|
| 1 | +************* |
| 2 | +Version 2.2.0 |
| 3 | +************* |
| 4 | + |
| 5 | +New major features |
| 6 | +================== |
| 7 | + |
| 8 | + - LLVM build support (MPS2/3/4, RSE) |
| 9 | + |
| 10 | + - Mbed TLS upgrade to v3.6.3. |
| 11 | + |
| 12 | + - Compliant with PSA Architecture Compliance Kit tests v1.6 |
| 13 | + |
| 14 | + - Initial support for on-core and off-core clients on Hybrid platforms (A-profile + M-profile or |
| 15 | + multiple M-profile) using HYBRID_PLAT_SCHED_TYPE=NSPE (a.k.a. solution 2) as described in [1]_. |
| 16 | + The functionality is still under active testing and development. |
| 17 | + |
| 18 | + |
| 19 | +Other relevant changes |
| 20 | +====================== |
| 21 | + |
| 22 | + - BL1 changes to: key config, crypto api, image layout, BL2 hash removal, fixes for encodings, |
| 23 | + ECC keys derivation support, all crypto functions are FIH enabled, shared symbols list updates. |
| 24 | + - BL2 changes to: dynamic arbitrary numbers of ROTPKs, shared regions indirection, config options |
| 25 | + - Tools: Option to generate signing requests, key_derivation module |
| 26 | + - COSE: Switch to upstream t_cose repo |
| 27 | + - NS agent mailbox: Support multiple mailbox sources in RPC callback |
| 28 | + - Logs: Clean-up macros |
| 29 | + - CC3XX: sanity checks, enhancements for PKA & ECDSA, alignments, tests, DRBG additions |
| 30 | + - Threat Model: Add mitigation strategies |
| 31 | + - MISRA-C: Document status of reported violations |
| 32 | + |
| 33 | + |
| 34 | +New security advisories |
| 35 | +======================= |
| 36 | + |
| 37 | +None. |
| 38 | + |
| 39 | + |
| 40 | +New platforms support |
| 41 | +===================== |
| 42 | + |
| 43 | + - Initial support for building nRF54L15 |
| 44 | + - Initial support for building stm32wba65i-dk |
| 45 | + |
| 46 | + |
| 47 | +Deprecated platforms |
| 48 | +==================== |
| 49 | + |
| 50 | +TC2: arm/rse/tc/tc2 |
| 51 | + |
| 52 | + |
| 53 | +Tested platforms [WIP] |
| 54 | +====================== |
| 55 | + |
| 56 | +The following platforms are successfully tested in this release. |
| 57 | + |
| 58 | +- **Arm** |
| 59 | + |
| 60 | + - AN519 |
| 61 | + - AN521 |
| 62 | + - AN555 |
| 63 | + - Corstone-300 |
| 64 | + - Corstone-310 |
| 65 | + - Corstone-315 |
| 66 | + - Corstone-320 |
| 67 | + - Corstone-1000 |
| 68 | + - Musca-B1 |
| 69 | + - Musca-S1 |
| 70 | + |
| 71 | +- **ArmChina** |
| 72 | + |
| 73 | + - Alcor (AN557) |
| 74 | + |
| 75 | +- **STM** |
| 76 | + |
| 77 | + - NUCLEO-L552ZE-Q - TBC |
| 78 | + - STM32H573idk - TBC |
| 79 | + |
| 80 | +- **Infineon/Cypress** |
| 81 | + |
| 82 | + - PSoC 64 - TBC |
| 83 | + |
| 84 | +- **NXP** |
| 85 | + |
| 86 | + - LPCXpresso55S69 - TBC |
| 87 | + |
| 88 | +- **Nordic** |
| 89 | + |
| 90 | + - nrf5340dk_nrf5340_cpuapp |
| 91 | + - nrf9160dk_nrf9160 |
| 92 | + - nrf9161dk_nrf9161 |
| 93 | + |
| 94 | +Reference memory footprint |
| 95 | +========================== |
| 96 | + |
| 97 | +All measurements below are made for *AN521* platform, built `TF-Mv2.2.0-RC2 |
| 98 | +<https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tag/?h=TF-Mv2.2.0-RC2>`_ |
| 99 | +on Windows 10 using Armclang v6.18 and build type MinSizeRel. |
| 100 | + |
| 101 | +All modules are measured in bytes. Some minor modules are not shown in the table below. |
| 102 | + |
| 103 | +.. note:: |
| 104 | + |
| 105 | + Profile `Medium-ARoT-less` built with disabled Firmware Update service to align with other |
| 106 | + TF-M Profiles. |
| 107 | + |
| 108 | ++----------------------+--------------+--------------+--------------+--------------+--------------+ |
| 109 | +| Module | Base | Small | ARoT-less | Medium | Large | |
| 110 | ++ +-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 111 | +| Module | Base | RAM | Small | RAM | ARoT | RAM | Med. | RAM | Large | RAM | |
| 112 | ++======================+=======+======+=======+======+=======+======+=======+======+=======+======+ |
| 113 | +|Generated | 112| 3184| 208| 3184| 224| 3184| 272| 3184| 272| 3184| |
| 114 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 115 | +|Objects | 972| 1056| 1280| 5188| 1379| 5872| 1513| 1468| 1587| 1468| |
