[K32W0] SDK 2.6.13 changes (project-chip#30678)

* [K32W0] Bring platform diff

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [K32W0] Add SSBL version retrieval

The applications will now print the SSBL version also.
If the SSBL doesn't have a version defined, the expected value is 0.

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [K32W0] Fix SSBL version retrieval

SSBL will always be seen as booting from address 0, thanks to the remapping mechanism.
This means the SSBL version will always offset from address 0.

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [K32W0] Add support for simple hash verification

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [K32W] Add support for BLE callback delegate

Application can register callbacks for GAP/GATT events.

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [K32W0] Add example for registering BLE event callbacks

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [K32W0] replace to use SecLib API and SecLib mutex

* [COMMON] Fix manufacturing flow

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [COMMON] Add python script to generate certificates

Signed-off-by: Axel Le Bourhis <axel.lebourhis@nxp.com>

* [common] Update generate_certs script

* Add valid_from and lifetime optional parameters
* Updated parameters descriptions
* Misc improvements

Signed-off-by: Axel Le Bourhis <axel.lebourhis@nxp.com>

* [COMMON] Update nxp_manufacturing_flow document

Updated the document to make use of the new generate_certs.py script.

Signed-off-by: Axel Le Bourhis <axel.lebourhis@nxp.com>

* [K32W0] Fix function signature

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [K32W0] Remove duplicate reboot cause set

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [K32W] Set BLE manager impl pointer before calling InitHostController

When adding app BLE callbacks, the sImplInstance pointer is used, so it
needs to be set beforehand.

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [COMMON] Update ot-nxp to release branch

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [K32W0] Update west manifest to point to 2.6.13 SDK

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [K32W0] Fix ICD parameters

Signed-off-by: Doru Gucea <doru-cristian.gucea@nxp.com>

* [NXP] Bump ot-nxp to latest

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [NXP] Fix tools lint errors

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* Restyled by whitespace
Restyled by clang-format
Restyled by gn
Restyled by prettier-markdown
Restyled by autopep8
Restyled by isort

* [NXP] Add extra condition for SDK gn variable to take into account CI

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* Restyled by gn

* [NXP] Fix some lint errors

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [K32W0] Fix include header

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* Restyled by autopep8

* [NXP] Fix lint error

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [NXP] Update docker image used by the github actions workflow for K32W

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* [K32W1] Add example for registering BLE event callbacks

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

* Restyled by clang-format

* [NXP] Clarify usage of hash id in factory data. Update MATTER_ROOT to use a more generic path

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>

---------

Signed-off-by: marius-alex-tache <marius.tache@nxp.com>
Signed-off-by: Axel Le Bourhis <axel.lebourhis@nxp.com>
Signed-off-by: Doru Gucea <doru-cristian.gucea@nxp.com>
Co-authored-by: Ethan Tan <nxf42555@lsvm11u0000160.swis.ap-northeast-2.aws.nxp.com>
Co-authored-by: Axel Le Bourhis <axel.lebourhis@nxp.com>
Co-authored-by: Doru Gucea <doru-cristian.gucea@nxp.com>
Co-authored-by: Restyled.io <commits@restyled.io>

.github/workflows/examples-k32w.yaml

@@ -37,7 +37,7 @@ jobs:
         if: github.actor != 'restyled-io[bot]'
 
         container:
-            image: ghcr.io/project-chip/chip-build-k32w:26
+            image: ghcr.io/project-chip/chip-build-k32w:27
             volumes:
                 - "/tmp/bloat_reports:/tmp/bloat_reports"
         steps:

examples/contact-sensor-app/nxp/k32w/k32w0/BUILD.gn

@@ -25,6 +25,7 @@ import("${chip_root}/src/platform/device.gni")
 
 declare_args() {
   chip_software_version = 0
+  chip_simple_hash_verification = 0
 }
 
 if (chip_pw_tokenizer_logging) {
@@ -177,6 +178,10 @@ action("binsign") {
   script = "${k32w0_platform_dir}/scripts/sign-outdir.py"
   output_name = "bignsign.log"
   outputs = [ "${root_build_dir}/${output_name}" ]
+
+  if (chip_simple_hash_verification == 1) {
+    args = [ "--simple-hash" ]
+  }
 }
 
 group("default") {

examples/contact-sensor-app/nxp/k32w/k32w0/README.md

@@ -440,6 +440,10 @@ SSBL demo application can be imported from the `Quickstart panel`:
 
