diff --git a/doc/nrf/drivers/entropy_cc310.rst b/doc/nrf/drivers/entropy_cc310.rst index 4adc81e1f8e..eddd3666e6f 100644 --- a/doc/nrf/drivers/entropy_cc310.rst +++ b/doc/nrf/drivers/entropy_cc310.rst @@ -16,8 +16,8 @@ You can use the CC310 entropy driver (*entropy_cc310*) to generate random data u When used with nRF52840, the CC310 entropy driver gathers entropy by using the CC310 hardware through the :ref:`nrf_cc3xx_platform_readme`. When used with nRF5340 or nRF9160, the driver behavior depends on whether it is used in an application with or without Cortex-M Security Extensions (CMSE): -* In an application without CMSE, or when the :ref:`lib_spm` is not used, the CC310 entropy driver gathers entropy by using the CC310 hardware through the :ref:`nrf_cc3xx_platform_readme`. -* In an application with CMSE, the driver gathers entropy through the :ref:`lib_secure_services` library. +* In an application without CMSE the CC310 entropy driver gathers entropy by using the CC310 hardware through the :ref:`nrf_cc3xx_platform_readme`. +* In an application with CMSE, the driver gathers entropy through the PSA Crypto APIs exposed by :ref:`Trusted Firmware-M (TF-M) `. For more details on CMSE, see :ref:`app_boards_spe_nspe`. diff --git a/doc/nrf/includes/spm.txt b/doc/nrf/includes/spm.txt deleted file mode 100644 index a8e0991eafe..00000000000 --- a/doc/nrf/includes/spm.txt +++ /dev/null @@ -1,4 +0,0 @@ -The sample is configured to compile and run as a non-secure application on nRF91's Cortex-M33. -Therefore, it automatically includes the :ref:`secure_partition_manager` that prepares the required peripherals to be available for the application. - -You can also configure it to use :ref:`TF-M ` instead of Secure Partition Manager. diff --git a/doc/nrf/known_issues.rst b/doc/nrf/known_issues.rst index e86aac0cf08..6dff3c48a4f 100644 --- a/doc/nrf/known_issues.rst +++ b/doc/nrf/known_issues.rst @@ -149,10 +149,10 @@ CIA-661: Asset Tracker v2 application configured for LwM2M cannot be built for t **Workaround:** Use one of the following workarounds for modem traces: - * Use :ref:`secure_partition_manager` instead of TF-M by setting :kconfig:option:`CONFIG_SPM` to ``y`` and :kconfig:option:`CONFIG_BUILD_WITH_TFM` to ``n``. + * Use Secure Partition Manager instead of TF-M by setting ``CONFIG_SPM`` to ``y`` and :kconfig:option:`CONFIG_BUILD_WITH_TFM` to ``n``. * Reduce the value of :kconfig:option:`CONFIG_NRF_MODEM_LIB_SHMEM_TRACE_SIZE` to 8 Kb, however, this might lead to loss of modem traces. - For memfault, use :ref:`secure_partition_manager` instead of TF-M by setting :kconfig:option:`CONFIG_SPM` to ``y`` and :kconfig:option:`CONFIG_BUILD_WITH_TFM` to ``n``. + For memfault, use Secure Partition Manager instead of TF-M by setting ``CONFIG_SPM`` to ``y`` and :kconfig:option:`CONFIG_BUILD_WITH_TFM` to ``n``. Serial LTE Modem ================ @@ -186,7 +186,7 @@ NCSDK-15471: Compilation with SUPL client library fails when TF-M is enabled **Workaround:** Use one of the following workarounds: - * Use :ref:`secure_partition_manager` instead of TF-M. + * Use Secure Partition Manager instead of TF-M. * Disable the FPU by setting :kconfig:option:`CONFIG_FPU` to ``n``. .. rst-class:: v2-2-0 v2-1-2 v2-1-1 v2-1-0 v2-0-2 v2-0-1 v2-0-0 v1-9-2 v1-9-1 v1-9-0 v1-8-0 v1-7-1 v1-7-0 v1-6-1 v1-6-0 @@ -1691,7 +1691,7 @@ Build system .. rst-class:: v2-1-2 v2-1-1 v2-1-0 v2-0-2 v2-0-1 v2-0-0 v1-9-2 v1-9-1 v1-9-0 v1-8-0 v1-7-1 v1-7-0 v1-6-1 v1-6-0 v1-5-2 v1-5-1 v1-5-0 v1-4-2 v1-4-1 v1-4-0 v1-3-2 v1-3-1 v1-3-0 NCSDK-6117: Build configuration issues - The build configuration consisting of :ref:`bootloader`, :ref:`secure_partition_manager`, and application does not work. + The build configuration consisting of :ref:`bootloader`, Secure Partition Manager, and application does not work. (The SPM has been deprecated with the |NCS| v2.1.0.) **Workaround:** Either include MCUboot in the build or use MCUboot instead of the immutable bootloader. @@ -1865,7 +1865,7 @@ Secure Partition Manager (SPM) .. rst-class:: v2-2-0 v2-1-2 v2-1-1 v2-1-0 v2-0-2 v2-0-1 v2-0-0 v1-9-2 v1-9-1 v1-9-0 v1-8-0 v1-7-1 v1-7-0 v1-6-1 v1-6-0 v1-5-2 v1-5-1 v1-5-0 v1-4-2 v1-4-1 v1-4-0 v1-3-2 v1-3-1 v1-3-0 NCSIDB-114: Default logging causes crash - Enabling default logging in the :ref:`secure_partition_manager` sample makes it crash if the sample logs