| 116 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 117 | +|c_w.l | 190| 0| 506| 0| 548| 0| 506| 0| 746| 0| |
| 118 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 119 | +|platform_s.a | 5312| 281| 5644| 281| 6044| 281| 6426| 281| 6556| 281| |
| 120 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 121 | +|spm.a | 3678| 173| 4716| 173| 4054| 173| 6652| 1409| 6854| 1414| |
| 122 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 123 | +|sprt.a | 274| 0| 1488| 0| 1402| 0| 2530| 4| 2530| 4| |
| 124 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 125 | +|mbedcrypto.a | 0| 0| 24464| 2108| 28292| 2108| 28392| 2108| 77692| 1992| |
| 126 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 127 | +|PROT_attestation.a | 0| 0| 1610| 557| 1579| 1153| 1583| 3201| 1699| 3201| |
| 128 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 129 | +|PROT_crypto.a | 0| 0| 3596| 2046| 4042| 16002| 4092| 22146| 4600| 28226| |
| 130 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 131 | +|PROT_its.a | 0| 0| 4830| 80| 4864| 112| 5064| 1988| 5072| 2468| |
| 132 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 133 | +|PROT_platform.a | 0| 0| 0| 0| 532| 0| 522| 1280| 522| 1280| |
| 134 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 135 | +|AROT_ps.a | 0| 0| 0| 0| 0| 0| 3312| 4344| 3312| 4344| |
| 136 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 137 | +|Padding | 26| 38| 95| 43| 126| 43| 117| 59| 169| 50| |
| 138 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 139 | +|platform_crypto_keys.a| 0| 0| 258| 0| 276| 0| 276| 0| 276| 0| |
| 140 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 141 | +|qcbor.a | 0| 0| 854| 0| 1070| 0| 1070| 0| 1070| 0| |
| 142 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 143 | +|crypto_service_p256m.a| 0| 0| 0| 0| 3612| 0| 3602| 0| 0| 0| |
| 144 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 145 | +|t_cose_s.a | 0| 0| 1007| 0| 2164| 0| 2159| 0| 2159| 0| |
| 146 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 147 | +|Total inc. Padding | 10564| 4732| 50556| 13660| 60208| 28928| 68088| 41472| 115116| 47912| |
| 148 | ++----------------------+-------+------+-------+------+-------+------+-------+------+-------+------+ |
| 149 | + |
| 150 | +Known issues |
| 151 | +============ |
| 152 | + |
| 153 | +Some open issues are not fixed in this release. |
| 154 | + |
| 155 | +.. list-table:: |
| 156 | + :header-rows: 1 |
| 157 | + |
| 158 | + * - Descriptions |
| 159 | + - Issue links |
| 160 | + * - SPM does not automatically unmap mm-iovecs. It will be recovered in a future release. |
| 161 | + - https://github.com/TrustedFirmware-M/trusted-firmware-m/issues/20 |
| 162 | + |
| 163 | + |
| 164 | +Issues fixed since v2.1.1 |
| 165 | +------------------------- |
| 166 | + |
| 167 | +The following issues have been fixed since the v2.1.1 release. |
| 168 | + |
| 169 | +.. list-table:: |
| 170 | + :header-rows: 1 |
| 171 | + |
| 172 | + * - Descriptions |
| 173 | + - Issue links |
| 174 | + * - KConfig build has been fixed |
| 175 | + - <None> |
| 176 | + * - Services do not unmap IOVECS |
| 177 | + - https://github.com/TrustedFirmware-M/trusted-firmware-m/issues/19 |
| 178 | + * - SPM does not return PSA_ERROR on refused psa_connect |
| 179 | + - https://github.com/TrustedFirmware-M/trusted-firmware-m/issues/21 |
| 180 | + * - Fix wrapper to properly mark NSPE images as such |
| 181 | + - https://github.com/TrustedFirmware-M/trusted-firmware-m/issues/24 |
| 182 | + * - Protected Storage content can be lost |
| 183 | + - https://github.com/TrustedFirmware-M/trusted-firmware-m/issues/26 |
| 184 | + |
| 185 | + |
| 186 | +Reference |
| 187 | +========= |
| 188 | + |
| 189 | +.. [1] `Trusted Firmware-M and Hybrid platforms, TF-M tech forum 14-09-2023 <https://www.trustedfirmware.org/docs/tech_forum_20230914_non_seucure_clients.pdf>`_ |
| 190 | +
|
| 191 | +-------------- |
| 192 | + |
| 193 | + *SPDX-License-Identifier: BSD-3-Clause* |
| 194 | + |
| 195 | + *SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors* |
0 commit comments