blob: 1aca22b05b2711a25295ce2e84b98c74767a81e5 [file] [log] [blame]
Paul Beesley32379552019-02-11 17:58:21 +00001Trusted Firmware-A Release Notes
2================================
Douglas Raillard30d7b362017-06-28 16:14:55 +01003
Paul Beesley32379552019-02-11 17:58:21 +00004This document contains a summary of the new features, changes, fixes and known
5issues in each release of Trusted Firmware-A.
Douglas Raillard30d7b362017-06-28 16:14:55 +01006
7.. contents::
8
Paul Beesley32379552019-02-11 17:58:21 +00009Version 2.1
10-----------
Paul Beesleybbf48042019-03-25 12:21:57 +000011
12New Features
Paul Beesley32379552019-02-11 17:58:21 +000013^^^^^^^^^^^^
Paul Beesleybbf48042019-03-25 12:21:57 +000014
15- Architecture
16 - Support for ARMv8.3 pointer authentication in the normal and secure worlds
17
18 The use of pointer authentication in the normal world is enabled whenever
19 architectural support is available, without the need for additional build
20 flags.
21
22 Use of pointer authentication in the secure world remains an
23 experimental configuration at this time. Using both the ``ENABLE_PAUTH``
24 and ``CTX_INCLUDE_PAUTH_REGS`` build flags, pointer authentication can be
25 enabled in EL3 and S-EL1/0.
26
27 See the `Firmware Design`_ document for additional details on the use of
28 pointer authentication.
29
30 - Enable Data Independent Timing (DIT) in EL3, where supported
31
32- Build System
33 - Support for BL-specific build flags
34
35 - Support setting compiler target architecture based on ``ARM_ARCH_MINOR``
36 build option.
37
38 - New ``RECLAIM_INIT_CODE`` build flag:
39
40 A significant amount of the code used for the initialization of BL31 is
41 not needed again after boot time. In order to reduce the runtime memory
42 footprint, the memory used for this code can be reclaimed after
43 initialization.
44
45 Certain boot-time functions were marked with the ``__init`` attribute to
46 enable this reclamation.
47
48- CPU Support
49 - cortex-a76: Workaround for erratum 1073348
50 - cortex-a76: Workaround for erratum 1220197
51 - cortex-a76: Workaround for erratum 1130799
52
53 - cortex-a75: Workaround for erratum 790748
54 - cortex-a75: Workaround for erratum 764081
55
56 - cortex-a73: Workaround for erratum 852427
57 - cortex-a73: Workaround for erratum 855423
58
59 - cortex-a57: Workaround for erratum 817169
60 - cortex-a57: Workaround for erratum 814670
61
62 - cortex-a55: Workaround for erratum 903758
63 - cortex-a55: Workaround for erratum 846532
64 - cortex-a55: Workaround for erratum 798797
65 - cortex-a55: Workaround for erratum 778703
66 - cortex-a55: Workaround for erratum 768277
67
68 - cortex-a53: Workaround for erratum 819472
69 - cortex-a53: Workaround for erratum 824069
70 - cortex-a53: Workaround for erratum 827319
71
72 - cortex-a17: Workaround for erratum 852423
73 - cortex-a17: Workaround for erratum 852421
74
75 - cortex-a15: Workaround for erratum 816470
76 - cortex-a15: Workaround for erratum 827671
77
78- Documentation
79 - Exception Handling Framework documentation
80
81 - Library at ROM (romlib) documentation
82
83 - RAS framework documentation
84
85 - Coding Guidelines document
86
87- Drivers
88 - ccn: Add API for setting and reading node registers
89 - Adds ``ccn_read_node_reg`` function
90 - Adds ``ccn_write_node_reg`` function
91
92 - partition: Support MBR partition entries
93
94 - scmi: Add ``plat_css_get_scmi_info`` function
95
96 Adds a new API ``plat_css_get_scmi_info`` which lets the platform
97 register a platform-specific instance of ``scmi_channel_plat_info_t`` and
98 remove the default values
99
Paul Beesleybd1c4162019-03-29 10:14:56 +0000100 - tzc380: Add TZC-380 TrustZone Controller driver
Paul Beesleybbf48042019-03-25 12:21:57 +0000101
102 - tzc-dmc620: Add driver to manage the TrustZone Controller within the
103 DMC-620 Dynamic Memory Controller
104
105- Library at ROM (romlib)
106 - Add platform-specific jump table list
107
108 - Allow patching of romlib functions
109
110 This change allows patching of functions in the romlib. This can be done by
111 adding "patch" at the end of the jump table entry for the function that
112 needs to be patched in the file jmptbl.i.
113
114- Library Code
115 - Support non-LPAE-enabled MMU tables in AArch32
116
117 - mmio: Add ``mmio_clrsetbits_16`` function
118 - 16-bit variant of ``mmio_clrsetbits``
119
120 - object_pool: Add Object Pool Allocator
121 - Manages object allocation using a fixed-size static array
122 - Adds ``pool_alloc`` and ``pool_alloc_n`` functions
123 - Does not provide any functions to free allocated objects (by design)
124
125 - libc: Added ``strlcpy`` function
126
127 - libc: Import ``strrchr`` function from FreeBSD
128
129 - xlat_tables: Add support for ARMv8.4-TTST
130
131 - xlat_tables: Support mapping regions without an explicitly specified VA
132
133- Math
134 - Added softudiv macro to support software division
135
136- Memory Partitioning And Monitoring (MPAM)
137 - Enabled MPAM EL2 traps (``MPAMHCR_EL2`` and ``MPAM_EL2``)
138
139- Platforms
140 - amlogic: Add support for Meson S905 (GXBB)
141
142 - arm/fvp_ve: Add support for FVP Versatile Express platform
143
144 - arm/n1sdp: Add support for Neoverse N1 System Development platform
145
146 - arm/rde1edge: Add support for Neoverse E1 platform
147
148 - arm/rdn1edge: Add support for Neoverse N1 platform
149
150 - arm: Add support for booting directly to Linux without an intermediate
151 loader (AArch32)
152
153 - arm/juno: Enable new CPU errata workarounds for A53 and A57
154
155 - arm/juno: Add romlib support
156
157 Building a combined BL1 and ROMLIB binary file with the correct page
158 alignment is now supported on the Juno platform. When ``USE_ROMLIB`` is set
159 for Juno, it generates the combined file ``bl1_romlib.bin`` which needs to
160 be used instead of bl1.bin.
161
162 - intel/stratix: Add support for Intel Stratix 10 SoC FPGA platform
163
164 - marvell: Add support for Armada-37xx SoC platform
165
166 - nxp: Add support for i.MX8M and i.MX7 Warp7 platforms
167
168 - renesas: Add support for R-Car Gen3 platform
169
170 - xilinx: Add support for Versal ACAP platforms
171
172- Position-Independent Executable (PIE)
173
174 PIE support has initially been added to BL31. The ``ENABLE_PIE`` build flag is
175 used to enable or disable this functionality as required.
176
177- Secure Partition Manager
Paul Beesleybd1c4162019-03-29 10:14:56 +0000178 - New SPM implementation based on SPCI Alpha 1 draft specification
Paul Beesleybbf48042019-03-25 12:21:57 +0000179
Paul Beesleybd1c4162019-03-29 10:14:56 +0000180 A new version of SPM has been implemented, based on the SPCI (Secure
181 Partition Client Interface) and SPRT (Secure Partition Runtime) draft
182 specifications.
Paul Beesleybbf48042019-03-25 12:21:57 +0000183
184 The new implementation is a prototype that is expected to undergo intensive
185 rework as the specifications change. It has basic support for multiple
186 Secure Partitions and Resource Descriptions.
187
Paul Beesleybd1c4162019-03-29 10:14:56 +0000188 The older version of SPM, based on MM (ARM Management Mode Interface
Paul Beesleybbf48042019-03-25 12:21:57 +0000189 Specification), is still present in the codebase. A new build flag,
190 ``SPM_MM`` has been added to allow selection of the desired implementation.
191 This flag defaults to 1, selecting the MM-based implementation.
192
193- Security
194 - Spectre Variant-1 mitigations (``CVE-2017-5753``)
195
196 - Use Speculation Store Bypass Safe (SSBS) functionality where available
197
198 Provides mitigation against ``CVE-2018-19440`` (Not saving x0 to x3
199 registers can leak information from one Normal World SMC client to another)
200
201
202Changed
Paul Beesley32379552019-02-11 17:58:21 +0000203^^^^^^^
Paul Beesleybbf48042019-03-25 12:21:57 +0000204
205- Build System
206 - Warning levels are now selectable with ``W=<1,2,3>``
207
208 - Removed unneeded include paths in PLAT_INCLUDES
209
210 - "Warnings as errors" (Werror) can be disabled using ``E=0``
211
212 - Support totally quiet output with ``-s`` flag
213
214 - Support passing options to checkpatch using ``CHECKPATCH_OPTS=<opts>``
215
216 - Invoke host compiler with ``HOSTCC / HOSTCCFLAGS`` instead of ``CC / CFLAGS``
217
218 - Make device tree pre-processing similar to U-boot/Linux by:
219 - Creating separate ``CPPFLAGS`` for DT preprocessing so that compiler
220 options specific to it can be accommodated.
221 - Replacing ``CPP`` with ``PP`` for DT pre-processing
222
223- CPU Support
224 - Errata report function definition is now mandatory for CPU support files
225
226 CPU operation files must now define a ``<name>_errata_report`` function to
227 print errata status. This is no longer a weak reference.
228
229- Documentation
230 - Migrated some content from GitHub wiki to ``docs/`` directory
231
232 - Security advisories now have CVE links
233
234 - Updated copyright guidelines
235
Paul Beesleybbf48042019-03-25 12:21:57 +0000236- Drivers
237 - console: The ``MULTI_CONSOLE_API`` framework has been rewritten in C
Paul Beesleybd1c4162019-03-29 10:14:56 +0000238
Paul Beesleybbf48042019-03-25 12:21:57 +0000239 - console: Ported multi-console driver to AArch32
240
241 - gic: Remove 'lowest priority' constants
242
243 Removed ``GIC_LOWEST_SEC_PRIORITY`` and ``GIC_LOWEST_NS_PRIORITY``.
244 Platforms should define these if required, or instead determine the correct
245 priority values at runtime.
246
247 - delay_timer: Check that the Generic Timer extension is present
248
249 - mmc: Increase command reply timeout to 10 milliseconds
250
251 - mmc: Poll eMMC device status to ensure ``EXT_CSD`` command completion
252
253 - mmc: Correctly check return code from ``mmc_fill_device_info``
254
255- External Libraries
256
257 - libfdt: Upgraded from 1.4.2 to 1.4.6-9
258
259 - mbed TLS: Upgraded from 2.12 to 2.16
260
261 This change incorporates fixes for security issues that should be reviewed
262 to determine if they are relevant for software implementations using
263 Trusted Firmware-A. See the `mbed TLS releases`_ page for details on
264 changes from the 2.12 to the 2.16 release.
265
266- Library Code
267 - compiler-rt: Updated ``lshrdi3.c`` and ``int_lib.h`` with changes from
268 LLVM master branch (r345645)
269
270 - cpu: Updated macro that checks need for ``CVE-2017-5715`` mitigation
271
272 - libc: Made setjmp and longjmp C standard compliant
273
274 - libc: Allowed overriding the default libc (use ``OVERRIDE_LIBC``)
275
276 - libc: Moved setjmp and longjmp to the ``libc/`` directory
277
278- Platforms
279 - Removed Mbed TLS dependency from plat_bl_common.c
280
281 - arm: Removed unused ``ARM_MAP_BL_ROMLIB`` macro
282
283 - arm: Removed ``ARM_BOARD_OPTIMISE_MEM`` feature and build flag
284
285 - arm: Moved several components into ``drivers/`` directory
286
287 This affects the SDS, SCP, SCPI, MHU and SCMI components
288
289 - arm/juno: Increased maximum BL2 image size to ``0xF000``
290
291 This change was required to accommodate a larger ``libfdt`` library
292
293- SCMI
294 - Optimized bakery locks when hardware-assisted coherency is enabled using the
295 ``HW_ASSISTED_COHERENCY`` build flag
296
297- SDEI
298 - Added support for unconditionally resuming secure world execution after
299 SDEI event processing completes
300
301 SDEI interrupts, although targeting EL3, occur on behalf of the non-secure
302 world, and may have higher priority than secure world
303 interrupts. Therefore they might preempt secure execution and yield
304 execution to the non-secure SDEI handler. Upon completion of SDEI event
305 handling, resume secure execution if it was preempted.
306
307- Translation Tables (XLAT)
308 - Dynamically detect need for ``Common not Private (TTBRn_ELx.CnP)`` bit
309
310 Properly handle the case where ``ARMv8.2-TTCNP`` is implemented in a CPU
311 that does not implement all mandatory v8.2 features (and so must claim to
312 implement a lower architecture version).
313
314
315Resolved Issues
Paul Beesley32379552019-02-11 17:58:21 +0000316^^^^^^^^^^^^^^^
Paul Beesleybbf48042019-03-25 12:21:57 +0000317
318- Architecture
319 - Incorrect check for SSBS feature detection
320
321 - Unintentional register clobber in AArch32 reset_handler function
322
323- Build System
324 - Dependency issue during DTB image build
325
326 - Incorrect variable expansion in Arm platform makefiles
327
328 - Building on Windows with verbose mode (``V=1``) enabled is broken
329
330 - AArch32 compilation flags is missing ``$(march32-directive)``
331
332- BL-Specific Issues
333 - bl2: ``uintptr_t is not defined`` error when ``BL2_IN_XIP_MEM`` is defined
334
335 - bl2: Missing prototype warning in ``bl2_arch_setup``
336
337 - bl31: Omission of Global Offset Table (GOT) section
338
339- Code Quality Issues
340 - Multiple MISRA compliance issues
341
342 - Potential NULL pointer dereference (Coverity-detected)
343
344- Drivers
345 - mmc: Local declaration of ``scr`` variable causes a cache issue when
346 invalidating after the read DMA transfer completes
347
348 - mmc: ``ACMD41`` does not send voltage information during initialization,
349 resulting in the command being treated as a query. This prevents the
350 command from initializing the controller.
