文章目录
- BL2 和 TFM_S 的配置和编译
- flash 布局
- 配置 tfm
- 编译
- qemu 启动
BL2 和 TFM_S 的配置和编译
前面介绍了 bl2 的启动文件，链接文件和启动流程等。
flash 布局
| 区域 | Flash offset | 物理地址 | 大小 | 用途 |
|---|---|---|---|---|
| BL2 | 0x00000000 | 0x10000000 | 0x80000，512 KB | MCUboot bootloader |
| Primary image | 0x00080000 | 0x10080000 | 0x100000，1 MB | Secure 和 Non-Secure 主镜像 |
| Secondary image | 0x00180000 | 0x10180000 | 0x100000，1 MB | Secure 和 Non-Secure 升级镜像 |
| Scratch | 0x00280000 | 0x10280000 | 0x100000，1 MB | 镜像交换的临时区域 |
| Protected Storage | 0x00380000 | 0x10380000 | 0x5000，20 KB | PS 持久化数据 |
| Internal Trusted Storage | 0x00385000 | 0x10385000 | 0x4000，16 KB | ITS 持久化数据 |
| OTP / NV counters | 0x00389000 | 0x10389000 | 0x2000，8 KB | OTP 和安全计数器 |
| 未使用 | 0x0038B000 | 0x1038B000 | 468 KB | 未分配空间 |
镜像区域的前0x400字节由 BL2 image header 使用，剩余空间存放镜像正文和 trailer。Secure 镜像的代码从 primary slot 的offset + 0x400开始，Non-Secure 镜像同理。
所以 tfm_s 的镜像是从0x10080400开始的。
配置 tfm
按照之前bl2 + tfm_s的配置命令如下
cd"/home/tyustli/Desktop/tyustli/study/code/qemu/trust_firmware/tfm/code/trusted-firmware-m"source env/bin/activate cmake-S.-B build_an521_ninja-G Ninja \-DTFM_PLATFORM=arm/mps2/an521 \-DCMAKE_BUILD_TYPE=Debug \-DMCUBOOT_IMAGE_NUMBER=1\-DTFM_PARTITION_CRYPTO=ON \-DTFM_PARTITION_INTERNAL_TRUSTED_STORAGE=ON \-DTFM_PARTITION_PROTECTED_STORAGE=ON \-DTFM_PARTITION_PLATFORM=ON配置效果如下
-----------Secure Partitions------------------------Non-Secure Mailbox Agent OFF Protected Storage Partition ON TF-M Internal Trusted Storage Partition ON TFM Crypto Partition ON TFM Platform Partition ON TFM Initial Attestation Partition OFF TFM Firmware Update Partition OFF------------------------------------------------------如果想生成compile_commands.json，供 clangd 等工具查询源文件的编译参数。可以使用如下命令
cmake-S.-Bbuild_an521_make-DCMAKE_EXPORT_COMPILE_COMMANDS=ON-S .指定当前目录为源码目录。-B build_an521_make使用已有构建目录，保留其中的其他配置。-DCMAKE_EXPORT_COMPILE_COMMANDS=ON开启编译命令导出，生成compile_commands.json，供 clangd 等工具查询源文件的编译参数。
编译
cmake--build build_an521_ninja--target install编译产物如下
[58/73]Linking C executable bin/bl2.axf Memory region Used Size Region Size%age Used FLASH:49352B512KB9.41%RAM:25376B2MB1.21%[66/73]Generating../bin/secure_fw.hex Merged:/home/tyustli/Desktop/tyustli/study/code/qemu/trust_firmware/tfm/code/trusted-firmware-m/build_an521_ninja/bin/secure_fw.hex[68/73]Linking C executable bin/tfm_s.axf Memory region Used Size Region Size%age Used FLASH:153984B511KB29.43%RAM:45632B1MB4.35%[71/73]Generating tfm_s_signed.bin,../../../bin/tfm_s_signed.bin wrapper.py:PSA key ids provided:0x7fff816bimage.py:sign the payload[72/73]Install the project...--Install configuration:"Debug"从编译产物可以看到，同时生成了 bl2 和 tfm_s 两个固件。可以分别看下 bl2 和 tfm_s 的 elf 布局
查看 bl2 的布局
arm-none-eabi-objdump-s-j.text build_an521_ninja/bin/bl2.elf|head-32bl2 的布局如下
1000000020530038f51600109d140010 a3140010 S.8............10000010a9140010 af140010 b5140010 bb140010................10000020000000000000000000000000c1140010................10000030c714001000000000cd140010 d3140010................10000040d9140010 df140010 e5140010 eb140010................10000050f1140010 f7140010 fd14001003150010................1000006000000000091500100f15001015150010................查看 tfm_s 的布局
arm-none-eabi-objdump-s-j.TFM_VECTORS build_an521_ninja/bin/tfm_s.elf|head-32tfm_s 的布局如下
10080400f8150038 c1e6091069200a10 a5220a10...8....i..."..10080410b5220a10 c5220a10 e5220a10 d5220a10."..."..."..."..100804200000000000000000000000005dfb0910............]...100804306f200a100000000075200a107b200a10 o......u..{..1008044081200a1087200a108d200a1093200a10............1008045099200a109f200a10 a5200a10 ab200a10............1008046000000000b1200a10 b7200a10 bd200a10.............- bl2 从 0x10000000 开始
- tfm_s 从 0x10080400 开始，前面 0x400 放 image header
qemu 启动
qemu-system-arm \-M mps2-an521 \-cpu cortex-m33 \-nographic \-device loader,file="/home/tyustli/Desktop/tyustli/study/code/qemu/trust_firmware/tfm/code/trusted-firmware-m/build_an521_ninja/bin/bl2.hex"\-device loader,file="/home/tyustli/Desktop/tyustli/study/code/qemu/trust_firmware/tfm/code/trusted-firmware-m/build_an521_ninja/bin/tfm_s_signed.hex"这里启动 bl2 + tfm_s
日志如下
[INF]Starting bootloader[INF]Beginning BL2 provisioning[WRN]TFM_DUMMY_PROVISIONING is not suitableforproduction!This device is NOT SECURE[INF]PSA Crypto init done,sig_type:EC-P256,using builtin keys[INF]Image index:0,Swap type:none[INF]Bootloader chainload address offset:0x80000[INF]Image version:v2.3.0[INF]Jumping to the first image slot[NOT]Booting TF-M v2.3.0[NOT]Built Thu29Oct202609:12:54UTC[INF]Beginning TF-M provisioning[WRN]TFM_DUMMY_PROVISIONING is not suitableforproduction!This device is NOT SECURE[WRN]This device was provisioned with dummy keys.This device is NOT SECURE[VER]Isolation level is:1Creating an empty ITS flash layout.Creating an empty PS flash layout.[INF][Crypto]Provision entropy seed...[INF][Crypto]Provision entropy seed...complete.[VER][Crypto]Init TF-PSA-Crypto1.1.0...[VER][Crypto]Internal heap size is12288bytes[VER][Crypto]Init TF-PSA-Crypto1.1.0...complete.[INF][PS]Encryption alg:0x5500200
