Adding IPC to TF-M secure peripheral project

RE: Adding IPC to TF-M secure peripheral project

Elfving — Tue, 24 Sep 2024 13:54:37 GMT

[quote user="afok-esmart"]I anticipate smooth sailing from here to implement the project based on what I need, but I will keep the post open a while longer just in case.[/quote]

No problem :)

[quote user="afok-esmart"](OP replying) Fixed EBUSY issue. Root cause was the app core project not enabling network core; adding CONFIG_BOARD_ENABLE_CPUNET=y fixed it (Output from app core, network core, and TF-M - Nordic Q&A - Nordic DevZone - Nordic DevZone (nordicsemi.com)). With some slight adjustments, I confirmed the data being sent was what I was receiving.[/quote]

Glad to hear it!

Did you fix your ESB issues as well, or do you still have an issue with that?

Regards,

Elfving

RE: Adding IPC to TF-M secure peripheral project

Elfving — Tue, 24 Sep 2024 13:54:35 GMT

[quote user="afok-esmart"]I anticipate smooth sailing from here to implement the project based on what I need, but I will keep the post open a while longer just in case.[/quote]

No problem :)

Glad to hear it!

Did you fix your ESB issues as well, or do you still have an issue with that?

Regards,

Elfving

RE: Adding IPC to TF-M secure peripheral project

afok-esmart — Fri, 20 Sep 2024 23:14:46 GMT

(OP replying) Fixed EBUSY issue. Root cause was the app core project not enabling network core; adding CONFIG_BOARD_ENABLE_CPUNET=y fixed it (Output from app core, network core, and TF-M - Nordic Q&A - Nordic DevZone - Nordic DevZone (nordicsemi.com)). With some slight adjustments, I confirmed the data being sent was what I was receiving.

I anticipate smooth sailing from here to implement the project based on what I need, but I will keep the post open a while longer just in case.

RE: Adding IPC to TF-M secure peripheral project

afok-esmart — Fri, 20 Sep 2024 16:53:51 GMT

Ok, thank you for the clarification.

Per my project requirements, I need ESB and not BLE (for the faster throughput). From my understanding, ESB functions cannot be called within the application core, and there needs to be some code for sending it over between cores. But I will double check this on my end to be sure.

-------

EDIT #1 - On my end, I cannot build ESB for app core. When I took the ESB PTX sample project (nrf/samples/esb/esb_ptx), and tried building for app core, I got this error:

-- Generated devicetree_generated.h: c:/<path_to_esb_ptx_proj>/build_nrf53/zephyr/include/generated/devicetree_generated.h
-- Including generated dts.cmake file: c:/<path_to_esb_ptx_proj>/build_nrf53/zephyr/dts.cmake

warning: MPSL (defined at C:/ncs/v2.5.0/nrfxlib\mpsl/Kconfig:7) has direct dependencies SOC_SERIES_BSIM_NRFXX || SOC_SERIES_NRF52X || SOC_NRF5340_CPUNET with value n, but is currently being y-selected by the following symbols:
 - ESB (defined at C:/ncs/v2.5.0/nrf\subsys\esb/Kconfig:7), with value y, direct dependencies y (value: y)

error: Aborting due to Kconfig warnings

Parsing c:/<path_to_esb_ptx_proj>/Kconfig
Loaded configuration 'C:/ncs/v2.5.0/zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpuapp_defconfig'
Merged configuration 'c:/<path_to_esb_ptx_proj>/prj.conf'
CMake Error at C:/ncs/v2.5.0/zephyr/cmake/modules/kconfig.cmake:348 (message):
  command failed with return code: 1
Call Stack (most recent call first):
  C:/ncs/v2.5.0/nrf/cmake/modules/kconfig.cmake:29 (include)
  C:/ncs/v2.5.0/zephyr/cmake/modules/zephyr_default.cmake:129 (include)
  C:/ncs/v2.5.0/zephyr/share/zephyr-package/cmake/ZephyrConfig.cmake:66 (include)
  C:/ncs/v2.5.0/zephyr/share/zephyr-package/cmake/ZephyrConfig.cmake:92 (include_boilerplate)
  CMakeLists.txt:8 (find_package)


-- Configuring incomplete, errors occurred!
FATAL ERROR: command exited with status 1: 'C:\ncs\toolchains\c57af46cb7\opt\bin\cmake.EXE' -DWEST_PYTHON=C:/ncs/toolchains/c57af46cb7/opt/bin/python.exe '-Bc:\nrf_projs\esb_ptx_v01\build_nrf53' -GNinja -DBOARD=nrf5340dk_nrf5340_cpuapp -DNCS_TOOLCHAIN_VERSION=NONE -DCONF_FILE=c:/<path_to_esb_ptx_proj>/prj.conf '-Sc:\nrf_projs\esb_ptx_v01'

RE: Adding IPC to TF-M secure peripheral project

Elfving — Fri, 20 Sep 2024 08:59:23 GMT

[quote user="afok-esmart"]Did you mean that I take the data from the secure app, send it to the non-secure app, and then send it to the network core?[/quote]

Yes. You could go at it like this:

Send something from a peripheral to the appcore (or alternatively use a secure peripheral)
Send this from the app to TFM using a secure service
Encrypt data in TFM
Send encrypted data to app
Send encrypted data from app over BLE/ESB.

, and the opposite one the other end.

[quote user="afok-esmart"]But again, the issue I have at the moment is regarding communication between the cores of a single nRF5340 (which I imagine must be figured out before I consider communication between the network cores of 2 nRF5340's).[/quote]

I am still not sure why you need this functionality, besides what is allready happening in the BLE stack.

Regards,

Elfving

RE: Adding IPC to TF-M secure peripheral project

afok-esmart — Thu, 19 Sep 2024 23:39:25 GMT

(OP replying) Instead of adding IPC code to the secure partition, I tried adding it to the non-secure partition (I will look into transferring data between secure/non-secure later). It builds and can flash on my board; for quick testing, I flashed the entire IPC sample project (application and network core) and then flashed my main project (which should overwrite only application core).

But it's not able to complete the setup of my endpoint. It keeps hanging at my k_sem_take() function call; if I change the timeout to K_NO_WAIT, I get -EBUSY (device is busy). Any thoughts on debugging this?

RE: Adding IPC to TF-M secure peripheral project

afok-esmart — Thu, 19 Sep 2024 16:49:13 GMT

I'm a bit confused with your suggestion. Where would the part about sending the data from the application core to the network core be? Did you mean that I take the data from the secure app, send it to the non-secure app, and then send it to the network core?

To clarify some more, my original plan for secure communication between the 2 nRF5340DK's is to perform encryption (using TF-M's libraries and such) on one device, use ESB to wirelessly send it to the other device, and perform decryption on the other device. But again, the issue I have at the moment is regarding communication between the cores of a single nRF5340 (which I imagine must be figured out before I consider communication between the network cores of 2 nRF5340's).

RE: Adding IPC to TF-M secure peripheral project

Elfving — Thu, 19 Sep 2024 11:57:28 GMT

Hello,

I am not sure if I understand exactly went wrong with what you are trying to do, but either way, I think you're approaching this the wrong way.

The communication between the devices shouldn't be considered secure. You should therefore allow the communication to reach the non-secure app first, then forward this to TFM. I guess doing it this way also has the added benefit of being a little less complex than what you were trying to do.

Regards,

Elfving