351
352 - mmc: When checking device state using ``mmc_device_state()`` there are no
353 retries attempted in the event of an error
354
355 - ccn: Incorrect Region ID calculation for RN-I nodes
356
357 - console: ``Fix MULTI_CONSOLE_API`` when used as a crash console
358
359 - partition: Improper NULL checking in gpt.c
360
361 - partition: Compilation failure in ``VERBOSE`` mode (``V=1``)
362
363- Library Code
364 - common: Incorrect check for Address Authentication support
365
366 - xlat: Fix XLAT_V1 / XLAT_V2 incompatibility
367
368 The file ``arm_xlat_tables.h`` has been renamed to ``xlat_tables_compat.h``
369 and has been moved to a common folder. This header can be used to guarantee
370 compatibility, as it includes the correct header based on
371 ``XLAT_TABLES_LIB_V2``.
372
373 - xlat: armclang unused-function warning on ``xlat_clean_dcache_range``
374
375 - xlat: Invalid ``mm_cursor`` checks in ``mmap_add`` and ``mmap_add_ctx``
376
377 - sdei: Missing ``context.h`` header
378
379- Platforms
380 - common: Missing prototype warning for ``plat_log_get_prefix``
381
382 - arm: Insufficient maximum BL33 image size
383
384 - arm: Potential memory corruption during BL2-BL31 transition
385
386 On Arm platforms, the BL2 memory can be overlaid by BL31/BL32. The memory
387 descriptors describing the list of executable images are created in BL2
388 R/W memory, which could be possibly corrupted later on by BL31/BL32 due
389 to overlay. This patch creates a reserved location in SRAM for these
390 descriptors and are copied over by BL2 before handing over to next BL
391 image.
392
393 - juno: Invalid behaviour when ``CSS_USE_SCMI_SDS_DRIVER`` is not set
394
395 In ``juno_pm.c`` the ``css_scmi_override_pm_ops`` function was used
396 regardless of whether the build flag was set. The original behaviour has
397 been restored in the case where the build flag is not set.
398
399- Tools
400 - fiptool: Incorrect UUID parsing of blob parameters
401
402 - doimage: Incorrect object rules in Makefile
403
404
405Deprecations
Paul Beesley32379552019-02-11 17:58:21 +0000406^^^^^^^^^^^^
Paul Beesleybbf48042019-03-25 12:21:57 +0000407
408- Common Code
409 - ``plat_crash_console_init`` function
410
411 - ``plat_crash_console_putc`` function
412
413 - ``plat_crash_console_flush`` function
414
415 - ``finish_console_register`` macro
416
417- AArch64-specific Code
418 - helpers: ``get_afflvl_shift``
419
420 - helpers: ``mpidr_mask_lower_afflvls``
421
422 - helpers: ``eret``
423
424- Secure Partition Manager (SPM)
425 - Boot-info structure
426
427
428Known Issues
Paul Beesley32379552019-02-11 17:58:21 +0000429^^^^^^^^^^^^
Paul Beesleybbf48042019-03-25 12:21:57 +0000430
431- Build System Issues
432 - dtb: DTB creation not supported when building on a Windows host.
433
434 This step in the build process is skipped when running on a Windows host. A
435 known issue from the 1.6 release.
436
437- Platform Issues
438 - arm/juno: System suspend from Linux does not function as documented in the
439 user guide
440
441 Following the instructions provided in the user guide document does not
442 result in the platform entering system suspend state as expected. A message
443 relating to the hdlcd driver failing to suspend will be emitted on the
444 Linux terminal.
445
Soby Mathewb58f97a2019-03-28 13:46:40 +0000446 - arm/juno: The firmware update use-cases do not work with motherboard
447 firmware version < v1.5.0 (the reset reason is not preserved). The Linaro
448 18.04 release has MB v1.4.9. The MB v1.5.0 is available in Linaro 18.10
449 release.
450
Paul Beesleybbf48042019-03-25 12:21:57 +0000451 - mediatek/mt6795: This platform does not build in this release
452
Paul Beesley32379552019-02-11 17:58:21 +0000453Version 2.0
454-----------
Joanna Farleyadd34512018-09-28 08:38:17 +0100455
456New Features
Paul Beesley32379552019-02-11 17:58:21 +0000457^^^^^^^^^^^^
Joanna Farleyadd34512018-09-28 08:38:17 +0100458
Paul Beesley1fbc97b2019-01-11 18:26:51 +0000459- Removal of a number of deprecated APIs
Joanna Farleyadd34512018-09-28 08:38:17 +0100460
461 - A new Platform Compatibility Policy document has been created which
462 references a wiki page that maintains a listing of deprecated
463 interfaces and the release after which they will be removed.
464
465 - All deprecated interfaces except the MULTI_CONSOLE_API have been removed
466 from the code base.
467
468 - Various Arm and partner platforms have been updated to remove the use of
Paul Beesley1fbc97b2019-01-11 18:26:51 +0000469 removed APIs in this release.
Joanna Farleyadd34512018-09-28 08:38:17 +0100470
471 - This release is otherwise unchanged from 1.6 release
472
473Issues resolved since last release
Paul Beesley32379552019-02-11 17:58:21 +0000474^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Joanna Farleyadd34512018-09-28 08:38:17 +0100475
476- No issues known at 1.6 release resolved in 2.0 release
477
478Known Issues
Paul Beesley32379552019-02-11 17:58:21 +0000479^^^^^^^^^^^^
Joanna Farleyadd34512018-09-28 08:38:17 +0100480
481- DTB creation not supported when building on a Windows host. This step in the
482 build process is skipped when running on a Windows host. Known issue from
483 1.6 version.
484
485- As a result of removal of deprecated interfaces the Nvidia Tegra, Marvell
486 Armada 8K and MediaTek MT6795 platforms do not build in this release.
487 Also MediaTek MT8173, NXP QorIQ LS1043A, NXP i.MX8QX, NXP i.MX8QMa,
488 Rockchip RK3328, Rockchip RK3368 and Rockchip RK3399 platforms have not been
489 confirmed to be working after the removal of the deprecated interfaces
490 although they do build.
491
Paul Beesley32379552019-02-11 17:58:21 +0000492Version 1.6
493-----------
Joanna Farley325ef902018-09-11 15:51:31 +0100494
495New Features
Paul Beesley32379552019-02-11 17:58:21 +0000496^^^^^^^^^^^^
Joanna Farley325ef902018-09-11 15:51:31 +0100497
Joanna Farleyadd34512018-09-28 08:38:17 +0100498- Addressing Speculation Security Vulnerabilities
Joanna Farley325ef902018-09-11 15:51:31 +0100499
500 - Implement static workaround for CVE-2018-3639 for AArch32 and AArch64
501
502 - Add support for dynamic mitigation for CVE-2018-3639
503
504 - Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76
505
506 - Ensure SDEI handler executes with CVE-2018-3639 mitigation enabled
507
508- Introduce RAS handling on AArch64
509
John Tsichritzisf93256f2018-10-05 14:16:26 +0100510 - Some RAS extensions are mandatory for Armv8.2 CPUs, with others
511 mandatory for Armv8.4 CPUs however, all extensions are also optional
512 extensions to the base Armv8.0 architecture.
Joanna Farley325ef902018-09-11 15:51:31 +0100513
John Tsichritzisf93256f2018-10-05 14:16:26 +0100514 - The Armv8 RAS Extensions introduced Standard Error Records which are a
Joanna Farley325ef902018-09-11 15:51:31 +0100515 set of standard registers to configure RAS node policy and allow RAS
516 Nodes to record and expose error information for error handling agents.
517
518 - Capabilities are provided to support RAS Node enumeration and iteration
519 along with individual interrupt registrations and fault injections
520 support.
521
522 - Introduce handlers for Uncontainable errors, Double Faults and EL3
523 External Aborts
524
525- Enable Memory Partitioning And Monitoring (MPAM) for lower EL's
526
527 - Memory Partitioning And Monitoring is an Armv8.4 feature that enables
528 various memory system components and resources to define partitions.
529 Software running at various ELs can then assign themselves to the
530 desired partition to control their performance aspects.
531
532 - When ENABLE_MPAM_FOR_LOWER_ELS is set to 1, EL3 allows
533 lower ELs to access their own MPAM registers without trapping to EL3.
534 This patch however, doesn't make use of partitioning in EL3; platform
535 initialisation code should configure and use partitions in EL3 if
536 required.
537
538- Introduce ROM Lib Feature
539
540 - Support combining several libraries into a self-called "romlib" image,
541 that may be shared across images to reduce memory footprint. The romlib
542 image is stored in ROM but is accessed through a jump-table that may be
543 stored in read-write memory, allowing for the library code to be patched.
544
545- Introduce Backtrace Feature
546
547 - This function displays the backtrace, the current EL and security state
548 to allow a post-processing tool to choose the right binary to interpret
549 the dump.
550
551 - Print backtrace in assert() and panic() to the console.
552
553- Code hygiene changes and alignment with MISRA C-2012 guideline with fixes
554 addressing issues complying to the following rules:
555
556 - MISRA rules 4.9, 5.1, 5.3, 5.7, 8.2-8.5, 8.8, 8.13, 9.3, 10.1,
557 10.3-10.4, 10.8, 11.3, 11.6, 12.1, 14.4, 15.7, 16.1-16.7, 17.7-17.8,
558 20.7, 20.10, 20.12, 21.1, 21.15, 22.7
559
560 - Clean up the usage of void pointers to access symbols
561
562 - Increase usage of static qualifier to locally used functions and data
563
564 - Migrated to use of u_register_t for register read/write to better
565 match AArch32 and AArch64 type sizes
566
567 - Use int-ll64 for both AArch32 and AArch64 to assist in consistent
568 format strings between architectures
569
570 - Clean up TF-A libc by removing non arm copyrighted implementations
571 and replacing them with modified FreeBSD and SCC implementations
572
573- Various changes to support Clang linker and assembler
574
John Tsichritzisf93256f2018-10-05 14:16:26 +0100575 - The clang assembler/preprocessor is used when Clang is selected. However,
Joanna Farley325ef902018-09-11 15:51:31 +0100576 the clang linker is not used because it is unable to link TF-A objects
577 due to immaturity of clang linker functionality at this time.
578
Paul Beesley1fbc97b2019-01-11 18:26:51 +0000579- Refactor support APIs into Libraries
Joanna Farley325ef902018-09-11 15:51:31 +0100580
581 - Evolve libfdt, mbed TLS library and standard C library sources as
582 proper libraries that TF-A may be linked against.
583
584- CPU Enhancements
585
586 - Add CPU support for Cortex-Ares and Cortex-A76
587
588 - Add AMU support for Cortex-Ares
589
590 - Add initial CPU support for Cortex-Deimos
591
592 - Add initial CPU support for Cortex-Helios
593
594 - Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76
595
596 - Implement Cortex-Ares erratum 1043202 workaround
597
598 - Implement DSU erratum 936184 workaround
599
600 - Check presence of fix for errata 843419 in Cortex-A53
601
602 - Check presence of fix for errata 835769 in Cortex-A53
603
604- Translation Tables Enhancements
605
606 - The xlat v2 library has been refactored in order to be reused by
607 different TF components at different EL's including the addition of EL2.
608 Some refactoring to make the code more generic and less specific to TF,
609 in order to reuse the library outside of this project.
610
611- SPM Enhancements
612
613 - General cleanups and refactoring to pave the way to multiple partitions
614 support
615
616- SDEI Enhancements
617
618 - Allow platforms to define explicit events
619
620 - Determine client EL from NS context's SCR_EL3
621
622 - Make dispatches synchronous
623
624 - Introduce jump primitives for BL31
625
626 - Mask events after CPU wakeup in SDEI dispatcher to conform to the
627 specification
628
629- Misc TF-A Core Common Code Enhancements
630
631 - Add support for eXecute In Place (XIP) memory in BL2
632
633 - Add support for the SMC Calling Convention 2.0
634
635 - Introduce External Abort handling on AArch64
636 External Abort routed to EL3 was reported as an unhandled exception
637 and caused a panic. This change enables Arm Trusted Firmware-A to
638 handle External Aborts routed to EL3.
639
640 - Save value of ACTLR_EL1 implementation-defined register in the CPU
641 context structure rather than forcing it to 0.
642
643 - Introduce ARM_LINUX_KERNEL_AS_BL33 build option, which allows BL31 to
644 directly jump to a Linux kernel. This makes for a quicker and simpler
645 boot flow, which might be useful in some test environments.
646
647 - Add dynamic configurations for BL31, BL32 and BL33 enabling support for
648 Chain of Trust (COT).
649
650 - Make TF UUID RFC 4122 compliant
651
652- New Platform Support
653
654 - Arm SGI-575
655
656 - Arm SGM-775
657
658 - Allwinner sun50i_64
659
660 - Allwinner sun50i_h6
661
John Tsichritzisf93256f2018-10-05 14:16:26 +0100662 - NXP QorIQ LS1043A
Joanna Farley325ef902018-09-11 15:51:31 +0100663
664 - NXP i.MX8QX
665
666 - NXP i.MX8QM
667
John Tsichritzisf93256f2018-10-05 14:16:26 +0100668 - NXP i.MX7Solo WaRP7
669
Joanna Farley325ef902018-09-11 15:51:31 +0100670 - TI K3
671
672 - Socionext Synquacer SC2A11
673
674 - Marvell Armada 8K
675
676 - STMicroelectronics STM32MP1
677
678- Misc Generic Platform Common Code Enhancements
679
680 - Add MMC framework that supports both eMMC and SD card devices
681
682- Misc Arm Platform Common Code Enhancements
683
684 - Demonstrate PSCI MEM_PROTECT from el3_runtime
685
686 - Provide RAS support
687
688 - Migrate AArch64 port to the multi console driver. The old API is
689 deprecated and will eventually be removed.