any data after the application has booted (for example, during a SecureFault, or in a secure service). + Enabling default logging in the Secure Partition Manager sample makes it crash if the sample logs any data after the application has booted (for example, during a SecureFault, or in a secure service). At that point, RTC1 and UARTE0 are non-secure. **Workaround:** Do not enable logging and add a breakpoint in the fault handling, or try a different logging backend. @@ -1873,7 +1873,7 @@ NCSIDB-114: Default logging causes crash .. rst-class:: v1-6-1 v1-6-0 v1-5-2 v1-5-1 v1-5-0 v1-4-2 v1-4-1 v1-4-0 v1-3-2 v1-3-1 v1-3-0 v1-2-1 v1-2-0 v1-1-0 NCSDK-8232: Secure Partition Manager and application building together - It is not possible to build and program :ref:`secure_partition_manager` and the application individually. + It is not possible to build and program Secure Partition Manager and the application individually. .. rst-class:: v1-5-2 v1-5-1 v1-5-0 @@ -2653,14 +2653,14 @@ TF-M is not supported for Thingy:91 v1.5.0 and lower versions NCSDK-15382: TF-M uses more RAM compared to SPM in the minimal configuration TF-M uses 64 KB of RAM in the minimal configuration, while SPM uses 32 KB of RAM. - **Workaround:** Free up memory in the application if needed or keep :kconfig:option:`CONFIG_SPM` enabled in the application. + **Workaround:** Free up memory in the application if needed or keep ``CONFIG_SPM`` enabled in the application. .. rst-class:: v2-0-2 v2-0-1 v2-0-0 NCSDK-15379: TF-M does not support FP Hard ABI TF-M does not support enabling the Float Point Hard Application Binary Interface configuration enabled with :kconfig:option:`CONFIG_FP_HARDABI`. - **Workaround:** Use :kconfig:option:`CONFIG_FP_SOFTABI` or keep :kconfig:option:`CONFIG_SPM` enabled in the application. + **Workaround:** Use :kconfig:option:`CONFIG_FP_SOFTABI` or keep ``CONFIG_SPM`` enabled in the application. .. rst-class:: v2-0-2 v2-0-1 v2-0-0 @@ -2668,7 +2668,7 @@ NCSDK-15345: TF-M does not support non-secure partitions in external flash TF-M does not support configuring a non-secure partition in external flash, such as non-secure storage or MCUboot secondary partition. Partitions that TF-M will attempt to configure as non-secure are: ``tfm_nonsecure``, ``nonsecure_storage``, and ``mcuboot_secondary``. - **Workaround:** Do not put non-secure partitions in external flash or keep :kconfig:option:`CONFIG_SPM` enabled in the application. + **Workaround:** Do not put non-secure partitions in external flash or keep ``CONFIG_SPM`` enabled in the application. .. rst-class:: v2-1-2 v2-1-1 v2-1-0 v2-0-2 v2-0-1 v2-0-0 v1-9-2 v1-9-1 v1-9-0 v1-8-0 @@ -2706,7 +2706,7 @@ NCSDK-14590: Usage fault in interrupt handlers when using FPU extensions NCSDK-15443: TF-M cannot be booted by MCUboot without enabling :kconfig:option:`CONFIG_MCUBOOT_CLEANUP_ARM_CORE` in MCUboot TF-M cannot be booted by MCUboot unless MCUboot cleans up the ARM hardware state to reset values before booting TF-M. - **Workaround:** Upgrade MCUboot with :kconfig:option:`CONFIG_MCUBOOT_CLEANUP_ARM_CORE` enabled or keep :kconfig:option:`CONFIG_SPM` enabled in the application. + **Workaround:** Upgrade MCUboot with :kconfig:option:`CONFIG_MCUBOOT_CLEANUP_ARM_CORE` enabled or keep ``CONFIG_SPM`` enabled in the application. .. rst-class:: v1-9-2 v1-9-1 v1-9-0 diff --git a/doc/nrf/libraries/networking/fota_download.rst b/doc/nrf/libraries/networking/fota_download.rst index ba27d7f177a..4e2dbb10948 100644 --- a/doc/nrf/libraries/networking/fota_download.rst +++ b/doc/nrf/libraries/networking/fota_download.rst @@ -51,7 +51,7 @@ To do this, provide two paths in the ``file`` argument, separated by a space cha * The first entry must point to the second-stage upgradable bootloader variant linked against the S0 partition. * The second entry must point to the second-stage upgradable bootloader variant linked against the S1 partition. -When an upgradeable bootloader, like MCUboot, is included in the project, the FOTA download library uses the :ref:`lib_secure_services` library to detect the active second-stage upgradable bootloader partition (S0 or S1). +When an upgradeable bootloader, like MCUboot, is included in the project, the FOTA download library uses :ref:`Trusted Firmware-M (TF-M) ` to detect the active second-stage upgradable bootloader partition (S0 or S1). If