Paul Beesley | fc9ee36 | 2019-03-07 15:47:15 +0000 | [diff] [blame] | 1 | Change Log & Release Notes |
| 2 | ========================== |
Douglas Raillard | 30d7b36 | 2017-06-28 16:14:55 +0100 | [diff] [blame] | 3 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 4 | This document contains a summary of the new features, changes, fixes and known |
| 5 | issues in each release of Trusted Firmware-A. |
Douglas Raillard | 30d7b36 | 2017-06-28 16:14:55 +0100 | [diff] [blame] | 6 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 7 | Version 2.1 |
| 8 | ----------- |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 9 | |
| 10 | New Features |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 11 | ^^^^^^^^^^^^ |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 12 | |
| 13 | - Architecture |
| 14 | - Support for ARMv8.3 pointer authentication in the normal and secure worlds |
| 15 | |
| 16 | The use of pointer authentication in the normal world is enabled whenever |
| 17 | architectural support is available, without the need for additional build |
| 18 | flags. |
| 19 | |
| 20 | Use of pointer authentication in the secure world remains an |
| 21 | experimental configuration at this time. Using both the ``ENABLE_PAUTH`` |
| 22 | and ``CTX_INCLUDE_PAUTH_REGS`` build flags, pointer authentication can be |
| 23 | enabled in EL3 and S-EL1/0. |
| 24 | |
| 25 | See the `Firmware Design`_ document for additional details on the use of |
| 26 | pointer authentication. |
| 27 | |
| 28 | - Enable Data Independent Timing (DIT) in EL3, where supported |
| 29 | |
| 30 | - Build System |
| 31 | - Support for BL-specific build flags |
| 32 | |
| 33 | - Support setting compiler target architecture based on ``ARM_ARCH_MINOR`` |
| 34 | build option. |
| 35 | |
| 36 | - New ``RECLAIM_INIT_CODE`` build flag: |
| 37 | |
| 38 | A significant amount of the code used for the initialization of BL31 is |
| 39 | not needed again after boot time. In order to reduce the runtime memory |
| 40 | footprint, the memory used for this code can be reclaimed after |
| 41 | initialization. |
| 42 | |
| 43 | Certain boot-time functions were marked with the ``__init`` attribute to |
| 44 | enable this reclamation. |
| 45 | |
| 46 | - CPU Support |
| 47 | - cortex-a76: Workaround for erratum 1073348 |
| 48 | - cortex-a76: Workaround for erratum 1220197 |
| 49 | - cortex-a76: Workaround for erratum 1130799 |
| 50 | |
| 51 | - cortex-a75: Workaround for erratum 790748 |
| 52 | - cortex-a75: Workaround for erratum 764081 |
| 53 | |
| 54 | - cortex-a73: Workaround for erratum 852427 |
| 55 | - cortex-a73: Workaround for erratum 855423 |
| 56 | |
| 57 | - cortex-a57: Workaround for erratum 817169 |
| 58 | - cortex-a57: Workaround for erratum 814670 |
| 59 | |
| 60 | - cortex-a55: Workaround for erratum 903758 |
| 61 | - cortex-a55: Workaround for erratum 846532 |
| 62 | - cortex-a55: Workaround for erratum 798797 |
| 63 | - cortex-a55: Workaround for erratum 778703 |
| 64 | - cortex-a55: Workaround for erratum 768277 |
| 65 | |
| 66 | - cortex-a53: Workaround for erratum 819472 |
| 67 | - cortex-a53: Workaround for erratum 824069 |
| 68 | - cortex-a53: Workaround for erratum 827319 |
| 69 | |
| 70 | - cortex-a17: Workaround for erratum 852423 |
| 71 | - cortex-a17: Workaround for erratum 852421 |
| 72 | |
| 73 | - cortex-a15: Workaround for erratum 816470 |
| 74 | - cortex-a15: Workaround for erratum 827671 |
| 75 | |
| 76 | - Documentation |
| 77 | - Exception Handling Framework documentation |
| 78 | |
| 79 | - Library at ROM (romlib) documentation |
| 80 | |
| 81 | - RAS framework documentation |
| 82 | |
| 83 | - Coding Guidelines document |
| 84 | |
| 85 | - Drivers |
| 86 | - ccn: Add API for setting and reading node registers |
| 87 | - Adds ``ccn_read_node_reg`` function |
| 88 | - Adds ``ccn_write_node_reg`` function |
| 89 | |
| 90 | - partition: Support MBR partition entries |
| 91 | |
| 92 | - scmi: Add ``plat_css_get_scmi_info`` function |
| 93 | |
| 94 | Adds a new API ``plat_css_get_scmi_info`` which lets the platform |
| 95 | register a platform-specific instance of ``scmi_channel_plat_info_t`` and |
| 96 | remove the default values |
| 97 | |
Paul Beesley | bd1c416 | 2019-03-29 10:14:56 +0000 | [diff] [blame] | 98 | - tzc380: Add TZC-380 TrustZone Controller driver |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 99 | |
| 100 | - tzc-dmc620: Add driver to manage the TrustZone Controller within the |
| 101 | DMC-620 Dynamic Memory Controller |
| 102 | |
| 103 | - Library at ROM (romlib) |
| 104 | - Add platform-specific jump table list |
| 105 | |
| 106 | - Allow patching of romlib functions |
| 107 | |
| 108 | This change allows patching of functions in the romlib. This can be done by |
| 109 | adding "patch" at the end of the jump table entry for the function that |
| 110 | needs to be patched in the file jmptbl.i. |
| 111 | |
| 112 | - Library Code |
| 113 | - Support non-LPAE-enabled MMU tables in AArch32 |
| 114 | |
| 115 | - mmio: Add ``mmio_clrsetbits_16`` function |
| 116 | - 16-bit variant of ``mmio_clrsetbits`` |
| 117 | |
| 118 | - object_pool: Add Object Pool Allocator |
| 119 | - Manages object allocation using a fixed-size static array |
| 120 | - Adds ``pool_alloc`` and ``pool_alloc_n`` functions |
| 121 | - Does not provide any functions to free allocated objects (by design) |
| 122 | |
| 123 | - libc: Added ``strlcpy`` function |
| 124 | |
| 125 | - libc: Import ``strrchr`` function from FreeBSD |
| 126 | |
| 127 | - xlat_tables: Add support for ARMv8.4-TTST |
| 128 | |
| 129 | - xlat_tables: Support mapping regions without an explicitly specified VA |
| 130 | |
| 131 | - Math |
| 132 | - Added softudiv macro to support software division |
| 133 | |
| 134 | - Memory Partitioning And Monitoring (MPAM) |
| 135 | - Enabled MPAM EL2 traps (``MPAMHCR_EL2`` and ``MPAM_EL2``) |
| 136 | |
| 137 | - Platforms |
| 138 | - amlogic: Add support for Meson S905 (GXBB) |
| 139 | |
| 140 | - arm/fvp_ve: Add support for FVP Versatile Express platform |
| 141 | |
| 142 | - arm/n1sdp: Add support for Neoverse N1 System Development platform |
| 143 | |
| 144 | - arm/rde1edge: Add support for Neoverse E1 platform |
| 145 | |
| 146 | - arm/rdn1edge: Add support for Neoverse N1 platform |
| 147 | |
| 148 | - arm: Add support for booting directly to Linux without an intermediate |
| 149 | loader (AArch32) |
| 150 | |
| 151 | - arm/juno: Enable new CPU errata workarounds for A53 and A57 |
| 152 | |
| 153 | - arm/juno: Add romlib support |
| 154 | |
| 155 | Building a combined BL1 and ROMLIB binary file with the correct page |
| 156 | alignment is now supported on the Juno platform. When ``USE_ROMLIB`` is set |
| 157 | for Juno, it generates the combined file ``bl1_romlib.bin`` which needs to |
| 158 | be used instead of bl1.bin. |
| 159 | |
| 160 | - intel/stratix: Add support for Intel Stratix 10 SoC FPGA platform |
| 161 | |
| 162 | - marvell: Add support for Armada-37xx SoC platform |
| 163 | |
| 164 | - nxp: Add support for i.MX8M and i.MX7 Warp7 platforms |
| 165 | |
| 166 | - renesas: Add support for R-Car Gen3 platform |
| 167 | |
| 168 | - xilinx: Add support for Versal ACAP platforms |
| 169 | |
| 170 | - Position-Independent Executable (PIE) |
| 171 | |
| 172 | PIE support has initially been added to BL31. The ``ENABLE_PIE`` build flag is |
| 173 | used to enable or disable this functionality as required. |
| 174 | |
| 175 | - Secure Partition Manager |
Paul Beesley | bd1c416 | 2019-03-29 10:14:56 +0000 | [diff] [blame] | 176 | - New SPM implementation based on SPCI Alpha 1 draft specification |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 177 | |
Paul Beesley | bd1c416 | 2019-03-29 10:14:56 +0000 | [diff] [blame] | 178 | A new version of SPM has been implemented, based on the SPCI (Secure |
| 179 | Partition Client Interface) and SPRT (Secure Partition Runtime) draft |
| 180 | specifications. |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 181 | |
| 182 | The new implementation is a prototype that is expected to undergo intensive |
| 183 | rework as the specifications change. It has basic support for multiple |
| 184 | Secure Partitions and Resource Descriptions. |
| 185 | |
Paul Beesley | bd1c416 | 2019-03-29 10:14:56 +0000 | [diff] [blame] | 186 | The older version of SPM, based on MM (ARM Management Mode Interface |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 187 | Specification), is still present in the codebase. A new build flag, |
| 188 | ``SPM_MM`` has been added to allow selection of the desired implementation. |
| 189 | This flag defaults to 1, selecting the MM-based implementation. |
| 190 | |
| 191 | - Security |
| 192 | - Spectre Variant-1 mitigations (``CVE-2017-5753``) |
| 193 | |
| 194 | - Use Speculation Store Bypass Safe (SSBS) functionality where available |
| 195 | |
| 196 | Provides mitigation against ``CVE-2018-19440`` (Not saving x0 to x3 |
| 197 | registers can leak information from one Normal World SMC client to another) |
| 198 | |
| 199 | |
| 200 | Changed |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 201 | ^^^^^^^ |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 202 | |
| 203 | - Build System |
| 204 | - Warning levels are now selectable with ``W=<1,2,3>`` |
| 205 | |
| 206 | - Removed unneeded include paths in PLAT_INCLUDES |
| 207 | |
| 208 | - "Warnings as errors" (Werror) can be disabled using ``E=0`` |
| 209 | |
| 210 | - Support totally quiet output with ``-s`` flag |
| 211 | |
| 212 | - Support passing options to checkpatch using ``CHECKPATCH_OPTS=<opts>`` |
| 213 | |
| 214 | - Invoke host compiler with ``HOSTCC / HOSTCCFLAGS`` instead of ``CC / CFLAGS`` |
| 215 | |
| 216 | - Make device tree pre-processing similar to U-boot/Linux by: |
| 217 | - Creating separate ``CPPFLAGS`` for DT preprocessing so that compiler |
| 218 | options specific to it can be accommodated. |
| 219 | - Replacing ``CPP`` with ``PP`` for DT pre-processing |
| 220 | |
| 221 | - CPU Support |
| 222 | - Errata report function definition is now mandatory for CPU support files |
| 223 | |
| 224 | CPU operation files must now define a ``<name>_errata_report`` function to |
| 225 | print errata status. This is no longer a weak reference. |
| 226 | |
| 227 | - Documentation |
| 228 | - Migrated some content from GitHub wiki to ``docs/`` directory |
| 229 | |
| 230 | - Security advisories now have CVE links |
| 231 | |
| 232 | - Updated copyright guidelines |
| 233 | |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 234 | - Drivers |
| 235 | - console: The ``MULTI_CONSOLE_API`` framework has been rewritten in C |
Paul Beesley | bd1c416 | 2019-03-29 10:14:56 +0000 | [diff] [blame] | 236 | |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 237 | - console: Ported multi-console driver to AArch32 |
| 238 | |
| 239 | - gic: Remove 'lowest priority' constants |
| 240 | |
| 241 | Removed ``GIC_LOWEST_SEC_PRIORITY`` and ``GIC_LOWEST_NS_PRIORITY``. |
| 242 | Platforms should define these if required, or instead determine the correct |
| 243 | priority values at runtime. |
| 244 | |
| 245 | - delay_timer: Check that the Generic Timer extension is present |
| 246 | |
| 247 | - mmc: Increase command reply timeout to 10 milliseconds |
| 248 | |
| 249 | - mmc: Poll eMMC device status to ensure ``EXT_CSD`` command completion |
| 250 | |
| 251 | - mmc: Correctly check return code from ``mmc_fill_device_info`` |
| 252 | |
| 253 | - External Libraries |
| 254 | |
| 255 | - libfdt: Upgraded from 1.4.2 to 1.4.6-9 |
| 256 | |
| 257 | - mbed TLS: Upgraded from 2.12 to 2.16 |
| 258 | |
| 259 | This change incorporates fixes for security issues that should be reviewed |
| 260 | to determine if they are relevant for software implementations using |
| 261 | Trusted Firmware-A. See the `mbed TLS releases`_ page for details on |
| 262 | changes from the 2.12 to the 2.16 release. |
| 263 | |
| 264 | - Library Code |
| 265 | - compiler-rt: Updated ``lshrdi3.c`` and ``int_lib.h`` with changes from |
| 266 | LLVM master branch (r345645) |
| 267 | |
| 268 | - cpu: Updated macro that checks need for ``CVE-2017-5715`` mitigation |
| 269 | |
| 270 | - libc: Made setjmp and longjmp C standard compliant |
| 271 | |
| 272 | - libc: Allowed overriding the default libc (use ``OVERRIDE_LIBC``) |
| 273 | |
| 274 | - libc: Moved setjmp and longjmp to the ``libc/`` directory |
| 275 | |
| 276 | - Platforms |
| 277 | - Removed Mbed TLS dependency from plat_bl_common.c |
| 278 | |
| 279 | - arm: Removed unused ``ARM_MAP_BL_ROMLIB`` macro |
| 280 | |
| 281 | - arm: Removed ``ARM_BOARD_OPTIMISE_MEM`` feature and build flag |
| 282 | |
| 283 | - arm: Moved several components into ``drivers/`` directory |
| 284 | |
| 285 | This affects the SDS, SCP, SCPI, MHU and SCMI components |
| 286 | |
| 287 | - arm/juno: Increased maximum BL2 image size to ``0xF000`` |
| 288 | |
| 289 | This change was required to accommodate a larger ``libfdt`` library |
| 290 | |
| 291 | - SCMI |
| 292 | - Optimized bakery locks when hardware-assisted coherency is enabled using the |
| 293 | ``HW_ASSISTED_COHERENCY`` build flag |
| 294 | |
| 295 | - SDEI |
| 296 | - Added support for unconditionally resuming secure world execution after |
Paul Beesley | 606d807 | 2019-03-13 13:58:02 +0000 | [diff] [blame] | 297 | |SDEI| event processing completes |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 298 | |
Paul Beesley | 606d807 | 2019-03-13 13:58:02 +0000 | [diff] [blame] | 299 | |SDEI| interrupts, although targeting EL3, occur on behalf of the non-secure |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 300 | world, and may have higher priority than secure world |
| 301 | interrupts. Therefore they might preempt secure execution and yield |
Paul Beesley | 606d807 | 2019-03-13 13:58:02 +0000 | [diff] [blame] | 302 | execution to the non-secure |SDEI| handler. Upon completion of |SDEI| event |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 303 | handling, resume secure execution if it was preempted. |
| 304 | |
| 305 | - Translation Tables (XLAT) |
| 306 | - Dynamically detect need for ``Common not Private (TTBRn_ELx.CnP)`` bit |
| 307 | |
| 308 | Properly handle the case where ``ARMv8.2-TTCNP`` is implemented in a CPU |
| 309 | that does not implement all mandatory v8.2 features (and so must claim to |
| 310 | implement a lower architecture version). |
| 311 | |
| 312 | |
| 313 | Resolved Issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 314 | ^^^^^^^^^^^^^^^ |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 315 | |
| 316 | - Architecture |
| 317 | - Incorrect check for SSBS feature detection |
| 318 | |
| 319 | - Unintentional register clobber in AArch32 reset_handler function |
| 320 | |
| 321 | - Build System |
| 322 | - Dependency issue during DTB image build |
| 323 | |
| 324 | - Incorrect variable expansion in Arm platform makefiles |
| 325 | |
| 326 | - Building on Windows with verbose mode (``V=1``) enabled is broken |
| 327 | |
| 328 | - AArch32 compilation flags is missing ``$(march32-directive)`` |
| 329 | |
| 330 | - BL-Specific Issues |
| 331 | - bl2: ``uintptr_t is not defined`` error when ``BL2_IN_XIP_MEM`` is defined |
| 332 | |
| 333 | - bl2: Missing prototype warning in ``bl2_arch_setup`` |
| 334 | |
| 335 | - bl31: Omission of Global Offset Table (GOT) section |
| 336 | |
| 337 | - Code Quality Issues |
| 338 | - Multiple MISRA compliance issues |
| 339 | |
| 340 | - Potential NULL pointer dereference (Coverity-detected) |
| 341 | |
| 342 | - Drivers |
| 343 | - mmc: Local declaration of ``scr`` variable causes a cache issue when |
| 344 | invalidating after the read DMA transfer completes |
| 345 | |
| 346 | - mmc: ``ACMD41`` does not send voltage information during initialization, |
| 347 | resulting in the command being treated as a query. This prevents the |
| 348 | command from initializing the controller. |
| 349 | |
| 350 | - mmc: When checking device state using ``mmc_device_state()`` there are no |
| 351 | retries attempted in the event of an error |
| 352 | |
| 353 | - ccn: Incorrect Region ID calculation for RN-I nodes |
| 354 | |
| 355 | - console: ``Fix MULTI_CONSOLE_API`` when used as a crash console |
| 356 | |
| 357 | - partition: Improper NULL checking in gpt.c |
| 358 | |
| 359 | - partition: Compilation failure in ``VERBOSE`` mode (``V=1``) |
| 360 | |
| 361 | - Library Code |
| 362 | - common: Incorrect check for Address Authentication support |
| 363 | |
| 364 | - xlat: Fix XLAT_V1 / XLAT_V2 incompatibility |
| 365 | |
