nRF9160 application porting to non secure domain

[StefanL]

Dear nordic support

We're in the concept phase of a product that implements cellular cloud connectivity.

We already implemented a "blueprint" ESW which provides supporting functionality like logging, a console interface, dedicated debug pins etc.

In order to implement cloud communication I currently attempt to port the project to run as non secure application (so that the modem functionality can be used).

My setup is as follows:

• nRF9160-DK Board (PCA10090 1.0.1 2021.25)
• nRF Connect SDK 2.1.0
• nRF9160 SiP modem firmware 1.3.3

When I build the esw using board configuration nrf9160dk_nrf9160 it runs as expected.

When I build using nrf9160dk_nrf9160_ns the application gets stuck in the main() within the TF-M (never reaches the main of the parent application)

I don't know about possible reasons for this issue and what I should check to find the root cause.

I'm very thankful for any hint, or guideline on how to port an existing application to non secure domain.

Best, Stefan

[dejans]

Hi Stefan,

What are you referring to as ESW?

Best regards,
Dejan

[StefanL]

Hi Dejan

I'm aware that I didn't yet give much context about our application, but I'm happy to provide you with further info, if it helps.

I read some reference text in the nRF Connect SDK documentation (e.g. "Running applications with Trusted Firmware-M"). I'm aware that peripherals must be dedicated to the non secure domain, in order to be used from code in this domain.

I'm uncertain if peripherals are dedicated to the NS domain per default (if I build the target using "nrf9160dk_nrf9160_ns" board), or if I need to configure this somehow.

(..it's just my guess that maybe the parent software doesn't startup because peripherals are configured wrongly)

Best, Stefan

[dejans]

Hi Stefan,

As specified in Running Applications with Trusted Firmware M, during build process, TF-M is included as an image in multi-image build.  TF-M can be added to the build by specifying CONFIG_BUILD_WITH_TFM=y in your prj.conf file. TF-M is built using non-secure build target.

Most peripherals reside in non-secure domain by default. You can read more about peripheral instantiation in the documentation. Additionally, there is TF-M secure peripheral partition sample which demonstrates the configuration of peripherals as secure peripherals, and the usage of the secure peripherals in the secure partition.

Best regards,
Dejan 

[StefanL]

Thanks Dejan

I've now approached the challenge a little bit differently. Instead of trying to port our existing software, I started from a sample project which already includes the TF-M. I succeeded to include some of our existing software items into it (not yet finished, but looks promising).

Anyway, ...thanks for your support and the provided links.

BR, Stefan