690
691 - Move BL31 below BL2 to enable BL2 overlay resulting in changes in the
692 layout of BL images in memory to enable more efficient use of available
693 space.
694
695 - Add cpp build processing for dtb that allows processing device tree
696 with external includes.
697
698 - Extend FIP io driver to support multiple FIP devices
699
700 - Add support for SCMI AP core configuration protocol v1.0
701
702 - Use SCMI AP core protocol to set the warm boot entrypoint
703
704 - Add support to Mbed TLS drivers for shared heap among different
705 BL images to help optimise memory usage
706
707 - Enable non-secure access to UART1 through a build option to support
708 a serial debug port for debugger connection
709
710- Enhancements for Arm Juno Platform
711
712 - Add support for TrustZone Media Protection 1 (TZMP1)
713
714- Enhancements for Arm FVP Platform
715
716 - Dynamic_config: remove the FVP dtb files
717
718 - Set DYNAMIC_WORKAROUND_CVE_2018_3639=1 on FVP by default
719
720 - Set the ability to dynamically disable Trusted Boot Board
721 authentication to be off by default with DYN_DISABLE_AUTH
722
723 - Add librom enhancement support in FVP
724
725 - Support shared Mbed TLS heap between BL1 and BL2 that allow a
726 reduction in BL2 size for FVP
727
728- Enhancements for Arm SGI/SGM Platform
729
730 - Enable ARM_PLAT_MT flag for SGI-575
731
732 - Add dts files to enable support for dynamic config
733
734 - Add RAS support
735
736 - Support shared Mbed TLS heap for SGI and SGM between BL1 and BL2
737
738- Enhancements for Non Arm Platforms
739
740 - Raspberry Pi Platform
741
742 - Hikey Platforms
743
744 - Xilinx Platforms
745
746 - QEMU Platform
747
748 - Rockchip rk3399 Platform
749
750 - TI Platforms
751
752 - Socionext Platforms
753
754 - Allwinner Platforms
755
756 - NXP Platforms
757
758 - NVIDIA Tegra Platform
759
760 - Marvell Platforms
761
762 - STMicroelectronics STM32MP1 Platform
763
764Issues resolved since last release
Paul Beesley32379552019-02-11 17:58:21 +0000765^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Joanna Farley325ef902018-09-11 15:51:31 +0100766
767- No issues known at 1.5 release resolved in 1.6 release
768
769Known Issues
Paul Beesley32379552019-02-11 17:58:21 +0000770^^^^^^^^^^^^
Joanna Farley325ef902018-09-11 15:51:31 +0100771
772- DTB creation not supported when building on a Windows host. This step in the
773 build process is skipped when running on a Windows host. Known issue from
774 1.5 version.
775
Paul Beesley32379552019-02-11 17:58:21 +0000776Version 1.5
777-----------
David Cunadob1580432018-03-14 17:57:31 +0000778
779New features
Paul Beesley32379552019-02-11 17:58:21 +0000780^^^^^^^^^^^^
David Cunadob1580432018-03-14 17:57:31 +0000781
782- Added new firmware support to enable RAS (Reliability, Availability, and
783 Serviceability) functionality.
784
785 - Secure Partition Manager (SPM): A Secure Partition is a software execution
786 environment instantiated in S-EL0 that can be used to implement simple
787 management and security services. The SPM is the firmware component that
788 is responsible for managing a Secure Partition.
789
790 - SDEI dispatcher: Support for interrupt-based SDEI events and all
791 interfaces as defined by the SDEI specification v1.0, see
792 `SDEI Specification`_
793
794 - Exception Handling Framework (EHF): Framework that allows dispatching of
795 EL3 interrupts to their registered handlers which are registered based on
796 their priorities. Facilitates firmware-first error handling policy where
797 asynchronous exceptions may be routed to EL3.
798
799 Integrated the TSPD with EHF.
800
801- Updated PSCI support:
802
803 - Implemented PSCI v1.1 optional features `MEM_PROTECT` and `SYSTEM_RESET2`.
804 The supported PSCI version was updated to v1.1.
805
806 - Improved PSCI STAT timestamp collection, including moving accounting for
807 retention states to be inside the locks and fixing handling of wrap-around
808 when calculating residency in AArch32 execution state.
809
810 - Added optional handler for early suspend that executes when suspending to
811 a power-down state and with data caches enabled.
812
813 This may provide a performance improvement on platforms where it is safe
814 to perform some or all of the platform actions from `pwr_domain_suspend`
815 with the data caches enabled.
816
817- Enabled build option, BL2_AT_EL3, for BL2 to allow execution at EL3 without
818 any dependency on TF BL1.
819
820 This allows platforms which already have a non-TF Boot ROM to directly load
821 and execute BL2 and subsequent BL stages without need for BL1. This was not
822 previously possible because BL2 executes at S-EL1 and cannot jump straight to
823 EL3.
824
825- Implemented support for SMCCC v1.1, including `SMCCC_VERSION` and
826 `SMCCC_ARCH_FEATURES`.
827
828 Additionally, added support for `SMCCC_VERSION` in PSCI features to enable
829 discovery of the SMCCC version via PSCI feature call.
830
831- Added Dynamic Configuration framework which enables each of the boot loader
832 stages to be dynamically configured at runtime if required by the platform.
833 The boot loader stage may optionally specify a firmware configuration file
834 and/or hardware configuration file that can then be shared with the next boot
835 loader stage.
836
837 Introduced a new BL handover interface that essentially allows passing of 4
838 arguments between the different BL stages.
839
840 Updated cert_create and fip_tool to support the dynamic configuration files.
841 The COT also updated to support these new files.
842
843- Code hygiene changes and alignment with MISRA guideline:
844
845 - Fix use of undefined macros.
846
847 - Achieved compliance with Mandatory MISRA coding rules.
848
849 - Achieved compliance for following Required MISRA rules for the default
850 build configurations on FVP and Juno platforms : 7.3, 8.3, 8.4, 8.5 and
851 8.8.
852
853- Added support for Armv8.2-A architectural features:
854
855 - Updated translation table set-up to set the CnP (Common not Private) bit
856 for secure page tables so that multiple PEs in the same Inner Shareable
857 domain can use the same translation table entries for a given stage of
858 translation in a particular translation regime.
859
860 - Extended the supported values of ID_AA64MMFR0_EL1.PARange to include the
861 52-bit Physical Address range.
862
863 - Added support for the Scalable Vector Extension to allow Normal world
864 software to access SVE functionality but disable access to SVE, SIMD and
865 floating point functionality from the Secure world in order to prevent
866 corruption of the Z-registers.
867
868- Added support for Armv8.4-A architectural feature Activity Monitor Unit (AMU)
869 extensions.
870
871 In addition to the v8.4 architectural extension, AMU support on Cortex-A75
872 was implemented.
873
874- Enhanced OP-TEE support to enable use of pageable OP-TEE image. The Arm
875 standard platforms are updated to load up to 3 images for OP-TEE; header,
876 pager image and paged image.
877
878 The chain of trust is extended to support the additional images.
879
880- Enhancements to the translation table library:
881
882 - Introduced APIs to get and set the memory attributes of a region.
883
Paul Beesley1fbc97b2019-01-11 18:26:51 +0000884 - Added support to manage both privilege levels in translation regimes that
David Cunadob1580432018-03-14 17:57:31 +0000885 describe translations for 2 Exception levels, specifically the EL1&0
886 translation regime, and extended the memory map region attributes to
887 include specifying Non-privileged access.
888
889 - Added support to specify the granularity of the mappings of each region,
890 for instance a 2MB region can be specified to be mapped with 4KB page
891 tables instead of a 2MB block.
892
893 - Disabled the higher VA range to avoid unpredictable behaviour if there is
894 an attempt to access addresses in the higher VA range.
895
896 - Added helpers for Device and Normal memory MAIR encodings that align with
897 the Arm Architecture Reference Manual for Armv8-A (Arm DDI0487B.b).
898
899 - Code hygiene including fixing type length and signedness of constants,
900 refactoring of function to enable the MMU, removing all instances where
901 the virtual address space is hardcoded and added comments that document
902 alignment needed between memory attributes and attributes specified in
903 TCR_ELx.
904
905- Updated GIC support:
906
907 - Introduce new APIs for GICv2 and GICv3 that provide the capability to
908 specify interrupt properties rather than list of interrupt numbers alone.
909 The Arm platforms and other upstream platforms are migrated to use
910 interrupt properties.
911
912 - Added helpers to save / restore the GICv3 context, specifically the
913 Distributor and Redistributor contexts and architectural parts of the ITS
914 power management. The Distributor and Redistributor helpers also support
915 the implementation-defined part of GIC-500 and GIC-600.
916
917 Updated the Arm FVP platform to save / restore the GICv3 context on system
918 suspend / resume as an example of how to use the helpers.
919
920 Introduced a new TZC secured DDR carve-out for use by Arm platforms for
921 storing EL3 runtime data such as the GICv3 register context.
922
923- Added support for Armv7-A architecture via build option ARM_ARCH_MAJOR=7.
924 This includes following features:
925
926 - Updates GICv2 driver to manage GICv1 with security extensions.
927
928 - Software implementation for 32bit division.
929
930 - Enabled use of generic timer for platforms that do not set
931 ARM_CORTEX_Ax=yes.
932
933 - Support for Armv7-A Virtualization extensions [DDI0406C_C].
934
935 - Support for both Armv7-A platforms that only have 32-bit addressing and
936 Armv7-A platforms that support large page addressing.
937
938 - Included support for following Armv7 CPUs: Cortex-A12, Cortex-A17,
939 Cortex-A7, Cortex-A5, Cortex-A9, Cortex-A15.
940
941 - Added support in QEMU for Armv7-A/Cortex-A15.
942
943- Enhancements to Firmware Update feature:
944
945 - Updated the FWU documentation to describe the additional images needed for
946 Firmware update, and how they are used for both the Juno platform and the
947 Arm FVP platforms.
948
949- Enhancements to Trusted Board Boot feature:
950
951 - Added support to cert_create tool for RSA PKCS1# v1.5 and SHA384, SHA512
952 and SHA256.
953
954 - For Arm platforms added support to use ECDSA keys.
955
956 - Enhanced the mbed TLS wrapper layer to include support for both RSA and
957 ECDSA to enable runtime selection between RSA and ECDSA keys.
958
959- Added support for secure interrupt handling in AArch32 sp_min, hardcoded to
960 only handle FIQs.
961
962- Added support to allow a platform to load images from multiple boot sources,
963 for example from a second flash drive.
964
965- Added a logging framework that allows platforms to reduce the logging level
966 at runtime and additionally the prefix string can be defined by the platform.
967
968- Further improvements to register initialisation:
969
970 - Control register PMCR_EL0 / PMCR is set to prohibit cycle counting in the
971 secure world. This register is added to the list of registers that are
972 saved and restored during world switch.
973
974 - When EL3 is running in AArch32 execution state, the Non-secure version of
975 SCTLR is explicitly initialised during the warmboot flow rather than
976 relying on the hardware to set the correct reset values.
977
978- Enhanced support for Arm platforms:
979
980 - Introduced driver for Shared-Data-Structure (SDS) framework which is used
981 for communication between SCP and the AP CPU, replacing Boot-Over_MHU
982 (BOM) protocol.
983
984 The Juno platform is migrated to use SDS with the SCMI support added in
985 v1.3 and is set as default.
986
987 The driver can be found in the plat/arm/css/drivers folder.
988
989 - Improved memory usage by only mapping TSP memory region when the TSPD has
990 been included in the build. This reduces the memory footprint and avoids
991 unnecessary memory being mapped.
992
993 - Updated support for multi-threading CPUs for FVP platforms - always check
994 the MT field in MPDIR and access the bit fields accordingly.
995
996 - Support building for platforms that model DynamIQ configuration by
997 implementing all CPUs in a single cluster.
998
999 - Improved nor flash driver, for instance clearing status registers before
1000 sending commands. Driver can be found plat/arm/board/common folder.
1001
1002- Enhancements to QEMU platform:
1003
1004 - Added support for TBB.
1005
1006 - Added support for using OP-TEE pageable image.
1007
1008 - Added support for LOAD_IMAGE_V2.
1009
1010 - Migrated to use translation table library v2 by default.
1011
1012 - Added support for SEPARATE_CODE_AND_RODATA.
1013
1014- Applied workarounds CVE-2017-5715 on Arm Cortex-A57, -A72, -A73 and -A75, and
1015 for Armv7-A CPUs Cortex-A9, -A15 and -A17.
1016
1017- Applied errata workaround for Arm Cortex-A57: 859972.
1018
1019- Applied errata workaround for Arm Cortex-A72: 859971.
1020
1021- Added support for Poplar 96Board platform.
1022
1023- Added support for Raspberry Pi 3 platform.
1024
1025- Added Call Frame Information (CFI) assembler directives to the vector entries
1026 which enables debuggers to display the backtrace of functions that triggered
1027 a synchronous abort.
1028
1029- Added ability to build dtb.
1030
1031- Added support for pre-tool (cert_create and fiptool) image processing
1032 enabling compression of the image files before processing by cert_create and
1033 fiptool.
1034
1035 This can reduce fip size and may also speed up loading of images. The image
1036 verification will also get faster because certificates are generated based on
1037 compressed images.
1038
1039 Imported zlib 1.2.11 to implement gunzip() for data compression.
1040
1041- Enhancements to fiptool:
1042
1043 - Enabled the fiptool to be built using Visual Studio.
1044
1045 - Added padding bytes at the end of the last image in the fip to be
1046 facilitate transfer by DMA.
