565 lines
21 KiB
CMake
565 lines
21 KiB
CMake
# Copyright (c) 2019 - 2023 Linaro
|
|
# Copyright (c) 2020 - 2023 Nordic Semiconductor ASA
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# List of all partitions supported by TF-M
|
|
# Name must match name in 'trusted-firmware-m/tools/tfm_manifest_list.yaml'
|
|
set(TFM_VALID_PARTITIONS
|
|
TFM_PARTITION_NS_AGENT_MAILBOX
|
|
TFM_PARTITION_PROTECTED_STORAGE
|
|
TFM_PARTITION_INTERNAL_TRUSTED_STORAGE
|
|
TFM_PARTITION_CRYPTO
|
|
TFM_PARTITION_PLATFORM
|
|
TFM_PARTITION_INITIAL_ATTESTATION
|
|
TFM_PARTITION_FIRMWARE_UPDATE
|
|
)
|
|
|
|
# List of all crypto modules that can be enabled/disabled
|
|
# Corresponds to the *_MODULE_DISABLED configs in 'trusted-firmware-m/secure_fw/partitions/crypto/Kconfig'
|
|
set(TFM_CRYPTO_MODULES
|
|
CRYPTO_RNG_MODULE
|
|
CRYPTO_KEY_MODULE
|
|
CRYPTO_AEAD_MODULE
|
|
CRYPTO_MAC_MODULE
|
|
CRYPTO_HASH_MODULE
|
|
CRYPTO_CIPHER_MODULE
|
|
CRYPTO_ASYM_SIGN_MODULE
|
|
CRYPTO_ASYM_ENCRYPT_MODULE
|
|
CRYPTO_KEY_DERIVATION_MODULE
|
|
)
|
|
|
|
|
|
if (CONFIG_BUILD_WITH_TFM)
|
|
# PSA API awareness for the Non-Secure application
|
|
target_compile_definitions(app PRIVATE "TFM_PSA_API")
|
|
if (CONFIG_TFM_SFN)
|
|
list(APPEND TFM_CMAKE_ARGS -DCONFIG_TFM_SPM_BACKEND="SFN")
|
|
else() # CONFIG_TFM_IPC
|
|
list(APPEND TFM_CMAKE_ARGS -DCONFIG_TFM_SPM_BACKEND="IPC")
|
|
endif()
|
|
if (CONFIG_TFM_REGRESSION_S)
|
|
list(APPEND TFM_CMAKE_ARGS -DTEST_S=ON)
|
|
endif()
|
|
if (CONFIG_TFM_REGRESSION_NS)
|
|
list(APPEND TFM_CMAKE_ARGS -DTEST_NS=ON)
|
|
endif()
|
|
if (CONFIG_TFM_BL2)
|
|
list(APPEND TFM_CMAKE_ARGS -DBL2=TRUE)
|
|
list(APPEND TFM_CMAKE_ARGS -DMCUBOOT_IMAGE_VERSION_S=${CONFIG_TFM_IMAGE_VERSION_S})
|
|
list(APPEND TFM_CMAKE_ARGS -DMCUBOOT_IMAGE_VERSION_NS=${CONFIG_TFM_IMAGE_VERSION_NS})
|
|
else()
|
|
list(APPEND TFM_CMAKE_ARGS -DBL2=FALSE)
|
|
endif()
|
|
if (CONFIG_TFM_BUILD_NS)
|
|
list(APPEND TFM_CMAKE_ARGS -DNS=TRUE)
|
|
else()
|
|
list(APPEND TFM_CMAKE_ARGS -DNS=FALSE)
|
|
endif()
|
|
if (CONFIG_TFM_ISOLATION_LEVEL)
|
|
list(APPEND TFM_CMAKE_ARGS -DTFM_ISOLATION_LEVEL=${CONFIG_TFM_ISOLATION_LEVEL})
|
|
endif()
|
|
if (CONFIG_TFM_ITS_NUM_ASSETS_OVERRIDE)
|
|
list(APPEND TFM_CMAKE_ARGS -DITS_NUM_ASSETS=${CONFIG_TFM_ITS_NUM_ASSETS})
|
|
endif()
|
|
if (CONFIG_TFM_ITS_MAX_ASSET_SIZE_OVERRIDE)
|
|
list(APPEND TFM_CMAKE_ARGS -DITS_MAX_ASSET_SIZE=${CONFIG_TFM_ITS_MAX_ASSET_SIZE})
|
|
endif()
|
|
if (CONFIG_TFM_PROFILE)
|
|
list(APPEND TFM_CMAKE_ARGS -DTFM_PROFILE=${CONFIG_TFM_PROFILE})
|
|
endif()
|
|
if (CONFIG_TFM_PSA_TEST_CRYPTO)
|
|
set(TFM_PSA_TEST_SUITE CRYPTO)
|
|
elseif (CONFIG_TFM_PSA_TEST_PROTECTED_STORAGE)
|
