nRF9151-DK Partition Table Differs from nRF9151 Custom Board Template

[gfrung]

The partition table for the nRF9151-DK is different than the partition table generated when the Create a new board option is used in the nRF Connect SDK and the nRF9151-LACA is selected as the SoC.

Here is the partition table used when building for the nRF9151-DK:

dts/vendor/nordic/nrf91xx_partition.dtsi

partitions {
	compatible = "fixed-partitions";
	#address-cells = <1>;
	#size-cells = <1>;

	boot_partition: partition@0 {
		label = "mcuboot";
		reg = <0x00000000 0x10000>;
	};

	slot0_partition: partition@10000 {
		label = "image-0";
		reg = <0x00010000 0x40000>;
	};

	slot0_ns_partition: partition@50000 {
		label = "image-0-nonsecure";
		reg = <0x00050000 0x30000>;
	};

	slot1_partition: partition@80000 {
		label = "image-1";
		reg = <0x00080000 0x40000>;
	};

	slot1_ns_partition: partition@c0000 {
		label = "image-1-nonsecure";
		reg = <0x000c0000 0x30000>;
	};

	tfm_ps_partition: partition@f0000 {
		label = "tfm-ps";
		reg = <0x000f0000 0x00004000>;
	};

	tfm_its_partition: partition@f4000 {
		label = "tfm-its";
		reg = <0x000f4000 0x00002000>;
	};

	tfm_otp_partition: partition@f6000 {
		label = "tfm-otp";
		reg = <0x000f6000 0x00002000>;
	};

	storage_partition: partition@f8000 {
		label = "storage";
		reg = <0x000f8000 0x00008000>;
	};
};

The three partitions related to TF-M— tfm_ps_partition, tfm_its_partition, tfm_otp_partition— are not included in the template used when creating a new board.

scripts/west_commands/create_board/templates/nrf91/board-partitioning.dtsi.jinja2

partitions {
	compatible = "fixed-partitions";
	#address-cells = <1>;
	#size-cells = <1>;

	boot_partition: partition@0 {
		label = "mcuboot";
		reg = <0x00000000 DT_SIZE_K(64)>;
	};

	slot0_partition: partition@10000 {
		label = "image-0";
		reg = <0x00010000 DT_SIZE_K(256)>;
	};

	slot0_ns_partition: partition@50000 {
		label = "image-0-nonsecure";
		reg = <0x00050000 DT_SIZE_K(212)>;
	};

	slot1_partition: partition@85000 {
		label = "image-1";
		reg = <0x00085000 DT_SIZE_K(256)>;
	};

	slot1_ns_partition: partition@c5000 {
		label = "image-1-nonsecure";
		reg = <0x000c5000 DT_SIZE_K(212)>;
	};

	storage_partition: partition@fa000 {
		label = "storage";
		reg = <0x000fa000 DT_SIZE_K(24)>;
	};
};

My concern is that there is a comment in the partition table used for the nRF9151-DK that seems to indicate these partitions are important.

This layout matches (by necessity) that in the TF-M repository.

(from dts/vendor/nordic/nrf91xx_partition.dtsi)

Questions:

• Was the omission of these three partitions in the board template an oversight or intentional?
• If I am developing a custom board based on the nRF9151, should I manually add these partitions back to the generated files?  If they are required, shouldn't they be in the template?

[Håkon Alseth]

Hi,

 

When creating a nRF91 board, the partition layout in the device tree files is not used, as the nRF91 series devices are always multi-build targets.

It is the Partition Manager that handles multi-image build and its partitioning, based on what is enabled in your build:

https://docs.nordicsemi.com/bundle/ncs-3.0.1/page/nrf/scripts/partition_manager/partition_manager.html

 

Kind regards,

Håkon

[gfrung]

I see.  I actually removed the entire partition table from the device tree, built, and the output merged.hex file, that is programmed to the device, was identical.  So, it is clear the partition table is completely unused.

Why is it even there?  Is there a case where it would be used?  If not, it's confusing to have it there, because I could have gone in there to adjust the partitions and been very surprised when they weren't changing.  If it's never used, could it just be deleted from the board template for the nRF9151 to avoid the confusion?

[Håkon Alseth]

Hi,

 

The rule of thumb is that device tree partition table is active for single image build, and and partition manager is used for multi-image builds.

gfrung said:

Why is it even there?  Is there a case where it would be used?  If not, it's confusing to have it there, because I could have gone in there to adjust the partitions and been very surprised when they weren't changing.  If it's never used, could it just be deleted from the board template for the nRF9151 to avoid the confusion?

I know this is a bad reason from our side, but I'll try to be as transparent as possible: The reason is historical.

Since upstream zephyr did not have any means of performing multi-image builds (until recently), we added partition manager to NCS.

The intention is that a unified solution shall be used in the future, as system build (sysbuild) slowly gets more mature:

https://docs.zephyrproject.org/latest/build/sysbuild/index.html

 

But, these things also take time, so at this time (NCS v3.0.x) we are using sysbuild for multi image handling, but still on Partition Manager for the physical layout.

 

Kind regards,

Håkon

[gfrung]

Thanks for the clarification, and the historical context! It helps to understand why things are the way they are, and the direction they're potentially going in the future.

If you don't mind me asking: when you say that "the nRF91 series devices are always multi-build targets", why is this? Are other parts not always multi-build targets? Which parts are and which are not?

Is this true even if I build without the /ns build option? In that case, TF-M won't be included, and only the app will be built. Is it still a multi-image build, just with a single image?

[Håkon Alseth]

Hi,

 

gfrung said:

If you don't mind me asking: when you say that "the nRF91 series devices are always multi-build targets", why is this? Are other parts not always multi-build targets? Which parts are and which are not?

I do not mind at all!

We made a hardware design-wise choice for the nRF9160, where the modem can only communicate with the application core in a non-secure state.

The Cortex M33 CPU application core inside the nRF9160 boots up in a secure state, so you have to run some sort of firmware to transition from secure->nonsecure state, which is the reason why you have a hard requirement on a secure / non-secure split with the nRF91-series devices.

The typical image to use in the secure side is TF-M, with various supported features (minimal, medium, and full) in terms of crypto and non-secure callable functions.

gfrung said:

Is this true even if I build without the /ns build option? In that case, TF-M won't be included, and only the app will be built. Is it still a multi-image build, just with a single image?

A colleague pointed out that my former comment is not entirely true, as i stated this:

Håkon Alseth said:

The rule of thumb is that device tree partition table is active for single image build, and and partition manager is used for multi-image builds.

From the introduction of sysbuild in NCS v2.7.0, we force partition manager to be used when sysbuild is active for both single- or multi-image build.

If you do not use sysbuild (west --no-sysbuild ...), then the former comment is true.

 

Please note that if you omit the "/ns", and build for nrf9160dk/nrf9160, you will not be able to communicate with the modem.

 

Kind regards,

Håkon