 ![SSBL Application Select](../../../../platform/nxp/k32w/k32w0/doc/images/ssbl_select.JPG)
 
+### Features
+
+#### Multi image
+
 To support multi-image OTA feature, the SSBL project must be compiled using the
 following defines:
 
@@ -457,6 +461,24 @@ Optionally, add the following defines:
 
 ![SSBL_MULTI_IMAGE](../../../../platform/nxp/k32w/k32w0/doc/images/ssbl_multi_image.JPG)
 
+#### Simple hash verification
+
+When secure boot is not used, a simple hash can be appended at the end of the
+image for integrity check. Applications should be built with
+`chip_simple_hash_verification=1`.
+
+To support simple hash verification feature, the SSBL project must be compiled
+with:
+
+-   `gSimpleHashVerification=1`
+
+and update the post-build command to use simple hash verification instead of the
+default options. Go to
+`Project -> Properties -> C/C++ Build -> Settings -> Build steps` and press
+`Edit` under `Post-build steps` subsection. The command should look similar to:
+
+![SSBL_SIMPLE_HASH_VERIFICATION](../../../../platform/nxp/k32w/k32w0/doc/images/ssbl_simple_hash.JPG)
+
 Once compiled, the required SSBL file is called `k32w061dk6_ssbl.bin`.
 
 ![SSBL_BIN](../../../../platform/nxp/k32w/k32w0/doc/images/ssbl_bin.JPG)

examples/contact-sensor-app/nxp/k32w/k32w0/args.gni

@@ -22,3 +22,7 @@ k32w0_sdk_target = get_label_info(":sdk", "label_no_toolchain")
 chip_enable_ota_requestor = true
 chip_stack_lock_tracking = "fatal"
 chip_enable_ble = true
+
+chip_enable_icd_server = true
+chip_persist_subscriptions = true
+chip_subscription_timeout_resumption = true

examples/contact-sensor-app/nxp/k32w/k32w0/include/CHIPProjectConfig.h

@@ -59,6 +59,11 @@
 #define CHIP_DEVICE_CONFIG_DEVICE_VENDOR_ID 0x1037
 #define CHIP_DEVICE_CONFIG_DEVICE_PRODUCT_ID 0xA220
 
+// Set the following define to use the Certification Declaration from below and not use it stored in factory data section
+#ifndef CHIP_USE_DEVICE_CONFIG_CERTIFICATION_DECLARATION
+#define CHIP_USE_DEVICE_CONFIG_CERTIFICATION_DECLARATION 0
+#endif
+
 #ifndef CHIP_DEVICE_CONFIG_CERTIFICATION_DECLARATION
 //-> format_version = 1
 //-> vendor_id = 0x1037
@@ -188,8 +193,7 @@
 #define CHIP_CONFIG_MAX_FABRICS 5 // 5 is the minimum number of supported fabrics
 
 #define CHIP_DEVICE_CONFIG_ENABLE_SED 1
-#define CHIP_DEVICE_CONFIG_ICD_SLOW_POLL_INTERVAL 1000_ms32
-#define CHIP_DEVICE_CONFIG_ICD_FAST_POLL_INTERVAL 100_ms32
+
 /**
  * @def CHIP_IM_MAX_NUM_COMMAND_HANDLER
  *

examples/contact-sensor-app/nxp/k32w/k32w0/main/AppTask.cpp

@@ -45,6 +45,8 @@
 #include <src/platform/nxp/k32w/common/OTAImageProcessorImpl.h>
 #endif
 
+#include "BLEManagerImpl.h"
+
 #include "Keyboard.h"
 #include "LED.h"
 #include "LEDWidget.h"
@@ -123,6 +125,18 @@ CHIP_ERROR AppTask::StartAppTask()
     return err;
 }
 
