modules: trusted-fimware-m: Add memory configuration logs by AntonZma · Pull Request #28732 · nrfconnect/sdk-nrf

AntonZma · 2026-05-12T14:14:30Z

The only way to extract the actual information about memory regions configured as non-secure is by debugging the code.

This PR adds debug functions for printing SAU and MPC configuration of nRF54L devices, as well as modifying the existing code printing configuration for MPU and SPU, aligning its implementation with SAU/MPC.
A new KConfig option to activate this functionality has also been added.

NordicBuilder · 2026-05-12T14:22:19Z

CI Information

^{To view the history of this post, click the 'edited' button above}
Build number: 4

Inputs:

Sources:

sdk-nrf: PR head: 0e49f28abed5fb4547d62c0dc84cb6ebe10c8b72

more details

sdk-nrf:

PR head: 0e49f28abed5fb4547d62c0dc84cb6ebe10c8b72
merge base: edc1422794d19117e9b7b11cc92e04ad4b1136fb
target head (main): ea86ade4e72ff025485c6b0d132ab7eb3465db35
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (9)

doc
│  ├── nrf
│  │  ├── releases_and_maturity
│  │  │  ├── releases
│  │  │  │  │ release-notes-changelog.rst
modules
│  ├── trusted-firmware-m
│  │  ├── CMakeLists.txt
│  │  ├── Kconfig
│  │  ├── tfm_boards
│  │  │  ├── CMakeLists.txt
│  │  │  ├── common
│  │  │  │  │ tfm_hal_platform.c
│  │  │  ├── include
│  │  │  │  │ log_memory_protection.h
│  │  │  ├── src
│  │  │  │  ├── log_memory_protection_mpu_spu.c
│  │  │  │  │ log_memory_protection_sau_mpc.c
samples
│  ├── crypto
│  │  ├── hmac
│  │  │  │ prj.conf

Outputs:

Toolchain

Version: b819b2845f
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:b819b2845f_5ea73affbf

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister
- sdk-nrf test count: 1052
❌ Integration tests
- ✅ test-fw-nrfconnect-nrf_crypto
- ✅ test-fw-nrfconnect-tfm
- ❌ test-sdk-find-my
- ✅ test-sdk-mcuboot
- ✅ test-sdk-dfu

Disabled integration tests

- test-fw-nrfconnect-nrf_lrcs_mosh
- test-fw-nrfconnect-nrf_lrcs_positioning
- desktop52_verification
- test_ble_nrf_config
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-apps_nrfdesktop
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-chip
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-ps-main
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-rs
- test-fw-nrfconnect-thread-main
- test-low-level
- test-sdk-audio
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

degjorva · 2026-05-12T14:37:48Z

+	  during TF-M initialization. It contains address ranges of the non-secure
+	  memory regions (both volatile and non-volatile). The rest of the memory
+	  is secure by default.
+	  This option is currently available for nRF54L15/10/05.


This is blocked on SOC_SERIES_NRF54L, but you state that only 54l15/10/05 is supported. Do you mean all 54L devices or is this restricted to 54L15? And if restricted to 54L15 why?

Yes, you are right. This option is for all nRF54L devices (which are being configured in target_cfg_54l.c )

github-actions · 2026-05-12T14:58:16Z

You can find the documentation preview for this PR here.

Preview links for modified nRF Connect SDK documents:

https://ncsbmdoc.z6.web.core.windows.net/ncs/PR-28732/nrf/releases_and_maturity/releases/release-notes-changelog.html

umapraseeda · 2026-05-13T06:02:51Z

 * Added:

  * Support for the X25519 key pair storage in the :ref:`Key Management Unit (KMU) <ug_kmu_guides_supported_key_types>`.
+  * The :kconfig:option:`CONFIG_TFM_LOG_NS_MEMORY_LAYOUT` to print the configuration of SAU and MPC during TF-M initialization of the nRF54L15 devices.


Suggested change

* The :kconfig:option:`CONFIG_TFM_LOG_NS_MEMORY_LAYOUT` to print the configuration of SAU and MPC during TF-M initialization of the nRF54L15 devices.