|
set(TFM_PSA_TEST_SUITE PROTECTED_STORAGE)
|
|
elseif (CONFIG_TFM_PSA_TEST_INTERNAL_TRUSTED_STORAGE)
|
|
set(TFM_PSA_TEST_SUITE INTERNAL_TRUSTED_STORAGE)
|
|
elseif (CONFIG_TFM_PSA_TEST_STORAGE)
|
|
set(TFM_PSA_TEST_SUITE STORAGE)
|
|
elseif (CONFIG_TFM_PSA_TEST_INITIAL_ATTESTATION)
|
|
set(TFM_PSA_TEST_SUITE INITIAL_ATTESTATION)
|
|
endif()
|
|
if (DEFINED TFM_PSA_TEST_SUITE)
|
|
list(APPEND TFM_CMAKE_ARGS -DTEST_PSA_API=${TFM_PSA_TEST_SUITE})
|
|
endif()
|
|
if (CONFIG_TFM_CMAKE_BUILD_TYPE_RELEASE)
|
|
set(TFM_CMAKE_BUILD_TYPE "Release")
|
|
elseif (CONFIG_TFM_CMAKE_BUILD_TYPE_MINSIZEREL)
|
|
set(TFM_CMAKE_BUILD_TYPE "MinSizeRel")
|
|
elseif (CONFIG_TFM_CMAKE_BUILD_TYPE_DEBUG)
|
|
set(TFM_CMAKE_BUILD_TYPE "Debug")
|
|
else ()
|
|
set(TFM_CMAKE_BUILD_TYPE "RelWithDebInfo")
|
|
endif()
|
|
if (DEFINED CONFIG_TFM_MCUBOOT_IMAGE_NUMBER)
|
|
list(APPEND TFM_CMAKE_ARGS -DMCUBOOT_IMAGE_NUMBER=${CONFIG_TFM_MCUBOOT_IMAGE_NUMBER})
|
|
endif()
|
|
|
|
if (CONFIG_TFM_EXCEPTION_INFO_DUMP)
|
|
list(APPEND TFM_CMAKE_ARGS -DTFM_EXCEPTION_INFO_DUMP=ON)
|
|
else()
|
|
list(APPEND TFM_CMAKE_ARGS -DTFM_EXCEPTION_INFO_DUMP=OFF)
|
|
endif()
|
|
|
|
if (CONFIG_TFM_PARTITION_LOG_LEVEL_DEBUG)
|
|
set(TFM_PARTITION_LOG_LEVEL "TFM_PARTITION_LOG_LEVEL_DEBUG")
|
|
elseif (CONFIG_TFM_PARTITION_LOG_LEVEL_INFO)
|
|
set(TFM_PARTITION_LOG_LEVEL "TFM_PARTITION_LOG_LEVEL_INFO")
|
|
elseif (CONFIG_TFM_PARTITION_LOG_LEVEL_ERROR)
|
|
set(TFM_PARTITION_LOG_LEVEL "TFM_PARTITION_LOG_LEVEL_ERROR")
|
|
elseif (CONFIG_TFM_PARTITION_LOG_LEVEL_SILENCE OR CONFIG_TFM_LOG_LEVEL_SILENCE)
|
|
set(TFM_PARTITION_LOG_LEVEL "TFM_PARTITION_LOG_LEVEL_SILENCE")
|
|
endif()
|
|
|
|
if (DEFINED TFM_PARTITION_LOG_LEVEL)
|
|
list(APPEND TFM_CMAKE_ARGS -DTFM_PARTITION_LOG_LEVEL=${TFM_PARTITION_LOG_LEVEL})
|
|
endif()
|
|
|
|
if (CONFIG_TFM_SPM_LOG_LEVEL_DEBUG)
|
|
set(TFM_SPM_LOG_LEVEL "TFM_SPM_LOG_LEVEL_DEBUG")
|
|
elseif (CONFIG_TFM_SPM_LOG_LEVEL_INFO)
|
|
set(TFM_SPM_LOG_LEVEL "TFM_SPM_LOG_LEVEL_INFO")
|
|
elseif (CONFIG_TFM_SPM_LOG_LEVEL_ERROR)
|
|
set(TFM_SPM_LOG_LEVEL "TFM_SPM_LOG_LEVEL_ERROR")
|
|
elseif (CONFIG_TFM_SPM_LOG_LEVEL_SILENCE OR CONFIG_TFM_LOG_LEVEL_SILENCE)
|
|
set(TFM_SPM_LOG_LEVEL "TFM_SPM_LOG_LEVEL_SILENCE")
|
|
endif()
|
|
|
|
if (DEFINED TFM_SPM_LOG_LEVEL)
|
|
list(APPEND TFM_CMAKE_ARGS -DTFM_SPM_LOG_LEVEL=${TFM_SPM_LOG_LEVEL})
|
|
endif()
|
|
|
|
# Enable TFM partitions as specified in Kconfig
|
|
foreach(partition ${TFM_VALID_PARTITIONS})
|
|
if (CONFIG_${partition})
|
|
# list(APPEND TFM_ENABLED_PARTITIONS_ARG ${partition})
|
|
set(val "ON")
|
|
else()
|
|
set(val "OFF")
|
|
endif()
|
|
list(APPEND TFM_CMAKE_ARGS -D${partition}=${val})