1047
1048Issues resolved since last release
Paul Beesley32379552019-02-11 17:58:21 +00001049^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
David Cunadob1580432018-03-14 17:57:31 +00001050
1051- TF-A can be built with optimisations disabled (-O0).
1052
1053- Memory layout updated to enable Trusted Board Boot on Juno platform when
1054 running TF-A in AArch32 execution mode (resolving `tf-issue#501`_).
1055
1056Known Issues
Paul Beesley32379552019-02-11 17:58:21 +00001057^^^^^^^^^^^^
David Cunadob1580432018-03-14 17:57:31 +00001058
Joanna Farley325ef902018-09-11 15:51:31 +01001059- DTB creation not supported when building on a Windows host. This step in the
1060 build process is skipped when running on a Windows host.
David Cunadob1580432018-03-14 17:57:31 +00001061
Paul Beesley32379552019-02-11 17:58:21 +00001062Version 1.4
1063-----------
David Cunado1b796fa2017-07-03 18:59:07 +01001064
1065New features
Paul Beesley32379552019-02-11 17:58:21 +00001066^^^^^^^^^^^^
David Cunado1b796fa2017-07-03 18:59:07 +01001067
1068- Enabled support for platforms with hardware assisted coherency.
1069
1070 A new build option HW_ASSISTED_COHERENCY allows platforms to take advantage
1071 of the following optimisations:
1072
1073 - Skip performing cache maintenance during power-up and power-down.
1074
1075 - Use spin-locks instead of bakery locks.
1076
1077 - Enable data caches early on warm-booted CPUs.
1078
1079- Added support for Cortex-A75 and Cortex-A55 processors.
1080
Dan Handley610e7e12018-03-01 18:44:00 +00001081 Both Cortex-A75 and Cortex-A55 processors use the Arm DynamIQ Shared Unit
David Cunado1b796fa2017-07-03 18:59:07 +01001082 (DSU). The power-down and power-up sequences are therefore mostly managed in
1083 hardware, reducing complexity of the software operations.
1084
Dan Handley610e7e12018-03-01 18:44:00 +00001085- Introduced Arm GIC-600 driver.
David Cunado1b796fa2017-07-03 18:59:07 +01001086
Dan Handley610e7e12018-03-01 18:44:00 +00001087 Arm GIC-600 IP complies with Arm GICv3 architecture. For FVP platforms, the
David Cunado1b796fa2017-07-03 18:59:07 +01001088 GIC-600 driver is chosen when FVP_USE_GIC_DRIVER is set to FVP_GIC600.
1089
1090- Updated GICv3 support:
1091
1092 - Introduced power management APIs for GICv3 Redistributor. These APIs
1093 allow platforms to power down the Redistributor during CPU power on/off.
1094 Requires the GICv3 implementations to have power management operations.
1095
1096 Implemented the power management APIs for FVP.
1097
1098 - GIC driver data is flushed by the primary CPU so that secondary CPU do
1099 not read stale GIC data.
1100
Dan Handley610e7e12018-03-01 18:44:00 +00001101- Added support for Arm System Control and Management Interface v1.0 (SCMI).
David Cunado1b796fa2017-07-03 18:59:07 +01001102
1103 The SCMI driver implements the power domain management and system power
Dan Handley610e7e12018-03-01 18:44:00 +00001104 management protocol of the SCMI specification (Arm DEN 0056ASCMI) for
David Cunado1b796fa2017-07-03 18:59:07 +01001105 communicating with any compliant power controller.
1106
1107 Support is added for the Juno platform. The driver can be found in the
1108 plat/arm/css/drivers folder.
1109
Dan Handley610e7e12018-03-01 18:44:00 +00001110- Added support to enable pre-integration of TBB with the Arm TrustZone
David Cunado1b796fa2017-07-03 18:59:07 +01001111 CryptoCell product, to take advantage of its hardware Root of Trust and
1112 crypto acceleration services.
1113
1114- Enabled Statistical Profiling Extensions for lower ELs.
1115
1116 The firmware support is limited to the use of SPE in the Non-secure state
1117 and accesses to the SPE specific registers from S-EL1 will trap to EL3.
1118
1119 The SPE are architecturally specified for AArch64 only.
1120
1121- Code hygiene changes aligned with MISRA guidelines:
1122
1123 - Fixed signed / unsigned comparison warnings in the translation table
1124 library.
1125
1126 - Added U(_x) macro and together with the existing ULL(_x) macro fixed
1127 some of the signed-ness defects flagged by the MISRA scanner.
1128
1129- Enhancements to Firmware Update feature:
1130
1131 - The FWU logic now checks for overlapping images to prevent execution of
Paul Beesley1fbc97b2019-01-11 18:26:51 +00001132 unauthenticated arbitrary code.
David Cunado1b796fa2017-07-03 18:59:07 +01001133
1134 - Introduced new FWU_SMC_IMAGE_RESET SMC that changes the image loading
1135 state machine to go from COPYING, COPIED or AUTHENTICATED states to
1136 RESET state. Previously, this was only possible when the authentication
1137 of an image failed or when the execution of the image finished.
1138
1139 - Fixed integer overflow which addressed TFV-1: Malformed Firmware Update
1140 SMC can result in copy of unexpectedly large data into secure memory.
1141
Dan Handley610e7e12018-03-01 18:44:00 +00001142- Introduced support for Arm Compiler 6 and LLVM (clang).
David Cunado1b796fa2017-07-03 18:59:07 +01001143
Dan Handley610e7e12018-03-01 18:44:00 +00001144 TF-A can now also be built with the Arm Compiler 6 or the clang compilers.
David Cunado1b796fa2017-07-03 18:59:07 +01001145 The assembler and linker must be provided by the GNU toolchain.
1146
Dan Handley610e7e12018-03-01 18:44:00 +00001147 Tested with Arm CC 6.7 and clang 3.9.x and 4.0.x.
David Cunado1b796fa2017-07-03 18:59:07 +01001148
1149- Memory footprint improvements:
1150
1151 - Introduced `tf_snprintf`, a reduced version of `snprintf` which has
1152 support for a limited set of formats.
1153
1154 The mbedtls driver is updated to optionally use `tf_snprintf` instead of
1155 `snprintf`.
1156
1157 - The `assert()` is updated to no longer print the function name, and
1158 additional logging options are supported via an optional platform define
1159 `PLAT_LOG_LEVEL_ASSERT`, which controls how verbose the assert output is.
1160
Dan Handley610e7e12018-03-01 18:44:00 +00001161- Enhancements to TF-A support when running in AArch32 execution state:
David Cunado1b796fa2017-07-03 18:59:07 +01001162
1163 - Support booting SP_MIN and BL33 in AArch32 execution mode on Juno. Due to
1164 hardware limitations, BL1 and BL2 boot in AArch64 state and there is
1165 additional trampoline code to warm reset into SP_MIN in AArch32 execution
1166 state.
1167
Dan Handley610e7e12018-03-01 18:44:00 +00001168 - Added support for Arm Cortex-A53/57/72 MPCore processors including the
David Cunado1b796fa2017-07-03 18:59:07 +01001169 errata workarounds that are already implemented for AArch64 execution
1170 state.
1171
1172 - For FVP platforms, added AArch32 Trusted Board Boot support, including the
1173 Firmware Update feature.
1174
Dan Handley610e7e12018-03-01 18:44:00 +00001175- Introduced Arm SiP service for use by Arm standard platforms.
David Cunado1b796fa2017-07-03 18:59:07 +01001176
Dan Handley610e7e12018-03-01 18:44:00 +00001177 - Added new Arm SiP Service SMCs to enable the Non-secure world to read PMF
David Cunado1b796fa2017-07-03 18:59:07 +01001178 timestamps.
1179
Dan Handley610e7e12018-03-01 18:44:00 +00001180 Added PMF instrumentation points in TF-A in order to quantify the
David Cunado1b796fa2017-07-03 18:59:07 +01001181 overall time spent in the PSCI software implementation.
1182
Dan Handley610e7e12018-03-01 18:44:00 +00001183 - Added new Arm SiP service SMC to switch execution state.
David Cunado1b796fa2017-07-03 18:59:07 +01001184
1185 This allows the lower exception level to change its execution state from
1186 AArch64 to AArch32, or vice verse, via a request to EL3.
1187
1188- Migrated to use SPDX[0] license identifiers to make software license
1189 auditing simpler.
1190
1191 *NOTE:* Files that have been imported by FreeBSD have not been modified.
1192
1193 [0]: https://spdx.org/
1194
1195- Enhancements to the translation table library:
1196
1197 - Added version 2 of translation table library that allows different
1198 translation tables to be modified by using different 'contexts'. Version 1
David Cunadob1580432018-03-14 17:57:31 +00001199 of the translation table library only allows the current EL's translation
David Cunado1b796fa2017-07-03 18:59:07 +01001200 tables to be modified.
1201
1202 Version 2 of the translation table also added support for dynamic
1203 regions; regions that can be added and removed dynamically whilst the
1204 MMU is enabled. Static regions can only be added or removed before the
1205 MMU is enabled.
1206
1207 The dynamic mapping functionality is enabled or disabled when compiling
1208 by setting the build option PLAT_XLAT_TABLES_DYNAMIC to 1 or 0. This can
1209 be done per-image.
1210
1211 - Added support for translation regimes with two virtual address spaces
1212 such as the one shared by EL1 and EL0.
1213
1214 The library does not support initializing translation tables for EL0
1215 software.
1216
1217 - Added support to mark the translation tables as non-cacheable using an
1218 additional build option `XLAT_TABLE_NC`.
1219
1220- Added support for GCC stack protection. A new build option
1221 ENABLE_STACK_PROTECTOR was introduced that enables compilation of all BL
1222 images with one of the GCC -fstack-protector-* options.
1223
1224 A new platform function plat_get_stack_protector_canary() was introduced
1225 that returns a value used to initialize the canary for stack corruption
1226 detection. For increased effectiveness of protection platforms must provide
1227 an implementation that returns a random value.
1228
Dan Handley610e7e12018-03-01 18:44:00 +00001229- Enhanced support for Arm platforms:
David Cunado1b796fa2017-07-03 18:59:07 +01001230
1231 - Added support for multi-threading CPUs, indicated by `MT` field in MPDIR.
1232 A new build flag `ARM_PLAT_MT` is added, and when enabled, the functions
1233 accessing MPIDR assume that the `MT` bit is set for the platform and
1234 access the bit fields accordingly.
1235
1236 Also, a new API `plat_arm_get_cpu_pe_count` is added when `ARM_PLAT_MT` is
1237 enabled, returning the Processing Element count within the physical CPU
1238 corresponding to `mpidr`.
1239
Dan Handley610e7e12018-03-01 18:44:00 +00001240 - The Arm platforms migrated to use version 2 of the translation tables.
David Cunado1b796fa2017-07-03 18:59:07 +01001241
Dan Handley610e7e12018-03-01 18:44:00 +00001242 - Introduced a new Arm platform layer API `plat_arm_psci_override_pm_ops`
1243 which allows Arm platforms to modify `plat_arm_psci_pm_ops` and therefore
David Cunado1b796fa2017-07-03 18:59:07 +01001244 dynamically define PSCI capability.
1245
Dan Handley610e7e12018-03-01 18:44:00 +00001246 - The Arm platforms migrated to use IMAGE_LOAD_V2 by default.
David Cunado1b796fa2017-07-03 18:59:07 +01001247
1248- Enhanced reporting of errata workaround status with the following policy:
1249
1250 - If an errata workaround is enabled:
1251
1252 - If it applies (i.e. the CPU is affected by the errata), an INFO message
1253 is printed, confirming that the errata workaround has been applied.
1254
1255 - If it does not apply, a VERBOSE message is printed, confirming that the
1256 errata workaround has been skipped.
1257
1258 - If an errata workaround is not enabled, but would have applied had it
1259 been, a WARN message is printed, alerting that errata workaround is
1260 missing.
1261
1262- Added build options ARM_ARCH_MAJOR and ARM_ARM_MINOR to choose the
Dan Handley610e7e12018-03-01 18:44:00 +00001263 architecture version to target TF-A.
David Cunado1b796fa2017-07-03 18:59:07 +01001264
1265- Updated the spin lock implementation to use the more efficient CAS (Compare
1266 And Swap) instruction when available. This instruction was introduced in
Dan Handley610e7e12018-03-01 18:44:00 +00001267 Armv8.1-A.
David Cunado1b796fa2017-07-03 18:59:07 +01001268
Dan Handley610e7e12018-03-01 18:44:00 +00001269- Applied errata workaround for Arm Cortex-A53: 855873.
David Cunado1b796fa2017-07-03 18:59:07 +01001270
Dan Handley610e7e12018-03-01 18:44:00 +00001271- Applied errata workaround for Arm-Cortex-A57: 813419.
David Cunado1b796fa2017-07-03 18:59:07 +01001272
1273- Enabled all A53 and A57 errata workarounds for Juno, both in AArch64 and
1274 AArch32 execution states.
1275
1276- Added support for Socionext UniPhier SoC platform.
1277
1278- Added support for Hikey960 and Hikey platforms.
1279
1280- Added support for Rockchip RK3328 platform.
1281
1282- Added support for NVidia Tegra T186 platform.
1283
1284- Added support for Designware emmc driver.
1285
1286- Imported libfdt v1.4.2 that addresses buffer overflow in fdt_offset_ptr().
1287
1288- Enhanced the CPU operations framework to allow power handlers to be
1289 registered on per-level basis. This enables support for future CPUs that
1290 have multiple threads which might need powering down individually.
1291
1292- Updated register initialisation to prevent unexpected behaviour:
1293
1294 - Debug registers MDCR-EL3/SDCR and MDCR_EL2/HDCR are initialised to avoid
1295 unexpected traps into the higher exception levels and disable secure
1296 self-hosted debug. Additionally, secure privileged external debug on
1297 Juno is disabled by programming the appropriate Juno SoC registers.
1298
1299 - EL2 and EL3 configurable controls are initialised to avoid unexpected
1300 traps in the higher exception levels.
