Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

applications: nrf_desktop: enable fprotect in mcuboot configurations #18322

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

applications: nrf_desktop: enable fprotect in mcuboot configurations #18322

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
82b6f03
applications: nrf_desktop: optimize MCUboot QSPI build for nRF52840 DK
kapi-no Nov 29, 2024
8e35a6b
applications: nrf_desktop: enable fprotect in mcuboot configs
kapi-no Oct 29, 2024
e73c65d
applications: nrf_desktop: enable stack protection in mcuboot configs
kapi-no Nov 29, 2024
0d72d35
applications: nrf_desktop: enable MPU in MCUboot SMP config for gmouse
kapi-no Nov 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions ...cations/nrf_desktop/configuration/nrf52820dongle_nrf52820/images/mcuboot/prj_release.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,6 @@

CONFIG_SIZE_OPTIMIZATIONS=y
MarekPieta marked this conversation as resolved.
Show resolved Hide resolved

# Disable memory guard to avoid false faults in application after boot
CONFIG_HW_STACK_PROTECTION=n

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

CONFIG_MAIN_STACK_SIZE=4096
Expand All @@ -17,6 +14,7 @@ CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_FLASH=y
CONFIG_FPROTECT=y
CONFIG_BOOT_ERASE_PROGRESSIVELY=y
CONFIG_SOC_FLASH_NRF_EMULATE_ONE_BYTE_WRITE_ACCESS=y

Expand Down Expand Up @@ -54,6 +52,7 @@ CONFIG_BOOT_BANNER=n
CONFIG_NCS_BOOT_BANNER=n
CONFIG_ERRNO=n
CONFIG_ARM_MPU=n
CONFIG_HW_STACK_PROTECTION=n
CONFIG_BOOT_SERIAL_IMG_GRP_HASH=n

# Use minimal C library instead of the Picolib
Expand Down
5 changes: 2 additions & 3 deletions applications/nrf_desktop/configuration/nrf52833dk_nrf52820/images/mcuboot/prj_release.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,6 @@

CONFIG_SIZE_OPTIMIZATIONS=y

# Disable memory guard to avoid false faults in application after boot
CONFIG_HW_STACK_PROTECTION=n

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

CONFIG_MAIN_STACK_SIZE=4096
Expand All @@ -17,6 +14,7 @@ CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_FLASH=y
CONFIG_FPROTECT=y
CONFIG_BOOT_ERASE_PROGRESSIVELY=y
CONFIG_SOC_FLASH_NRF_EMULATE_ONE_BYTE_WRITE_ACCESS=y

Expand Down Expand Up @@ -58,6 +56,7 @@ CONFIG_BOOT_BANNER=n
CONFIG_NCS_BOOT_BANNER=n
CONFIG_ERRNO=n
CONFIG_ARM_MPU=n
CONFIG_HW_STACK_PROTECTION=n
CONFIG_BOOT_SERIAL_IMG_GRP_HASH=n

# Use minimal C library instead of the Picolib
Expand Down
4 changes: 2 additions & 2 deletions applications/nrf_desktop/configuration/nrf52833dk_nrf52833/images/mcuboot/prj.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,7 @@

CONFIG_SIZE_OPTIMIZATIONS=y

# Disable memory guard to avoid false faults in application after boot
CONFIG_HW_STACK_PROTECTION=n
CONFIG_HW_STACK_PROTECTION=y

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

Expand All @@ -17,6 +16,7 @@ CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_FLASH=y
CONFIG_FPROTECT=y
CONFIG_BOOT_ERASE_PROGRESSIVELY=y
CONFIG_SOC_FLASH_NRF_EMULATE_ONE_BYTE_WRITE_ACCESS=y

Expand Down
4 changes: 2 additions & 2 deletions applications/nrf_desktop/configuration/nrf52833dk_nrf52833/images/mcuboot/prj_release.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,7 @@

