1. Overview of the Trusted Firmware-M project[edit | edit source]
Trusted Firmware-M (TF-M) is an open-source project managed by TrustedFirmware group[1].
The software environment is design to run in the Secure Processing Environment (SPE) of ARMv8-M microcontrollers following the PSA Certified guidelines[2].
TF-M uses secure partitions that offers services. They can be isolated following different isolation levels:
- Level 1: SPE and NSPE isolation.
- Level 2: Level 1 + Application Root of Trust (ARoT) protection from NSPE and PSA Root of Trust (PRoT) protection from NSPE and ARoT.
- Level 3: Level 2 + Secure partition protection from NSPE and other secure partitions. PSA Root of Trust (RoT) domain protection from NSPE and all Secure Partitions.
The default secure partitions that can be isolated to the nonsecure environment:
- Initial attestation
- Crypto services
- Internal trusted storage
- Firmware update
- Protected storage
The secure partitions are accessible using PSA dedicated API[3].
1.1. License[edit | edit source]
TF-M is delivered under a BSD-3-Clause style license and can run secure partitions without restriction on their licensing model. It also includes different sub-projects with their dedicated license[4].
1.2. Architecture overview[edit | edit source]
1.3. Software profile[edit | edit source]
TF-M defines different profiles offered to the user to select the security level targeted. See TF-M profile page[5] for more information.
ST implementation uses the medium profile by default.
1.4. Secure boot[edit | edit source]
The secure boot is driven by the platform first stage boot loader.
On STM32MP2 series, depending on the TD flavor (A35-TD or M33-TD) 
defined on the platform, different flavors are allowed to achieve the secure boot.
1.4.1. For A35-TD flavor [edit | edit source]
For A35-TD flavor , the secure boot is ensured by default trusted boot bootchain.
To complete the secure boot chain and run TF-M in TrustZone area, it has to be started following the secure coprocessor loading process.
This will ensure that the TF-M and associated nonsecure part (NSPE) is authenticated and follows the secure boot requirements.
1.4.2. For M33-TD flavor [edit | edit source]
For M33-TD flavor , the ROM code authenticates an FSBL-M, which is MCUboot, as it is the default secure bootloader (BL2) for TF-M. This FSBL-M authenticates (and decrypts) the defined slots to be loaded: one for the the DDR firmware, one for the TF-M image and its associated NSPE.
1.5. Secure Partitions[edit | edit source]
1.5.1. Crypto[edit | edit source]
Crypto partitions offer PSA Crypto API[6] implementation in a dedicated RoT secure partition. The implementation is based on Mbed crypto[7]
1.5.2. Firmware update[edit | edit source]
The firmware update partition implements the PSA Firmware update API [8]. It gives all the mandatory features to authenticate, verify and install a new updated image and manage the security about the update process.
1.5.3. Initial attestation[edit | edit source]
Initial attestation partition implements the PSA Attestation API [9]. It provides a verifiable report of the state of the platform.
1.5.4. Internal trusted storage[edit | edit source]
Internal Trusted Storage (ITS) implements PSA secure storage API [10]. The internal storage is designed to store the most secure and critical assets used by the RoT.
1.5.5. Protected storage[edit | edit source]
Secure partition in the ARoT that implements the PSA secure storage API [10] and allows to store secure data on external storage.
2. References[edit | edit source]
- ↑ https://www.trustedfirmware.org/projects/tf-m
- ↑ https://www.psacertified.org
- ↑ https://www.psacertified.org/getting-certified/functional-api-certification/
- ↑ https://tf-m-user-guide.trustedfirmware.org/introduction/readme.html
- ↑ https://trustedfirmware-m.readthedocs.io/en/latest/configuration/profiles/index.html
- ↑ https://arm-software.github.io/psa-api/crypto/
- ↑ https://github.com/Mbed-TLS
- ↑ https://arm-software.github.io/psa-api/fwu/
- ↑ https://arm-software.github.io/psa-api/attestation/1.0/
- ↑ 10.0 10.1 https://arm-software.github.io/psa-api/storage/1.0/
Arm® is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere. 