|
|
endforeach()
|
|
|
|
# Enable TFM crypto modules as specified in Kconfig
|
|
foreach(module ${TFM_CRYPTO_MODULES})
|
|
if (CONFIG_TFM_${module}_ENABLED)
|
|
# list(APPEND TFM_ENABLED_CRYPTO_MODULES_ARG ${module})
|
|
set(val "FALSE")
|
|
else()
|
|
set(val "TRUE")
|
|
endif()
|
|
list(APPEND TFM_CMAKE_ARGS -D${module}_DISABLED=${val})
|
|
endforeach()
|
|
|
|
set(TFM_BINARY_DIR ${CMAKE_BINARY_DIR}/tfm)
|
|
|
|
set(TFM_TEST_REPO_PATH ${ZEPHYR_CURRENT_MODULE_DIR}/../tf-m-tests)
|
|
set(PSA_ARCH_TESTS_PATH ${ZEPHYR_CURRENT_MODULE_DIR}/../psa-arch-tests)
|
|
|
|
set(VENEERS_FILE ${TFM_BINARY_DIR}/secure_fw/s_veneers.o)
|
|
set(TFM_API_NS_PATH ${TFM_BINARY_DIR}/tf-m-tests/app/libtfm_api_ns.a)
|
|
set(PLATFORM_NS_FILE ${TFM_BINARY_DIR}/platform/ns/libplatform_ns.a)
|
|
set(TFM_GENERATED_INCLUDES ${TFM_BINARY_DIR}/generated/interface/include)
|
|
set(TFM_INTERFACE_SOURCE_DIR ${TFM_BINARY_DIR}/install/interface/src)
|
|
|
|
if (TFM_PSA_TEST_SUITE)
|
|
set(PSA_TEST_VAL_FILE ${TFM_BINARY_DIR}/tf-m-tests/app/psa_api_tests/val/val_nspe.a)
|
|
set(PSA_TEST_PAL_FILE ${TFM_BINARY_DIR}/tf-m-tests/app/psa_api_tests/platform/pal_nspe.a)
|
|
set(COMBINE_DIR_STORAGE storage)
|
|
set(COMBINE_DIR_PROTECTED_STORAGE storage)
|
|
set(COMBINE_DIR_INTERNAL_TRUSTED_STORAGE storage)
|
|
set(COMBINE_DIR_CRYPTO crypto)
|
|
set(COMBINE_DIR_INITIAL_ATTESTATION initial_attestation)
|
|
set(PSA_TEST_COMBINE_FILE ${TFM_BINARY_DIR}/tf-m-tests/app/psa_api_tests/dev_apis/${COMBINE_DIR_${TFM_PSA_TEST_SUITE}}/test_combine.a)
|
|
endif()
|
|
|
|
if(CONFIG_TFM_BL2)
|
|
set(BL2_ELF_FILE ${TFM_BINARY_DIR}/bin/bl2.elf)
|
|
set(BL2_BIN_FILE ${TFM_BINARY_DIR}/bin/bl2.bin)
|
|
set(BL2_HEX_FILE ${TFM_BINARY_DIR}/bin/bl2.hex)
|
|
endif()
|
|
set(TFM_S_ELF_FILE ${TFM_BINARY_DIR}/bin/tfm_s.elf)
|
|
set(TFM_S_BIN_FILE ${TFM_BINARY_DIR}/bin/tfm_s.bin)
|
|
set(TFM_S_HEX_FILE ${TFM_BINARY_DIR}/bin/tfm_s.hex)
|
|
set(TFM_NS_BIN_FILE ${TFM_BINARY_DIR}/bin/tfm_ns.bin)
|
|
set(TFM_NS_HEX_FILE ${TFM_BINARY_DIR}/bin/tfm_ns.hex)
|
|
set(TFM_S_SIGNED_BIN_FILE ${TFM_BINARY_DIR}/bin/tfm_s_signed.bin)
|
|
set(TFM_NS_SIGNED_BIN_FILE ${TFM_BINARY_DIR}/bin/tfm_ns_signed.bin)
|
|
set(TFM_S_NS_SIGNED_BIN_FILE ${TFM_BINARY_DIR}/bin/tfm_s_ns_signed.bin)
|
|
|
|
set(BUILD_BYPRODUCTS
|
|
${VENEERS_FILE}
|
|
${TFM_API_NS_PATH}
|
|
${TFM_GENERATED_INCLUDES}/psa_manifest/sid.h
|
|
${PSA_TEST_VAL_FILE}
|
|
${PSA_TEST_PAL_FILE}
|
|
${PSA_TEST_COMBINE_FILE}
|
|
${PLATFORM_NS_FILE}
|
|
${BL2_ELF_FILE}
|
|
${BL2_BIN_FILE}
|
|
${BL2_HEX_FILE}
|
|
${TFM_S_ELF_FILE}
|
|
${TFM_S_BIN_FILE}
|
|
${TFM_S_HEX_FILE}
|
|
${TFM_NS_BIN_FILE}
|
|
${TFM_NS_HEX_FILE}
|
|