the ``file`` argument contains a space character, it is internally updated to contain only the entry that corresponds to the non-active slot. This updated path is then used to download the image. A device reset triggers the second-stage upgradable bootloader to copy the image from the update bank to the non-active slot. diff --git a/doc/nrf/libraries/others/memfault_ncs.rst b/doc/nrf/libraries/others/memfault_ncs.rst index 13693e2fb13..40618a86bd4 100644 --- a/doc/nrf/libraries/others/memfault_ncs.rst +++ b/doc/nrf/libraries/others/memfault_ncs.rst @@ -47,7 +47,6 @@ To get access to all the benefits, like up to 100 free devices connected, regist When building applications with :ref:`Trusted Firmware-M ` (TF-M), the faults resulting from memory access in secure regions are not caught by Memfault's fault handler. Instead, they are handled by TF-M. This means that those faults are not reported to the Memfault platform. - You can configure your application to use the :ref:`secure_partition_manager` instead of TF-M if you prefer all such faults to be reported to the Memfault platform. Configuration ************* diff --git a/doc/nrf/libraries/others/secure_services.rst b/doc/nrf/libraries/others/secure_services.rst deleted file mode 100644 index 474f50dcac9..00000000000 --- a/doc/nrf/libraries/others/secure_services.rst +++ /dev/null @@ -1,28 +0,0 @@ -.. _lib_secure_services: - -Secure Services -############### - -.. contents:: - :local: - :depth: 2 - -Secure Services are functions implemented in the firmware in Secure Processing Environment (SPE), but made available to be called from firmware in Non-Secure Processing Environment (NSPE). - -Calling functions in this API requires that the service is enabled in the :ref:`secure_partition_manager`. -See :kconfig:option:`CONFIG_SPM_SECURE_SERVICES` in the :ref:`secure_partition_manager`'s menuconfig. -Some services are enabled by default. - -.. Remove parts with regards to debugging and programming when NRF91-313 is resolved - -By default :kconfig:option:`CONFIG_SPM_BLOCK_NON_SECURE_RESET` is disabled. This is to make sure that your debugger will be able to issue a system reset during the development stage and that devices which do not have pin-reset routed can do a re-flashing routine correctly. This option should be turned off when you are putting a product into production to increase the security of your device. - -API documentation -***************** - -| Header file: :file:`include/secure_services.h` -| Source file: :file:`subsys/spm/secure_services.c` (compiled into the :ref:`secure_partition_manager`) - -.. doxygengroup:: secure_services - :project: nrf - :members: diff --git a/doc/nrf/libraries/others/spm.rst b/doc/nrf/libraries/others/spm.rst deleted file mode 100644 index 790d2741b97..00000000000 --- a/doc/nrf/libraries/others/spm.rst +++ /dev/null @@ -1,121 +0,0 @@ -.. _lib_spm: - -Secure Partition Manager (SPM) -############################## - -.. contents:: - :local: - :depth: 2 - -The Secure Partition Manager (SPM) provides functionality for the Trusted Execution Environment of the nRF9160 SiP and the nRF5340 SoC. -As of |NCS| v2.1.0, the Secure Partition Manager is replaced by the Trusted Firmware-M (TF-M) and deprecated. -It will be removed in a future release of the |NCS|. - -See :ref:`ug_tfm` for more information about the TF-M. - -Overview -******** - -The Cortex-M33 CPU in the nRF9160 and nRF5340 devices implements `ARM TrustZone`_. -This allows the CPU to run firmware in Secure Processing Environment (SPE) and Non-Secure Processing Environment (NSPE) side by side. - -The SPM runs as an SPE firmware. -It configures the permissions and resources of the NSPE firmware and then boots it. -Such separation of firmware is required to run NSPE applications. - -The SPM also provides NSPE firmware with access to features that are normally only available to firmware in SPE. -You can find the feature list on the :ref:`lib_spm_secure_services` page. - -.. note:: - If your application uses :ref:`TF-M `, SPM is not included in the build. - -The SPM library is used in the :ref:`secure_partition_manager` sample. - -.. _lib_spm_configuration: - -Configuration -************* - -The Secure Partition Manager (SPM) uses the `System Protection Unit`_ (SPU) peripheral to set security attributions for the flash memory, the SRAM, and