1# Change Log & Release Notes 2 3This document contains a summary of the new features, changes, fixes and known 4issues in each release of Trusted Firmware-A. 5 6## 2.5.0 (2021-05-17) 7 8### New Features 9 10- Architecture support 11 12 - Added support for speculation barrier(`FEAT_SB`) for non-Armv8.5 platforms 13 starting from Armv8.0 14 - Added support for Activity Monitors Extension version 1.1(`FEAT_AMUv1p1`) 15 - Added helper functions for Random number generator(`FEAT_RNG`) registers 16 - Added support for Armv8.6 Multi-threaded PMU extensions (`FEAT_MTPMU`) 17 - Added support for MTE Asymmetric Fault Handling extensions(`FEAT_MTE3`) 18 - Added support for Privileged Access Never extensions(`FEAT_PANx`) 19 20- Bootloader images 21 22 - Added PIE support for AArch32 builds 23 - Enable Trusted Random Number Generator service for BL32(sp_min) 24 25- Build System 26 27 - Added build option for Arm Feature Modifiers 28 29- Drivers 30 31 - Added support for interrupts in TZC-400 driver 32 - Broadcom 33 - Added support for I2C, MDIO and USB drivers 34 - Marvell 35 - Added support for secure read/write of dfc register-set 36 - Added support for thermal sensor driver 37 - Implement a3700_core_getc API in console driver 38 - Added rx training on 10G port 39 - Marvell Mochi 40 - Added support for cn913x in PCIe mode 41 - Marvell Armada A8K 42 - Added support for TRNG-IP-76 driver and accessing RNG register 43 - Mediatek MT8192 44 - Added support for following drivers 45 - MPU configuration for SCP/PCIe 46 - SPM suspend 47 - Vcore DVFS 48 - LPM 49 - PTP3 50 - UART save and restore 51 - Power-off 52 - PMIC 53 - CPU hotplug and MCDI support 54 - SPMC 55 - MPU 56 - Mediatek MT8195 57 - Added support for following drivers 58 - GPIO, NCDI, SPMC drivers 59 - Power-off 60 - CPU hotplug, reboot and MCDI 61 - Delay timer and sys timer 62 - GIC 63 - NXP 64 - Added support for 65 - non-volatile storage API 66 - chain of trust and trusted board boot using two modes: MBEDTLS and CSF 67 - fip-handler necessary for DDR initialization 68 - SMMU and console drivers 69 - crypto hardware accelerator driver 70 - following drivers: SD, EMMC, QSPI, FLEXSPI, GPIO, GIC, CSU, PMU, DDR 71 - NXP Security Monitor and SFP driver 72 - interconnect config APIs using ARM CCN-CCI driver 73 - TZC APIs to configure DDR region 74 - generic timer driver 75 - Device configuration driver 76 - IMX 77 - Added support for image loading and io-storage driver for TBBR fip booting 78 - Renesas 79 - Added support for PFC and EMMC driver 80 - RZ Family: 81 - G2N, G2E and G2H SoCs 82 - Added support for watchdog, QoS, PFC and DRAM initialization 83 - RZG Family: 84 - G2M 85 - Added support for QoS and DRAM initialization 86 - Xilinx 87 - Added JTAG DCC support for Versal and ZynqMP SoC family. 88 89- Libraries 90 91 - C standard library 92 - Added support to print `%` in `snprintf()` and `printf()` APIs 93 - Added support for strtoull, strtoll, strtoul, strtol APIs from FreeBSD 94 project 95 - CPU support 96 - Added support for 97 - Cortex_A78C CPU 98 - Makalu ELP CPU 99 - Makalu CPU 100 - Matterhorn ELP CPU 101 - Neoverse-N2 CPU 102 - CPU Errata 103 - Arm Cortex-A76: Added workaround for erratum 1946160 104 - Arm Cortex-A77: Added workaround for erratum 1946167 105 - Arm Cortex-A78: Added workaround for erratum 1941498 and 1951500 106 - Arm Neoverse-N1: Added workaround for erratum 1946160 107 - Flattened device tree(libfdt) 108 - Added support for wrapper function to read UUIDs in string format from dtb 109 110- Platforms 111 112 - Added support for MediaTek MT8195 113 - Added support for Arm RD-N2 board 114 - Allwinner 115 - Added support for H616 SoC 116 - Arm 117 - Added support for GPT parser 118 - Protect GICR frames for fused/unused cores 119 - Arm Morello 120 - Added VirtIO network device to Morello FVP fdts 121 - Arm RD-N2 122 - Added support for variant 1 of RD-N2 platform 123 - Enable AMU support 124 - Arm RD-V1 125 - Enable AMU support 126 - Arm SGI 127 - Added support for platform variant build option 128 - Arm TC0 129 - Added Matterhorn ELP CPU support 130 - Added support for opteed 131 - Arm Juno 132 - Added support to use hw_config in BL31 133 - Use TRNG entropy source for SMCCC TRNG interface 134 - Condition Juno entropy source with CRC instructions 135 - Marvell Mochi 136 - Added support for detection of secure mode 137 - Marvell ARMADA 138 - Added support for new compile option A3720_DB_PM_WAKEUP_SRC 139 - Added support doing system reset via CM3 secure coprocessor 140 - Made several makefile enhancements required to build WTMI_MULTI_IMG and 141 TIMDDRTOOL 142 - Added support for building DOIMAGETOOL tool 143 - Added new target mrvl_bootimage 144 - Mediatek MT8192 145 - Added support for rtc power off sequence 146 - Mediatek MT8195 147 - Added support for SiP service 148 - STM32MP1 149 - Added support for 150 - Seeed ODYSSEY SoM and board 151 - SDMMC2 and I2C2 pins in pinctrl 152 - I2C2 peripheral in DTS 153 - PIE for BL32 154 - TZC-400 interrupt managament 155 - Linux Automation MC-1 board 156 - Renesas RZG 157 - Added support for identifying EK874 RZ/G2E board 158 - Added support for identifying HopeRun HiHope RZ/G2H and RZ/G2H boards 159 - Rockchip 160 - Added support for stack protector 161 - QEMU 162 - Added support for `max` CPU 163 - Added Cortex-A72 support to `virt` platform 164 - Enabled trigger reboot from secure pl061 165 - QEMU SBSA 166 - Added support for sbsa-ref Embedded Controller 167 - NXP 168 - Added support for warm reset to retain ddr content 169 - Added support for image loader necessary for loading fip image 170 - lx2160a SoC Family 171 - Added support for 172 - new platform lx2160a-aqds 173 - new platform lx2160a-rdb 174 - new platform lx2162a-aqds 175 - errata handling 176 - IMX imx8mm 177 - Added support for trusted board boot 178 - TI K3 179 - Added support for lite device board 180 - Enabled Cortex-A72 erratum 1319367 181 - Enabled Cortex-A53 erratum 1530924 182 - Xilinx ZynqMP 183 - Added support for PS and system reset on WDT restart 184 - Added support for error management 185 - Enable support for log messages necessary for debug 186 - Added support for PM API SMC call for efuse and register access 187 188- Processes 189 190 - Introduced process for platform deprecation 191 - Added documentation for TF-A threat model 192 - Provided a copy of the MIT license to comply with the license requirements 193 of the arm-gic.h source file (originating from the Linux kernel project and 194 re-distributed in TF-A). 195 196- Services 197 198 - Added support for TRNG firmware interface service 199 - Arm 200 - Added SiP service to configure Ethos-N NPU 201 - SPMC 202 - Added documentation for SPM(Hafnium) SMMUv3 driver 203 - SPMD 204 - Added support for 205 - FFA_INTERRUPT forwading ABI 206 - FFA_SECONDARY_EP_REGISTER ABI 207 - FF-A v1.0 boot time power management, SPMC secondary core boot and early 208 run-time power management 209 210- Tools 211 212 - FIPTool 213 - Added mechanism to allow platform specific image UUID 214 - git hooks 215 - Added support for conventional commits through commitlint hook, commitizen 216 hook and husky configuration files. 217 - NXP tool 218 - Added support for a tool that creates pbl file from BL2 219 - Renesas RZ/G2 220 - Added tool support for creating bootparam and cert_header images 221 - CertCreate 222 - Added support for platform-defined certificates, keys, and extensions 223 using the platform's makefile 224 - shared tools 225 - Added EFI_GUID representation to uuid helper data structure 226 227### Changed 228 229- Common components 230 231 - Print newline after hex address in aarch64 el3_panic function 232 - Use proper `#address-cells` and `#size-cells` for reserved-memory in dtbs 233 234- Drivers 235 236 - Move SCMI driver from ST platform directory and make it common to all 237 platforms 238 - Arm GICv3 239 - Shift eSPI register offset in GICD_OFFSET_64() 240 - Use mpidr to probe GICR for current CPU 241 - Arm TZC-400 242 - Adjust filter tag if it set to FILTER_BIT_ALL 243 - Cadence 244 - Enhance UART driver APIs to put characters to fifo 245 - Mediatek MT8192 246 - Move timer driver to common folder 247 - Enhanced sys_cirq driver to add more IC services 248 - Renesas 249 - Move ddr and delay driver to common directory 250 - Renesas rcar 251 - Treat log as device memory in console driver 252 - Renesas RZ Family: 253 - G2N and G2H SoCs 254 - Select MMC_CH1 for eMMC channel 255 - Marvell 256 - Added support for checking if TRNG unit is present 257 - Marvell A3K 258 - Set TXDCLK_2X_SEL bit during PCIe initialization 259 - Set mask parameter for every reg_set call 260 - Marvell Mochi 261 - Added missing stream IDs configurations 262 - MbedTLS 263 - Migrated to Mbed TLS v2.26.0 264 - IMX imx8mp 265 - Change the bl31 physical load address 266 - QEMU SBSA 267 - Enable secure variable storage 268 - SCMI 269 - Update power domain protocol version to 2.0 270 - STM32 271 - Remove dead code from nand FMC driver 272 273- Libraries 274 275 - C Standard Library 276 - Use macros to reduce duplicated code between snprintf and printf 277 - CPU support 278 - Sanity check pointers before use in AArch32 builds 279 - Arm Cortex-A78 280 - Remove rainier cpu workaround for errata 1542319 281 - Arm Makalu ELP 282 - Added "\_arm" suffix to Makalu ELP CPU lib 283 284- Miscellaneous 285 286 - Editorconfig 287 - set max line length to 100 288 289- Platforms 290 291 - Allwinner 292 - Added reserved-memory node to DT 293 - Express memmap more dynamically 294 - Move SEPARATE_NOBITS_REGION to platforms 295 - Limit FDT checks to reduce code size 296 - Use CPUIDLE hardware when available 297 - Allow conditional compilation of SCPI and native PSCI ops 298 - Always use a 3MHz RSB bus clock 299 - Enable workaround for Cortex-A53 erratum 1530924 300 - Fixed non-default PRELOADED_BL33_BASE 301 - Leave CPU power alone during BL31 setup 302 - Added several psci hooks enhancements to improve system shutdown/reset 303 sequence 304 - Return the PMIC to I2C mode after use 305 - Separate code to power off self and other CPUs 306 - Split native and SCPI-based PSCI implementations 307 - Allwinner H6 308 - Added R_PRCM security setup for H6 board 309 - Added SPC security setup for H6 board 310 - Use RSB for the PMIC connection on H6 311 - Arm 312 - Store UUID as a string, rather than ints 313 - Replace FIP base and size macro with a generic name 314 - Move compile time switch from source to dt file 315 - Don't provide NT_FW_CONFIG when booting hafnium 316 - Do not setup 'disabled' regulator 317 - Increase SP max size 318 - Remove false dependency of ARM_LINUX_KERNEL_AS_BL33 on RESET_TO_BL31 and 319 allow it to be enabled independently 320 - Arm FVP 321 - Do not map GIC region in BL1 and BL2 322 - Arm Juno 323 - Refactor juno_getentropy() to return 64 bits on each call 324 - Arm Morello 325 - Remove "virtio-rng" from Morello FVP 326 - Enable virtIO P9 