${TFM_S_SIGNED_BIN_FILE}
|
|
${TFM_NS_SIGNED_BIN_FILE}
|
|
${TFM_S_NS_SIGNED_BIN_FILE}
|
|
|
|
${TFM_INTERFACE_SOURCE_DIR}/tfm_attest_api.c
|
|
${TFM_INTERFACE_SOURCE_DIR}/tfm_crypto_api.c
|
|
${TFM_INTERFACE_SOURCE_DIR}/tfm_its_api.c
|
|
${TFM_INTERFACE_SOURCE_DIR}/tfm_platform_api.c
|
|
${TFM_INTERFACE_SOURCE_DIR}/tfm_ps_api.c
|
|
${TFM_INTERFACE_SOURCE_DIR}/tfm_psa_ns_api.c
|
|
${TFM_INTERFACE_SOURCE_DIR}/tfm_psa_ns_connection_api.c
|
|
|
|
# Specific to nordic_nrf platform
|
|
${TFM_INTERFACE_SOURCE_DIR}/tfm_ioctl_core_ns_api.c
|
|
)
|
|
|
|
# Get the toolchain variant
|
|
# TODO: Add support for cross-compile toolchain variant
|
|
# TODO: Enforce GCC version check against TF-M compiler requirements
|
|
if(${ZEPHYR_TOOLCHAIN_VARIANT} STREQUAL "zephyr")
|
|
set(TFM_TOOLCHAIN_FILE "toolchain_GNUARM.cmake")
|
|
set(TFM_TOOLCHAIN_PREFIX "arm-zephyr-eabi")
|
|
set(TFM_TOOLCHAIN_PATH ${ZEPHYR_SDK_INSTALL_DIR}/arm-zephyr-eabi/bin)
|
|
elseif(${ZEPHYR_TOOLCHAIN_VARIANT} STREQUAL "gnuarmemb")
|
|
set(TFM_TOOLCHAIN_FILE "toolchain_GNUARM.cmake")
|
|
set(TFM_TOOLCHAIN_PREFIX "arm-none-eabi")
|
|
set(TFM_TOOLCHAIN_PATH ${GNUARMEMB_TOOLCHAIN_PATH}/bin)
|
|
elseif(${ZEPHYR_TOOLCHAIN_VARIANT} STREQUAL "xtools")
|
|
set(TFM_TOOLCHAIN_FILE "toolchain_GNUARM.cmake")
|
|
set(TFM_TOOLCHAIN_PREFIX "arm-zephyr-eabi")
|
|
set(TFM_TOOLCHAIN_PATH ${XTOOLS_TOOLCHAIN_PATH}/arm-zephyr-eabi/bin)
|
|
else()
|
|
message(FATAL_ERROR "Unsupported ZEPHYR_TOOLCHAIN_VARIANT: ${ZEPHYR_TOOLCHAIN_VARIANT}")
|
|
endif()
|
|
|
|
if (CONFIG_TFM_PARTITION_INITIAL_ATTESTATION AND CONFIG_TFM_QCBOR_PATH STREQUAL "")
|
|
# TODO: Remove this when QCBOR licensing issues w/t_cose have been resolved,
|
|
# or only allow it when 'QCBOR_PATH' is set to a local path where QCBOR has
|
|
# been manually downloaded by the user before starting the build.
|
|
message(FATAL_ERROR "CONFIG_TFM_PARTITION_INITIAL_ATTESTATION is not available "
|
|
"with TF-M 1.7.0 due to licensing issues with a dependent library. This "
|
|
"restriction will be removed once licensing issues have been resolved."
|
|
)
|
|
endif()
|
|
|
|
if (CONFIG_TFM_PSA_TEST_INITIAL_ATTESTATION AND CONFIG_TFM_QCBOR_PATH STREQUAL "")
|
|
# TODO: Remove this when QCBOR licensing issues w/t_cose have been resolved,
|
|
# or only allow it when 'QCBOR_PATH' is set to a local path where QCBOR has
|
|
# been manually downloaded by the user before starting the build.
|
|
message(FATAL_ERROR "CONFIG_TFM_PSA_TEST_INITIAL_ATTESTATION is not available "
|
|
"with TF-M 1.7.0 due to licensing issues with a dependent library. This "
|
|
"restriction will be removed once licensing issues have been resolved."
