Skip to content

Commit c937217

Browse files
urutvaurutva
committed
Build TFM & MCUBoot as a subproject
This also links the App at the offset expected by TFM and uses a non-secure address in the startup code This allows for firmware update, MCUBoot sytle. The modifications include: * Reserve room in flash for the MCUBoot header (0x400) * Sign firmware parts as part of the build process The total size of RAM in MPS3 AN524 is 128KB out of which 96KB is allocated to TF-M. Update app linker file to allocate remaining RAM. In addition reduce stack size from `0x1800` to `0x1000` to keep heap size at `0x1000`. Finally, we call some PSA APIs in the example application to test this integration. Signed-off-by: Jimmy Brisson <jimmy.brisson@linaro.org> Signed-off-by: Devaraj Ranganna <devaraj.ranganna@linaro.org>
1 parent b02af19 commit c937217

File tree

13 files changed

+541
-10
lines changed

13 files changed

+541
-10
lines changed

‎.gitmodules‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,9 @@
99
[submodule "core/lib/jsmn/src"]
1010
path = core/lib/jsmn/src
1111
url = https://github.com/zserge/jsmn
12+
[submodule "core/lib/tfm"]
13+
path = core/lib/tfm
14+
url = https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git
15+
[submodule "core/lib/tf-m-tests"]
16+
path = core/lib/tf-m-tests
17+
url = https://git.trustedfirmware.org/TF-M/tf-m-tests.git

‎Arm/MPS3_AN524/CMakeLists.txt‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@ include(${GSG_BASE_DIR}/cmake/utilities.cmake)
2525
project(mps3_524 C ASM)
2626

2727
# Exceptions required by CMSIS UART driver (-Wno-ignored-qualifiers -Wno-return-type)
28-
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-ignored-qualifiers -Wno-return-type")
28+
# Make threadx run in non-secure mode (-DTX_SINGLE_MODE_NON_SECURE)
29+
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-ignored-qualifiers -Wno-return-type -DTX_SINGLE_MODE_NON_SECURE")
30+
set(CMAKE_ASM_FLAGS "${CMAKE_ASM_FLAGS} -DTX_SINGLE_MODE_NON_SECURE")
2931

3032
# add_subdirectory(${CORE_SRC_DIR} core_src)
3133
add_subdirectory(lib)

‎Arm/MPS3_AN524/app/CMakeLists.txt‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
# Copyright (c) 2021 Linaro Limited.
22
# Licensed under the MIT License.
33

4+
set(APP_CONFIG_OPTIONS "${CMAKE_CURRENT_LIST_DIR}/config.cmake" CACHE FILEPATH
5+
"Configuration Options"
6+
)
7+
8+
include(${APP_CONFIG_OPTIONS})
9+
410
set(LINKER_SCRIPT "${CMAKE_CURRENT_LIST_DIR}/startup/mps3_an524.ld")
511

612
set(SOURCES
@@ -19,6 +25,7 @@ target_link_libraries(${PROJECT_NAME}
1925
# app_common
2026
# jsmn
2127
AN524
28+
tfm_api
2229
# netx_driver
2330
)
2431