1301
1302 - Essential control registers are fully initialised on EL3 start-up, when
1303 initialising the non-secure and secure context structures and when
Paul Beesley1fbc97b2019-01-11 18:26:51 +00001304 preparing to leave EL3 for a lower EL. This gives better alignment with
Dan Handley610e7e12018-03-01 18:44:00 +00001305 the Arm ARM which states that software must initialise RES0 and RES1
David Cunado1b796fa2017-07-03 18:59:07 +01001306 fields with 0 / 1.
1307
1308- Enhanced PSCI support:
1309
1310 - Introduced new platform interfaces that decouple PSCI stat residency
1311 calculation from PMF, enabling platforms to use alternative methods of
1312 capturing timestamps.
1313
1314 - PSCI stat accounting performed for retention/standby states when
1315 requested at multiple power levels.
1316
1317- Simplified fiptool to have a single linked list of image descriptors.
1318
1319- For the TSP, resolved corruption of pre-empted secure context by aborting any
1320 pre-empted SMC during PSCI power management requests.
1321
1322Issues resolved since last release
Paul Beesley32379552019-02-11 17:58:21 +00001323^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
David Cunado1b796fa2017-07-03 18:59:07 +01001324
Dan Handley610e7e12018-03-01 18:44:00 +00001325- TF-A can be built with the latest mbed TLS version (v2.4.2). The earlier
1326 version 2.3.0 cannot be used due to build warnings that the TF-A build
David Cunado1b796fa2017-07-03 18:59:07 +01001327 system interprets as errors.
1328
1329- TBBR, including the Firmware Update feature is now supported on FVP
Dan Handley610e7e12018-03-01 18:44:00 +00001330 platforms when running TF-A in AArch32 state.
David Cunado1b796fa2017-07-03 18:59:07 +01001331
1332- The version of the AEMv8 Base FVP used in this release has resolved the issue
1333 of the model executing a reset instead of terminating in response to a
1334 shutdown request using the PSCI SYSTEM_OFF API.
1335
1336Known Issues
Paul Beesley32379552019-02-11 17:58:21 +00001337^^^^^^^^^^^^
David Cunado1b796fa2017-07-03 18:59:07 +01001338
Dan Handley610e7e12018-03-01 18:44:00 +00001339- Building TF-A with compiler optimisations disabled (-O0) fails.
David Cunado1b796fa2017-07-03 18:59:07 +01001340
1341- Trusted Board Boot currently does not work on Juno when running Trusted
1342 Firmware in AArch32 execution state due to error when loading the sp_min to
David Cunadob1580432018-03-14 17:57:31 +00001343 memory because of lack of free space available. See `tf-issue#501`_ for more
David Cunado1b796fa2017-07-03 18:59:07 +01001344 details.
1345
1346- The errata workaround for A53 errata 843419 is only available from binutils
1347 2.26 and is not present in GCC4.9. If this errata is applicable to the
1348 platform, please use GCC compiler version of at least 5.0. See `PR#1002`_ for
1349 more details.
1350
Paul Beesley32379552019-02-11 17:58:21 +00001351Version 1.3
1352-----------
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001353
Douglas Raillard30d7b362017-06-28 16:14:55 +01001354
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001355New features
Paul Beesley32379552019-02-11 17:58:21 +00001356^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001357
Dan Handley610e7e12018-03-01 18:44:00 +00001358- Added support for running TF-A in AArch32 execution state.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001359
1360 The PSCI library has been refactored to allow integration with **EL3 Runtime
1361 Software**. This is software that is executing at the highest secure
1362 privilege which is EL3 in AArch64 or Secure SVC/Monitor mode in AArch32. See
1363 `PSCI Integration Guide`_.
1364
1365 Included is a minimal AArch32 Secure Payload, **SP-MIN**, that illustrates
1366 the usage and integration of the PSCI library with EL3 Runtime Software
1367 running in AArch32 state.
1368
1369 Booting to the BL1/BL2 images as well as booting straight to the Secure
1370 Payload is supported.
1371
Dan Handley610e7e12018-03-01 18:44:00 +00001372- Improvements to the initialization framework for the PSCI service and Arm
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001373 Standard Services in general.
1374
Dan Handley610e7e12018-03-01 18:44:00 +00001375 The PSCI service is now initialized as part of Arm Standard Service
1376 initialization. This consolidates the initializations of any Arm Standard
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001377 Service that may be added in the future.
1378
1379 A new function ``get_arm_std_svc_args()`` is introduced to get arguments
1380 corresponding to each standard service and must be implemented by the EL3
1381 Runtime Software.
1382
1383 For PSCI, a new versioned structure ``psci_lib_args_t`` is introduced to
1384 initialize the PSCI Library. **Note** this is a compatibility break due to
1385 the change in the prototype of ``psci_setup()``.
1386
1387- To support AArch32 builds of BL1 and BL2, implemented a new, alternative
1388 firmware image loading mechanism that adds flexibility.
1389
1390 The current mechanism has a hard-coded set of images and execution order
1391 (BL31, BL32, etc). The new mechanism is data-driven by a list of image
1392 descriptors provided by the platform code.
1393
Dan Handley610e7e12018-03-01 18:44:00 +00001394 Arm platforms have been updated to support the new loading mechanism.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001395
1396 The new mechanism is enabled by a build flag (``LOAD_IMAGE_V2``) which is
1397 currently off by default for the AArch64 build.
1398
1399 **Note** ``TRUSTED_BOARD_BOOT`` is currently not supported when
1400 ``LOAD_IMAGE_V2`` is enabled.
1401
Dan Handley610e7e12018-03-01 18:44:00 +00001402- Updated requirements for making contributions to TF-A.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001403
1404 Commits now must have a 'Signed-off-by:' field to certify that the
1405 contribution has been made under the terms of the
1406 `Developer Certificate of Origin`_.
1407
1408 A signed CLA is no longer required.
1409
1410 The `Contribution Guide`_ has been updated to reflect this change.
1411
1412- Introduced Performance Measurement Framework (PMF) which provides support
1413 for capturing, storing, dumping and retrieving time-stamps to measure the
1414 execution time of critical paths in the firmware. This relies on defining
1415 fixed sample points at key places in the code.
1416
1417- To support the QEMU platform port, imported libfdt v1.4.1 from
Paul Beesley2437ddc2019-02-08 16:43:05 +00001418 https://git.kernel.org/pub/scm/utils/dtc/dtc.git
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001419
1420- Updated PSCI support:
1421
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01001422 - Added support for PSCI NODE_HW_STATE API for Arm platforms.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001423
1424 - New optional platform hook, ``pwr_domain_pwr_down_wfi()``, in
1425 ``plat_psci_ops`` to enable platforms to perform platform-specific actions
1426 needed to enter powerdown, including the 'wfi' invocation.
1427
Dan Handley610e7e12018-03-01 18:44:00 +00001428 - PSCI STAT residency and count functions have been added on Arm platforms
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001429 by using PMF.
1430
1431- Enhancements to the translation table library:
1432
1433 - Limited memory mapping support for region overlaps to only allow regions
1434 to overlap that are identity mapped or have the same virtual to physical
1435 address offset, and overlap completely but must not cover the same area.
1436
1437 This limitation will enable future enhancements without having to
1438 support complex edge cases that may not be necessary.
1439
1440 - The initial translation lookup level is now inferred from the virtual
1441 address space size. Previously, it was hard-coded.
1442
1443 - Added support for mapping Normal, Inner Non-cacheable, Outer
1444 Non-cacheable memory in the translation table library.
1445
1446 This can be useful to map a non-cacheable memory region, such as a DMA
1447 buffer.
1448
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01001449 - Introduced the MT_EXECUTE/MT_EXECUTE_NEVER memory mapping attributes to
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001450 specify the access permissions for instruction execution of a memory
1451 region.
1452
1453- Enabled support to isolate code and read-only data on separate memory pages,
1454 allowing independent access control to be applied to each.
1455
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01001456- Enabled SCR_EL3.SIF (Secure Instruction Fetch) bit in BL1 and BL31 common
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001457 architectural setup code, preventing fetching instructions from non-secure
1458 memory when in secure state.
1459
1460- Enhancements to FIP support:
1461
1462 - Replaced ``fip_create`` with ``fiptool`` which provides a more consistent
1463 and intuitive interface as well as additional support to remove an image
1464 from a FIP file.
1465
1466 - Enabled printing the SHA256 digest with info command, allowing quick
1467 verification of an image within a FIP without having to extract the
1468 image and running sha256sum on it.
1469
1470 - Added support for unpacking the contents of an existing FIP file into
1471 the working directory.
1472
1473 - Aligned command line options for specifying images to use same naming
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01001474 convention as specified by TBBR and already used in cert_create tool.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001475
1476- Refactored the TZC-400 driver to also support memory controllers that
Dan Handley610e7e12018-03-01 18:44:00 +00001477 integrate TZC functionality, for example Arm CoreLink DMC-500. Also added
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001478 DMC-500 specific support.
1479
1480- Implemented generic delay timer based on the system generic counter and
1481 migrated all platforms to use it.
1482
Dan Handley610e7e12018-03-01 18:44:00 +00001483- Enhanced support for Arm platforms:
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001484
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01001485 - Updated image loading support to make SCP images (SCP_BL2 and SCP_BL2U)
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001486 optional.
1487
1488 - Enhanced topology description support to allow multi-cluster topology
1489 definitions.
1490
1491 - Added interconnect abstraction layer to help platform ports select the
1492 right interconnect driver, CCI or CCN, for the platform.
1493
1494 - Added support to allow loading BL31 in the TZC-secured DRAM instead of
1495 the default secure SRAM.
1496
1497 - Added support to use a System Security Control (SSC) Registers Unit
Dan Handley610e7e12018-03-01 18:44:00 +00001498 enabling TF-A to be compiled to support multiple Arm platforms and
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001499 then select one at runtime.
1500
1501 - Restricted mapping of Trusted ROM in BL1 to what is actually needed by
1502 BL1 rather than entire Trusted ROM region.
1503
1504 - Flash is now mapped as execute-never by default. This increases security
1505 by restricting the executable region to what is strictly needed.
1506
1507- Applied following erratum workarounds for Cortex-A57: 833471, 826977,
1508 829520, 828024 and 826974.
1509
1510- Added support for Mediatek MT6795 platform.
1511
Dan Handley610e7e12018-03-01 18:44:00 +00001512- Added support for QEMU virtualization Armv8-A target.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001513
1514- Added support for Rockchip RK3368 and RK3399 platforms.
1515
1516- Added support for Xilinx Zynq UltraScale+ MPSoC platform.
1517
Dan Handley610e7e12018-03-01 18:44:00 +00001518- Added support for Arm Cortex-A73 MPCore Processor.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001519
Dan Handley610e7e12018-03-01 18:44:00 +00001520- Added support for Arm Cortex-A72 processor.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001521
Dan Handley610e7e12018-03-01 18:44:00 +00001522- Added support for Arm Cortex-A35 processor.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001523
Dan Handley610e7e12018-03-01 18:44:00 +00001524- Added support for Arm Cortex-A32 MPCore Processor.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001525
1526- Enabled preloaded BL33 alternative boot flow, in which BL2 does not load
1527 BL33 from non-volatile storage and BL31 hands execution over to a preloaded
1528 BL33. The User Guide has been updated with an example of how to use this
1529 option with a bootwrapped kernel.
1530
Dan Handley610e7e12018-03-01 18:44:00 +00001531- Added support to build TF-A on a Windows-based host machine.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001532
1533- Updated Trusted Board Boot prototype implementation:
1534
1535 - Enabled the ability for a production ROM with TBBR enabled to boot test
1536 software before a real ROTPK is deployed (e.g. manufacturing mode).
1537 Added support to use ROTPK in certificate without verifying against the
1538 platform value when ``ROTPK_NOT_DEPLOYED`` bit is set.
1539
1540 - Added support for non-volatile counter authentication to the
1541 Authentication Module to protect against roll-back.
1542
1543- Updated GICv3 support:
1544
1545 - Enabled processor power-down and automatic power-on using GICv3.
1546
1547 - Enabled G1S or G0 interrupts to be configured independently.
1548
1549 - Changed FVP default interrupt driver to be the GICv3-only driver.
Dan Handley610e7e12018-03-01 18:44:00 +00001550 **Note** the default build of TF-A will not be able to boot
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001551 Linux kernel with GICv2 FDT blob.
1552
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01001553 - Enabled wake-up from CPU_SUSPEND to stand-by by temporarily re-routing
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001554 interrupts and then restoring after resume.
1555
1556Issues resolved since last release
Paul Beesley32379552019-02-11 17:58:21 +00001557^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001558
1559Known issues
Paul Beesley32379552019-02-11 17:58:21 +00001560^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001561
1562- The version of the AEMv8 Base FVP used in this release resets the model
1563 instead of terminating its execution in response to a shutdown request using
1564 the PSCI ``SYSTEM_OFF`` API. This issue will be fixed in a future version of
1565 the model.
1566
Dan Handley610e7e12018-03-01 18:44:00 +00001567- Building TF-A with compiler optimisations disabled (``-O0``) fails.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001568
Dan Handley610e7e12018-03-01 18:44:00 +00001569- TF-A cannot be built with mbed TLS version v2.3.0 due to build warnings
1570 that the TF-A build system interprets as errors.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001571
Dan Handley610e7e12018-03-01 18:44:00 +00001572- TBBR is not currently supported when running TF-A in AArch32 state.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001573
Paul Beesley32379552019-02-11 17:58:21 +00001574Version 1.2
1575-----------
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001576
1577New features
Paul Beesley32379552019-02-11 17:58:21 +00001578^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001579
Dan Handley610e7e12018-03-01 18:44:00 +00001580- The Trusted Board Boot implementation on Arm platforms now conforms to the
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001581 mandatory requirements of the TBBR specification.