device for Morello fvp 327 - Arm RDV1 328 - Allow all PSCI callbacks on RD-V1 329 - Rename rddaniel to rdv1 330 - Arm RDV1MC 331 - Rename rddanielxlr to rdv1mc 332 - Initialize TZC-400 controllers 333 - Arm TC0 334 - Updated GICR base address 335 - Use scmi_dvfs clock index 1 for cores 4-7 through fdt 336 - Added reserved-memory node for OP-TEE fdts 337 - Enabled Theodul DSU in TC platform 338 - OP-TEE as S-EL1 SP with SPMC at S-EL2 339 - Update Matterhorm ELP DVFS clock index 340 - Arm SGI 341 - Allow access to TZC controller on all chips 342 - Define memory regions for multi-chip platforms 343 - Allow access to nor2 flash and system registers from S-EL0 344 - Define default list of memory regions for DMC-620 TZC 345 - Improve macros defining cper buffer memory region 346 - Refactor DMC-620 error handling SMC function id 347 - Refactor SDEI specific macros 348 - Added platform id value for RDN2 platform 349 - Refactored header file inclusions and inclusion of memory mapping 350 - Arm RDN2 351 - Allow usage of secure partitions on RDN2 platform 352 - Update GIC redistributor and TZC base address 353 - Arm SGM775 354 - Deprecate Arm sgm775 FVP platform 355 - Marvell 356 - Increase TX FIFO EMPTY timeout from 2ms to 3ms 357 - Update delay code to be compatible with 1200 MHz CPU 358 - Marvell ARMADA 359 - Postpone MSS CPU startup to BL31 stage 360 - Allow builds without MSS support 361 - Use MSS SRAM in secure mode 362 - Added missing FORCE, .PHONY and clean targets 363 - Cleanup MSS SRAM if used for copy 364 - Move definition of mrvl_flash target to common marvell_common.mk file 365 - Show informative build messages and blank lines 366 - Marvell ARMADA A3K 367 - Added a new target mrvl_uart which builds UART image 368 - Added checks that WTP, MV_DDR_PATH and CRYPTOPP_PATH are correctly defined 369 - Allow use of the system Crypto++ library 370 - Build \$(WTMI_ENC_IMG) in \$(BUILD_PLAT) directory 371 - Build intermediate files in \$(BUILD_PLAT) directory 372 - Build UART image files directly in \$(BUILD_UART) subdirectory 373 - Correctly set DDR_TOPOLOGY and CLOCKSPRESET for WTMI 374 - Do not use 'echo -e' in Makefile 375 - Improve 4GB DRAM usage from 3.375 GB to 3.75 GB 376 - Remove unused variable WTMI_SYSINIT_IMG from Makefile 377 - Simplify check if WTP variable is defined 378 - Split building \$(WTMI_MULTI_IMG) and \$(TIMDDRTOOL) 379 - Marvell ARMADA A8K 380 - Allow CP1/CP2 mapping at BLE stage 381 - Mediatek MT8183 382 - Added timer V20 compensation 383 - Nvidia Tegra 384 - Rename SMC API 385 - TI K3 386 - Make plat_get_syscnt_freq2 helper check CNT_FID0 register 387 - Fill non-message data fields in sec_proxy with 0x0 388 - Update ti_sci_msg_req_reboot ABI to include domain 389 - Enable USE_COHERENT_MEM only for the generic board 390 - Explicitly map SEC_SRAM_BASE to 0x0 391 - Use BL31_SIZE instead of computing 392 - Define the correct number of max table entries and increase SRAM size to 393 account for additional table 394 - Raspberry Pi4 395 - Switch to gicv2.mk and GICV2_SOURCES 396 - Renesas 397 - Move headers and assembly files to common folder 398 - Renesas rzg 399 - Added device tree memory node enhancements 400 - Rockchip 401 - Switch to using common gicv3.mk 402 - STM32MP1 403 - Set BL sizes regardless of flags 404 - QEMU 405 - Include gicv2.mk for compiling GICv2 source files 406 - Change DEVICE2 definition for MMU 407 - Added helper to calculate the position shift from MPIDR 408 - QEMU SBSA 409 - Include libraries for Cortex-A72 410 - Increase SHARED_RAM_SIZE 411 - Addes support in spm_mm for upto 512 cores 412 - Added support for topology handling 413 - QTI 414 - Mandate SMC implementation 415 - Xilinx 416 - Rename the IPI CRC checksum macro 417 - Use fno-jump-tables flag in CPPFLAGS 418 - Xilinx versal 419 - Added the IPI CRC checksum macro support 420 - Mark IPI calls secure/non-secure 421 - Enable sgi to communicate with linux using IPI 422 - Remove Cortex-A53 compilation 423 - Xilinx ZynqMP 424 - Configure counter frequency during initialization 425 - Filter errors related to clock gate permissions 426 - Implement pinctrl request/release EEMI API 427 - Reimplement pinctrl get/set config parameter EEMI API calls 428 - Reimplement pinctrl set/get function EEMI API 429 - Update error codes to match Linux and PMU Firmware 430 - Update PM version and support PM version check 431 - Update return type in query functions 432 - Added missing ids for 43/46/47dr devices 433 - Checked for DLL status before doing reset 434 - Disable ITAPDLYENA bit for zero ITAP delay 435 - Include GICv2 makefile 436 - Remove the custom crash implementation 437 438- Services 439 440 - SPMD 441 - Lock the g_spmd_pm structure 442 - Declare third cactus instance as UP SP 443 - Provide number of vCPUs and VM size for first SP 444 - Remove `chosen` node from SPMC manifests 445 - Move OP-TEE SP manifest DTS to FVP platform 446 - Update OP-TEE SP manifest with device-regions node 447 - Remove device-memory node from SPMC manifests 448 - SPM_MM 449 - Use sp_boot_info to set SP context 450 - SDEI 451 - Updata the affinity of shared event 452 453- Tools 454 455 - FIPtool 456 - Do not print duplicate verbose lines about building fiptool 457 - CertCreate 458 - Updated tool for platform defined certs, keys & extensions 459 - Create only requested certificates 460 - Avoid duplicates in extension stack 461 462### Resolved Issues 463 464- Several fixes for typos and mis-spellings in documentation 465 466- Build system 467 468 - Fixed \$\{FIP_NAME} to be rebuilt only when needed in Makefile 469 - Do not mark file targets as .PHONY target in Makefile 470 471- Drivers 472 473 - Authorization 474 - Avoid NV counter upgrade without certificate validation 475 - Arm GICv3 476 - Fixed logical issue for num_eints 477 - Limit SPI ID to avoid misjudgement in GICD_OFFSET() 478 - Fixed potential GICD context override with ESPI enabled 479 - Marvell A3700 480 - Fixed configuring polarity invert bits 481 - Arm TZC-400 482 - Correct FAIL_CONTROL Privileged bit 483 - Fixed logical error in FILTER_BIT definitions 484 - Renesas rcar 485 - Fixed several coding style violations reported by checkpatch 486 487- Libraries 488 489 - Arch helpers 490 - Fixed assertions in processing dynamic relocations for AArch64 builds 491 - C standard library 492 - Fixed MISRA issues in memset() ABI 493 - RAS 494 - Fixed bug of binary search in RAS interrupt handler 495 496- Platforms 497 498 - Arm 499 - Fixed missing copyrights in arm-gic.h file 500 - Fixed the order of header files in several dts files 501 - Fixed error message printing in board makefile 502 - Fixed bug of overriding the last node in image load helper API 503 - Fixed stdout-path in fdts files of TC0 and N1SDP platforms 504 - Turn ON/OFF redistributor in sync with GIC CPU interface ON/OFF for css 505 platforms 506 - Arm FVP 507 - Fixed Generic Timer interrupt types in platform dts files 508 - Arm Juno 509 - Fixed parallel build issue for romlib config 510 - Arm SGI 511 - Fixed bug in SDEI receive event of RAS handler 512 - Intel Agilex 513 - Fixed PLAT_MAX_PWR_LVL value 514 - Marvell 515 - Fixed SPD handling in dram port 516 - Marvell ARMADA 517 - Fixed TRNG return SMC handling 518 - Fixed the logic used for LD selector mask 519 - Fixed MSS firmware loader for A8K family 520 - ST 521 - Fixed few violations reported by coverity static checks 522 - STM32MP1 523 - Fixed SELFREF_TO_X32 mask in ddr driver 524 - Do not keep mmc_device_info in stack 525 - Correct plat_crash_console_flush() 526 - QEMU SBSA 527 - Fixed memory type of secure NOR flash 528 - QTI 529 - Fixed NUM_APID and REG_APID_MAP() argument in SPMI driver 530 - Intel 531 - Do not keep mmc_device_info in stack 532 - Hisilicon 533 - Do not keep mmc_device_info in stack 534 535- Services 536 537 - EL3 runtime 538 - Fixed the EL2 context save/restore routine by removing EL2 generic timer 539 system registers 540 - Added fix for exception handler in BL31 by synchronizing pending EA using 541 DSB barrier 542 - SPMD 543 - Fixed error codes to use int32_t type 544 - TSPD 545 - Added bug fix in tspd interrupt handling when TSP_NS_INTR_ASYNC_PREEMPT is 546 enabled 547 - TRNG 548 - Fixed compilation errors with -O0 compile option 549 - DebugFS 550 - Checked channel index before calling clone function 551 - PSCI 552 - Fixed limit of 256 CPUs caused by cast to unsigned char 553 - TSP 554 - Fixed compilation erros when built with GCC 11.0.0 toolchain 555 556- Tools 557 558 - FIPtool 559 - Do not call `make clean` for `all` target 560 - CertCreate 561 - Fixed bug to avoid cleaning when building the binary 562 - Used preallocated parts of the HASH struct to avoid leaking HASH struct 563 fields 564 - Free arguments copied with strdup 565 - Free keys after use 566 - Free X509_EXTENSION structures on stack to avoid leaking them 567 - Optimized the code to avoid unnecessary attempts to create non-requested 568 certificates 569 570## 2.4.0 (2020-11-17) 571 572### New Features 573 574- Architecture support 575 - Armv8.6-A 576 - Added support for Armv8.6 Enhanced Counter Virtualization (ECV) 577 - Added support for Armv8.6 Fine Grained Traps (FGT) 578 - Added support for Armv8.6 WFE trap delays 579- Bootloader images 580 - Added support for Measured Boot 581- Build System 582 - Added build option `COT_DESC_IN_DTB` to create Chain of Trust at runtime 583 - Added build option `OPENSSL_DIR` to direct tools to OpenSSL libraries 584 - Added build option `RAS_TRAP_LOWER_EL_ERR_ACCESS` to enable trapping RAS 585 register accesses from EL1/EL2 to EL3 586 - Extended build option `BRANCH_PROTECTION` to support branch target 587 identification 588- Common components 589 - Added support for exporting CPU nodes to the device tree 590 - Added support for single and dual-root Chains of Trust in secure partitions 591- Drivers 592 - Added Broadcom RNG driver 593 - Added Marvell `mg_conf_cm3` driver 594 - Added System Control and Management Interface (SCMI) driver 595 - Added STMicroelectronics ETZPC driver 596 - Arm GICv3 597 - Added support for detecting topology at runtime 598 - Dual Root 599 - Added support for platform certificates 600 - Marvell Cache LLC 601 - Added support for mapping the entire LLC into SRAM 602 - Marvell CCU 603 - Added workaround for erratum 3033912 604 - Marvell CP110 COMPHY 605 - Added support for SATA COMPHY polarity inversion 606 - Added support for USB COMPHY polarity inversion 607 - Added workaround for erratum IPCE_COMPHY-1353 608 - STM32MP1 Clocks 609 - Added `RTC` as a gateable clock 610 - Added support for shifted clock selector bit masks 611 - Added support for using additional clocks as parents 612- Libraries 613 - C standard library 614 - Added support for hexadecimal and pointer format specifiers in `snprint()` 615 - Added assembly alternatives for various library functions 616 - CPU support 617 - Arm Cortex-A53 618 - Added workaround for erratum 1530924 619 - Arm