|
|
)
|
|
endif()
|
|
|
|
if (CONFIG_TFM_QCBOR_PATH STREQUAL "DOWNLOAD")
|
|
# Change CMake cache type to string to avoid QCBOR_PATH=/absolute/path/DOWNLOAD being set.
|
|
set(QCBOR_PATH_TYPE ":STRING")
|
|
endif()
|
|
# Always set QCBOR_PATH, this will make sure that we don't automatically download this
|
|
# dependency in the TF-M build system and it will fail when set to an invalid value.
|
|
list(APPEND TFM_CMAKE_ARGS -DQCBOR_PATH${QCBOR_PATH_TYPE}=${CONFIG_TFM_QCBOR_PATH})
|
|
|
|
if(CONFIG_BOARD_LPCXPRESSO55S69_CPU0)
|
|
# Supply path to NXP HAL sources used for TF-M build
|
|
set(TFM_PLATFORM_NXP_HAL_FILE_PATH ${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}/platform/ext/target/nxp/)
|
|
list(APPEND TFM_CMAKE_ARGS -DTFM_PLATFORM_NXP_HAL_FILE_PATH=${TFM_PLATFORM_NXP_HAL_FILE_PATH})
|
|
endif()
|
|
|
|
if(CONFIG_TFM_BL2 AND CONFIG_TFM_MCUBOOT_PATH_LOCAL)
|
|
# Supply path to MCUboot for TF-M build
|
|
list(APPEND TFM_CMAKE_ARGS -DMCUBOOT_PATH=${ZEPHYR_MCUBOOT_MODULE_DIR})
|
|
endif()
|
|
|
|
if(CONFIG_TFM_MCUBOOT_DATA_SHARING)
|
|
list(APPEND TFM_CMAKE_ARGS -DMCUBOOT_DATA_SHARING=ON)
|
|
endif()
|
|
|
|
if(TFM_PSA_TEST_SUITE)
|
|
list(APPEND TFM_CMAKE_ARGS
|
|
-DPSA_TOOLCHAIN_FILE=${CMAKE_CURRENT_LIST_DIR}/psa/GNUARM.cmake
|
|
-DTOOLCHAIN=INHERIT
|
|
)
|
|
endif()
|
|
|
|
if(CONFIG_FPU AND CONFIG_FP_HARDABI)
|
|
list(APPEND TFM_CMAKE_ARGS -DCONFIG_TFM_ENABLE_FP=ON)
|
|
# Note: This is not a cmake option in TF-M.
|
|
# This should be specified by the platform in preload.cmake
|
|
# This works as a workaround for the platforms that do not have this.
|
|
list(APPEND TFM_CMAKE_ARGS -DCONFIG_TFM_FP_ARCH=${FPU_FOR_${GCC_M_CPU}})
|
|
else()
|
|
list(APPEND TFM_CMAKE_ARGS -DCONFIG_TFM_ENABLE_FP=OFF)
|
|
endif()
|
|
|
|
file(MAKE_DIRECTORY ${TFM_BINARY_DIR})
|
|
add_custom_target(tfm_cmake
|
|
DEPENDS ${TFM_BINARY_DIR}/CMakeCache.txt
|
|
)
|
|
add_custom_command(
|
|
OUTPUT ${TFM_BINARY_DIR}/CMakeCache.txt
|
|
COMMAND ${CMAKE_COMMAND}
|
|
-G${CMAKE_GENERATOR}
|
|
-DTFM_TOOLCHAIN_FILE=${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}/${TFM_TOOLCHAIN_FILE}
|
|
-DCROSS_COMPILE=${TFM_TOOLCHAIN_PATH}/${TFM_TOOLCHAIN_PREFIX}
|
|
-DCMAKE_BUILD_TYPE=${TFM_CMAKE_BUILD_TYPE}
|
|
-DTFM_PLATFORM=${CONFIG_TFM_BOARD}
|
|
-DCONFIG_TFM_BUILD_LOG_QUIET=ON
|
|
-DCONFIG_TFM_MEMORY_USAGE_QUIET=OFF
|
|
${TFM_CMAKE_ARGS}
|
|
$<GENEX_EVAL:$<TARGET_PROPERTY:zephyr_property_target,TFM_CMAKE_OPTIONS>>
|
|
-DMBEDCRYPTO_PATH=$<IF:$<BOOL:$<TARGET_PROPERTY:zephyr_property_target,TFM_MBEDCRYPTO_PATH>>,$<TARGET_PROPERTY:zephyr_property_target,TFM_MBEDCRYPTO_PATH>,${ZEPHYR_MBEDTLS_MODULE_DIR}>
|
|
-DTFM_TEST_REPO_PATH=${TFM_TEST_REPO_PATH}
|
|
-DPSA_ARCH_TESTS_PATH=${PSA_ARCH_TESTS_PATH}
|
|
${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}
|
|
WORKING_DIRECTORY ${TFM_BINARY_DIR}
|
|
COMMAND_EXPAND_LISTS
|
|
)
|
|
|
|
include(ExternalProject)
|
|
|
|
if(${CMAKE_HOST_SYSTEM_NAME} STREQUAL Windows)
