Hi Anton

Thank you for your response.

Let me break it down a bit.

1. We have several subsystems running on the non-secure side that require certain sensitive metadata to be stored in ITS. 2. Default values of ITS parameters are insufficient. 3. While building the Zephyr app with TF-M, NS-side (during build) passes these overriding values to CMake, which adds the specified preprocessor definitions to the compiler flags of TF-M, ensuring they are available during compilation. 4. Zephyr already has the harness for this flow.

This entire flow currently doesn’t work if we don’t explicitly use these preprocessors in TF-M CMake files.

Using a custom profile is not feasible for us because the overriding values are provided by the NS side based on their specific needs.

Additionally, even when we attempt to provide these parameters through the command line while building only TF-M (without NS-side), we encounter the same warning: "Manually-specified variables were not used by the project."

This warning indicates that these parameters are not being utilized in the CMake scripts (which make sense).

I guess the question would be is there a way to override these parameters from command-line, while being platform agnostic? If not, is there any specific reason we chose not to, other than this approach could potentially override the platform specific configuration, like you suggested?

We would appreciate any guidance or suggestions on how to properly handle this scenario. If needed, we can discuss this further in the next TF-M Tech forum, like you suggested.

Regards

Saurabh

On 1/24/25, 12:47 PM, "Anton Komlev via TF-M" <tf-m@lists.trustedfirmware.org mailto:tf-m@lists.trustedfirmware.org> wrote:

Hi Saurabh,

If I understand you correctly, you're looking to modify the ITS_MAX_ASSET definition, which is a build-time option and cannot be changed post S-side build. Could you please explain your scenario for wanting to update it from the NS-side?

You're correct that a platform can redefine certain options which is intended behavior, allowing platforms to either override or verify these settings. For more details, you can refer to the TF-M configuration priorities here: https://trustedfirmware-m.readthedocs.io/en/latest/configuration/index.html#... https://trustedfirmware-m.readthedocs.io/en/latest/configuration/index.html#priorities.

The highest priority is the command line, which can override options even those defined in platforms. We should proceed cautiously with this approach, as there might be reasons why platforms alter the default configuration.

A recommended alternative is to create a custom profile and place all your options there, though some platforms might still overwrite them as expected.

We can discuss this further in the next TF-M Tech forum if you wish.

Hope that helps,

Anton

-----Original Message-----

From: Jain, Saurabh via TF-M <tf-m@lists.trustedfirmware.org mailto:tf-m@lists.trustedfirmware.org>

Sent: Thursday, January 23, 2025 7:47 PM

To: tf-m@lists.trustedfirmware.org mailto:tf-m@lists.trustedfirmware.org

Subject: [TF-M] Inquiry on Overriding ITS Parameters in TF-M via Zephyr

Hi All,

We are developing a platform using TF-M with Zephyr running on the Non-Secure (NS) side. As part of our requirements, we need to override certain ITS-related parameters, such as ITS_MAX_ASSET, from the NS side.

Zephyr provides a mechanism for this through Kconfig.tfm under modules/trusted-firmware-m, which includes symbols like TFM_ITS_MAX_ASSET_SIZE_OVERRIDE. When enabled, these configurations are passed to the TF-M build system via TFM_CMAKE_ARGS through CMake under modules/trusted-firmware-m. However, we observe that TF-M does not seem to support external overrides for these parameters. This results in the CMake warning:

"Manually-specified variables were not used by the project."

As a result, the overrides are ignored.

Currently, we address this by explicitly checking for external definitions of ITS_MAX_ASSET in platform-specific TF-M CMake files. While this works, it is platform-specific.

We would like to confirm:

1. Is there an existing platform-independent method to achieve such overrides that we may have missed?

2. If not, would the community be open to adding support for this functionality so it can be upstreamed and benefit other platforms?

Looking forward to your input.

Best regards,

Saurabh

--

TF-M mailing list -- tf-m@lists.trustedfirmware.org mailto:tf-m@lists.trustedfirmware.org To unsubscribe send an email to tf-m-leave@lists.trustedfirmware.org mailto:tf-m-leave@lists.trustedfirmware.org

--

TF-M mailing list -- tf-m@lists.trustedfirmware.org mailto:tf-m@lists.trustedfirmware.org

To unsubscribe send an email to tf-m-leave@lists.trustedfirmware.org mailto:tf-m-leave@lists.trustedfirmware.org