Merge branch 'release/2.3.x' into main

Merge the release 2.3.x branch into main from tag 'TF-Mv2.3.0'.

Trusted Firmware-M v2.3.0

Change-Id: If3dbe8aaa2d9b4f60badc79bd25fbd51ed74b205
Signed-off-by: Nicola Mazzucato <nicola.mazzucato@arm.com>

Author: nicola-mazzucato-arm

cmake/version.cmake

@@ -8,7 +8,7 @@
 # TFM_VERSION_MANUAL is used as a fallback when Git tags aren’t available.
 # The '**' is added on purpose to show that the version is uncertain in that case.
 # Please keep it in place when updating.
-set(TFM_VERSION_MANUAL "2.2.2**")
+set(TFM_VERSION_MANUAL "2.3.0**")
 
 execute_process(COMMAND git describe --always --candidates=1
     WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}

config/config_base.cmake

@@ -40,7 +40,7 @@ set(TF_PSA_CRYPTO_FORCE_PATCH           OFF         CACHE BOOL      "Always appl
 set(TF_PSA_CRYPTO_GIT_REMOTE            "https://github.com/Mbed-TLS/TF-PSA-Crypto" CACHE STRING "The URL to retrieve TF-PSA-Crypto from.")
 
 set(MCUBOOT_PATH                        "DOWNLOAD"   CACHE PATH     "Path to MCUboot (or DOWNLOAD to fetch automatically")
-set(MCUBOOT_VERSION                     "v2.4.0-rc1" CACHE STRING   "The version of MCUboot to use")
+set(MCUBOOT_VERSION                     "v2.4.0"     CACHE STRING   "The version of MCUboot to use")
 set(MCUBOOT_GIT_REMOTE                  "https://github.com/mcu-tools/mcuboot.git" CACHE STRING "The URL to retrieve MCUboot from.")
 set(MCUBOOT_PATCH_DIR                   "${CMAKE_SOURCE_DIR}/lib/ext/mcuboot"      CACHE PATH   "Path to local folder which contains patches for MCUboot")
 set(MCUBOOT_FORCE_PATCH                 OFF         CACHE BOOL      "Always apply MCUboot patches")

docs/building/tfm_build_instruction.rst

@@ -239,7 +239,7 @@ The following table lists the commonly used repos. For others, you can refer to
 +----------------+---------------------+-----------------------------------------------------+
 | Dependency     | Cmake variable      | Git repo URL                                        |
 +================+=====================+=====================================================+
-| TF-PSA Crypto  | TF_PSA_CRYPTO_PATH  | https://github.com/Mbed-TLS/TF-PSA-Crypto           |
+| TF-PSA-Crypto  | TF_PSA_CRYPTO_PATH  | https://github.com/Mbed-TLS/TF-PSA-Crypto           |
 +----------------+---------------------+-----------------------------------------------------+
 | MCUboot        | MCUBOOT_PATH        | https://github.com/mcu-tools/mcuboot                |
 +----------------+---------------------+-----------------------------------------------------+
@@ -257,7 +257,7 @@ The recommended versions of the dependencies are listed in ``config/config_base.
    An alternative is to copy out the auto-downloaded repos under the ``<build_dir>/lib/ext``.
    They have been applied with patches and can be used directly.
 
-Example: building TF-M with local TF-PSA Crypto repo
+Example: building TF-M with local TF-PSA-Crypto repo
 ----------------------------------------------------
 
 Preparing a local repository consists of 2 steps: cloning and patching.
@@ -267,15 +267,15 @@ cloning the repo and checking out the correct branch.
 
 .. code-block:: bash
 
-    cd <TF-PSA Crypto base folder>
+    cd <TF-PSA-Crypto base folder>
     git clone https://github.com/Mbed-TLS/TF-PSA-Crypto
     cd TF-PSA-Crypto
     git checkout <TF_PSA_CRYPTO_VERSION> from <TF-M source dir>/config/config_base.cmake>
     git apply <TF-M source dir>/lib/ext/tf-psa-crypto/*.patch
 
 .. Note::
 
-   ``<TF-PSA Crypto base folder>`` does not need to have any fixed position related
+   ``<TF-PSA-Crypto base folder>`` does not need to have any fixed position related
    to the TF-M repo so alternative method to get prepared dependency repos is to
    let TF-M download it once and then copy them out of the ``build/lib/ext`` folder.
 
