michaelh/zephyr
1
0
Fork 0
Code Releases Activity

modules: trusted-firmware-m: Define BL1 flags

Browse source 
Define BL1 and sign key for BL2 configs and pass them to the TF-M
This will allow to trigger BL1 over zephyr and specify BL2 sign key

Signed-off-by: Sadik Ozer <sadik.ozer@analog.com>
This commit is contained in:
Sadik Ozer 2025-02-19 18:24:44 +03:00 • committed by Benjamin Cabé
commit dd71a2d2db
2 changed files with 26 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
modules/trusted-firmware-m/CMakeLists.txt
View file

@ -18,6 +18,14 @@ set(TFM_VALID_PARTITIONS
if (CONFIG_BUILD_WITH_TFM) if (CONFIG_BUILD_WITH_TFM)
# PSA API awareness for the Non-Secure application # PSA API awareness for the Non-Secure application
target_compile_definitions(app PRIVATE "TFM_PSA_API") target_compile_definitions(app PRIVATE "TFM_PSA_API")
if(CONFIG_TFM_BL1)
list(APPEND TFM_CMAKE_ARGS -DBL1:BOOL=ON)
if(CONFIG_TFM_BL2_SIGNING_KEY_PATH)
list(APPEND TFM_CMAKE_ARGS -DTFM_BL2_SIGNING_KEY_PATH=${CONFIG_TFM_BL2_SIGNING_KEY_PATH})
endif()
endif()
if (CONFIG_TFM_SFN) if (CONFIG_TFM_SFN)
list(APPEND TFM_CMAKE_ARGS -DCONFIG_TFM_SPM_BACKEND="SFN") list(APPEND TFM_CMAKE_ARGS -DCONFIG_TFM_SPM_BACKEND="SFN")
else() # CONFIG_TFM_IPC else() # CONFIG_TFM_IPC

18
modules/trusted-firmware-m/Kconfig.tfm
View file

@ -206,6 +206,12 @@ config TFM_IMAGE_VERSION_NS
help help
Version of the non-secure image. Version of the non-secure image.
config TFM_BL1
bool "Add BL1 to TFM"
help
TFM is designed to run with BL1 in a certain configuration.
This config adds BL1 to the build - built via TFM's build system.
config TFM_BL2 config TFM_BL2
bool "Add MCUboot to TFM" bool "Add MCUboot to TFM"
depends on !TFM_BL2_NOT_SUPPORTED depends on !TFM_BL2_NOT_SUPPORTED
@ -240,6 +246,18 @@ config TFM_CONNECTION_BASED_SERVICE_API
system. When this option is not enabled in the TF-M build system this system. When this option is not enabled in the TF-M build system this
will result in compilation error. will result in compilation error.
if TFM_BL1
config TFM_BL2_SIGNING_KEY_PATH
string "Path to private key used to sign BL2 firmware images."
help
Path to binary BL2 signing private key
Default is ${ZEPHYR_TRUSTED_FIRMWARE_M_MODULE_DIR}/bl1/bl1_2/bl1_dummy_rotpk
if it has not been changed on TF-M side for your board
endif # TFM_BL1
if TFM_BL2 if TFM_BL2
config TFM_IMAGE_SECURITY_COUNTER config TFM_IMAGE_SECURITY_COUNTER