+static void app_gap_callback(gapGenericEvent_t * event)
+{
+    /* This callback is called in the context of BLE task, so event processing
+     * should be posted to app task. */
+}
+
+static void app_gatt_callback(deviceId_t id, gattServerEvent_t * event)
+{
+    /* This callback is called in the context of BLE task, so event processing
+     * should be posted to app task. */
+}
+
 #if CHIP_DEVICE_CONFIG_ENABLE_OTA_REQUESTOR
 static void CheckOtaEntry()
 {
@@ -240,6 +254,17 @@ CHIP_ERROR AppTask::Init()
 
     K32W_LOG("Current Software Version: %s, %" PRIu32, currentSoftwareVer, currentVersion);
 
+#if CHIP_DEVICE_CONFIG_ENABLE_OTA_REQUESTOR
+    /* SSBL will always be seen as booting from address 0, thanks to the remapping mechanism.
+     * This means the SSBL version will always offset from address 0. */
+    extern uint32_t __MATTER_SSBL_VERSION_START[];
+    K32W_LOG("Current SSBL Version: %ld. Found at address 0x%lx", *((uint32_t *) __MATTER_SSBL_VERSION_START),
+             (uint32_t) __MATTER_SSBL_VERSION_START);
+#endif
+
+    auto & bleManager = chip::DeviceLayer::Internal::BLEMgrImpl();
+    bleManager.RegisterAppCallbacks(app_gap_callback, app_gatt_callback);
+
     return err;
 }
 

examples/contact-sensor-app/nxp/k32w/k32w1/main/AppTask.cpp

@@ -46,6 +46,8 @@
 #include <src/platform/nxp/k32w/common/OTAImageProcessorImpl.h>
 #endif
 
+#include <src/platform/nxp/k32w/k32w1/BLEManagerImpl.h>
+
 #include "K32W1PersistentStorageOpKeystore.h"
 
 #include "LEDWidget.h"
@@ -106,6 +108,18 @@ static BDXDownloader gDownloader __attribute__((section(".data")));
 constexpr uint16_t requestedOtaBlockSize = 1024;
 #endif
 
+static void app_gap_callback(gapGenericEvent_t * event)
+{
+    /* This callback is called in the context of BLE task, so event processing
+     * should be posted to app task. */
+}
+
+static void app_gatt_callback(deviceId_t id, gattServerEvent_t * event)
+{
+    /* This callback is called in the context of BLE task, so event processing
+     * should be posted to app task. */
+}
+
 CHIP_ERROR AppTask::StartAppTask()
 {
     CHIP_ERROR err = CHIP_NO_ERROR;
@@ -188,6 +202,9 @@ CHIP_ERROR AppTask::Init()
 
     K32W_LOG("Current Software Version: %s, %d", currentSoftwareVer, currentVersion);
 
+    auto & bleManager = chip::DeviceLayer::Internal::BLEMgrImpl();
+    bleManager.RegisterAppCallbacks(app_gap_callback, app_gatt_callback);
+
     return err;
 }
 

examples/lighting-app/nxp/k32w/k32w0/BUILD.gn

@@ -25,6 +25,7 @@ import("${chip_root}/src/platform/device.gni")
 
 declare_args() {
   chip_software_version = 0
+  chip_simple_hash_verification = 0
 }
 
 if (chip_pw_tokenizer_logging) {
@@ -170,6 +171,10 @@ action("binsign") {
   script = "${k32w0_platform_dir}/scripts/sign-outdir.py"
   output_name = "bignsign.log"
   outputs = [ "${root_build_dir}/${output_name}" ]
+
+  if (chip_simple_hash_verification == 1) {
+    args = [ "--simple-hash" ]
+  }
 }
 
 group("default") {

examples/lighting-app/nxp/k32w/k32w0/README.md

@@ -457,6 +457,10 @@ SSBL demo application can be imported from the `Quickstart panel`:
 
 ![SSBL Application Select](../../../../platform/nxp/k32w/k32w0/doc/images/ssbl_select.JPG)
 
+### Features
+
+#### Multi image
+
 To support multi-image OTA feature, the SSBL project must be compiled using the
 following defines:
 
@@ -474,6 +478,24 @@ Optionally, add the following defines:
 
 ![SSBL_MULTI_IMAGE](../../../../platform/nxp/k32w/k32w0/doc/images/ssbl_multi_image.JPG)
 