| 366 | The file ``arm_xlat_tables.h`` has been renamed to ``xlat_tables_compat.h`` |
| 367 | and has been moved to a common folder. This header can be used to guarantee |
| 368 | compatibility, as it includes the correct header based on |
| 369 | ``XLAT_TABLES_LIB_V2``. |
| 370 | |
| 371 | - xlat: armclang unused-function warning on ``xlat_clean_dcache_range`` |
| 372 | |
| 373 | - xlat: Invalid ``mm_cursor`` checks in ``mmap_add`` and ``mmap_add_ctx`` |
| 374 | |
| 375 | - sdei: Missing ``context.h`` header |
| 376 | |
| 377 | - Platforms |
| 378 | - common: Missing prototype warning for ``plat_log_get_prefix`` |
| 379 | |
| 380 | - arm: Insufficient maximum BL33 image size |
| 381 | |
| 382 | - arm: Potential memory corruption during BL2-BL31 transition |
| 383 | |
| 384 | On Arm platforms, the BL2 memory can be overlaid by BL31/BL32. The memory |
| 385 | descriptors describing the list of executable images are created in BL2 |
| 386 | R/W memory, which could be possibly corrupted later on by BL31/BL32 due |
| 387 | to overlay. This patch creates a reserved location in SRAM for these |
| 388 | descriptors and are copied over by BL2 before handing over to next BL |
| 389 | image. |
| 390 | |
| 391 | - juno: Invalid behaviour when ``CSS_USE_SCMI_SDS_DRIVER`` is not set |
| 392 | |
| 393 | In ``juno_pm.c`` the ``css_scmi_override_pm_ops`` function was used |
| 394 | regardless of whether the build flag was set. The original behaviour has |
| 395 | been restored in the case where the build flag is not set. |
| 396 | |
| 397 | - Tools |
| 398 | - fiptool: Incorrect UUID parsing of blob parameters |
| 399 | |
| 400 | - doimage: Incorrect object rules in Makefile |
| 401 | |
| 402 | |
| 403 | Deprecations |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 404 | ^^^^^^^^^^^^ |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 405 | |
| 406 | - Common Code |
| 407 | - ``plat_crash_console_init`` function |
| 408 | |
| 409 | - ``plat_crash_console_putc`` function |
| 410 | |
| 411 | - ``plat_crash_console_flush`` function |
| 412 | |
| 413 | - ``finish_console_register`` macro |
| 414 | |
| 415 | - AArch64-specific Code |
| 416 | - helpers: ``get_afflvl_shift`` |
| 417 | |
| 418 | - helpers: ``mpidr_mask_lower_afflvls`` |
| 419 | |
| 420 | - helpers: ``eret`` |
| 421 | |
| 422 | - Secure Partition Manager (SPM) |
| 423 | - Boot-info structure |
| 424 | |
| 425 | |
| 426 | Known Issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 427 | ^^^^^^^^^^^^ |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 428 | |
| 429 | - Build System Issues |
| 430 | - dtb: DTB creation not supported when building on a Windows host. |
| 431 | |
| 432 | This step in the build process is skipped when running on a Windows host. A |
| 433 | known issue from the 1.6 release. |
| 434 | |
| 435 | - Platform Issues |
| 436 | - arm/juno: System suspend from Linux does not function as documented in the |
| 437 | user guide |
| 438 | |
| 439 | Following the instructions provided in the user guide document does not |
| 440 | result in the platform entering system suspend state as expected. A message |
| 441 | relating to the hdlcd driver failing to suspend will be emitted on the |
| 442 | Linux terminal. |
| 443 | |
Soby Mathew | b58f97a | 2019-03-28 13:46:40 +0000 | [diff] [blame] | 444 | - arm/juno: The firmware update use-cases do not work with motherboard |
| 445 | firmware version < v1.5.0 (the reset reason is not preserved). The Linaro |
| 446 | 18.04 release has MB v1.4.9. The MB v1.5.0 is available in Linaro 18.10 |
| 447 | release. |
| 448 | |
Paul Beesley | bbf4804 | 2019-03-25 12:21:57 +0000 | [diff] [blame] | 449 | - mediatek/mt6795: This platform does not build in this release |
| 450 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 451 | Version 2.0 |
| 452 | ----------- |
Joanna Farley | add3451 | 2018-09-28 08:38:17 +0100 | [diff] [blame] | 453 | |
| 454 | New Features |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 455 | ^^^^^^^^^^^^ |
Joanna Farley | add3451 | 2018-09-28 08:38:17 +0100 | [diff] [blame] | 456 | |
Paul Beesley | 1fbc97b | 2019-01-11 18:26:51 +0000 | [diff] [blame] | 457 | - Removal of a number of deprecated APIs |
Joanna Farley | add3451 | 2018-09-28 08:38:17 +0100 | [diff] [blame] | 458 | |
| 459 | - A new Platform Compatibility Policy document has been created which |
| 460 | references a wiki page that maintains a listing of deprecated |
| 461 | interfaces and the release after which they will be removed. |
| 462 | |
| 463 | - All deprecated interfaces except the MULTI_CONSOLE_API have been removed |
| 464 | from the code base. |
| 465 | |
| 466 | - Various Arm and partner platforms have been updated to remove the use of |
Paul Beesley | 1fbc97b | 2019-01-11 18:26:51 +0000 | [diff] [blame] | 467 | removed APIs in this release. |
Joanna Farley | add3451 | 2018-09-28 08:38:17 +0100 | [diff] [blame] | 468 | |
| 469 | - This release is otherwise unchanged from 1.6 release |
| 470 | |
| 471 | Issues resolved since last release |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 472 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
Joanna Farley | add3451 | 2018-09-28 08:38:17 +0100 | [diff] [blame] | 473 | |
| 474 | - No issues known at 1.6 release resolved in 2.0 release |
| 475 | |
| 476 | Known Issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 477 | ^^^^^^^^^^^^ |
Joanna Farley | add3451 | 2018-09-28 08:38:17 +0100 | [diff] [blame] | 478 | |
| 479 | - DTB creation not supported when building on a Windows host. This step in the |
| 480 | build process is skipped when running on a Windows host. Known issue from |
| 481 | 1.6 version. |
| 482 | |
| 483 | - As a result of removal of deprecated interfaces the Nvidia Tegra, Marvell |
| 484 | Armada 8K and MediaTek MT6795 platforms do not build in this release. |
| 485 | Also MediaTek MT8173, NXP QorIQ LS1043A, NXP i.MX8QX, NXP i.MX8QMa, |
| 486 | Rockchip RK3328, Rockchip RK3368 and Rockchip RK3399 platforms have not been |
| 487 | confirmed to be working after the removal of the deprecated interfaces |
| 488 | although they do build. |
| 489 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 490 | Version 1.6 |
| 491 | ----------- |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 492 | |
| 493 | New Features |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 494 | ^^^^^^^^^^^^ |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 495 | |
Joanna Farley | add3451 | 2018-09-28 08:38:17 +0100 | [diff] [blame] | 496 | - Addressing Speculation Security Vulnerabilities |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 497 | |
| 498 | - Implement static workaround for CVE-2018-3639 for AArch32 and AArch64 |
| 499 | |
| 500 | - Add support for dynamic mitigation for CVE-2018-3639 |
| 501 | |
| 502 | - Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 |
| 503 | |
Paul Beesley | 606d807 | 2019-03-13 13:58:02 +0000 | [diff] [blame] | 504 | - Ensure |SDEI| handler executes with CVE-2018-3639 mitigation enabled |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 505 | |
| 506 | - Introduce RAS handling on AArch64 |
| 507 | |
John Tsichritzis | f93256f | 2018-10-05 14:16:26 +0100 | [diff] [blame] | 508 | - Some RAS extensions are mandatory for Armv8.2 CPUs, with others |
| 509 | mandatory for Armv8.4 CPUs however, all extensions are also optional |
| 510 | extensions to the base Armv8.0 architecture. |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 511 | |
John Tsichritzis | f93256f | 2018-10-05 14:16:26 +0100 | [diff] [blame] | 512 | - The Armv8 RAS Extensions introduced Standard Error Records which are a |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 513 | set of standard registers to configure RAS node policy and allow RAS |
| 514 | Nodes to record and expose error information for error handling agents. |
| 515 | |
| 516 | - Capabilities are provided to support RAS Node enumeration and iteration |
| 517 | along with individual interrupt registrations and fault injections |
| 518 | support. |
| 519 | |
| 520 | - Introduce handlers for Uncontainable errors, Double Faults and EL3 |
| 521 | External Aborts |
| 522 | |
| 523 | - Enable Memory Partitioning And Monitoring (MPAM) for lower EL's |
| 524 | |
| 525 | - Memory Partitioning And Monitoring is an Armv8.4 feature that enables |
| 526 | various memory system components and resources to define partitions. |
| 527 | Software running at various ELs can then assign themselves to the |
| 528 | desired partition to control their performance aspects. |
| 529 | |
| 530 | - When ENABLE_MPAM_FOR_LOWER_ELS is set to 1, EL3 allows |
| 531 | lower ELs to access their own MPAM registers without trapping to EL3. |
| 532 | This patch however, doesn't make use of partitioning in EL3; platform |
| 533 | initialisation code should configure and use partitions in EL3 if |
| 534 | required. |
| 535 | |
| 536 | - Introduce ROM Lib Feature |
| 537 | |
| 538 | - Support combining several libraries into a self-called "romlib" image, |
| 539 | that may be shared across images to reduce memory footprint. The romlib |
| 540 | image is stored in ROM but is accessed through a jump-table that may be |
| 541 | stored in read-write memory, allowing for the library code to be patched. |
| 542 | |
| 543 | - Introduce Backtrace Feature |
| 544 | |
| 545 | - This function displays the backtrace, the current EL and security state |
| 546 | to allow a post-processing tool to choose the right binary to interpret |
| 547 | the dump. |
| 548 | |
| 549 | - Print backtrace in assert() and panic() to the console. |
| 550 | |
| 551 | - Code hygiene changes and alignment with MISRA C-2012 guideline with fixes |
| 552 | addressing issues complying to the following rules: |
| 553 | |
| 554 | - MISRA rules 4.9, 5.1, 5.3, 5.7, 8.2-8.5, 8.8, 8.13, 9.3, 10.1, |
| 555 | 10.3-10.4, 10.8, 11.3, 11.6, 12.1, 14.4, 15.7, 16.1-16.7, 17.7-17.8, |
| 556 | 20.7, 20.10, 20.12, 21.1, 21.15, 22.7 |
| 557 | |
| 558 | - Clean up the usage of void pointers to access symbols |
| 559 | |
| 560 | - Increase usage of static qualifier to locally used functions and data |
| 561 | |
| 562 | - Migrated to use of u_register_t for register read/write to better |
| 563 | match AArch32 and AArch64 type sizes |
| 564 | |
| 565 | - Use int-ll64 for both AArch32 and AArch64 to assist in consistent |
| 566 | format strings between architectures |
| 567 | |
| 568 | - Clean up TF-A libc by removing non arm copyrighted implementations |
| 569 | and replacing them with modified FreeBSD and SCC implementations |
| 570 | |
| 571 | - Various changes to support Clang linker and assembler |
| 572 | |
John Tsichritzis | f93256f | 2018-10-05 14:16:26 +0100 | [diff] [blame] | 573 | - The clang assembler/preprocessor is used when Clang is selected. However, |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 574 | the clang linker is not used because it is unable to link TF-A objects |
| 575 | due to immaturity of clang linker functionality at this time. |
| 576 | |
Paul Beesley | 1fbc97b | 2019-01-11 18:26:51 +0000 | [diff] [blame] | 577 | - Refactor support APIs into Libraries |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 578 | |
| 579 | - Evolve libfdt, mbed TLS library and standard C library sources as |
| 580 | proper libraries that TF-A may be linked against. |
| 581 | |
| 582 | - CPU Enhancements |
| 583 | |
| 584 | - Add CPU support for Cortex-Ares and Cortex-A76 |
| 585 | |
| 586 | - Add AMU support for Cortex-Ares |
| 587 | |
| 588 | - Add initial CPU support for Cortex-Deimos |
| 589 | |
| 590 | - Add initial CPU support for Cortex-Helios |
| 591 | |
| 592 | - Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 |
| 593 | |
| 594 | - Implement Cortex-Ares erratum 1043202 workaround |
| 595 | |
| 596 | - Implement DSU erratum 936184 workaround |
| 597 | |
| 598 | - Check presence of fix for errata 843419 in Cortex-A53 |
| 599 | |
| 600 | - Check presence of fix for errata 835769 in Cortex-A53 |
| 601 | |
| 602 | - Translation Tables Enhancements |
| 603 | |
| 604 | - The xlat v2 library has been refactored in order to be reused by |
| 605 | different TF components at different EL's including the addition of EL2. |
| 606 | Some refactoring to make the code more generic and less specific to TF, |
| 607 | in order to reuse the library outside of this project. |
| 608 | |
| 609 | - SPM Enhancements |
| 610 | |
| 611 | - General cleanups and refactoring to pave the way to multiple partitions |
| 612 | support |
| 613 | |
| 614 | - SDEI Enhancements |
| 615 | |
| 616 | - Allow platforms to define explicit events |
| 617 | |
| 618 | - Determine client EL from NS context's SCR_EL3 |
| 619 | |
| 620 | - Make dispatches synchronous |
| 621 | |
| 622 | - Introduce jump primitives for BL31 |
| 623 | |
Paul Beesley | 606d807 | 2019-03-13 13:58:02 +0000 | [diff] [blame] | 624 | - Mask events after CPU wakeup in |SDEI| dispatcher to conform to the |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 625 | specification |
| 626 | |
| 627 | - Misc TF-A Core Common Code Enhancements |
| 628 | |
| 629 | - Add support for eXecute In Place (XIP) memory in BL2 |
| 630 | |
| 631 | - Add support for the SMC Calling Convention 2.0 |
| 632 | |
| 633 | - Introduce External Abort handling on AArch64 |
| 634 | External Abort routed to EL3 was reported as an unhandled exception |
| 635 | and caused a panic. This change enables Arm Trusted Firmware-A to |
| 636 | handle External Aborts routed to EL3. |
| 637 | |
| 638 | - Save value of ACTLR_EL1 implementation-defined register in the CPU |
| 639 | context structure rather than forcing it to 0. |
| 640 | |
| 641 | - Introduce ARM_LINUX_KERNEL_AS_BL33 build option, which allows BL31 to |
| 642 | directly jump to a Linux kernel. This makes for a quicker and simpler |
| 643 | boot flow, which might be useful in some test environments. |
| 644 | |
| 645 | - Add dynamic configurations for BL31, BL32 and BL33 enabling support for |
| 646 | Chain of Trust (COT). |
| 647 | |
| 648 | - Make TF UUID RFC 4122 compliant |
| 649 | |
| 650 | - New Platform Support |
| 651 | |
| 652 | - Arm SGI-575 |
| 653 | |
| 654 | - Arm SGM-775 |
| 655 | |
| 656 | - Allwinner sun50i_64 |
| 657 | |
| 658 | - Allwinner sun50i_h6 |
| 659 | |
John Tsichritzis | f93256f | 2018-10-05 14:16:26 +0100 | [diff] [blame] | 660 | - NXP QorIQ LS1043A |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 661 | |
| 662 | - NXP i.MX8QX |
| 663 | |
| 664 | - NXP i.MX8QM |
| 665 | |
John Tsichritzis | f93256f | 2018-10-05 14:16:26 +0100 | [diff] [blame] | 666 | - NXP i.MX7Solo WaRP7 |
| 667 | |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 668 | - TI K3 |
| 669 | |
| 670 | - Socionext Synquacer SC2A11 |
| 671 | |
| 672 | - Marvell Armada 8K |
| 673 | |
| 674 | - STMicroelectronics STM32MP1 |
| 675 | |
| 676 | - Misc Generic Platform Common Code Enhancements |
| 677 | |
| 678 | - Add MMC framework that supports both eMMC and SD card devices |
| 679 | |
| 680 | - Misc Arm Platform Common Code Enhancements |
| 681 | |
| 682 | - Demonstrate PSCI MEM_PROTECT from el3_runtime |
| 683 | |
| 684 | - Provide RAS support |
| 685 | |
| 686 | - Migrate AArch64 port to the multi console driver. The old API is |
| 687 | deprecated and will eventually be removed. |
| 688 | |
| 689 | - Move BL31 below BL2 to enable BL2 overlay resulting in changes in the |
| 690 | layout of BL images in memory to enable more efficient use of available |
| 691 | space. |
| 692 | |
| 693 | - Add cpp build processing for dtb that allows processing device tree |
| 694 | with external includes. |
| 695 | |
| 696 | - Extend FIP io driver to support multiple FIP devices |
| 697 | |
| 698 | - Add support for SCMI AP core configuration protocol v1.0 |
| 699 | |
| 700 | - Use SCMI AP core protocol to set the warm boot entrypoint |
| 701 | |
| 702 | - Add support to Mbed TLS drivers for shared heap among different |
| 703 | BL images to help optimise memory usage |
| 704 | |
| 705 | - Enable non-secure access to UART1 through a build option to support |
| 706 | a serial debug port for debugger connection |
| 707 | |
| 708 | - Enhancements for Arm Juno Platform |
| 709 | |
| 710 | - Add support for TrustZone Media Protection 1 (TZMP1) |
| 711 | |
| 712 | - Enhancements for Arm FVP Platform |
| 713 | |
| 714 | - Dynamic_config: remove the FVP dtb files |
| 715 | |
| 716 | - Set DYNAMIC_WORKAROUND_CVE_2018_3639=1 on FVP by default |
| 717 | |
| 718 | - Set the ability to dynamically disable Trusted Boot Board |
| 719 | authentication to be off by default with DYN_DISABLE_AUTH |
| 720 | |
