Building standalone library without any TFM dependencies on nrf5340 TFM secure environment

[ske]

Hello,

We are developing a library which uses the psa crypto features for key storage and few other crypto operations which is expected to be integrated on nrf5340 secure environment.

The communication between NSE and SE will be over TFM-IPC. Our intention is to deliver the source code as a library which can be integrated a partner company using nordic connect SDK. Due to this, we would like to build our library without any TFM dependencies so that when the partner upgrades the ncs version with an upgrade of TFM, we do not need to redeliver.

However, we fail to build our source code as a standalone library when building part of TFM. Do you have any integration guidelines for such a use case?

Thanks & Regards,
Sabari

[Didrik Rokhaug]

Hi,

Just to make sure I understood your question correctly:

You are developing a library, that will run in the non-secure domain, which uses some TF-M functionality. But, because you don't want to build a new library for each TF-M version, you do not want to depend on any TF-M symbols.

Does that accurately sum up your question?

If so, I would make a wrapper around the TF-M functionality that you use, and use the wrapper in the library. Then, you instruct the users how to implement the glue layer. This solution is similar to what we do for out modem library for the nRF9160. The library itself is OS agnostic, but requires some support from the OS/runtime, which means that the users of the modem library have to implement a glue layer between the library and the OS they are using.

You can see how we document this here: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/2.2.0/nrfxlib/nrf_modem/doc/ug_nrf_modem_porting_os.html#os-abstraction-layer

Best regards,

Didrik