MCUBOOT with nrf9161-sica

[Uri Rotshtein]

I’m working on a custom board based on the nRF9160 (SICA variant) and trying to enable MCUboot + TF-M with sysbuild. I’m running into an issue where the system never reaches the application after MCUboot hands over control.

---

 Environment

• NCS version: 3.2.2

• Zephyr: 4.2.99

• Toolchain: NCS toolchain (default)

• Board: custom (rit_nordic3_nrf9160/ns)

• Using sysbuild with MCUboot and TF-M

Problem description

The device boots into MCUboot correctly, validates the image, and attempts to jump to slot0. However, nothing executes afterward:

• No Zephyr banner

• No TF-M logs (e.g. [Sec Thread] Secure image initializing!)

• No RTT output

• No UART output from the application

---

MCUboot log

*** Booting MCUboot v2.3.0-dev ***
I: Starting bootloader
...
I: Image version: v1.1.0
?: Jumping to the first image slot

After this line → system is silent

---

What we verified

• MCUboot builds and runs correctly

• Image is properly signed and validated (ECDSA OK)

• Partition layout looks correct (slot0 @ 0x10000, slot1 @ 0x80000)

• TF-M is being built (build/.../tfm exists)

• Using sysbuild (--sysbuild)

---

What we tried

1. Logging / console debugging

• Switched to RTT:

  CONFIG_USE_SEGGER_RTT=y
  CONFIG_LOG_BACKEND_RTT=y
  CONFIG_RTT_CONSOLE=y
  CONFIG_UART_CONSOLE=n
  

• Result: still no output after MCUboot jump

---

2. UART console

• Initially UART console worked for MCUboot logs

• Disabled UART console → still no application output

---

3. Partition Manager

• Verified layout using partition_manager_report

• Matches expected MCUboot + TF-M layout

---

4. TF-M dependency check

• Tried disabling TF-M → build fails due to missing psa/crypto.h

• So TF-M is required in our application

---

5. DTS cleanup

We started with a minimal SICA DTS:

#include <nordic/nrf9160ns_sica.dtsi>

Then adjusted our board DTS to:

/dts-v1/;

#include <nordic/nrf9160ns_sica.dtsi>
#include "rit_nordic3_nrf9160-pinctrl.dtsi"
#include "rit_nordic3_nrf9160-partitioning.dtsi"
#include "rit_nordic3_nrf9160.dtsi"

/ {
    chosen {
        zephyr,flash = &flash0;
        zephyr,sram = &sram0_ns;
        zephyr,code-partition = &slot0_partition;
    };
};

Also removed:

• duplicate includes

• flash/sram overrides

• extra soc {} node

---

Current understanding

It looks like:

• MCUboot works and jumps correctly

• Failure happens immediately after jump

• TF-M does not seem to start at all

• Likely a secure memory / SPU / TF-M platform integration issue

Given we are using the SICA variant, we suspect:

• missing or incorrect secure attribution configuration

• board DTS / platform not fully aligned with TF-M expectations

---

Questions

1. Is nrf9160ns_sica.dtsi alone sufficient for TF-M + MCUboot setups?

2. Are there additional required configurations for SPU / secure memory when using SICA?

3. Is there a reference board or example using SICA + TF-M + MCUboot?

4. What is the minimal set of requirements for a custom board DTS to work with TF-M?

---

Goal

We want:

• MCUboot + TF-M working on a custom SICA-based board

• Ability to run application (with console/menu) after boot

---

Any guidance or reference configuration would be greatly appreciated.

Thanks!

[Øyvind]

Hello, 

are you able to build for nrf9160dk/nrf9160/ns and test the same application on that board? 

Are you getting any warnings/errors in the build log while building for your custom board? How is you custom board configured?

Kind regards,
Øyvind

[Uri Rotshtein]

Yes, I can build my application and it is running perfect without any error or warning during the build. Once I tried to add the MCUBOOT to support 2 images I started to had the problem. Without the MCUBOOT every thing is working fine 

[Øyvind]

Øyvind said:

are you able to build for nrf9160dk/nrf9160/ns and test the same application on that board? 

Does the nRF9160DK fail with MCUBOOT as well?

[Uri Rotshtein]

The application runs perfectly on my custom board when compiled without MCUboot. However, when I enable MCUboot, the boot process hangs right when it is supposed to jump to my application. Note: I haven't tested this on the official dev board yet.

[Øyvind]

Are you using Sysbuild in your application? Our AI chatbot provides the following explanation on MCUboot and Sysbuild:

MCUboot and Sysbuild

Sysbuild and MCUboot are closely integrated in the nRF Connect SDK. Here's how they relate:

Sysbuild manages MCUboot as an extra image

Sysbuild is a higher-level build system that can combine multiple build systems — including MCUboot — into a single hierarchical build. MCUboot is one of the pre-made images available in nRF Connect SDK that can be pulled into the build via Sysbuild. [Sysbuild overview]

Enabling MCUboot via Sysbuild

To add MCUboot to your application, you simply enable it in the sysbuild.conf file in your project root:

SB_CONFIG_BOOTLOADER_MCUBOOT=y

This single option instructs Sysbuild to build MCUboot alongside your application, flash both images, and link your application as an MCUboot-bootable image. [Adding MCUboot]

Configuring MCUboot through Sysbuild

Sysbuild Kconfig options (prefixed with SB_CONFIG_) generally override MCUboot's own Kconfig options, ensuring a coherent environment for the entire system. [MCUboot config]

To apply MCUboot-specific configuration, create a sysbuild/mcuboot.conf file in your project. For example, to disable serial logging in MCUboot:

CONFIG_SERIAL=n

[Adding MCUboot]

Key roles MCUboot can play (configured via Sysbuild)

| Role | Sysbuild options | |---|---| | Immutable first-stage bootloader | SB_CONFIG_BOOTLOADER_MCUBOOT=y | | Upgradable second-stage bootloader | SB_CONFIG_BOOTLOADER_MCUBOOT=y + SB_CONFIG_SECURE_BOOT_APPCORE=y | | Firmware loader mode | SB_CONFIG_BOOTLOADER_MCUBOOT=y + SB_CONFIG_MCUBOOT_MODE_FIRMWARE_UPDATER=y |

[MCUboot in NCS]

Configuration rules

Importantly, Sysbuild can configure MCUboot and the application, but MCUboot and the application cannot configure Sysbuild or each other. This provides a clear separation of ownership. [Sysbuild blog]

Kind regards,
Øyvind