| 721 | - Add librom enhancement support in FVP |
| 722 | |
| 723 | - Support shared Mbed TLS heap between BL1 and BL2 that allow a |
| 724 | reduction in BL2 size for FVP |
| 725 | |
| 726 | - Enhancements for Arm SGI/SGM Platform |
| 727 | |
| 728 | - Enable ARM_PLAT_MT flag for SGI-575 |
| 729 | |
| 730 | - Add dts files to enable support for dynamic config |
| 731 | |
| 732 | - Add RAS support |
| 733 | |
| 734 | - Support shared Mbed TLS heap for SGI and SGM between BL1 and BL2 |
| 735 | |
| 736 | - Enhancements for Non Arm Platforms |
| 737 | |
| 738 | - Raspberry Pi Platform |
| 739 | |
| 740 | - Hikey Platforms |
| 741 | |
| 742 | - Xilinx Platforms |
| 743 | |
| 744 | - QEMU Platform |
| 745 | |
| 746 | - Rockchip rk3399 Platform |
| 747 | |
| 748 | - TI Platforms |
| 749 | |
| 750 | - Socionext Platforms |
| 751 | |
| 752 | - Allwinner Platforms |
| 753 | |
| 754 | - NXP Platforms |
| 755 | |
| 756 | - NVIDIA Tegra Platform |
| 757 | |
| 758 | - Marvell Platforms |
| 759 | |
| 760 | - STMicroelectronics STM32MP1 Platform |
| 761 | |
| 762 | Issues resolved since last release |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 763 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 764 | |
| 765 | - No issues known at 1.5 release resolved in 1.6 release |
| 766 | |
| 767 | Known Issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 768 | ^^^^^^^^^^^^ |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 769 | |
| 770 | - DTB creation not supported when building on a Windows host. This step in the |
| 771 | build process is skipped when running on a Windows host. Known issue from |
| 772 | 1.5 version. |
| 773 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 774 | Version 1.5 |
| 775 | ----------- |
David Cunado | b158043 | 2018-03-14 17:57:31 +0000 | [diff] [blame] | 776 | |
| 777 | New features |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 778 | ^^^^^^^^^^^^ |
David Cunado | b158043 | 2018-03-14 17:57:31 +0000 | [diff] [blame] | 779 | |
| 780 | - Added new firmware support to enable RAS (Reliability, Availability, and |
| 781 | Serviceability) functionality. |
| 782 | |
| 783 | - Secure Partition Manager (SPM): A Secure Partition is a software execution |
| 784 | environment instantiated in S-EL0 that can be used to implement simple |
| 785 | management and security services. The SPM is the firmware component that |
| 786 | is responsible for managing a Secure Partition. |
| 787 | |
Paul Beesley | 606d807 | 2019-03-13 13:58:02 +0000 | [diff] [blame] | 788 | - SDEI dispatcher: Support for interrupt-based |SDEI| events and all |
| 789 | interfaces as defined by the |SDEI| specification v1.0, see |
David Cunado | b158043 | 2018-03-14 17:57:31 +0000 | [diff] [blame] | 790 | `SDEI Specification`_ |
| 791 | |
| 792 | - Exception Handling Framework (EHF): Framework that allows dispatching of |
| 793 | EL3 interrupts to their registered handlers which are registered based on |
| 794 | their priorities. Facilitates firmware-first error handling policy where |
| 795 | asynchronous exceptions may be routed to EL3. |
| 796 | |
| 797 | Integrated the TSPD with EHF. |
| 798 | |
| 799 | - Updated PSCI support: |
| 800 | |
| 801 | - Implemented PSCI v1.1 optional features `MEM_PROTECT` and `SYSTEM_RESET2`. |
| 802 | The supported PSCI version was updated to v1.1. |
| 803 | |
| 804 | - Improved PSCI STAT timestamp collection, including moving accounting for |
| 805 | retention states to be inside the locks and fixing handling of wrap-around |
| 806 | when calculating residency in AArch32 execution state. |
| 807 | |
| 808 | - Added optional handler for early suspend that executes when suspending to |
| 809 | a power-down state and with data caches enabled. |
| 810 | |
| 811 | This may provide a performance improvement on platforms where it is safe |
| 812 | to perform some or all of the platform actions from `pwr_domain_suspend` |
| 813 | with the data caches enabled. |
| 814 | |
| 815 | - Enabled build option, BL2_AT_EL3, for BL2 to allow execution at EL3 without |
| 816 | any dependency on TF BL1. |
| 817 | |
| 818 | This allows platforms which already have a non-TF Boot ROM to directly load |
| 819 | and execute BL2 and subsequent BL stages without need for BL1. This was not |
| 820 | previously possible because BL2 executes at S-EL1 and cannot jump straight to |
| 821 | EL3. |
| 822 | |
| 823 | - Implemented support for SMCCC v1.1, including `SMCCC_VERSION` and |
| 824 | `SMCCC_ARCH_FEATURES`. |
| 825 | |
| 826 | Additionally, added support for `SMCCC_VERSION` in PSCI features to enable |
| 827 | discovery of the SMCCC version via PSCI feature call. |
| 828 | |
| 829 | - Added Dynamic Configuration framework which enables each of the boot loader |
| 830 | stages to be dynamically configured at runtime if required by the platform. |
| 831 | The boot loader stage may optionally specify a firmware configuration file |
| 832 | and/or hardware configuration file that can then be shared with the next boot |
| 833 | loader stage. |
| 834 | |
| 835 | Introduced a new BL handover interface that essentially allows passing of 4 |
| 836 | arguments between the different BL stages. |
| 837 | |
| 838 | Updated cert_create and fip_tool to support the dynamic configuration files. |
| 839 | The COT also updated to support these new files. |
| 840 | |
| 841 | - Code hygiene changes and alignment with MISRA guideline: |
| 842 | |
| 843 | - Fix use of undefined macros. |
| 844 | |
| 845 | - Achieved compliance with Mandatory MISRA coding rules. |
| 846 | |
| 847 | - Achieved compliance for following Required MISRA rules for the default |
| 848 | build configurations on FVP and Juno platforms : 7.3, 8.3, 8.4, 8.5 and |
| 849 | 8.8. |
| 850 | |
| 851 | - Added support for Armv8.2-A architectural features: |
| 852 | |
| 853 | - Updated translation table set-up to set the CnP (Common not Private) bit |
| 854 | for secure page tables so that multiple PEs in the same Inner Shareable |
| 855 | domain can use the same translation table entries for a given stage of |
| 856 | translation in a particular translation regime. |
| 857 | |
| 858 | - Extended the supported values of ID_AA64MMFR0_EL1.PARange to include the |
| 859 | 52-bit Physical Address range. |
| 860 | |
| 861 | - Added support for the Scalable Vector Extension to allow Normal world |
| 862 | software to access SVE functionality but disable access to SVE, SIMD and |
| 863 | floating point functionality from the Secure world in order to prevent |
| 864 | corruption of the Z-registers. |
| 865 | |
| 866 | - Added support for Armv8.4-A architectural feature Activity Monitor Unit (AMU) |
| 867 | extensions. |
| 868 | |
| 869 | In addition to the v8.4 architectural extension, AMU support on Cortex-A75 |
| 870 | was implemented. |
| 871 | |
| 872 | - Enhanced OP-TEE support to enable use of pageable OP-TEE image. The Arm |
| 873 | standard platforms are updated to load up to 3 images for OP-TEE; header, |
| 874 | pager image and paged image. |
| 875 | |
| 876 | The chain of trust is extended to support the additional images. |
| 877 | |
| 878 | - Enhancements to the translation table library: |
| 879 | |
| 880 | - Introduced APIs to get and set the memory attributes of a region. |
| 881 | |
Paul Beesley | 1fbc97b | 2019-01-11 18:26:51 +0000 | [diff] [blame] | 882 | - Added support to manage both privilege levels in translation regimes that |
David Cunado | b158043 | 2018-03-14 17:57:31 +0000 | [diff] [blame] | 883 | describe translations for 2 Exception levels, specifically the EL1&0 |
| 884 | translation regime, and extended the memory map region attributes to |
| 885 | include specifying Non-privileged access. |
| 886 | |
| 887 | - Added support to specify the granularity of the mappings of each region, |
| 888 | for instance a 2MB region can be specified to be mapped with 4KB page |
| 889 | tables instead of a 2MB block. |
| 890 | |
| 891 | - Disabled the higher VA range to avoid unpredictable behaviour if there is |
| 892 | an attempt to access addresses in the higher VA range. |
| 893 | |
| 894 | - Added helpers for Device and Normal memory MAIR encodings that align with |
| 895 | the Arm Architecture Reference Manual for Armv8-A (Arm DDI0487B.b). |
| 896 | |
| 897 | - Code hygiene including fixing type length and signedness of constants, |
| 898 | refactoring of function to enable the MMU, removing all instances where |
| 899 | the virtual address space is hardcoded and added comments that document |
| 900 | alignment needed between memory attributes and attributes specified in |
| 901 | TCR_ELx. |
| 902 | |
| 903 | - Updated GIC support: |
| 904 | |
| 905 | - Introduce new APIs for GICv2 and GICv3 that provide the capability to |
| 906 | specify interrupt properties rather than list of interrupt numbers alone. |
| 907 | The Arm platforms and other upstream platforms are migrated to use |
| 908 | interrupt properties. |
| 909 | |
| 910 | - Added helpers to save / restore the GICv3 context, specifically the |
| 911 | Distributor and Redistributor contexts and architectural parts of the ITS |
| 912 | power management. The Distributor and Redistributor helpers also support |
| 913 | the implementation-defined part of GIC-500 and GIC-600. |
| 914 | |
| 915 | Updated the Arm FVP platform to save / restore the GICv3 context on system |
| 916 | suspend / resume as an example of how to use the helpers. |
| 917 | |
| 918 | Introduced a new TZC secured DDR carve-out for use by Arm platforms for |
| 919 | storing EL3 runtime data such as the GICv3 register context. |
| 920 | |
| 921 | - Added support for Armv7-A architecture via build option ARM_ARCH_MAJOR=7. |
| 922 | This includes following features: |
| 923 | |
| 924 | - Updates GICv2 driver to manage GICv1 with security extensions. |
| 925 | |
| 926 | - Software implementation for 32bit division. |
| 927 | |
| 928 | - Enabled use of generic timer for platforms that do not set |
| 929 | ARM_CORTEX_Ax=yes. |
| 930 | |
| 931 | - Support for Armv7-A Virtualization extensions [DDI0406C_C]. |
| 932 | |
| 933 | - Support for both Armv7-A platforms that only have 32-bit addressing and |
| 934 | Armv7-A platforms that support large page addressing. |
| 935 | |
| 936 | - Included support for following Armv7 CPUs: Cortex-A12, Cortex-A17, |
| 937 | Cortex-A7, Cortex-A5, Cortex-A9, Cortex-A15. |
| 938 | |
| 939 | - Added support in QEMU for Armv7-A/Cortex-A15. |
| 940 | |
| 941 | - Enhancements to Firmware Update feature: |
| 942 | |
| 943 | - Updated the FWU documentation to describe the additional images needed for |
| 944 | Firmware update, and how they are used for both the Juno platform and the |
| 945 | Arm FVP platforms. |
| 946 | |
| 947 | - Enhancements to Trusted Board Boot feature: |
| 948 | |
| 949 | - Added support to cert_create tool for RSA PKCS1# v1.5 and SHA384, SHA512 |
| 950 | and SHA256. |
| 951 | |
| 952 | - For Arm platforms added support to use ECDSA keys. |
| 953 | |
| 954 | - Enhanced the mbed TLS wrapper layer to include support for both RSA and |
| 955 | ECDSA to enable runtime selection between RSA and ECDSA keys. |
| 956 | |
| 957 | - Added support for secure interrupt handling in AArch32 sp_min, hardcoded to |
| 958 | only handle FIQs. |
| 959 | |
| 960 | - Added support to allow a platform to load images from multiple boot sources, |
| 961 | for example from a second flash drive. |
| 962 | |
| 963 | - Added a logging framework that allows platforms to reduce the logging level |
| 964 | at runtime and additionally the prefix string can be defined by the platform. |
| 965 | |
| 966 | - Further improvements to register initialisation: |
| 967 | |
| 968 | - Control register PMCR_EL0 / PMCR is set to prohibit cycle counting in the |
| 969 | secure world. This register is added to the list of registers that are |
| 970 | saved and restored during world switch. |
| 971 | |
| 972 | - When EL3 is running in AArch32 execution state, the Non-secure version of |
| 973 | SCTLR is explicitly initialised during the warmboot flow rather than |
| 974 | relying on the hardware to set the correct reset values. |
| 975 | |
| 976 | - Enhanced support for Arm platforms: |
| 977 | |
| 978 | - Introduced driver for Shared-Data-Structure (SDS) framework which is used |
| 979 | for communication between SCP and the AP CPU, replacing Boot-Over_MHU |
| 980 | (BOM) protocol. |
| 981 | |
| 982 | The Juno platform is migrated to use SDS with the SCMI support added in |
| 983 | v1.3 and is set as default. |
| 984 | |
| 985 | The driver can be found in the plat/arm/css/drivers folder. |
| 986 | |
| 987 | - Improved memory usage by only mapping TSP memory region when the TSPD has |
| 988 | been included in the build. This reduces the memory footprint and avoids |
| 989 | unnecessary memory being mapped. |
| 990 | |
| 991 | - Updated support for multi-threading CPUs for FVP platforms - always check |
| 992 | the MT field in MPDIR and access the bit fields accordingly. |
| 993 | |
| 994 | - Support building for platforms that model DynamIQ configuration by |
| 995 | implementing all CPUs in a single cluster. |
| 996 | |
| 997 | - Improved nor flash driver, for instance clearing status registers before |
| 998 | sending commands. Driver can be found plat/arm/board/common folder. |
| 999 | |
| 1000 | - Enhancements to QEMU platform: |
| 1001 | |
| 1002 | - Added support for TBB. |
| 1003 | |
| 1004 | - Added support for using OP-TEE pageable image. |
| 1005 | |
| 1006 | - Added support for LOAD_IMAGE_V2. |
| 1007 | |
| 1008 | - Migrated to use translation table library v2 by default. |
| 1009 | |
| 1010 | - Added support for SEPARATE_CODE_AND_RODATA. |
| 1011 | |
| 1012 | - Applied workarounds CVE-2017-5715 on Arm Cortex-A57, -A72, -A73 and -A75, and |
| 1013 | for Armv7-A CPUs Cortex-A9, -A15 and -A17. |
| 1014 | |
| 1015 | - Applied errata workaround for Arm Cortex-A57: 859972. |
| 1016 | |
| 1017 | - Applied errata workaround for Arm Cortex-A72: 859971. |
| 1018 | |
| 1019 | - Added support for Poplar 96Board platform. |
| 1020 | |
| 1021 | - Added support for Raspberry Pi 3 platform. |
| 1022 | |
| 1023 | - Added Call Frame Information (CFI) assembler directives to the vector entries |
| 1024 | which enables debuggers to display the backtrace of functions that triggered |
| 1025 | a synchronous abort. |
| 1026 | |
| 1027 | - Added ability to build dtb. |
| 1028 | |
| 1029 | - Added support for pre-tool (cert_create and fiptool) image processing |
| 1030 | enabling compression of the image files before processing by cert_create and |
| 1031 | fiptool. |
| 1032 | |
| 1033 | This can reduce fip size and may also speed up loading of images. The image |
| 1034 | verification will also get faster because certificates are generated based on |
| 1035 | compressed images. |
| 1036 | |
| 1037 | Imported zlib 1.2.11 to implement gunzip() for data compression. |
| 1038 | |
| 1039 | - Enhancements to fiptool: |
| 1040 | |
| 1041 | - Enabled the fiptool to be built using Visual Studio. |
| 1042 | |
| 1043 | - Added padding bytes at the end of the last image in the fip to be |
| 1044 | facilitate transfer by DMA. |
| 1045 | |
| 1046 | Issues resolved since last release |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1047 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
David Cunado | b158043 | 2018-03-14 17:57:31 +0000 | [diff] [blame] | 1048 | |
| 1049 | - TF-A can be built with optimisations disabled (-O0). |
| 1050 | |
| 1051 | - Memory layout updated to enable Trusted Board Boot on Juno platform when |
| 1052 | running TF-A in AArch32 execution mode (resolving `tf-issue#501`_). |
| 1053 | |
| 1054 | Known Issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1055 | ^^^^^^^^^^^^ |
David Cunado | b158043 | 2018-03-14 17:57:31 +0000 | [diff] [blame] | 1056 | |
Joanna Farley | 325ef90 | 2018-09-11 15:51:31 +0100 | [diff] [blame] | 1057 | - DTB creation not supported when building on a Windows host. This step in the |
| 1058 | build process is skipped when running on a Windows host. |
David Cunado | b158043 | 2018-03-14 17:57:31 +0000 | [diff] [blame] | 1059 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1060 | Version 1.4 |
| 1061 | ----------- |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1062 | |
| 1063 | New features |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1064 | ^^^^^^^^^^^^ |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1065 | |
| 1066 | - Enabled support for platforms with hardware assisted coherency. |
| 1067 | |
| 1068 | A new build option HW_ASSISTED_COHERENCY allows platforms to take advantage |