1582
1583 In particular, the boot process is now guarded by a Trusted Watchdog, which
Dan Handley610e7e12018-03-01 18:44:00 +00001584 will reset the system in case of an authentication or loading error. On Arm
1585 platforms, a secure instance of Arm SP805 is used as the Trusted Watchdog.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001586
1587 Also, a firmware update process has been implemented. It enables
1588 authenticated firmware to update firmware images from external interfaces to
1589 SoC Non-Volatile memories. This feature functions even when the current
1590 firmware in the system is corrupt or missing; it therefore may be used as
1591 a recovery mode.
1592
1593- Improvements have been made to the Certificate Generation Tool
1594 (``cert_create``) as follows.
1595
1596 - Added support for the Firmware Update process by extending the Chain
1597 of Trust definition in the tool to include the Firmware Update
1598 certificate and the required extensions.
1599
1600 - Introduced a new API that allows one to specify command line options in
1601 the Chain of Trust description. This makes the declaration of the tool's
1602 arguments more flexible and easier to extend.
1603
1604 - The tool has been reworked to follow a data driven approach, which
1605 makes it easier to maintain and extend.
1606
1607- Extended the FIP tool (``fip_create``) to support the new set of images
1608 involved in the Firmware Update process.
1609
1610- Various memory footprint improvements. In particular:
1611
1612 - The bakery lock structure for coherent memory has been optimised.
1613
1614 - The mbed TLS SHA1 functions are not needed, as SHA256 is used to
1615 generate the certificate signature. Therefore, they have been compiled
1616 out, reducing the memory footprint of BL1 and BL2 by approximately
1617 6 KB.
1618
Dan Handley610e7e12018-03-01 18:44:00 +00001619 - On Arm development platforms, each BL stage now individually defines
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001620 the number of regions that it needs to map in the MMU.
1621
1622- Added the following new design documents:
1623
1624 - `Authentication framework`_
1625 - `Firmware Update`_
Dan Handley610e7e12018-03-01 18:44:00 +00001626 - `TF-A Reset Design`_
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001627 - `Power Domain Topology Design`_
1628
1629- Applied the new image terminology to the code base and documentation, as
Dan Handley610e7e12018-03-01 18:44:00 +00001630 described on the `TF-A wiki on GitHub`_.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001631
1632- The build system has been reworked to improve readability and facilitate
1633 adding future extensions.
1634
Dan Handley610e7e12018-03-01 18:44:00 +00001635- On Arm standard platforms, BL31 uses the boot console during cold boot
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001636 but switches to the runtime console for any later logs at runtime. The TSP
1637 uses the runtime console for all output.
1638
Dan Handley610e7e12018-03-01 18:44:00 +00001639- Implemented a basic NOR flash driver for Arm platforms. It programs the
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001640 device using CFI (Common Flash Interface) standard commands.
1641
Dan Handley610e7e12018-03-01 18:44:00 +00001642- Implemented support for booting EL3 payloads on Arm platforms, which
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001643 reduces the complexity of developing EL3 baremetal code by doing essential
1644 baremetal initialization.
1645
1646- Provided separate drivers for GICv3 and GICv2. These expect the entire
1647 software stack to use either GICv2 or GICv3; hybrid GIC software systems
Dan Handley610e7e12018-03-01 18:44:00 +00001648 are no longer supported and the legacy Arm GIC driver has been deprecated.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001649
Dan Handley610e7e12018-03-01 18:44:00 +00001650- Added support for Juno r1 and r2. A single set of Juno TF-A binaries can run
1651 on Juno r0, r1 and r2 boards. Note that this TF-A version depends on a Linaro
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001652 release that does *not* contain Juno r2 support.
1653
1654- Added support for MediaTek mt8173 platform.
1655
Dan Handley610e7e12018-03-01 18:44:00 +00001656- Implemented a generic driver for Arm CCN IP.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001657
1658- Major rework of the PSCI implementation.
1659
1660 - Added framework to handle composite power states.
1661
1662 - Decoupled the notions of affinity instances (which describes the
1663 hierarchical arrangement of cores) and of power domain topology, instead
1664 of assuming a one-to-one mapping.
1665
1666 - Better alignment with version 1.0 of the PSCI specification.
1667
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01001668- Added support for the SYSTEM_SUSPEND PSCI API on Arm platforms. When invoked
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001669 on the last running core on a supported platform, this puts the system
1670 into a low power mode with memory retention.
1671
1672- Unified the reset handling code as much as possible across BL stages.
1673 Also introduced some build options to enable optimization of the reset path
1674 on platforms that support it.
1675
1676- Added a simple delay timer API, as well as an SP804 timer driver, which is
1677 enabled on FVP.
1678
1679- Added support for NVidia Tegra T210 and T132 SoCs.
1680
Dan Handley610e7e12018-03-01 18:44:00 +00001681- Reorganised Arm platforms ports to greatly improve code shareability and
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001682 facilitate the reuse of some of this code by other platforms.
1683
Dan Handley610e7e12018-03-01 18:44:00 +00001684- Added support for Arm Cortex-A72 processor in the CPU specific framework.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001685
1686- Provided better error handling. Platform ports can now define their own
1687 error handling, for example to perform platform specific bookkeeping or
1688 post-error actions.
1689
Dan Handley610e7e12018-03-01 18:44:00 +00001690- Implemented a unified driver for Arm Cache Coherent Interconnects used for
1691 both CCI-400 & CCI-500 IPs. Arm platforms ports have been migrated to this
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001692 common driver. The standalone CCI-400 driver has been deprecated.
1693
1694Issues resolved since last release
Paul Beesley32379552019-02-11 17:58:21 +00001695^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001696
1697- The Trusted Board Boot implementation has been redesigned to provide greater
1698 modularity and scalability. See the `Authentication Framework`_ document.
1699 All missing mandatory features are now implemented.
1700
1701- The FVP and Juno ports may now use the hash of the ROTPK stored in the
1702 Trusted Key Storage registers to verify the ROTPK. Alternatively, a
1703 development public key hash embedded in the BL1 and BL2 binaries might be
1704 used instead. The location of the ROTPK is chosen at build-time using the
1705 ``ARM_ROTPK_LOCATION`` build option.
1706
1707- GICv3 is now fully supported and stable.
1708
1709Known issues
Paul Beesley32379552019-02-11 17:58:21 +00001710^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001711
1712- The version of the AEMv8 Base FVP used in this release resets the model
1713 instead of terminating its execution in response to a shutdown request using
1714 the PSCI ``SYSTEM_OFF`` API. This issue will be fixed in a future version of
1715 the model.
1716
1717- While this version has low on-chip RAM requirements, there are further
1718 RAM usage enhancements that could be made.
1719
1720- The upstream documentation could be improved for structural consistency,
1721 clarity and completeness. In particular, the design documentation is
1722 incomplete for PSCI, the TSP(D) and the Juno platform.
1723
Dan Handley610e7e12018-03-01 18:44:00 +00001724- Building TF-A with compiler optimisations disabled (``-O0``) fails.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001725
Paul Beesley32379552019-02-11 17:58:21 +00001726Version 1.1
1727-----------
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001728
1729New features
Paul Beesley32379552019-02-11 17:58:21 +00001730^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001731
1732- A prototype implementation of Trusted Board Boot has been added. Boot
1733 loader images are verified by BL1 and BL2 during the cold boot path. BL1 and
1734 BL2 use the PolarSSL SSL library to verify certificates and images. The
1735 OpenSSL library is used to create the X.509 certificates. Support has been
1736 added to ``fip_create`` tool to package the certificates in a FIP.
1737
1738- Support for calling CPU and platform specific reset handlers upon entry into
1739 BL3-1 during the cold and warm boot paths has been added. This happens after
1740 another Boot ROM ``reset_handler()`` has already run. This enables a developer
1741 to perform additional actions or undo actions already performed during the
1742 first call of the reset handlers e.g. apply additional errata workarounds.
1743
1744- Support has been added to demonstrate routing of IRQs to EL3 instead of
1745 S-EL1 when execution is in secure world.
1746
1747- The PSCI implementation now conforms to version 1.0 of the PSCI
1748 specification. All the mandatory APIs and selected optional APIs are
1749 supported. In particular, support for the ``PSCI_FEATURES`` API has been
1750 added. A capability variable is constructed during initialization by
1751 examining the ``plat_pm_ops`` and ``spd_pm_ops`` exported by the platform and
1752 the Secure Payload Dispatcher. This is used by the PSCI FEATURES function
1753 to determine which PSCI APIs are supported by the platform.
1754
1755- Improvements have been made to the PSCI code as follows.
1756
1757 - The code has been refactored to remove redundant parameters from
1758 internal functions.
1759
1760 - Changes have been made to the code for PSCI ``CPU_SUSPEND``, ``CPU_ON`` and
1761 ``CPU_OFF`` calls to facilitate an early return to the caller in case a
1762 failure condition is detected. For example, a PSCI ``CPU_SUSPEND`` call
1763 returns ``SUCCESS`` to the caller if a pending interrupt is detected early
1764 in the code path.
1765
1766 - Optional platform APIs have been added to validate the ``power_state`` and
1767 ``entrypoint`` parameters early in PSCI ``CPU_ON`` and ``CPU_SUSPEND`` code
1768 paths.
1769
1770 - PSCI migrate APIs have been reworked to invoke the SPD hook to determine
1771 the type of Trusted OS and the CPU it is resident on (if
1772 applicable). Also, during a PSCI ``MIGRATE`` call, the SPD hook to migrate
1773 the Trusted OS is invoked.
1774
Dan Handley610e7e12018-03-01 18:44:00 +00001775- It is now possible to build TF-A without marking at least an extra page of
1776 memory as coherent. The build flag ``USE_COHERENT_MEM`` can be used to
1777 choose between the two implementations. This has been made possible through
1778 these changes.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001779
1780 - An implementation of Bakery locks, where the locks are not allocated in
1781 coherent memory has been added.
1782
1783 - Memory which was previously marked as coherent is now kept coherent
1784 through the use of software cache maintenance operations.
1785
1786 Approximately, 4K worth of memory is saved for each boot loader stage when
1787 ``USE_COHERENT_MEM=0``. Enabling this option increases the latencies
1788 associated with acquire and release of locks. It also requires changes to
1789 the platform ports.
1790
1791- It is now possible to specify the name of the FIP at build time by defining
1792 the ``FIP_NAME`` variable.
1793
Paul Beesley1fbc97b2019-01-11 18:26:51 +00001794- Issues with dependencies on the 'fiptool' makefile target have been
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001795 rectified. The ``fip_create`` tool is now rebuilt whenever its source files
1796 change.
1797
1798- The BL3-1 runtime console is now also used as the crash console. The crash
1799 console is changed to SoC UART0 (UART2) from the previous FPGA UART0 (UART0)
1800 on Juno. In FVP, it is changed from UART0 to UART1.
1801
1802- CPU errata workarounds are applied only when the revision and part number
1803 match. This behaviour has been made consistent across the debug and release
1804 builds. The debug build additionally prints a warning if a mismatch is
1805 detected.
1806
1807- It is now possible to issue cache maintenance operations by set/way for a
1808 particular level of data cache. Levels 1-3 are currently supported.
1809
1810- The following improvements have been made to the FVP port.
1811
1812 - The build option ``FVP_SHARED_DATA_LOCATION`` which allowed relocation of
1813 shared data into the Trusted DRAM has been deprecated. Shared data is
1814 now always located at the base of Trusted SRAM.
1815
1816 - BL2 Translation tables have been updated to map only the region of
1817 DRAM which is accessible to normal world. This is the region of the 2GB
1818 DDR-DRAM memory at 0x80000000 excluding the top 16MB. The top 16MB is
1819 accessible to only the secure world.
1820
1821 - BL3-2 can now reside in the top 16MB of DRAM which is accessible only to
1822 the secure world. This can be done by setting the build flag
1823 ``FVP_TSP_RAM_LOCATION`` to the value ``dram``.
1824
Paul Beesley1fbc97b2019-01-11 18:26:51 +00001825- Separate translation tables are created for each boot loader image. The
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001826 ``IMAGE_BLx`` build options are used to do this. This allows each stage to
1827 create mappings only for areas in the memory map that it needs.
1828
1829- A Secure Payload Dispatcher (OPTEED) for the OP-TEE Trusted OS has been
Dan Handley610e7e12018-03-01 18:44:00 +00001830 added. Details of using it with TF-A can be found in `OP-TEE Dispatcher`_
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001831
1832Issues resolved since last release
Paul Beesley32379552019-02-11 17:58:21 +00001833^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001834
1835- The Juno port has been aligned with the FVP port as follows.
1836
1837 - Support for reclaiming all BL1 RW memory and BL2 memory by overlaying
1838 the BL3-1/BL3-2 NOBITS sections on top of them has been added to the
1839 Juno port.
1840
1841 - The top 16MB of the 2GB DDR-DRAM memory at 0x80000000 is configured
1842 using the TZC-400 controller to be accessible only to the secure world.
1843
Dan Handley610e7e12018-03-01 18:44:00 +00001844 - The Arm GIC driver is used to configure the GIC-400 instead of using a
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001845 GIC driver private to the Juno port.
1846
1847 - PSCI ``CPU_SUSPEND`` calls that target a standby state are now supported.
1848
1849 - The TZC-400 driver is used to configure the controller instead of direct
1850 accesses to the registers.
1851
1852- The Linux kernel version referred to in the user guide has DVFS and HMP
1853 support enabled.
1854
1855- DS-5 v5.19 did not detect Version 5.8 of the Cortex-A57-A53 Base FVPs in
1856 CADI server mode. This issue is not seen with DS-5 v5.20 and Version 6.2 of
1857 the Cortex-A57-A53 Base FVPs.