|
|
# Set number of parallel jobs for TF-M build to 1.
|
|
# In some circumstances it has been experienced that building TF-M with
|
|
# multiple parallel jobs then `permission denied` may occur. Root cause on
|
|
# Windows has not been identified but current suspicion is around folder /
|
|
# file lock mechanism. To ensure correct behaviour in all cases, limit
|
|
# number of parallel jobs to 1.
|
|
set(PARALLEL_JOBS -j 1)
|
|
else()
|
|
# Leave PARALLEL_JOBS unset and use the default number of
|
|
# threads. Which is num_cores+2 on Ninja and MAKEFLAGS with Make.
|
|
endif()
|
|
|
|
ExternalProject_Add(
|
|
tfm
|
|
SOURCE_DIR ${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}
|
|
BINARY_DIR ${TFM_BINARY_DIR}
|
|
CONFIGURE_COMMAND ""
|
|
BUILD_COMMAND ${CMAKE_COMMAND} --build . ${PARALLEL_JOBS}
|
|
INSTALL_COMMAND ${CMAKE_COMMAND} --install .
|
|
BUILD_ALWAYS True
|
|
USES_TERMINAL_BUILD True
|
|
DEPENDS tfm_cmake
|
|
BUILD_BYPRODUCTS ${BUILD_BYPRODUCTS}
|
|
)
|
|
|
|
# Set TFM binary directory as target property on 'tfm'
|
|
# This is the root of all TFM build artifacts.
|
|
set_target_properties(tfm PROPERTIES TFM_BINARY_DIR ${TFM_BINARY_DIR})
|
|
|
|
# Set BL2 (MCUboot) executable file paths as target properties on 'tfm'
|
|
# These files are produced by the TFM build system.
|
|
if(CONFIG_TFM_BL2)
|
|
set_target_properties(tfm PROPERTIES
|
|
BL2_ELF_FILE ${BL2_ELF_FILE}
|
|
BL2_BIN_FILE ${BL2_BIN_FILE}
|
|
BL2_HEX_FILE ${BL2_HEX_FILE}
|
|
)
|
|
endif()
|
|
|
|
# Set TFM S/NS executable file paths as target properties on 'tfm'
|
|
# These files are produced by the TFM build system.
|
|
# Note that the Nonsecure FW is replaced by the Zephyr app in regular Zephyr
|
|
# builds.
|
|
set_target_properties(tfm PROPERTIES
|
|
TFM_S_ELF_FILE ${TFM_S_ELF_FILE}
|
|
TFM_S_BIN_FILE ${TFM_S_BIN_FILE} # TFM Secure FW (unsigned)
|
|
TFM_S_HEX_FILE ${TFM_S_HEX_FILE} # TFM Secure FW (unsigned)
|
|
TFM_NS_BIN_FILE ${TFM_NS_BIN_FILE} # TFM Nonsecure FW (unsigned)
|
|
TFM_NS_HEX_FILE ${TFM_NS_HEX_FILE} # TFM Nonsecure FW (unsigned)
|
|
TFM_S_SIGNED_BIN_FILE ${TFM_S_SIGNED_BIN_FILE} # TFM Secure FW (signed)
|
|
TFM_NS_SIGNED_BIN_FILE ${TFM_NS_SIGNED_BIN_FILE} # TFM Nonsecure FW (signed)
|
|
TFM_S_NS_SIGNED_BIN_FILE ${TFM_S_NS_SIGNED_BIN_FILE} # Merged TFM Secure/Nonsecure FW (signed)
|
|
)
|
|
|
|
zephyr_library_named(tfm_api)
|
|
|
|
zephyr_library_sources(
|
|
src/zephyr_tfm_log.c
|
|
interface/interface.c
|
|
)
|
|
|
|
# Non-Secure interface to request system reboot
|
|
if (CONFIG_TFM_PARTITION_PLATFORM AND NOT CONFIG_TFM_PARTITION_PLATFORM_CUSTOM_REBOOT)
|
|
zephyr_library_sources(src/reboot.c)
|
|
endif()
|
|
zephyr_library_sources_ifndef(CONFIG_TFM_PSA_TEST_NONE src/zephyr_tfm_psa_test.c)
|
|
|
|
if (TFM_PSA_TEST_SUITE)
|
|
zephyr_library_link_libraries(
|
|
${PSA_TEST_VAL_FILE}
|
|
${PSA_TEST_PAL_FILE}
|
|
${PSA_TEST_COMBINE_FILE}
|
|
)
|
|
endif()
|
|
|
|
if(NOT CONFIG_TFM_BUILD_NS)
|
|
