tfm: Change TFM_BL2 config from a choice to a bool

The choice allowed for using TFM's own default. We now need full
knowledge over whether BL2 is enabled or not (e.g. to do signing),
so remove this option and simplify to a bool.

Signed-off-by: Øyvind Rønningstad <[email protected]>

Author: oyvindronningstad

boards/arm/lpcxpresso55s28/lpcxpresso55s28_ns_defconfig

@@ -23,6 +23,6 @@ CONFIG_ARM_MPU=n
 CONFIG_TRUSTED_EXECUTION_NONSECURE=y
 CONFIG_RUNTIME_NMI=y
 # TFM will run without MCUboot
-CONFIG_TFM_BL2_FALSE=y
+CONFIG_TFM_BL2=n
 
 CONFIG_BUILD_OUTPUT_HEX=y

boards/arm/lpcxpresso55s69/CMakeLists.txt

@@ -21,7 +21,7 @@ if (CONFIG_BUILD_WITH_TFM)
 		set(TFM_IMAGE_VERSION_NS 0.0.0+0)
 	endif()
 
-	if (NOT CONFIG_TFM_BL2_FALSE)
+	if (CONFIG_TFM_BL2)
 		set(PREPROCESSED_FILE_S "${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/CMakeFiles/signing_layout_s.dir/signing_layout_s.o")
 		set(PREPROCESSED_FILE_NS "${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/CMakeFiles/signing_layout_ns.dir/signing_layout_ns.o")
 		set(TFM_MCUBOOT_DIR "${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}/trusted-firmware-m/bl2/ext/mcuboot")
@@ -37,7 +37,7 @@ if (CONFIG_BUILD_WITH_TFM)
 		message(FATAL_ERROR "'srec_cat' not found. Please install it, or add it to $PATH.")
 	endif()
 
-	if (CONFIG_TFM_BL2_FALSE)
+	if (NOT CONFIG_TFM_BL2)
 		#merge tfm_s and zephyr_ns to a single image
 		#offset needs to be the same value as flash_layout.h in TFM
 		set_property(GLOBAL APPEND PROPERTY extra_post_build_commands

boards/arm/lpcxpresso55s69/Kconfig.defconfig

@@ -57,11 +57,11 @@ config FLASH_LOAD_SIZE
 if TRUSTED_EXECUTION_NONSECURE || BOARD_LPCXPRESSO55S69_CPU1
 
 config FLASH_LOAD_OFFSET
-	default 0x40000 if TFM_BL2_FALSE
+	default 0x40000 if !TFM_BL2
 	default $(dt_chosen_reg_addr_hex,$(DT_CHOSEN_Z_CODE_PARTITION))
 
 config FLASH_LOAD_SIZE
-	default 0x40000 if TFM_BL2_FALSE
+	default 0x40000 if !TFM_BL2
 	default $(dt_chosen_reg_size_hex,$(DT_CHOSEN_Z_CODE_PARTITION))
 
 endif # TRUSTED_EXECUTION_NONSECURE || BOARD_LPCXPRESSO55S69_CPU1

boards/arm/nrf5340dk_nrf5340/CMakeLists.txt

@@ -17,7 +17,7 @@ if (CONFIG_BUILD_WITH_TFM)
 		set(TFM_IMAGE_VERSION_NS 0.0.0+0)
 	endif()
 
-	if (NOT CONFIG_TFM_BL2_FALSE)
+	if (CONFIG_TFM_BL2)
 		set(PREPROCESSED_FILE_S "${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/CMakeFiles/signing_layout_s.dir/signing_layout_s.o")
 		set(PREPROCESSED_FILE_NS "${CMAKE_BINARY_DIR}/tfm/bl2/ext/mcuboot/CMakeFiles/signing_layout_ns.dir/signing_layout_ns.o")
 		set(TFM_MCUBOOT_DIR "${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}/trusted-firmware-m/bl2/ext/mcuboot")
@@ -39,7 +39,7 @@ if (CONFIG_BUILD_WITH_TFM)
 	    message(FATAL_ERROR "'srec_cat' not found. Please install it, or add it to $PATH.")
 	endif()
 
