Building and configuring TF-M

TF-M is one of the images that are built as part of a multi-image application.

To add TF-M to your build, enable the CONFIG_BUILD_WITH_TFM configuration option by adding it to your prj.conf file.

Note

If you use menuconfig to enable CONFIG_BUILD_WITH_TFM, you must also enable its dependencies.

By default, TF-M is built with the configurable version on all devices except the Thingy:91 and the Thingy:91 X which default to the minimal version.

Board targets supported by TF-M

The boards supported by the SDK distinguish entries according to which CPU is to be targeted (for multi-core SoCs) and whether the security by separation is to be used or not (addition of the */ns variant if it is used). To build with TF-M in the nRF Connect SDK, you must use a board target with the */ns variant.

The following table lists the board targets that you can use to build with TF-M. See Board support for the complete list of boards and board targets supported by the SDK.

Board targets supported by TF-M

Hardware platform

PCA number

Board name

TF-M board target

nRF9161 DK

PCA10153

nrf9161dk

nrf9161dk/nrf9161/ns

nRF9160 DK

PCA10090

nrf9160dk

nrf9160dk/nrf9160/ns

nRF9151 DK

PCA10171

nrf9151dk

nrf9151dk/nrf9151/ns

nRF9131 EK

PCA10165

nrf9131ek

nrf9131ek/nrf9131/ns

nRF54LV10 DK

PCA10188

nrf54lv10dk

nrf54lv10dk/nrf54lv10a/cpuapp/ns

nRF54LM20 DK

PCA10184

nrf54lm20dk
nrf54lm20dk/nrf54lm20a/cpuapp/ns
nrf54lm20dk/nrf54lm20b/cpuapp/ns

nRF54L15 DK

PCA10156

nrf54l15dk

nrf54l15dk/nrf54l15/cpuapp/ns

nRF54L10 emulated on the nRF54L15 DK

PCA10156

nrf54l10dk/nrf54l10

nrf54l15dk/nrf54l10/cpuapp/ns

nRF5340 DK

PCA10095

nrf5340dk

nrf5340dk/nrf5340/cpuapp/ns

Thingy:53

PCA20053

thingy53

thingy53/nrf5340/cpuapp/ns

nRF7002 DK

PCA10143

nrf7002dk

nrf7002dk/nrf5340/cpuapp/ns

Thingy:91

PCA20035

thingy91

thingy91/nrf9160/ns

Thingy:91 X

PCA20065

thingy91x

thingy91x/nrf9151/ns

Enabling secure services

To enable the secure services in TF-M, you must use the TF-M Crypto Service PSA Crypto API implementation.

Complete the following steps to enable the secure services in TF-M:

  1. Enable CONFIG_PSA_CRYPTO to use the PSA Crypto API through nRF Security.

  2. Configure PSA Crypto API Kconfig options.

  3. Build the application for a board target supported by TF-M with Minimal build or Configurable build.

After building the application, the TF-M secure image enables the use of the hardware acceleration, while the Kconfig configurations in the nRF Security subsystem control the features enabled in TF-M.

See Crypto service for more information about the TF-M Crypto partition.

Note

Depending on the implementation you are using, the nRF Connect SDK build system uses different versions of the PSA Crypto API.

PSA Crypto API versions by implementation

Implementation

PSA Crypto API version

Oberon PSA Crypto

v1.4.1

TF-M Crypto Service

v1.4.1

IronSide Secure Enclave

v1.4.1

Minimal build

The default configuration of TF-M has all supported features enabled, which results in a significant memory footprint. For this reason, the nRF Connect SDK provides a minimal version of the TF-M secure application, which shows how to configure a reduced version of TF-M.

The secure services supported by the minimal version allow for:

  • Generating random numbers using the random generator available in the device (see psa_generate_random() in crypto.h).

  • Using the platform services with tfm_platform_api.h from the non-secure side (except the tfm_platform_nv_counter_* functions). This includes sending platform-specific service requests using tfm_ioctl_core_api.h and tfm_ioctl_api.h.

  • Reading secure memory from the non-secure application (strictly restricted to a list of allowed addresses). Depending on the device, this lets you read metadata in the bootloader, verify FICR or UICR values, or access a peripheral that is secure-only.

  • Rebooting from the non-secure side.

The minimal build uses an image of 32 kB. It is set with the CONFIG_TFM_PROFILE_TYPE_MINIMAL Kconfig option that is enabled by default on the Thingy:91 and Thingy:91 X devices.

With the minimal build, the configuration of TF-M is severely limited. The only configurable option is to enable a security service for cryptographic hashes. For example, you can enable the PSA_WANT_ALG_SHA_256 Kconfig option to provide SHA-256 support using TF-M.

Configurable build

The configurable build is the full TF-M implementation that lets you configure all of its features. It does not have the constraints of the minimal build.

To enable the configurable, full TF-M build, make sure the following Kconfig options are configured:

For description of the build profiles, see TF-M Profiles. It is not recommended to use predefined TF-M profiles as they might result in a larger memory footprint than necessary.

Configuring TF-M profile type and partitions

When the CONFIG_TFM_PROFILE_TYPE_NOT_SET Kconfig option is enabled, the build process will not set a specific TF-M profile type. This allows for a more flexible configuration where individual TF-M features can be enabled or disabled as needed. It also provides more control over the build process and allows for a more fine-grained configuration of the TF-M secure image.

To configure the features of the TF-M secure image, you must choose which TF-M partitions and which secure services to include in the build.

Note

A “TF-M partition” in this context refers to a secure partition within the Trusted Firmware-M architecture. These partitions are isolated from each other and from the non-secure application code. A service running inside TF-M would typically be implemented within one of these secure partitions.

For more information about the TF-M partitions, see TF-M memory partitioning.

Each service can be a separate partition, or multiple related services might be grouped into a single partition. The partition provides the execution environment for the service. It handles secure function calls and ensures that the service’s code and data are protected from unauthorized access.

Following are the available Kconfig options for TF-M partitions:

Available TF-M Partitions

Option name

Description

Default value

Dependencies

CONFIG_TFM_PARTITION_PLATFORM

Provides Platform service.

Enabled

CONFIG_TFM_PARTITION_CRYPTO

Provides Crypto service.

Enabled

CONFIG_TFM_PARTITION_PROTECTED_STORAGE

Provides Protected Storage service.

Enabled

PLATFORM, CRYPTO

CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE

Provides Internal Trusted Storage service.

Enabled

CONFIG_TFM_PARTITION_INITIAL_ATTESTATION

Provides Initial Attestation service.

Disabled

CRYPTO

Configuring Secure Partition Manager backend

TF-M’s Secure Partition Manager (SPM) is responsible for managing the secure partitions and the secure services.

Depending on the isolation requirements of the application, you can configure the SPM backend to use. The following table lists the available SPM backends and the isolation levels they support:

SPM backends

Backend

Option

Description

Allowed isolation levels

Secure Function (SFN)

CONFIG_TFM_SFN

With SFN, the Secure Partition is made up of a collection of callback functions that implement secure services.

Level 1

Inter-Process Communication (IPC)

CONFIG_TFM_IPC

With IPC, each Secure Partition processes signals in any order, and can defer responding to a message while continuing to process other signals.

Levels 1, 2 and 3

Configuring SPM logging

To control the number of logging messages, set the CONFIG_TFM_SPM_LOG_LEVEL Kconfig option. To disable logging, set the CONFIG_TFM_LOG_LEVEL_SILENCE option.