build: Speech recognition application with split-build

Signed-off-by: Gergely Kovacs <[email protected]>

Author: gergkv

applications/speech_recognition/CMakeLists.txt

@@ -4,6 +4,8 @@
 
 cmake_minimum_required(VERSION 3.21.0 FATAL_ERROR)
 
+# NS target name the TF-M api_ns CMakeLists.txt uses
+set(NS_TARGET_NAME speech-recognition)
 set(ML_INFERENCE_ENGINE     "ETHOS" CACHE STRING "Machine Learning inference engine (ETHOS)")
 set(AUDIO_SOURCE            "ROM"   CACHE STRING "Source of audio data (ROM | VSI)")
 set(APPLICATION_PATH        "${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/applications/speech_recognition" CACHE STRING "Path to the application folder")
@@ -22,10 +24,7 @@ set(AWS_OTA_SIGNATURE_TYPE  "RSA-3072" CACHE STRING "Supported algorithms for si
 # Because of this, if only PATCH version is changed then the OTA will be rejected
 # due to same firmware version.
 # We will therefore change the build version from TF-M.
-set(MCUBOOT_IMAGE_VERSION_NS "0.0.1+10")
 set(MCUBOOT_IMAGE_VERSION_NS_UPDATE "0.0.1+20")
-set(MCUBOOT_IMAGE_NUMBER 2 CACHE STRING "Total number of firmware images")
-set(DEFAULT_MCUBOOT_FLASH_MAP ON)
 
 if (${ML_INFERENCE_ENGINE} STREQUAL "ETHOS")
     set(ETHOS_U_NPU_ENABLED ON)
@@ -36,31 +35,14 @@ endif()
 set(ML_USE_CASE "asr")
 set(ML_MODEL "GenerateASRModel")
 set(ML_USE_CASE_RESOURCES_FILE "${CMAKE_CURRENT_LIST_DIR}/resources/use_case_resources.json")
-set(TFM_PLATFORM_UPGRADE_STRATEGY "SWAP_USING_SCRATCH")
-set(TFM_PLATFORM_CONFIRM_IMAGE ON)
-
-# Trusted Firmware-M setup
-set(TFM_CMAKE_APP_ARGS
-    -DPROJECT_CONFIG_HEADER_FILE=${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/applications/speech_recognition/configs/tfm_config/project_config.h
-    -DMCUBOOT_CONFIRM_IMAGE=${TFM_PLATFORM_CONFIRM_IMAGE}
-    -DMCUBOOT_UPGRADE_STRATEGY=${TFM_PLATFORM_UPGRADE_STRATEGY}
-    -DMCUBOOT_IMAGE_VERSION_NS=${MCUBOOT_IMAGE_VERSION_NS}
-    -DCONFIG_TFM_HALT_ON_CORE_PANIC=ON
-    -DMCUBOOT_DATA_SHARING=ON
-    -DPLATFORM_HAS_FIRMWARE_UPDATE_SUPPORT=ON
-    -DTFM_PARTITION_FIRMWARE_UPDATE=ON
-    -DTFM_PARTITION_LOG_LEVEL=TFM_PARTITION_LOG_LEVEL_INFO
-)
 
-project(speech-recognition LANGUAGES C CXX)
+# Toolchain file has to be included before the very first project() call
+include(${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/components/security/trusted_firmware-m/integration/cmake/TfmNsToolchain.cmake)
 
-# Set global optimization level to reduce code size while keeping the debug experience.
-if(${CMAKE_C_COMPILER_ID} STREQUAL "GNU")
-    add_compile_options(-Og)
-elseif(${CMAKE_C_COMPILER_ID} STREQUAL "ARMClang")
-    add_compile_options(-O1)
-endif()
+project(speech-recognition LANGUAGES C CXX)
 
+set_compiler_and_linker_flags()
+include(${CONFIG_SPE_PATH}/config/cp_check.cmake)
 
 add_subdirectory(${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR} ${CMAKE_BINARY_DIR}/iot_reference_arm_corstone3xx)
 
@@ -85,6 +67,7 @@ add_executable(speech-recognition
     main.c
     ml_interface.cc
     model_config.cc
+    ${CONFIG_SPE_PATH}/interface/src/os_wrapper/tfm_ns_interface_rtos.c
 )
 
 target_include_directories(speech-recognition
@@ -136,10 +119,6 @@ target_compile_options(speech-recognition
         $<$<COMPILE_LANGUAGE:C>:-std=c99>
 )
 
