nRF5340, UART interrupt-based reads in secure partition

[esmart-engineering]

I'm adapting the sample code for TF-M secure peripheral sample (NCS v2.5.0, nrf/samples/tfm/tfm_secure_peripheral) to also add a UART peripheral. But this sample uses the older API (nrfx) which so far I've struggled with finding example code for. I was able to infer from the timer setup in that sample project, and get code working that can do a blocking write, with functions like nrf_uarte_tx_buffer_set() and nrf_uarte_task_trigger(). But how can I perform reads? I need to be able to perform them non-blocking, and interrupt-based.

If I could get some sample projects that explain this, I'd appreciate it. Thank you in advance!

[Einar Thorsrud]

Hi,

The SDK includes nrfx UARTE samples under modules/hal/nordic/nrfx/samples/src/nrfx_uarte/, including a non-blocking (interrupt-based) sample. (TF-M is not a Zephyr applicaiton, so you cannot use Zephyr APIS. But low-levle APIs like nrfx or HAL functionality can be used.)

[esmart-engineering]

I tried adding it to the secure peripheral sample and it builds but the board keeps restarting. Could you help debug this please?

Attached is the project. For context, I am developing on Windows 10 w/ VS Code (and the nRF Connect extension). I'm also using an nRF5340DK.
tfm_secure_peripheral_20241022.zip

Summary of my changes include:

• Editing secure_peripheral_partition/secure_peripheral_partition.c, w/ UART init and interrupt handler
• Editing .conf file to add nrfx drivers for UART1
• Editing secure_peripheral_partition/tfm_secure_peripheral_partition.yaml to add UART peripheral alongside timer and SPI
• Creating build config preset for nRF5340DK

Symptoms of the restarting:

• No output on VCOM0 or VCOM1, even when I use RESET button to restart the board
• Constant output of 'Booting TF-M v1.8.0' on secure partition output (nRF5340DK pin P0.25)

This next note can be addressed later (priority right now is just getting the above to work) but ideally, I need output from app core, network core, and secure partition. I believe app core and network core will use UART0 and UART1 respectively, so I assume I need a separate one like UART2 for data transfer. I did try adjusting the code for UART2 but it failed to build with an error that looks like "C:/ncs/v2.5.0/modules/hal/nordic/nrfx/drivers/include/nrfx_uarte.h:70:35: error: 'NRFX_UARTE2_INST_IDX' undeclared (first use in this function); did you mean 'NRFX_UARTE1_INST_IDX'?"

[Einar Thorsrud]

Hi,

I have not had a chance to test your applicaiton, but looking at it one thing sticks out. UART1 is used by logging in TF-M by default, and you have not disabled it. So here it looks like you are trying to use UART1 for two things at the same time? (both for logging and directly in your secure_peripheral_partition/secure_peripheral_partition.c)? Do you see a difference if you disable logging in TF-M (CONFIG_TFM_LOG_LEVEL_SILENCE)?

[esmart-engineering]

I tried adding CONFIG_TFM_LOG_LEVEL_SILENCE=y to prj.conf and could not build it. I got an error that looks like:

C:/ncs/v2.5.0/modules/hal/nordic/nrfx/drivers/include/nrfx_uarte.h:70:35: error: 'NRFX_UARTE1_INST_IDX' undeclared (first use in this function); did you mean 'NRFX_UARTE_INSTANCE'?

[Einar Thorsrud]

Hi,

Ah  yes. When disabling TF-M logging, that also disabled the UART driver etc. Setting CONFIG_TFM_SECURE_UART1=y should fix this.

A colleague of me made a sample some time ago using UARTE0 via nrfx drivers in a modified secure periperal partision sample that you can refer to: tfm_secure_peripheral_uarte0.zip (This was made for SDK 2.2, but there has not been that many changes since then related to this)

[esmart-engineering]

Currently looking into integrating code from your colleague's example into my own.