Cortex-A55 620 - Added workaround for erratum 1530923 621 - Arm Cortex-A57 622 - Added workaround for erratum 1319537 623 - Arm Cortex-A76 624 - Added workaround for erratum 1165522 625 - Added workaround for erratum 1791580 626 - Added workaround for erratum 1868343 627 - Arm Cortex-A72 628 - Added workaround for erratum 1319367 629 - Arm Cortex-A77 630 - Added workaround for erratum 1508412 631 - Added workaround for erratum 1800714 632 - Added workaround for erratum 1925769 633 - Arm Neoverse-N1 634 - Added workaround for erratum 1868343 635 - EL3 Runtime 636 - Added support for saving/restoring registers related to nested 637 virtualization in EL2 context switches if the architecture supports it 638 - FCONF 639 - Added support for Measured Boot 640 - Added support for populating Chain of Trust properties 641 - Added support for loading the `fw_config` image 642 - Measured Boot 643 - Added support for event logging 644- Platforms 645 - Added support for Arm Morello 646 - Added support for Arm TC0 647 - Added support for iEi PUZZLE-M801 648 - Added support for Marvell OCTEON TX2 T9130 649 - Added support for MediaTek MT8192 650 - Added support for NXP i.MX 8M Nano 651 - Added support for NXP i.MX 8M Plus 652 - Added support for QTI CHIP SC7180 653 - Added support for STM32MP151F 654 - Added support for STM32MP153F 655 - Added support for STM32MP157F 656 - Added support for STM32MP151D 657 - Added support for STM32MP153D 658 - Added support for STM32MP157D 659 - Arm 660 - Added support for platform-owned SPs 661 - Added support for resetting to BL31 662 - Arm FPGA 663 - Added support for Klein 664 - Added support for Matterhorn 665 - Added support for additional CPU clusters 666 - Arm FVP 667 - Added support for performing SDEI platform setup at runtime 668 - Added support for SMCCC's `SMCCC_ARCH_SOC_ID` command 669 - Added an `id` field under the NV-counter node in the device tree to 670 differentiate between trusted and non-trusted NV-counters 671 - Added support for extracting the clock frequency from the timer node in 672 the device tree 673 - Arm Juno 674 - Added support for SMCCC's `SMCCC_ARCH_SOC_ID` command 675 - Arm N1SDP 676 - Added support for cross-chip PCI-e 677 - Marvell 678 - Added support for AVS reduction 679 - Marvell ARMADA 680 - Added support for twin-die combined memory device 681 - Marvell ARMADA A8K 682 - Added support for DDR with 32-bit bus width (both ECC and non-ECC) 683 - Marvell AP806 684 - Added workaround for erratum FE-4265711 685 - Marvell AP807 686 - Added workaround for erratum 3033912 687 - Nvidia Tegra 688 - Added debug printouts indicating SC7 entry sequence completion 689 - Added support for SDEI 690 - Added support for stack protection 691 - Added support for GICv3 692 - Added support for SMCCC's `SMCCC_ARCH_SOC_ID` command 693 - Nvidia Tegra194 694 - Added support for RAS exception handling 695 - Added support for SPM 696 - NXP i.MX 697 - Added support for SDEI 698 - QEMU SBSA 699 - Added support for the Secure Partition Manager 700 - QTI 701 - Added RNG driver 702 - Added SPMI PMIC arbitrator driver 703 - Added support for SMCCC's `SMCCC_ARCH_SOC_ID` command 704 - STM32MP1 705 - Added support for exposing peripheral interfaces to the non-secure world 706 at runtime 707 - Added support for SCMI clock and reset services 708 - Added support for STM32MP15x CPU revision Z 709 - Added support for SMCCC services in `SP_MIN` 710- Services 711 - Secure Payload Dispatcher 712 - Added a provision to allow clients to retrieve the service UUID 713 - SPMC 714 - Added secondary core endpoint information to the SPMC context structure 715 - SPMD 716 - Added support for booting OP-TEE as a guest S-EL1 Secure Partition on top 717 of Hafnium in S-EL2 718 - Added a provision for handling SPMC messages to register secondary core 719 entry points 720 - Added support for power management operations 721- Tools 722 - CertCreate 723 - Added support for secure partitions 724 - CertTool 725 - Added support for the `fw_config` image 726 - FIPTool 727 - Added support for the `fw_config` image 728 729### Changed 730 731- Architecture support 732- Bootloader images 733- Build System 734 - The top-level Makefile now supports building FipTool on Windows 735 - The default value of `KEY_SIZE` has been changed to to 2048 when RSA is in 736 use 737 - The previously-deprecated macro `__ASSEMBLY__` has now been removed 738- Common components 739 - Certain functions that flush the console will no longer return error 740 information 741- Drivers 742 - Arm GIC 743 - Usage of `drivers/arm/gic/common/gic_common.c` has now been deprecated in 744 favour of `drivers/arm/gic/vX/gicvX.mk` 745 - Added support for detecting the presence of a GIC600-AE 746 - Added support for detecting the presence of a GIC-Clayton 747 - Marvell MCI 748 - Now performs link tuning for all MCI interfaces to improve performance 749 - Marvell MoChi 750 - PIDI masters are no longer forced into a non-secure access level when 751 `LLC_SRAM` is enabled 752 - The SD/MMC controllers are now accessible from guest virtual machines 753 - Mbed TLS 754 - Migrated to Mbed TLS v2.24.0 755 - STM32 FMC2 NAND 756 - Adjusted FMC node bindings to include an EBI controller node 757 - STM32 Reset 758 - Added an optional timeout argument to assertion functions 759 - STM32MP1 Clocks 760 - Enabled several additional system clocks during initialization 761- Libraries 762 - C Standard Library 763 - Improved `memset` performance by avoiding single-byte writes 764 - Added optimized assembly variants of `memset` 765 - CPU support 766 - Renamed Cortex-Hercules to Cortex-A78 767 - Renamed Cortex-Hercules AE to Cortex-A78 AE 768 - Renamed Neoverse Zeus to Neoverse V1 769 - Coreboot 770 - Updated ‘coreboot_get_memory_type’ API to take an extra argument as a 771 ’memory size’ that used to return a valid memory type. 772 - libfdt 773 - Updated to latest upstream version 774- Platforms 775 - Allwinner 776 - Disabled non-secure access to PRCM power control registers 777 - Arm 778 - `BL32_BASE` is now platform-dependent when `SPD_spmd` is enabled 779 - Added support for loading the Chain of Trust from the device tree 780 - The firmware update check is now executed only once 781 - NV-counter base addresses are now loaded from the device tree when 782 `COT_DESC_IN_DTB` is enabled 783 - Now loads and populates `fw_config` and `tb_fw_config` 784 - FCONF population now occurs after caches have been enabled in order to 785 reduce boot times 786 - Arm Corstone-700 787 - Platform support has been split into both an FVP and an FPGA variant 788 - Arm FPGA 789 - DTB and BL33 load addresses have been given sensible default values 790 - Now reads generic timer counter frequency, GICD and GICR base addresses, 791 and UART address from DT 792 - Now treats the primary PL011 UART as an SBSA Generic UART 793 - Arm FVP 794 - Secure interrupt descriptions, UART parameters, clock frequencies and 795 GICv3 parameters are now queried through FCONF 796 - UART parameters are now queried through the device tree 797 - Added an owner field to Cactus secure partitions 798 - Increased the maximum size of BL2 when the Chain of Trust is loaded from 799 the device tree 800 - Reduces the maximum size of BL31 801 - The `FVP_USE_SP804_TIMER` and `FVP_VE_USE_SP804_TIMER` build options have 802 been removed in favour of a common `USE_SP804_TIMER` option 803 - Added a third Cactus partition to manifests 804 - Device tree nodes now store UUIDs in big-endian 805 - Arm Juno 806 - Increased the maximum size of BL2 when optimizations have not been applied 807 - Reduced the maximum size of BL31 and BL32 808 - Marvell AP807 809 - Enabled snoop filters 810 - Marvell ARMADA A3K 811 - UART recovery images are now suffixed with `.bin` 812 - Marvell ARMADA A8K 813 - Option `BL31_CACHE_DISABLE` is now disabled (`0`) by default 814 - Nvidia Tegra 815 - Added VPR resize supported check when processing video memory resize 816 requests 817 - Added SMMU verification to prevent potential issues caused by undetected 818 corruption of the SMMU configuration during boot 819 - The GIC CPU interface is now properly disabled after CPU off 820 - The GICv2 sources list and the `BL31_SIZE` definition have been made 821 platform-specific 822 - The SPE driver will no longer flush the console when writing individual 823 characters 824 - Nvidia Tegra194 825 - TZDRAM setup has been moved to platform-specific early boot handlers 826 - Increased verbosity of debug prints for RAS SErrors 827 - Support for powering down CPUs during CPU suspend has been removed 828 - Now verifies firewall settings before using resources 829 - TI K3 830 - The UART number has been made configurable through `K3_USART` 831 - Rockchip RK3368 832 - The maximum number of memory map regions has been increased to 20 833 - Socionext Uniphier 834 - The maximum size of BL33 has been increased to support larger bootloaders 835 - STM32 836 - Removed platform-specific DT functions in favour of using existing generic 837 alternatives 838 - STM32MP1 839 - Increased verbosity of exception reports in debug builds 840 - Device trees have been updated to align with the Linux kernel 841 - Now uses the ETZPC driver to configure secure-aware interfaces for 842 assignment to the non-secure world 843 - Finished good variants have been added to the board identifier 844 enumerations 845 - Non-secure access to clocks and reset domains now depends on their state 846 of registration 847 - NEON is now disabled in `SP_MIN` 848 - The last page of `SYSRAM` is now used as SCMI shared memory 849 - Checks to verify platform compatibility have been added to verify that an 850 image is compatible with the chip ID of the running platform 851 - QEMU SBSA 852 - Removed support for Arm's Cortex-A53 853- Services 854 - Renamed SPCI to FF-A 855 - SPMD 856 - No longer forwards requests to the non-secure world when retrieving 857 partition information 858 - SPMC manifest size is now retrieved directly from SPMD instead of the 859 device tree 860 - The FF-A version handler now returns SPMD's version when the origin of the 861 call is secure, and SPMC's version when the origin of the call is 862 non-secure 863 - SPMC 864 - Updated the manifest to declare CPU nodes in descending order as per the 865 SPM (Hafnium) multicore requirement 866 - Updated the device tree to mark 2GB as device memory for the first 867 partition excluding trusted DRAM region (which is reserved for SPMC) 868 - Increased the number of EC contexts to the maximum number of PEs as per 869 the FF-A specification 870- Tools 871 - FIPTool 872 - Now returns `0` on `help` and `help <command>` 873 - Marvell DoImage 874 - Updated Mbed TLS support to v2.8 875 - SPTool 876 - Now appends CertTool arguments 877 878### Resolved Issues 879 880- Bootloader images 881 - Fixed compilation errors for dual-root Chains of Trust caused by symbol 882 collision 883 - BL31 884 - Fixed compilation