Skip to content

Commit c51505f

Browse files
joerchancarlescufi
joerchan
authored and
carlescufi
committed
modules: tfm: Exclude non-secure TF-M application from build
Exclude the non-secure TF-M application from being built by TF-M. This also stops the building of the tfm_ns_api library that we were linking against. This library is defined by the tf-m regression tests. Add the installed interface source files exported by the TF-M build system compile them in the zephyr build system. Signed-off-by: Joakim Andersson <[email protected]>
1 parent a703cbe commit c51505f

File tree

5 files changed

+102
-12
lines changed

5 files changed

+102
-12
lines changed

‎modules/trusted-firmware-m/CMakeLists.txt‎

Lines changed: 67 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@ if (CONFIG_BUILD_WITH_TFM)
4949
else()
5050
list(APPEND TFM_CMAKE_ARGS -DBL2=FALSE)
5151
endif()
52+
if (CONFIG_TFM_BUILD_NS)
53+
list(APPEND TFM_CMAKE_ARGS -DNS=TRUE)
54+
else()
55+
list(APPEND TFM_CMAKE_ARGS -DNS=FALSE)
56+
endif()
5257
if (CONFIG_TFM_ISOLATION_LEVEL)
5358
list(APPEND TFM_CMAKE_ARGS -DTFM_ISOLATION_LEVEL=${CONFIG_TFM_ISOLATION_LEVEL})
5459
endif()
@@ -148,8 +153,9 @@ if (CONFIG_BUILD_WITH_TFM)
148153

149154
set(VENEERS_FILE ${TFM_BINARY_DIR}/secure_fw/s_veneers.o)
150155
set(TFM_API_NS_PATH ${TFM_BINARY_DIR}/tf-m-tests/app/libtfm_api_ns.a)
151-
set(TFM_GENERATED_INCLUDES ${TFM_BINARY_DIR}/generated/interface/include)
152156
set(PLATFORM_NS_FILE ${TFM_BINARY_DIR}/platform/libplatform_ns.a)
157+
set(TFM_GENERATED_INCLUDES ${TFM_BINARY_DIR}/generated/interface/include)
158+
set(TFM_INTERFACE_SOURCE_DIR ${TFM_BINARY_DIR}/install/interface/src)
153159

154160
if (TFM_PSA_TEST_SUITE)
155161
set(PSA_TEST_VAL_FILE ${TFM_BINARY_DIR}/tf-m-tests/app/psa_api_tests/val/val_nspe.a)
@@ -195,6 +201,25 @@ if (CONFIG_BUILD_WITH_TFM)
195201
${TFM_S_SIGNED_BIN_FILE}
196202
${TFM_NS_SIGNED_BIN_FILE}
197203
${TFM_S_NS_SIGNED_BIN_FILE}
204+
205+
${TFM_INTERFACE_SOURCE_DIR}/tfm_platform_ipc_api.c
206+
${TFM_INTERFACE_SOURCE_DIR}/tfm_ps_ipc_api.c
207+
${TFM_INTERFACE_SOURCE_DIR}/tfm_its_ipc_api.c
208+
${TFM_INTERFACE_SOURCE_DIR}/tfm_crypto_ipc_api.c
209+
${TFM_INTERFACE_SOURCE_DIR}/tfm_initial_attestation_ipc_api.c
210+
${TFM_INTERFACE_SOURCE_DIR}/tfm_firmware_update_ipc_api.c
211+
212+
${TFM_INTERFACE_SOURCE_DIR}/tfm_psa_ns_api.c
213+
214+
${TFM_INTERFACE_SOURCE_DIR}/tfm_platform_func_api.c
215+
${TFM_INTERFACE_SOURCE_DIR}/tfm_ps_func_api.c
216+
${TFM_INTERFACE_SOURCE_DIR}/tfm_its_func_api.c
217+
${TFM_INTERFACE_SOURCE_DIR}/tfm_crypto_func_api.c
218+
${TFM_INTERFACE_SOURCE_DIR}/tfm_initial_attestation_func_api.c
219+
${TFM_INTERFACE_SOURCE_DIR}/tfm_firmware_update_func_api.c
220+
221+
# Specific to nordic_nrf platform
222+
${TFM_INTERFACE_SOURCE_DIR}/tfm_ioctl_core_ns_api.c
198223
)
199224

