Changed board to secure thingy91_nrf9160 (NOT NS)

[ArmNewbie]

I'm trying to build some of your samples using nRF Connect/VSCode, but when I try to build a non-secure build for the Thingy91 (thingy91_nrf9160_ns), it changes to secure build (with the message "Changed board to secure thingy91_nrf9160 (NOT NS)").

I run on a Mac M1/OSX-11.7, VSCode 1.74.2, nRF SDK 2.0.2.

I've tried other build configurations/boards (e.g. Nordic nRF9160_DK, Sparkfun nRF9160 etc), and they build a _ns build without problems, but the Thingy91 and also a custom nRF9160 board refuses, and switches to secure build with the same message.

I can try e.g. to build the hello_world sample, and also tried to switch to SDK 1.9.0 or 2.2.0, but same result; nRF9160_DK_ns builds fine, but Thingy91_ns does not.

I've read a few tutorials and (think) I know the details behind TF-M and secure vs non-secure build.
I've seen similar questions in the forum earlier, but unable to find the actual cause of the switch away from ns-builds.

Any hints would be appreciated!

Attached is (some of) the build output:

 *  Executing task: nRF Connect: Build [pristine]: hello_world/build_T (active) 

Building hello_world
west build --build-dir /Users/alfe/Documents/NRF_side/hello_world/build_T /Users/alfe/Documents/NRF_side/hello_world --pristine --board thingy91_nrf9160_ns -- -DNCS_TOOLCHAIN_VERSION:STRING="NONE" -DCONF_FILE:STRING="/Users/alfe/Documents/NRF_side/hello_world/prj.conf"

-- west build: generating a build system
Loading Zephyr default modules (Zephyr base).
-- Application: /Users/alfe/Documents/NRF_side/hello_world
-- Found Python3: /opt/nordic/ncs/toolchains/v2.0.2/bin/python3.9 (found suitable exact version "3.9.6") found components: Interpreter 
-- Cache files will be written to: /Users/alfe/Library/Caches/zephyr
-- Zephyr version: 3.0.99 (/opt/nordic/ncs/v2.0.2/zephyr)
-- Found west (found suitable version "0.13.1", minimum required is "0.7.1")
-- Board: thingy91_nrf9160_ns
-- Found host-tools: zephyr 0.14.1 (/opt/nordic/ncs/toolchains/v2.0.2/opt/zephyr-sdk)
-- Found dtc: /opt/nordic/ncs/toolchains/v2.0.2/bin/dtc (found suitable version "1.6.1", minimum required is "1.4.6")
-- Found toolchain: zephyr 0.14.1 (/opt/nordic/ncs/toolchains/v2.0.2/opt/zephyr-sdk)
-- Found BOARD.dts: /opt/nordic/ncs/v2.0.2/nrf/boards/arm/thingy91_nrf9160/thingy91_nrf9160_ns.dts
-- Generated zephyr.dts: /Users/alfe/Documents/NRF_side/hello_world/build_T/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: /Users/alfe/Documents/NRF_side/hello_world/build_T/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: /Users/alfe/Documents/NRF_side/hello_world/build_T/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: /Users/alfe/Documents/NRF_side/hello_world/build_T/zephyr/dts.cmake
Parsing /opt/nordic/ncs/v2.0.2/zephyr/Kconfig
Loaded configuration '/opt/nordic/ncs/v2.0.2/nrf/boards/arm/thingy91_nrf9160/thingy91_nrf9160_ns_defconfig'
Merged configuration '/Users/alfe/Documents/NRF_side/hello_world/prj.conf'
Configuration saved to '/Users/alfe/Documents/NRF_side/hello_world/build_T/zephyr/.config'
Kconfig header saved to '/Users/alfe/Documents/NRF_side/hello_world/build_T/zephyr/include/generated/autoconf.h'
-- The C compiler identification is GNU 10.3.0
-- The CXX compiler identification is GNU 10.3.0
-- The ASM compiler identification is GNU
-- Found assembler: /opt/nordic/ncs/toolchains/v2.0.2/opt/zephyr-sdk/arm-zephyr-eabi/bin/arm-zephyr-eabi-gcc
Changed board to secure thingy91_nrf9160 (NOT NS)