other peripherals. -Security attributions are boolean Kconfig options that configure security settings like, for example, defining a peripheral as secure or non-secure. -The SPU peripheral is the nRF version of an Implementation-Defined Security Attribution Unit (IDAU). - -To configure SPM, do the following: - -* Use Kconfig to configure the security attributions for the peripherals. -* Modify the source code of the SPM library to configure the security attributions of the SRAM. - -Partition Manager must be used with SPM. -The security attributions of the flash memory regions are taken from the generated :file:`pm.config` file. - -For the SRAM and the peripherals, the following security attribution configuration is applied: - -* Lower 64 kB: Secure -* Upper 192 kB: Non-Secure - -In total, this makes 256 kB for the SRAM. - -The following peripherals are configured as Non-Secure: - -* Common peripherals: - - * CLOCK - * DPPI - * EGU1, EGU2 - * FPU - * GPIO (and GPIO pins) - * GPIOTE1 - * IPC - * NFCT - * NVMC, VMC - * PWM0-3 - * REGULATORS - * RTC0, RTC1 - * SAADC - * SPIM3 - * TIMER0-2 - * TWIM2 - * UARTE0, UARTE1 - * P0 - -* nRF9160 SiP specific peripherals: - - * WDT - * PDM - * I2S - -* nRF5340 SoC specific peripherals: - - * Oscillators - * Reset - * SPIM4 - * WDT0-1 - * COMP - * LPCOMP - * PDM0 - * I2S0 - * QSPI - * NFCT - * MUTEX - * QDEC0-1 - * USBD - * USB Regulator - * P1 - -.. _lib_spm_secure_services: - -Secure Services -*************** - -The SPM provides by default certain Secure Services to the NSPE firmware. -See :ref:`lib_secure_services` for more information. - -API documentation -***************** - -| Header file: :file:`include/spm.h` -| Source files: :file:`subsys/spm/` - -.. doxygengroup:: secure_partition_manager - :project: nrf - :members: diff --git a/doc/nrf/releases/release-notes-0.3.0.rst b/doc/nrf/releases/release-notes-0.3.0.rst index e1933dd1723..603d8cea590 100644 --- a/doc/nrf/releases/release-notes-0.3.0.rst +++ b/doc/nrf/releases/release-notes-0.3.0.rst @@ -96,7 +96,7 @@ nRF9160 * Added target nRF52840_PCA10090 (used when compiling for the nRF9160 DK Board Controller). * Added the following samples: - * :ref:`secure_partition_manager`: + * Secure Partition Manager: This sample provides a reference implementation of a first-stage boot firmware. The sample configures resources for the secure domain and boots an application from the non-secure domain. * **at_client**: diff --git a/doc/nrf/releases/release-notes-0.4.0.rst b/doc/nrf/releases/release-notes-0.4.0.rst index b800756e168..052500915a0 100644 --- a/doc/nrf/releases/release-notes-0.4.0.rst +++ b/doc/nrf/releases/release-notes-0.4.0.rst @@ -111,7 +111,7 @@ Common libraries * :ref:`lib_download_client` - downloads files over HTTP and reports back the progress (as data fragments) to the application * Nordic CoAP library - ported to the |NCS| - * :ref:`lib_spm` (replacing Secure Boot) - configures security attributions for the flash, SRAM, and peripherals + * Secure Partition Manager (SPM) (replacing Secure Boot) - configures security attributions for the flash, SRAM, and peripherals Crypto @@ -188,7 +188,7 @@ Documentation * :ref:`app_event_manager` and :ref:`nrf_profiler` * :ref:`at_cmd_parser_readme`, :ref:`at_params_readme`, and :ref:`modem_info_readme` * :ref:`lib_download_client` - * :ref:`lib_spm` + * Secure Partition Manager (SPM) * :ref:`st25r3911b_nfc_readme` * :ref:`dfu_smp_readme` and :ref:`lbs_readme` diff --git a/doc/nrf/releases/release-notes-1.0.0.rst b/doc/nrf/releases/release-notes-1.0.0.rst index 041e049d3e6..9587e6c61c7 100644 --- a/doc/nrf/releases/release-notes-1.0.0.rst +++ b/doc/nrf/releases/release-notes-1.0.0.rst @@ -130,7 +130,7 @@ Secure Partition Manager (SPM) library * :file:`secure_services.c` resides in secure firmware (SPM). * :file:`secure_services.h` declares functions that can be called from non-secure firmware. - * :ref:`lib_spm` now exposes secure entry functions by default. + * Secure Partition Manager (SPM) now exposes secure entry functions by default. * Added reboot as a secure service. The reboot secure service is called when the non-secure firmware calls ``sys_reboot()``. * PWM0-3 added as non-secure. @@ -211,7 +211,7 @@ Documentation * nRF9160: * nRF9160: Secure Services - * :ref:`secure_partition_manager` + * Secure Partition Manager * nRF9160: AWS FOTA * :ref:`lte_sensor_gateway` @@ -230,12 +230,12 @@ Documentation * nRF9160: - * :ref:`lib_spm` + * Secure Partition Manager (SPM) * ``at_cmd`` library * :ref:`lib_download_client` * :ref:`lib_aws_fota` * :ref:`lib_fota_download` - * :ref:`lib_secure_services` + * Secure Services * Bluetooth Low Energy: diff --git a/doc/nrf/releases/release-notes-1.1.0.rst b/doc/nrf/releases/release-notes-1.1.0.rst index 6dbf85f4b1b..8d9057cd197 100644 --- a/doc/nrf/releases/release-notes-1.1.0.rst +++ b/doc/nrf/releases/release-notes-1.1.0.rst @@ -182,7 +182,7 @@ Updated libraries * Dropped the nRF Connect SDK copy of the MQTT library and adopted Zephyr's :ref:`zephyr:mqtt_socket_interface` library instead. -* :ref:`lib_spm`: +* Secure Partition Manager (SPM): * Added a new non-secure-callable function :c:func:`spm_firmware_info`. @@ -470,7 +470,7 @@ Documentation * :ref:`nfc_t4t_apdu_readme` * :ref:`nfc_t4t_isodep_readme` * :ref:`nrf_profiler` - * :ref:`lib_secure_services` + * Secure Services * Added or updated the following documentation: @@ -567,7 +567,7 @@ NFC Build system ============ -* It is not possible to build and program :ref:`secure_partition_manager` and the application individually. +* It is not possible to build and program Secure Partition Manager and the application individually. nrfxlib ======= diff --git a/doc/nrf/releases/release-notes-1.2.0.rst b/doc/nrf/releases/release-notes-1.2.0.rst index 22738e857f2..745bcd89489 100644 --- a/doc/nrf/releases/release-notes-1.2.0.rst +++ b/doc/nrf/releases/release-notes-1.2.0.rst @@ -150,7 +150,7 @@ Updated libraries * Added the ``CONFIG_DOWNLOAD_CLIENT_MAX_TLS_FRAGMENT_SIZE`` option that allows to configure fragment sizes for TLS connections and non-TLS connections independently. * Added support for using non-default ports. -* :ref:`lib_spm`: +* Secure Partition Manager (SPM): * Updated the security attribution to configure the peripherals NRF_REGULATORS and NRF_WDT as Non-secure. * Added the RTC0 peripheral (as Non-Secure). @@ -584,7 +584,7 @@ NFC Build system ============ -* It is not possible to build and program :ref:`secure_partition_manager` and the application individually. +* It is not possible to build and program Secure Partition Manager and the application individually. nrfxlib ======= diff --git a/doc/nrf/releases/release-notes-1.3.0.rst b/doc/nrf/releases/release-notes-1.3.0.rst index 1953009eb68..de6cf924f8b 100644 --- a/doc/nrf/releases/release-notes-1.3.0.rst +++ b/doc/nrf/releases/release-notes-1.3.0.rst @@ -369,8 +369,8 @@ Secure Partition Manager (SPM) * Added support for disabling some services in the nRF9160: Secure Services sample. It now works in more bootloader configurations. -* Disabled :kconfig:option:`CONFIG_SPM_SERVICE_PREVALIDATE` in the :ref:`lib_spm` library, because this option requires the immutable bootloader. -* Updated the :ref:`lib_spm` library to make it compatible with nRF5340 (with or without `anomaly 19`_). +* Disabled ``CONFIG_SPM_SERVICE_PREVALIDATE`` in the Secure Partition Manager (SPM) library, because this option requires the immutable bootloader. +* Updated the Secure Partition Manager (SPM) library to make it compatible with nRF5340 (with or without `anomaly 19`_). CPU load measurement -------------------- @@ -532,7 +532,7 @@ Common Samples and applications ------------------------ -* The build configuration consisting of :ref:`bootloader`, :ref:`secure_partition_manager`, and application does not work. +* The build configuration consisting of :ref:`bootloader`, Secure Partition Manager, and application does not work. As a workaround, either include MCUboot in the build or use MCUboot instead of the immutable bootloader. * ``west flash`` and ``ninja flash`` only program one core, even if multiple cores are included in the build. As a workaround, execute the flash command from inside the build directory of the child image that is placed on the other core (for example, :file:`build/hci_rpmsg`). @@ -550,14 +550,14 @@ Crypto Secure Partition Manager (SPM) ------------------------------ -* Enabling default logging in the :ref:`secure_partition_manager` sample makes it crash if the sample logs any data after the application has booted (for example, during a SecureFault, or in a secure service). +* Enabling default logging in the Secure Partition Manager sample makes it