200225
# Get the toolchain variant
@@ -331,12 +356,51 @@ if (CONFIG_BUILD_WITH_TFM)
331356
src/zephyr_tfm_log.c
332357
interface/interface.c
333358
)
359+
334360
# Non-Secure interface to request system reboot
335361
if (CONFIG_TFM_PARTITION_PLATFORM AND NOT CONFIG_TFM_PARTITION_PLATFORM_CUSTOM_REBOOT)
336362
zephyr_library_sources(src/reboot.c)
337363
endif()
338364
zephyr_library_sources_ifndef(CONFIG_TFM_PSA_TEST_NONE src/zephyr_tfm_psa_test.c)
339365

366+
if (TFM_PSA_TEST_SUITE)
367+
zephyr_library_link_libraries(
368+
${PSA_TEST_VAL_FILE}
369+
${PSA_TEST_PAL_FILE}
370+
${PSA_TEST_COMBINE_FILE}
371+
)
372+
endif()
373+
374+
if(NOT CONFIG_TFM_BUILD_NS)
375+
if(CONFIG_TFM_IPC)
376+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_PLATFORM ${TFM_INTERFACE_SOURCE_DIR}/tfm_platform_ipc_api.c)
377+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_PROTECTED_STORAGE ${TFM_INTERFACE_SOURCE_DIR}/tfm_ps_ipc_api.c)
378+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE ${TFM_INTERFACE_SOURCE_DIR}/tfm_its_ipc_api.c)
379+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_CRYPTO ${TFM_INTERFACE_SOURCE_DIR}/tfm_crypto_ipc_api.c)
380+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_INITIAL_ATTESTATION ${TFM_INTERFACE_SOURCE_DIR}/tfm_initial_attestation_ipc_api.c)
381+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_FIRMWARE_UPDATE ${TFM_INTERFACE_SOURCE_DIR}/tfm_firmware_update_ipc_api.c)
382+
383+
zephyr_library_sources(${TFM_INTERFACE_SOURCE_DIR}/tfm_psa_ns_api.c)
384+
else()
385+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_PLATFORM ${TFM_INTERFACE_SOURCE_DIR}/tfm_platform_func_api.c)
386+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_PROTECTED_STORAGE ${TFM_INTERFACE_SOURCE_DIR}/tfm_ps_func_api.c)
387+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE ${TFM_INTERFACE_SOURCE_DIR}/tfm_its_func_api.c)
388+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_CRYPTO ${TFM_INTERFACE_SOURCE_DIR}/tfm_crypto_func_api.c)
389+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_INITIAL_ATTESTATION ${TFM_INTERFACE_SOURCE_DIR}/tfm_initial_attestation_func_api.c)
390+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_FIRMWARE_UPDATE ${TFM_INTERFACE_SOURCE_DIR}/tfm_firmware_update_func_api.c)
391+
endif()
392+
393+
if(CONFIG_SOC_FAMILY_NRF)
394+
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_PLATFORM ${TFM_INTERFACE_SOURCE_DIR}/tfm_ioctl_core_ns_api.c)
395+
endif()
396+
397+
else()
398+
zephyr_library_link_libraries(
399+
${TFM_API_NS_PATH}
400+
${PLATFORM_NS_FILE}
401+
)
402+
endif()
403+
340404
zephyr_include_directories(
341405
${TFM_GENERATED_INCLUDES}
342406
)
@@ -346,11 +410,6 @@ if (CONFIG_BUILD_WITH_TFM)
346410
)
347411

348412
zephyr_library_link_libraries(
349-
${PSA_TEST_VAL_FILE}
350-
${PSA_TEST_PAL_FILE}
351-
${PSA_TEST_COMBINE_FILE}
352-
${PLATFORM_NS_FILE}
353-
${TFM_API_NS_PATH}
354413
${VENEERS_FILE}
355414
)
356415

@@ -408,7 +467,7 @@ if (CONFIG_BUILD_WITH_TFM)
408467
set(NS_SIGNED_FILE ${CMAKE_BINARY_DIR}/zephyr_ns_signed.hex)
409468
set(S_SIGNED_FILE ${CMAKE_BINARY_DIR}/tfm_s_signed.hex)
410469