=== child image spm -  begin ===
loading initial cache file /Users/alfe/Documents/NRF_side/hello_world/build_T/spm/child_image_preload.cmake
Loading Zephyr default modules (Zephyr base).
-- Application: /opt/nordic/ncs/v2.0.2/nrf/samples/spm
-- Found Python3: /opt/nordic/ncs/toolchains/v2.0.2/bin/python3.9 (found suitable exact version "3.9.6") found components: Interpreter 
-- Cache files will be written to: /Users/alfe/Library/Caches/zephyr
-- Zephyr version: 3.0.99 (/opt/nordic/ncs/v2.0.2/zephyr)
-- Found west (found suitable version "0.13.1", minimum required is "0.7.1")
-- Board: thingy91_nrf9160
-- Found host-tools: zephyr 0.14.1 (/opt/nordic/ncs/toolchains/v2.0.2/opt/zephyr-sdk)
-- Found dtc: /opt/nordic/ncs/toolchains/v2.0.2/bin/dtc (found suitable version "1.6.1", minimum required is "1.4.6")
-- Found toolchain: zephyr 0.14.1 (/opt/nordic/ncs/toolchains/v2.0.2/opt/zephyr-sdk)
-- Found BOARD.dts: /opt/nordic/ncs/v2.0.2/nrf/boards/arm/thingy91_nrf9160/thingy91_nrf9160.dts
-- Generated zephyr.dts: /Users/alfe/Documents/NRF_side/hello_world/build_T/spm/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: /Users/alfe/Documents/NRF_side/hello_world/build_T/spm/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: /Users/alfe/Documents/NRF_side/hello_world/build_T/spm/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: /Users/alfe/Documents/NRF_side/hello_world/build_T/spm/zephyr/dts.cmake
Parsing /opt/nordic/ncs/v2.0.2/zephyr/Kconfig
Loaded configuration '/opt/nordic/ncs/v2.0.2/nrf/boards/arm/thingy91_nrf9160/thingy91_nrf9160_defconfig'
Merged configuration '/opt/nordic/ncs/v2.0.2/nrf/samples/spm/prj.conf'
Merged configuration '/opt/nordic/ncs/v2.0.2/nrf/subsys/partition_manager/partition_manager_enabled.conf'
Merged configuration '/Users/alfe/Documents/NRF_side/hello_world/build_T/spm/zephyr/misc/generated/extra_kconfig_options.conf'
Configuration saved to '/Users/alfe/Documents/NRF_side/hello_world/build_T/spm/zephyr/.config'
Kconfig header saved to '/Users/alfe/Documents/NRF_side/hello_world/build_T/spm/zephyr/include/generated/autoconf.h'
-- The C compiler identification is GNU 10.3.0
-- The CXX compiler identification is GNU 10.3.0
-- The ASM compiler identification is GNU
-- Found assembler: /opt/nordic/ncs/toolchains/v2.0.2/opt/zephyr-sdk/arm-zephyr-eabi/bin/arm-zephyr-eabi-gcc
CMake Warning at /opt/nordic/ncs/v2.0.2/zephyr/CMakeLists.txt:1803 (message):
  __ASSERT() statements are globally ENABLED


-- Configuring done
-- Generating done
-- Build files have been written to: /Users/alfe/Documents/NRF_side/hello_world/build_T/spm
=== child image spm -  end ===

-- Found Python3: /opt/nordic/ncs/toolchains/v2.0.2/bin/python3.9 (found version "3.9.6") found components: Interpreter 
Changed board to secure thingy91_nrf9160 (NOT NS)

