Application fails to boot with MCUboot image in external flash and TF-M

[andvib]

For my project I want MCUboot with the upgrade image placed in the external flash, and TF-M. I am not able to get this combo to boot however, and I suspect the reason is that MCUboot and non-secure application is fighting over the SPI bus.

In this branch I've set up Zephyr's hello world to have the same configuration, and I see MCUboot running just fine, TF-M booting and printing jump to image, but I never see the application image boot. If I move the upgrade image back into the primary flash the configuration works right away.

Is there a chance that MCUboot running the SPI peripheral in the secure world collides with the application attempting to use the SPI peripheral in the non-secure world? The SPI is not configured to be secure, but is it a requirement that the peripheral is reset after MCUboot is done with it so the application can configure it for non-secure execution?

I'm running on a nRF54LM20A DK. I have upgrade image in external flash and TF-M running in separate projects without issues, however when I combine them I can't get them to boot. In a different project I had issues when the I2C peripheral had status="okay" in both the secure and non-secure DTS, which lead to a hard fault when I initialized it in my non-secure application. I', suspecting a similar issue, that the kernel initializes the peripheral even though it's not used and this causing issues for the non-secure application.

Thanks!

[AHaug]

Hello! 

Could you share the runtime logs and/or any error messages that you run into when trying?

Could you share your memory map (generated partitions,yml in your build folder is fine)? 

I'm more leaning towards the option of there being a non-correct partitioning w.r.t tf-m partitions rather than a conflict of spi resources, but I'm not excluding that this could be the case

Kind regards,
Andreas

[andvib]

Getting the partitions right for TF-M is difficult, so I'm also open to this being the issue. This is the compiled parititons.yml, or you can see the pm_static in my fork.

app:
  address: 0x73000
  end_address: 0x1fd000
  region: flash_primary
  size: 0x18a000
bootconf:
  address: 0xffd080
  end_address: 0xffd084
  region: bootconf
  size: 0x4
external_flash:
  address: 0x0
  end_address: 0x800000
  region: external_flash
  size: 0x800000
mcuboot:
  address: 0x0
  end_address: 0x28000
  placement:
    before:
    - mcuboot_primary
  region: flash_primary
  size: 0x28000
mcuboot_pad:
  address: 0x28000
  end_address: 0x29000
  placement:
    before:
    - app
  region: flash_primary
  size: 0x1000
mcuboot_primary:
  address: 0x28000
  end_address: 0x1e5000
  region: flash_primary
  size: 0x1bd000
  span:
  - mcuboot_pad
  - app
mcuboot_primary_app:
  address: 0x28000
  end_address: 0x1e5000
  region: flash_primary
  size: 0x1bd000
  span:
  - mcuboot_pad
  - app
mcuboot_secondary:
  address: 0x0
  end_address: 0x1bc000
  placement:
    align:
      start: 0x1000
  region: external_flash
  size: 0x1bc000
mcuboot_sram:
  address: 0x20000000
  end_address: 0x20010000
  orig_span: &id001
  - tfm_sram
  region: sram_primary
  size: 0x10000
  span: *id001
otp:
  address: 0xffd500
  end_address: 0xffd980
  region: otp
  size: 0x480
sram_nonsecure:
  address: 0x20010000
  end_address: 0x2007fe40
  orig_span: &id002
  - sram_primary
  region: sram_primary
  size: 0x6fe40
  span: *id002
sram_primary:
  address: 0x20010000
  end_address: 0x2007fe40
  region: sram_primary
  size: 0x6fe40
sram_secure:
  address: 0x20000000
  end_address: 0x20010000
  orig_span: &id003
  - tfm_sram
  region: sram_primary
  size: 0x10000
  span: *id003
tfm:
  address: 0x29000
  end_address: 0x68800
  placement:
    before:
    - app
  region: flash_primary
  size: 0x3f800
tfm_its:
  address: 0x68800
  end_address: 0x6c800
  inside:
  - tfm_storage
  placement:
    before:
    - tfm_otp_nv_counters
  region: flash_primary
  size: 0x4000
tfm_nonsecure:
  address: 0x73000
  end_address: 0x1e5000
  orig_span: &id004
  - app
  region: flash_primary
  size: 0x172000
  span: *id004
tfm_otp_nv_counters:
  address: 0x6c800
  end_address: 0x6e800
  inside:
  - tfm_storage
  placement:
    before:
    - tfm_ps
  region: flash_primary
  size: 0x2000
tfm_ps:
  address: 0x6e800
  end_address: 0x73000
  inside:
  - tfm_storage
  placement:
    after:
    - tfm_secure
  region: flash_primary
  size: 0x4800
tfm_secure:
  address: 0x29000
  end_address: 0x68800
  orig_span: &id005
  - tfm
  region: flash_primary
  size: 0x3f800
  span: *id005
tfm_sram:
  address: 0x20000000
  end_address: 0x20010000
  inside:
  - sram_secure
  placement:
    after:
    - start
  region: sram_primary
  size: 0x10000
tfm_storage:
  address: 0x68800
  end_address: 0x73000
  orig_span: &id006
  - tfm_ps
  - tfm_its
  - tfm_otp_nv_counters
  region: flash_primary
  size: 0xa800
  span: *id006

This is the runtime logs I get from MCUboot:

*** Booting Zephyr OS build ncs-v3.3.0-2-gda4454231faa ***
*** Booting My Application v2.3.0-dev-fce4dac2e629 ***
*** Using nRF Connect SDK v3.3.0-a7f2e9d655e2 ***
*** Using Zephyr OS v4.3.99-da4454231faa ***
[00:00:00.024,078] <inf> mcuboot: Starting bootloader
[00:00:00.030,154] <inf> mcuboot: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
[00:00:00.040,139] <inf> mcuboot: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
[00:00:00.050,121] <inf> mcuboot: Boot source: none
[00:00:00.055,659] <inf> mcuboot: Image index: 0, Swap type: none
[00:00:00.154,197] <inf> mcuboot: Bootloader chainload address offset: 0x28000
[00:00:00.161,754] <inf> mcuboot: Image version: v0.0.0
[00:00:00.167,384] <inf> mcuboot: Jumping to the first image slot

This is the runtime logs from TF-M (which do look a bit cut off):

Pins have been configured as secure.
GPIO port: 0x00000000
Pin: 0x00000000
Pin: 0x00000001
Booting TF-M v2.2.2**

I get no output from the application, even when I've tried to disable the UART for MCUboot and TF-M to make sure they don't fight over the peripheral. I also added blinky code to Hello World to have a visual confirmation other than UART logs, and the LED is not blinking which supports the app never booting.