TF-M has been under active development since it was launched in Q1'18. It is being designed to include 1. //**Secure boot**// ensuring integrity of runtime images and responsible for firmware upgrade. 2. Runtime firmware consisting of //** TF-M Core**// responsible for secure isolation, execution and communication aspects. and a set of Secure Services providing services to the Non-Secure and Secure Applications. The secures services currently planned to be supported are //**Secure Storage, Cryptography, Audit Logs, Attestation, Provisioning and Platform Services**// Roadmap below shows when the services are getting supported and then enhanced. Currently Supported Features - [[ http://git.trustedfirmware.org/trusted-firmware-m.git/tree/bl2/ext/mcuboot | Secure Boot]] - [[ https://developer.trustedfirmware.org/w/tf_m/design/ipc_design/ | TF-M Core - Inter Process Communication (IPC)]] - [[ http://git.trustedfirmware.org/trusted-firmware-m.git/tree/docs/user_guides/services/tfm_sst_integration_guide.md | Secure Storage]] - [[ http://git.trustedfirmware.org/trusted-firmware-m.git/tree/docs/user_guides/services/tfm_audit_integration_guide.md | Audit Logs]] - [[ https://git.trustedfirmware.org/trusted-firmware-m.git/tree/docs/user_guides/services/tfm_crypto_integration_guide.md | Crypto Secure Service]] - [[ https://git.trustedfirmware.org/trusted-firmware-m.git/tree/docs/user_guides/services/tfm_attestation_integration_guide.md | Initial Attestation Service ]] [[ https://developer.trustedfirmware.org/w/tf_m/design/secure_partition_interrupt_handling/ | Secure Partition Interrupt Handling ]] - [Platform] Reset Service - [Attestation] EAT (Entity Attestation Token) - CBOR, COSE Integration. PSA Compliance - [Crypto] PSA API Compliance - [Secure Storage] PSA API Implementation CQ2'19 - [TF-M Core] [[ https://developer.trustedfirmware.org/w/tf_m/design/trusted_firmware-m_isolation_level_2/ | PSA Level2 Isolation ]] - [Secure Storage] Compatible with PSA Firmware Framework IPC - [Crypto] Compatible with PSA Firmware Framework IPC - [Attestation] Compatible with PSA Firmware Framework IPC - [Secure Boot] [[ https://developer.trustedfirmware.org/w/tf_m/design/trusted_boot/rollback_protection/ | Rollback Protection ]] - [TF-M Core] Secure Interrupt Handling - [TF-M Core] Pre-emption of SPE execution - Dual v7-M Enablement - Open Continuous Integration (CI) System - [Crypto] Migrate to mbedcrypto CQ3'19 - [TF-M Core] Multiple Secure Context, Interrupt Handling - [Storage] Crypto Binding - Dual v7-M Hardening - Boot and Runtime Crypto Hardware Integration - [Secure Boot] Multiple Image Update - [Secure Storage] Extended PSA APIs - [Secure Storage] Key Diversification Enhancements Future - [Platform] NV Count, Timer - [Platform] Secure Time - Secure Debug Investigation - [Provisioning] Initial Investigation/API Prototype - [Secure Boot] Key Revocation - [Secure Storage] Support Internal Trusted Storage PSA APIs - [Secure Storage] Lifecycle Management - [Crypto] RNG, KDF - [Audit Logs] Secure Storage, Policy Manager - [Platform] GPIO, Debug, NONCE - Secure Debug Prototype