=== child image mcuboot -  begin ===
loading initial cache file /Users/alfe/Documents/NRF_side/hello_world/build_T/mcuboot/child_image_preload.cmake
Loading Zephyr default modules (Zephyr base).
-- Application: /opt/nordic/ncs/v2.0.2/bootloader/mcuboot/boot/zephyr
-- Found Python3: /opt/nordic/ncs/toolchains/v2.0.2/bin/python3.9 (found suitable exact version "3.9.6") found components: Interpreter 
-- Cache files will be written to: /Users/alfe/Library/Caches/zephyr
-- Zephyr version: 3.0.99 (/opt/nordic/ncs/v2.0.2/zephyr)
-- Found west (found suitable version "0.13.1", minimum required is "0.7.1")
-- Board: thingy91_nrf9160
-- Found host-tools: zephyr 0.14.1 (/opt/nordic/ncs/toolchains/v2.0.2/opt/zephyr-sdk)
-- Found dtc: /opt/nordic/ncs/toolchains/v2.0.2/bin/dtc (found suitable version "1.6.1", minimum required is "1.4.6")
-- Found toolchain: zephyr 0.14.1 (/opt/nordic/ncs/toolchains/v2.0.2/opt/zephyr-sdk)
-- Found BOARD.dts: /opt/nordic/ncs/v2.0.2/nrf/boards/arm/thingy91_nrf9160/thingy91_nrf9160.dts
-- Found devicetree overlay: /opt/nordic/ncs/v2.0.2/bootloader/mcuboot/boot/zephyr/dts.overlay
-- Generated zephyr.dts: /Users/alfe/Documents/NRF_side/hello_world/build_T/mcuboot/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: /Users/alfe/Documents/NRF_side/hello_world/build_T/mcuboot/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: /Users/alfe/Documents/NRF_side/hello_world/build_T/mcuboot/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: /Users/alfe/Documents/NRF_side/hello_world/build_T/mcuboot/zephyr/dts.cmake
Parsing /opt/nordic/ncs/v2.0.2/bootloader/mcuboot/boot/zephyr/Kconfig
Loaded configuration '/opt/nordic/ncs/v2.0.2/nrf/boards/arm/thingy91_nrf9160/thingy91_nrf9160_defconfig'
Merged configuration '/opt/nordic/ncs/v2.0.2/bootloader/mcuboot/boot/zephyr/prj.conf'
Merged configuration '/opt/nordic/ncs/v2.0.2/bootloader/mcuboot/boot/zephyr/boards/thingy91_nrf9160.conf'
Merged configuration '/opt/nordic/ncs/v2.0.2/nrf/subsys/partition_manager/partition_manager_enabled.conf'
Merged configuration '/Users/alfe/Documents/NRF_side/hello_world/build_T/mcuboot/zephyr/misc/generated/extra_kconfig_options.conf'
Configuration saved to '/Users/alfe/Documents/NRF_side/hello_world/build_T/mcuboot/zephyr/.config'
Kconfig header saved to '/Users/alfe/Documents/NRF_side/hello_world/build_T/mcuboot/zephyr/include/generated/autoconf.h'
-- The C compiler identification is GNU 10.3.0
-- The CXX compiler identification is GNU 10.3.0
-- The ASM compiler identification is GNU
-- Found assembler: /opt/nordic/ncs/toolchains/v2.0.2/opt/zephyr-sdk/arm-zephyr-eabi/bin/arm-zephyr-eabi-gcc
MCUBoot bootloader key file: /opt/nordic/ncs/v2.0.2/bootloader/mcuboot/root-rsa-2048.pem
-- Configuring done
-- Generating done
-- Build files have been written to: /Users/alfe/Documents/NRF_side/hello_world/build_T/mcuboot
=== child image mcuboot -  end ===

CMake Warning at /opt/nordic/ncs/v2.0.2/nrf/modules/mcuboot/CMakeLists.txt:281 (message):
  

        ---------------------------------------------------------
        --- WARNING: Using default MCUBoot key, it should not ---
        --- be used for production.                           ---
        ---------------------------------------------------------
        



-- Found partition manager static configuration: /opt/nordic/ncs/v2.0.2/nrf/boards/arm/thingy91_nrf9160/thingy91_pm_static_spm.yml
Partition 'mcuboot' is not included in the dynamic resolving since it is statically defined.
Partition 'mcuboot_pad' is not included in the dynamic resolving since it is statically defined.
Partition 'mcuboot_primary' is not included in the dynamic resolving since it is statically defined.
Partition 'mcuboot_primary_app' is not included in the dynamic resolving since it is statically defined.
Partition 'mcuboot_secondary' is not included in the dynamic resolving since it is statically defined.
Partition 'spm' is not included in the dynamic resolving since it is statically defined.
Dropping partition 'nrf_modem_lib_trace' since its size is 0.
-- Configuring done
-- Generating done
-- Build files have been written to: /Users/alfe/Documents/NRF_side/hello_world/build_T
-- west build: building application
[1/199] Preparing syscall dependency handling

[2/199] Creating directories for 'spm_subimage'
[3/199] Generating misc/generated/syscalls_subdirs.trigger
[4/199] Creating directories for 'mcuboot_subimage'
[5/199] Generating include/generated/version.h
-- Zephyr version: 3.0.99 (/opt/nordic/ncs/v2.0.2/zephyr), build: v3.0.99-ncs1-1
[6/199] No download step for 'mcuboot_subimage'
[7/199] No download step for 'spm_subimage'
[8/199] No update step for 'spm_subimage'
[9/199] No update step for 'mcuboot_subimage'
[10/199] No patch step for 'spm_subimage'
[11/199] No patch step for 'mcuboot_subimage'
[12/199] No configure step for 'spm_subimage'
[12/199] Performing build step for 'spm_subimage'
[1/268] Preparing syscall dependency handling