errors on platforms with fewer than 4 cores caused by 885 initialization code exceeding the end of the stacks 886 - Fixed compilation errors when building a position-independent image 887- Build System 888 - Fixed invalid empty version strings 889 - Fixed compilation errors on Windows caused by a non-portable architecture 890 revision comparison 891- Drivers 892 - Arm GIC 893 - Fixed spurious interrupts caused by a missing barrier 894 - STM32 Flexible Memory Controller 2 (FMC2) NAND driver 895 - Fixed runtime instability caused by incorrect error detection logic 896 - STM32MP1 Clock driver 897 - Fixed incorrectly-formatted log messages 898 - Fixed runtime instability caused by improper clock gating procedures 899 - STMicroelectronics Raw NAND driver 900 - Fixed runtime instability caused by incorrect unit conversion when waiting 901 for NAND readiness 902- Libraries 903 - AMU 904 - Fixed timeout errors caused by excess error logging 905 - EL3 Runtime 906 - Fixed runtime instability caused by improper register save/restore routine 907 in EL2 908 - FCONF 909 - Fixed failure to initialize GICv3 caused by overly-strict device tree 910 requirements 911 - Measured Boot 912 - Fixed driver errors caused by a missing default value for the `HASH_ALG` 913 build option 914 - SPE 915 - Fixed feature detection check that prevented CPUs supporting SVE from 916 detecting support for SPE in the non-secure world 917 - Translation Tables 918 - Fixed various MISRA-C 2012 static analysis violations 919- Platforms 920 - Allwinner A64 921 - Fixed USB issues on certain battery-powered device caused by improperly 922 activated USB power rail 923 - Arm 924 - Fixed compilation errors caused by increase in BL2 size 925 - Fixed compilation errors caused by missing Makefile dependencies to 926 generated files when building the FIP 927 - Fixed MISRA-C 2012 static analysis violations caused by unused structures 928 in include directives intended to be feature-gated 929 - Arm FPGA 930 - Fixed initialization issues caused by incorrect MPIDR topology mapping 931 logic 932 - Arm RD-N1-edge 933 - Fixed compilation errors caused by mismatched parentheses in Makefile 934 - Arm SGI 935 - Fixed crashes due to the flash memory used for cold reboot attack 936 protection not being mapped 937 - Intel Agilex 938 - Fixed initialization issues caused by several compounding bugs 939 - Marvell 940 - Fixed compilation warnings caused by multiple Makefile inclusions 941 - Marvell ARMADA A3K 942 - Fixed boot issue in debug builds caused by checks on the BL33 load address 943 that are not appropriate for this platform 944 - Nvidia Tegra 945 - Fixed incorrect delay timer reads 946 - Fixed spurious interrupts in the non-secure world during cold boot caused 947 by the arbitration bit in the memory controller not being cleared 948 - Fixed faulty video memory resize sequence 949 - Nvidia Tegra194 950 - Fixed incorrect alignment of TZDRAM base address 951 - NXP iMX8M 952 - Fixed CPU hot-plug issues caused by race condition 953 - STM32MP1 954 - Fixed compilation errors in highly-parallel builds caused by incorrect 955 Makefile dependencies 956 - STM32MP157C-ED1 957 - Fixed initialization issues caused by missing device tree hash node 958 - Raspberry Pi 3 959 - Fixed compilation errors caused by incorrect dependency ordering in 960 Makefile 961 - Rockchip 962 - Fixed initialization issues caused by non-critical errors when parsing FDT 963 being treated as critical 964 - Rockchip RK3368 965 - Fixed runtime instability caused by incorrect CPUID shift value 966 - QEMU 967 - Fixed compilation errors caused by incorrect dependency ordering in 968 Makefile 969 - QEMU SBSA 970 - Fixed initialization issues caused by FDT exceeding reserved memory size 971 - QTI 972 - Fixed compilation errors caused by inclusion of a non-existent file 973- Services 974 - FF-A (previously SPCI) 975 - Fixed SPMD aborts caused by incorrect behaviour when the manifest is 976 page-aligned 977- Tools 978 - Fixed compilation issues when compiling tools from within their respective 979 directories 980 - FIPTool 981 - Fixed command line parsing issues on Windows when using arguments whose 982 names also happen to be a subset of another's 983 - Marvell DoImage 984 - Fixed PKCS signature verification errors at boot on some platforms caused 985 by generation of misaligned images 986 987### Known Issues 988 989- Platforms 990 - NVIDIA Tegra 991 - Signed comparison compiler warnings occurring in libfdt are currently 992 being worked around by disabling the warning for the platform until the 993 underlying issue is resolved in libfdt 994 995## 2.3 (2020-04-20) 996 997### New Features 998 999- Arm Architecture 1000 - Add support for Armv8.4-SecEL2 extension through the SPCI defined SPMD/SPMC 1001 components. 1002 - Build option to support EL2 context save and restore in the secure world 1003 (CTX_INCLUDE_EL2_REGS). 1004 - Add support for SMCCC v1.2 (introducing the new SMCCC_ARCH_SOC_ID SMC). Note 1005 that the support is compliant, but the SVE registers save/restore will be 1006 done as part of future S-EL2/SPM development. 1007- BL-specific 1008 - Enhanced BL2 bootloader flow to load secure partitions based on firmware 1009 configuration data (fconf). 1010 - Changes necessary to support SEPARATE_NOBITS_REGION feature 1011 - TSP and BL2_AT_EL3: Add Position Independent Execution `PIE` support 1012- Build System 1013 - Add support for documentation build as a target in Makefile 1014 - Add `COT` build option to select the Chain of Trust to use when the Trusted 1015 Boot feature is enabled (default: `tbbr`). 1016 - Added creation and injection of secure partition packages into the FIP. 1017 - Build option to support SPMC component loading and run at S-EL1 or S-EL2 1018 (SPMD_SPM_AT_SEL2). 1019 - Enable MTE support 1020 - Enable Link Time Optimization in GCC 1021 - Enable -Wredundant-decls warning check 1022 - Makefile: Add support to optionally encrypt BL31 and BL32 1023 - Add support to pass the nt_fw_config DTB to OP-TEE. 1024 - Introduce per-BL `CPPFLAGS`, `ASFLAGS`, and `LDFLAGS` 1025 - build_macros: Add CREATE_SEQ function to generate sequence of numbers 1026- CPU Support 1027 - cortex-a57: Enable higher performance non-cacheable load forwarding 1028 - Hercules: Workaround for Errata 1688305 1029 - Klein: Support added for Klein CPU 1030 - Matterhorn: Support added for Matterhorn CPU 1031- Drivers 1032 - auth: Add `calc_hash` function for hash calculation. Used for authentication 1033 of images when measured boot is enabled. 1034 - cryptocell: Add authenticated decryption framework, and support for 1035 CryptoCell-713 and CryptoCell-712 RSA 3K 1036 - gic600: Add support for multichip configuration and Clayton 1037 - gicv3: Introduce makefile, Add extended PPI and SPI range, Add support for 1038 probing multiple GIC Redistributor frames 1039 - gicv4: Add GICv4 extension for GIC driver 1040 - io: Add an IO abstraction layer to load encrypted firmwares 1041 - mhu: Derive doorbell base address 1042 - mtd: Add SPI-NOR, SPI-NAND, SPI-MEM, and raw NAND framework 1043 - scmi: Allow use of multiple SCMI channels 1044 - scu: Add a driver for snoop control unit 1045- Libraries 1046 - coreboot: Add memory range parsing and use generic base address 1047 - compiler_rt: Import popcountdi2.c and popcountsi2.c files, aeabi_ldivmode.S 1048 file and dependencies 1049 - debugFS: Add DebugFS functionality 1050 - el3_runtime: Add support for enabling S-EL2 1051 - fconf: Add Firmware Configuration Framework (fconf) (experimental). 1052 - libc: Add memrchr function 1053 - locks: bakery: Use is_dcache_enabled() helper and add a DMB to the 1054 'read_cache_op' macro 1055 - psci: Add support to enable different personality of the same soc. 1056 - xlat_tables_v2: Add support to pass shareability attribute for normal memory 1057 region, use get_current_el_maybe_constant() in is_dcache_enabled(), 1058 read-only xlat tables for BL31 memory, and add enable_mmu() 1059- New Platforms Support 1060 - arm/arm_fpga: New platform support added for FPGA 1061 - arm/rddaniel: New platform support added for rd-daniel platform 1062 - brcm/stingray: New platform support added for Broadcom stingray platform 1063 - nvidia/tegra194: New platform support for Nvidia Tegra194 platform 1064- Platforms 1065 - allwinner: Implement PSCI system suspend using SCPI, add a msgbox driver for 1066 use with SCPI, and reserve and map space for the SCP firmware 1067 - allwinner: axp: Add AXP805 support 1068 - allwinner: power: Add DLDO4 power rail 1069 - amlogic: axg: Add a build flag when using ATOS as BL32 and support for the 1070 A113D (AXG) platform 1071 - arm/a5ds: Add ethernet node and L2 cache node in devicetree 1072 - arm/common: Add support for the new `dualroot` chain of trust 1073 - arm/common: Add support for SEPARATE_NOBITS_REGION 1074 - arm/common: Re-enable PIE when RESET_TO_BL31=1 1075 - arm/common: Allow boards to specify second DRAM Base address and to define 1076 PLAT_ARM_TZC_FILTERS 1077 - arm/corstone700: Add support for mhuv2 and stack protector 1078 - arm/fvp: Add support for fconf in BL31 and SP_MIN. Populate power domain 1079 descriptor dynamically by leveraging fconf APIs. 1080 - arm/fvp: Add Cactus/Ivy Secure Partition information and use two instances 1081 of Cactus at S-EL1 1082 - arm/fvp: Add support to run BL32 in TDRAM and BL31 in secure DRAM 1083 - arm/fvp: Add support for GICv4 extension and BL2 hash calculation in BL1 1084 - arm/n1sdp: Setup multichip gic routing table, update platform macros for 1085 dual-chip setup, introduce platform information SDS region, add support to 1086 update presence of External LLC, and enable the NEOVERSE_N1_EXTERNAL_LLC 1087 flag 1088 - arm/rdn1edge: Add support for dual-chip configuration and use CREATE_SEQ 1089 helper macro to compare chip count 1090 - arm/sgm: Always use SCMI for SGM platforms 1091 - arm/sgm775: Add support for dynamic config using fconf 1092 - arm/sgi: Add multi-chip mode parameter in HW_CONFIG dts, macros for remote 1093 chip device region, chip_id and multi_chip_mode to platform variant info, 1094 and introduce number of chips macro 1095 - brcm: Add BL2 and BL31 support common across Broadcom platforms 1096 - brcm: Add iproc SPI Nor flash support, spi driver, emmc driver, and support 1097 to retrieve plat_toc_flags 1098 - hisilicon: hikey960: Enable system power off callback 1099 - intel: Enable bridge access, SiP SMC secure register access, and uboot 1100 entrypoint support 1101 - intel: Implement platform specific system reset 2 1102 - intel: Introduce mailbox response length handling 1103 - imx: console: Use CONSOLE_T_BASE for UART base address and generic console_t 1104 data structure 1105 - imx8mm: Provide uart base as build option and add the support for opteed spd 1106 on imx8mq/imx8mm 1107 - imx8qx: Provide debug uart num as build 1108 - imx8qm: Apply clk/pinmux configuration for DEBUG_CONSOLE