[nrf noup] boot: zephyr: Protect only the bootloader

When using fprotect_area(), only protect the areas assigned
to bootloader. Don't assume there is nothing between
bootloader and primary slot.

This allows placing TF-M storage between bootloader and
MCUboot primary slot.

Signed-off-by: Seppo Takalo <[email protected]>

Author: SeppoTakalo

boot/zephyr/main.c

@@ -635,15 +635,19 @@ int main(void)
 
 #ifdef PM_S1_ADDRESS
 /* MCUBoot is stored in either S0 or S1, protect both */
-#define PROTECT_SIZE (PM_MCUBOOT_PRIMARY_ADDRESS - PM_S0_ADDRESS)
-#define PROTECT_ADDR PM_S0_ADDRESS
+#define PROTECT_START PM_S0_ADDRESS
+#define PROTECT_END PM_S1_END_ADDRESS
 #else
 /* There is only one instance of MCUBoot */
-#define PROTECT_SIZE (PM_MCUBOOT_PRIMARY_ADDRESS - PM_MCUBOOT_ADDRESS)
-#define PROTECT_ADDR PM_MCUBOOT_ADDRESS
+#define PROTECT_START PM_MCUBOOT_ADDRESS
+#define PROTECT_END PM_MCUBOOT_END_ADDRESS
 #endif
 
-    rc = fprotect_area(PROTECT_ADDR, PROTECT_SIZE);
+    uint32_t start = ALIGN_DOWN(PROTECT_START, CONFIG_FPROTECT_BLOCK_SIZE);
+    uint32_t end = ALIGN_UP(PROTECT_END, CONFIG_FPROTECT_BLOCK_SIZE);
+    uint32_t size = end - start;
+
+    rc = fprotect_area(start, size);
 
     if (rc != 0) {
         BOOT_LOG_ERR("Protect mcuboot flash failed, cancel startup.");