Currently the TFM_LVL define is passed to the secure services build by the cmake system. Currently this define is not used by the services, and it is recommended by the Platform Security Architecture Firmware Framework specification that services should be written to support the most strict, level 3 isolation, in which case there is no need to know the actual isolation level.

So the TFM_LVL define should not be passed to the compiler when building secure services.