Hi,

Do you mind sharing your commands/configs of building TF-M? May I know if you downloaded a whole NS+S image or separated images to MSP2?

Best regards, Hu Ziji

From: Antonio De Angelis via TF-M tf-m@lists.trustedfirmware.org Date: Friday, October 6, 2023 at 02:11 To: capablegh@gmail.com capablegh@gmail.com, tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org, nd nd@arm.com Subject: [TF-M] Re: Building TF-M for ARM reference SoC/boards MPS2/MPS3 and Musca S1 Hi,

The reference designs hosted on the upstream repo, for MPS2 (AN521) for example already work like this (the other core is disabled) . I believe that the choice of the topology is determined by the integration setup, so this question I believe is more for some Zephyr-specific mailing list, or if there is any Zephyr dev reading this list they could chime in.

Thanks, Antonio

Sent from Outlook for Androidhttps://aka.ms/AAb9ysg

________________________________ From: capablegh--- via TF-M tf-m@lists.trustedfirmware.org Sent: Thursday, October 5, 2023 12:34:54 pm To: tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org Subject: [TF-M] Building TF-M for ARM reference SoC/boards MPS2/MPS3 and Musca S1

Hello.

The ARM MPS2/MPS3 have Cortex M33 two processor configuration. I am building TF-M under the Zephyr OS setup. From the build it appears that the secure (TF-M) and non-secure (Zephyr OS and app) are bound and executed on separate CPUs. Assuming that two CPUs are used, in the build, is there a way to force using same one CPU for TF-M and Zephyr/app, while disabling the second CPU?

Thanks. -- TF-M mailing list -- tf-m@lists.trustedfirmware.org To unsubscribe send an email to tf-m-leave@lists.trustedfirmware.org

Hi,

I’ve tried with the latest main branch (commit e43540934) and TF-Mv1.8.1 tag, both worked well with exactly your build command: cmake -S . -B cmake_build -DTFM_PLATFORM=musca_s1 -DTEST_PSA_API=CRYPTO cmake --build cmake_build -- install

As this config will choose GCC compiler and use “toolchain_GNUARM.cmake” by default, please double check your environment. Here is my GCC version for your reference: arm-none-eabi-gcc --version arm-none-eabi-gcc (GNU Arm Embedded Toolchain 10.3-2021.10) 10.3.1 20210824 (release)

Best regards, Xinyu

From: capablegh--- via TF-M tf-m@lists.trustedfirmware.org Date: Monday, October 23, 2023 at 00:58 To: tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org Subject: [TF-M] Re: Building TF-M for ARM reference SoC/boards MPS2/MPS3 and Musca S1 Hello Antonio and David.

Instead of following the Zephyr build I follow the instructions per 'https://tf-m-user-guide.trustedfirmware.org/building/tfm_build_instruction.h...' and build for Musca S1,

The build command lines are cmake -S . -B cmake_build -DTFM_PLATFORM=musca_s1 -DTEST_PSA_API=CRYPTO cmake --build cmake_build -- install

I get an error "/usr/lib/gcc/arm-none-eabi/10.3.1/../../../arm-none-eabi/bin/ld: /usr/lib/gcc/arm-none-eabi/10.3.1/../../../arm-none-eabi/lib/thumb/v8-m.main/nofp/libnosys.a(sbrk.o): in function `_sbrk': Memory region Used Size Region Size %age Used FLASH: 159572 B 380 KB 41.01% RAM: 48656 B 256 KB 18.56% collect2: error: ld returned 1 exit status"

Am I using the correct command? How do I get this to build successfully?

I get the same error if I use "-DTEST_S=ON -DTEST_NS=ON" instead of "-DTEST_PSA_API=CRYPTO"

If I do not provide either of the two specific "-D" options for test, the build completes.

With this I see the ".hex", ".bin" files in 'cmake_build/bin/'. If I copy 'tfm_s_ns_signed.bin' to the DAPLink USB MSD partition that gets mounted, I see a "FAIL.TXT" file created there with content "An error occurred during the transfer".

This is with the default "main" branch of the Git repo of 'trusted-firmware-m'. I get the same error for "-DTEST_PSA_API=CRYPTO" if I checkout "TF-Mv1.8.1" tag.

Is this expected to work for the Musca S1? Am I using the correct command line(s)? -- TF-M mailing list -- tf-m@lists.trustedfirmware.org To unsubscribe send an email to tf-m-leave@lists.trustedfirmware.org

Hi Arun,

this normally happens when there is some component that is requiring heap memory (heap is disabled in TF-M's plaform linker files, as we shouldn't have any function that requires it, apart for some debug functionalities (i.e. used only when the build type is Debug)).

This could be an issue with the toolchain (in the sense that some lib component is requiring heap and TF-M does not expect that) or that some functions in Musca-S1 platform are linked which require heap. I believe last year some fixes went to clean up some of the print() inclusions (i.e. the CryptoCell printing functions were being linked against the libc printf, rather than the printf implemented within TF-M). I suggest to check that your branch has those fixes as well. I am not entirely sure how TF-M gets integrated into Zephyr, they might have forked before those went it?

Thanks, Antonio

________________________________ From: Arun D via TF-M tf-m@lists.trustedfirmware.org Sent: Monday, October 23, 2023 12:37 To: tf-m@lists.trustedfirmware.org tf-m@lists.trustedfirmware.org Subject: [TF-M] Re: Building TF-M for ARM reference SoC/boards MPS2/MPS3 and Musca S1

Hi Xinyu,

The error reported by the cross compiler in "_sbrk" is "sbrk.c:21: undefined reference to `end'", seems to happen in the standalone clone of TF-M Git clone as well as the one under Zephyr "v3.4.0" (which is TF-M hash '79a6115d3', your commit dated 'Mon Apr 10 14:43:47 2023').

