About the future of TF-M with Zephyr

[Farossco]

Hi !

This is more of a question than an issue. I am curious about the future of TF-M and its implementation on Zephyr. Does anyone know what are the plans on Zephy's or Nordic's side regarding the using of TF-M? Will it eventually replace SPM and will the libraries be updated to support it? I'm thinking for example about the FOTA or DFU Target libraries.

Also, speaking about FOTA, is there any useful implementation for FOTA updates using TF-M with Zephyr ?

Thank you by advance.

Kind regards,
Farès

[galak]

@ioannisg @microbuilder FYI.

[microbuilder]

Zephyr has been keeping pace with major TF-M releases, and there is obvious interest in seeing that continue. The biggest obstacle to enabling TF-M on a wider variety of boards is the need to have the MCU and board supported upstream in TF-M. There is a certain learning curve associated with that, but more importantly limited bandwidth from people currently working on the TF-M integration in Zephyr to tackle that as well.

As for firmware over the air (FOTA), TF-M 1.3 introduced a new secure service called FWU (Firmware Update) that aims to provide a plaltform-agnostic mechanism to handle firmware updates, with the image retrieval delegated to the NS app, and image verification and update handled on the secure sidee. This means it can be OTA, or something else. It's still a WIP and there isn't a reference example implemented yet in Zephyr, but it's on our radar.

If you are interested in whether Nordic plans to support their own specific OTA update process over FWU, I'll have to defer to them, since I can't speak for their plans for their chips specifically.