@@ -36,3 +43,67 @@ target_include_directories(${PROJECT_NAME}
3643
PUBLIC
3744
.
3845
)
46+
47+
if(BUILD_WITH_TFM)
48+
if (NOT TFM_MCUBOOT_IMAGE_NUMBER STREQUAL "OFF")
49+
set(TFM_MCUBOOT_IMAGE_NUMBER_OPTION "MCUBOOT_IMAGE_NUMBER ${TFM_MCUBOOT_IMAGE_NUMBER}")
50+
endif()
51+
if (TFM_ISOLATION_LEVEL)
52+
set(TFM_ISOLATION_LEVEL_OPTION "ISOLATION_LEVEL ${TFM_ISOLATION_LEVEL}")
53+
endif()
54+
if (TFM_KEY_FILE_S)
55+
set(TFM_KEY_FILE_S_OPTION "KEY_FILE_S ${TFM_KEY_FILE_S}")
56+
endif()
57+
if (TFM_KEY_FILE_NS)
58+
set(TFM_KEY_FILE_NS_OPTION "KEY_FILE_NS ${TFM_KEY_FILE_NS}")
59+
endif()
60+
if (TFM_PROFILE)
61+
set(TFM_PROFILE_OPTION BUILD_PROFILE ${TFM_PROFILE})
62+
endif()
63+
if (TFM_BL2)
64+
set(TFM_BL2_OPTION "BL2")
65+
endif()
66+
if (TFM_IPC)
67+
set(TFM_IPC_OPTION "IPC")
68+
endif()
69+
if (TFM_REGRESSION)
70+
set(TFM_REGRESSION_OPTION "REGRESSION")
71+
endif()
72+
if (TFM_PARTITION_PROTECTED_STORAGE)
73+
list(APPEND PARTITIONS "TFM_PARTITION_PROTECTED_STORAGE")
74+
endif()
75+
if (TFM_PARTITION_INTERNAL_TRUSTED_STORAGE)
76+
list(APPEND PARTITIONS "TFM_PARTITION_INTERNAL_TRUSTED_STORAGE")
77+
endif()
78+
if (TFM_PARTITION_PLATFORM)
79+
list(APPEND PARTITIONS "TFM_PARTITION_PLATFORM")
80+
endif()
81+
if (TFM_PARTITION_CRYPTO)
82+
list(APPEND PARTITIONS "TFM_PARTITION_CRYPTO")
83+
endif()
84+
if (TFM_PARTITION_INITIAL_ATTESTATION)
85+
list(APPEND PARTITIONS "TFM_PARTITION_INITIAL_ATTESTATION")
86+
endif()
87+
if (TFM_PARTITION_AUDIT_LOG)
88+
list(APPEND PARTITIONS "TFM_PARTITION_AUDIT_LOG")
89+
endif()
90+
if (TFM_PARTITION_FIRMWARE_UPDATE)
91+
list(APPEND PARTITIONS "TFM_PARTITION_FIRMWARE_UPDATE")
92+
endif()
93+
if (PARTITIONS)
94+
set(PARTITIONS_OPTION "ENABLED_PARTITIONS ${PARTITIONS}")
95+
endif()
96+
trusted_firmware_build(
97+
BINARY_DIR ${CMAKE_BINARY_DIR}/tfm
98+
BOARD arm/mps3/an524
99+
${TFM_PROFILE_OPTION}
100+
${TFM_MCUBOOT_IMAGE_NUMBER_OPTION}
101+
${TFM_ISOLATION_LEVEL_OPTION}
102+
${TFM_KEY_FILE_S_OPTION}
103+
${TFM_KEY_FILE_NS_OPTION}
104+
${TFM_BL2_OPTION}
105+
${TFM_IPC_OPTION}
106+
${TFM_REGRESSION_OPTION}
107+
${PARTITIONS_OPTION}
108+
)
109+
endif()

