TF-M logging

TF-M employs two UART interfaces for logging: one for the Secure Processing Environment (including MCUboot and TF-M), and one for the Non-Secure Processing Environment (including user application).

By default, the logs from Nordic Semiconductor’s Development Kits (DKs) arrive on different serial ports on the host PC.

Note

Serial ports are referred to as COM ports on Windows, /dev/ttyACM devices on Linux, and /dev/tty devices on macOS. To list Nordic Semiconductor devices connected to your computer together with their serial ports, open a terminal and run the nrfutil device list command. Alternatively, check your operating system’s device manager or its equivalent.

The UART instances can vary by device family:

  • nRF5340 and nRF91 Series: The application typically uses the UART instance 0 (uart0), and TF-M uses the UART instance 1 (uart1) by default.

  • nRF54L Series devices that support TF-M: The application typically uses the UART instance 20 (uart20), and TF-M uses the UART instance 30 (uart30) by default.

For more information about the logging in the nRF Connect SDK, see Logging in nRF Connect SDK.

Configuring logging to the same UART as the application

Note

This option is not available to nRF54L Series devices.

For nRF5340 and nRF91 Series devices, you can configure TF-M to connect to the same UART as the application. Setting the appropriate Kconfig option makes TF-M logs automatically visible on the application’s UART.

To configure TF-M to connect to the same UART as the application, you can use the CONFIG_TFM_SECURE_UART Kconfig options, for example CONFIG_TFM_SECURE_UART0 for the example above.

When building TF-M with logging enabled, UART instance used by TF-M must be disabled in the non-secure application, otherwise the non-secure application will fail to run. The recommended way to do this is by setting it in an .overlay file. For example, assuming TF-M uses the uart1 instance and CONFIG_TFM_SECURE_UART0 is set, you can disable TF-M’s UART instance in the devicetree overlay file like this:

&uart1 {
             status = "disabled";
};

See Set devicetree overlays in the Zephyr documentation for more information about configuring devicetree overlays and Providing CMake options in the nRF Connect SDK documentation for how to provide overlay files to the build system.

Note

When TF-M and the user application use the same UART, TF-M disables logging after it has booted and re-enables it again only to log a fatal error.

Disabling logging

To disable logging, enable the CONFIG_TFM_LOG_LEVEL_SILENCE option.

Logging on nRF5340 DK devices

For nRF5340 DK devices, see Log output from TF-M on nRF5340 DK.