and provide debug 1109 uart num as build param 1110 - marvell: a8k: Implement platform specific power off and add support for 1111 loading MG CM3 images 1112 - mediatek: mt8183: Add Vmodem/Vcore DVS init level 1113 - qemu: Support optional encryption of BL31 and BL32 images and 1114 ARM_LINUX_KERNEL_AS_BL33 to pass FDT address 1115 - qemu: Define ARMV7_SUPPORTS_VFP 1116 - qemu: Implement PSCI_CPU_OFF and qemu_system_off via semihosting 1117 - renesas: rcar_gen3: Add new board revision for M3ULCB 1118 - rockchip: Enable workaround for erratum 855873, claim a macro to enable hdcp 1119 feature for DP, enable power domains of rk3399 before reset, add support for 1120 UART3 as serial output, and initialize reset and poweroff GPIOs with known 1121 invalid value 1122 - rpi: Implement PSCI CPU_OFF, use MMIO accessor, autodetect Mini-UART vs. 1123 PL011 configuration, and allow using PL011 UART for RPi3/RPi4 1124 - rpi3: Include GPIO driver in all BL stages and use same "clock-less" setup 1125 scheme as RPi4 1126 - rpi3/4: Add support for offlining CPUs 1127 - st: stm32mp1: platform.mk: Support generating multiple images in one build, 1128 migrate to implicit rules, derive map file name from target name, generate 1129 linker script with fixed name, and use PHONY for the appropriate targets 1130 - st: stm32mp1: Add support for SPI-NOR, raw NAND, and SPI-NAND boot device, 1131 QSPI, FMC2 driver 1132 - st: stm32mp1: Use stm32mp_get_ddr_ns_size() function, set XN attribute for 1133 some areas in BL2, dynamically map DDR later and non-cacheable during its 1134 test, add a function to get non-secure DDR size, add DT helper for reg by 1135 name, and add compilation flags for boot devices 1136 - socionext: uniphier: Turn on ENABLE_PIE 1137 - ti: k3: Add PIE support 1138 - xilinx: versal: Add set wakeup source, client wakeup, query data, request 1139 wakeup, PM_INIT_FINALIZE, PM_GET_TRUSTZONE_VERSION, PM IOCTL, support for 1140 suspend related, and Get_ChipID APIs 1141 - xilinx: versal: Implement power down/restart related EEMI, SMC handler for 1142 EEMI, PLL related PM, clock related PM, pin control related PM, reset 1143 related PM, device related PM , APIs 1144 - xilinx: versal: Enable ipi mailbox service 1145 - xilinx: versal: Add get_api_version support and support to send PM API to 1146 PMC using IPI 1147 - xilinx: zynqmp: Add checksum support for IPI data, GET_CALLBACK_DATA 1148 function, support to query max divisor, CLK_SET_RATE_PARENT in gem clock 1149 node, support for custom type flags, LPD WDT clock to the pm_clock 1150 structure, idcodes for new RFSoC silicons ZU48DR and ZU49DR, and id for new 1151 RFSoC device ZU39DR 1152- Security 1153 - Use Speculation Barrier instruction for v8.5+ cores 1154 - Add support for optional firmware encryption feature (experimental). 1155 - Introduce a new `dualroot` chain of trust. 1156 - aarch64: Prevent speculative execution past ERET 1157 - aarch32: Stop speculative execution past exception returns. 1158- SPCI 1159 - Introduced the Secure Partition Manager Dispatcher (SPMD) component as a new 1160 standard service. 1161- Tools 1162 - cert_create: Introduce CoT build option and TBBR CoT makefile, and define 1163 the dualroot CoT 1164 - encrypt_fw: Add firmware authenticated encryption tool 1165 - memory: Add show_memory script that prints a representation of the memory 1166 layout for the latest build 1167 1168### Changed 1169 1170- Arm Architecture 1171 - PIE: Make call to GDT relocation fixup generalized 1172- BL-Specific 1173 - Increase maximum size of BL2 image 1174 - BL31: Discard .dynsym .dynstr .hash sections to make ENABLE_PIE work 1175 - BL31: Split into two separate memory regions 1176 - Unify BL linker scripts and reduce code duplication. 1177- Build System 1178 - Changes to drive cert_create for dualroot CoT 1179 - Enable -Wlogical-op always 1180 - Enable -Wshadow always 1181 - Refactor the warning flags 1182 - PIE: Pass PIE options only to BL31 1183 - Reduce space lost to object alignment 1184 - Set lld as the default linker for Clang builds 1185 - Remove -Wunused-const-variable and -Wpadded warning 1186 - Remove -Wmissing-declarations warning from WARNING1 level 1187- Drivers 1188 - authentication: Necessary fix in drivers to upgrade to mbedtls-2.18.0 1189 - console: Integrate UART base address in generic console_t 1190 - gicv3: Change API for GICR_IPRIORITYR accessors and separate GICD and GICR 1191 accessor functions 1192 - io: Change seek offset to signed long long and panic in case of io setup 1193 failure 1194 - smmu: SMMUv3: Changed retry loop to delay timer 1195 - tbbr: Reduce size of hash and ECDSA key buffers when possible 1196- Library Code 1197 - libc: Consolidate the size_t, unified, and NULL definitions, and unify 1198 intmax_t and uintmax_t on AArch32/64 1199 - ROMLIB: Optimize memory layout when ROMLIB is used 1200 - xlat_tables_v2: Use ARRAY_SIZE in REGISTER_XLAT_CONTEXT_FULL_SPEC, merge 1201 REGISTER_XLAT_CONTEXT\_{FULL_SPEC,RO_BASE_TABLE}, and simplify end address 1202 checks in mmap_add_region_check() 1203- Platforms 1204 - allwinner: Adjust SRAM A2 base to include the ARISC vectors, clean up MMU 1205 setup, reenable USE_COHERENT_MEM, remove unused include path, move the 1206 NOBITS region to SRAM A1, convert AXP803 regulator setup code into a driver, 1207 enable clock before resetting I2C/RSB 1208 - allwinner: h6: power: Switch to using the AXP driver 1209 - allwinner: a64: power: Use fdt_for_each_subnode, remove obsolete register 1210 check, remove duplicate DT check, and make sunxi_turn_off_soc static 1211 - allwinner: Build PMIC bus drivers only in BL31, clean up PMIC-related error 1212 handling, and synchronize PMIC enumerations 1213 - arm/a5ds: Change boot address to point to DDR address 1214 - arm/common: Check for out-of-bound accesses in the platform io policies 1215 - arm/corstone700: Updating the kernel arguments to support initramfs, use 1216 fdts DDR memory and XIP rootfs, and set UART clocks to 32MHz 1217 - arm/fvp: Modify multithreaded dts file of DynamIQ FVPs, slightly bump the 1218 stack size for bl1 and bl2, remove re-definition of topology related build 1219 options, stop reclaiming init code with Clang builds, and map only the 1220 needed DRAM region statically in BL31/SP_MIN 1221 - arm/juno: Maximize space allocated to SCP_BL2 1222 - arm/sgi: Bump bl1 RW limit, mark remote chip shared ram as non-cacheable, 1223 move GIC related constants to board files, include AFF3 affinity in core 1224 position calculation, move bl31_platform_setup to board file, and move 1225 topology information to board folder 1226 - common: Refactor load_auth_image_internal(). 1227 - hisilicon: Remove uefi-tools in hikey and hikey960 documentation 1228 - intel: Modify non secure access function, BL31 address mapping, mailbox's 1229 get_config_status, and stratix10 BL31 parameter handling 1230 - intel: Remove un-needed checks for qspi driver r/w and s10 unused source 1231 code 1232 - intel: Change all global sip function to static 1233 - intel: Refactor common platform code 1234 - intel: Create SiP service header file 1235 - marvell: armada: scp_bl2: Allow loading up to 8 images 1236 - marvell: comphy-a3700: Support SGMII COMPHY power off and fix USB3 powering 1237 on when on lane 2 1238 - marvell: Consolidate console register calls 1239 - mediatek: mt8183: Protect 4GB~8GB dram memory, refine GIC driver for low 1240 power scenarios, and switch PLL/CLKSQ/ck_off/axi_26m control to SPM 1241 - qemu: Update flash address map to keep FIP in secure FLASH0 1242 - renesas: rcar_gen3: Update IPL and Secure Monitor Rev.2.0.6, update DDR 1243 setting for H3, M3, M3N, change fixed destination address of BL31 and BL32, 1244 add missing #{address,size}-cells into generated DT, pass DT to OpTee OS, 1245 and move DDR drivers out of staging 1246 - rockchip: Make miniloader ddr_parameter handling optional, cleanup securing 1247 of ddr regions, move secure init to separate file, use base+size for secure 1248 ddr regions, bring TZRAM_SIZE values in lined, and prevent macro expansion 1249 in paths 1250 - rpi: Move plat_helpers.S to common 1251 - rpi3: gpio: Simplify GPIO setup 1252 - rpi4: Skip UART initialisation 1253 - st: stm32m1: Use generic console_t data structure, remove second QSPI flash 1254 instance, update for FMC2 pin muxing, and reduce MAX_XLAT_TABLES to 4 1255 - socionext: uniphier: Make on-chip SRAM and I/O register regions configurable 1256 - socionext: uniphier: Make PSCI related, counter control, UART, pinmon, NAND 1257 controller, and eMMC controller base addresses configurable 1258 - socionext: uniphier: Change block_addressing flag and the return value type 1259 of .is_usb_boot() to bool 1260 - socionext: uniphier: Run BL33 at EL2, call uniphier_scp_is_running() only 1261 when on-chip STM is supported, define PLAT_XLAT_TABLES_DYNAMIC only for BL2, 1262 support read-only xlat tables, use enable_mmu() in common function, shrink 1263 UNIPHIER_ROM_REGION_SIZE, prepare uniphier_soc_info() for next SoC, extend 1264 boot device detection for future SoCs, make all BL images completely 1265 position-independent, make uniphier_mmap_setup() work with PIE, pass SCP 1266 base address as a function parameter, set buffer offset and length for 1267 io_block dynamically, and use more mmap_add_dynamic_region() for loading 1268 images 1269 - spd/trusty: Disable error messages seen during boot, allow gic base to be 1270 specified with GICD_BASE, and allow getting trusty memsize from 1271 BL32_MEM_SIZE instead of TSP_SEC_MEM_SIZE 1272 - ti: k3: common: Enable ARM cluster power down and rename device IDs to be 1273 more consistent 1274 - ti: k3: drivers: ti_sci: Put sequence number in coherent memory and remove 1275 indirect structure of const data 1276 - xilinx: Move ipi mailbox svc to xilinx common 1277 - xilinx: zynqmp: Use GIC framework for warm restart 1278 - xilinx: zynqmp: pm: Move custom clock flags to typeflags, remove 1279 CLK_TOPSW_LSBUS from invalid clock list and rename FPD WDT clock ID 1280 - xilinx: versal: Increase OCM memory size for DEBUG builds and adjust cpu 1281 clock, Move versal_def.h and versal_private to include directory 1282- Tools 1283 - sptool: Updated sptool to accommodate building secure partition packages. 1284 1285### Resolved Issues 1286 1287- Arm Architecture 1288 - Fix crash dump for lower EL 1289- BL-Specific 1290 - Bug fix: Protect TSP prints with lock 1291 - Fix boot failures on some builds linked with ld.lld. 1292- Build System 1293 - Fix clang build if CC is not in the path. 1294 - Fix 'BL stage' comment for build macros 1295- Code Quality 1296 - coverity: Fix various MISRA violations including null pointer violations, C 1297 issues in BL1/BL2/BL31 and FDT helper functions, using boolean essential, 1298 type, and removing unnecessary header file and comparisons to LONG_MAX in 1299 debugfs devfip 1300 - Based on coding guidelines, replace all `unsigned long` depending on if 1301 fixed based on AArch32 or AArch64. 