+#### Simple hash verification
+
+When secure boot is not used, a simple hash can be appended at the end of the
+image for integrity check. Applications should be built with
+`chip_simple_hash_verification=1`.
+
+To support simple hash verification feature, the SSBL project must be compiled
+with:
+
+-   `gSimpleHashVerification=1`
+
+and update the post-build command to use simple hash verification instead of the
+default options. Go to
+`Project -> Properties -> C/C++ Build -> Settings -> Build steps` and press
+`Edit` under `Post-build steps` subsection. The command should look similar to:
+
+![SSBL_SIMPLE_HASH_VERIFICATION](../../../../platform/nxp/k32w/k32w0/doc/images/ssbl_simple_hash.JPG)
+
 Once compiled, the required SSBL file is called `k32w061dk6_ssbl.bin`.
 
 ![SSBL_BIN](../../../../platform/nxp/k32w/k32w0/doc/images/ssbl_bin.JPG)

examples/lighting-app/nxp/k32w/k32w0/include/CHIPProjectConfig.h

@@ -59,6 +59,11 @@
 #define CHIP_DEVICE_CONFIG_DEVICE_VENDOR_ID 0x1037
 #define CHIP_DEVICE_CONFIG_DEVICE_PRODUCT_ID 0xA220
 
+// Set the following define to use the Certification Declaration from below and not use it stored in factory data section
+#ifndef CHIP_USE_DEVICE_CONFIG_CERTIFICATION_DECLARATION
+#define CHIP_USE_DEVICE_CONFIG_CERTIFICATION_DECLARATION 0
+#endif
+
 #ifndef CHIP_DEVICE_CONFIG_CERTIFICATION_DECLARATION
 //-> format_version = 1
 //-> vendor_id = 0x1037

examples/lighting-app/nxp/k32w/k32w0/main/AppTask.cpp

@@ -249,6 +249,14 @@ CHIP_ERROR AppTask::Init()
 
     K32W_LOG("Current Software Version: %s, %" PRIu32, currentSoftwareVer, currentVersion);
 
+#if CHIP_DEVICE_CONFIG_ENABLE_OTA_REQUESTOR
+    /* SSBL will always be seen as booting from address 0, thanks to the remapping mechanism.
+     * This means the SSBL version will always offset from address 0. */
+    extern uint32_t __MATTER_SSBL_VERSION_START[];
+    K32W_LOG("Current SSBL Version: %ld. Found at address 0x%lx", *((uint32_t *) __MATTER_SSBL_VERSION_START),
+             (uint32_t) __MATTER_SSBL_VERSION_START);
+#endif
+
     return err;
 }
 
@@ -897,11 +905,24 @@ void AppTask::PostTurnOnActionRequest(int32_t aActor, LightingManager::Action_t
 
 void AppTask::PostEvent(const AppEvent * aEvent)
 {
+    portBASE_TYPE taskToWake = pdFALSE;
     if (sAppEventQueue != NULL)
     {
-        if (!xQueueSend(sAppEventQueue, aEvent, 1))
+        if (__get_IPSR())
         {
-            K32W_LOG("Failed to post event to app task event queue");
+            if (!xQueueSendToFrontFromISR(sAppEventQueue, aEvent, &taskToWake))
+            {
+                K32W_LOG("Failed to post event to app task event queue");
+            }
+
+            portYIELD_FROM_ISR(taskToWake);
+        }
+        else
+        {
+            if (!xQueueSend(sAppEventQueue, aEvent, 1))
+            {
+                K32W_LOG("Failed to post event to app task event queue");
+            }
         }
     }
 }

examples/lock-app/nxp/k32w/k32w0/args.gni

@@ -21,3 +21,7 @@ k32w0_sdk_target = get_label_info(":sdk", "label_no_toolchain")
 
 chip_stack_lock_tracking = "fatal"
 chip_enable_ble = true
+
+chip_enable_icd_server = true
+chip_persist_subscriptions = true
+chip_subscription_timeout_resumption = true

examples/lock-app/nxp/k32w/k32w0/include/CHIPProjectConfig.h

@@ -59,6 +59,11 @@
 #define CHIP_DEVICE_CONFIG_DEVICE_VENDOR_ID 0x1037
 #define CHIP_DEVICE_CONFIG_DEVICE_PRODUCT_ID 0xA220
 