-	if (CONFIG_TFM_BL2_FALSE)
+	if (NOT CONFIG_TFM_BL2)
 		# Merge tfm_s and zephyr (NS) image to a single binary.
 		set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
 			COMMAND ${SREC_CAT}

modules/trusted-firmware-m/CMakeLists.txt

@@ -39,12 +39,12 @@ set(TFM_VALID_PARTITIONS
 #                        IPC
 #                        ISOLATION_LEVEL 2
 #                        REGRESSION
-#                        BL2 True
+#                        BL2
 #                        BUILD_PROFILE profile_small
 #                        ENABLED_PARTITIONS TFM_PARTITION_PLATFORM TFM_PARTITION_CRYPTO)
 function(trusted_firmware_build)
-  set(options IPC REGRESSION)
-  set(oneValueArgs BINARY_DIR BOARD BL2 ISOLATION_LEVEL CMAKE_BUILD_TYPE BUILD_PROFILE
+  set(options IPC REGRESSION BL2)
+  set(oneValueArgs BINARY_DIR BOARD ISOLATION_LEVEL CMAKE_BUILD_TYPE BUILD_PROFILE
     MCUBOOT_IMAGE_NUMBER)
   set(multiValueArgs ENABLED_PARTITIONS)
   cmake_parse_arguments(TFM "${options}" "${oneValueArgs}" "${multiValueArgs}" ${ARGN})
@@ -59,11 +59,6 @@ function(trusted_firmware_build)
     list(APPEND TFM_PARTITIONS_ARGS -D${partition}=${val})
   endforeach()
 
-  if(NOT DEFINED TFM_BL2)
-    set(TFM_BL2 True)
-  endif()
-  set(TFM_BL2_ARG "-DBL2=${TFM_BL2}")
-
   if(TFM_IPC)
     set(TFM_IPC_ARG -DTFM_PSA_API=ON)
     # PSA API awareness for the Non-Secure application
@@ -148,7 +143,7 @@ function(trusted_firmware_build)
                -DTFM_PLATFORM=${TFM_BOARD}
                -DCROSS_COMPILE=${TFM_TOOLCHAIN_PATH}/${TFM_TOOLCHAIN_PREFIX}
                ${TFM_CMAKE_BUILD_TYPE_ARG}
-               ${TFM_BL2_ARG}
+               -DBL2=${TFM_BL2}
                ${TFM_IPC_ARG}
                ${TFM_ISOLATION_LEVEL_ARG}
                ${TFM_REGRESSION_ARG}
@@ -217,10 +212,8 @@ if (CONFIG_BUILD_WITH_TFM)
   if (CONFIG_TFM_REGRESSION)
     set(TFM_REGRESSION_ARG REGRESSION)
   endif()
-  if (CONFIG_TFM_BL2_TRUE)
-    set(TFM_BL2_ARG BL2 True)
-  elseif (CONFIG_TFM_BL2_FALSE)
-    set(TFM_BL2_ARG BL2 False)
+  if (CONFIG_TFM_BL2)
+    set(TFM_BL2_ARG BL2)
   endif()
   if (CONFIG_TFM_ISOLATION_LEVEL)
     set(TFM_ISOLATION_LEVEL_ARG ISOLATION_LEVEL ${CONFIG_TFM_ISOLATION_LEVEL})

modules/trusted-firmware-m/Kconfig

@@ -98,23 +98,12 @@ config TFM_ISOLATION_LEVEL
 	  Manually set the required TFM isolation level. Possible values are
 	  1,2 or 3; the default is set by build configuration.
 
-choice TFM_BL2
-	prompt "BL2 configuration, should TFM build with MCUboot support"
-	default TFM_BL2_CONFIG_FILE_DEFAULT
-
-config TFM_BL2_CONFIG_FILE_DEFAULT
-	bool "Use TFM BL2 setting from TFM configuration file"
+config TFM_BL2
+	bool "Add MCUboot to TFM"
+	default y
 	help
-	  This option does not set -DBL2 in TFM, which means the TF-M platform's
-	  default is used. Currently all TF-M platforms have BL2=ON as default.
-
-config TFM_BL2_TRUE
-	bool "TFM BL2 enabled"
-
-config TFM_BL2_FALSE
-	bool "TFM BL2 disabled"
-
-endchoice
+	  TFM is designed to run with MCUboot in a certain configuration.
+	  This config adds MCUboot to the build - built via TFM's build system.
 
 config TFM_MCUBOOT_IMAGE_NUMBER
 	int "Granularity of FW updates of TFM and app"
@@ -205,7 +194,7 @@ config TFM_REGRESSION
 	  the Secure and the Non-Secure regression tests.
 
 
-if !TFM_BL2_FALSE
+if TFM_BL2
 
 config ROM_START_OFFSET
 	hex "ROM Start Offset accounting for BL2 Header in the NS image"
@@ -215,6 +204,6 @@ config ROM_START_OFFSET
 	  needs to be updated if TF-M switches to use a different header
 	  size for BL2.
 
-endif # !TFM_BL2_FALSE
+endif # !TFM_BL2
 
 endif # BUILD_WITH_TFM