* The :kconfig:option:`CONFIG_TFM_LOG_NS_MEMORY_LAYOUT` Kconfig option to print the configuration of SAU and MPC during TF-M initialization of the nRF54L15 devices.

Vge0rge · 2026-06-01T10:44:04Z

 * Added:

  * Support for the X25519 key pair storage in the :ref:`Key Management Unit (KMU) <ug_kmu_guides_supported_key_types>`.
+  * The :kconfig:option:`CONFIG_TFM_LOG_NS_MEMORY_LAYOUT` Kconfig option to print the configuration of SAU and MPC during TF-M initialization of the nRF54L15 devices.


nrf54L15 -> nr54L series devices maybe? Since this is not specific to the nrf54L15.

Vge0rge · 2026-06-01T10:50:19Z

+
+static void log_memory_protection_sau(void)
+{
+	uint32_t sau_regions_count = SAU->TYPE;


Maybe here it will make sense to do SAU->TYPE & 0xF since the rest of the field is reserved?
https://developer.arm.com/documentation/100235/0100/The-Cortex-M33-Peripherals/Security-Attribution-and--Memory-Protection/Security-Attribution-Unit-Type-Register?lang=en

Yeah, it definitely makes sense

Vge0rge · 2026-06-01T11:14:06Z

+
+static void log_memory_protection_mpc(void)
+{
+	/* On 54l the NRF_MPC00->REGION[]'s are fixed in HW and the


Nit, in 54L there are only overrides, not regions

Vge0rge · 2026-06-01T11:17:41Z

+	for (uint32_t i = 0; i <= max_index; i++) {
+		config = nrf_mpc_override_config_get(NRF_MPC00, i);
+		if (config.enable) {
+			SPMLOG_INFMSG("NS region\r\n");


Since MPC could possibly set the override as secure do you think that it makes sense to also call nrf_mpc_override_perm_get here and check the secure bit?
https://docs-be.nordicsemi.com/bundle/ps_nrf54L15/page/mpc.html#register.OVERRIDE.PERM

Yeah, this is a more universal approach. When implementing this I checked how this is configured in target_cfg_54l.c.
Anyway, now it is updated to check both PERM and PERMMASK.

greg-fer · 2026-06-01T11:46:07Z

 * Added:

  * Support for the X25519 key pair storage in the :ref:`Key Management Unit (KMU) <ug_kmu_guides_supported_key_types>`.
+  * The :kconfig:option:`CONFIG_TFM_LOG_NS_MEMORY_LAYOUT` Kconfig option to print the configuration of SAU and MPC during TF-M initialization of the nRF54L15 devices.


Suggested change

* The :kconfig:option:`CONFIG_TFM_LOG_NS_MEMORY_LAYOUT` Kconfig option to print the configuration of SAU and MPC during TF-M initialization of the nRF54L15 devices.

* The :kconfig:option:`CONFIG_TFM_LOG_NS_MEMORY_LAYOUT` Kconfig option, which prints the configuration of SAU and MPC during the initialization of TF-M on the nRF54L Series devices.

greg-fer · 2026-06-01T12:01:02Z

+
+static void log_memory_protection_mpc(void)
+{
+	/* On 54l the NRF_MPC00->REGION[]'s are fixed in HW and the


Suggested change

/* On 54l the NRF_MPC00->REGION[]'s are fixed in HW and the

/* On 54L, the regions (NRF_MPC00->REGION[]) are fixed in HW and the

Rephrased a bit after applying a fix suggested by Georgios

greg-fer · 2026-06-01T12:01:15Z

+{
+	/* On 54l the NRF_MPC00->REGION[]'s are fixed in HW and the
+	 * OVERRIDE indexes (that are useful to us) start at 0 and end
+	 * (inclusive) at 4.


Suggested change

* (inclusive) at 4.

* at 4 (inclusive).

greg-fer · 2026-06-01T12:02:33Z

+	  This option activates logic to print the configuration of SAU and MPC
+	  during TF-M initialization. It contains address ranges of the non-secure
+	  memory regions (both volatile and non-volatile). The rest of the memory
+	  is secure by default.
+	  This option is currently available for all nRF54L devices.


