TF-M and DFU Image Manager/MCUboot

[caspar.friedrich]

Hi!

I'm trying to switch from SPM to TF-M in oder to use the secure processing environment. We currently use MCUboot + SPM for bootstrapping and DFU Image Manager for applying firmware updates. If I enable CONFIG_BUILD_WITH_TFM and CONFIG_BOOTLOADER_MCUBOOT I get the following:

Partition manager failed: partition signed_tfm_app (['app', 'tfm']) does not span over consecutive parts. Solution: ['bl2', 'tfm', 'mcuboot', 'mcuboot_pad', 'app', 'tfm_secondary', 'app_secondary', 'tfm_extra', 'mcuboot_secondary']
Failed to partition region flash_primary, size of region: 1048576
Partition Configuration:
bl2:
  placement:
    before:
    - tfm
  size: 32768
mcuboot:
  placement:
    before:
    - mcuboot_primary
  size: 49152
mcuboot_pad:
  placement:
    align:
      start: 32768
   before:
   - mcuboot_primary_app
  size: 512
tfm:
  placement:
    before:
    - app
  size: 262144
tfm_extra:
  align:
    start: 32768
  placement:
    after:
    - app_secondary
    - app
  size: 65536

As far as I cas senn the Image Manager directly depends on that module. I'm building for nrf9160dk_nrf9160ns with no modifications other than disabling uart1 as suggested.

Regards

Caspar

[Hakon]

Hello,

I have asked about this internally and still waiting for an answer. I will let you know when I hear from them.

[caspar.friedrich]

Cool, thank you!

[Hakon]

From my understanding, you can't have CONFIG_BOOTLOADER_MCUBOOT enabled because TF-M is certified with a specific version of MCUboot called BL2.

[caspar.friedrich]

That's my understanding, too. Currently we use the API provides through dfu/mcuboot.h to install firmware updates and verify images. At the moment I can't see a alternative that uses tfm/bl2.