CONFIG_SIZE_OPTIMIZATIONS=y

# Disable memory guard to avoid false faults in application after boot
CONFIG_HW_STACK_PROTECTION=n
CONFIG_HW_STACK_PROTECTION=y

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

Expand All @@ -17,6 +16,7 @@ CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_FLASH=y
CONFIG_FPROTECT=y
CONFIG_BOOT_ERASE_PROGRESSIVELY=y
CONFIG_SOC_FLASH_NRF_EMULATE_ONE_BYTE_WRITE_ACCESS=y

Expand Down
4 changes: 2 additions & 2 deletions applications/nrf_desktop/configuration/nrf52833dongle_nrf52833/images/mcuboot/prj.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,7 @@

CONFIG_SIZE_OPTIMIZATIONS=y

# Disable memory guard to avoid false faults in application after boot
CONFIG_HW_STACK_PROTECTION=n
CONFIG_HW_STACK_PROTECTION=y

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

Expand All @@ -17,6 +16,7 @@ CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_FLASH=y
CONFIG_FPROTECT=y
CONFIG_BOOT_ERASE_PROGRESSIVELY=y
CONFIG_SOC_FLASH_NRF_EMULATE_ONE_BYTE_WRITE_ACCESS=y

Expand Down
4 changes: 2 additions & 2 deletions ...cations/nrf_desktop/configuration/nrf52833dongle_nrf52833/images/mcuboot/prj_release.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,7 @@

CONFIG_SIZE_OPTIMIZATIONS=y

# Disable memory guard to avoid false faults in application after boot
CONFIG_HW_STACK_PROTECTION=n
CONFIG_HW_STACK_PROTECTION=y

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

Expand All @@ -17,6 +16,7 @@ CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_FLASH=y
CONFIG_FPROTECT=y
CONFIG_BOOT_ERASE_PROGRESSIVELY=y
CONFIG_SOC_FLASH_NRF_EMULATE_ONE_BYTE_WRITE_ACCESS=y

Expand Down
4 changes: 2 additions & 2 deletions applications/nrf_desktop/configuration/nrf52840dk_nrf52840/images/mcuboot/prj_fast_pair.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,7 @@
#
CONFIG_SIZE_OPTIMIZATIONS=y

# Disable memory guard to avoid false faults in application after boot
CONFIG_HW_STACK_PROTECTION=n
CONFIG_HW_STACK_PROTECTION=y

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

Expand All @@ -19,6 +18,7 @@ CONFIG_BOOT_BOOTSTRAP=n
CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_FLASH=y
CONFIG_FPROTECT=y
CONFIG_SOC_FLASH_NRF_EMULATE_ONE_BYTE_WRITE_ACCESS=y

# Reduce memory consumption
Expand Down
7 changes: 2 additions & 5 deletions ...ations/nrf_desktop/configuration/nrf52840dk_nrf52840/images/mcuboot/prj_mcuboot_qspi.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,7 @@
#
CONFIG_SIZE_OPTIMIZATIONS=y

# Disable memory guard to avoid false faults in application after boot
CONFIG_HW_STACK_PROTECTION=n
CONFIG_HW_STACK_PROTECTION=y

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

Expand All @@ -16,9 +15,7 @@ CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_FLASH=y

# Required by QSPI
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we add a release note here? Have you verified if the DFU still works fine?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think so as this is a memory optimization and does not change any feature set.

How can I test the DFU? Is the upload of the dfu_application.zip enough with nRFCDM app?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DFU could be a good test. Keep in mind that you need to use configuration channel as a DFU image transport here (IIRC this configuration does not support SMP DFU image transport).