1302 - Unify type of "cpu_idx" and Platform specific defines across PSCI module. 1303- Drivers 1304 - auth: Necessary fix in drivers to upgrade to mbedtls-2.18.0 1305 - delay_timer: Fix non-standard frequency issue in udelay 1306 - gicv3: Fix compiler dependent behavior 1307 - gic600: Fix include ordering according to the coding style and power up 1308 sequence 1309- Library Code 1310 - el3_runtime: Fix stack pointer maintenance on EA handling path, fixup 1311 'cm_setup_context' prototype, and adds TPIDR_EL2 register to the context 1312 save restore routines 1313 - libc: Fix SIZE_MAX on AArch32 1314 - locks: T589: Fix insufficient ordering guarantees in bakery lock 1315 - pmf: Fix 'tautological-constant-compare' error, Make the runtime 1316 instrumentation work on AArch32, and Simplify PMF helper macro definitions 1317 across header files 1318 - xlat_tables_v2: Fix assembler warning of PLAT_RO_XLAT_TABLES 1319- Platforms 1320 - allwinner: Fix H6 GPIO and CCU memory map addresses and incorrect ARISC code 1321 patch offset check 1322 - arm/a5ds: Correct system freq and Cache Writeback Granule, and cleanup 1323 enable-method in devicetree 1324 - arm/fvp: Fix incorrect GIC mapping, BL31 load address and image size for 1325 RESET_TO_BL31=1, topology description of cpus for DynamIQ based FVP, and 1326 multithreaded FVP power domain tree 1327 - arm/fvp: spm-mm: Correcting instructions to build SPM for FVP 1328 - arm/common: Fix ROTPK hash generation for ECDSA encryption, BL2 bug in 1329 dynamic configuration initialisation, and current RECLAIM_INIT_CODE behavior 1330 - arm/rde1edge: Fix incorrect topology tree description 1331 - arm/sgi: Fix the incorrect check for SCMI channel ID 1332 - common: Flush dcache when storing timestamp 1333 - intel: Fix UEFI decompression issue, memory calibration, SMC SIP service, 1334 mailbox config return status, mailbox driver logic, FPGA manager on 1335 reconfiguration, and mailbox send_cmd issue 1336 - imx: Fix shift-overflow errors, the rdc memory region slot's offset, 1337 multiple definition of ipc_handle, missing inclusion of cdefs.h, and correct 1338 the SGIs that used for secure interrupt 1339 - mediatek: mt8183: Fix AARCH64 init fail on CPU0 1340 - rockchip: Fix definition of struct param_ddr_usage 1341 - rpi4: Fix documentation of armstub config entry 1342 - st: Correct io possible NULL pointer dereference and device_size type, nand 1343 xor_ecc.val assigned value, static analysis tool issues, and fix incorrect 1344 return value and correctly check pwr-regulators node 1345 - xilinx: zynqmp: Correct syscnt freq for QEMU and fix clock models and IDs of 1346 GEM-related clocks 1347 1348### Known Issues 1349 1350- Build System 1351 - dtb: DTB creation not supported when building on a Windows host. 1352 1353 This step in the build process is skipped when running on a Windows host. A 1354 known issue from the 1.6 release. 1355 1356 - Intermittent assertion firing `ASSERT: services/spd/tspd/tspd_main.c:105` 1357- Coverity 1358 - Intermittent Race condition in Coverity Jenkins Build Job 1359- Platforms 1360 - arm/juno: System suspend from Linux does not function as documented in the 1361 user guide 1362 1363 Following the instructions provided in the user guide document does not 1364 result in the platform entering system suspend state as expected. A message 1365 relating to the hdlcd driver failing to suspend will be emitted on the Linux 1366 terminal. 1367 1368 - mediatek/mt6795: This platform does not build in this release 1369 1370## 2.2 (2019-10-22) 1371 1372### New Features 1373 1374- Architecture 1375 - Enable Pointer Authentication (PAuth) support for Secure World 1376 1377 - Adds support for ARMv8.3-PAuth in BL1 SMC calls and BL2U image for 1378 firmware updates. 1379 1380 - Enable Memory Tagging Extension (MTE) support in both secure and non-secure 1381 worlds 1382 1383 - Adds support for the new Memory Tagging Extension arriving in ARMv8.5. MTE 1384 support is now enabled by default on systems that support it at EL0. 1385 - To enable it at ELx for both the non-secure and the secure world, the 1386 compiler flag `CTX_INCLUDE_MTE_REGS` includes register saving and 1387 restoring when necessary in order to prevent information leakage between 1388 the worlds. 1389 1390 - Add support for Branch Target Identification (BTI) 1391- Build System 1392 - Modify FVP makefile for CPUs that support both AArch64/32 1393 - AArch32: Allow compiling with soft-float toolchain 1394 - Makefile: Add default warning flags 1395 - Add Makefile check for PAuth and AArch64 1396 - Add compile-time errors for HW_ASSISTED_COHERENCY flag 1397 - Apply compile-time check for AArch64-only CPUs 1398 - build_macros: Add mechanism to prevent bin generation. 1399 - Add support for default stack-protector flag 1400 - spd: opteed: Enable NS_TIMER_SWITCH 1401 - plat/arm: Skip BL2U if RESET_TO_SP_MIN flag is set 1402 - Add new build option to let each platform select which implementation of 1403 spinlocks it wants to use 1404- CPU Support 1405 - DSU: Workaround for erratum 798953 and 936184 1406 - Neoverse N1: Force cacheable atomic to near atomic 1407 - Neoverse N1: Workaround for erratum 1073348, 1130799, 1165347, 1207823, 1408 1220197, 1257314, 1262606, 1262888, 1275112, 1315703, 1542419 1409 - Neoverse Zeus: Apply the MSR SSBS instruction 1410 - cortex-Hercules/HerculesAE: Support added for Cortex-Hercules and 1411 Cortex-HerculesAE CPUs 1412 - cortex-Hercules/HerculesAE: Enable AMU for Cortex-Hercules and 1413 Cortex-HerculesAE 1414 - cortex-a76AE: Support added for Cortex-A76AE CPU 1415 - cortex-a76: Workaround for erratum 1257314, 1262606, 1262888, 1275112, 1416 1286807 1417 - cortex-a65/a65AE: Support added for Cortex-A65 and Cortex-A65AE CPUs 1418 - cortex-a65: Enable AMU for Cortex-A65 1419 - cortex-a55: Workaround for erratum 1221012 1420 - cortex-a35: Workaround for erratum 855472 1421 - cortex-a9: Workaround for erratum 794073 1422- Drivers 1423 - console: Allow the console to register multiple times 1424 1425 - delay: Timeout detection support 1426 1427 - gicv3: Enabled multi-socket GIC redistributor frame discovery and migrated 1428 ARM platforms to the new API 1429 1430 - Adds `gicv3_rdistif_probe` function that delegates the responsibility of 1431 discovering the corresponding redistributor base frame to each CPU itself. 1432 1433 - sbsa: Add SBSA watchdog driver 1434 1435 - st/stm32_hash: Add HASH driver 1436 1437 - ti/uart: Add an AArch32 variant 1438- Library at ROM (romlib) 1439 - Introduce BTI support in Library at ROM (romlib) 1440- New Platforms Support 1441 - amlogic: g12a: New platform support added for the S905X2 (G12A) platform 1442 - amlogic: meson/gxl: New platform support added for Amlogic Meson S905x (GXL) 1443 - arm/a5ds: New platform support added for A5 DesignStart 1444 - arm/corstone: New platform support added for Corstone-700 1445 - intel: New platform support added for Agilex 1446 - mediatek: New platform support added for MediaTek mt8183 1447 - qemu/qemu_sbsa: New platform support added for QEMU SBSA platform 1448 - renesas/rcar_gen3: plat: New platform support added for D3 1449 - rockchip: New platform support added for px30 1450 - rockchip: New platform support added for rk3288 1451 - rpi: New platform support added for Raspberry Pi 4 1452- Platforms 1453 - arm/common: Introduce wrapper functions to setup secure watchdog 1454 - arm/fvp: Add Delay Timer driver to BL1 and BL31 and option for defining 1455 platform DRAM2 base 1456 - arm/fvp: Add Linux DTS files for 32 bit threaded FVPs 1457 - arm/n1sdp: Add code for DDR ECC enablement and BL33 copy to DDR, Initialise 1458 CNTFRQ in Non Secure CNTBaseN 1459 - arm/juno: Use shared mbedtls heap between BL1 and BL2 and add basic support 1460 for dynamic config 1461 - imx: Basic support for PicoPi iMX7D, rdc module init, caam module init, 1462 aipstz init, IMX_SIP_GET_SOC_INFO, IMX_SIP_BUILDINFO added 1463 - intel: Add ncore ccu driver 1464 - mediatek/mt81\*: Use new bl31_params_parse() helper 1465 - nvidia: tegra: Add support for multi console interface 1466 - qemu/qemu_sbsa: Adding memory mapping for both FLASH0/FLASH1 1467 - qemu: Added gicv3 support, new console interface in AArch32, and 1468 sub-platforms 1469 - renesas/rcar_gen3: plat: Add R-Car V3M support, new board revision for 1470 H3ULCB, DBSC4 setting before self-refresh mode 1471 - socionext/uniphier: Support console based on multi-console 1472 - st: stm32mp1: Add OP-TEE, Avenger96, watchdog, LpDDR3, authentication 1473 support and general SYSCFG management 1474 - ti/k3: common: Add support for J721E, Use coherent memory for shared data, 1475 Trap all asynchronous bus errors to EL3 1476 - xilinx/zynqmp: Add support for multi console interface, Initialize IPI table 1477 from zynqmp_config_setup() 1478- PSCI 1479 - Adding new optional PSCI hook `pwr_domain_on_finish_late` 1480 - This PSCI hook `pwr_domain_on_finish_late` is similar to 1481 `pwr_domain_on_finish` but is guaranteed to be invoked when the respective 1482 core and cluster are participating in coherency. 1483- Security 1484 - Speculative Store Bypass Safe (SSBS): Further enhance protection against 1485 Spectre variant 4 by disabling speculative loads/stores (SPSR.SSBS bit) by 1486 default. 1487 - UBSAN support and handlers 1488 - Adds support for the Undefined Behaviour sanitizer. There are two types of 1489 support offered - minimalistic trapping support which essentially 1490 immediately crashes on undefined behaviour and full support with full 1491 debug messages. 1492- Tools 1493 - cert_create: Add support for bigger RSA key sizes (3KB and 4KB), previously 1494 the maximum size was 2KB. 1495 - fiptool: Add support to build fiptool on Windows. 1496 1497### Changed 1498 1499- Architecture 1500 - Refactor ARMv8.3 Pointer Authentication support code 1501 - backtrace: Strip PAC field when PAUTH is enabled 1502 - Prettify crash reporting output on AArch64. 1503 - Rework smc_unknown return code path in smc_handler 1504 - Leverage the existing `el3_exit()` return routine for smc_unknown return 1505 path rather than a custom set of instructions. 