| 1069 | of the following optimisations: |
| 1070 | |
| 1071 | - Skip performing cache maintenance during power-up and power-down. |
| 1072 | |
| 1073 | - Use spin-locks instead of bakery locks. |
| 1074 | |
| 1075 | - Enable data caches early on warm-booted CPUs. |
| 1076 | |
| 1077 | - Added support for Cortex-A75 and Cortex-A55 processors. |
| 1078 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1079 | Both Cortex-A75 and Cortex-A55 processors use the Arm DynamIQ Shared Unit |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1080 | (DSU). The power-down and power-up sequences are therefore mostly managed in |
| 1081 | hardware, reducing complexity of the software operations. |
| 1082 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1083 | - Introduced Arm GIC-600 driver. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1084 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1085 | Arm GIC-600 IP complies with Arm GICv3 architecture. For FVP platforms, the |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1086 | GIC-600 driver is chosen when FVP_USE_GIC_DRIVER is set to FVP_GIC600. |
| 1087 | |
| 1088 | - Updated GICv3 support: |
| 1089 | |
| 1090 | - Introduced power management APIs for GICv3 Redistributor. These APIs |
| 1091 | allow platforms to power down the Redistributor during CPU power on/off. |
| 1092 | Requires the GICv3 implementations to have power management operations. |
| 1093 | |
| 1094 | Implemented the power management APIs for FVP. |
| 1095 | |
| 1096 | - GIC driver data is flushed by the primary CPU so that secondary CPU do |
| 1097 | not read stale GIC data. |
| 1098 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1099 | - Added support for Arm System Control and Management Interface v1.0 (SCMI). |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1100 | |
| 1101 | The SCMI driver implements the power domain management and system power |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1102 | management protocol of the SCMI specification (Arm DEN 0056ASCMI) for |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1103 | communicating with any compliant power controller. |
| 1104 | |
| 1105 | Support is added for the Juno platform. The driver can be found in the |
| 1106 | plat/arm/css/drivers folder. |
| 1107 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1108 | - Added support to enable pre-integration of TBB with the Arm TrustZone |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1109 | CryptoCell product, to take advantage of its hardware Root of Trust and |
| 1110 | crypto acceleration services. |
| 1111 | |
| 1112 | - Enabled Statistical Profiling Extensions for lower ELs. |
| 1113 | |
| 1114 | The firmware support is limited to the use of SPE in the Non-secure state |
| 1115 | and accesses to the SPE specific registers from S-EL1 will trap to EL3. |
| 1116 | |
| 1117 | The SPE are architecturally specified for AArch64 only. |
| 1118 | |
| 1119 | - Code hygiene changes aligned with MISRA guidelines: |
| 1120 | |
| 1121 | - Fixed signed / unsigned comparison warnings in the translation table |
| 1122 | library. |
| 1123 | |
| 1124 | - Added U(_x) macro and together with the existing ULL(_x) macro fixed |
| 1125 | some of the signed-ness defects flagged by the MISRA scanner. |
| 1126 | |
| 1127 | - Enhancements to Firmware Update feature: |
| 1128 | |
| 1129 | - The FWU logic now checks for overlapping images to prevent execution of |
Paul Beesley | 1fbc97b | 2019-01-11 18:26:51 +0000 | [diff] [blame] | 1130 | unauthenticated arbitrary code. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1131 | |
| 1132 | - Introduced new FWU_SMC_IMAGE_RESET SMC that changes the image loading |
| 1133 | state machine to go from COPYING, COPIED or AUTHENTICATED states to |
| 1134 | RESET state. Previously, this was only possible when the authentication |
| 1135 | of an image failed or when the execution of the image finished. |
| 1136 | |
| 1137 | - Fixed integer overflow which addressed TFV-1: Malformed Firmware Update |
| 1138 | SMC can result in copy of unexpectedly large data into secure memory. |
| 1139 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1140 | - Introduced support for Arm Compiler 6 and LLVM (clang). |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1141 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1142 | TF-A can now also be built with the Arm Compiler 6 or the clang compilers. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1143 | The assembler and linker must be provided by the GNU toolchain. |
| 1144 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1145 | Tested with Arm CC 6.7 and clang 3.9.x and 4.0.x. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1146 | |
| 1147 | - Memory footprint improvements: |
| 1148 | |
| 1149 | - Introduced `tf_snprintf`, a reduced version of `snprintf` which has |
| 1150 | support for a limited set of formats. |
| 1151 | |
| 1152 | The mbedtls driver is updated to optionally use `tf_snprintf` instead of |
| 1153 | `snprintf`. |
| 1154 | |
| 1155 | - The `assert()` is updated to no longer print the function name, and |
| 1156 | additional logging options are supported via an optional platform define |
| 1157 | `PLAT_LOG_LEVEL_ASSERT`, which controls how verbose the assert output is. |
| 1158 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1159 | - Enhancements to TF-A support when running in AArch32 execution state: |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1160 | |
| 1161 | - Support booting SP_MIN and BL33 in AArch32 execution mode on Juno. Due to |
| 1162 | hardware limitations, BL1 and BL2 boot in AArch64 state and there is |
| 1163 | additional trampoline code to warm reset into SP_MIN in AArch32 execution |
| 1164 | state. |
| 1165 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1166 | - Added support for Arm Cortex-A53/57/72 MPCore processors including the |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1167 | errata workarounds that are already implemented for AArch64 execution |
| 1168 | state. |
| 1169 | |
| 1170 | - For FVP platforms, added AArch32 Trusted Board Boot support, including the |
| 1171 | Firmware Update feature. |
| 1172 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1173 | - Introduced Arm SiP service for use by Arm standard platforms. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1174 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1175 | - Added new Arm SiP Service SMCs to enable the Non-secure world to read PMF |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1176 | timestamps. |
| 1177 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1178 | Added PMF instrumentation points in TF-A in order to quantify the |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1179 | overall time spent in the PSCI software implementation. |
| 1180 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1181 | - Added new Arm SiP service SMC to switch execution state. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1182 | |
| 1183 | This allows the lower exception level to change its execution state from |
| 1184 | AArch64 to AArch32, or vice verse, via a request to EL3. |
| 1185 | |
| 1186 | - Migrated to use SPDX[0] license identifiers to make software license |
| 1187 | auditing simpler. |
| 1188 | |
| 1189 | *NOTE:* Files that have been imported by FreeBSD have not been modified. |
| 1190 | |
| 1191 | [0]: https://spdx.org/ |
| 1192 | |
| 1193 | - Enhancements to the translation table library: |
| 1194 | |
| 1195 | - Added version 2 of translation table library that allows different |
| 1196 | translation tables to be modified by using different 'contexts'. Version 1 |
David Cunado | b158043 | 2018-03-14 17:57:31 +0000 | [diff] [blame] | 1197 | of the translation table library only allows the current EL's translation |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1198 | tables to be modified. |
| 1199 | |
| 1200 | Version 2 of the translation table also added support for dynamic |
| 1201 | regions; regions that can be added and removed dynamically whilst the |
| 1202 | MMU is enabled. Static regions can only be added or removed before the |
| 1203 | MMU is enabled. |
| 1204 | |
| 1205 | The dynamic mapping functionality is enabled or disabled when compiling |
| 1206 | by setting the build option PLAT_XLAT_TABLES_DYNAMIC to 1 or 0. This can |
| 1207 | be done per-image. |
| 1208 | |
| 1209 | - Added support for translation regimes with two virtual address spaces |
| 1210 | such as the one shared by EL1 and EL0. |
| 1211 | |
| 1212 | The library does not support initializing translation tables for EL0 |
| 1213 | software. |
| 1214 | |
| 1215 | - Added support to mark the translation tables as non-cacheable using an |
| 1216 | additional build option `XLAT_TABLE_NC`. |
| 1217 | |
| 1218 | - Added support for GCC stack protection. A new build option |
| 1219 | ENABLE_STACK_PROTECTOR was introduced that enables compilation of all BL |
| 1220 | images with one of the GCC -fstack-protector-* options. |
| 1221 | |
| 1222 | A new platform function plat_get_stack_protector_canary() was introduced |
| 1223 | that returns a value used to initialize the canary for stack corruption |
| 1224 | detection. For increased effectiveness of protection platforms must provide |
| 1225 | an implementation that returns a random value. |
| 1226 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1227 | - Enhanced support for Arm platforms: |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1228 | |
| 1229 | - Added support for multi-threading CPUs, indicated by `MT` field in MPDIR. |
| 1230 | A new build flag `ARM_PLAT_MT` is added, and when enabled, the functions |
| 1231 | accessing MPIDR assume that the `MT` bit is set for the platform and |
| 1232 | access the bit fields accordingly. |
| 1233 | |
| 1234 | Also, a new API `plat_arm_get_cpu_pe_count` is added when `ARM_PLAT_MT` is |
| 1235 | enabled, returning the Processing Element count within the physical CPU |
| 1236 | corresponding to `mpidr`. |
| 1237 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1238 | - The Arm platforms migrated to use version 2 of the translation tables. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1239 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1240 | - Introduced a new Arm platform layer API `plat_arm_psci_override_pm_ops` |
| 1241 | which allows Arm platforms to modify `plat_arm_psci_pm_ops` and therefore |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1242 | dynamically define PSCI capability. |
| 1243 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1244 | - The Arm platforms migrated to use IMAGE_LOAD_V2 by default. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1245 | |
| 1246 | - Enhanced reporting of errata workaround status with the following policy: |
| 1247 | |
| 1248 | - If an errata workaround is enabled: |
| 1249 | |
| 1250 | - If it applies (i.e. the CPU is affected by the errata), an INFO message |
| 1251 | is printed, confirming that the errata workaround has been applied. |
| 1252 | |
| 1253 | - If it does not apply, a VERBOSE message is printed, confirming that the |
| 1254 | errata workaround has been skipped. |
| 1255 | |
| 1256 | - If an errata workaround is not enabled, but would have applied had it |
| 1257 | been, a WARN message is printed, alerting that errata workaround is |
| 1258 | missing. |
| 1259 | |
| 1260 | - Added build options ARM_ARCH_MAJOR and ARM_ARM_MINOR to choose the |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1261 | architecture version to target TF-A. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1262 | |
| 1263 | - Updated the spin lock implementation to use the more efficient CAS (Compare |
| 1264 | And Swap) instruction when available. This instruction was introduced in |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1265 | Armv8.1-A. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1266 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1267 | - Applied errata workaround for Arm Cortex-A53: 855873. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1268 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1269 | - Applied errata workaround for Arm-Cortex-A57: 813419. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1270 | |
| 1271 | - Enabled all A53 and A57 errata workarounds for Juno, both in AArch64 and |
| 1272 | AArch32 execution states. |
| 1273 | |
| 1274 | - Added support for Socionext UniPhier SoC platform. |
| 1275 | |
| 1276 | - Added support for Hikey960 and Hikey platforms. |
| 1277 | |
| 1278 | - Added support for Rockchip RK3328 platform. |
| 1279 | |
| 1280 | - Added support for NVidia Tegra T186 platform. |
| 1281 | |
| 1282 | - Added support for Designware emmc driver. |
| 1283 | |
| 1284 | - Imported libfdt v1.4.2 that addresses buffer overflow in fdt_offset_ptr(). |
| 1285 | |
| 1286 | - Enhanced the CPU operations framework to allow power handlers to be |
| 1287 | registered on per-level basis. This enables support for future CPUs that |
| 1288 | have multiple threads which might need powering down individually. |
| 1289 | |
| 1290 | - Updated register initialisation to prevent unexpected behaviour: |
| 1291 | |
| 1292 | - Debug registers MDCR-EL3/SDCR and MDCR_EL2/HDCR are initialised to avoid |
| 1293 | unexpected traps into the higher exception levels and disable secure |
| 1294 | self-hosted debug. Additionally, secure privileged external debug on |
| 1295 | Juno is disabled by programming the appropriate Juno SoC registers. |
| 1296 | |
| 1297 | - EL2 and EL3 configurable controls are initialised to avoid unexpected |
| 1298 | traps in the higher exception levels. |
| 1299 | |
| 1300 | - Essential control registers are fully initialised on EL3 start-up, when |
| 1301 | initialising the non-secure and secure context structures and when |
Paul Beesley | 1fbc97b | 2019-01-11 18:26:51 +0000 | [diff] [blame] | 1302 | preparing to leave EL3 for a lower EL. This gives better alignment with |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1303 | the Arm ARM which states that software must initialise RES0 and RES1 |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1304 | fields with 0 / 1. |
| 1305 | |
| 1306 | - Enhanced PSCI support: |
| 1307 | |
| 1308 | - Introduced new platform interfaces that decouple PSCI stat residency |
| 1309 | calculation from PMF, enabling platforms to use alternative methods of |
| 1310 | capturing timestamps. |
| 1311 | |
| 1312 | - PSCI stat accounting performed for retention/standby states when |
| 1313 | requested at multiple power levels. |
| 1314 | |
| 1315 | - Simplified fiptool to have a single linked list of image descriptors. |
| 1316 | |
| 1317 | - For the TSP, resolved corruption of pre-empted secure context by aborting any |
| 1318 | pre-empted SMC during PSCI power management requests. |
| 1319 | |
| 1320 | Issues resolved since last release |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1321 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1322 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1323 | - TF-A can be built with the latest mbed TLS version (v2.4.2). The earlier |
| 1324 | version 2.3.0 cannot be used due to build warnings that the TF-A build |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1325 | system interprets as errors. |
| 1326 | |
| 1327 | - TBBR, including the Firmware Update feature is now supported on FVP |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1328 | platforms when running TF-A in AArch32 state. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1329 | |
| 1330 | - The version of the AEMv8 Base FVP used in this release has resolved the issue |
| 1331 | of the model executing a reset instead of terminating in response to a |
| 1332 | shutdown request using the PSCI SYSTEM_OFF API. |
| 1333 | |
| 1334 | Known Issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1335 | ^^^^^^^^^^^^ |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1336 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1337 | - Building TF-A with compiler optimisations disabled (-O0) fails. |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1338 | |
| 1339 | - Trusted Board Boot currently does not work on Juno when running Trusted |
| 1340 | Firmware in AArch32 execution state due to error when loading the sp_min to |
David Cunado | b158043 | 2018-03-14 17:57:31 +0000 | [diff] [blame] | 1341 | memory because of lack of free space available. See `tf-issue#501`_ for more |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 1342 | details. |
