Samples or documentation to add a custom service with TF-M

[ske]

Hello,
 
We are developing a library which is intended to use the trustzone feature (TF-M based) available with nrf5340 DK. i.e., CONFIG_BUILD_WITH_TFM=y

Here, we would like to provide our own non secure callable APIs with TFM similar to what is explained in Using a custom Secure Partition Manager with your application for SPM.
 
Is it possible to add a custom service with tfm(i.e., CONFIG_BUILD_WITH_TFM=y)? Could you please point to any samples or documentation which could help?

[Raoul]

Hi again,

This TF-M Secure Peripheral Partition sample is the relevant one for your use case: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/2.2.0/nrf/samples/tfm/tfm_secure_peripheral/README.html

One of my colleagues has also written a blog post explaining more about custom TF-M services:  

 An Introduction to Trusted Firmware-M (TF-M)

I hope this is of help.

Best regards,

Raoul

[ske]

Hello,

Thanks for the clarification.

From further reading tfm_secure_partition_addition, my understanding is that nrf connect sdk does not have support for TFM with SFN model. When checked for the CONFIG_TFM_SFN in Kconfig reference, I could find it from kconfig_sfn. However, I could not find the CONFIG_TFM_SFN in nrf connect sdk environment.

Could you please confirm that nrf connect sdk do not have the support for TFM in SFN mode today? If so, is there any plan to support this in near future?

[ske]

Hello,

After upgrading the nrf connect sdk from v1.9.1 to v2.2.0, I could find the CONFIG_TFM_SFN in Kconfig from nrf connect sdk v2.2.0. When I check the samples for TFM in SFN model, I could not find it. I should have checked it earlier. Sorry.

However, I could not find any sample tests which explains the usage of TFM in SFN mode. Could you please help to share any samples which can be referred to use TF-M in SFN model?

[Raoul]

Hi Sabari, I'm back on this case. Thanks for waiting.

I tried building a TF-M sample with the SFN Kconfig option enabled, and hit an error:

SFN backend does not support IPC Partitions:
['TFM_SP_PLATFORM']

There's also very little information on the use of SFN, I'm suspecting that support for SFN is still a work-in-progress.

I've asked the developers and will get back to you when I get an answer.

Best regards,

Raoul

[Raoul]

Hi again,

I just heard from the developers, regarding the error I encountered, and support for SFN:

It's not supported in the version of TF-M that we have, unfortunately this means it is not very usable currently as the platform partition is quite fundamental.

I expect support for SFN and the TF-M "Small" Profile to improve in the coming versions of NCS, but for now I'm afraid we don't have any samples or documentation for this.

For something similar, you can check out the TF-M Library model. https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/kconfig/index.html#CONFIG_TFM_LIBRARY

It is similiarly "lighter weight" than the IPC model. The IPC model has an associated sample: https://docs.zephyrproject.org/2.7.0/samples/tfm_integration/tfm_ipc/README.html but it is nowadays the default model, so you need to use the CONFIG_TFM_LIBRARY to use the library model.

Best regards,

Raoul