However, if you have any thoughts about the following, I'd appreciate your thoughts on what else I can try. I've found that:

• Adding CONFIG_TFM_SECURE_UART1=y puts me back at the board constantly restarting.
• Your colleague's example doesn't build in SDK 2.5.0. I didn't expect it to immediately build, but just to document, I'm seeing this build error
  • Traceback (most recent call last):
    File "C:/ncs/v2.5.0/modules/tee/tf-m/trusted-firmware-m/tools/tfm_parse_manifest_list.py", line 723, in <module>
    main()
    File "C:/ncs/v2.5.0/modules/tee/tf-m/trusted-firmware-m/tools/tfm_parse_manifest_list.py", line 711, in main
    context = process_partition_manifests(manifest_lists,
    File "C:/ncs/v2.5.0/modules/tee/tf-m/trusted-firmware-m/tools/tfm_parse_manifest_list.py", line 303, in process_partition_manifests
    logging.info(" {:40s} ON".format(manifest_item['description']))
    KeyError: 'description'
    CMake Error at tools/CMakeLists.txt:192 (message):
    Manifest tool failed to generate files!

[esmart-engineering]

Hello. So it's been about a week since I first posted the project files that I've been trying. Even though I've been getting suggestions, it's clear that my specific project has not been looked at, tried out on your end, etc. I'd like to ask if this question's priority could be moved up, and if I could get someone else (i.e., a senior engineer) to help provide more concrete and technical support please.

[Sigurd Hellesvik]

Hi,

I am also helping in this ticket, and I am jumping in to give you an answer today, since Einar has gone home for the day. He will be back tomorrow.

I tried my hand on strapping together the TF-M Secure Peripheral sample and the nrfx UARTE sample. While I would in no words call this test tidy, it at least works.

Connect an UART reader to P0.25 and P0.26, and you should be able to see the following:

[Sec Thread] Secure image initializing!
Booting TF-M v1.8.0
Starting nrfx_uarte non-blocking example.
Content of TX buffer: Nordic Semiconductor
Content of RX buffer: 
Nordic Semiconductor

The "Contect" stuff is logging, but the last line "Nordic Semiconductor" is written over UART using nrfx.

tfm_secure_peripheral_uart1.zip

I hope having code that runs can give you a good starting point to do what you want.
Let us know if this is what you need

[esmart-engineering]

I tried out your code but it is still not working. I'm still seeing the UART (at P0.25) constantly outputting 'Booting TF-M v1.8.0' (must be constantly restarting I assume).

[Sec Thread] Secure image initializing!
Booting TF-M v1.8.0
Nordic Semiconductor[Sec Thread] Secure image initializing!
Booting TF-M v1.8.0
Nordic Semiconductor[Sec Thread] Secure image initializing!
Booting TF-M v1.8.0
Nordic Semiconductor
... (this keeps repeating over and over)

I've tried doing an 'erase & flash', making sure nothing is running on the network core (flashed the 'empty_net_core' project at NCS v2.5.0, nrf/samples/nrf5340/empty_net_core), etc.

Also recall that my original question is to get UART working specifically with reading (not writing) data. So I'm expecting code that also shows the basics of reading (using interrupts).

[Einar Thorsrud]

Hi,

The nrfx approach (which was used in the project you got yesterday) was not ideal, as interrupts needs to be handled specially in TF-M and that was not the case ther. It turns out that the cleanest is to avoid nrfx and use the lower-level HAL direcly, in th esame way as is allready done for SPIM in the sample. I put together a very simple sample now which does that: tfm_secure_peripheral_uarte_hal.zip. This is a minimal change from the existing sample in the SDK, but it does work and demonstrate both Tx and interrupt driven Rx. It sends "Nordic Seminoductor" once, and handles incomming Rx data. It does not process the data in any way, and just re-starts Rx when data is received, so to see that it works you can put a breakpoint in tfm_uarte1_irq_flih() before sending data and see taht the uart_rx_buf is populated with the received data:

In addition to the changes in the secure_peripheral_partition.c file and prj.conf, there are also some changes in the tfm_secure_peripheral_partition.yaml needed for the interrupt handling (search for UARTE1 in that file), this is as described under Secure interrupt in the sample documentation.