-# Trusted Firmware-M must be built before the application, because
-# the application depends on the NS interface and the BL2 signing scripts,
-# both of which are generated as parts of the Trusted Firmware-M build process.
-add_dependencies(speech-recognition trusted_firmware-m-build)
 # The provision data must be built before the application because
 # it provides credentials to connect to AWS.
 add_dependencies(speech-recognition provisioning_data_bin)
@@ -159,37 +138,41 @@ target_link_libraries(speech-recognition
         ota-update
         provisioning-lib
         speexdsp
-        tfm-ns-interface
+        tfm_api_ns
         toolchain-override
         asr_api
         asr_model
         helpers-logging
+        # FRI always uses TrustZone
+        tfm_api_ns_tz
 )
 
 include(${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/bsp/cmake/SetLinkerOptions.cmake)
 set_linker_script(speech-recognition)
 
 list(APPEND CMAKE_MODULE_PATH ${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/tools/cmake)
 include(ConvertElfToBin)
-include(ExternalProject)
-ExternalProject_Get_Property(trusted_firmware-m-build BINARY_DIR)
 
 extract_sections_from_axf(
     speech-recognition
     SECTIONS_NAMES   "ddr.bin"
     OUTPUT_BIN_NAME  "ns_image"
 )
 
-# The non-secure application image should be padded while being signed
-# Hence, passing "TRUE" as the input parameter to the pad option of sign function.
-iot_reference_arm_corstone3xx_tf_m_sign_image(
-    speech-recognition
-    "ns_image"
-    speech-recognition_signed
-    ${MCUBOOT_IMAGE_VERSION_NS}
-    "${BINARY_DIR}/api_ns/image_signing/layout_files/signing_layout_ns.o"
-    TRUE
+# Copy the binary flash content to the location expected by default signing
+# Signing is implemented in the exported TF-M NS CMakeLists.txt (in the
+# ${CONFIG_SPE_PATH} directory)
+add_custom_target(speech-recognition_bin
+    SOURCES ${CMAKE_BINARY_DIR}/speech-recognition.bin
+    DEPENDS speech-recognition
 )
+add_custom_command(OUTPUT ${CMAKE_BINARY_DIR}/speech-recognition.bin
+    DEPENDS speech-recognition
+    COMMAND ${CMAKE_COMMAND}
+        -E copy ${SECTORS_BIN_DIR}/ns_image.bin
+        ${CMAKE_BINARY_DIR}/speech-recognition.bin
+)
+
 
 # The update image is not padded to fill the whole slot (no --pad), because
 # 1) the image to download is smaller without padding
@@ -200,7 +183,7 @@ iot_reference_arm_corstone3xx_tf_m_sign_image(
     "ns_image"
     speech-recognition-update_signed
     ${MCUBOOT_IMAGE_VERSION_NS_UPDATE}
-    "${BINARY_DIR}/api_ns/image_signing/layout_files/signing_layout_ns.o"
+    "${CONFIG_SPE_PATH}/image_signing/layout_files/signing_layout_ns.o"
     FALSE
 )
 