411-
if (CONFIG_TFM_REGRESSION_NS)
470+
if (CONFIG_TFM_USE_NS_APP)
412471
# Use the TF-M NS binary as the Non-Secure application firmware image
413472
set(NS_APP_FILE $<TARGET_PROPERTY:tfm,TFM_NS_HEX_FILE>)
414473
else()
@@ -453,7 +512,7 @@ if (CONFIG_BUILD_WITH_TFM)
453512
)
454513

455514
else()
456-
if (CONFIG_TFM_REGRESSION_NS)
515+
if (CONFIG_TFM_USE_NS_APP)
457516
tfm_sign(sign_cmd_ns NS TRUE ${NS_APP_FILE} ${NS_SIGNED_FILE})
458517
else()
459518
tfm_sign(sign_cmd_ns NS FALSE ${NS_APP_FILE} ${NS_SIGNED_FILE})

‎modules/trusted-firmware-m/Kconfig.tfm‎

Lines changed: 31 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,31 @@ config TFM_BL2
206206
TFM is designed to run with MCUboot in a certain configuration.
207207
This config adds MCUboot to the build - built via TFM's build system.
208208

209+
config TFM_BUILD_NS
210+
bool "Build the TF-M Non-Secure application and libraries"
211+
help
212+
Instruct the TF-M build system to build the TF-M Non-Secure
213+
application and libraries.
214+
215+
This option is intended for testing purposes only, since this is the
216+
easiest way to build the TF-M regression tests application and test
217+
support libraries in the zephyr build system.
218+
219+
config TFM_USE_NS_APP
220+
bool "Use the TF-M Non-Secure application"
221+
depends on TFM_BUILD_NS
222+
help
223+
The TF-M build system can produce multiple executable files.
224+
The main one is the TF-M secure firmware. Optionally the TF-M
225+
non-secure application can be built.
226+
Usually the TF-M non-secure application is not used since the
227+
zephyr application is the non-secure application.
228+
With this option enabled this is reversed and the TF-M non-secure
229+
application is used instead of the Zephyr non-secure application.
230+
231+
This option is intended for testing purposes only, since this is the
232+
easiest way to integrate and run the TF-M regression tests in the
233+
zephyr build system.
209234
if TFM_BL2
210235

211236
config TFM_MCUBOOT_IMAGE_NUMBER
@@ -265,12 +290,15 @@ config TFM_REGRESSION_S
265290
help
266291
When enabled, this option signifies that the TF-M build includes
267292
the Secure domain regression tests.
293+
The regression tests will be included in the TF-M secure firmware.
268294

269295
config TFM_REGRESSION_NS
270-
bool "Use the TF-M Non-Secure Regression test application"
296+
bool "TF-M Non-Secure Regression tests"
271297
help
272-
When this is enabled, the Zephyr application as a whole will be
273-
replaced with the TF-M Non-Secure Regression test application.
298+
When enabled, this option signifies that the TF-M build includes
299+
the Non-Secure domain regression tests.
300+
The regression tests will be included in the TF-M non-secure
301+
application.
274302

275303
choice TFM_PSA_TEST
276304
prompt "Enable a PSA test suite"

‎samples/tfm_integration/tfm_psa_test/prj.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
#
66

77
CONFIG_BUILD_WITH_TFM=y
8+
CONFIG_TFM_BUILD_NS=y
89
CONFIG_TFM_PROFILE_TYPE_NOT_SET=y
910
CONFIG_QEMU_ICOUNT_SHIFT=1
1011

‎samples/tfm_integration/tfm_regression_test/prj.conf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66

77
CONFIG_BUILD_WITH_TFM=y
88
CONFIG_TFM_PROFILE_TYPE_NOT_SET=y
9+
CONFIG_TFM_BUILD_NS=y
10+
CONFIG_TFM_USE_NS_APP=y
911
CONFIG_TFM_REGRESSION_S=y
1012
CONFIG_TFM_REGRESSION_NS=y
1113

‎west.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,7 @@ manifest:
225225
groups:
226226
- debug
227227
- name: trusted-firmware-m
228-
revision: 7c53a6e76130a85303f83b15d868a92fdcd5f5be
228+
revision: f13209f1883232cbcb9f0c31fb4c63e7c242df0d
229229
path: modules/tee/tf-m/trusted-firmware-m
230230
groups:
231231
- tee

0 commit comments

Comments
 (0)