1858
1859Known issues
Paul Beesley32379552019-02-11 17:58:21 +00001860^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001861
1862- The Trusted Board Boot implementation is a prototype. There are issues with
1863 the modularity and scalability of the design. Support for a Trusted
1864 Watchdog, firmware update mechanism, recovery images and Trusted debug is
1865 absent. These issues will be addressed in future releases.
1866
1867- The FVP and Juno ports do not use the hash of the ROTPK stored in the
1868 Trusted Key Storage registers to verify the ROTPK in the
1869 ``plat_match_rotpk()`` function. This prevents the correct establishment of
1870 the Chain of Trust at the first step in the Trusted Board Boot process.
1871
1872- The version of the AEMv8 Base FVP used in this release resets the model
1873 instead of terminating its execution in response to a shutdown request using
1874 the PSCI ``SYSTEM_OFF`` API. This issue will be fixed in a future version of
1875 the model.
1876
1877- GICv3 support is experimental. There are known issues with GICv3
Dan Handley610e7e12018-03-01 18:44:00 +00001878 initialization in the TF-A.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001879
1880- While this version greatly reduces the on-chip RAM requirements, there are
1881 further RAM usage enhancements that could be made.
1882
1883- The firmware design documentation for the Test Secure-EL1 Payload (TSP) and
1884 its dispatcher (TSPD) is incomplete. Similarly for the PSCI section.
1885
1886- The Juno-specific firmware design documentation is incomplete.
1887
Paul Beesley32379552019-02-11 17:58:21 +00001888Version 1.0
1889-----------
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001890
1891New features
Paul Beesley32379552019-02-11 17:58:21 +00001892^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001893
1894- It is now possible to map higher physical addresses using non-flat virtual
1895 to physical address mappings in the MMU setup.
1896
1897- Wider use is now made of the per-CPU data cache in BL3-1 to store:
1898
1899 - Pointers to the non-secure and secure security state contexts.
1900
1901 - A pointer to the CPU-specific operations.
1902
1903 - A pointer to PSCI specific information (for example the current power
1904 state).
1905
1906 - A crash reporting buffer.
1907
1908- The following RAM usage improvements result in a BL3-1 RAM usage reduction
1909 from 96KB to 56KB (for FVP with TSPD), and a total RAM usage reduction
1910 across all images from 208KB to 88KB, compared to the previous release.
1911
1912 - Removed the separate ``early_exception`` vectors from BL3-1 (2KB code size
1913 saving).
1914
1915 - Removed NSRAM from the FVP memory map, allowing the removal of one
1916 (4KB) translation table.
1917
1918 - Eliminated the internal ``psci_suspend_context`` array, saving 2KB.
1919
1920 - Correctly dimensioned the PSCI ``aff_map_node`` array, saving 1.5KB in the
1921 FVP port.
1922
1923 - Removed calling CPU mpidr from the bakery lock API, saving 160 bytes.
1924
1925 - Removed current CPU mpidr from PSCI common code, saving 160 bytes.
1926
1927 - Inlined the mmio accessor functions, saving 360 bytes.
1928
1929 - Fully reclaimed all BL1 RW memory and BL2 memory on the FVP port by
1930 overlaying the BL3-1/BL3-2 NOBITS sections on top of these at runtime.
1931
1932 - Made storing the FP register context optional, saving 0.5KB per context
1933 (8KB on the FVP port, with TSPD enabled and running on 8 CPUs).
1934
1935 - Implemented a leaner ``tf_printf()`` function, allowing the stack to be
1936 greatly reduced.
1937
1938 - Removed coherent stacks from the codebase. Stacks allocated in normal
1939 memory are now used before and after the MMU is enabled. This saves 768
1940 bytes per CPU in BL3-1.
1941
1942 - Reworked the crash reporting in BL3-1 to use less stack.
1943
1944 - Optimized the EL3 register state stored in the ``cpu_context`` structure
1945 so that registers that do not change during normal execution are
1946 re-initialized each time during cold/warm boot, rather than restored
1947 from memory. This saves about 1.2KB.
1948
1949 - As a result of some of the above, reduced the runtime stack size in all
1950 BL images. For BL3-1, this saves 1KB per CPU.
1951
1952- PSCI SMC handler improvements to correctly handle calls from secure states
1953 and from AArch32.
1954
1955- CPU contexts are now initialized from the ``entry_point_info``. BL3-1 fully
1956 determines the exception level to use for the non-trusted firmware (BL3-3)
1957 based on the SPSR value provided by the BL2 platform code (or otherwise
1958 provided to BL3-1). This allows platform code to directly run non-trusted
1959 firmware payloads at either EL2 or EL1 without requiring an EL2 stub or OS
1960 loader.
1961
1962- Code refactoring improvements:
1963
1964 - Refactored ``fvp_config`` into a common platform header.
1965
1966 - Refactored the fvp gic code to be a generic driver that no longer has an
1967 explicit dependency on platform code.
1968
1969 - Refactored the CCI-400 driver to not have dependency on platform code.
1970
1971 - Simplified the IO driver so it's no longer necessary to call ``io_init()``
1972 and moved all the IO storage framework code to one place.
1973
1974 - Simplified the interface the the TZC-400 driver.
1975
1976 - Clarified the platform porting interface to the TSP.
1977
1978 - Reworked the TSPD setup code to support the alternate BL3-2
Paul Beesley1fbc97b2019-01-11 18:26:51 +00001979 initialization flow where BL3-1 generic code hands control to BL3-2,
Douglas Raillardd7c21b72017-06-28 15:23:03 +01001980 rather than expecting the TSPD to hand control directly to BL3-2.
1981
1982 - Considerable rework to PSCI generic code to support CPU specific
1983 operations.
1984
1985- Improved console log output, by:
1986
1987 - Adding the concept of debug log levels.
1988
1989 - Rationalizing the existing debug messages and adding new ones.
1990
1991 - Printing out the version of each BL stage at runtime.
1992
1993 - Adding support for printing console output from assembler code,
1994 including when a crash occurs before the C runtime is initialized.
1995
1996- Moved up to the latest versions of the FVPs, toolchain, EDK2, kernel, Linaro
1997 file system and DS-5.
1998
1999- On the FVP port, made the use of the Trusted DRAM region optional at build
2000 time (off by default). Normal platforms will not have such a "ready-to-use"
2001 DRAM area so it is not a good example to use it.
2002
2003- Added support for PSCI ``SYSTEM_OFF`` and ``SYSTEM_RESET`` APIs.
2004
2005- Added support for CPU specific reset sequences, power down sequences and
2006 register dumping during crash reporting. The CPU specific reset sequences
2007 include support for errata workarounds.
2008
2009- Merged the Juno port into the master branch. Added support for CPU hotplug
2010 and CPU idle. Updated the user guide to describe how to build and run on the
2011 Juno platform.
2012
2013Issues resolved since last release
Paul Beesley32379552019-02-11 17:58:21 +00002014^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002015
2016- Removed the concept of top/bottom image loading. The image loader now
2017 automatically detects the position of the image inside the current memory
Paul Beesley1fbc97b2019-01-11 18:26:51 +00002018 layout and updates the layout to minimize fragmentation. This resolves the
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002019 image loader limitations of previously releases. There are currently no
2020 plans to support dynamic image loading.
2021
2022- CPU idle now works on the publicized version of the Foundation FVP.
2023
2024- All known issues relating to the compiler version used have now been
Dan Handley610e7e12018-03-01 18:44:00 +00002025 resolved. This TF-A version uses Linaro toolchain 14.07 (based on GCC 4.9).
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002026
2027Known issues
Paul Beesley32379552019-02-11 17:58:21 +00002028^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002029
2030- GICv3 support is experimental. The Linux kernel patches to support this are
2031 not widely available. There are known issues with GICv3 initialization in
Dan Handley610e7e12018-03-01 18:44:00 +00002032 the TF-A.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002033
2034- While this version greatly reduces the on-chip RAM requirements, there are
2035 further RAM usage enhancements that could be made.
2036
2037- The firmware design documentation for the Test Secure-EL1 Payload (TSP) and
2038 its dispatcher (TSPD) is incomplete. Similarly for the PSCI section.
2039
2040- The Juno-specific firmware design documentation is incomplete.
2041
2042- Some recent enhancements to the FVP port have not yet been translated into
2043 the Juno port. These will be tracked via the tf-issues project.
2044
2045- The Linux kernel version referred to in the user guide has DVFS and HMP
2046 support disabled due to some known instabilities at the time of this
2047 release. A future kernel version will re-enable these features.
2048
2049- DS-5 v5.19 does not detect Version 5.8 of the Cortex-A57-A53 Base FVPs in
2050 CADI server mode. This is because the ``<SimName>`` reported by the FVP in
2051 this version has changed. For example, for the Cortex-A57x4-A53x4 Base FVP,
2052 the ``<SimName>`` reported by the FVP is ``FVP_Base_Cortex_A57x4_A53x4``, while
2053 DS-5 expects it to be ``FVP_Base_A57x4_A53x4``.
2054
2055 The temporary fix to this problem is to change the name of the FVP in
2056 ``sw/debugger/configdb/Boards/ARM FVP/Base_A57x4_A53x4/cadi_config.xml``.
2057 Change the following line:
2058
2059 ::
2060
2061 <SimName>System Generator:FVP_Base_A57x4_A53x4</SimName>
2062
2063 to
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01002064 System Generator:FVP_Base_Cortex-A57x4_A53x4
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002065
2066 A similar change can be made to the other Cortex-A57-A53 Base FVP variants.
2067
Paul Beesley32379552019-02-11 17:58:21 +00002068Version 0.4
2069-----------
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002070
2071New features
Paul Beesley32379552019-02-11 17:58:21 +00002072^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002073
2074- Makefile improvements:
2075
2076 - Improved dependency checking when building.
2077
2078 - Removed ``dump`` target (build now always produces dump files).
2079
2080 - Enabled platform ports to optionally make use of parts of the Trusted
2081 Firmware (e.g. BL3-1 only), rather than being forced to use all parts.
2082 Also made the ``fip`` target optional.
2083
2084 - Specified the full path to source files and removed use of the ``vpath``
2085 keyword.
2086
2087- Provided translation table library code for potential re-use by platforms
2088 other than the FVPs.
2089
2090- Moved architectural timer setup to platform-specific code.
2091
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01002092- Added standby state support to PSCI cpu_suspend implementation.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002093
2094- SRAM usage improvements:
2095
2096 - Started using the ``-ffunction-sections``, ``-fdata-sections`` and
2097 ``--gc-sections`` compiler/linker options to remove unused code and data
2098 from the images. Previously, all common functions were being built into
2099 all binary images, whether or not they were actually used.
2100
2101 - Placed all assembler functions in their own section to allow more unused
2102 functions to be removed from images.
2103
2104 - Updated BL1 and BL2 to use a single coherent stack each, rather than one
2105 per CPU.
2106
2107 - Changed variables that were unnecessarily declared and initialized as
2108 non-const (i.e. in the .data section) so they are either uninitialized
2109 (zero init) or const.
2110
2111- Moved the Test Secure-EL1 Payload (BL3-2) to execute in Trusted SRAM by
2112 default. The option for it to run in Trusted DRAM remains.
2113
2114- Implemented a TrustZone Address Space Controller (TZC-400) driver. A
2115 default configuration is provided for the Base FVPs. This means the model
2116 parameter ``-C bp.secure_memory=1`` is now supported.
2117
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01002118- Started saving the PSCI cpu_suspend 'power_state' parameter prior to
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002119 suspending a CPU. This allows platforms that implement multiple power-down
2120 states at the same affinity level to identify a specific state.
2121
2122- Refactored the entire codebase to reduce the amount of nesting in header
2123 files and to make the use of system/user includes more consistent. Also
2124 split platform.h to separate out the platform porting declarations from the
2125 required platform porting definitions and the definitions/declarations
2126 specific to the platform port.
2127
2128- Optimized the data cache clean/invalidate operations.
2129
2130- Improved the BL3-1 unhandled exception handling and reporting. Unhandled
2131 exceptions now result in a dump of registers to the console.
2132
2133- Major rework to the handover interface between BL stages, in particular the
2134 interface to BL3-1. The interface now conforms to a specification and is
2135 more future proof.
2136
2137- Added support for optionally making the BL3-1 entrypoint a reset handler
2138 (instead of BL1). This allows platforms with an alternative image loading
2139 architecture to re-use BL3-1 with fewer modifications to generic code.
2140
2141- Reserved some DDR DRAM for secure use on FVP platforms to avoid future
2142 compatibility problems with non-secure software.
2143
2144- Added support for secure interrupts targeting the Secure-EL1 Payload (SP)
2145 (using GICv2 routing only). Demonstrated this working by adding an interrupt
2146 target and supporting test code to the TSP. Also demonstrated non-secure
2147 interrupt handling during TSP processing.
2148
2149Issues resolved since last release
Paul Beesley32379552019-02-11 17:58:21 +00002150^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002151
2152- Now support use of the model parameter ``-C bp.secure_memory=1`` in the Base
2153 FVPs (see **New features**).
2154
2155- Support for secure world interrupt handling now available (see **New
2156 features**).
2157
2158- Made enough SRAM savings (see **New features**) to enable the Test Secure-EL1
2159 Payload (BL3-2) to execute in Trusted SRAM by default.
2160
2161- The tested filesystem used for this release (Linaro AArch64 OpenEmbedded
2162 14.04) now correctly reports progress in the console.