| 1343 | |
| 1344 | - The errata workaround for A53 errata 843419 is only available from binutils |
| 1345 | 2.26 and is not present in GCC4.9. If this errata is applicable to the |
| 1346 | platform, please use GCC compiler version of at least 5.0. See `PR#1002`_ for |
| 1347 | more details. |
| 1348 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1349 | Version 1.3 |
| 1350 | ----------- |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1351 | |
Douglas Raillard | 30d7b36 | 2017-06-28 16:14:55 +0100 | [diff] [blame] | 1352 | |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1353 | New features |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1354 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1355 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1356 | - Added support for running TF-A in AArch32 execution state. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1357 | |
| 1358 | The PSCI library has been refactored to allow integration with **EL3 Runtime |
| 1359 | Software**. This is software that is executing at the highest secure |
| 1360 | privilege which is EL3 in AArch64 or Secure SVC/Monitor mode in AArch32. See |
| 1361 | `PSCI Integration Guide`_. |
| 1362 | |
| 1363 | Included is a minimal AArch32 Secure Payload, **SP-MIN**, that illustrates |
| 1364 | the usage and integration of the PSCI library with EL3 Runtime Software |
| 1365 | running in AArch32 state. |
| 1366 | |
| 1367 | Booting to the BL1/BL2 images as well as booting straight to the Secure |
| 1368 | Payload is supported. |
| 1369 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1370 | - Improvements to the initialization framework for the PSCI service and Arm |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1371 | Standard Services in general. |
| 1372 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1373 | The PSCI service is now initialized as part of Arm Standard Service |
| 1374 | initialization. This consolidates the initializations of any Arm Standard |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1375 | Service that may be added in the future. |
| 1376 | |
| 1377 | A new function ``get_arm_std_svc_args()`` is introduced to get arguments |
| 1378 | corresponding to each standard service and must be implemented by the EL3 |
| 1379 | Runtime Software. |
| 1380 | |
| 1381 | For PSCI, a new versioned structure ``psci_lib_args_t`` is introduced to |
| 1382 | initialize the PSCI Library. **Note** this is a compatibility break due to |
| 1383 | the change in the prototype of ``psci_setup()``. |
| 1384 | |
| 1385 | - To support AArch32 builds of BL1 and BL2, implemented a new, alternative |
| 1386 | firmware image loading mechanism that adds flexibility. |
| 1387 | |
| 1388 | The current mechanism has a hard-coded set of images and execution order |
| 1389 | (BL31, BL32, etc). The new mechanism is data-driven by a list of image |
| 1390 | descriptors provided by the platform code. |
| 1391 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1392 | Arm platforms have been updated to support the new loading mechanism. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1393 | |
| 1394 | The new mechanism is enabled by a build flag (``LOAD_IMAGE_V2``) which is |
| 1395 | currently off by default for the AArch64 build. |
| 1396 | |
| 1397 | **Note** ``TRUSTED_BOARD_BOOT`` is currently not supported when |
| 1398 | ``LOAD_IMAGE_V2`` is enabled. |
| 1399 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1400 | - Updated requirements for making contributions to TF-A. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1401 | |
| 1402 | Commits now must have a 'Signed-off-by:' field to certify that the |
| 1403 | contribution has been made under the terms of the |
| 1404 | `Developer Certificate of Origin`_. |
| 1405 | |
| 1406 | A signed CLA is no longer required. |
| 1407 | |
| 1408 | The `Contribution Guide`_ has been updated to reflect this change. |
| 1409 | |
| 1410 | - Introduced Performance Measurement Framework (PMF) which provides support |
| 1411 | for capturing, storing, dumping and retrieving time-stamps to measure the |
| 1412 | execution time of critical paths in the firmware. This relies on defining |
| 1413 | fixed sample points at key places in the code. |
| 1414 | |
| 1415 | - To support the QEMU platform port, imported libfdt v1.4.1 from |
Paul Beesley | 2437ddc | 2019-02-08 16:43:05 +0000 | [diff] [blame] | 1416 | https://git.kernel.org/pub/scm/utils/dtc/dtc.git |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1417 | |
| 1418 | - Updated PSCI support: |
| 1419 | |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 1420 | - Added support for PSCI NODE_HW_STATE API for Arm platforms. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1421 | |
| 1422 | - New optional platform hook, ``pwr_domain_pwr_down_wfi()``, in |
| 1423 | ``plat_psci_ops`` to enable platforms to perform platform-specific actions |
| 1424 | needed to enter powerdown, including the 'wfi' invocation. |
| 1425 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1426 | - PSCI STAT residency and count functions have been added on Arm platforms |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1427 | by using PMF. |
| 1428 | |
| 1429 | - Enhancements to the translation table library: |
| 1430 | |
| 1431 | - Limited memory mapping support for region overlaps to only allow regions |
| 1432 | to overlap that are identity mapped or have the same virtual to physical |
| 1433 | address offset, and overlap completely but must not cover the same area. |
| 1434 | |
| 1435 | This limitation will enable future enhancements without having to |
| 1436 | support complex edge cases that may not be necessary. |
| 1437 | |
| 1438 | - The initial translation lookup level is now inferred from the virtual |
| 1439 | address space size. Previously, it was hard-coded. |
| 1440 | |
| 1441 | - Added support for mapping Normal, Inner Non-cacheable, Outer |
| 1442 | Non-cacheable memory in the translation table library. |
| 1443 | |
| 1444 | This can be useful to map a non-cacheable memory region, such as a DMA |
| 1445 | buffer. |
| 1446 | |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 1447 | - Introduced the MT_EXECUTE/MT_EXECUTE_NEVER memory mapping attributes to |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1448 | specify the access permissions for instruction execution of a memory |
| 1449 | region. |
| 1450 | |
| 1451 | - Enabled support to isolate code and read-only data on separate memory pages, |
| 1452 | allowing independent access control to be applied to each. |
| 1453 | |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 1454 | - Enabled SCR_EL3.SIF (Secure Instruction Fetch) bit in BL1 and BL31 common |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1455 | architectural setup code, preventing fetching instructions from non-secure |
| 1456 | memory when in secure state. |
| 1457 | |
| 1458 | - Enhancements to FIP support: |
| 1459 | |
| 1460 | - Replaced ``fip_create`` with ``fiptool`` which provides a more consistent |
| 1461 | and intuitive interface as well as additional support to remove an image |
| 1462 | from a FIP file. |
| 1463 | |
| 1464 | - Enabled printing the SHA256 digest with info command, allowing quick |
| 1465 | verification of an image within a FIP without having to extract the |
| 1466 | image and running sha256sum on it. |
| 1467 | |
| 1468 | - Added support for unpacking the contents of an existing FIP file into |
| 1469 | the working directory. |
| 1470 | |
| 1471 | - Aligned command line options for specifying images to use same naming |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 1472 | convention as specified by TBBR and already used in cert_create tool. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1473 | |
| 1474 | - Refactored the TZC-400 driver to also support memory controllers that |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1475 | integrate TZC functionality, for example Arm CoreLink DMC-500. Also added |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1476 | DMC-500 specific support. |
| 1477 | |
| 1478 | - Implemented generic delay timer based on the system generic counter and |
| 1479 | migrated all platforms to use it. |
| 1480 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1481 | - Enhanced support for Arm platforms: |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1482 | |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 1483 | - Updated image loading support to make SCP images (SCP_BL2 and SCP_BL2U) |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1484 | optional. |
| 1485 | |
| 1486 | - Enhanced topology description support to allow multi-cluster topology |
| 1487 | definitions. |
| 1488 | |
| 1489 | - Added interconnect abstraction layer to help platform ports select the |
| 1490 | right interconnect driver, CCI or CCN, for the platform. |
| 1491 | |
| 1492 | - Added support to allow loading BL31 in the TZC-secured DRAM instead of |
| 1493 | the default secure SRAM. |
| 1494 | |
| 1495 | - Added support to use a System Security Control (SSC) Registers Unit |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1496 | enabling TF-A to be compiled to support multiple Arm platforms and |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1497 | then select one at runtime. |
| 1498 | |
| 1499 | - Restricted mapping of Trusted ROM in BL1 to what is actually needed by |
| 1500 | BL1 rather than entire Trusted ROM region. |
| 1501 | |
| 1502 | - Flash is now mapped as execute-never by default. This increases security |
| 1503 | by restricting the executable region to what is strictly needed. |
| 1504 | |
| 1505 | - Applied following erratum workarounds for Cortex-A57: 833471, 826977, |
| 1506 | 829520, 828024 and 826974. |
| 1507 | |
| 1508 | - Added support for Mediatek MT6795 platform. |
| 1509 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1510 | - Added support for QEMU virtualization Armv8-A target. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1511 | |
| 1512 | - Added support for Rockchip RK3368 and RK3399 platforms. |
| 1513 | |
| 1514 | - Added support for Xilinx Zynq UltraScale+ MPSoC platform. |
| 1515 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1516 | - Added support for Arm Cortex-A73 MPCore Processor. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1517 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1518 | - Added support for Arm Cortex-A72 processor. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1519 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1520 | - Added support for Arm Cortex-A35 processor. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1521 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1522 | - Added support for Arm Cortex-A32 MPCore Processor. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1523 | |
| 1524 | - Enabled preloaded BL33 alternative boot flow, in which BL2 does not load |
| 1525 | BL33 from non-volatile storage and BL31 hands execution over to a preloaded |
| 1526 | BL33. The User Guide has been updated with an example of how to use this |
| 1527 | option with a bootwrapped kernel. |
| 1528 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1529 | - Added support to build TF-A on a Windows-based host machine. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1530 | |
| 1531 | - Updated Trusted Board Boot prototype implementation: |
| 1532 | |
| 1533 | - Enabled the ability for a production ROM with TBBR enabled to boot test |
| 1534 | software before a real ROTPK is deployed (e.g. manufacturing mode). |
| 1535 | Added support to use ROTPK in certificate without verifying against the |
| 1536 | platform value when ``ROTPK_NOT_DEPLOYED`` bit is set. |
| 1537 | |
| 1538 | - Added support for non-volatile counter authentication to the |
| 1539 | Authentication Module to protect against roll-back. |
| 1540 | |
| 1541 | - Updated GICv3 support: |
| 1542 | |
| 1543 | - Enabled processor power-down and automatic power-on using GICv3. |
| 1544 | |
| 1545 | - Enabled G1S or G0 interrupts to be configured independently. |
| 1546 | |
| 1547 | - Changed FVP default interrupt driver to be the GICv3-only driver. |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1548 | **Note** the default build of TF-A will not be able to boot |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1549 | Linux kernel with GICv2 FDT blob. |
| 1550 | |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 1551 | - Enabled wake-up from CPU_SUSPEND to stand-by by temporarily re-routing |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1552 | interrupts and then restoring after resume. |
| 1553 | |
| 1554 | Issues resolved since last release |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1555 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1556 | |
| 1557 | Known issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1558 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1559 | |
| 1560 | - The version of the AEMv8 Base FVP used in this release resets the model |
| 1561 | instead of terminating its execution in response to a shutdown request using |
| 1562 | the PSCI ``SYSTEM_OFF`` API. This issue will be fixed in a future version of |
| 1563 | the model. |
| 1564 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1565 | - Building TF-A with compiler optimisations disabled (``-O0``) fails. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1566 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1567 | - TF-A cannot be built with mbed TLS version v2.3.0 due to build warnings |
| 1568 | that the TF-A build system interprets as errors. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1569 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1570 | - TBBR is not currently supported when running TF-A in AArch32 state. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1571 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1572 | Version 1.2 |
| 1573 | ----------- |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1574 | |
| 1575 | New features |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1576 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1577 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1578 | - The Trusted Board Boot implementation on Arm platforms now conforms to the |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1579 | mandatory requirements of the TBBR specification. |
| 1580 | |
| 1581 | In particular, the boot process is now guarded by a Trusted Watchdog, which |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1582 | will reset the system in case of an authentication or loading error. On Arm |
| 1583 | platforms, a secure instance of Arm SP805 is used as the Trusted Watchdog. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1584 | |
| 1585 | Also, a firmware update process has been implemented. It enables |
| 1586 | authenticated firmware to update firmware images from external interfaces to |
| 1587 | SoC Non-Volatile memories. This feature functions even when the current |
| 1588 | firmware in the system is corrupt or missing; it therefore may be used as |
| 1589 | a recovery mode. |
| 1590 | |
| 1591 | - Improvements have been made to the Certificate Generation Tool |
| 1592 | (``cert_create``) as follows. |
| 1593 | |
| 1594 | - Added support for the Firmware Update process by extending the Chain |
| 1595 | of Trust definition in the tool to include the Firmware Update |
| 1596 | certificate and the required extensions. |
| 1597 | |
| 1598 | - Introduced a new API that allows one to specify command line options in |
| 1599 | the Chain of Trust description. This makes the declaration of the tool's |
| 1600 | arguments more flexible and easier to extend. |
| 1601 | |
| 1602 | - The tool has been reworked to follow a data driven approach, which |
| 1603 | makes it easier to maintain and extend. |
| 1604 | |
| 1605 | - Extended the FIP tool (``fip_create``) to support the new set of images |
| 1606 | involved in the Firmware Update process. |
| 1607 | |
| 1608 | - Various memory footprint improvements. In particular: |
| 1609 | |
| 1610 | - The bakery lock structure for coherent memory has been optimised. |
| 1611 | |
| 1612 | - The mbed TLS SHA1 functions are not needed, as SHA256 is used to |
| 1613 | generate the certificate signature. Therefore, they have been compiled |
| 1614 | out, reducing the memory footprint of BL1 and BL2 by approximately |
| 1615 | 6 KB. |
