1.. _tf-m_profiles:
2
3#############
4TF-M Profiles
5#############
6
7The capabilities and resources may dramatically vary on different IoT devices.
8Some IoT devices may have very limited memory resource. The program on those devices should keep
9small memory footprint and basic functionalities.
10On the other hand, some devices may consist of more memory and extended storage, to support stronger
11software capabilities.
12
13Diverse IoT use cases also require different levels of security and requirements on device resource.
14For example, use cases require different cipher capabilities. Selecting cipher suites can be
15sensitive to memory footprint on devices with constrained resource.
16
17Trusted Firmware-M (TF-M) defines several general profiles, such as Profile Small, Profile Medium,
18Profile Medium ARoT-less and Profile Large, to provide different levels of security to fit diverse
19device capabilities and use cases applied on the top of the base configuration.
20
21Each profile specifies a predefined list of features, targeting typical use cases with specific
22hardware constraints. Profiles can serve as reference designs, based on which developers can
23continue further development and configurations, according to use case.
24
25TF-M Profiles align with Platform Security Architecture specifications and certification
26guidelines. It can help vendors to simplify security configuring for PSA certification.
27
28Please check the table below to compare differences while details are discussed
29in the links below.
30
31.. toctree::
32    :maxdepth: 1
33    :glob:
34
35     Small <tfm_profile_small>
36     ARoT-less <tfm_profile_medium_arot-less>
37     Medium <tfm_profile_medium>
38     Large <tfm_profile_large>
39
40+----------------------------------------+--------+--------+---------+--------+--------+
41| Option                                 | Base   | Small  |ARoT-less| Medium | Large  |
42+========================================+========+========+=========+========+========+
43| TFM_ISOLATION_LEVEL                    | 1      | 1      | 1       | 2      | 3      |
44+----------------------------------------+--------+--------+---------+--------+--------+
45| CONFIG_TFM_SPM_BACKEND                 | SFN    | SFN    | SFN     | IPC    | IPC    |
46+----------------------------------------+--------+--------+---------+--------+--------+
47| TFM_PARTITION_CRYPTO                   | OFF    | ON     | ON      | ON     | ON     |
48+----------------------------------------+--------+--------+---------+--------+--------+
49| TFM_PARTITION_INTERNAL_TRUSTED_STORAGE | OFF    | ON     | ON      | ON     | ON     |
50+----------------------------------------+--------+--------+---------+--------+--------+
51| TFM_PARTITION_PLATFORM                 | OFF    | OFF    | ON      | ON     | ON     |
52+----------------------------------------+--------+--------+---------+--------+--------+
53| TFM_PARTITION_PROTECTED_STORAGE        | OFF    | OFF    | OFF     | ON     | ON     |
54+----------------------------------------+--------+--------+---------+--------+--------+
55| TFM_PARTITION_INITIAL_ATTESTATION      | OFF    | ON     | ON      | ON     | ON     |
56+----------------------------------------+--------+--------+---------+--------+--------+
57| SYMMETRIC_INITIAL_ATTESTATION          | OFF    | ON     | OFF     | OFF    | OFF    |
58+----------------------------------------+--------+--------+---------+--------+--------+
59| TFM_PARTITION_FIRMWARE_UPDATE          | OFF    | OFF    | ON      | OFF    | OFF    |
60+----------------------------------------+--------+--------+---------+--------+--------+
61| PS_CRYPTO_AEAD_ALG                     | GCM    | `-`    | `-`     | CCM    | CCM    |
62+----------------------------------------+--------+--------+---------+--------+--------+
63| PSA_FRAMEWORK_HAS_MM_IOVEC             | OFF    | ON     | OFF     | OFF    | OFF    |
64+----------------------------------------+--------+--------+---------+--------+--------+
65| MCUBOOT_IMAGE_NUMBER :sup:`1`          | 2      | 1      | 2       | 2      | 2      |
66+----------------------------------------+--------+--------+---------+--------+--------+
67| *Advanced options, defined in the corresponded header (.h) file*                     |
68+----------------------------------------+--------+--------+---------+--------+--------+
69| CRYPTO_ENGINE_BUF_SIZE                 | 0x2080 | 0x400  | 0x2080  | 0x2080 | 0x2380 |
70+----------------------------------------+--------+--------+---------+--------+--------+
71| CRYPTO_ASYM_SIGN_MODULE_ENABLED        | ON     | OFF    | ON      | ON     | ON     |
72+----------------------------------------+--------+--------+---------+--------+--------+
73| CRYPTO_ASYM_ENCRYPT_MODULE_ENABLED     | ON     | OFF    | OFF     | OFF    | ON     |
74+----------------------------------------+--------+--------+---------+--------+--------+
75| CRYPTO_SINGLE_PART_FUNCS_DISABLED      | OFF    | ON     | OFF     | OFF    | OFF    |
76+----------------------------------------+--------+--------+---------+--------+--------+
77| CRYPTO_CONC_OPER_NUM                   | 8      | 4      | 8       | 8      | 8      |
78+----------------------------------------+--------+--------+---------+--------+--------+
79| CONFIG_TFM_CONN_HANDLE_MAX_NUM         | 8      | 3      | 8       | 8      | 8      |
80+----------------------------------------+--------+--------+---------+--------+--------+
81| ITS_BUF_SIZE :sup:`2`                  | 512    | 32     | 32      | 32     | 512    |
82+----------------------------------------+--------+--------+---------+--------+--------+
83
841. `MCUBOOT_IMAGGE_NUMBER` value is taken from MCUBoot default configuration,
85   execept profile Small.
862. Many platforms redefine `ITS_BUF_SIZE` value.
87
88Each profile has predefined configuration for cryptographic library, located in
89``/lib/ext/mbedcrypto/mbedcrypto_config/``
90
91--------------
92
93*Copyright (c) 2020, Arm Limited. All rights reserved.*
94