TF-M has been under active development since it was launched in Q1'18. It is being designed to include 1. //**Secure boot**// ensuring integrity of runtime images and responsible for firmware upgrade. 2. Runtime firmware consisting of //** TF-M Core**// responsible for secure isolation, execution and communication aspects. and a set of Secure Services providing services to the Non-Secure and Secure Applications. The secures services currently supported are //**Secure Storage, Cryptography, Firmware Update, Attestation and Platform Services**// If you are interested in collaborating on any of the roadmap features or other features, please mail TF-M [[ https://lists.trustedfirmware.org/mailman3/lists/tf-m.lists.trustedfirmware.org/ | mailing list ]] Supported Features - PSA Firmware Framework v1.0, 1.1 Extension including IPC and SFN modes. - PSA Level1, 2 and 3 Isolation. - Secure Boot (mcuboot upstream) including generic fault injection mitigations - PSA Protected Storage, Internal Trusted Storage v1.0 and Encrypted ITS - PSA Cryptov1.0 (uses Mbed TLS v3.4.0) - PSA Initial Attestation Service v1.0 - PSA Firmware Update v1.0 - PSA ADAC Specification Implementation - Base Config - kconfig based configuration - Profile Small, Medium, ARoT-less Medium, Large - Secure Partition Interrupt Handling, Pre-emption of SPE execution - Platform Reset Service - Dual CPU - Open Continuous Integration (CI) System - Boot and Runtime Crypto Hardware Integration - Fault Injection Handling library to mitigate against physical attacks - Threat Model - Arm v8.1-M Privileged Execute Never (PXN) attribute and Thread reentrancy disabled (TRD) - FPU, MVE Support - CC-312 PSA Cryptoprocessor Driver Interface CQ4'23 - TF-M v1.9 release - Mbed TLS 3.5.0, mcuboot 2.0.0 Integration - Design, prototype: Supporting multiple clients i.e. TF-M supporting multiple on core and off core clients on Hetrogeneous (e.g. Cortex-A + Cortex-M platforms) - Demonstrating TLS in Non-Secure using PSA Crypto APIs in TF-M - Build System Enhancements - Separate Secure, Non-Secure Builds - Mailbox interrupt handling Future: - Long Term Stable (LTS) support - Implement support for multiple clients - Remote Test Infrastructure - MISRA testing - TF-M Performance - Further Benchmarking and Optimization - Scheduler - Multiple Secure Context Implementation - Arm v8.1-M Architecture Enablement - PAC/BTI - PSA FWU Service Enhancements - PSA ADAC Spec - Enhancements and Testing - Arm v8.1-M Unprevileged Debug - [Secure Storage] Extended PSA APIs, Key Diversification Enhancements - [Audit Logs] Secure Storage, Policy Manager - PSA FF Lifecycle API - Fuzz Testing

TF-M has been under active development since it was launched in Q1'18. It is being designed to include 1. //**Secure boot**// ensuring integrity of runtime images and responsible for firmware upgrade. 2. Runtime firmware consisting of //** TF-M Core**// responsible for secure isolation, execution and communication aspects. and a set of Secure Services providing services to the Non-Secure and Secure Applications. The secures services currently planned to be supported are //**Secure Storage, Cryptography, Audit Logs, AttestationFirmware Update, ProvisioningAttestation and Platform Services**// Roadmap below shows when the services are getting supported and then enhanced. Currently If you are interested in collaborating on any of the roadmap features or other features, please mail TF-M [[ https://lists.trustedfirmware.org/mailman3/lists/tf-m.lists.trustedfirmware.org/ | mailing list ]] Supported Features - [[ http://git.trustedfirmware.org/trusted-firmware-m.git/tree/bl2/ext/mcuboot | Secure Boot]] - [[ https://developer.trustedfirmware.org/w/tf_m/design/ipc_design/ | TF-M Core - Inter Process Communication (IPC)]]PSA Firmware Framework v1.0, 1.1 Extension including IPC and SFN modes. - [[ http://git.trustedfirmware.org/trusted-firmware-m.git/tree/docs/user_guides/services/tfm_sst_integration_guide.md | Secure Storage]]PSA Level1, 2 and 3 Isolation. - [[ http://git.trustedfirmware.org/trusted-firmware-m.git/tree/docs/user_guides/services/tfm_audit_integration_guide.md | Audit Logs]] - [[ https://git.trustedfirmware.org/trusted-firmware-m.git/tree/docs/user_guides/services/tfm_crypto_integration_guide.md | Crypto Secure Service]] - [[ https://git.trustedfirmware.org/trusted-firmware-m.git/tree/docs/user_guides/services/tfm_attestation_integration_guide.md | Initial Attestation Service ]] Secure Boot (mcuboot upstream) including generic fault injection mitigations [[ https://developer.trustedfirmware.org/w/tf_m/design/secure_partition_interrupt_handling/ | Secure Partition Interrupt Handling ]] - [Platform] Reset Service- PSA Protected Storage, Internal Trusted Storage v1.0 and Encrypted ITS - [Attestation] EAT (Entity Attestation Token) - CBOR, COSE Integration. PSA Compliance- PSA Cryptov1.0 (uses Mbed TLS v3.4.0) - [Crypto]- PSA API Compliance - [Secure Storage] PSA API Implementation CQ2'19Initial Attestation Service v1.0 - [TF-M Core] [[ https://developer.trustedfirmware.org/w/tf_m/design/trusted_firmware-m_isolation_level_2/ | PSA Level2 Isolation ]] PSA Firmware Update v1.0 - [Secure Storage] Compatible with PSA Firmware Framework IPC- PSA ADAC Specification Implementation - [Crypto] Compatible with PSA Firmware Framework IPC- Base Config - [Attestation] Compatible with PSA Firmware Framework IPC- kconfig based configuration - [Secure Boot] [[ https://developer.trustedfirmware.org/w/tf_m/design/trusted_boot/rollback_protection/ | Rollback Protection ]]- Profile Small, Medium, ARoT-less Medium, Large - [TF-M Core] Secure- Secure Partition Interrupt Handling, Pre-emption of SPE execution - [TF-M Core] Pre-emption of SPE execution- Platform Reset Service - Dual v7-M EnablementCPU - Open Continuous Integration (CI) System - [Crypto] Migrate to mbedcrypto CQ3'19- Boot and Runtime Crypto Hardware Integration - [TF-M Core] Multiple Secure Context, Interrupt Handling - Fault Injection Handling library to mitigate against physical attacks - [Storage] Crypto Binding- Threat Model - Dual v7-M Hardening- Arm v8.1-M Privileged Execute Never (PXN) attribute and Thread reentrancy disabled (TRD) - Boot and Runtime Crypto Hardware Integration - [Secure Boot] Multiple Image Update- FPU, MVE Support - [Secure Storage] Extended PSA APIs- CC-312 PSA Cryptoprocessor Driver Interface CQ4'23 - [Secure Storage] Key Diversification Enhancements - TF-M v1.9 release - Mbed TLS 3.5.0, mcuboot 2.0.0 Integration Future- Design, prototype: Supporting multiple clients - [Platform] NV Count, i.e. Timer - [Platform] Secure TimeTF-M supporting multiple on core and off core clients on Hetrogeneous (e.g. Cortex-A + Cortex-M platforms) - - Demonstrating TLS in Non-Secure Debug Investigationusing PSA Crypto APIs in TF-M - [Provisioning] Initial Investigation/API Prototype- Build System Enhancements - Separate Secure, Non-Secure Builds - Mailbox interrupt handling Future: - [Secure Boot] Key Revocation- Long Term Stable (LTS) support - Implement support for multiple clients - [Secure Storage] Suppor- Remote Test Internal Trusted Storage PSA APIsfrastructure - [Secure Storage] Lifecycle Management- MISRA testing - TF-M Performance - Further Benchmarking and Optimization - Scheduler - Multiple Secure Context Implementation - Arm v8.1-M Architecture Enablement - PAC/BTI - [Crypto] RNG, KDF- PSA FWU Service Enhancements - PSA ADAC Spec - Enhancements and Testing - Arm v8.1-M Unprevileged Debug - [Secure Storage] Extended PSA APIs, Key Diversification Enhancements - [Audit Logs] Secure Storage, Policy Manager - [Platform] GPIO, Debug, NONCE- PSA FF Lifecycle API - Secure Debug Prototype- Fuzz Testing