Adding mcuboot/NSIB/TFM to nrf9160

[Anthony Ambuehl]

Hello I have an application developed on NCS 2.3.0 with nrf5340dk_nrf5340_cpuapp_ns, that uses TF-M with encrypted ITS and a secure partition, NSIB(b0) and mcuboot with external flash.

I am now porting this application to nrf9160dk_nrf9160_ns. 

I'm running into size issues which I believe are due to TF-M not in minimal mode. 

Is there an example of how to build a minimal custom TF-M or how to fit the full-size TF-M with mcuboot/NSIB on the nrf9160?

[Håkon Alseth]

Hi,

 

A minimal build of TFM is effectively a small 32k flash area which has no crypto features. This is selected using kconfig "CONFIG_TFM_PROFILE_TYPE_MINIMAL" and is the default target for most builds. 

Is there an example of how to build a minimal custom TF-M or how to fit the full-size TF-M with mcuboot/NSIB on the nrf9160?

Adjusting the sizes of TF-M can be tricky, as you'll need to dynamically adjust the size of the TFM partition to match your tfm-firmware image size.

I posted a bit more detailed information + a link to an tfm crypto example in this thread:  RE: partition manager doesn't place the modem shared memory correctly, pm_static.yml required? 

 

Kind regards,

Håkon

[Anthony Ambuehl]

I was able to make everything fit.

Some helpful tools

west build -t tfm_ram_report

west build -t tfm_rom_report

If you are using partition manager (not static partition) you need to set

CONFIG_PM_PARTITION_SIZE_TFM=0x3FE00
CONFIG_PM_PARTITION_SIZE_TFM_SRAM=0x44000

NOTE: the actual sizes should be based on the results of the ram/rom report

With KConfig numeric values, be sure to put 0x at the beginning if you want hexadecimal, the interpretation will vary depending on whether there the characters [a-fA-F] are present.. if the numeric literal only has characters [0-9] it will be interpreted as decimal, but it will accept hexadecimal values without the 0x prefix and switch between decimal/hexadecimal.

Also important to note that TFM partition sizes only matter at run time for matching the SPU region alignment requirements.  The nRF9160 and nrf5340 have different SPU region sizes.  The region size is determined by ONFIG_NRF_SPU_FLASH_REGION_SIZE.. 0x4000 for nrf5340 and 0x8000 for nrf9160.  

In the current build, TF-M is combined with the non-secure application as a single update image so the partitioning doesn't matter for DFU.. its ok to change between releases.  NOTE: there may be modes (in the future?) where TF-M and the NS app can be updated independently.