@@ -284,7 +284,7 @@ Now build TF-M binaries
 .. code-block:: bash
 
     cd <TF-M source dir>
-    cmake -S . -B build -DTFM_PLATFORM=arm/mps2/an521 -DTF_PSA_CRYPTO_PATH=<TF-PSA Crypto base folder>/tf-psa-crypto
+    cmake -S . -B build -DTFM_PLATFORM=arm/mps2/an521 -DTF_PSA_CRYPTO_PATH=<TF-PSA-Crypto base folder>
     cmake --build build -- install
 
 .. _Building NSPE:

docs/building/tfm_build_instruction_iar.rst

@@ -11,15 +11,10 @@ Notes for building with IARARM
 
     IAR Embedded Workbench for ARM (EWARM) versions v9.30.1 or later are required.
 
-    Currently the MUSCA_B1 and MUSCA_S1 targets are not supported with IARARM,
-    due to lack of testing.
+    Currently the MUSCA_B1 target is not supported with IARARM, due to lack of testing.
 
     cmake needs to be version 3.21 or newer.
 
-    The V8M IAR CMSIS_5 RTX libraries in CMSIS_5 5.5.0 has a problem and has been updated in
-    CMSIS_5 5.7.0. The updated libraries are part of the tf-m-tests repo and no special instructions
-    are needed when the libraries from this repo are used.
-
     For all configurations and build options some of the QCBOR tests fail due to the tests not handling
     double float NaN:s according to the Arm Runtime ABI. This should be sorted out in the future.
 
@@ -61,4 +56,12 @@ Alternately using traditional cmake syntax
     cmake .. -DTFM_PLATFORM=arm/mps2/an521 -DTFM_TOOLCHAIN_FILE=../toolchain_IARARM.cmake -DTEST_S=ON -DTEST_NS=ON
     make install
 
-*Copyright (c) 2020-2021, Arm Limited. All rights reserved.*
+.. Note::
+    For PSA API tests, you may need to append ``-DTOOLCHAIN=INHERIT`` to the build command.
+
+
+--------------
+
+*SPDX-License-Identifier: BSD-3-Clause*
+
+*SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors*

docs/conf.py

@@ -20,7 +20,7 @@
 # -- Project information -----------------------------------------------------
 
 project = 'Trusted Firmware-M'
-copyright = '2017-2025, ARM CE-OSS'
+copyright = '2017-2026, ARM CE-OSS'
 author = 'ARM CE-OSS'
 title = 'User Guide'
 

docs/configuration/profiles/index.rst

@@ -85,9 +85,11 @@ in the links below.
    except profile Small.
 2. Many platforms redefine `ITS_BUF_SIZE` value.
 
-Each profile has predefined configuration for cryptographic library, located in
-``/lib/ext/mbedcrypto/mbedcrypto_config/``
+Each profile has predefined configuration for the cryptographic library,
+located in ``/lib/ext/tf-psa-crypto/tfpsacrypto_config/``
 
 --------------
 
-*Copyright (c) 2020, Arm Limited. All rights reserved.*
+*SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors*
+
+*SPDX-License-Identifier: BSD-3-Clause*

docs/configuration/profiles/tfm_profile_large.rst

@@ -236,16 +236,14 @@ Crypto Secure Partition
 TF-M Profile Large enables Crypto SP in top-level CMake config file and selects
 all the Crypto modules.
 
-MbedTLS configurations
-^^^^^^^^^^^^^^^^^^^^^^
+TF-PSA-Crypto configurations
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-TF-M Profile Large adds a dedicated MbedTLS config file
-``tfm_mbedcrypto_config_profile_large.h`` and MbedTLS PSA config file
-``crypto_config_profile_large.h`` under
-``/lib/ext/mbedcrypto/mbedcrypto_config`` folder, instead of the common one
-``tfm_mbedcrypto_config_default.h`` and ``crypto_config_default.h`` [7]_.
+TF-M Profile Large adds a dedicated TF-PSA-Crypto config file ``crypto_config_profile_large.h``
+under ``/lib/ext/tf-psa-crypto/tfpsacrypto_config`` folder, instead of the common one
+``crypto_config_default.h`` [7]_.
 
