modules: avoid fetching external repo in TF-M

What is changed?
 - Use the updated TF-M that is compatible with the Zephyr's
   latest Ethos-U driver repo.
 - Change the default behavior of TF-M builds to use Ethos driver
   locally fetched by Zephyr, using west update, instead of
   downloading it from external repo.

Why is this change required?
 - This is to be inline with Zephyr's rules to not fetch code from
   external repo.

Fixes #81656

Signed-off-by: Sudan Landge <sudan.landge@arm.com>

modules/trusted-firmware-m/CMakeLists.txt

@@ -253,6 +253,8 @@ if (CONFIG_BUILD_WITH_TFM)
 
   list(APPEND TFM_CMAKE_ARGS -DTFM_TESTS_REVISION_CHECKS=OFF)
 
+  list(APPEND TFM_CMAKE_ARGS -DETHOS_DRIVER_PATH=${CONFIG_TFM_ETHOS_DRIVER_PATH_LOCAL})
+
   file(MAKE_DIRECTORY ${TFM_BINARY_DIR})
   add_custom_target(tfm_cmake
     DEPENDS ${TFM_BINARY_DIR}/CMakeCache.txt

modules/trusted-firmware-m/Kconfig.tfm

@@ -310,6 +310,17 @@ config TFM_MCUBOOT_PATH_DOWNLOAD
 
 endchoice
 
+config TFM_ETHOS_DRIVER_PATH_LOCAL
+	string "Path to a locally available Ethos-U driver or an empty string"
+	default "${ZEPHYR_HAL_ETHOS_U_MODULE_DIR}"
+	help
+	  Path to a locally available Ethos-U driver to be used for TF-M builds or
+	  an empty string to allow TF-M to automatically fetch the Ethos-U
+	  driver from an external repository at build time.
+	  By default Zephyr's Ethos-U driver will be used. It is present in
+	  the hal_ethos_u module.
+	  Alternatively, applications can point to their own paths for Ethos-U driver.
+
 config TFM_QCBOR_PATH
 	string
 	prompt "Path to QCBOR or DOWNLOAD to fetch automatically"

west.yml

@@ -353,7 +353,7 @@ manifest:
       groups:
         - tee
     - name: trusted-firmware-m
-      revision: fa020a8b001843bb5a115bc4692eaf6787e3d1de
+      revision: 3fb1f9e536b8fae5879c482ddd0f728052c3b509
       path: modules/tee/tf-m/trusted-firmware-m
       groups:
         - tee