RE: SPM secure services issue

Håkon Alseth — Fri, 28 Feb 2020 13:27:56 GMT

Hi,

481 ms with printing (ie: untouched):

168 ms with CONFIG_SPM_BOOT_SILENTLY=y:

168 ms with CONFIG_SERIAL=n:

To override spm, I would recommend that you add this to your samples/nrf9160/my_application/CMakeLists.txt file, just below the "cmake_minimum_required(VERSION 3.13.1)" line:

if (EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/spm.conf")
  set(spm_CONF_FILE
    prj.conf
    ${CMAKE_CURRENT_LIST_DIR}/spm.conf
  )
endif()
 
if (EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/mcuboot.conf")
  set(mcuboot_CONF_FILE
    prj.conf
    ${CMAKE_CURRENT_LIST_DIR}/mcuboot.conf
  )
endif()
 
if (EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/${BOARD}.overlay")
  set(mcuboot_DTC_OVERLAY_FILE "${CMAKE_CURRENT_SOURCE_DIR}/${BOARD}.overlay")
  set(spm_DTC_OVERLAY_FILE "${CMAKE_CURRENT_SOURCE_DIR}/${BOARD}.overlay")
endif()

Now, if you create the file my_application/spm.conf, it should be automatically loaded when you reconfigure you project.

Paste in CONFIG_SERIAL=n into the spm.conf file, and you should see the same boot-up time as I have above here.

Kind regards,

Håkon

RE: SPM secure services issue

rbence — Thu, 27 Feb 2020 18:50:01 GMT

I think I found the answer for the second question.

This is from secure_services.c:

__TZ_NONSECURE_ENTRY_FUNC
int spm_request_read(void *destination, u32_t addr, size_t len)
{
	static const struct read_range ranges[] = {
#ifdef PM_MCUBOOT_ADDRESS
		/* Allow reads of mcuboot metadata */
		{.start = PM_MCUBOOT_PAD_ADDRESS,
		 .size = PM_MCUBOOT_PAD_SIZE},
#endif
		{.start = FICR_PUBLIC_ADDR,
		 .size = FICR_PUBLIC_SIZE},
		{.start = FICR_RESTRICTED_ADDR,
		 .size = FICR_RESTRICTED_SIZE},
	};

	if (destination == NULL || len <= 0) {
		return -EINVAL;
	}

	for (size_t i = 0; i < ARRAY_SIZE(ranges); i++) {
		u32_t start = ranges[i].start;
		u32_t size = ranges[i].size;

		if (addr >= start && addr + len <= start + size) {
			memcpy(destination, (const void *)addr, len);
			return 0;
		}
	}

	return -EPERM;
}
#endif /* CONFIG_SPM_SERVICE_READ */

It seems that you cannot read from anywhere in the Secure region but only from FICR and MCUBOOT_PAD. I can modify this function to add custom regions which can be read.

However it would be better if I could reduce the running time of the Secure part from 350 ms to below 100 ms.