2163
2164- Improved the Makefile structure to make it easier to separate out parts of
Dan Handley610e7e12018-03-01 18:44:00 +00002165 the TF-A for re-use in platform ports. Also, improved target dependency
2166 checking.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002167
2168Known issues
Paul Beesley32379552019-02-11 17:58:21 +00002169^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002170
2171- GICv3 support is experimental. The Linux kernel patches to support this are
2172 not widely available. There are known issues with GICv3 initialization in
Dan Handley610e7e12018-03-01 18:44:00 +00002173 the TF-A.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002174
2175- Dynamic image loading is not available yet. The current image loader
2176 implementation (used to load BL2 and all subsequent images) has some
2177 limitations. Changing BL2 or BL3-1 load addresses in certain ways can lead
2178 to loading errors, even if the images should theoretically fit in memory.
2179
Dan Handley610e7e12018-03-01 18:44:00 +00002180- TF-A still uses too much on-chip Trusted SRAM. A number of RAM usage
2181 enhancements have been identified to rectify this situation.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002182
2183- CPU idle does not work on the advertised version of the Foundation FVP.
2184 Some FVP fixes are required that are not available externally at the time
2185 of writing. This can be worked around by disabling CPU idle in the Linux
2186 kernel.
2187
Dan Handley610e7e12018-03-01 18:44:00 +00002188- Various bugs in TF-A, UEFI and the Linux kernel have been observed when
2189 using Linaro toolchain versions later than 13.11. Although most of these
2190 have been fixed, some remain at the time of writing. These mainly seem to
2191 relate to a subtle change in the way the compiler converts between 64-bit
2192 and 32-bit values (e.g. during casting operations), which reveals
2193 previously hidden bugs in client code.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002194
2195- The firmware design documentation for the Test Secure-EL1 Payload (TSP) and
2196 its dispatcher (TSPD) is incomplete. Similarly for the PSCI section.
2197
Paul Beesley32379552019-02-11 17:58:21 +00002198Version 0.3
2199-----------
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002200
2201New features
Paul Beesley32379552019-02-11 17:58:21 +00002202^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002203
2204- Support for Foundation FVP Version 2.0 added.
2205 The documented UEFI configuration disables some devices that are unavailable
2206 in the Foundation FVP, including MMC and CLCD. The resultant UEFI binary can
2207 be used on the AEMv8 and Cortex-A57-A53 Base FVPs, as well as the Foundation
2208 FVP.
2209
2210 NOTE: The software will not work on Version 1.0 of the Foundation FVP.
2211
2212- Enabled third party contributions. Added a new contributing.md containing
2213 instructions for how to contribute and updated copyright text in all files
2214 to acknowledge contributors.
2215
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01002216- The PSCI CPU_SUSPEND API has been stabilised to the extent where it can be
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002217 used for entry into power down states with the following restrictions:
2218
2219 - Entry into standby states is not supported.
2220 - The API is only supported on the AEMv8 and Cortex-A57-A53 Base FVPs.
2221
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01002222- The PSCI AFFINITY_INFO api has undergone limited testing on the Base FVPs to
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002223 allow experimental use.
2224
Dan Handley610e7e12018-03-01 18:44:00 +00002225- Required C library and runtime header files are now included locally in
2226 TF-A instead of depending on the toolchain standard include paths. The
2227 local implementation has been cleaned up and reduced in scope.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002228
2229- Added I/O abstraction framework, primarily to allow generic code to load
2230 images in a platform-independent way. The existing image loading code has
2231 been reworked to use the new framework. Semi-hosting and NOR flash I/O
2232 drivers are provided.
2233
2234- Introduced Firmware Image Package (FIP) handling code and tools. A FIP
2235 combines multiple firmware images with a Table of Contents (ToC) into a
2236 single binary image. The new FIP driver is another type of I/O driver. The
2237 Makefile builds a FIP by default and the FVP platform code expect to load a
2238 FIP from NOR flash, although some support for image loading using semi-
2239 hosting is retained.
2240
2241 NOTE: Building a FIP by default is a non-backwards-compatible change.
2242
2243 NOTE: Generic BL2 code now loads a BL3-3 (non-trusted firmware) image into
2244 DRAM instead of expecting this to be pre-loaded at known location. This is
2245 also a non-backwards-compatible change.
2246
2247 NOTE: Some non-trusted firmware (e.g. UEFI) will need to be rebuilt so that
2248 it knows the new location to execute from and no longer needs to copy
2249 particular code modules to DRAM itself.
2250
2251- Reworked BL2 to BL3-1 handover interface. A new composite structure
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01002252 (bl31_args) holds the superset of information that needs to be passed from
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002253 BL2 to BL3-1, including information on how handover execution control to
2254 BL3-2 (if present) and BL3-3 (non-trusted firmware).
2255
2256- Added library support for CPU context management, allowing the saving and
2257 restoring of
2258
2259 - Shared system registers between Secure-EL1 and EL1.
2260 - VFP registers.
2261 - Essential EL3 system registers.
2262
2263- Added a framework for implementing EL3 runtime services. Reworked the PSCI
2264 implementation to be one such runtime service.
2265
Sandrine Bailleux15530dd2019-02-08 15:26:36 +01002266- Reworked the exception handling logic, making use of both SP_EL0 and SP_EL3
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002267 stack pointers for determining the type of exception, managing general
2268 purpose and system register context on exception entry/exit, and handling
2269 SMCs. SMCs are directed to the correct EL3 runtime service.
2270
2271- Added support for a Test Secure-EL1 Payload (TSP) and a corresponding
2272 Dispatcher (TSPD), which is loaded as an EL3 runtime service. The TSPD
2273 implements Secure Monitor functionality such as world switching and
2274 EL1 context management, and is responsible for communication with the TSP.
2275 NOTE: The TSPD does not yet contain support for secure world interrupts.
2276 NOTE: The TSP/TSPD is not built by default.
2277
2278Issues resolved since last release
Paul Beesley32379552019-02-11 17:58:21 +00002279^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002280
2281- Support has been added for switching context between secure and normal
2282 worlds in EL3.
2283
2284- PSCI API calls ``AFFINITY_INFO`` & ``PSCI_VERSION`` have now been tested (to
2285 a limited extent).
2286
Dan Handley610e7e12018-03-01 18:44:00 +00002287- The TF-A build artifacts are now placed in the ``./build`` directory and
2288 sub-directories instead of being placed in the root of the project.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002289
Dan Handley610e7e12018-03-01 18:44:00 +00002290- TF-A is now free from build warnings. Build warnings are now treated as
2291 errors.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002292
Dan Handley610e7e12018-03-01 18:44:00 +00002293- TF-A now provides C library support locally within the project to maintain
2294 compatibility between toolchains/systems.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002295
2296- The PSCI locking code has been reworked so it no longer takes locks in an
2297 incorrect sequence.
2298
2299- The RAM-disk method of loading a Linux file-system has been confirmed to
Dan Handley610e7e12018-03-01 18:44:00 +00002300 work with the TF-A and Linux kernel version (based on version 3.13) used
2301 in this release, for both Foundation and Base FVPs.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002302
2303Known issues
Paul Beesley32379552019-02-11 17:58:21 +00002304^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002305
2306The following is a list of issues which are expected to be fixed in the future
Dan Handley610e7e12018-03-01 18:44:00 +00002307releases of TF-A.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002308
2309- The TrustZone Address Space Controller (TZC-400) is not being programmed
2310 yet. Use of model parameter ``-C bp.secure_memory=1`` is not supported.
2311
2312- No support yet for secure world interrupt handling.
2313
2314- GICv3 support is experimental. The Linux kernel patches to support this are
2315 not widely available. There are known issues with GICv3 initialization in
Dan Handley610e7e12018-03-01 18:44:00 +00002316 TF-A.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002317
2318- Dynamic image loading is not available yet. The current image loader
2319 implementation (used to load BL2 and all subsequent images) has some
2320 limitations. Changing BL2 or BL3-1 load addresses in certain ways can lead
2321 to loading errors, even if the images should theoretically fit in memory.
2322
Dan Handley610e7e12018-03-01 18:44:00 +00002323- TF-A uses too much on-chip Trusted SRAM. Currently the Test Secure-EL1
2324 Payload (BL3-2) executes in Trusted DRAM since there is not enough SRAM.
2325 A number of RAM usage enhancements have been identified to rectify this
2326 situation.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002327
2328- CPU idle does not work on the advertised version of the Foundation FVP.
2329 Some FVP fixes are required that are not available externally at the time
2330 of writing.
2331
Dan Handley610e7e12018-03-01 18:44:00 +00002332- Various bugs in TF-A, UEFI and the Linux kernel have been observed when
2333 using Linaro toolchain versions later than 13.11. Although most of these
2334 have been fixed, some remain at the time of writing. These mainly seem to
2335 relate to a subtle change in the way the compiler converts between 64-bit
2336 and 32-bit values (e.g. during casting operations), which reveals
2337 previously hidden bugs in client code.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002338
2339- The tested filesystem used for this release (Linaro AArch64 OpenEmbedded
2340 14.01) does not report progress correctly in the console. It only seems to
2341 produce error output, not standard output. It otherwise appears to function
2342 correctly. Other filesystem versions on the same software stack do not
2343 exhibit the problem.
2344
2345- The Makefile structure doesn't make it easy to separate out parts of the
Dan Handley610e7e12018-03-01 18:44:00 +00002346 TF-A for re-use in platform ports, for example if only BL3-1 is required in
2347 a platform port. Also, dependency checking in the Makefile is flawed.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002348
2349- The firmware design documentation for the Test Secure-EL1 Payload (TSP) and
2350 its dispatcher (TSPD) is incomplete. Similarly for the PSCI section.
2351
Paul Beesley32379552019-02-11 17:58:21 +00002352Version 0.2
2353-----------
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002354
2355New features
Paul Beesley32379552019-02-11 17:58:21 +00002356^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002357
2358- First source release.
2359
2360- Code for the PSCI suspend feature is supplied, although this is not enabled
2361 by default since there are known issues (see below).
2362
2363Issues resolved since last release
Paul Beesley32379552019-02-11 17:58:21 +00002364^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002365
2366- The "psci" nodes in the FDTs provided in this release now fully comply
2367 with the recommendations made in the PSCI specification.
2368
2369Known issues
Paul Beesley32379552019-02-11 17:58:21 +00002370^^^^^^^^^^^^
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002371
2372The following is a list of issues which are expected to be fixed in the future
Dan Handley610e7e12018-03-01 18:44:00 +00002373releases of TF-A.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002374
2375- The TrustZone Address Space Controller (TZC-400) is not being programmed
2376 yet. Use of model parameter ``-C bp.secure_memory=1`` is not supported.
2377
2378- No support yet for secure world interrupt handling or for switching context
2379 between secure and normal worlds in EL3.
2380
2381- GICv3 support is experimental. The Linux kernel patches to support this are
2382 not widely available. There are known issues with GICv3 initialization in
Dan Handley610e7e12018-03-01 18:44:00 +00002383 TF-A.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002384
2385- Dynamic image loading is not available yet. The current image loader
2386 implementation (used to load BL2 and all subsequent images) has some
2387 limitations. Changing BL2 or BL3-1 load addresses in certain ways can lead
2388 to loading errors, even if the images should theoretically fit in memory.
2389
2390- Although support for PSCI ``CPU_SUSPEND`` is present, it is not yet stable
2391 and ready for use.
2392
Dan Handley610e7e12018-03-01 18:44:00 +00002393- PSCI API calls ``AFFINITY_INFO`` & ``PSCI_VERSION`` are implemented but have
2394 not been tested.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002395
Dan Handley610e7e12018-03-01 18:44:00 +00002396- The TF-A make files result in all build artifacts being placed in the root
2397 of the project. These should be placed in appropriate sub-directories.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002398
Dan Handley610e7e12018-03-01 18:44:00 +00002399- The compilation of TF-A is not free from compilation warnings. Some of these
2400 warnings have not been investigated yet so they could mask real bugs.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002401
Dan Handley610e7e12018-03-01 18:44:00 +00002402- TF-A currently uses toolchain/system include files like stdio.h. It should
2403 provide versions of these within the project to maintain compatibility
2404 between toolchains/systems.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002405
2406- The PSCI code takes some locks in an incorrect sequence. This may cause
2407 problems with suspend and hotplug in certain conditions.
2408
2409- The Linux kernel used in this release is based on version 3.12-rc4. Using
Dan Handley610e7e12018-03-01 18:44:00 +00002410 this kernel with the TF-A fails to start the file-system as a RAM-disk. It
2411 fails to execute user-space ``init`` from the RAM-disk. As an alternative,
2412 the VirtioBlock mechanism can be used to provide a file-system to the
2413 kernel.
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002414
2415--------------
2416
Dan Handley610e7e12018-03-01 18:44:00 +00002417*Copyright (c) 2013-2018, Arm Limited and Contributors. All rights reserved.*
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002418
David Cunadob1580432018-03-14 17:57:31 +00002419.. _SDEI Specification: http://infocenter.arm.com/help/topic/com.arm.doc.den0054a/ARM_DEN0054A_Software_Delegated_Exception_Interface.pdf
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002420.. _PSCI Integration Guide: psci-lib-integration-guide.rst
2421.. _Developer Certificate of Origin: ../dco.txt
2422.. _Contribution Guide: ../contributing.rst
2423.. _Authentication framework: auth-framework.rst
2424.. _Firmware Update: firmware-update.rst
Dan Handley610e7e12018-03-01 18:44:00 +00002425.. _TF-A Reset Design: reset-design.rst
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002426.. _Power Domain Topology Design: psci-pd-tree.rst
Dan Handley610e7e12018-03-01 18:44:00 +00002427.. _TF-A wiki on GitHub: https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Image-Terminology
Douglas Raillardd7c21b72017-06-28 15:23:03 +01002428.. _Authentication Framework: auth-framework.rst
2429.. _OP-TEE Dispatcher: optee-dispatcher.rst
David Cunado1b796fa2017-07-03 18:59:07 +01002430.. _tf-issue#501: https://github.com/ARM-software/tf-issues/issues/501
2431.. _PR#1002: https://github.com/ARM-software/arm-trusted-firmware/pull/1002#issuecomment-312650193