable them from the devicetree gui.