| 1616 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1617 | - On Arm development platforms, each BL stage now individually defines |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1618 | the number of regions that it needs to map in the MMU. |
| 1619 | |
| 1620 | - Added the following new design documents: |
| 1621 | |
| 1622 | - `Authentication framework`_ |
| 1623 | - `Firmware Update`_ |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1624 | - `TF-A Reset Design`_ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1625 | - `Power Domain Topology Design`_ |
| 1626 | |
| 1627 | - Applied the new image terminology to the code base and documentation, as |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1628 | described on the `TF-A wiki on GitHub`_. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1629 | |
| 1630 | - The build system has been reworked to improve readability and facilitate |
| 1631 | adding future extensions. |
| 1632 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1633 | - On Arm standard platforms, BL31 uses the boot console during cold boot |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1634 | but switches to the runtime console for any later logs at runtime. The TSP |
| 1635 | uses the runtime console for all output. |
| 1636 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1637 | - Implemented a basic NOR flash driver for Arm platforms. It programs the |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1638 | device using CFI (Common Flash Interface) standard commands. |
| 1639 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1640 | - Implemented support for booting EL3 payloads on Arm platforms, which |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1641 | reduces the complexity of developing EL3 baremetal code by doing essential |
| 1642 | baremetal initialization. |
| 1643 | |
| 1644 | - Provided separate drivers for GICv3 and GICv2. These expect the entire |
| 1645 | software stack to use either GICv2 or GICv3; hybrid GIC software systems |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1646 | are no longer supported and the legacy Arm GIC driver has been deprecated. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1647 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1648 | - Added support for Juno r1 and r2. A single set of Juno TF-A binaries can run |
| 1649 | on Juno r0, r1 and r2 boards. Note that this TF-A version depends on a Linaro |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1650 | release that does *not* contain Juno r2 support. |
| 1651 | |
| 1652 | - Added support for MediaTek mt8173 platform. |
| 1653 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1654 | - Implemented a generic driver for Arm CCN IP. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1655 | |
| 1656 | - Major rework of the PSCI implementation. |
| 1657 | |
| 1658 | - Added framework to handle composite power states. |
| 1659 | |
| 1660 | - Decoupled the notions of affinity instances (which describes the |
| 1661 | hierarchical arrangement of cores) and of power domain topology, instead |
| 1662 | of assuming a one-to-one mapping. |
| 1663 | |
| 1664 | - Better alignment with version 1.0 of the PSCI specification. |
| 1665 | |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 1666 | - Added support for the SYSTEM_SUSPEND PSCI API on Arm platforms. When invoked |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1667 | on the last running core on a supported platform, this puts the system |
| 1668 | into a low power mode with memory retention. |
| 1669 | |
| 1670 | - Unified the reset handling code as much as possible across BL stages. |
| 1671 | Also introduced some build options to enable optimization of the reset path |
| 1672 | on platforms that support it. |
| 1673 | |
| 1674 | - Added a simple delay timer API, as well as an SP804 timer driver, which is |
| 1675 | enabled on FVP. |
| 1676 | |
| 1677 | - Added support for NVidia Tegra T210 and T132 SoCs. |
| 1678 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1679 | - Reorganised Arm platforms ports to greatly improve code shareability and |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1680 | facilitate the reuse of some of this code by other platforms. |
| 1681 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1682 | - Added support for Arm Cortex-A72 processor in the CPU specific framework. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1683 | |
| 1684 | - Provided better error handling. Platform ports can now define their own |
| 1685 | error handling, for example to perform platform specific bookkeeping or |
| 1686 | post-error actions. |
| 1687 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1688 | - Implemented a unified driver for Arm Cache Coherent Interconnects used for |
| 1689 | both CCI-400 & CCI-500 IPs. Arm platforms ports have been migrated to this |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1690 | common driver. The standalone CCI-400 driver has been deprecated. |
| 1691 | |
| 1692 | Issues resolved since last release |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1693 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1694 | |
| 1695 | - The Trusted Board Boot implementation has been redesigned to provide greater |
| 1696 | modularity and scalability. See the `Authentication Framework`_ document. |
| 1697 | All missing mandatory features are now implemented. |
| 1698 | |
| 1699 | - The FVP and Juno ports may now use the hash of the ROTPK stored in the |
| 1700 | Trusted Key Storage registers to verify the ROTPK. Alternatively, a |
| 1701 | development public key hash embedded in the BL1 and BL2 binaries might be |
| 1702 | used instead. The location of the ROTPK is chosen at build-time using the |
| 1703 | ``ARM_ROTPK_LOCATION`` build option. |
| 1704 | |
| 1705 | - GICv3 is now fully supported and stable. |
| 1706 | |
| 1707 | Known issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1708 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1709 | |
| 1710 | - The version of the AEMv8 Base FVP used in this release resets the model |
| 1711 | instead of terminating its execution in response to a shutdown request using |
| 1712 | the PSCI ``SYSTEM_OFF`` API. This issue will be fixed in a future version of |
| 1713 | the model. |
| 1714 | |
| 1715 | - While this version has low on-chip RAM requirements, there are further |
| 1716 | RAM usage enhancements that could be made. |
| 1717 | |
| 1718 | - The upstream documentation could be improved for structural consistency, |
| 1719 | clarity and completeness. In particular, the design documentation is |
| 1720 | incomplete for PSCI, the TSP(D) and the Juno platform. |
| 1721 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1722 | - Building TF-A with compiler optimisations disabled (``-O0``) fails. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1723 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1724 | Version 1.1 |
| 1725 | ----------- |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1726 | |
| 1727 | New features |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1728 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1729 | |
| 1730 | - A prototype implementation of Trusted Board Boot has been added. Boot |
| 1731 | loader images are verified by BL1 and BL2 during the cold boot path. BL1 and |
| 1732 | BL2 use the PolarSSL SSL library to verify certificates and images. The |
| 1733 | OpenSSL library is used to create the X.509 certificates. Support has been |
| 1734 | added to ``fip_create`` tool to package the certificates in a FIP. |
| 1735 | |
| 1736 | - Support for calling CPU and platform specific reset handlers upon entry into |
| 1737 | BL3-1 during the cold and warm boot paths has been added. This happens after |
| 1738 | another Boot ROM ``reset_handler()`` has already run. This enables a developer |
| 1739 | to perform additional actions or undo actions already performed during the |
| 1740 | first call of the reset handlers e.g. apply additional errata workarounds. |
| 1741 | |
| 1742 | - Support has been added to demonstrate routing of IRQs to EL3 instead of |
| 1743 | S-EL1 when execution is in secure world. |
| 1744 | |
| 1745 | - The PSCI implementation now conforms to version 1.0 of the PSCI |
| 1746 | specification. All the mandatory APIs and selected optional APIs are |
| 1747 | supported. In particular, support for the ``PSCI_FEATURES`` API has been |
| 1748 | added. A capability variable is constructed during initialization by |
| 1749 | examining the ``plat_pm_ops`` and ``spd_pm_ops`` exported by the platform and |
| 1750 | the Secure Payload Dispatcher. This is used by the PSCI FEATURES function |
| 1751 | to determine which PSCI APIs are supported by the platform. |
| 1752 | |
| 1753 | - Improvements have been made to the PSCI code as follows. |
| 1754 | |
| 1755 | - The code has been refactored to remove redundant parameters from |
| 1756 | internal functions. |
| 1757 | |
| 1758 | - Changes have been made to the code for PSCI ``CPU_SUSPEND``, ``CPU_ON`` and |
| 1759 | ``CPU_OFF`` calls to facilitate an early return to the caller in case a |
| 1760 | failure condition is detected. For example, a PSCI ``CPU_SUSPEND`` call |
| 1761 | returns ``SUCCESS`` to the caller if a pending interrupt is detected early |
| 1762 | in the code path. |
| 1763 | |
| 1764 | - Optional platform APIs have been added to validate the ``power_state`` and |
| 1765 | ``entrypoint`` parameters early in PSCI ``CPU_ON`` and ``CPU_SUSPEND`` code |
| 1766 | paths. |
| 1767 | |
| 1768 | - PSCI migrate APIs have been reworked to invoke the SPD hook to determine |
| 1769 | the type of Trusted OS and the CPU it is resident on (if |
| 1770 | applicable). Also, during a PSCI ``MIGRATE`` call, the SPD hook to migrate |
| 1771 | the Trusted OS is invoked. |
| 1772 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1773 | - It is now possible to build TF-A without marking at least an extra page of |
| 1774 | memory as coherent. The build flag ``USE_COHERENT_MEM`` can be used to |
| 1775 | choose between the two implementations. This has been made possible through |
| 1776 | these changes. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1777 | |
| 1778 | - An implementation of Bakery locks, where the locks are not allocated in |
| 1779 | coherent memory has been added. |
| 1780 | |
| 1781 | - Memory which was previously marked as coherent is now kept coherent |
| 1782 | through the use of software cache maintenance operations. |
| 1783 | |
| 1784 | Approximately, 4K worth of memory is saved for each boot loader stage when |
| 1785 | ``USE_COHERENT_MEM=0``. Enabling this option increases the latencies |
| 1786 | associated with acquire and release of locks. It also requires changes to |
| 1787 | the platform ports. |
| 1788 | |
| 1789 | - It is now possible to specify the name of the FIP at build time by defining |
| 1790 | the ``FIP_NAME`` variable. |
| 1791 | |
Paul Beesley | 1fbc97b | 2019-01-11 18:26:51 +0000 | [diff] [blame] | 1792 | - Issues with dependencies on the 'fiptool' makefile target have been |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1793 | rectified. The ``fip_create`` tool is now rebuilt whenever its source files |
| 1794 | change. |
| 1795 | |
| 1796 | - The BL3-1 runtime console is now also used as the crash console. The crash |
| 1797 | console is changed to SoC UART0 (UART2) from the previous FPGA UART0 (UART0) |
| 1798 | on Juno. In FVP, it is changed from UART0 to UART1. |
| 1799 | |
| 1800 | - CPU errata workarounds are applied only when the revision and part number |
| 1801 | match. This behaviour has been made consistent across the debug and release |
| 1802 | builds. The debug build additionally prints a warning if a mismatch is |
| 1803 | detected. |
| 1804 | |
| 1805 | - It is now possible to issue cache maintenance operations by set/way for a |
| 1806 | particular level of data cache. Levels 1-3 are currently supported. |
| 1807 | |
| 1808 | - The following improvements have been made to the FVP port. |
| 1809 | |
| 1810 | - The build option ``FVP_SHARED_DATA_LOCATION`` which allowed relocation of |
| 1811 | shared data into the Trusted DRAM has been deprecated. Shared data is |
| 1812 | now always located at the base of Trusted SRAM. |
| 1813 | |
| 1814 | - BL2 Translation tables have been updated to map only the region of |
| 1815 | DRAM which is accessible to normal world. This is the region of the 2GB |
| 1816 | DDR-DRAM memory at 0x80000000 excluding the top 16MB. The top 16MB is |
| 1817 | accessible to only the secure world. |
| 1818 | |
| 1819 | - BL3-2 can now reside in the top 16MB of DRAM which is accessible only to |
| 1820 | the secure world. This can be done by setting the build flag |
| 1821 | ``FVP_TSP_RAM_LOCATION`` to the value ``dram``. |
| 1822 | |
Paul Beesley | 1fbc97b | 2019-01-11 18:26:51 +0000 | [diff] [blame] | 1823 | - Separate translation tables are created for each boot loader image. The |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1824 | ``IMAGE_BLx`` build options are used to do this. This allows each stage to |
| 1825 | create mappings only for areas in the memory map that it needs. |
| 1826 | |
| 1827 | - A Secure Payload Dispatcher (OPTEED) for the OP-TEE Trusted OS has been |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1828 | added. Details of using it with TF-A can be found in `OP-TEE Dispatcher`_ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1829 | |
| 1830 | Issues resolved since last release |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1831 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1832 | |
| 1833 | - The Juno port has been aligned with the FVP port as follows. |
| 1834 | |
| 1835 | - Support for reclaiming all BL1 RW memory and BL2 memory by overlaying |
| 1836 | the BL3-1/BL3-2 NOBITS sections on top of them has been added to the |
| 1837 | Juno port. |
| 1838 | |
| 1839 | - The top 16MB of the 2GB DDR-DRAM memory at 0x80000000 is configured |
| 1840 | using the TZC-400 controller to be accessible only to the secure world. |
| 1841 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1842 | - The Arm GIC driver is used to configure the GIC-400 instead of using a |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1843 | GIC driver private to the Juno port. |
| 1844 | |
| 1845 | - PSCI ``CPU_SUSPEND`` calls that target a standby state are now supported. |
| 1846 | |
| 1847 | - The TZC-400 driver is used to configure the controller instead of direct |
| 1848 | accesses to the registers. |
| 1849 | |
| 1850 | - The Linux kernel version referred to in the user guide has DVFS and HMP |
| 1851 | support enabled. |
| 1852 | |
| 1853 | - DS-5 v5.19 did not detect Version 5.8 of the Cortex-A57-A53 Base FVPs in |
| 1854 | CADI server mode. This issue is not seen with DS-5 v5.20 and Version 6.2 of |
| 1855 | the Cortex-A57-A53 Base FVPs. |
| 1856 | |
| 1857 | Known issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1858 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1859 | |
| 1860 | - The Trusted Board Boot implementation is a prototype. There are issues with |
| 1861 | the modularity and scalability of the design. Support for a Trusted |
| 1862 | Watchdog, firmware update mechanism, recovery images and Trusted debug is |
| 1863 | absent. These issues will be addressed in future releases. |
| 1864 | |
| 1865 | - The FVP and Juno ports do not use the hash of the ROTPK stored in the |
| 1866 | Trusted Key Storage registers to verify the ROTPK in the |
| 1867 | ``plat_match_rotpk()`` function. This prevents the correct establishment of |
| 1868 | the Chain of Trust at the first step in the Trusted Board Boot process. |
| 1869 | |
| 1870 | - The version of the AEMv8 Base FVP used in this release resets the model |
| 1871 | instead of terminating its execution in response to a shutdown request using |
| 1872 | the PSCI ``SYSTEM_OFF`` API. This issue will be fixed in a future version of |
| 1873 | the model. |
| 1874 | |
| 1875 | - GICv3 support is experimental. There are known issues with GICv3 |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 1876 | initialization in the TF-A. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1877 | |
| 1878 | - While this version greatly reduces the on-chip RAM requirements, there are |
| 1879 | further RAM usage enhancements that could be made. |
| 1880 | |
| 1881 | - The firmware design documentation for the Test Secure-EL1 Payload (TSP) and |
