Thingy53 - peripheral_lbs sample fails to build for target thingy53/cpuapp/ns

[zpm1066]

Hello,

Attempts to build the "peripheral_lbs" sample for target thingy53/cpuapp/ns in the latest nRF Connect SDK v3.2.1 fails.

The build for target thingy53/cpuapp works fine.

The build failed with error  "‘FLASH overflowed when building TFM image".

/opt/nordic/ncs/toolchains/322ac893fe/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld: address 0x241e0 of bin/tfm_s.axf section `.TFM_UNPRIV_CODE' is not within region `FLASH'
/opt/nordic/ncs/toolchains/322ac893fe/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld: address 0x27c40 of bin/tfm_s.axf section `.gnu.sgstubs' is not within region `FLASH'
/opt/nordic/ncs/toolchains/322ac893fe/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld: bin/tfm_s.axf section `.TFM_PSA_ROT_LINKER_DATA' will not fit in region `FLASH'
/opt/nordic/ncs/toolchains/322ac893fe/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld: address 0x241e0 of bin/tfm_s.axf section `.TFM_UNPRIV_CODE' is not within region `FLASH'
/opt/nordic/ncs/toolchains/322ac893fe/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld: address 0x27c40 of bin/tfm_s.axf section `.gnu.sgstubs' is not within region `FLASH'
/opt/nordic/ncs/toolchains/322ac893fe/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld: region `FLASH' overflowed by 48668 bytes
Memory region         Used Size  Region Size  %age Used
           FLASH:       97308 B      48640 B    200.06%
             RAM:       48404 B       192 KB     24.62%
collect2: error: ld returned 1 exit status
ninja: build stopped: subcommand failed.

I've used the following temporary workaround:

• Disabled “CONFIG_BT_LBS_SECURITY_ENABLED=n" in prj.conf
• Used SB_CONFIG_NETCORE_HCI_IPC=y in sysbuild.conf 
• Removed Kconfig.sysbuild
• Built for thingy53/cpuapp/ns
• Application built and ran fine

However, I'd like to have the BT_LBS_SECURITY_ENABLED set.

What is the fix for thingy53/cpuapp/ns build with the default Kconfig “BT_LBS_SECURITY_ENABLED=y"?


Thank you.

[zpm1066]

Update:

I've re-built the peripheral_lbs for target thingy53/cpuapp/ns for both NETCORE_IPC_RADIO and NETWORE_HCI_IPC, with “CONFIG_BT_LBS_SECURITY_ENABLED=n" in prj.conf.

Configurations and results as follow.

NETCORE_IPC_RADIO

• Disabled “CONFIG_BT_LBS_SECURITY_ENABLED=n" in prj.conf
• Sample Kconfig.sysbuild used (NETCORE_IPC_RADIO_BT_HCI_IPC)
• Built with thingy53/cpuapp/ns
• Application built and ran fine
• In Kconfig.sysbuild, “NRF_DEFAULT_IPC_RADIO” is defined. 
• Where is "NRF_DEFAULT_IPC_RADIO" used? “Kconfig search” in docs.nordicsemi.com has no entry for it.

Console output:

[Disconnected]
[Connected]
[00:00:00.000,793] <inf> udc_nrf: Preinit
*** Booting My Application v3.2.1 - unknown commit ***
*** Using nRF Connect SDK v3.2.1-d8887f6f32df ***
*** Using Zephyr OS v4.2.99-ec78104f1569 ***
[00:00:00.001,342] <inf> udc_nrf: Initialized
Starting Bluetooth Peripheral LBS sample
[00:00:00.005,584] <inf> udc_nrf: SUSPEND state detected
[00:00:00.015,502] <inf> bt_hci_core: HW Platform: Nordic Semiconductor (0x0002)
[00:00:00.015,533] <inf> bt_hci_core: HW Variant: nRF53x (0x0003)
[00:00:00.015,563] <inf> bt_hci_core: Firmware: Standard Bluetooth controller (0x00) Version 155.44175 Build 2923568579
[00:00:00.018,432] <inf> bt_hci_core: HCI transport: IPC
[00:00:00.018,524] <inf> bt_hci_core: Identity: C3:A6:C8:C4:25:42 (random)
[00:00:00.018,554] <inf> bt_hci_core: HCI: version 6.2 (0x10) revision 0x2020, manufacturer 0x0059
[00:00:00.018,585] <inf> bt_hci_core: LMP: version 6.2 (0x10) subver 0x2020
Bluetooth initialized
Advertising successfully started
[00:00:00.103,851] <inf> udc_nrf: Reset
[00:00:00.103,912] <inf> udc: ep 0x80 is not halted|disabled
[00:00:00.103,942] <inf> udc_nrf: RESUMING from suspend
Connected
[00:01:55.334,228] <wrn> bt_l2cap: Ignoring data for unknown channel ID 0x003a
Disconnected, reason 0x13 
Connection object available from previous conn. Disconnect is complete!
Advertising successfully started

NETWORE_HCI_IPC

• Disabled “CONFIG_BT_LBS_SECURITY_ENABLED=n" in prj.conf
• Used SB_CONFIG_NETCORE_HCI_IPC=y in sysbuild.conf 
• Removed Kconfig.sysbuild
• Built with thingy53/cpuapp/ns
• Application built and ran fine

Console Output

Note that this configuration threw error:

