| ####### |
| Roadmap |
| ####### |
| |
| TF-M has been under active development since it was launched in Q1'18. It is |
| being designed to include |
| |
| 1. Secure boot ensuring integrity of runtime images and responsible for firmware upgrade. |
| 2. Runtime firmware consisting of TF-M Core is responsible for secure isolation, |
| execution and communication aspects. and a set of Secure Services providing |
| services to the Non-Secure and Secure Applications. The secures services |
| currently supported are Secure Storage, Cryptography, Firmware Update, |
| Attestation and Platform Services |
| |
| If you are interested in collaborating on any of the roadmap features or other |
| features, please mail TF-M mailing list |
| |
| ****************** |
| Supported Features |
| ****************** |
| - PSA Firmware Framework v1.0, 1.1 Extension including IPC and SFN modes. |
| - PSA Level1, 2 and 3 Isolation. |
| - Secure Boot (mcuboot upstream) including generic fault injection mitigations |
| - PSA Protected Storage, Internal Trusted Storage v1.0 and Encrypted ITS |
| - PSA Cryptov1.0 (uses Mbed TLS v3.4.0) |
| - PSA Initial Attestation Service v1.0 |
| - PSA Firmware Update v1.0 |
| - PSA ADAC Specification Implementation |
| - Base Config, kconfig based configuration |
| - Profile Small, Medium, ARoT-less Medium, Large |
| - Secure Partition Interrupt Handling, Pre-emption of SPE execution |
| - Dual CPU |
| - Open Continuous Integration (CI) System |
| - Boot and Runtime Crypto Hardware Integration |
| - Fault Injection Handling library to mitigate against physical attacks |
| - Threat Model |
| - Arm v8.1-M Privileged Execute Never (PXN) attribute and Thread reentrancy disabled (TRD) |
| - FPU, MVE Support |
| - CC-312 PSA Cryptoprocessor Driver Interface |
| - Secure Storage - Key Diversification Enhancements |
| - Build System - Separate Secure and Non-Secure builds |
| - PSA Crypto layer for mcuboot/BL2 |
| - Support LLVM Embedded Toolchain for Arm |
| - MISRA testing/documentation |
| - Switch to using upstream t_cose |
| - Remote Test Infrastructure |
| |
| ****** |
| CQ2'25 |
| ****** |
| - Supporting multiple clients (Hybrid Platforms) i.e. TF-M supporting multiple on |
| core and off core clients on heterogeneous (e.g. Cortex-A + Cortex-M platforms) |
| - TF-M v2.2.0 release |
| - Update to Mbed TLS3.6.3 |
| |
| ****** |
| Future |
| ****** |
| - Integrate TF-PSACrypto |
| - TF-M v2.3.0 |
| - Image encryption via. PSA Crypto in mcuboot |
| - Implement support for multiple clients (Hybrid Platforms) contd. |
| - Build System Enhancements - Simplify build scripts |
| - TF-M Performance - Further Benchmarking and Optimization |
| - Scheduler - Multiple Secure Context Implementation |
| - PSA FWU Service Enhancements |
| - PSA ADAC Spec - Enhancements and Testing |
| - Arm v8.1-M Unprevileged Debug |
| - [Secure Storage] Extended PSA APIs |
| - [Audit Logs] Secure Storage, Policy Manager |
| - PSA FF Lifecycle API |
| - Fuzz Testing |
| |
| -------------- |
| |
| *Copyright (c) 2017-2024, Arm Limited. All rights reserved.* |