[2/268] Generating include/generated/version.h
-- Zephyr version: 3.0.99 (/opt/nordic/ncs/v2.0.2/zephyr), build: v3.0.99-ncs1-1
[3/268] Generating misc/generated/syscalls_subdirs.trigger
[4/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/psa_crypto_slot_management.c.obj
[5/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/psa_crypto.c.obj
[6/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/psa_crypto_aead.c.obj
[7/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/psa_crypto_cipher.c.obj
[8/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/psa_crypto_client.c.obj
[9/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/psa_crypto_hash.c.obj
[10/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/psa_crypto_ecp.c.obj
[11/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/psa_crypto_mac.c.obj
[12/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/psa_crypto_rsa.c.obj
[13/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/psa_crypto_storage.c.obj
[14/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/psa_crypto_driver_wrappers.c.obj
[15/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/pkcs12.c.obj
[16/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/pkwrite.c.obj
[17/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/random_ext.c.obj
[18/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/pem.c.obj
[19/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/pkcs5.c.obj
[20/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/pkparse.c.obj
[21/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/dhm.c.obj
[22/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/cipher.c.obj
[23/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/cipher_wrap.c.obj
[24/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/md.c.obj
[25/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/pk.c.obj
[26/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/pk_wrap.c.obj
[27/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/sha1.c.obj
[28/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/sha256.c.obj
[29/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/sha512.c.obj
[30/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/ripemd160.c.obj
[31/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/md5.c.obj
[32/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/aesni.c.obj
[33/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/aria.c.obj
[34/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/camellia.c.obj
[35/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/des.c.obj
[36/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/cmac.c.obj
[37/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/ccm.c.obj
[38/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/chachapoly.c.obj
[39/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/ecdh.c.obj
[40/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/ecdsa.c.obj
[41/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/gcm.c.obj
[42/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/ecp_curves.c.obj
[43/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/hkdf.c.obj
[44/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/ecp.c.obj
[45/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/hmac_drbg.c.obj
[46/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/rsa.c.obj
[47/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/rsa_alt_helpers.c.obj
[48/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/chacha20.c.obj
[49/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/poly1305.c.obj
[50/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/legacy/aes.c.obj
[51/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/opt/nordic/ncs/v2.0.2/mbedtls/library/ecjpake.c.obj
[52/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/legacy/aes_oberon.c.obj
[53/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedcrypto.dir/legacy/ecjpake_oberon.c.obj
[54/268] Building C object modules/nrfxlib/nrfxlib/nrf_security/src/CMakeFiles/mbedx509.dir/opt/nordic/ncs/v
...

[Didrik Rokhaug]

Hi,

This is expected.

When the CPU is reset, it will reboot in "secure" mode. You will therefore need some code to be "secure", which can set up the "non-secure" environment, and jump to the "non-secure" application.

(And just to avoid any misunderstanding, having the application run in the "non-secure" domain doesn't make it less secure. It is the separation between the domains that brings the security)

When you build your application as "non-secure", the build system will include the "secure" application automatically (TF-M or SPM depending on the NCS version). In addition, if you have a bootloader enabled (which is the default on the Thingy:91), it will also be built for the "secure" domain.

If you look at the log in more detail, you will see that it first builds the application for the "non-secure" domain (technically, at this point, it only generates the ninja and configuration files), then it changes the board to the "secure" version and builds the SPM and MCUBoot.

-- west build: generating a build system
Loading Zephyr default modules (Zephyr base).
-- Application: /Users/alfe/Documents/NRF_side/hello_world

...

Changed board to secure thingy91_nrf9160 (NOT NS)

=== child image spm -  begin ===
loading initial cache file /Users/alfe/Documents/NRF_side/hello_world/build_T/spm/child_image_preload.cmake
Loading Zephyr default modules (Zephyr base).
-- Application: /opt/nordic/ncs/v2.0.2/nrf/samples/spm

...