CONFIG_MULTITHREADING=y
CONFIG_FPROTECT=y

CONFIG_NORDIC_QSPI_NOR=y
CONFIG_NORDIC_QSPI_NOR_FLASH_LAYOUT_PAGE_SIZE=4096
Expand Down
4 changes: 2 additions & 2 deletions ...cations/nrf_desktop/configuration/nrf52840dk_nrf52840/images/mcuboot/prj_mcuboot_smp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,7 @@
#
CONFIG_SIZE_OPTIMIZATIONS=y

# Disable memory guard to avoid false faults in application after boot
CONFIG_HW_STACK_PROTECTION=n
CONFIG_HW_STACK_PROTECTION=y

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

Expand All @@ -17,6 +16,7 @@ CONFIG_BOOT_MAX_IMG_SECTORS=256
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_FLASH=y
CONFIG_FPROTECT=y
CONFIG_SOC_FLASH_NRF_EMULATE_ONE_BYTE_WRITE_ACCESS=y

# Logger
Expand Down
4 changes: 2 additions & 2 deletions ...tions/nrf_desktop/configuration/nrf52840gmouse_nrf52840/images/mcuboot/prj_fast_pair.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,7 @@
#
CONFIG_SIZE_OPTIMIZATIONS=y

# Disable memory guard to avoid false faults in application after boot
CONFIG_HW_STACK_PROTECTION=n
CONFIG_HW_STACK_PROTECTION=y

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

Expand All @@ -19,6 +18,7 @@ CONFIG_BOOT_BOOTSTRAP=n
CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_FLASH=y
CONFIG_FPROTECT=y
CONFIG_SOC_FLASH_NRF_EMULATE_ONE_BYTE_WRITE_ACCESS=y

# Reduce memory consumption
Expand Down
5 changes: 2 additions & 3 deletions ...ons/nrf_desktop/configuration/nrf52840gmouse_nrf52840/images/mcuboot/prj_mcuboot_smp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,7 @@
#
CONFIG_SIZE_OPTIMIZATIONS=y

# Disable memory guard to avoid false faults in application after boot
CONFIG_HW_STACK_PROTECTION=n
CONFIG_HW_STACK_PROTECTION=y

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

Expand All @@ -15,6 +14,7 @@ CONFIG_MAIN_STACK_SIZE=10240
CONFIG_BOOT_BOOTSTRAP=n

CONFIG_FLASH=y
CONFIG_FPROTECT=y
CONFIG_SOC_FLASH_NRF_EMULATE_ONE_BYTE_WRITE_ACCESS=y

# Decrease memory footprint
Expand All @@ -28,7 +28,6 @@ CONFIG_ERRNO=n
CONFIG_PRINTK=n
CONFIG_CBPRINTF_NANO=y
CONFIG_TIMESLICING=n
CONFIG_ARM_MPU=n
CONFIG_THREAD_STACK_INFO=n

# Disable USB
Expand Down
4 changes: 2 additions & 2 deletions ...f_desktop/configuration/nrf52840gmouse_nrf52840/images/mcuboot/prj_release_fast_pair.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,7 @@
#
CONFIG_SIZE_OPTIMIZATIONS=y

# Disable memory guard to avoid false faults in application after boot
MarekPieta marked this conversation as resolved.
Show resolved Hide resolved
CONFIG_HW_STACK_PROTECTION=n
CONFIG_HW_STACK_PROTECTION=y

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

Expand All @@ -19,6 +18,7 @@ CONFIG_BOOT_BOOTSTRAP=n
CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_FLASH=y
CONFIG_FPROTECT=y
CONFIG_SOC_FLASH_NRF_EMULATE_ONE_BYTE_WRITE_ACCESS=y

# Disable USB
Expand Down
4 changes: 2 additions & 2 deletions ...ons/nrf_desktop/configuration/nrf52kbd_nrf52832/images/mcuboot/prj_release_fast_pair.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,7 @@
#
CONFIG_SIZE_OPTIMIZATIONS=y

# Disable memory guard to avoid false faults in application after boot
CONFIG_HW_STACK_PROTECTION=n
CONFIG_HW_STACK_PROTECTION=y

