ironside: move to IronSide support package

Pull in the new IronSide support package which replaces the
IronSide APIs that were previously in the zephyr repository.
This includes a few naming changes and some changes to the headers,
but should not introduce any functional changes.
Update the code that interacts with IronSide to make use of
the new APIs.

Signed-off-by: Jonathan Nilsen <jonathan.nilsen@nordicsemi.no>

Author: jonathannilsen

include/tfm/ironside/se/ipc_service.h

@@ -7,25 +7,6 @@
 #ifndef __SDFW_PSA_IPC_SERVICE_H__
 #define __SDFW_PSA_IPC_SERVICE_H__
 
-/*
- * This header contains symbols that are used by both the IronSide SE client
- * and the IronSide SE service.
- */
-enum {
-	IRONSIDE_SE_IPC_INDEX_HANDLE,
-	IRONSIDE_SE_IPC_INDEX_IN_VEC,
-	IRONSIDE_SE_IPC_INDEX_IN_LEN,
-	IRONSIDE_SE_IPC_INDEX_OUT_VEC,
-	IRONSIDE_SE_IPC_INDEX_OUT_LEN,
-	IRONSIDE_SE_IPC_INDEX_STATUS,
-	IRONSIDE_SE_IPC_INDEX_TYPE,
-	/* The last enum value is reserved for the size of the IPC buffer */
-	IRONSIDE_SE_IPC_DATA_LEN
-};
-
-/* IronSide call identifiers with implicit versions */
-#define IRONSIDE_CALL_ID_PSA_V1 0
-
 /* We are adding the source files for the TF-M Crypto partition
  * and the TF-M Internal Trusted Storage partition to the build.
  *

lib/nrf_modem_lib/nrf_modem_os_rpc.c

@@ -17,8 +17,8 @@
 #include <zephyr/drivers/mbox.h>
 #include <zephyr/ipc/icmsg.h>
 #include <zephyr/ipc/pbuf.h>
-#if defined(CONFIG_NRF_IRONSIDE)
-#include <nrf_ironside/cpuconf.h>
+#if defined(CONFIG_IRONSIDE_SE_CALL)
+#include <ironside/se/api.h>
 #endif
 
 #define DCACHE_LINE_SIZE (CONFIG_DCACHE_LINE_SIZE)
@@ -119,7 +119,7 @@ uintptr_t nrf_modem_os_rpc_sigdev_modem_get(void)
 
 int nrf_modem_os_rpc_cellcore_boot(void)
 {
-#if defined(CONFIG_NRF_IRONSIDE)
+#if defined(CONFIG_IRONSIDE_SE_CALL)
 	struct boot_report_cellcore_ldc params;
 
 	params.ipc_buf_addr = DT_REG_ADDR(DT_NODELABEL(cpuapp_cpucell_ipc_shm_ctrl));
@@ -136,7 +136,7 @@ int nrf_modem_os_rpc_cellcore_boot(void)
 	/* TODO: Replace hardcoded value with NRF_PROCESSOR_CELLCORE when it's available
 	 * in the MDK.
 	 */
-	return ironside_cpuconf(4, NULL, cpu_wait, msg, msg_size);
+	return ironside_se_cpuconf(4, NULL, cpu_wait, msg, msg_size);
 #else
 	/* Without IronSide SE, cellcore is booted by the SDFW. */
 	return 0;

samples/dfu/ab_split/sysbuild/mcuboot/prj.conf

@@ -38,6 +38,6 @@ CONFIG_BOOT_SHARE_DATA_BOOTINFO=y
 CONFIG_BOOT_SHARE_BACKEND_RETENTION=y
 
 # Enable IronSide service
-CONFIG_NRF_IRONSIDE_COUNTER_SERVICE=y
+CONFIG_IRONSIDE_SE_CALL=y
 # Enable MCUboot counter implementation that uses IronSide counters
 CONFIG_NRF_MCUBOOT_IRONSIDE_COUNTERS=y

samples/ironside_se/secondary_boot_gen_uicr/prj.conf

@@ -10,5 +10,3 @@ CONFIG_UART_CONSOLE=y
 
 # Enable printk
 CONFIG_PRINTK=y
-
-CONFIG_NRF_IRONSIDE_BOOTMODE_SERVICE=y

samples/ironside_se/secondary_boot_gen_uicr/src/main.c

@@ -6,7 +6,7 @@
 
 #include <zephyr/kernel.h>
 #include <zephyr/sys/printk.h>
-#include <nrf_ironside/bootmode.h>
+#include <ironside/se/api.h>
 #include <string.h>
 
 int main(void)
@@ -16,7 +16,7 @@ int main(void)
 	printk("=== Hello World from Primary Image ===\n");
 