applications/speech_recognition/TfmInitialCache.cmake

@@ -0,0 +1,20 @@
+# Copyright 2025 Arm Limited and/or its affiliates
+# <[email protected]>
+# SPDX-License-Identifier: MIT
+
+include(${ROOT}/cmake/TfmInitialCacheCommon.cmake)
+
+set(TFM_MBEDCRYPTO_CONFIG_CLIENT_PATH "${ROOT}/applications/speech_recognition/configs/mbedtls_config/aws_mbedtls_config.h" CACHE FILEPATH "TFM_MBEDCRYPTO_CONFIG_CLIENT_PATH" FORCE)
+
+set(PROJECT_CONFIG_HEADER_FILE ${ROOT}/applications/speech_recognition/configs/tfm_config/project_config.h CACHE FILEPATH "PROJECT_CONFIG_HEADER_FILE" FORCE)
+set(MCUBOOT_IMAGE_NUMBER 2 CACHE STRING "MCUBOOT_IMAGE_NUMBER" FORCE)
+set(DEFAULT_MCUBOOT_FLASH_MAP ON CACHE BOOL "DEFAULT_MCUBOOT_FLASH_MAP" FORCE)
+set(MCUBOOT_UPGRADE_STRATEGY "SWAP_USING_SCRATCH" CACHE STRING "MCUBOOT_UPGRADE_STRATEGY" FORCE)
+set(MCUBOOT_IMAGE_VERSION_NS  "0.0.1+10" CACHE STRING "MCUBOOT_IMAGE_VERSION_NS" FORCE)
+set(CONFIG_TFM_HALT_ON_CORE_PANIC ON CACHE BOOL "CONFIG_TFM_HALT_ON_CORE_PANIC" FORCE)
+set(MCUBOOT_DATA_SHARING ON CACHE BOOL "MCUBOOT_DATA_SHARING" FORCE)
+set(PLATFORM_HAS_FIRMWARE_UPDATE_SUPPORT ON CACHE BOOL "PLATFORM_HAS_FIRMWARE_UPDATE_SUPPORT" FORCE)
+set(TFM_PARTITION_FIRMWARE_UPDATE ON CACHE BOOL "TFM_PARTITION_FIRMWARE_UPDATE" FORCE)
+set(TFM_PARTITION_LOG_LEVEL TFM_PARTITION_LOG_LEVEL_INFO CACHE STRING "TFM_PARTITION_LOG_LEVEL" FORCE)
+set(CONFIG_TFM_ENABLE_MVE ON CACHE STRING "CONFIG_TFM_ENABLE_MVE" FORCE)
+set(CONFIG_TFM_ENABLE_MVE_FP ON CACHE STRING "CONFIG_TFM_ENABLE_MVE_FP" FORCE)

applications/speech_recognition/configs/freertos_config/CMakeLists.txt

@@ -1,4 +1,4 @@
-# Copyright 2023 Arm Limited and/or its affiliates
+# Copyright 2023-2025 Arm Limited and/or its affiliates
 # <[email protected]>
 # SPDX-License-Identifier: MIT
 
@@ -14,6 +14,6 @@ target_compile_definitions(freertos_config
 
 target_link_libraries(freertos_config
     INTERFACE
-        tfm-ns-interface
+        tfm_api_ns
         app-config
 )

applications/speech_recognition/configs/mbedtls_config/CMakeLists.txt

@@ -1,4 +1,4 @@
-# Copyright 2023 Arm Limited and/or its affiliates
+# Copyright 2023-2025 Arm Limited and/or its affiliates
 # <[email protected]>
 # SPDX-License-Identifier: MIT
 
@@ -7,11 +7,6 @@ target_include_directories(mbedtls-config
         .
 )
 
-target_compile_definitions(mbedtls-config
-    INTERFACE
-        MBEDTLS_CONFIG_FILE="aws_mbedtls_config.h"
-)
-
 target_link_libraries(mbedtls-config
     INTERFACE
         freertos_kernel

applications/speech_recognition/configs/mbedtls_config/aws_mbedtls_config.h

@@ -11,7 +11,7 @@
 /*
  *  Copyright The Mbed TLS Contributors
  *  SPDX-License-Identifier: Apache-2.0
- *  Copyright 2024 Arm Limited and/or its affiliates
+ *  Copyright 2024-2025 Arm Limited and/or its affiliates
  *  <[email protected]>
  *
  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
@@ -27,6 +27,11 @@
  *  limitations under the License.
  */
 
+#ifndef DOMAIN_NS
+    /* Set if this config file is currently used for TF-M secure clients */
+    #define PSA_CRYPTO_TFM_SECURE_CONFIG
+#endif /* DOMAIN_NS == 1 */
+
 /**
  * This is an optional version symbol that enables compatibility handling of
  * config files.
@@ -1158,7 +1163,7 @@ void mbedtls_platform_free( void * ptr );
  * \warning This interface is experimental and may change or be removed
  * without notice.
  */
-#ifdef PSA_CRYPTO_IMPLEMENTATION_TFM
+#if defined( PSA_CRYPTO_IMPLEMENTATION_TFM ) || defined( PSA_CRYPTO_TFM_SECURE_CONFIG )
     #define MBEDTLS_PSA_CRYPTO_CLIENT
 #endif
 
@@ -1758,7 +1763,9 @@ void mbedtls_platform_free( void * ptr );
  * This feature is still experimental and is not ready for production since
  * it is not completed.
  */
-/*#define MBEDTLS_PSA_CRYPTO_CONFIG */
+#ifdef PSA_CRYPTO_TFM_SECURE_CONFIG
+    #define MBEDTLS_PSA_CRYPTO_CONFIG
+#endif
 
 /**
  * \def MBEDTLS_VERSION_FEATURES