‎Arm/MPS3_AN524/app/config.cmake‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
# Copyright (c) 2021 Linaro Limited.
2+
# Licensed under the MIT License.
3+
4+
set(TX_TFM_BASE_DIR ${GSG_BASE_DIR}/core/lib/tfm)
5+
set(TX_TFM_BL2_DIR ${TX_TFM_BASE_DIR}/bl2/ext/mcuboot)
6+
7+
option(BUILD_WITH_TFM "Build with TF-M as the Secure Execution Environment" ON)
8+
include(CMakeDependentOption)
9+
set(TFM_KEY_FILE_S
10+
"${TX_TFM_BL2_DIR}/root-RSA-3072.pem"
11+
CACHE FILEPATH
12+
"The path and filename for the .pem file containing the private key
13+
that should be used by the BL2 bootloader when signing secure
14+
firmware images."
15+
)
16+
17+
set(TFM_KEY_FILE_NS
18+
"${TX_TFM_BL2_DIR}/root-RSA-3072_1.pem"
19+
CACHE FILEPATH
20+
"The path and filename for the .pem file containing the private key
21+
that should be used by the BL2 bootloader when signing non-secure
22+
firmware images."
23+
)
24+
25+
set(TFM_PROFILE
26+
OFF
27+
CACHE STRING
28+
"The build profile used for TFM Secure image."
29+
)
30+
31+
set(TFM_ISOLATION_LEVEL
32+
"1"
33+
CACHE STRING
34+
"Manually set the required TFM isolation level. Possible values are
35+
1,2 or 3; the default is set by build configuration."
36+
)
37+
38+
cmake_dependent_option(TFM_BL2
39+
"TFM is designed to run with MCUboot in a certain configuration.
40+
This config adds MCUboot to the build - built via TFM's build system."
41+
ON
42+
BUILD_WITH_TFM OFF
43+
)
44+
45+
set(TFM_MCUBOOT_IMAGE_NUMBER
46+
"1"
47+
CACHE STRING
48+
"How many images the bootloader sees when it looks at TFM and the app.
49+
When this is 1, the S and NS are considered as 1 image and must be
50+
updated in one atomic operation. When this is 2, they are split and
51+
can be updated independently if dependency requirements are met."
52+
)
53+
54+
cmake_dependent_option(TFM_PARTITION_PROTECTED_STORAGE
55+
"Setting this option will cause '-DTFM_PARTITION_PROTECTED_STORAGE'
56+
to be passed to the TF-M build system. Look at 'config_default.cmake'
57+
in the trusted-firmware-m repository for details regarding this
58+
parameter. Any dependencies between the various TFM_PARTITION_*
59+
options are handled by the build system in the trusted-firmware-m
60+
repository."
61+
ON
62+
BUILD_WITH_TFM OFF
63+
)
64+
65+
cmake_dependent_option(TFM_PARTITION_INTERNAL_TRUSTED_STORAGE
66+
"Setting this option will cause '-DTFM_PARTITION_INTERNAL_TRUSTED_STORAGE'
67+
to be passed to the TF-M build system. Look at 'config_default.cmake'
68+
in the trusted-firmware-m repository for details regarding this
69+
parameter. Any dependencies between the various TFM_PARTITION_*
70+
options are handled by the build system in the trusted-firmware-m
71+
repository."
72+
ON
73+
BUILD_WITH_TFM OFF
74+
)
75+
76+
cmake_dependent_option(TFM_PARTITION_CRYPTO
77+
"Setting this option will cause '-DTFM_PARTITION_CRYPTO'
78+
to be passed to the TF-M build system. Look at 'config_default.cmake'
79+
in the trusted-firmware-m repository for details regarding this
80+
parameter. Any dependencies between the various TFM_PARTITION_*
81+
options are handled by the build system in the trusted-firmware-m
82+
repository."
83+
ON
84+
BUILD_WITH_TFM OFF
85+
)
86+
87+
cmake_dependent_option(TFM_PARTITION_INITIAL_ATTESTATION
88+
"Setting this option will cause '-DTFM_PARTITION_INITIAL_ATTESTATION'
89+
to be passed to the TF-M build system. Look at 'config_default.cmake'
90+
in the trusted-firmware-m repository for details regarding this
91+
parameter. Any dependencies between the various TFM_PARTITION_*
92+
options are handled by the build system in the trusted-firmware-m
93+
repository."
94+
ON
95+
BUILD_WITH_TFM OFF
96+
)
97+
98+
cmake_dependent_option(TFM_PARTITION_PLATFORM
99+
"Setting this option will cause '-DTFM_PARTITION_PLATFORM'
100+
to be passed to the TF-M build system. Look at 'config_default.cmake'
101+
in the trusted-firmware-m repository for details regarding this
102+
parameter. Any dependencies between the various TFM_PARTITION_*
103+
options are handled by the build system in the trusted-firmware-m
104+
repository."
105+
ON
106+
BUILD_WITH_TFM OFF
107+
)
108+
109+
cmake_dependent_option(TFM_PARTITION_AUDIT_LOG
110+
"Setting this option will cause '-DTFM_PARTITION_AUDIT_LOG'
111+
to be passed to the TF-M build system. Look at 'config_default.cmake'
112+
in the trusted-firmware-m repository for details regarding this
113+
parameter. Any dependencies between the various TFM_PARTITION_*
114+
options are handled by the build system in the trusted-firmware-m
115+
repository."
116+
ON
117+
BUILD_WITH_TFM OFF
118+
)
119+
120+
cmake_dependent_option(TFM_PARTITION_FIRMWARE_UPDATE
121+
"Setting this option will cause '-DTFM_PARTITION_FIRMWARE_UPDATE'
122+
to be passed to the TF-M build system. Look at 'config_default.cmake'
123+
in the trusted-firmware-m repository for details regarding this
124+
parameter. Any dependencies between the various TFM_PARTITION_*
125+
options are handled by the build system in the trusted-firmware-m
126+
repository."
127+
On
128+
BUILD_WITH_TFM OFF
129+
)
130+
131+
cmake_dependent_option(TFM_IPC
132+
"When enabled, this option signifies that the TF-M build supports
133+
the PSA API (IPC mode) instead of the secure library mode."
134+
ON
135+
BUILD_WITH_TFM OFF
136+
)
137+
138+
cmake_dependent_option(TFM_REGRESSION
139+
"When enabled, this option signifies that the TF-M build includes
140+
the Secure and the Non-Secure regression tests."
141+
ON
142+
BUILD_WITH_TFM OFF
143+
)
144+
145+
set(APP_CONFIG OFF CACHE FILEPATH
146+
"Configuration file for the MPS3 AN524 example app"
147+
)
148+
149+
if (APP_CONFIG)
150+
include(${APP_CONFIG})
151+
endif()