1506- BL-Specific 1507 - Invalidate dcache build option for BL2 entry at EL3 1508 - Add missing support for BL2_AT_EL3 in XIP memory 1509- Boot Flow 1510 - Add helper to parse BL31 parameters (both versions) 1511 - Factor out cross-BL API into export headers suitable for 3rd party code 1512 - Introduce lightweight BL platform parameter library 1513- Drivers 1514 - auth: Memory optimization for Chain of Trust (CoT) description 1515 - bsec: Move bsec_mode_is_closed_device() service to platform 1516 - cryptocell: Move Cryptocell specific API into driver 1517 - gicv3: Prevent pending G1S interrupt from becoming G0 interrupt 1518 - mbedtls: Remove weak heap implementation 1519 - mmc: Increase delay between ACMD41 retries 1520 - mmc: stm32_sdmmc2: Correctly manage block size 1521 - mmc: stm32_sdmmc2: Manage max-frequency property from DT 1522 - synopsys/emmc: Do not change FIFO TH as this breaks some platforms 1523 - synopsys: Update synopsys drivers to not rely on undefined overflow 1524 behaviour 1525 - ufs: Extend the delay after reset to wait for some slower chips 1526- Platforms 1527 - amlogic/meson/gxl: Remove BL2 dependency from BL31 1528 - arm/common: Shorten the Firmware Update (FWU) process 1529 - arm/fvp: Remove GIC initialisation from secondary core cold boot 1530 - arm/sgm: Temporarily disable shared Mbed TLS heap for SGM 1531 - hisilicon: Update hisilicon drivers to not rely on undefined overflow 1532 behaviour 1533 - imx: imx8: Replace PLAT_IMX8\* with PLAT_imx8\*, remove duplicated linker 1534 symbols and deprecated code include, keep only IRQ 32 unmasked, enable all 1535 power domain by default 1536 - marvell: Prevent SError accessing PCIe link, Switch to xlat_tables_v2, do 1537 not rely on argument passed via smc, make sure that comphy init will use 1538 correct address 1539 - mediatek: mt8173: Refactor RTC and PMIC drivers 1540 - mediatek: mt8173: Apply MULTI_CONSOLE framework 1541 - nvidia: Tegra: memctrl_v2: fix "overflow before widen" coverity issue 1542 - qemu: Simplify the image size calculation, Move and generalise FDT PSCI 1543 fixup, move gicv2 codes to separate file 1544 - renesas/rcar_gen3: Convert to multi-console API, update QoS setting, Update 1545 IPL and Secure Monitor Rev2.0.4, Change to restore timer counter value at 1546 resume, Update DDR setting rev.0.35, qos: change subslot cycle, Change 1547 periodic write DQ training option. 1548 - rockchip: Allow SOCs with undefined wfe check bits, Streamline and complete 1549 UARTn_BASE macros, drop rockchip-specific imported linker symbols for bl31, 1550 Disable binary generation for all SOCs, Allow console device to be set by 1551 DTB, Use new bl31_params_parse functions 1552 - rpi/rpi3: Move shared rpi3 files into common directory 1553 - socionext/uniphier: Set CONSOLE_FLAG_TRANSLATE_CRLF and clean up console 1554 driver 1555 - socionext/uniphier: Replace DIV_ROUND_UP() with div_round_up() from 1556 utils_def.h 1557 - st/stm32mp: Split stm32mp_io_setup function, move 1558 stm32_get_gpio_bank_clock() to private file, correctly handle Clock 1559 Spreading Generator, move oscillator functions to generic file, realign 1560 device tree files with internal devs, enable RTCAPB clock for dual-core 1561 chips, use a common function to check spinlock is available, move 1562 check_header() to common code 1563 - ti/k3: Enable SEPARATE_CODE_AND_RODATA by default, Remove shared RAM space, 1564 Drop \_ADDRESS from K3_USART_BASE to match other defines, Remove MSMC port 1565 definitions, Allow USE_COHERENT_MEM for K3, Set L2 latency on A72 cores 1566- PSCI 1567 - PSCI: Lookup list of parent nodes to lock only once 1568- Secure Partition Manager (SPM): SPCI Prototype 1569 - Fix service UUID lookup 1570 - Adjust size of virtual address space per partition 1571 - Refactor xlat context creation 1572 - Move shim layer to TTBR1_EL1 1573 - Ignore empty regions in resource description 1574- Security 1575 - Refactor SPSR initialisation code 1576 - SMMUv3: Abort DMA transactions 1577 - For security DMA should be blocked at the SMMU by default unless 1578 explicitly enabled for a device. SMMU is disabled after reset with all 1579 streams bypassing the SMMU, and abortion of all incoming transactions 1580 implements a default deny policy on reset. 1581 - Moves `bl1_platform_setup()` function from arm_bl1_setup.c to FVP 1582 platforms' fvp_bl1_setup.c and fvp_ve_bl1_setup.c files. 1583- Tools 1584 - cert_create: Remove RSA PKCS#1 v1.5 support 1585 1586### Resolved Issues 1587 1588- Architecture 1589 - Fix the CAS spinlock implementation by adding a missing DSB in 1590 `spin_unlock()` 1591 - AArch64: Fix SCTLR bit definitions 1592 - Removes incorrect `SCTLR_V_BIT` definition and adds definitions for 1593 ARMv8.3-Pauth `EnIB`, `EnDA` and `EnDB` bits. 1594 - Fix restoration of PAuth context 1595 - Replace call to `pauth_context_save()` with `pauth_context_restore()` in 1596 case of unknown SMC call. 1597- BL-Specific Issues 1598 - Fix BL31 crash reporting on AArch64 only platforms 1599- Build System 1600 - Remove several warnings reported with W=2 and W=1 1601- Code Quality Issues 1602 - SCTLR and ACTLR are 32-bit for AArch32 and 64-bit for AArch64 1603 - Unify type of "cpu_idx" across PSCI module. 1604 - Assert if power level value greater then PSCI_INVALID_PWR_LVL 1605 - Unsigned long should not be used as per coding guidelines 1606 - Reduce the number of memory leaks in cert_create 1607 - Fix type of cot_desc_ptr 1608 - Use explicit-width data types in AAPCS parameter structs 1609 - Add python configuration for editorconfig 1610 - BL1: Fix type consistency 1611 - Enable -Wshift-overflow=2 to check for undefined shift behavior 1612 - Updated upstream platforms to not rely on undefined overflow behaviour 1613- Coverity Quality Issues 1614 - Remove GGC ignore -Warray-bounds 1615 - Fix Coverity #261967, Infinite loop 1616 - Fix Coverity #343017, Missing unlock 1617 - Fix Coverity #343008, Side affect in assertion 1618 - Fix Coverity #342970, Uninitialized scalar variable 1619- CPU Support 1620 - cortex-a12: Fix MIDR mask 1621- Drivers 1622 - console: Remove Arm console unregister on suspend 1623 - gicv3: Fix support for full SPI range 1624 - scmi: Fix wrong payload length 1625- Library Code 1626 - libc: Fix sparse warning for \_\_assert() 1627 - libc: Fix memchr implementation 1628- Platforms 1629 - rpi: rpi3: Fix compilation error when stack protector is enabled 1630 - socionext/uniphier: Fix compilation fail for SPM support build config 1631 - st/stm32mp1: Fix TZC400 configuration against non-secure DDR 1632 - ti/k3: common: Fix RO data area size calculation 1633- Security 1634 - AArch32: Disable Secure Cycle Counter 1635 - Changes the implementation for disabling Secure Cycle Counter. For ARMv8.5 1636 the counter gets disabled by setting `SDCR.SCCD` bit on CPU cold/warm 1637 boot. For the earlier architectures PMCR register is saved/restored on 1638 secure world entry/exit from/to Non-secure state, and cycle counting gets 1639 disabled by setting PMCR.DP bit. 1640 - AArch64: Disable Secure Cycle Counter 1641 - For ARMv8.5 the counter gets disabled by setting `MDCR_El3.SCCD` bit on 1642 CPU cold/warm boot. For the earlier architectures PMCR_EL0 register is 1643 saved/restored on secure world entry/exit from/to Non-secure state, and 1644 cycle counting gets disabled by setting PMCR_EL0.DP bit. 1645 1646### Deprecations 1647 1648- Common Code 1649 - Remove MULTI_CONSOLE_API flag and references to it 1650 - Remove deprecated `plat_crash_console_*` 1651 - Remove deprecated interfaces `get_afflvl_shift`, `mpidr_mask_lower_afflvls`, 1652 `eret` 1653 - AARCH32/AARCH64 macros are now deprecated in favor of `__aarch64__` 1654 - `__ASSEMBLY__` macro is now deprecated in favor of `__ASSEMBLER__` 1655- Drivers 1656 - console: Removed legacy console API 1657 - console: Remove deprecated finish_console_register 1658 - tzc: Remove deprecated types `tzc_action_t` and `tzc_region_attributes_t` 1659- Secure Partition Manager (SPM): 1660 - Prototype SPCI-based SPM (services/std_svc/spm) will be replaced with 1661 alternative methods of secure partitioning support. 1662 1663### Known Issues 1664 1665- Build System Issues 1666 - dtb: DTB creation not supported when building on a Windows host. 1667 1668 This step in the build process is skipped when running on a Windows host. A 1669 known issue from the 1.6 release. 1670- Platform Issues 1671 - arm/juno: System suspend from Linux does not function as documented in the 1672 user guide 1673 1674 Following the instructions provided in the user guide document does not 1675 result in the platform entering system suspend state as expected. A message 1676 relating to the hdlcd driver failing to suspend will be emitted on the Linux 1677 terminal. 1678 1679 - mediatek/mt6795: This platform does not build in this release 1680 1681## 2.1 (2019-03-29) 1682 1683### New Features 1684 1685- Architecture 1686 1687 - Support for ARMv8.3 pointer authentication in the normal and secure worlds 1688 1689 The use of pointer authentication in the normal world is enabled whenever 1690 architectural support is available, without the need for additional build 1691 flags. 1692 1693 Use of pointer authentication in the secure world remains an experimental 1694 configuration at this time. Using both the `ENABLE_PAUTH` and 1695 `CTX_INCLUDE_PAUTH_REGS` build flags, pointer authentication can be enabled 1696 in EL3 and S-EL1/0. 1697 1698 See the {ref}`Firmware Design` document for additional details on the use of 1699 pointer authentication. 1700 1701 - Enable Data Independent Timing (DIT) in EL3, where supported 1702 1703- Build System 1704 1705 - Support for BL-specific build flags 1706 1707 - Support setting compiler target architecture based on `ARM_ARCH_MINOR` build 1708 option. 1709 1710 - New `RECLAIM_INIT_CODE` build flag: 1711 1712 A significant amount of the code used for the initialization of BL31 is not 1713 needed again after boot time. In order to reduce the runtime memory 1714 footprint, the memory used for this code can be reclaimed after 1715 initialization. 1716 1717 Certain boot-time functions were marked with the `__init` attribute to 1718 enable this reclamation. 