Changed board to secure thingy91_nrf9160 (NOT NS)

=== child image mcuboot -  begin ===
loading initial cache file /Users/alfe/Documents/NRF_side/hello_world/build_T/mcuboot/child_image_preload.cmake
Loading Zephyr default modules (Zephyr base).
-- Application: /opt/nordic/ncs/v2.0.2/bootloader/mcuboot/boot/zephyr

Best regards,

Didrik

[ArmNewbie]

Thanks for elaborating the details Didrik, it really makes sense, and obvious that both the "secure" and "unsecure" parts are to be built.
I got kind of "blindfolded" by the fact that our custom board fails running an unsecure build, and I kind of "short circuited" that with the error in the build log.
Which obvious are two separate things!
For the record; the Thingy:91 runs fine with the NS build (as expected), but an NS build for the custom board does not (same code).
The error message from the console log is this (e.g. when running a hello_world example project):

*** Booting Zephyr OS build v3.0.99-ncs1-1  ***
I: Starting bootloader
I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Swap type: none
I: Bootloader chainload address offset: 0xc000
I: Jumping to the first image slot
E: Protect mcuboot flash failed, cancel startup.

The culprit then points to the board files I guess, and this being not correct.
We have been using your recommendation regarding creating custom board files: www.youtube.com/watch
And have been using the Thingy:91 as basis.
The status now (when building (secure) for the custom board) is that the HW seems to work fine (LED, GPIO, UART, I2C, SPI etc), but the NS builds will not run.
Is it possible to determine anything pointing to the problem from the console output from our board?

BR

-Alf

[Didrik Rokhaug]

The Thingy:91 board files will include MCUBoot automatically, to make it possible to run samples unmodified on the Thingy:91 without a debugger.

However, that also means that you get some Kconfig options that were meant to be Thingy:91 specific when you use that board as a starting point for your custom board.

One of those settings is that MCUBoot is enabled automatically, but you don't also get the Thingy:91-specific options for the MCUBoot child image.

To add the extra MCUBoot settings to your project, you can create a <your project directory>/child_image/mcuboot.conf file, with the contents of bootloader\mcuboot\boot\zephyr\boards\thingy91_nrf9160.conf.

In addition, depending on your antenna design, you might need to add the options from nrf\lib\modem_antenna\Kconfig to your project (your main prj.conf, not child_image/mcuboot.conf)

[ArmNewbie]

Hi Didrik, and thanks for the clarification, and also pointers to the additional config files!
Regarding the antenna design; we have only static antenna matching (yet), so no RF switches controlled by the MAGPIO lines (so far, but might be added later).

Regarding the CONFIG_MCUBOOT_SERIAL stuff in thingy91_nrf9160.conf, that is for being able to bootload the nRF9160 via the nRF52840 and the USB on the Thingy:91 right?
Without using the SWD interface and external debug probe?
On our custom board we have only the 9160, (and no 52840), so all flashing/debugging is done via a separate nRF9160-DK card connected to the SWD interface via the "Debug out" connector.

Anyhow, I've created the mcuboot.conf file as you suggested, and now the error from above is now gone, but still the NS boot doesn't seem to work (the sample program doesn't seem to start).

I've followed the main bim code with the debugger (.../v2.0.2/bootloader/mcuboot/boot/zephyr/main.c ), and it seems to execute ok from (struct arm_vector_table) vt->reset (in line 277), with the entry address  0x0C345 (that seems correct).
Then when further executing into the main code (in .../modules/tee/tf-m/trusted-firmware-m/secure_fw/spm/cmsis_psa/main.c) it seems to stop in nrf_spu_flashregion_set(), on the first assert() on line 408:

NRFX_ASSERT(!(p_reg->FLASHREGION[region_id].PERM & SPU_FLASHREGION_PERM_LOCK_Msk));

The region_id is 14 (when asserting).

Is it possible based on these details to tell what the problem now might be?

[Didrik Rokhaug]

Sorry for the late reply.

ArmNewbie said:

Regarding the CONFIG_MCUBOOT_SERIAL stuff in thingy91_nrf9160.conf, that is for being able to bootload the nRF9160 via the nRF52840 and the USB on the Thingy:91 right?
Without using the SWD interface and external debug probe?

Yes, CONFIG_MCUBOOT_SERIAL is used to enable serial recovery mode, which let you put the device in bootloader-mode and upload a new image over UART.

ArmNewbie said:

Anyhow, I've created the mcuboot.conf file as you suggested, and now the error from above is now gone, but still the NS boot doesn't seem to work (the sample program doesn't seem to start).

Could you try to do an erase-all when you flash, if you haven't done so already?

I tried to create a custom board myself, based on the Thingy:91, following the webinar you linked to. This builds and runs for me:

hello_custom_board.zip