How to disable default SPM sample and use the customized SPM firmware instead

RE: How to disable default SPM sample and use the customized SPM firmware instead

Simon — Wed, 10 Nov 2021 13:51:05 GMT

[quote user="duyanh.y4n"]

- When I built the custom SPM app (located in /path/to/my/custom_spm_app/), the custom SPM module is loaded and executed in the final firmware.

- When I built the other app or sample (for example, zephyr/samples/hello_world), the default nrf's SPM sample is loaded and executed in the final firmware.

[/quote][quote user="duyanh.y4n"]Can you confirm if this behavior is expected with the overall default configurations of NCS? (I haven't had much experience with multiple image build and the partition manager module yet)[/quote]

This should be the expected result. If you look in the CMakeLists.txt of custom_spm_app\application, the custom SPM will be added as an extra module (which will override the default one). In the default hello world sample, there are no such instructions in the CMakeLists.txt and if you build it with a non-secure board the default SPM will be used.

Best regards,

Simon

RE: How to disable default SPM sample and use the customized SPM firmware instead

duyanh.y4n — Mon, 08 Nov 2021 09:47:41 GMT

Thanks, Simon,

the approach you suggested is ok, still, we don't want to fork anything, because we don't want to spend too much time managing the dependencies ourselves.

So in the end, I've tried the custom SPM build as the above guide with some output printing tests. I've added, for example, "Hello SPM samples" to the nrf's sample (in <workspace>/nrf/samples/spm/src/main.c) like this:

// nrf/samples/spm/main.c

#include <spm.h>
#include <zephyr.h>


void main(void)
{
    printk("Hello from SPM sample\n");
	spm_config();
	spm_jump();
}

On the other hand, I've modified my custom SPM source with the same code (but with a different print message) like this:

// /path/to/my/custom_spm_app/spm_module/zephyr/spm/src/main.c
#include <spm.h>
#include <zephyr.h>

void main(void)
{
    printk("Hello secure firmware\n");
	spm_config();
	spm_jump();
}

Custom app project tree:

<workspace>
└── custom_spm_app
    ├── application
    │   ├── prj.conf
    │   └── src
    │       └── main.c
    └── spm_module
            ├── CMakeLists.txt
            ├── module.yml
            └── spm
                ├── boards
                │   └── nrf9160dk_nrf9160.conf
                ├── CMakeLists.txt
                ├── nrf9160dk_nrf9160.overlay
                ├── pm.yml
                ├── prj.conf
                ├── README.rst
                ├── sample.yaml
                └── src
                    └── main.c

So the results are as follows:

- When I built the custom SPM app (located in /path/to/my/custom_spm_app/), the custom SPM module is loaded and executed in the final firmware.

- When I built the other app or sample (for example, zephyr/samples/hello_world), the default nrf's SPM sample is loaded and executed in the final firmware.

So, in conclusion, these SPM images are not loaded together (according to my initial question above). In fact, the default SPM was overwritten with the custom SPM module, and I guess it was because that they both have the same child image name (defined in CMakeLists), and the customize SPM module is configured on the application top level.

# in path/to/custom_spm_app/spm_module/zephyr/CMakeLists.txt
if(CONFIG_SPM)
set(spm_CONFIG_SPM_SECURE_SERVICES ${CONFIG_SPM_SECURE_SERVICES})
add_child_image_from_source(
  NAME spm
  SOURCE_DIR ${CMAKE_CURRENT_LIST_DIR}/spm
  )
endif()

# in nrf/samples/CMakeLists.txt
if(CONFIG_SPM)

# other configs...

set(spm_CONFIG_SPM_SECURE_SERVICES ${CONFIG_SPM_SECURE_SERVICES})
add_child_image_from_source(
  NAME spm
  SOURCE_DIR ${CMAKE_CURRENT_LIST_DIR}/spm
  )
  
# other configs...

endif()

Can you confirm if this behavior is expected with the overall default configurations of NCS? (I haven't had much experience with multiple image build and the partition manager module yet)

If yes, then I think it is good for my use case and I can safely replace the default SPM sample.

RE: How to disable default SPM sample and use the customized SPM firmware instead

Simon — Fri, 05 Nov 2021 16:10:29 GMT

I did answer a similar question some time ago, concerning the mcuboot. Check it out here: https://devzone.nordicsemi.com/f/nordic-q-a/72387/suggestions-for-customizing-ncs-immutable-and-mcuboot-boot-loaders

Does the suggested solution in that ticket work for you?