crash if the sample logs any data after the application has booted (for example, during a SecureFault, or in a secure service). At that point, RTC1 and UARTE0 are non-secure. As a workaround, do not enable logging and add a breakpoint in the fault handling, or try a different logging backend. (NCSIDB-114) Build system ============ -* It is not possible to build and program :ref:`secure_partition_manager` and the application individually. (from v1.2.0) +* It is not possible to build and program Secure Partition Manager and the application individually. (from v1.2.0) Zephyr ====== diff --git a/doc/nrf/releases/release-notes-1.4.0.rst b/doc/nrf/releases/release-notes-1.4.0.rst index c84613c2945..0f49a1bb24a 100644 --- a/doc/nrf/releases/release-notes-1.4.0.rst +++ b/doc/nrf/releases/release-notes-1.4.0.rst @@ -391,7 +391,7 @@ Crypto For details, see :file:`crypto/nrf_cc310_mbedcrypto/include/mbedtls/cc3xx_kmu.h` in `sdk-nrfxlib`_. See the :ref:`crypto_changelog_nrf_cc3xx_mbedcrypto` for detailed information. - * RNG support in nRF5340 application core (using Secure Partition Manager's :ref:`lib_secure_services` and nrf_cc312_platform library). + * RNG support in nRF5340 application core (using Secure Partition Manager's Secure Services and nrf_cc312_platform library). * Updated: diff --git a/doc/nrf/releases/release-notes-1.5.0.rst b/doc/nrf/releases/release-notes-1.5.0.rst index bb22e9e1f55..de588e31469 100644 --- a/doc/nrf/releases/release-notes-1.5.0.rst +++ b/doc/nrf/releases/release-notes-1.5.0.rst @@ -152,7 +152,7 @@ nRF5340 SoC * :ref:`esb_readme` subsystem - Added support for nRF5340 (CPUNET) in the ESB subsystem. - * :ref:`lib_spm` subsystem - Added support for nRF5340 peripherals in non-secure applications. + * Secure Partition Manager (SPM) subsystem - Added support for nRF5340 peripherals in non-secure applications. * :ref:`ble_samples` - Added configuration overlays for child image to the required Bluetooth LE samples so that no Kconfig updates in the :ref:`zephyr:bluetooth-hci-rpmsg-sample` sample are needed by default. * :ref:`nrf5340_empty_app_core` sample - Disabled the kernel memory pool option :kconfig:option:`CONFIG_KERNEL_MEM_POOL` to reduce the memory footprint. * ``bl_boot`` library - Disabled clock interrupts before booting the application. This change fixes an issue where the :ref:`bootloader` sample would not be able to boot a Zephyr application on the nRF5340 SoC. diff --git a/doc/nrf/releases/release-notes-1.6.0.rst b/doc/nrf/releases/release-notes-1.6.0.rst index 2b9b233aca4..2da590a1f4b 100644 --- a/doc/nrf/releases/release-notes-1.6.0.rst +++ b/doc/nrf/releases/release-notes-1.6.0.rst @@ -184,7 +184,7 @@ nRF9160 * Added support for parsing parameters of type unsigned int or unsigned short. - * :ref:`lib_spm` library: + * Secure Partition Manager (SPM) library: * Added support for the nRF9160 pulse-density modulation (PDM) and inter-IC sound (I2S) peripherals in non-secure applications. * Fixed an issue where SPM and the application could have incompatible FPU configurations, resulting in a HardFault. @@ -351,7 +351,7 @@ Trusted Firmware-M TF-M automatically generates and stores random hardware unique keys (if not present), using the :ref:`lib_hw_unique_key` library. * TFM_MINIMAL: Added a size-optimized configuration of TF-M which provides a minimal set of features: - * This configuration requires 32 KB of flash and provides random number generation, SHA-256, and the platform memory read service, which is analogous to the feature set of :ref:`secure_partition_manager`. + * This configuration requires 32 KB of flash and provides random number generation, SHA-256, and the platform memory read service, which is analogous to the feature set of Secure Partition Manager. * The configuration is showcased in the :ref:`tfm_hello_world` sample. * The TF-M protected storage service is now using non-static labels when deriving encryption keys. diff --git a/doc/nrf/releases/release-notes-1.8.0.rst b/doc/nrf/releases/release-notes-1.8.0.rst index 1f7c2310ad5..239630d562f 100644 --- a/doc/nrf/releases/release-notes-1.8.0.rst +++ b/doc/nrf/releases/release-notes-1.8.0.rst @@ -675,7 +675,7 @@ Other libraries * Increased the number of supported nRF Profiler events. * Added a special nRF Profiler event for indicating a situation where the nRF Profiler's data buffer