| 1882 | its dispatcher (TSPD) is incomplete. Similarly for the PSCI section. |
| 1883 | |
| 1884 | - The Juno-specific firmware design documentation is incomplete. |
| 1885 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1886 | Version 1.0 |
| 1887 | ----------- |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1888 | |
| 1889 | New features |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 1890 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1891 | |
| 1892 | - It is now possible to map higher physical addresses using non-flat virtual |
| 1893 | to physical address mappings in the MMU setup. |
| 1894 | |
| 1895 | - Wider use is now made of the per-CPU data cache in BL3-1 to store: |
| 1896 | |
| 1897 | - Pointers to the non-secure and secure security state contexts. |
| 1898 | |
| 1899 | - A pointer to the CPU-specific operations. |
| 1900 | |
| 1901 | - A pointer to PSCI specific information (for example the current power |
| 1902 | state). |
| 1903 | |
| 1904 | - A crash reporting buffer. |
| 1905 | |
| 1906 | - The following RAM usage improvements result in a BL3-1 RAM usage reduction |
| 1907 | from 96KB to 56KB (for FVP with TSPD), and a total RAM usage reduction |
| 1908 | across all images from 208KB to 88KB, compared to the previous release. |
| 1909 | |
| 1910 | - Removed the separate ``early_exception`` vectors from BL3-1 (2KB code size |
| 1911 | saving). |
| 1912 | |
| 1913 | - Removed NSRAM from the FVP memory map, allowing the removal of one |
| 1914 | (4KB) translation table. |
| 1915 | |
| 1916 | - Eliminated the internal ``psci_suspend_context`` array, saving 2KB. |
| 1917 | |
| 1918 | - Correctly dimensioned the PSCI ``aff_map_node`` array, saving 1.5KB in the |
| 1919 | FVP port. |
| 1920 | |
| 1921 | - Removed calling CPU mpidr from the bakery lock API, saving 160 bytes. |
| 1922 | |
| 1923 | - Removed current CPU mpidr from PSCI common code, saving 160 bytes. |
| 1924 | |
| 1925 | - Inlined the mmio accessor functions, saving 360 bytes. |
| 1926 | |
| 1927 | - Fully reclaimed all BL1 RW memory and BL2 memory on the FVP port by |
| 1928 | overlaying the BL3-1/BL3-2 NOBITS sections on top of these at runtime. |
| 1929 | |
| 1930 | - Made storing the FP register context optional, saving 0.5KB per context |
| 1931 | (8KB on the FVP port, with TSPD enabled and running on 8 CPUs). |
| 1932 | |
| 1933 | - Implemented a leaner ``tf_printf()`` function, allowing the stack to be |
| 1934 | greatly reduced. |
| 1935 | |
| 1936 | - Removed coherent stacks from the codebase. Stacks allocated in normal |
| 1937 | memory are now used before and after the MMU is enabled. This saves 768 |
| 1938 | bytes per CPU in BL3-1. |
| 1939 | |
| 1940 | - Reworked the crash reporting in BL3-1 to use less stack. |
| 1941 | |
| 1942 | - Optimized the EL3 register state stored in the ``cpu_context`` structure |
| 1943 | so that registers that do not change during normal execution are |
| 1944 | re-initialized each time during cold/warm boot, rather than restored |
| 1945 | from memory. This saves about 1.2KB. |
| 1946 | |
| 1947 | - As a result of some of the above, reduced the runtime stack size in all |
| 1948 | BL images. For BL3-1, this saves 1KB per CPU. |
| 1949 | |
| 1950 | - PSCI SMC handler improvements to correctly handle calls from secure states |
| 1951 | and from AArch32. |
| 1952 | |
| 1953 | - CPU contexts are now initialized from the ``entry_point_info``. BL3-1 fully |
| 1954 | determines the exception level to use for the non-trusted firmware (BL3-3) |
| 1955 | based on the SPSR value provided by the BL2 platform code (or otherwise |
| 1956 | provided to BL3-1). This allows platform code to directly run non-trusted |
| 1957 | firmware payloads at either EL2 or EL1 without requiring an EL2 stub or OS |
| 1958 | loader. |
| 1959 | |
| 1960 | - Code refactoring improvements: |
| 1961 | |
| 1962 | - Refactored ``fvp_config`` into a common platform header. |
| 1963 | |
| 1964 | - Refactored the fvp gic code to be a generic driver that no longer has an |
| 1965 | explicit dependency on platform code. |
| 1966 | |
| 1967 | - Refactored the CCI-400 driver to not have dependency on platform code. |
| 1968 | |
| 1969 | - Simplified the IO driver so it's no longer necessary to call ``io_init()`` |
| 1970 | and moved all the IO storage framework code to one place. |
| 1971 | |
| 1972 | - Simplified the interface the the TZC-400 driver. |
| 1973 | |
| 1974 | - Clarified the platform porting interface to the TSP. |
| 1975 | |
| 1976 | - Reworked the TSPD setup code to support the alternate BL3-2 |
Paul Beesley | 1fbc97b | 2019-01-11 18:26:51 +0000 | [diff] [blame] | 1977 | initialization flow where BL3-1 generic code hands control to BL3-2, |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 1978 | rather than expecting the TSPD to hand control directly to BL3-2. |
| 1979 | |
| 1980 | - Considerable rework to PSCI generic code to support CPU specific |
| 1981 | operations. |
| 1982 | |
| 1983 | - Improved console log output, by: |
| 1984 | |
| 1985 | - Adding the concept of debug log levels. |
| 1986 | |
| 1987 | - Rationalizing the existing debug messages and adding new ones. |
| 1988 | |
| 1989 | - Printing out the version of each BL stage at runtime. |
| 1990 | |
| 1991 | - Adding support for printing console output from assembler code, |
| 1992 | including when a crash occurs before the C runtime is initialized. |
| 1993 | |
| 1994 | - Moved up to the latest versions of the FVPs, toolchain, EDK2, kernel, Linaro |
| 1995 | file system and DS-5. |
| 1996 | |
| 1997 | - On the FVP port, made the use of the Trusted DRAM region optional at build |
| 1998 | time (off by default). Normal platforms will not have such a "ready-to-use" |
| 1999 | DRAM area so it is not a good example to use it. |
| 2000 | |
| 2001 | - Added support for PSCI ``SYSTEM_OFF`` and ``SYSTEM_RESET`` APIs. |
| 2002 | |
| 2003 | - Added support for CPU specific reset sequences, power down sequences and |
| 2004 | register dumping during crash reporting. The CPU specific reset sequences |
| 2005 | include support for errata workarounds. |
| 2006 | |
| 2007 | - Merged the Juno port into the master branch. Added support for CPU hotplug |
| 2008 | and CPU idle. Updated the user guide to describe how to build and run on the |
| 2009 | Juno platform. |
| 2010 | |
| 2011 | Issues resolved since last release |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2012 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2013 | |
| 2014 | - Removed the concept of top/bottom image loading. The image loader now |
| 2015 | automatically detects the position of the image inside the current memory |
Paul Beesley | 1fbc97b | 2019-01-11 18:26:51 +0000 | [diff] [blame] | 2016 | layout and updates the layout to minimize fragmentation. This resolves the |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2017 | image loader limitations of previously releases. There are currently no |
| 2018 | plans to support dynamic image loading. |
| 2019 | |
| 2020 | - CPU idle now works on the publicized version of the Foundation FVP. |
| 2021 | |
| 2022 | - All known issues relating to the compiler version used have now been |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2023 | resolved. This TF-A version uses Linaro toolchain 14.07 (based on GCC 4.9). |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2024 | |
| 2025 | Known issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2026 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2027 | |
| 2028 | - GICv3 support is experimental. The Linux kernel patches to support this are |
| 2029 | not widely available. There are known issues with GICv3 initialization in |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2030 | the TF-A. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2031 | |
| 2032 | - While this version greatly reduces the on-chip RAM requirements, there are |
| 2033 | further RAM usage enhancements that could be made. |
| 2034 | |
| 2035 | - The firmware design documentation for the Test Secure-EL1 Payload (TSP) and |
| 2036 | its dispatcher (TSPD) is incomplete. Similarly for the PSCI section. |
| 2037 | |
| 2038 | - The Juno-specific firmware design documentation is incomplete. |
| 2039 | |
| 2040 | - Some recent enhancements to the FVP port have not yet been translated into |
| 2041 | the Juno port. These will be tracked via the tf-issues project. |
| 2042 | |
| 2043 | - The Linux kernel version referred to in the user guide has DVFS and HMP |
| 2044 | support disabled due to some known instabilities at the time of this |
| 2045 | release. A future kernel version will re-enable these features. |
| 2046 | |
| 2047 | - DS-5 v5.19 does not detect Version 5.8 of the Cortex-A57-A53 Base FVPs in |
| 2048 | CADI server mode. This is because the ``<SimName>`` reported by the FVP in |
| 2049 | this version has changed. For example, for the Cortex-A57x4-A53x4 Base FVP, |
| 2050 | the ``<SimName>`` reported by the FVP is ``FVP_Base_Cortex_A57x4_A53x4``, while |
| 2051 | DS-5 expects it to be ``FVP_Base_A57x4_A53x4``. |
| 2052 | |
| 2053 | The temporary fix to this problem is to change the name of the FVP in |
| 2054 | ``sw/debugger/configdb/Boards/ARM FVP/Base_A57x4_A53x4/cadi_config.xml``. |
| 2055 | Change the following line: |
| 2056 | |
| 2057 | :: |
| 2058 | |
| 2059 | <SimName>System Generator:FVP_Base_A57x4_A53x4</SimName> |
| 2060 | |
| 2061 | to |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 2062 | System Generator:FVP_Base_Cortex-A57x4_A53x4 |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2063 | |
| 2064 | A similar change can be made to the other Cortex-A57-A53 Base FVP variants. |
| 2065 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2066 | Version 0.4 |
| 2067 | ----------- |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2068 | |
| 2069 | New features |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2070 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2071 | |
| 2072 | - Makefile improvements: |
| 2073 | |
| 2074 | - Improved dependency checking when building. |
| 2075 | |
| 2076 | - Removed ``dump`` target (build now always produces dump files). |
| 2077 | |
| 2078 | - Enabled platform ports to optionally make use of parts of the Trusted |
| 2079 | Firmware (e.g. BL3-1 only), rather than being forced to use all parts. |
| 2080 | Also made the ``fip`` target optional. |
| 2081 | |
| 2082 | - Specified the full path to source files and removed use of the ``vpath`` |
| 2083 | keyword. |
| 2084 | |
| 2085 | - Provided translation table library code for potential re-use by platforms |
| 2086 | other than the FVPs. |
| 2087 | |
| 2088 | - Moved architectural timer setup to platform-specific code. |
| 2089 | |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 2090 | - Added standby state support to PSCI cpu_suspend implementation. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2091 | |
| 2092 | - SRAM usage improvements: |
| 2093 | |
| 2094 | - Started using the ``-ffunction-sections``, ``-fdata-sections`` and |
| 2095 | ``--gc-sections`` compiler/linker options to remove unused code and data |
| 2096 | from the images. Previously, all common functions were being built into |
| 2097 | all binary images, whether or not they were actually used. |
| 2098 | |
| 2099 | - Placed all assembler functions in their own section to allow more unused |
| 2100 | functions to be removed from images. |
| 2101 | |
| 2102 | - Updated BL1 and BL2 to use a single coherent stack each, rather than one |
| 2103 | per CPU. |
| 2104 | |
| 2105 | - Changed variables that were unnecessarily declared and initialized as |
| 2106 | non-const (i.e. in the .data section) so they are either uninitialized |
| 2107 | (zero init) or const. |
| 2108 | |
| 2109 | - Moved the Test Secure-EL1 Payload (BL3-2) to execute in Trusted SRAM by |
| 2110 | default. The option for it to run in Trusted DRAM remains. |
| 2111 | |
| 2112 | - Implemented a TrustZone Address Space Controller (TZC-400) driver. A |
| 2113 | default configuration is provided for the Base FVPs. This means the model |
| 2114 | parameter ``-C bp.secure_memory=1`` is now supported. |
| 2115 | |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 2116 | - Started saving the PSCI cpu_suspend 'power_state' parameter prior to |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2117 | suspending a CPU. This allows platforms that implement multiple power-down |
| 2118 | states at the same affinity level to identify a specific state. |
| 2119 | |
| 2120 | - Refactored the entire codebase to reduce the amount of nesting in header |
| 2121 | files and to make the use of system/user includes more consistent. Also |
| 2122 | split platform.h to separate out the platform porting declarations from the |
| 2123 | required platform porting definitions and the definitions/declarations |
| 2124 | specific to the platform port. |
| 2125 | |
| 2126 | - Optimized the data cache clean/invalidate operations. |
| 2127 | |
| 2128 | - Improved the BL3-1 unhandled exception handling and reporting. Unhandled |
| 2129 | exceptions now result in a dump of registers to the console. |
| 2130 | |
| 2131 | - Major rework to the handover interface between BL stages, in particular the |
| 2132 | interface to BL3-1. The interface now conforms to a specification and is |
| 2133 | more future proof. |
| 2134 | |
| 2135 | - Added support for optionally making the BL3-1 entrypoint a reset handler |
| 2136 | (instead of BL1). This allows platforms with an alternative image loading |
| 2137 | architecture to re-use BL3-1 with fewer modifications to generic code. |
| 2138 | |
| 2139 | - Reserved some DDR DRAM for secure use on FVP platforms to avoid future |
| 2140 | compatibility problems with non-secure software. |
| 2141 | |
| 2142 | - Added support for secure interrupts targeting the Secure-EL1 Payload (SP) |
| 2143 | (using GICv2 routing only). Demonstrated this working by adding an interrupt |
| 2144 | target and supporting test code to the TSP. Also demonstrated non-secure |
| 2145 | interrupt handling during TSP processing. |
| 2146 | |
| 2147 | Issues resolved since last release |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2148 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2149 | |
| 2150 | - Now support use of the model parameter ``-C bp.secure_memory=1`` in the Base |
| 2151 | FVPs (see **New features**). |
| 2152 | |
| 2153 | - Support for secure world interrupt handling now available (see **New |
| 2154 | features**). |
| 2155 | |
| 2156 | - Made enough SRAM savings (see **New features**) to enable the Test Secure-EL1 |
| 2157 | Payload (BL3-2) to execute in Trusted SRAM by default. |
| 2158 | |
| 2159 | - The tested filesystem used for this release (Linaro AArch64 OpenEmbedded |
| 2160 | 14.04) now correctly reports progress in the console. |
| 2161 | |
| 2162 | - Improved the Makefile structure to make it easier to separate out parts of |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2163 | the TF-A for re-use in platform ports. Also, improved target dependency |
| 2164 | checking. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2165 | |
| 2166 | Known issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2167 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2168 | |
| 2169 | - GICv3 support is experimental. The Linux kernel patches to support this are |
| 2170 | not widely available. There are known issues with GICv3 initialization in |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2171 | the TF-A. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2172 | |
| 2173 | - Dynamic image loading is not available yet. The current image loader |
| 2174 | implementation (used to load BL2 and all subsequent images) has some |
| 2175 | limitations. Changing BL2 or BL3-1 load addresses in certain ways can lead |
| 2176 | to loading errors, even if the images should theoretically fit in memory. |
| 2177 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2178 | - TF-A still uses too much on-chip Trusted SRAM. A number of RAM usage |
| 2179 | enhancements have been identified to rectify this situation. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2180 | |
| 2181 | - CPU idle does not work on the advertised version of the Foundation FVP. |
| 2182 | Some FVP fixes are required that are not available externally at the time |
| 2183 | of writing. This can be worked around by disabling CPU idle in the Linux |
| 2184 | kernel. |