‎Arm/MPS3_AN524/app/main.c‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@
66

77
#include "board_init.h"
88
#include "cmsis.h"
9+
#include "tfm_api.h"
10+
#include "tfm_ns_interface.h"
11+
#ifdef TFM_PSA_API
12+
#include "psa_manifest/sid.h"
13+
#endif
914

1015
#define AZURE_THREAD_STACK_SIZE 4096
1116
#define AZURE_THREAD_PRIORITY 4
@@ -25,6 +30,14 @@ static __inline void systick_interval_set(uint32_t ticks)
2530
SysTick->CTRL |= SysTick_CTRL_ENABLE_Msk;
2631
}
2732

33+
/* TODO: Locking for accessing the TFM interface */
34+
int32_t tfm_ns_interface_dispatch(veneer_fn fn,
35+
uint32_t arg0, uint32_t arg1,
36+
uint32_t arg2, uint32_t arg3)
37+
{
38+
return fn(arg0, arg1, arg2, arg3);
39+
}
40+
2841
TX_THREAD azure_thread;
2942
ULONG azure_thread_stack[AZURE_THREAD_STACK_SIZE / sizeof(ULONG)];
3043

@@ -33,7 +46,27 @@ void tx_application_define(void* first_unused_memory);
3346

3447
void azure_thread_entry(ULONG parameter)
3548
{
36-
printf("\r\nStarting Azure thread\r\n\r\n");
49+
uint32_t version;
50+
printf("Starting Azure thread\r\n");
51+
version = psa_framework_version();
52+
if (version == PSA_FRAMEWORK_VERSION) {
53+
printf("The version of the PSA Framework API is %lu.\n",
54+
version);
55+
} else {
56+
printf("The version of the PSA Framework API is not valid!\n");
57+
return;
58+
}
59+
psa_handle_t handle;
60+
61+
handle = psa_connect(IPC_SERVICE_TEST_BASIC_SID,
62+
IPC_SERVICE_TEST_BASIC_VERSION);
63+
if (handle > 0) {
64+
printf("Connect success!\n");
65+
} else {
66+
printf("The RoT Service has refused the connection!\n");
67+
return;
68+
}
69+
psa_close(handle);
3770
}
3871

3972
void tx_application_define(void* first_unused_memory)

‎Arm/MPS3_AN524/app/startup/mps3_an524.ld‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,13 @@
2424

2525
MEMORY
2626
{
27-
FLASH (rx) : ORIGIN = 0x10000000, LENGTH = 0x40000 /* 256 KB */
28-
RAM (rwx) : ORIGIN = 0x30000000, LENGTH = 0x20000 /* 128 KB */
27+
FLASH (rx) : ORIGIN = 0x000C0400, LENGTH = (0x40000 - 0x400) /* 256 KB */
28+
/* Total RAM size is 128KB, out of which 96KB is allocated to TF-M */
29+
RAM (rwx) : ORIGIN = 0x20018000, LENGTH = 0x8000 /* 32 KB */
2930
}
3031

3132
__heap_size__ = 0x0001000;
32-
__msp_stack_size__ = 0x0001800;
33+
__msp_stack_size__ = 0x0001000;
3334

3435
/* Library configurations */
3536
GROUP(libgcc.a libc.a libm.a libnosys.a)

‎Arm/MPS3_AN524/app/startup/startup_cmsdk_mps3_an524_bl2.S‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,7 @@ Reset_Handler:
191191
* Macro __STARTUP_COPY_MULTIPLE is used to choose between two schemes. */
192192

193193
/* Only run on core 0 */
194-
mov r0, #0x50000000
194+
mov r0, #0x40000000
195195
add r0, #0x0001F000
196196
ldr r0, [r0]
197197
cmp r0,#0

‎Arm/MPS3_AN524/lib/CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,4 @@ add_subdirectory(${CORE_LIB_DIR}/threadx threadx)
1414
#add_subdirectory(${CORE_LIB_DIR}/jsmn jsmn)
1515

1616
add_subdirectory(AN524)
17+
add_subdirectory(tf-m)

0 commit comments

Comments
 (0)