Configuring pm_static.yml when porting from SPM to TFM

[esisk]

Hello,

I'm working on updating my copy of the nRF Connect SDK from 1.7.0 to 2.4.2. My project runs on an nRF9160 so I had SPM configured for my project and now I need to use TFM instead. To do that, I'm following these instructions: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/security/tfm.html#ug-tfm-migrate. However, I get an error during build configuration from the partition manager saying that there are gaps in my partitions:

Partition manager failed: Incorrect amount of gaps found in static configuration. There must be exactly one gap in the static configuration to support placing the dynamic partitions (such as 'app').
Gaps found (2):0x20000000-0x20010000 0x200144e8-0x20040000 The most common solution to this problem is to fill the smallest of these gaps with statically defined partition(s) until there is only one gap left.
Alternatively re-order the already defined static partitions so that only one gap remains.

I'm not finding any gaps in my file, and I'm changing over the names as instructed. Here's my new pm_static.yml file

app:
  address: 0x1c200
  end_address: 0xfa000
  region: flash_primary
  size: 0xdde00
external_flash:
  address: 0xf2000
  end_address: 0x400000
  placement:
    after:
    - mcuboot_secondary
  region: external_flash
  size: 0x30e000
mcuboot:
  address: 0x0
  end_address: 0xc000
  placement:
    before:
    - mcuboot_primary
  region: flash_primary
  size: 0xc000
mcuboot_pad:
  address: 0xc000
  # end_address: 0xc200
  placement:
    before:
    - mcuboot_primary_app
  region: flash_primary
  size: 0x0
mcuboot_primary:
  address: 0xc000
  end_address: 0xfe000
  orig_span: &id001
  - tfm
  - mcuboot_pad
  - app
  region: flash_primary
  size: 0xf2000
  span: *id001
mcuboot_primary_app:
  address: 0xc200
  end_address: 0xfe000
  orig_span: &id002
  - app
  - tfm
  region: flash_primary
  size: 0xf1e00
  span: *id002
mcuboot_secondary:
  address: 0x0
  device: MX25L3
  end_address: 0xf2000
  placement:
    align:
      start: 0x0
  region: external_flash
  size: 0xf2000
nrf_modem_lib_ctrl:
  address: 0x20010000
  end_address: 0x200104e8
  inside:
  - sram_nonsecure
  placement:
    after:
    - start
  region: sram_primary
  size: 0x4e8
nrf_modem_lib_rx:
  address: 0x200124e8
  end_address: 0x200144e8
  inside:
  - sram_nonsecure
  placement:
    after:
    - nrf_modem_lib_tx
  region: sram_primary
  size: 0x2000
nrf_modem_lib_sram:
  address: 0x20010000
  end_address: 0x200144e8
  orig_span: &id003
  - nrf_modem_lib_ctrl
  - nrf_modem_lib_tx
  - nrf_modem_lib_rx
  region: sram_primary
  size: 0x44e8
  span: *id003
nrf_modem_lib_tx:
  address: 0x200104e8
  end_address: 0x200124e8
  inside:
  - sram_nonsecure
  placement:
    after:
    - nrf_modem_lib_ctrl
  region: sram_primary
  size: 0x2000
otp:
  address: 0xff8108
  end_address: 0xff83fc
  region: otp
  size: 0x2f4
tfm:
  address: 0xc000
  end_address: 0x1c200
  inside:
  - mcuboot_primary_app
  placement:
    before:
    - app
  region: flash_primary
  size: 0x10200
tfm_secure:
  address: 0xc000
  size: 0x10000
  span: [mcuboot_pad, tfm]
tfm_nonsecure:
  address: 0x1c200
  size: 0xdde00
  span: [app]
sram_nonsecure:
  address: 0x20010000
  end_address: 0x20040000
  orig_span: &id004
  - sram_primary
  - nrf_modem_lib_ctrl
  - nrf_modem_lib_tx
  - nrf_modem_lib_rx
  region: sram_primary
  size: 0x30000
  span: *id004
sram_primary:
  address: 0x200144e8
  end_address: 0x20040000
  region: sram_primary
  size: 0x2bb18
sram_secure:
  address: 0x20000000
  end_address: 0x20010000
  orig_span: &id005
  region: sram_primary
  size: 0x10000
  span: *id005
lwm2m_carrier:
  address: 0xfa000
  size: 0x4000
  inside:
  - tfm_nonsecure
settings_storage:
  address: 0xfe000
  end_address: 0x100000
  placement:
    before:
    - end
  region: flash_primary
  inside:
  - tfm_nonsecure
  size: 0x2000

compared to my old one:

app:
  address: 0x1c200
  end_address: 0xfa000
  region: flash_primary
  size: 0xdde00
external_flash:
  address: 0xf2000
  end_address: 0x400000
  placement:
    after:
    - mcuboot_secondary
  region: external_flash
  size: 0x30e000
mcuboot:
  address: 0x0
  end_address: 0xc000
  placement:
    before:
    - mcuboot_primary
  region: flash_primary
  size: 0xc000
mcuboot_pad:
  address: 0xc000
  end_address: 0xc200
  placement:
    before:
    - mcuboot_primary_app
  region: flash_primary
  size: 0x200
mcuboot_primary:
  address: 0xc000
  end_address: 0xfe000
  orig_span: &id001
  - spm
  - mcuboot_pad
  - app
  region: flash_primary
  size: 0xf2000
  span: *id001
mcuboot_primary_app:
  address: 0xc200
  end_address: 0xfe000
  orig_span: &id002
  - app
  - spm
  region: flash_primary
  size: 0xf1e00
  span: *id002
mcuboot_secondary:
  address: 0x0
  device: MX25L3
  end_address: 0xf2000
  placement:
    align:
      start: 0x0
  region: external_flash
  size: 0xf2000
nrf_modem_lib_ctrl:
  address: 0x20010000
  end_address: 0x200104e8
  inside:
  - sram_nonsecure
  placement:
    after:
    - spm_sram
    - start
  region: sram_primary
  size: 0x4e8
nrf_modem_lib_rx:
  address: 0x200124e8
  end_address: 0x200144e8
  inside:
  - sram_nonsecure
  placement:
    after:
    - nrf_modem_lib_tx
  region: sram_primary
  size: 0x2000
nrf_modem_lib_sram:
  address: 0x20010000
  end_address: 0x200144e8
  orig_span: &id003
  - nrf_modem_lib_ctrl
  - nrf_modem_lib_tx
  - nrf_modem_lib_rx
  region: sram_primary
  size: 0x44e8
  span: *id003
nrf_modem_lib_tx:
  address: 0x200104e8
  end_address: 0x200124e8
  inside:
  - sram_nonsecure
  placement:
    after:
    - nrf_modem_lib_ctrl
  region: sram_primary
  size: 0x2000
otp:
  address: 0xff8108
  end_address: 0xff83fc
  region: otp
  size: 0x2f4
spm:
  address: 0xc200
  end_address: 0x1c200
  inside:
  - mcuboot_primary_app
  placement:
    before:
    - app
  region: flash_primary
  size: 0x10000
spm_sram:
  address: 0x20000000
  end_address: 0x20010000
  inside:
  - sram_secure
  placement:
    after:
    - start
  region: sram_primary
  size: 0x10000
sram_nonsecure:
  address: 0x20010000
  end_address: 0x20040000
  orig_span: &id004
  - sram_primary
  - nrf_modem_lib_ctrl
  - nrf_modem_lib_tx
  - nrf_modem_lib_rx
  region: sram_primary
  size: 0x30000
  span: *id004
sram_primary:
  address: 0x200144e8
  end_address: 0x20040000
  region: sram_primary
  size: 0x2bb18
sram_secure:
  address: 0x20000000
  end_address: 0x20010000
  orig_span: &id005
  - spm_sram
  region: sram_primary
  size: 0x10000
  span: *id005
lwm2m_carrier:
  address: 0xfa000
  size: 0x4000
settings_storage:
  address: 0xfe000
  end_address: 0x100000
  placement:
    before:
    - end
  region: flash_primary
  size: 0x2000

Does anyone see anything glaringly wrong or have any tips?

[Hieu]

Hi esisk,

Sorry for the delay from me too. We had a high-loading period, and I am still recovering from it.

esisk said:

Edit 1:

When trying to build a the hello_world sample from zephyr/samples, I get this error:

Are you building a secure target (without _ns)?

esisk said:

Edit 2:

When looking at some samples I see this config variable CONFIG_TFM_BL2, could you explain more what this does?

TFM has a two-stage bootloader solution. However, that is not supported in NCS.

[esisk]

Hey Hieu,

Sorry for the delayed response, this is a side quest that I'm working on alongside other priorities. Something interesting to note, I finally got the project to build and run by disabling MCUBoot in the build. I have TFM enabled and my program is just printing Hello World. So the problem must lie with MCUBoot or how I've configured it. I will try building without a pm_static.yml file and see how that goes. Any other suggestions you could provide would be helpful.

Edit 1: My current hunch is that the regulator powering my external flash is not getting initialized correctly. MCUBoot needs to be able to access the external flash in order to determine which image to boot into. I think this is the issue because my app is hanging whenever I am initializing the application NVS file systems on the external flash, so I figure that the same thing would happen in MCUBoot. I'm able to get the regulator device handle correctly and call regulator_enable by passing in the handle, but this doesn't seem to be doing anything because trying to get the external flash device handle results in NULL. Has anything changed in how the regulator is powered upon boot or how to get the external flash device handle? The overlay that I sent in the zip folder above works fine in my project built with NCS 1.7.0

Edit 2: I have further confirmed the problem seems to be with MCUBoot. I built my hello world application with NCS 2.4.2 and sent an update to a device running an MCUBoot, SPM, and an application all built with NCS 1.7.0. The update was successful. So that implies to me that MCUBoot is the issue since the MCUBoot on the updated device is the same version that was on it previously

[Hieu]

Hi Ethan,

I also apologize for the late response. I have been out of office.

To rule out the external flash initialization issue, could you please configure your setup to work without external flash and see if the issue can still be reproduced?

Also, are you working on a custom board? If so, may I know what external flash device you are using, and what the configuration is?

Hieu