TF-M BL2 和 TFM_S 的配置和编译

文章目录

[BL2 和 TFM_S 的配置和编译](#BL2 和 TFM_S 的配置和编译)
- [flash 布局](#flash 布局)
- [配置 tfm](#配置 tfm)
- 编译
- [qemu 启动](#qemu 启动)

BL2 和 TFM_S 的配置和编译

前面介绍了 bl2 的启动文件，链接文件和启动流程等。

flash 布局

区域	Flash offset	物理地址	大小	用途
BL2	`0x00000000`	`0x10000000`	`0x80000`，512 KB	MCUboot bootloader
Primary image	`0x00080000`	`0x10080000`	`0x100000`，1 MB	Secure 和 Non-Secure 主镜像
Secondary image	`0x00180000`	`0x10180000`	`0x100000`，1 MB	Secure 和 Non-Secure 升级镜像
Scratch	`0x00280000`	`0x10280000`	`0x100000`，1 MB	镜像交换的临时区域
Protected Storage	`0x00380000`	`0x10380000`	`0x5000`，20 KB	PS 持久化数据
Internal Trusted Storage	`0x00385000`	`0x10385000`	`0x4000`，16 KB	ITS 持久化数据
OTP / NV counters	`0x00389000`	`0x10389000`	`0x2000`，8 KB	OTP 和安全计数器
未使用	`0x0038B000`	`0x1038B000`	468 KB	未分配空间

镜像区域的前 0x400 字节由 BL2 image header 使用，剩余空间存放镜像正文和 trailer。Secure 镜像的代码从 primary slot 的 offset + 0x400 开始，Non-Secure 镜像同理。

所以 tfm_s 的镜像是从 0x10080400 开始的。

配置 tfm

按照之前 bl2 + tfm_s 的配置命令如下

c 复制代码

cd "/home/tyustli/Desktop/tyustli/study/code/qemu/trust_firmware/tfm/code/trusted-firmware-m"
source env/bin/activate
cmake -S . -B build_an521_ninja -G Ninja \
    -DTFM_PLATFORM=arm/mps2/an521 \
    -DCMAKE_BUILD_TYPE=Debug \
    -DMCUBOOT_IMAGE_NUMBER=1 \
    -DTFM_PARTITION_CRYPTO=ON \
    -DTFM_PARTITION_INTERNAL_TRUSTED_STORAGE=ON \
    -DTFM_PARTITION_PROTECTED_STORAGE=ON \
    -DTFM_PARTITION_PLATFORM=ON

配置效果如下

c 复制代码

----------- Secure Partitions ------------------------
   Non-Secure Mailbox Agent                  OFF
   Protected Storage Partition               ON
   TF-M Internal Trusted Storage Partition   ON
   TFM Crypto Partition                      ON
   TFM Platform Partition                    ON
   TFM Initial Attestation Partition         OFF
   TFM Firmware Update Partition             OFF
------------------------------------------------------

如果想生成 compile_commands.json，供 clangd 等工具查询源文件的编译参数。可以使用如下命令

bash 复制代码

cmake -S . -B build_an521_make -DCMAKE_EXPORT_COMPILE_COMMANDS=ON

-S . 指定当前目录为源码目录。
-B build_an521_make 使用已有构建目录，保留其中的其他配置。
-DCMAKE_EXPORT_COMPILE_COMMANDS=ON 开启编译命令导出，生成 compile_commands.json，供 clangd 等工具查询源文件的编译参数。

编译

c 复制代码

cmake --build build_an521_ninja --target install

编译产物如下

c 复制代码

[58/73] Linking C executable bin/bl2.axf
Memory region         Used Size  Region Size  %age Used
           FLASH:       49352 B       512 KB      9.41%
             RAM:       25376 B         2 MB      1.21%
[66/73] Generating ../bin/secure_fw.hex
Merged: /home/tyustli/Desktop/tyustli/study/code/qemu/trust_firmware/tfm/code/trusted-firmware-m/build_an521_ninja/bin/secure_fw.hex
[68/73] Linking C executable bin/tfm_s.axf
Memory region         Used Size  Region Size  %age Used
           FLASH:      153984 B       511 KB     29.43%
             RAM:       45632 B         1 MB      4.35%
[71/73] Generating tfm_s_signed.bin, ../../../bin/tfm_s_signed.bin
wrapper.py: PSA key ids provided: 0x7fff816b
image.py: sign the payload
[72/73] Install the project...
-- Install configuration: "Debug"