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_PLATFORM ${TFM_INTERFACE_SOURCE_DIR}/tfm_platform_api.c)
|
|
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_PROTECTED_STORAGE ${TFM_INTERFACE_SOURCE_DIR}/tfm_ps_api.c)
|
|
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE ${TFM_INTERFACE_SOURCE_DIR}/tfm_its_api.c)
|
|
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_CRYPTO ${TFM_INTERFACE_SOURCE_DIR}/tfm_crypto_api.c)
|
|
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_INITIAL_ATTESTATION ${TFM_INTERFACE_SOURCE_DIR}/tfm_attest_api.c)
|
|
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_FIRMWARE_UPDATE ${TFM_INTERFACE_SOURCE_DIR}/tfm_fwu_api.c)
|
|
|
|
zephyr_library_sources_ifdef(CONFIG_TFM_CONNECTION_BASED_SERVICE_API ${TFM_INTERFACE_SOURCE_DIR}/tfm_psa_ns_connection_api.c)
|
|
zephyr_library_sources(${TFM_INTERFACE_SOURCE_DIR}/tfm_psa_ns_api.c)
|
|
|
|
if(CONFIG_SOC_FAMILY_NRF)
|
|
zephyr_library_sources_ifdef(CONFIG_TFM_PARTITION_PLATFORM ${TFM_INTERFACE_SOURCE_DIR}/tfm_ioctl_core_ns_api.c)
|
|
endif()
|
|
|
|
else()
|
|
zephyr_library_link_libraries(
|
|
${TFM_API_NS_PATH}
|
|
${PLATFORM_NS_FILE}
|
|
)
|
|
endif()
|
|
|
|
zephyr_include_directories(
|
|
${TFM_GENERATED_INCLUDES}
|
|
)
|
|
|
|
target_include_directories(tfm_api PRIVATE
|
|
${TFM_BINARY_DIR}/install/interface/include
|
|
${TFM_BINARY_DIR}/install/interface/include/crypto_keys
|
|
)
|
|
|
|
zephyr_library_link_libraries(
|
|
${VENEERS_FILE}
|
|
)
|
|
|
|
# To ensure that generated include files are created before they are used.
|
|
add_dependencies(zephyr_interface tfm)
|
|
|
|
if (CONFIG_TFM_BL2)
|
|
set(PREPROCESSED_FILE_S "${TFM_BINARY_DIR}/bl2/ext/mcuboot/CMakeFiles/signing_layout_s.dir/signing_layout_s.o")
|
|
set(PREPROCESSED_FILE_NS "${TFM_BINARY_DIR}/bl2/ext/mcuboot/CMakeFiles/signing_layout_ns.dir/signing_layout_ns.o")
|
|
set(TFM_MCUBOOT_DIR "${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}/bl2/ext/mcuboot")
|
|
endif()
|
|
|
|
# Configure which format (full or hash) to include the public key in
|
|
# the image manifest
|
|
if(NOT DEFINED TFM_PUBLIC_KEY_FORMAT)
|
|
set(TFM_PUBLIC_KEY_FORMAT "full")
|
|
endif()
|
|
|
|
if(DEFINED TFM_HEX_BASE_ADDRESS_S)
|
|
set(HEX_ADDR_ARGS_S "--hex-addr=${TFM_HEX_BASE_ADDRESS_S}")
|
|
endif()
|
|
|
|
if(DEFINED TFM_HEX_BASE_ADDRESS_NS)
|
|
set(HEX_ADDR_ARGS_NS "--hex-addr=${TFM_HEX_BASE_ADDRESS_NS}")
|
|
endif()
|
|
|
|
function(tfm_sign OUT_ARG SUFFIX PAD INPUT_FILE OUTPUT_FILE)
|
|
if(PAD)
|
|
set(pad_args --pad --pad-header)
|
|
endif()
|
|
set (${OUT_ARG}
|
|
# Add the MCUBoot script to the path so that if there is a version of imgtool in there then
|
|
# it gets used over the system imgtool. Used so that imgtool from upstream
|
|
# mcuboot is preferred over system imgtool
|
|
${CMAKE_COMMAND} -E env PYTHONPATH=${ZEPHYR_MCUBOOT_MODULE_DIR}/scripts
|
|
${PYTHON_EXECUTABLE} ${TFM_MCUBOOT_DIR}/scripts/wrapper/wrapper.py
|
|
--layout ${PREPROCESSED_FILE_${SUFFIX}}
|
|
-k ${CONFIG_TFM_KEY_FILE_${SUFFIX}}