CONFIG_SYSTEM_CLOCK_NO_WAIT=y

Expand All @@ -19,6 +18,7 @@ CONFIG_BOOT_BOOTSTRAP=n
CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_FLASH=y
CONFIG_FPROTECT=y
CONFIG_SOC_FLASH_NRF_EMULATE_ONE_BYTE_WRITE_ACCESS=y

# Reduce memory consumption
Expand Down
3 changes: 3 additions & 0 deletions applications/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/images/mcuboot/prj.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@
#
CONFIG_SIZE_OPTIMIZATIONS=y

CONFIG_HW_STACK_PROTECTION=y

CONFIG_MAIN_STACK_SIZE=10240
CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"

Expand All @@ -14,6 +16,7 @@ CONFIG_BOOT_BOOTSTRAP=n
CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_FLASH=y
CONFIG_FPROTECT=y

# Reduce memory consumption
CONFIG_BOOT_BANNER=n
Expand Down
3 changes: 3 additions & 0 deletions ...ns/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/images/mcuboot/prj_fast_pair.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@
#
CONFIG_SIZE_OPTIMIZATIONS=y

CONFIG_HW_STACK_PROTECTION=y

CONFIG_MAIN_STACK_SIZE=10240
CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"

Expand All @@ -14,6 +16,7 @@ CONFIG_BOOT_BOOTSTRAP=n
CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_FLASH=y
CONFIG_FPROTECT=y

# Reduce memory consumption
CONFIG_BOOT_BANNER=n
Expand Down
3 changes: 3 additions & 0 deletions ...ons/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/images/mcuboot/prj_keyboard.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@
#
CONFIG_SIZE_OPTIMIZATIONS=y

CONFIG_HW_STACK_PROTECTION=y

CONFIG_MAIN_STACK_SIZE=10240
CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"

Expand All @@ -14,6 +16,7 @@ CONFIG_BOOT_BOOTSTRAP=n
CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_FLASH=y
CONFIG_FPROTECT=y

# Reduce memory consumption
CONFIG_BOOT_BANNER=n
Expand Down
3 changes: 3 additions & 0 deletions ...ions/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/images/mcuboot/prj_release.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@
#
CONFIG_SIZE_OPTIMIZATIONS=y

CONFIG_HW_STACK_PROTECTION=y

CONFIG_MAIN_STACK_SIZE=10240
CONFIG_MBEDTLS_CFG_FILE="mcuboot-mbedtls-cfg.h"

Expand All @@ -14,6 +16,7 @@ CONFIG_BOOT_BOOTSTRAP=n
CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_FLASH=y
CONFIG_FPROTECT=y

CONFIG_RESET_ON_FATAL_ERROR=y

Expand Down
7 changes: 7 additions & 0 deletions doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,6 +247,13 @@ nRF Desktop
* :ref:`zephyr:nrf54l15dk_nrf54l15`
* :ref:`zephyr:nrf54h20dk_nrf54h20`

* MCUboot bootloader configurations to enable the following Kconfig options:

* :kconfig:option:`CONFIG_FPROTECT`: used to protect the bootloader partition against memory corruption
* :kconfig:option:`CONFIG_HW_STACK_PROTECTION`: used to protect against stack overflows

* MCUboot bootloader configuration for the MCUboot SMP build type and the nRF52840 Gaming Mouse target to enable the :kconfig:option:`CONFIG_ARM_MPU` Kconfig option that is used to enable Memory Protection Unit (MPU).

* Removed imply for partial erase feature of the nRF SoC flash driver (:kconfig:option:`CONFIG_SOC_FLASH_NRF_PARTIAL_ERASE`) for the USB next stack (:ref:`CONFIG_DESKTOP_USB_STACK_NEXT <config_desktop_app_options>`).
The partial erase feature was used as a workaround for device errors that might be reported by the Windows USB host in Device Manager if a USB cable is connected while erasing a secondary image slot in the background.
The workaround is no longer needed after the nRF UDC driver was improved.
Expand Down