 	printk("Booting secondary image\n");
-	err = ironside_bootmode_secondary_reboot(NULL, 0);
+	err = ironside_se_bootmode_secondary_reboot(NULL, 0);
 	if (err != 0) {
 		printk("Secondary image boot failed: %d\n", err);
 		return err;

subsys/nrf_security/src/ssf_secdom/Kconfig

@@ -9,7 +9,7 @@ config PSA_SSF_CRYPTO_CLIENT
 	prompt "PSA crypto provided through SSF"
 	default y
 	depends on SOC_NRF54H20 || SOC_SERIES_NRF92X
-	select NRF_IRONSIDE_CALL
+	select IRONSIDE_SE_CALL
 
 if PSA_SSF_CRYPTO_CLIENT
 

subsys/nrf_security/src/ssf_secdom/ironside_se_psa_ns_api.c

@@ -9,7 +9,8 @@
 
 #include <zephyr/kernel.h>
 #include <zephyr/cache.h>
-#include <nrf_ironside/call.h>
+#include <ironside/se/glue.h>
+#include <ironside/se/internal/api_serialization.h>
 
 #include <psa/client.h>
 #include <psa/error.h>
@@ -30,26 +31,26 @@ static psa_status_t psa_call_buffered_and_flushed(psa_handle_t handle, int32_t t
 						  const psa_invec *in_vec, size_t in_len,
 						  psa_outvec *out_vec, size_t out_len)
 {
-	struct ironside_call_buf *const buf = ironside_call_alloc();
+	struct ironside_se_call_buf *const buf = ironside_se_call_alloc();
 
-	buf->id = IRONSIDE_CALL_ID_PSA_V1;
+	buf->id = IRONSIDE_SE_CALL_ID_PSA_V1;
 
-	buf->args[IRONSIDE_SE_IPC_INDEX_HANDLE] = handle;
-	buf->args[IRONSIDE_SE_IPC_INDEX_IN_VEC] = (uint32_t)in_vec;
-	buf->args[IRONSIDE_SE_IPC_INDEX_IN_LEN] = in_len;
-	buf->args[IRONSIDE_SE_IPC_INDEX_OUT_VEC] = (uint32_t)out_vec;
-	buf->args[IRONSIDE_SE_IPC_INDEX_OUT_LEN] = out_len;
-	buf->args[IRONSIDE_SE_IPC_INDEX_TYPE] = type;
+	buf->args[IRONSIDE_SE_PSA_REQ_IDX_HANDLE] = handle;
+	buf->args[IRONSIDE_SE_PSA_REQ_IDX_IN_VEC] = (uint32_t)in_vec;
+	buf->args[IRONSIDE_SE_PSA_REQ_IDX_IN_LEN] = in_len;
+	buf->args[IRONSIDE_SE_PSA_REQ_IDX_OUT_VEC] = (uint32_t)out_vec;
+	buf->args[IRONSIDE_SE_PSA_REQ_IDX_OUT_LEN] = out_len;
+	buf->args[IRONSIDE_SE_PSA_REQ_IDX_TYPE] = type;
 
-	ironside_call_dispatch(buf);
+	ironside_se_call_dispatch(buf);
 
 	psa_status_t status = PSA_ERROR_COMMUNICATION_FAILURE;
 
-	if (buf->status == IRONSIDE_CALL_STATUS_RSP_SUCCESS) {
-		status = buf->args[IRONSIDE_SE_IPC_INDEX_STATUS];
+	if (buf->status == IRONSIDE_SE_CALL_STATUS_RSP_SUCCESS) {
+		status = buf->args[IRONSIDE_SE_PSA_RSP_IDX_STATUS];
 	}
 
-	ironside_call_release(buf);
+	ironside_se_call_release(buf);
 
 	return status;
 }

west.yml

@@ -63,8 +63,9 @@ manifest:
     # https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/zephyr/introduction/index.html
     # https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/zephyr/guides/modules.html
     - name: zephyr
-      repo-path: sdk-zephyr
-      revision: 796b28fa4b098a276322b31eca3516fc190af37a
+      # repo-path: sdk-zephyr
+      url: https://github.com/jonathannilsen/sdk-zephyr
+      revision: ironside-support2-ncs
       import:
         # In addition to the zephyr repository itself, NCS also
         # imports the contents of zephyr/west.yml at the above
@@ -125,8 +126,10 @@ manifest:
           upstream-sha: 1225729e8d84075f03bf9fc51eee85d84dfb0091
           compare-by-default: true
     - name: mcuboot
-      repo-path: sdk-mcuboot
-      revision: 0d9411f5dda336b999c56c4eb13c502af8b59851
+      url: https://github.com/jonathannilsen/sdk-mcuboot
+      revision: ironside-support-ncs
+      # repo-path: sdk-mcuboot
+      # revision: 0d9411f5dda336b999c56c4eb13c502af8b59851
       path: bootloader/mcuboot
     - name: qcbor
       url: https://github.com/laurencelundblade/QCBOR