However the one under Zephyr's TF-M (same hash of "79a6115d3") builds ok when compiled via Zephyr's "west" build system.

Also, if I grep for the "79a6115d3" hash in standalone TF-M Git clone, I do not find it.

I am not sure how to reconcile these different observations. I would appreciate any thought.

Regards, -Arun. -- TF-M mailing list -- tf-m@lists.trustedfirmware.org To unsubscribe send an email to tf-m-leave@lists.trustedfirmware.org

Hi Antonio.

Is there another reason why "cmake --build cmake_build -- install" might still result in "sbrk.c:21: undefined reference to `end'" link time error? I have done a "git checkout 9d455a7" of the Git hash you mention in your patch as well as forced "#define _CC_PAL_LOG(level, format, ...)" to be nil, but am still seeing the link error.

Regards, -Arun.

Hi Antonio,

Following if any matter or can help: - If I build the same for the MPS2 AN521, I see no error - everything builds ok. - If I build for the Musca S1 without the "-DTEST_S=ON -DTEST_NS=ON" options, it builds ok, no linker error. - I am using the GCC compiler toolchain.

The entire error output when it does emit the 'sbrk' linker error is: /usr/lib/gcc/arm-none-eabi/10.3.1/../../../arm-none-eabi/bin/ld: /usr/lib/gcc/ arm-none-eabi/10.3.1/../../../arm-none- eabi/lib/thumb/v8-m.main/nofp/libnosys. a(sbrk.o): in function `_sbrk': /build/newlib-pB30de/newlib-3.3.0/build/arm-none-eabi/thumb/v8-m.main/nofp/ libgloss/libnosys/../../../../../../../libgloss/libnosys/sbrk.c:21: undefined reference to `end' Memory region Used Size Region Size %age Used FLASH: 228704 B 380 KB 58.77% RAM: 57148 B 256 KB 21.80% collect2: error: ld returned 1 exit status gmake[2]: *** [secure_fw/CMakeFiles/tfm_s.dir/build.make:366: bin/tfm_s.axf]

Regards, -Arun.

Thanks for your responses Antonio and David.

Not sure what exactly it was, but we were able to build the tests and run them on the MPS2 AN521 QEMU config. Per the Zephyr's build output following is the command line that seems to work. Mentioning it if it might help anyone else.

board=arm/mps2/an521 # or could be arm/musca_s1 CROSS_COMPILE=arm-none-eabi LAYOUTDIR="$TFMDIR/cmake_build/install/image_signing/layout_files/"

/home/zephyr/cmake/cmake-3.26.0-linux-x86_64/bin/cmake \ -S . -B cmake_build \ -DTFM_TOOLCHAIN_FILE=$TFMDIR/toolchain_GNUARM.cmake \ -DCROSS_COMPILE=$CROSS_COMPILE \ -DCMAKE_BUILD_TYPE=RelWithDebInfo \ -DTFM_PLATFORM=${board} \ -DCONFIG_TFM_BUILD_LOG_QUIET=OFF \ -DCONFIG_TFM_MEMORY_USAGE_QUIET=OFF \ -DCONFIG_TFM_SPM_BACKEND="IPC" \ -DBL2=TRUE \ -DMCUBOOT_IMAGE_VERSION_S="0.0.0+0" \ -DMCUBOOT_IMAGE_VERSION_NS="0.0.0+0" \ -DNS=TRUE \ -DTFM_ISOLATION_LEVEL=1 \ -DMCUBOOT_IMAGE_NUMBER=2 \ -DTFM_PARTITION_AUDIT_LOG=ON \ -DTFM_EXCEPTION_INFO_DUMP=ON \ -DTFM_PARTITION_LOG_LEVEL=TFM_PARTITION_LOG_LEVEL_DEBUG \ -DTFM_SPM_LOG_LEVEL=TFM_SPM_LOG_LEVEL_DEBUG \ -DTFM_PARTITION_NS_AGENT_MAILBOX=OFF \ -DTFM_PARTITION_PROTECTED_STORAGE=ON \ -DTFM_PARTITION_INTERNAL_TRUSTED_STORAGE=ON \ -DTFM_PARTITION_CRYPTO=ON \ -DTFM_PARTITION_PLATFORM=ON \ -DTFM_PARTITION_INITIAL_ATTESTATION=OFF \ -DTFM_PARTITION_FIRMWARE_UPDATE=OFF \ -DCRYPTO_RNG_MODULE_DISABLED=FALSE \ -DCRYPTO_KEY_MODULE_DISABLED=FALSE \ -DCRYPTO_AEAD_MODULE_DISABLED=FALSE \ -DCRYPTO_MAC_MODULE_DISABLED=FALSE \ -DCRYPTO_HASH_MODULE_DISABLED=FALSE \ -DCRYPTO_CIPHER_MODULE_DISABLED=FALSE \ -DCRYPTO_ASYM_SIGN_MODULE_DISABLED=FALSE \ -DCRYPTO_ASYM_ENCRYPT_MODULE_DISABLED=FALSE \ -DCRYPTO_KEY_DERIVATION_MODULE_DISABLED=FALSE \ -DCONFIG_TFM_ENABLE_FP=OFF \ -DTEST_S=ON \ -DTEST_NS=ON

cmake --build cmake_build -- install