TF-M without UART

RE: TF-M without UART

Tomasz K — Wed, 17 Dec 2025 09:55:12 GMT

I don't want to jinx it, but seems like it's working.

I had to call it as early as possible doing in main.c:

int const_lat(void)
{
    NRF_POWER->TASKS_CONSTLAT = 1; // Enable constant latency mode
    return 0;
}

SYS_INIT(const_lat, EARLY, 0);

For debug purposes I think it should be enough.

Thank you for your help, haven't thought of checking errata, as it looked like some configuration issue. I guess uart was keeping clock active.

Thanks again
Tomasz

RE: TF-M without UART

Simon D-M — Wed, 17 Dec 2025 09:20:29 GMT

Hi,

Before searching more in depth, I found this erratum [Debug and Trace: Access port gets locked in WFI and WFE] which sounds a bit like your issue. It basically is that the access port gets locked after the device went to idle.

Can you please try the suggested workaround and tell me if it helped?

Best regards,

Simon D-M

RE: TF-M without UART

Tomasz K — Tue, 16 Dec 2025 16:14:55 GMT

hmmm,
Maybe I'm incorrectly assuming that it's tf-m fault.
Looks like somethink is doing: "there is no standard debug uart, therfore this must be release build, I will enable readback protection".
I have also mcuboot there, maybe it's or app itself is behaving that way?
Is there such option maybe?

RE: TF-M without UART

Tomasz K — Tue, 16 Dec 2025 15:56:28 GMT

Hi,
At some point I've already tried with CONFIG_TFM_SECURE_UART without any effect.
I'm using NCS 3.1.0
I can provide tommorow some cleaned up files from devicetre and prj.conf

Device tree have SPI0, I2C1, SPI2 and SPI3 configured with corresponding pins. Uart is nowhere mentioned, standard includes (as in most examples) are used.

Part of prj.conf:

CONFIG_SERIAL=n
CONFIG_LOG=y
CONFIG_CONSOLE=y
CONFIG_RTT_CONSOLE=y
CONFIG_LOG_BACKEND_RTT=y
CONFIG_USE_SEGGER_RTT=y
CONFIG_EXTENDED_LOGS=y

CONFIG_NRF_SECURITY=y
CONFIG_MBEDTLS_PSA_CRYPTO_C=y

CONFIG_PSA_CRYPTO_DRIVER_OBERON=y # Fallback to Oberon if CC3XX fails
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y
CONFIG_PSA_WANT_ALG_ECB_NO_PADDING=y
CONFIG_PSA_WANT_ALG_SHA_256=y
CONFIG_NRF_SECURITY_ADVANCED=y
CONFIG_NORDIC_SECURITY_BACKEND=y

Rest are config options for network, modem, spi, i2c...

defconfig file:

# Copyright (c) 2024 Nordic Semiconductor ASA
# SPDX-License-Identifier: Apache-2.0

# Enable MPU
CONFIG_ARM_MPU=y

# Enable TrustZone-M
CONFIG_ARM_TRUSTZONE_M=y

# Enable GPIO and PINCTRL
CONFIG_GPIO=y
CONFIG_PINCTRL=y
CONFIG_PINCTRL_DYNAMIC=y

# External Flash
CONFIG_SPI=y
CONFIG_SPI_NOR=y
CONFIG_SPI_NOR_FLASH_LAYOUT_PAGE_SIZE=4096
CONFIG_FLASH_JESD216_API=y

ns_defconfig file:

# Copyright (c) 2024 Nordic Semiconductor ASA
# SPDX-License-Identifier: Apache-2.0

# Enable MPU
CONFIG_ARM_MPU=y

# Enable TrustZone-M
CONFIG_ARM_TRUSTZONE_M=y

# Generate TF-M image 
CONFIG_BUILD_WITH_TFM=y
CONFIG_TFM_PROFILE_TYPE_NOT_SET=y
CONFIG_TFM_LOG_LEVEL_SILENCE=y
CONFIG_TFM_PROFILE_TYPE_MINIMAL=n
CONFIG_TFM_CMAKE_BUILD_TYPE_MINSIZEREL=y

# This Board implies building Non-Secure firmware
CONFIG_TRUSTED_EXECUTION_NONSECURE=y

# Enable GPIO and PINCTRL
CONFIG_GPIO=y
CONFIG_PINCTRL=y
CONFIG_PINCTRL_DYNAMIC=y

# External Flash
CONFIG_SPI=y
CONFIG_SPI_NOR=y
CONFIG_SPI_NOR_FLASH_LAYOUT_PAGE_SIZE=4096
CONFIG_FLASH_JESD216_API=y

Hope that helps at least something. If not, we can always convert ticket to privet and then I can share whole files.

Best regards
Tomasz

RE: TF-M without UART

Simon D-M — Tue, 16 Dec 2025 14:51:28 GMT

Hi Tomasz,

Can you please try with CONFIG_TFM_SECURE_UART=n ? It should already be at "n" as you enabled CONFIG_TFM_LOG_LEVEL_SILENCE, but we never know.

If it doesn't work, what NCS SDK version are you using ?

Can you maybe share some files from your project (devicetree/kconfig/...) ?

Best regards,

Simon D-M