从编译产物可以看到，同时生成了 bl2 和 tfm_s 两个固件。可以分别看下 bl2 和 tfm_s 的 elf 布局

查看 bl2 的布局

c 复制代码

arm-none-eabi-objdump -s -j .text build_an521_ninja/bin/bl2.elf | head -32

bl2 的布局如下

c 复制代码

 10000000 20530038 f5160010 9d140010 a3140010   S.8............
 10000010 a9140010 af140010 b5140010 bb140010  ................
 10000020 00000000 00000000 00000000 c1140010  ................
 10000030 c7140010 00000000 cd140010 d3140010  ................
 10000040 d9140010 df140010 e5140010 eb140010  ................
 10000050 f1140010 f7140010 fd140010 03150010  ................
 10000060 00000000 09150010 0f150010 15150010  ................

查看 tfm_s 的布局

c 复制代码

arm-none-eabi-objdump -s -j .TFM_VECTORS build_an521_ninja/bin/tfm_s.elf | head -32

tfm_s 的布局如下

c 复制代码

 10080400 f8150038 c1e60910 69200a10 a5220a10  ...8....i ..."..
 10080410 b5220a10 c5220a10 e5220a10 d5220a10  ."..."..."..."..
 10080420 00000000 00000000 00000000 5dfb0910  ............]...
 10080430 6f200a10 00000000 75200a10 7b200a10  o ......u ..{ ..
 10080440 81200a10 87200a10 8d200a10 93200a10  . ... ... ... ..
 10080450 99200a10 9f200a10 a5200a10 ab200a10  . ... ... ... ..
 10080460 00000000 b1200a10 b7200a10 bd200a10  ..... ... ... ..

bl2 从 0x10000000 开始
tfm_s 从 0x10080400 开始，前面 0x400 放 image header

qemu 启动

c 复制代码

qemu-system-arm \
    -M mps2-an521 \
    -cpu cortex-m33 \
    -nographic \
    -device loader,file="/home/tyustli/Desktop/tyustli/study/code/qemu/trust_firmware/tfm/code/trusted-firmware-m/build_an521_ninja/bin/bl2.hex" \
    -device loader,file="/home/tyustli/Desktop/tyustli/study/code/qemu/trust_firmware/tfm/code/trusted-firmware-m/build_an521_ninja/bin/tfm_s_signed.hex"

这里启动 bl2 + tfm_s

日志如下

c 复制代码

[INF] Starting bootloader
[INF] Beginning BL2 provisioning
[WRN] TFM_DUMMY_PROVISIONING is not suitable for production! This device is NOT SECURE
[INF] PSA Crypto init done, sig_type: EC-P256, using builtin keys
[INF] Image index: 0, Swap type: none
[INF] Bootloader chainload address offset: 0x80000
[INF] Image version: v2.3.0
[INF] Jumping to the first image slot
[NOT] Booting TF-M v2.3.0
[NOT] Built Thu 29 Oct 2026 09:12:54 UTC
[INF] Beginning TF-M provisioning
[WRN] TFM_DUMMY_PROVISIONING is not suitable for production! This device is NOT SECURE
[WRN] This device was provisioned with dummy keys. This device is NOT SECURE
[VER] Isolation level is: 1
Creating an empty ITS flash layout.
Creating an empty PS flash layout.
[INF] [Crypto] Provision entropy seed...
[INF] [Crypto] Provision entropy seed... complete.
[VER] [Crypto] Init TF-PSA-Crypto 1.1.0...
[VER] [Crypto] Internal heap size is 12288 bytes
[VER] [Crypto] Init TF-PSA-Crypto 1.1.0... complete.
[INF] [PS] Encryption alg: 0x5500200