Suggested change

This option activates logic to print the configuration of SAU and MPC

during TF-M initialization. It contains address ranges of the non-secure

memory regions (both volatile and non-volatile). The rest of the memory

is secure by default.

This option is currently available for all nRF54L devices.

This option activates the logic to print the configuration of SAU and MPC

during the initialization of TF-M. The logic targets address ranges of the non-secure

memory regions (both volatile and non-volatile). The rest of the memory

is secure by default.

This option is currently available for all nRF54L Series devices.

The only way to extract the actual information about memory regions configured as non-secure is by debugging the code. This commit adds debug functions for printing SAU and MPC configuration of nRF54L devices. It also modifies the existing code printing configuration for MPU and SPU, aligning its implementation with SAU/MPC. A new KConfig option to activate this functionality has also been added. Ref: NCSDK-38986 Signed-off-by: Anton Zyma <anton.zyma@nordicsemi.no>

tomi-font · 2026-06-02T10:44:26Z

+	uint32_t sau_regions_count = SAU->TYPE & SAU_TYPE_SREGION_Msk;
+	uint32_t limit_address;
+
+	SPMLOG_INFMSG("SAU config:\r\n");


this will need updating after #28975 goes in

yeah, this got merged so you will have to update this in order to get a green CI.
This is the relevant commit:
cc80336

Vge0rge · 2026-06-03T08:35:52Z

 CONFIG_PSA_WANT_ALG_SHA_256=y
 CONFIG_PSA_WANT_KEY_TYPE_HMAC=y
+
+CONFIG_TFM_LOG_NS_MEMORY_LAYOUT=y


I guess this was added by accident, right?

AntonZma requested review from Vge0rge and greg-fer May 12, 2026 14:14

AntonZma requested review from a team as code owners May 12, 2026 14:14

NordicBuilder added doc-required PR must not be merged without tech writer approval. changelog labels May 12, 2026

degjorva reviewed May 12, 2026

View reviewed changes

AntonZma force-pushed the tfm-config-logs branch from 0182dd2 to 32af922 Compare May 12, 2026 15:06

umapraseeda reviewed May 13, 2026

View reviewed changes

AntonZma requested a review from degjorva May 13, 2026 12:01

nordicjm approved these changes May 14, 2026

View reviewed changes

AntonZma force-pushed the tfm-config-logs branch from 32af922 to 7ec2a1b Compare May 14, 2026 14:52

AntonZma requested a review from umapraseeda May 14, 2026 14:53

Vge0rge reviewed Jun 1, 2026

View reviewed changes

greg-fer requested changes Jun 1, 2026

View reviewed changes

AntonZma force-pushed the tfm-config-logs branch from 7ec2a1b to 0e49f28 Compare June 2, 2026 10:37

AntonZma requested review from Vge0rge and greg-fer June 2, 2026 10:41

tomi-font reviewed Jun 2, 2026

View reviewed changes

greg-fer approved these changes Jun 2, 2026

View reviewed changes

Vge0rge reviewed Jun 3, 2026

View reviewed changes

	* The :kconfig:option:`CONFIG_TFM_LOG_NS_MEMORY_LAYOUT` to print the configuration of SAU and MPC during TF-M initialization of the nRF54L15 devices.
	* The :kconfig:option:`CONFIG_TFM_LOG_NS_MEMORY_LAYOUT` Kconfig option to print the configuration of SAU and MPC during TF-M initialization of the nRF54L15 devices.

	/* On 54l the NRF_MPC00->REGION[]'s are fixed in HW and the
	/* On 54L, the regions (NRF_MPC00->REGION[]) are fixed in HW and the

Conversation

AntonZma commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NordicBuilder commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AntonZma Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

AntonZma commented May 12, 2026 •

edited

Loading

NordicBuilder commented May 12, 2026 •

edited

Loading

AntonZma Jun 2, 2026 •

edited

Loading