|
|
--public-key-format ${TFM_PUBLIC_KEY_FORMAT}
|
|
--align 1
|
|
-v ${CONFIG_TFM_IMAGE_VERSION_${SUFFIX}}
|
|
${pad_args}
|
|
${HEX_ADDR_ARGS_${SUFFIX}}
|
|
${ADD_${SUFFIX}_IMAGE_MIN_VER}
|
|
-s auto
|
|
--measured-boot-record
|
|
-H ${CONFIG_ROM_START_OFFSET}
|
|
${INPUT_FILE}
|
|
${OUTPUT_FILE}
|
|
PARENT_SCOPE)
|
|
endfunction()
|
|
|
|
set(MERGED_FILE ${CMAKE_BINARY_DIR}/zephyr/tfm_merged.hex)
|
|
set(S_NS_FILE ${CMAKE_BINARY_DIR}/zephyr/tfm_s_zephyr_ns.hex)
|
|
set(S_NS_SIGNED_FILE ${CMAKE_BINARY_DIR}/zephyr/tfm_s_zephyr_ns_signed.hex)
|
|
set(NS_SIGNED_FILE ${CMAKE_BINARY_DIR}/zephyr/zephyr_ns_signed.hex)
|
|
set(S_SIGNED_FILE ${CMAKE_BINARY_DIR}/zephyr/tfm_s_signed.hex)
|
|
|
|
if (CONFIG_TFM_USE_NS_APP)
|
|
# Use the TF-M NS binary as the Non-Secure application firmware image
|
|
set(NS_APP_FILE $<TARGET_PROPERTY:tfm,TFM_NS_HEX_FILE>)
|
|
else()
|
|
# Use the Zephyr binary as the Non-Secure application firmware image
|
|
set(NS_APP_FILE ${CMAKE_BINARY_DIR}/zephyr/${KERNEL_HEX_NAME})
|
|
endif()
|
|
|
|
if (NOT CONFIG_TFM_BL2)
|
|
# Merge tfm_s and zephyr (NS) image to a single binary.
|
|
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
|
|
COMMAND ${PYTHON_EXECUTABLE} ${ZEPHYR_BASE}/scripts/build/mergehex.py
|
|
-o ${MERGED_FILE}
|
|
$<TARGET_PROPERTY:tfm,TFM_S_HEX_FILE>
|
|
${NS_APP_FILE}
|
|
)
|
|
|
|
set_property(GLOBAL APPEND PROPERTY extra_post_build_byproducts
|
|
${MERGED_FILE}
|
|
)
|
|
|
|
elseif(CONFIG_TFM_MCUBOOT_IMAGE_NUMBER STREQUAL "1")
|
|
tfm_sign(sign_cmd NS TRUE ${S_NS_FILE} ${S_NS_SIGNED_FILE})
|
|
|
|
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
|
|
COMMAND ${PYTHON_EXECUTABLE} ${ZEPHYR_BASE}/scripts/build/mergehex.py
|
|
-o ${S_NS_FILE}
|
|
$<TARGET_PROPERTY:tfm,TFM_S_HEX_FILE>
|
|
${NS_APP_FILE}
|
|
|
|
COMMAND ${sign_cmd}
|
|
|
|
COMMAND ${PYTHON_EXECUTABLE} ${ZEPHYR_BASE}/scripts/build/mergehex.py
|
|
-o ${MERGED_FILE}
|
|
$<TARGET_PROPERTY:tfm,BL2_HEX_FILE>
|
|
${S_NS_SIGNED_FILE}
|
|
)
|
|
|
|
set_property(GLOBAL APPEND PROPERTY extra_post_build_byproducts
|
|
${S_NS_FILE}
|
|
${S_NS_SIGNED_FILE}
|
|
${MERGED_FILE}
|
|
)
|
|
|
|
else()
|
|
if (CONFIG_TFM_USE_NS_APP)
|
|
tfm_sign(sign_cmd_ns NS TRUE ${NS_APP_FILE} ${NS_SIGNED_FILE})
|
|
else()
|
|
tfm_sign(sign_cmd_ns NS FALSE ${NS_APP_FILE} ${NS_SIGNED_FILE})
|
|
endif()
|
|
|
|
tfm_sign(sign_cmd_s S TRUE $<TARGET_PROPERTY:tfm,TFM_S_HEX_FILE> ${S_SIGNED_FILE})
|
|
|
|
#Create and sign for concatenated binary image, should align with the TF-M BL2
|
|
set_property(GLOBAL APPEND PROPERTY extra_post_build_commands
|
|
COMMAND ${sign_cmd_ns}
|
|
COMMAND ${sign_cmd_s}
|
|
|
|
COMMAND ${PYTHON_EXECUTABLE} ${ZEPHYR_BASE}/scripts/build/mergehex.py
|
|
-o ${MERGED_FILE}
|
|
$<TARGET_PROPERTY:tfm,BL2_HEX_FILE>
|
|
${S_SIGNED_FILE}
|
|
${NS_SIGNED_FILE}
|
|
)
|
|
|
|
set_property(GLOBAL APPEND PROPERTY extra_post_build_byproducts
|
|
${S_SIGNED_FILE}
|
|
${NS_SIGNED_FILE}
|
|
${MERGED_FILE}
|
|
)
|
|
endif()
|
|
endif()
|