[00:00:00.028,961] <err> bt_gatt: Unable to import the key for AES CMAC -134

[Disconnected]
[Connected]
[00:00:00.000,762] <inf> udc_nrf: Preinit
*** Booting My Application v3.2.1 - unknown commit ***
*** Using nRF Connect SDK v3.2.1-d8887f6f32df ***
*** Using Zephyr OS v4.2.99-ec78104f1569 ***
[00:00:00.001,525] <inf> udc_nrf: Initialized
Starting Bluetooth Peripheral LBS sample
[00:00:00.005,767] <inf> udc_nrf: SUSPEND state detected
[00:00:00.015,838] <inf> bt_hci_core: HW Platform: Nordic Semiconductor (0x0002)
[00:00:00.015,869] <inf> bt_hci_core: HW Variant: nRF53x (0x0003)
[00:00:00.015,869] <inf> bt_hci_core: Firmware: Standard Bluetooth controller (0x00) Version 155.44175 Build 2923568579
[00:00:00.018,829] <inf> bt_hci_core: HCI transport: IPC
[00:00:00.018,920] <inf> bt_hci_core: Identity: C3:A6:C8:C4:25:42 (random)
[00:00:00.018,951] <inf> bt_hci_core: HCI: version 6.2 (0x10) revision 0x2020, manufacturer 0x0059
[00:00:00.018,981] <inf> bt_hci_core: LMP: version 6.2 (0x10) subver 0x2020
Bluetooth initialized
Advertising successfully started
[00:00:00.028,961] <err> bt_gatt: Unable to import the key for AES CMAC -134
[00:00:00.102,935] <inf> udc_nrf: Reset
[00:00:00.102,996] <inf> udc: ep 0x80 is not halted|disabled
[00:00:00.103,027] <inf> udc_nrf: RESUMING from suspend
Connected
[00:00:22.549,224] <wrn> bt_l2cap: Ignoring data for unknown channel ID 0x003a
Disconnected, reason 0x13 
Connection object available from previous conn. Disconnect is complete!
Advertising successfully started
Connected
[00:01:00.380,340] <wrn> bt_l2cap: Ignoring data for unknown channel ID 0x003a
Disconnected, reason 0x13 
Connection object available from previous conn. Disconnect is complete!
Advertising successfully started
[Disconnected]

What is the fix for thingy53/cpuapp/ns build with the default Kconfig “BT_LBS_SECURITY_ENABLED=y"?

Is it a case that thingy53/cpuapp/ns build doesn't support BT_LBS_SECURITY_ENABLED?

Thank you.

[Priyanka]

Hi,

I am able to reproduce this issue. I am working on this and will get back to you with a response.

-Priyanka

[Priyanka]

Hi Ravi,

Since the size taken by TF-M has increased a lot, support for certain samples, (especially for the Thingy:53 ns ) has been removed. You can see it in this PR: https://github.com/nrfconnect/sdk-nrf/pull/24059/commits/bd3dc1f94c0d48b2aa0dead466b16ac8a729dc21 

Maybe extending the size of TF-M might help. but this is not something that we have tested, or is in the plans for the time being.

-Priyanka

[zpm1066]

HI Priyanka,

Yes, extending the size of TF-M may help. I'll dig further. Thanks.

Regards,
Ravi

[zpm1066]

Hi Priyanka,

Please keep this ticket open until it has been verified that TF-M size can be extended by using the Thing53 external FLASH. 

I'll give the above a go this week. Thank you.


Regards,
Ravi

[Priyanka]

Hi Ravi,

I will keep the ticket in waiting till then. But I am not sure whether extending can help or not because, as mentioned earlier, this is something that you need to try or verify yourselves as we have not tried or tested this at our end (and I don't think we have any plans for this in the near future.)

-Priyanka

[zpm1066]

HI Priyanka,

I have the "peripheral_lbs" nRF sample on the Thingy53 working as thingy53/nrf5340/cpuapp/ns after extending the TF-M size and placing a "pm_static_thingy53_nrf5340_cpuapp_ns.yml" in the local project folder.

However, I have to silence the TF-M logs, otherwise a TF-M BusFault occurs and the nRF5340 reboots continuously. Something is attempting to write to the secure FLASH.

A couple of BLE applications migrated to nRF Connect SDK 3.2.1 now work, provided TF-M logs are silenced. Both Thingy53 and nRF5340-DK behave the same.

TF-M log output when "CONFIG_TFM_LOG_LEVEL_SILENCE=n"

Pins have been configured as secure.
GPIO port: 0x00000001
Pin: 0x00000000
Pin: 0x00000001
Booting TF-M v2.2.0
[Sec Thread] Secure image initializing!
TF-M Float ABI: Hard
Lazy stacking enabled
FATAL ERROR: BusFault

I need to troubleshoot the issue further using "addr2line" to isolate the cause of the bus fault and reboots. 

Best Regards,
Ravi

[zpm1066]

Hi Priyanka,

I've fixed the remaining issue regarding Thingy53 TF-M logging using the following TF-M Kconfig.

# TF-M profile has to be properly configured to be able to run
# the Bluetooth stack which uses PSA crypto API.
# The following configuration is a minimal set of options required.
CONFIG_TFM_PROFILE_TYPE_NOT_SET=y
CONFIG_TFM_PARTITION_PLATFORM=y
CONFIG_TFM_PARTITION_CRYPTO=y
CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE=y
CONFIG_TFM_PARTITION_PROTECTED_STORAGE=n
CONFIG_TFM_PARTITION_INITIAL_ATTESTATION=n

# This Board implies building Non-Secure firmware
CONFIG_TRUSTED_EXECUTION_NONSECURE=y

# Set TF-M to share the default console
CONFIG_TFM_SECURE_UART0=y
CONFIG_TFM_SECURE_UART_SHARE_INSTANCE=y

We can close this ticket now. Thank you.


Best Regards,
Ravi