| 2185 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2186 | - Various bugs in TF-A, UEFI and the Linux kernel have been observed when |
| 2187 | using Linaro toolchain versions later than 13.11. Although most of these |
| 2188 | have been fixed, some remain at the time of writing. These mainly seem to |
| 2189 | relate to a subtle change in the way the compiler converts between 64-bit |
| 2190 | and 32-bit values (e.g. during casting operations), which reveals |
| 2191 | previously hidden bugs in client code. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2192 | |
| 2193 | - The firmware design documentation for the Test Secure-EL1 Payload (TSP) and |
| 2194 | its dispatcher (TSPD) is incomplete. Similarly for the PSCI section. |
| 2195 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2196 | Version 0.3 |
| 2197 | ----------- |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2198 | |
| 2199 | New features |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2200 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2201 | |
| 2202 | - Support for Foundation FVP Version 2.0 added. |
| 2203 | The documented UEFI configuration disables some devices that are unavailable |
| 2204 | in the Foundation FVP, including MMC and CLCD. The resultant UEFI binary can |
| 2205 | be used on the AEMv8 and Cortex-A57-A53 Base FVPs, as well as the Foundation |
| 2206 | FVP. |
| 2207 | |
| 2208 | NOTE: The software will not work on Version 1.0 of the Foundation FVP. |
| 2209 | |
| 2210 | - Enabled third party contributions. Added a new contributing.md containing |
| 2211 | instructions for how to contribute and updated copyright text in all files |
| 2212 | to acknowledge contributors. |
| 2213 | |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 2214 | - The PSCI CPU_SUSPEND API has been stabilised to the extent where it can be |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2215 | used for entry into power down states with the following restrictions: |
| 2216 | |
| 2217 | - Entry into standby states is not supported. |
| 2218 | - The API is only supported on the AEMv8 and Cortex-A57-A53 Base FVPs. |
| 2219 | |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 2220 | - The PSCI AFFINITY_INFO api has undergone limited testing on the Base FVPs to |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2221 | allow experimental use. |
| 2222 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2223 | - Required C library and runtime header files are now included locally in |
| 2224 | TF-A instead of depending on the toolchain standard include paths. The |
| 2225 | local implementation has been cleaned up and reduced in scope. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2226 | |
| 2227 | - Added I/O abstraction framework, primarily to allow generic code to load |
| 2228 | images in a platform-independent way. The existing image loading code has |
| 2229 | been reworked to use the new framework. Semi-hosting and NOR flash I/O |
| 2230 | drivers are provided. |
| 2231 | |
| 2232 | - Introduced Firmware Image Package (FIP) handling code and tools. A FIP |
| 2233 | combines multiple firmware images with a Table of Contents (ToC) into a |
| 2234 | single binary image. The new FIP driver is another type of I/O driver. The |
| 2235 | Makefile builds a FIP by default and the FVP platform code expect to load a |
| 2236 | FIP from NOR flash, although some support for image loading using semi- |
| 2237 | hosting is retained. |
| 2238 | |
| 2239 | NOTE: Building a FIP by default is a non-backwards-compatible change. |
| 2240 | |
| 2241 | NOTE: Generic BL2 code now loads a BL3-3 (non-trusted firmware) image into |
| 2242 | DRAM instead of expecting this to be pre-loaded at known location. This is |
| 2243 | also a non-backwards-compatible change. |
| 2244 | |
| 2245 | NOTE: Some non-trusted firmware (e.g. UEFI) will need to be rebuilt so that |
| 2246 | it knows the new location to execute from and no longer needs to copy |
| 2247 | particular code modules to DRAM itself. |
| 2248 | |
| 2249 | - Reworked BL2 to BL3-1 handover interface. A new composite structure |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 2250 | (bl31_args) holds the superset of information that needs to be passed from |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2251 | BL2 to BL3-1, including information on how handover execution control to |
| 2252 | BL3-2 (if present) and BL3-3 (non-trusted firmware). |
| 2253 | |
| 2254 | - Added library support for CPU context management, allowing the saving and |
| 2255 | restoring of |
| 2256 | |
| 2257 | - Shared system registers between Secure-EL1 and EL1. |
| 2258 | - VFP registers. |
| 2259 | - Essential EL3 system registers. |
| 2260 | |
| 2261 | - Added a framework for implementing EL3 runtime services. Reworked the PSCI |
| 2262 | implementation to be one such runtime service. |
| 2263 | |
Sandrine Bailleux | 15530dd | 2019-02-08 15:26:36 +0100 | [diff] [blame] | 2264 | - Reworked the exception handling logic, making use of both SP_EL0 and SP_EL3 |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2265 | stack pointers for determining the type of exception, managing general |
| 2266 | purpose and system register context on exception entry/exit, and handling |
| 2267 | SMCs. SMCs are directed to the correct EL3 runtime service. |
| 2268 | |
| 2269 | - Added support for a Test Secure-EL1 Payload (TSP) and a corresponding |
| 2270 | Dispatcher (TSPD), which is loaded as an EL3 runtime service. The TSPD |
| 2271 | implements Secure Monitor functionality such as world switching and |
| 2272 | EL1 context management, and is responsible for communication with the TSP. |
| 2273 | NOTE: The TSPD does not yet contain support for secure world interrupts. |
| 2274 | NOTE: The TSP/TSPD is not built by default. |
| 2275 | |
| 2276 | Issues resolved since last release |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2277 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2278 | |
| 2279 | - Support has been added for switching context between secure and normal |
| 2280 | worlds in EL3. |
| 2281 | |
| 2282 | - PSCI API calls ``AFFINITY_INFO`` & ``PSCI_VERSION`` have now been tested (to |
| 2283 | a limited extent). |
| 2284 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2285 | - The TF-A build artifacts are now placed in the ``./build`` directory and |
| 2286 | sub-directories instead of being placed in the root of the project. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2287 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2288 | - TF-A is now free from build warnings. Build warnings are now treated as |
| 2289 | errors. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2290 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2291 | - TF-A now provides C library support locally within the project to maintain |
| 2292 | compatibility between toolchains/systems. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2293 | |
| 2294 | - The PSCI locking code has been reworked so it no longer takes locks in an |
| 2295 | incorrect sequence. |
| 2296 | |
| 2297 | - The RAM-disk method of loading a Linux file-system has been confirmed to |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2298 | work with the TF-A and Linux kernel version (based on version 3.13) used |
| 2299 | in this release, for both Foundation and Base FVPs. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2300 | |
| 2301 | Known issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2302 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2303 | |
| 2304 | The following is a list of issues which are expected to be fixed in the future |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2305 | releases of TF-A. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2306 | |
| 2307 | - The TrustZone Address Space Controller (TZC-400) is not being programmed |
| 2308 | yet. Use of model parameter ``-C bp.secure_memory=1`` is not supported. |
| 2309 | |
| 2310 | - No support yet for secure world interrupt handling. |
| 2311 | |
| 2312 | - GICv3 support is experimental. The Linux kernel patches to support this are |
| 2313 | not widely available. There are known issues with GICv3 initialization in |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2314 | TF-A. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2315 | |
| 2316 | - Dynamic image loading is not available yet. The current image loader |
| 2317 | implementation (used to load BL2 and all subsequent images) has some |
| 2318 | limitations. Changing BL2 or BL3-1 load addresses in certain ways can lead |
| 2319 | to loading errors, even if the images should theoretically fit in memory. |
| 2320 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2321 | - TF-A uses too much on-chip Trusted SRAM. Currently the Test Secure-EL1 |
| 2322 | Payload (BL3-2) executes in Trusted DRAM since there is not enough SRAM. |
| 2323 | A number of RAM usage enhancements have been identified to rectify this |
| 2324 | situation. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2325 | |
| 2326 | - CPU idle does not work on the advertised version of the Foundation FVP. |
| 2327 | Some FVP fixes are required that are not available externally at the time |
| 2328 | of writing. |
| 2329 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2330 | - Various bugs in TF-A, UEFI and the Linux kernel have been observed when |
| 2331 | using Linaro toolchain versions later than 13.11. Although most of these |
| 2332 | have been fixed, some remain at the time of writing. These mainly seem to |
| 2333 | relate to a subtle change in the way the compiler converts between 64-bit |
| 2334 | and 32-bit values (e.g. during casting operations), which reveals |
| 2335 | previously hidden bugs in client code. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2336 | |
| 2337 | - The tested filesystem used for this release (Linaro AArch64 OpenEmbedded |
| 2338 | 14.01) does not report progress correctly in the console. It only seems to |
| 2339 | produce error output, not standard output. It otherwise appears to function |
| 2340 | correctly. Other filesystem versions on the same software stack do not |
| 2341 | exhibit the problem. |
| 2342 | |
| 2343 | - The Makefile structure doesn't make it easy to separate out parts of the |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2344 | TF-A for re-use in platform ports, for example if only BL3-1 is required in |
| 2345 | a platform port. Also, dependency checking in the Makefile is flawed. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2346 | |
| 2347 | - The firmware design documentation for the Test Secure-EL1 Payload (TSP) and |
| 2348 | its dispatcher (TSPD) is incomplete. Similarly for the PSCI section. |
| 2349 | |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2350 | Version 0.2 |
| 2351 | ----------- |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2352 | |
| 2353 | New features |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2354 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2355 | |
| 2356 | - First source release. |
| 2357 | |
| 2358 | - Code for the PSCI suspend feature is supplied, although this is not enabled |
| 2359 | by default since there are known issues (see below). |
| 2360 | |
| 2361 | Issues resolved since last release |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2362 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2363 | |
| 2364 | - The "psci" nodes in the FDTs provided in this release now fully comply |
| 2365 | with the recommendations made in the PSCI specification. |
| 2366 | |
| 2367 | Known issues |
Paul Beesley | 3237955 | 2019-02-11 17:58:21 +0000 | [diff] [blame] | 2368 | ^^^^^^^^^^^^ |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2369 | |
| 2370 | The following is a list of issues which are expected to be fixed in the future |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2371 | releases of TF-A. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2372 | |
| 2373 | - The TrustZone Address Space Controller (TZC-400) is not being programmed |
| 2374 | yet. Use of model parameter ``-C bp.secure_memory=1`` is not supported. |
| 2375 | |
| 2376 | - No support yet for secure world interrupt handling or for switching context |
| 2377 | between secure and normal worlds in EL3. |
| 2378 | |
| 2379 | - GICv3 support is experimental. The Linux kernel patches to support this are |
| 2380 | not widely available. There are known issues with GICv3 initialization in |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2381 | TF-A. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2382 | |
| 2383 | - Dynamic image loading is not available yet. The current image loader |
| 2384 | implementation (used to load BL2 and all subsequent images) has some |
| 2385 | limitations. Changing BL2 or BL3-1 load addresses in certain ways can lead |
| 2386 | to loading errors, even if the images should theoretically fit in memory. |
| 2387 | |
| 2388 | - Although support for PSCI ``CPU_SUSPEND`` is present, it is not yet stable |
| 2389 | and ready for use. |
| 2390 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2391 | - PSCI API calls ``AFFINITY_INFO`` & ``PSCI_VERSION`` are implemented but have |
| 2392 | not been tested. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2393 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2394 | - The TF-A make files result in all build artifacts being placed in the root |
| 2395 | of the project. These should be placed in appropriate sub-directories. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2396 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2397 | - The compilation of TF-A is not free from compilation warnings. Some of these |
| 2398 | warnings have not been investigated yet so they could mask real bugs. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2399 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2400 | - TF-A currently uses toolchain/system include files like stdio.h. It should |
| 2401 | provide versions of these within the project to maintain compatibility |
| 2402 | between toolchains/systems. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2403 | |
| 2404 | - The PSCI code takes some locks in an incorrect sequence. This may cause |
| 2405 | problems with suspend and hotplug in certain conditions. |
| 2406 | |
| 2407 | - The Linux kernel used in this release is based on version 3.12-rc4. Using |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2408 | this kernel with the TF-A fails to start the file-system as a RAM-disk. It |
| 2409 | fails to execute user-space ``init`` from the RAM-disk. As an alternative, |
| 2410 | the VirtioBlock mechanism can be used to provide a file-system to the |
| 2411 | kernel. |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2412 | |
| 2413 | -------------- |
| 2414 | |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2415 | *Copyright (c) 2013-2018, Arm Limited and Contributors. All rights reserved.* |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2416 | |
David Cunado | b158043 | 2018-03-14 17:57:31 +0000 | [diff] [blame] | 2417 | .. _SDEI Specification: http://infocenter.arm.com/help/topic/com.arm.doc.den0054a/ARM_DEN0054A_Software_Delegated_Exception_Interface.pdf |
Paul Beesley | ea22512 | 2019-02-11 17:54:45 +0000 | [diff] [blame] | 2418 | .. _PSCI Integration Guide: ./getting_started/psci-lib-integration-guide.rst |
Douglas Raillard | d7c21b7 | 2017-06-28 15:23:03 +0100 | [diff] [blame] | 2419 | .. _Developer Certificate of Origin: ../dco.txt |
Paul Beesley | ea22512 | 2019-02-11 17:54:45 +0000 | [diff] [blame] | 2420 | .. _Contribution Guide: ./contributing.rst |
| 2421 | .. _Authentication framework: ./design/auth-framework.rst |
| 2422 | .. _Firmware Update: ./design/firmware-update.rst |
| 2423 | .. _TF-A Reset Design: ./design/reset-design.rst |
| 2424 | .. _Power Domain Topology Design: ./design/psci-pd-tree.rst |
Dan Handley | 610e7e1 | 2018-03-01 18:44:00 +0000 | [diff] [blame] | 2425 | .. _TF-A wiki on GitHub: https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Image-Terminology |
Paul Beesley | ea22512 | 2019-02-11 17:54:45 +0000 | [diff] [blame] | 2426 | .. _Authentication Framework: ./design/auth-framework.rst |
| 2427 | .. _OP-TEE Dispatcher: ./spd/optee-dispatcher.rst |
David Cunado | 1b796fa | 2017-07-03 18:59:07 +0100 | [diff] [blame] | 2428 | .. _tf-issue#501: https://github.com/ARM-software/tf-issues/issues/501 |
| 2429 | .. _PR#1002: https://github.com/ARM-software/arm-trusted-firmware/pull/1002#issuecomment-312650193 |