-Major MbedTLS configurations are set as listed below:
+Major cryptographic configurations are set as listed below:
 
     - Enable SHA256, SHA384 and SHA512
     - Enable generic message digest wrappers
@@ -325,7 +323,7 @@ a platform can add a platform configuration file at
 Test configuration
 ------------------
 
-Some cryptography tests are disabled due to the reduced MbedTLS config.
+Some cryptography tests are disabled due to the reduced cryptographic configuration profile.
 Profile Large specific test configurations are also specified in Profile Large
 top-level CMake config file ``config/profile/profile_large_test.cmake``.
 

docs/configuration/profiles/tfm_profile_medium.rst

@@ -261,7 +261,7 @@ Will enable testing for all enabled partitions. See above for details of enabled
 partitions. Because Profile Medium enables IPC model, the IPC tests are also
 enabled.
 
-Some cryptography tests are disabled due to the reduced Mbed Crypto config.
+Some cryptography tests are disabled due to the reduced cryptographic configuration profile.
 
 .. table:: TFM options in Profile Medium top-level CMake config file
    :widths: auto
@@ -324,16 +324,14 @@ The following PSA Crypto operationts are enabled by default.
    - Key derivation
    - Key management
 
-Mbed Crypto configurations
-^^^^^^^^^^^^^^^^^^^^^^^^^^
+TF-PSA-Crypto configurations
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-TF-M Profile Medium adds a dedicated Mbed Crypto config file
-``tfm_mbedcrypto_config_profile_medium.h`` and Mbed Crypto PSA config file
-``crypto_config_profile_medium.h`` at ``/lib/ext/mbedcrypto/mbedcrypto_config``
-folder, instead of the common one ``tfm_mbedcrypto_config_default.h`` and
+TF-M Profile Medium adds a dedicated TF-PSA-Crypto config file ``crypto_config_profile_medium.h``
+under ``/lib/ext/tf-psa-crypto/tfpsacrypto_config`` folder, instead of the common one
 ``crypto_config_default.h`` [CRYPTO-DESIGN]_.
 
-Major Mbed Crypto configurations are set as listed below:
+Major cryptographic configurations are set as listed below:
 
     - Enable SHA256
     - Enable generic message digest wrappers

docs/configuration/profiles/tfm_profile_small.rst

@@ -385,16 +385,14 @@ Other modules and configurations [11]_ are kept as default values.
 Additional configuration flags with more fine granularity can be added to
 control building of specific crypto algorithms and corresponding test cases.
 
-Mbed Crypto configurations
-^^^^^^^^^^^^^^^^^^^^^^^^^^
+TF-PSA-Crypto configurations
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-TF-M Profile Small adds a dedicated Mbed Crypto config file
-``tfm_mbedcrypto_config_profile_small.h`` and Mbed Crypto PSA config file
-``crypto_config_profile_small.h`` at ``/lib/ext/mbedcrypto/mbedcrypto_config``
-folder, instead of the common one ``tfm_mbedcrypto_config_default.h`` and
+TF-M Profile Small adds a dedicated TF-PSA-Crypto config file ``crypto_config_profile_small.h``
+under ``/lib/ext/tf-psa-crypto/tfpsacrypto_config`` folder, instead of the common one
 ``crypto_config_default.h`` [11]_.
 
-Major Mbed Crypto configurations are set as listed below:
+Major cryptographic configurations are set as listed below:
 
     - Enable SHA256
     - Enable generic message digest wrappers
@@ -459,7 +457,7 @@ in Profile Small top-level CMake config file.
 Test configuration
 ------------------
 
-Some cryptography tests are disabled due to the reduced Mbed Crypto config.
+Some cryptography tests are disabled due to the reduced cryptographic configuration profile.
 Some of them are shown in the table below.
 
 .. table:: TFM options in Profile Small top-level CMake config file

docs/configuration/test_configuration.rst

@@ -65,8 +65,8 @@ test suites will be enabled or disabled as appropriate for the TF-M
 configuration (i.e. all enabled secure partitions will be tested).
 
 Some cryptographic tests can be enabled and disabled. This is done to prevent
-false failures from being reported when a smaller Mbed Crypto config is being
-used which does not support all features.
+false failures from being reported when a smaller crypto configuration profile
+is being used which does not support all features.
 
 +---------------------------------------+---------------------------------------+---------------+
 | Parameter                             | Description                           | Default value |
@@ -117,3 +117,9 @@ The Firmware Framework test suites are:
 
 Note that these map directly to the ``SUITE`` cmake variable used in the
 psa-arch-tests documentation.
+
+--------------
+
+*SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors*
+
+*SPDX-License-Identifier: BSD-3-Clause*