has overflowed and some events have been dropped, which causes the device to stop sending events. -* :ref:`lib_spm`: +* Secure Partition Manager (SPM): * Fixed the NCSDK-5156 issue with the size calculation for the non-secure callable region, which prevented users from adding a large number of custom secure services. * All EGU peripherals, instead of just EGU1 and EGU2, are now configurable to be non-secure and are configured as non-secure by default. diff --git a/doc/nrf/releases/release-notes-1.9.0.rst b/doc/nrf/releases/release-notes-1.9.0.rst index 89556ae4c54..5db0cb34e02 100644 --- a/doc/nrf/releases/release-notes-1.9.0.rst +++ b/doc/nrf/releases/release-notes-1.9.0.rst @@ -373,7 +373,7 @@ nRF9160 samples * Added support for triggering neighbor cell measurements. - * :ref:`secure_partition_manager` sample: + * Secure Partition Manager sample: * Updated the sample by reducing the amount of RAM reserved in the default configuration of the sample for nRF9160, freeing up 32 Kb of RAM for the application. @@ -396,7 +396,7 @@ Other samples * Added support for front-end module devices that support 2-pin PA/LNA interface with additional support for the Skyworks SKY66114-11 and the Skyworks SKY66403-11. See the section Skyworks front-end module in the sample documentation for more information. - * :ref:`secure_partition_manager` sample: + * Secure Partition Manager sample: * Fixed: diff --git a/doc/nrf/releases/release-notes-2.0.0.rst b/doc/nrf/releases/release-notes-2.0.0.rst index 8b0c20eab96..a7502f800c5 100644 --- a/doc/nrf/releases/release-notes-2.0.0.rst +++ b/doc/nrf/releases/release-notes-2.0.0.rst @@ -360,7 +360,7 @@ nRF9160 samples * :ref:`nrf_cloud_rest_cell_pos_sample` sample, demonstrating how to use the :ref:`lib_nrf_cloud_rest` library to perform cellular positioning requests. * :ref:`ciphersuites` sample, demonstrating how to use TLS ciphersuites. -* :ref:`secure_partition_manager` (rather than TF-M) is enabled by default for the applications and samples that support Thingy:91. +* Secure Partition Manager (rather than TF-M) is enabled by default for the applications and samples that support Thingy:91. * :ref:`at_monitor_sample` sample: diff --git a/doc/nrf/releases/release-notes-2.1.0.rst b/doc/nrf/releases/release-notes-2.1.0.rst index 1530ef3f9c9..3691db75a86 100644 --- a/doc/nrf/releases/release-notes-2.1.0.rst +++ b/doc/nrf/releases/release-notes-2.1.0.rst @@ -912,9 +912,9 @@ Other libraries * Added default metrics for Bluetooth. -* :ref:`lib_spm`: +* Secure Partition Manager (SPM): - * Deprecated Secure Partition Manager (SPM) and the Kconfig option :kconfig:option:`CONFIG_SPM`. + * Deprecated Secure Partition Manager (SPM) and the Kconfig option ``CONFIG_SPM``. It is replaced by the Trusted Firmware-M (TF-M) as the supported trusted execution solution. See :ref:`ug_tfm` for more information about the TF-M. diff --git a/doc/nrf/templates/sample_README.rst b/doc/nrf/templates/sample_README.rst index 89e8f720e4e..e3ff11a785b 100644 --- a/doc/nrf/templates/sample_README.rst +++ b/doc/nrf/templates/sample_README.rst @@ -271,7 +271,6 @@ It uses the following Zephyr libraries: In addition, it uses the following secure firmware components: -* :ref:`secure_partition_manager` * :ref:`Trusted Firmware-M ` The sample also uses drivers from `nrfx`_. diff --git a/doc/nrf/ug_bootloader.rst b/doc/nrf/ug_bootloader.rst index 3c9688bccae..9778891ef8c 100644 --- a/doc/nrf/ug_bootloader.rst +++ b/doc/nrf/ug_bootloader.rst @@ -72,7 +72,7 @@ For detailed information about the memory layout, see the partition configuratio See :ref:`partition_manager` and :ref:`ug_multi_image` for details. By default, building an application with any bootloader configuration creates a :ref:`multi-image build `, where the :ref:`partition_manager` manages its memory partitions. -When building an application with :ref:`Cortex-M Security Extensions (CMSE) enabled `, the :ref:`secure_partition_manager` is also built with the image automatically. +When building an application with :ref:`Cortex-M Security Extensions (CMSE) enabled `, then :ref:`Trusted Firmware-M (TF-M) ` is also built with the image automatically. .. _immutable_bootloader: diff --git a/doc/nrf/ug_tfm.rst b/doc/nrf/ug_tfm.rst index 92a192a5a19..bbb5c712789 100644 --- a/doc/nrf/ug_tfm.rst +++ b/doc/nrf/ug_tfm.rst @@ -78,8 +78,6 @@ A minimal version of the TF-M secure application is provided in |NCS| to show ho The secure services supported by this minimal version allow for generating random numbers, and the platform services. -This corresponds to the feature set provided by the deprecated :ref:`secure_partition_manager` (SPM). - The minimal version of TF-M is disabled by setting the :kconfig:option:`CONFIG_TFM_PROFILE_TYPE_NOT_SET` option or one of the other build profiles. When :kconfig:option:`CONFIG_TFM_PROFILE_TYPE_MINIMAL` is set, the configurability of TF-M is severely limited. @@ -157,7 +155,7 @@ Migrating from Secure Partition Manager to Trusted Firmware-M ************************************************************* The interface to TF-M is different from the interface to SPM. -Due to that, the application code that uses the SPM :ref:`lib_secure_services` needs to be ported to use TF-M instead. +Due to that, the application code that uses the SPM Secure Services needs to be ported to use TF-M instead. TF-M can replace the following SPM services: diff --git a/samples/nrf9160/modem_trace_flash/README.rst b/samples/nrf9160/modem_trace_flash/README.rst index 624734e412e..6dd4563194e 100644 --- a/samples/nrf9160/modem_trace_flash/README.rst +++ b/samples/nrf9160/modem_trace_flash/README.rst @@ -116,5 +116,4 @@ It uses the following Zephyr libraries: In addition, it uses the following secure firmware components: -* :ref:`secure_partition_manager` * :ref:`Trusted Firmware-M ` diff --git a/scripts/partition_manager/partition_manager.rst b/scripts/partition_manager/partition_manager.rst index eb9e88ed461..0d2ac826438 100644 --- a/scripts/partition_manager/partition_manager.rst +++ b/scripts/partition_manager/partition_manager.rst @@ -205,27 +205,27 @@ The following 2 examples are equivalent: .. _partition_manager_span_ex1: - * In the following example, the mcuboot and spm configurations result in this partition order: ``mcuboot``, ``spm``, ``app``. - Therefore, the foo partition configuration is invalid, because ``spm`` must be placed between ``mcuboot`` and ``app``, but is not in the span list. + * In the following example, the mcuboot and tfm configurations result in this partition order: ``mcuboot``, ``tfm``, ``app``. + Therefore, the foo partition configuration is invalid, because ``tfm`` must be placed between ``mcuboot`` and ``app``, but is not in the span list. .. code-block:: yaml :caption: Span property example 1 (invalid) mcuboot: placement: - before: [spm, app] + before: [tfm, app] - spm: + tfm: placement: before: [app] foo: span: [mcuboot, app] - * In the following example, these mcuboot, spm, and app configurations have two possible orders: + * In the following example, these mcuboot, tfm, and app configurations have two possible orders: - * Order 1: mcuboot, spm, app - * Order 2: mcuboot, app, spm + * Order 1: mcuboot, tfm, app + * Order 2: mcuboot, app, tfm In the absence of additional configuration, the Partition Manager may choose either order. However, since a span configuring the foo partition is present, the Partition Manager should choose order 2, since it is the only order that results in a valid configuration for the foo partition. @@ -236,7 +236,7 @@ The following 2 examples are equivalent: mcuboot: placement: - spm: + tfm: placement: after: [mcuboot] @@ -248,10 +248,10 @@ The following 2 examples are equivalent: span: [mcuboot, app] - * In the following example, these mcuboot, spm, and app configurations have two possible orders: + * In the following example, these mcuboot, tfm, and app configurations have two possible orders: - * Order 1: mcuboot, spm, app - * Order 2: mcuboot, app, spm + * Order 1: mcuboot, tfm, app + * Order 2: mcuboot, app, tfm However, the overall configuration is unsatisfiable: foo requires order 2, while bar requires order 1. @@ -261,7 +261,7 @@ The following 2 examples are equivalent: mcuboot: placement: - spm: + tfm: placement: after: [mcuboot] @@ -273,7 +273,7 @@ The following 2 examples are equivalent: span: [mcuboot, app] bar: - span: [mcuboot, spm] + span: [mcuboot, tfm] .. _partition_manager_inside: @@ -407,7 +407,7 @@ The information extracted from devicetree is the alignment value for some partit align: {start: CONFIG_FPROTECT_BLOCK_SIZE} app_image: - span: [tfm, spm, app] + span: [tfm, app] s0_image: # S0 spans over the image booted by B0