TF-M Firmware Update

Overview

This TF-M integration sample demonstrates how to use the PSA Firmware Update API to perform a firmware update on a device running TF-M on the secure side and Zephyr on the non-secure side.

The sample includes two applications:

The main application writes a new firmware image to the update partition using the PSA FWU API, then triggers a reboot to apply the update.
The swapped application is the new firmware image that boots after the update is applied.

For simplicity, the signed image of the swapped application is embedded directly into the main application binary at build time.

Note

Image signing, encryption, and anti-rollback enforcement are controlled by TF-M configuration options. This sample uses default development keys provided by TF-M. For production use, replace these with your own keys and verify that the configuration is appropriate for your security requirements.

Building and Running

This sample requires sysbuild and runs on platforms with TF-M support.

# From the root of the zephyr repository
west build -b mps2/an521/cpu0/ns samples/tfm_integration/tfm_fwu

Sample Output

TF-M FWU on mps2
Installing new firmware for component 1
Starting FWU
Writing 17286 bytes
Finishing FWU
Installing FWU
FWU installed, reboot required
Rebooting to apply the new firmware...

After reboot, the swapped application prints:

Swapped application booted on mps2
FWU completed successfully