+// Set the following define to use the Certification Declaration from below and not use it stored in factory data section
+#ifndef CHIP_USE_DEVICE_CONFIG_CERTIFICATION_DECLARATION
+#define CHIP_USE_DEVICE_CONFIG_CERTIFICATION_DECLARATION 0
+#endif
+
 #ifndef CHIP_DEVICE_CONFIG_CERTIFICATION_DECLARATION
 //-> format_version = 1
 //-> vendor_id = 0x1037
@@ -179,8 +184,6 @@
 #define CHIP_CONFIG_MAX_FABRICS 5 // 5 is the minimum number of supported fabrics
 
 #define CHIP_DEVICE_CONFIG_ENABLE_SED 1
-#define CHIP_DEVICE_CONFIG_ICD_SLOW_POLL_INTERVAL 1000_ms32
-#define CHIP_DEVICE_CONFIG_ICD_FAST_POLL_INTERVAL 100_ms32
 
 /**
  * CHIP_CONFIG_EVENT_LOGGING_DEFAULT_IMPORTANCE

examples/platform/nxp/k32w/k32w0/app/ldscripts/chip-k32w0x-linker.ld

@@ -432,8 +432,13 @@ SECTIONS
 
     __StackLimit = _vStackTop - STACK_SIZE;
 
-    __FACTORY_DATA_START = FACTORY_DATA_START_ADDRESS;
-    __FACTORY_DATA_SIZE = m_factory_data_size;
+    __MATTER_FACTORY_DATA_START = FACTORY_DATA_START_ADDRESS;
+    __MATTER_FACTORY_DATA_SIZE = m_factory_data_size;
+
+    /* The .ro_version section inside SSBL is set after the .m_interrupts sections,
+     * which is assumed to never change, so the offset remains the same across different
+     * SSBL versions. This symbol is used in Matter Application to retrieve the SSBL version. */
+    __MATTER_SSBL_VERSION_START = 0x00000120;
 
     ASSERT(((m_app_start + m_app_size + m_app_meta_data + m_factory_data_size + m_flash_config_size) <= m_int_flash_size),
             "Internal flash capacity exceeded")

examples/platform/nxp/k32w/k32w0/scripts/sign-outdir.py

@@ -1,17 +1,36 @@
+import argparse
 import os
 import subprocess
 
-if os.environ["NXP_K32W0_SDK_ROOT"] != "":
-    sign_images_path = os.environ["NXP_K32W0_SDK_ROOT"] + "/tools/imagetool/sign_images.sh"
-else:
-    sign_images_path = os.getcwd() + "/../../../../../../third_party/nxp/k32w0_sdk/repo/core/tools/imagetool/sign_images.sh"
 
-# Give execute permission if needed
-if os.access(sign_images_path, os.X_OK) is False:
-    os.chmod(sign_images_path, 0o766)
+def main(args):
+    if os.environ["NXP_K32W0_SDK_ROOT"] != "":
+        sign_images_path = os.environ["NXP_K32W0_SDK_ROOT"] + "/tools/imagetool/sign_images.sh"
+    else:
+        sign_images_path = os.getcwd() + "/../../../../../../../third_party/nxp/k32w0_sdk/repo/core/tools/imagetool/sign_images.sh"
 
-# Convert script to unix format if needed
-subprocess.call("(file " + sign_images_path + " | grep CRLF > /dev/null) && (dos2unix " + sign_images_path + ")", shell=True)
+    # Give execute permission if needed
+    if os.access(sign_images_path, os.X_OK) is False:
+        os.chmod(sign_images_path, 0o766)
 
-# Call sign_images.sh script with the output directory
-subprocess.call(sign_images_path + " " + os.getcwd(), shell=True)
+    # Convert script to unix format if needed
+    subprocess.call("(file " + sign_images_path + " | grep CRLF > /dev/null) && (dos2unix " + sign_images_path + ")", shell=True)
+
+    # Call sign_images.sh script with the output directory
+    cmd = sign_images_path + " " + os.getcwd()
+    if args.simple_hash:
+        cmd = cmd + " -SimpleHashVerification"
+
+    subprocess.call(cmd, shell=True)
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--simple-hash",
+        help="When enabled, adds a hash of the whole image at the end of the binary.",
+        action="store_true"
+    )
+    args = parser.parse_args()
+
+    main(args)