1719 1720- CPU Support 1721 1722 - cortex-a76: Workaround for erratum 1073348 1723 - cortex-a76: Workaround for erratum 1220197 1724 - cortex-a76: Workaround for erratum 1130799 1725 - cortex-a75: Workaround for erratum 790748 1726 - cortex-a75: Workaround for erratum 764081 1727 - cortex-a73: Workaround for erratum 852427 1728 - cortex-a73: Workaround for erratum 855423 1729 - cortex-a57: Workaround for erratum 817169 1730 - cortex-a57: Workaround for erratum 814670 1731 - cortex-a55: Workaround for erratum 903758 1732 - cortex-a55: Workaround for erratum 846532 1733 - cortex-a55: Workaround for erratum 798797 1734 - cortex-a55: Workaround for erratum 778703 1735 - cortex-a55: Workaround for erratum 768277 1736 - cortex-a53: Workaround for erratum 819472 1737 - cortex-a53: Workaround for erratum 824069 1738 - cortex-a53: Workaround for erratum 827319 1739 - cortex-a17: Workaround for erratum 852423 1740 - cortex-a17: Workaround for erratum 852421 1741 - cortex-a15: Workaround for erratum 816470 1742 - cortex-a15: Workaround for erratum 827671 1743 1744- Documentation 1745 1746 - Exception Handling Framework documentation 1747 - Library at ROM (romlib) documentation 1748 - RAS framework documentation 1749 - Coding Guidelines document 1750 1751- Drivers 1752 1753 - ccn: Add API for setting and reading node registers 1754 1755 - Adds `ccn_read_node_reg` function 1756 - Adds `ccn_write_node_reg` function 1757 1758 - partition: Support MBR partition entries 1759 1760 - scmi: Add `plat_css_get_scmi_info` function 1761 1762 Adds a new API `plat_css_get_scmi_info` which lets the platform register a 1763 platform-specific instance of `scmi_channel_plat_info_t` and remove the 1764 default values 1765 1766 - tzc380: Add TZC-380 TrustZone Controller driver 1767 1768 - tzc-dmc620: Add driver to manage the TrustZone Controller within the DMC-620 1769 Dynamic Memory Controller 1770 1771- Library at ROM (romlib) 1772 1773 - Add platform-specific jump table list 1774 1775 - Allow patching of romlib functions 1776 1777 This change allows patching of functions in the romlib. This can be done by 1778 adding "patch" at the end of the jump table entry for the function that 1779 needs to be patched in the file jmptbl.i. 1780 1781- Library Code 1782 1783 - Support non-LPAE-enabled MMU tables in AArch32 1784 - mmio: Add `mmio_clrsetbits_16` function 1785 - 16-bit variant of `mmio_clrsetbits` 1786 - object_pool: Add Object Pool Allocator 1787 - Manages object allocation using a fixed-size static array 1788 - Adds `pool_alloc` and `pool_alloc_n` functions 1789 - Does not provide any functions to free allocated objects (by design) 1790 - libc: Added `strlcpy` function 1791 - libc: Import `strrchr` function from FreeBSD 1792 - xlat_tables: Add support for ARMv8.4-TTST 1793 - xlat_tables: Support mapping regions without an explicitly specified VA 1794 1795- Math 1796 1797 - Added softudiv macro to support software division 1798 1799- Memory Partitioning And Monitoring (MPAM) 1800 1801 - Enabled MPAM EL2 traps (`MPAMHCR_EL2` and `MPAM_EL2`) 1802 1803- Platforms 1804 1805 - amlogic: Add support for Meson S905 (GXBB) 1806 1807 - arm/fvp_ve: Add support for FVP Versatile Express platform 1808 1809 - arm/n1sdp: Add support for Neoverse N1 System Development platform 1810 1811 - arm/rde1edge: Add support for Neoverse E1 platform 1812 1813 - arm/rdn1edge: Add support for Neoverse N1 platform 1814 1815 - arm: Add support for booting directly to Linux without an intermediate 1816 loader (AArch32) 1817 1818 - arm/juno: Enable new CPU errata workarounds for A53 and A57 1819 1820 - arm/juno: Add romlib support 1821 1822 Building a combined BL1 and ROMLIB binary file with the correct page 1823 alignment is now supported on the Juno platform. When `USE_ROMLIB` is set 1824 for Juno, it generates the combined file `bl1_romlib.bin` which needs to be 1825 used instead of bl1.bin. 1826 1827 - intel/stratix: Add support for Intel Stratix 10 SoC FPGA platform 1828 1829 - marvell: Add support for Armada-37xx SoC platform 1830 1831 - nxp: Add support for i.MX8M and i.MX7 Warp7 platforms 1832 1833 - renesas: Add support for R-Car Gen3 platform 1834 1835 - xilinx: Add support for Versal ACAP platforms 1836 1837- Position-Independent Executable (PIE) 1838 1839 PIE support has initially been added to BL31. The `ENABLE_PIE` build flag is 1840 used to enable or disable this functionality as required. 1841 1842- Secure Partition Manager 1843 1844 - New SPM implementation based on SPCI Alpha 1 draft specification 1845 1846 A new version of SPM has been implemented, based on the SPCI (Secure 1847 Partition Client Interface) and SPRT (Secure Partition Runtime) draft 1848 specifications. 1849 1850 The new implementation is a prototype that is expected to undergo intensive 1851 rework as the specifications change. It has basic support for multiple 1852 Secure Partitions and Resource Descriptions. 1853 1854 The older version of SPM, based on MM (ARM Management Mode Interface 1855 Specification), is still present in the codebase. A new build flag, `SPM_MM` 1856 has been added to allow selection of the desired implementation. This flag 1857 defaults to 1, selecting the MM-based implementation. 1858 1859- Security 1860 1861 - Spectre Variant-1 mitigations (`CVE-2017-5753`) 1862 1863 - Use Speculation Store Bypass Safe (SSBS) functionality where available 1864 1865 Provides mitigation against `CVE-2018-19440` (Not saving x0 to x3 registers 1866 can leak information from one Normal World SMC client to another) 1867 1868### Changed 1869 1870- Build System 1871 1872 - Warning levels are now selectable with `W=<1,2,3>` 1873 - Removed unneeded include paths in PLAT_INCLUDES 1874 - "Warnings as errors" (Werror) can be disabled using `E=0` 1875 - Support totally quiet output with `-s` flag 1876 - Support passing options to checkpatch using `CHECKPATCH_OPTS=<opts>` 1877 - Invoke host compiler with `HOSTCC / HOSTCCFLAGS` instead of `CC / CFLAGS` 1878 - Make device tree pre-processing similar to U-boot/Linux by: 1879 - Creating separate `CPPFLAGS` for DT preprocessing so that compiler options 1880 specific to it can be accommodated. 1881 - Replacing `CPP` with `PP` for DT pre-processing 1882 1883- CPU Support 1884 1885 - Errata report function definition is now mandatory for CPU support files 1886 1887 CPU operation files must now define a `<name>_errata_report` function to 1888 print errata status. This is no longer a weak reference. 1889 1890- Documentation 1891 1892 - Migrated some content from GitHub wiki to `docs/` directory 1893 - Security advisories now have CVE links 1894 - Updated copyright guidelines 1895 1896- Drivers 1897 1898 - console: The `MULTI_CONSOLE_API` framework has been rewritten in C 1899 1900 - console: Ported multi-console driver to AArch32 1901 1902 - gic: Remove 'lowest priority' constants 1903 1904 Removed `GIC_LOWEST_SEC_PRIORITY` and `GIC_LOWEST_NS_PRIORITY`. Platforms 1905 should define these if required, or instead determine the correct priority 1906 values at runtime. 1907 1908 - delay_timer: Check that the Generic Timer extension is present 1909 1910 - mmc: Increase command reply timeout to 10 milliseconds 1911 1912 - mmc: Poll eMMC device status to ensure `EXT_CSD` command completion 1913 1914 - mmc: Correctly check return code from `mmc_fill_device_info` 1915 1916- External Libraries 1917 1918 - libfdt: Upgraded from 1.4.2 to 1.4.6-9 1919 1920 > 1921 1922 - mbed TLS: Upgraded from 2.12 to 2.16 1923 1924 > 1925 1926 This change incorporates fixes for security issues that should be reviewed to 1927 determine if they are relevant for software implementations using Trusted 1928 Firmware-A. See the [mbed TLS releases] page for details on changes from the 1929 2.12 to the 2.16 release. 1930 1931- Library Code 1932 1933 - compiler-rt: Updated `lshrdi3.c` and `int_lib.h` with changes from LLVM 1934 master branch (r345645) 1935 - cpu: Updated macro that checks need for `CVE-2017-5715` mitigation 1936 - libc: Made setjmp and longjmp C standard compliant 1937 - libc: Allowed overriding the default libc (use `OVERRIDE_LIBC`) 1938 - libc: Moved setjmp and longjmp to the `libc/` directory 1939 1940- Platforms 1941 1942 - Removed Mbed TLS dependency from plat_bl_common.c 1943 1944 - arm: Removed unused `ARM_MAP_BL_ROMLIB` macro 1945 1946 - arm: Removed `ARM_BOARD_OPTIMISE_MEM` feature and build flag 1947 1948 - arm: Moved several components into `drivers/` directory 1949 1950 This affects the SDS, SCP, SCPI, MHU and SCMI components 1951 1952 - arm/juno: Increased maximum BL2 image size to `0xF000` 1953 1954 This change was required to accommodate a larger `libfdt` library 1955 1956- SCMI 1957 1958 - Optimized bakery locks when hardware-assisted coherency is enabled using the 1959 `HW_ASSISTED_COHERENCY` build flag 1960 1961- SDEI 1962 1963 - Added support for unconditionally resuming secure world execution after {{ 1964 SDEI }} event processing completes 1965 1966 {{ SDEI }} interrupts, although targeting EL3, occur on behalf of the 1967 non-secure world, and may have higher priority than secure world interrupts. 1968 Therefore they might preempt secure execution and yield execution to the 1969 non-secure {{ SDEI }} handler. Upon completion of {{ SDEI }} event handling, 1970 resume secure execution if it was preempted. 1971 1972- Translation Tables (XLAT) 1973 1974 - Dynamically detect need for `Common not Private (TTBRn_ELx.CnP)` bit 1975 1976 Properly handle the case where `ARMv8.2-TTCNP` is implemented in a CPU that 1977 does not implement all mandatory v8.2 features (and so must claim to 1978 implement a lower architecture version). 1979 1980### Resolved Issues 1981 1982- Architecture 1983 - Incorrect check for SSBS feature detection 1984 - Unintentional register clobber in AArch32 reset_handler function 1985- Build System 1986 - Dependency issue during DTB image build 1987 - Incorrect variable expansion in Arm platform makefiles 1988 - Building on Windows with verbose mode (`V=1`) enabled is broken 1989 - AArch32 compilation flags is missing `$(march32-directive)` 1990- BL-Specific Issues 1991 - bl2: `uintptr_t is not defined` error when `BL2_IN_XIP_MEM` is defined 1992 - bl2: Missing prototype warning in `bl2_arch_setup` 1993 - bl31: Omission of Global Offset Table (GOT) section 1994- Code Quality Issues 1995 - Multiple MISRA compliance issues 1996 - Potential NULL pointer dereference (Coverity-detected) 1997- Drivers 1998 - mmc: Local declaration of `scr` variable causes a cache issue when 1999 invalidating after the read DMA transfer completes 2000 - mmc: `ACMD41` does not send voltage information during initialization, 2001 resulting in the command being treated as a query. This prevents the command 2002 from initializing the controller. 2003 - mmc: When checking device state using `mmc_device_state()` there are no 2004 retries attempted in the event of an error 2005 - ccn: Incorrect Region ID calculation for RN-I nodes 2006 - console: `Fix MULTI_CONSOLE_API` when used as a crash console 2007 - partition: Improper NULL checking in gpt.c 2008 - partition: Compilation failure in `VERBOSE` mode (`V=1`) 2009- Library Code 2010 - common: Incorrect check for Address Authentication support 2011 2012 - xlat: Fix XLAT_V1 / XLAT_V2 incompatibility 2013 2014 The file `arm_xlat_tables.h` has been renamed to `xlat_tables_compat.h` and 2015 has been moved to a common folder. This header can be used to guarantee 2016 compatibility, as it includes the correct header based on 2017 `XLAT_TABLES_LIB_V2`. 2018 2019 - xlat: armclang unused-function warning on `xlat_clean_dcache_range` 2020 2021 - xlat: Invalid `mm_cursor` checks in `mmap_add` and `mmap_add_ctx` 2022 2023 - sdei: Missing `context.h` header 2024- Platforms 2025 - common: Missing prototype warning for `plat_log_get_prefix` 2026 2027 - arm: Insufficient maximum BL33 image size 2028 2029 - arm: Potential memory corruption during BL2-BL31 transition 2030 2031 On Arm platforms, the BL2 memory can be overlaid by BL31/BL32. The memory 2032 descriptors describing the list of executable images are created in BL2 R/W 2033 memory, which could be possibly corrupted later on by BL31/BL32 due to 2034 overlay. This patch creates a reserved location in SRAM for these 2035 descriptors and are copied over by BL2 before handing over to next BL image. 2036 2037 - juno: Invalid behaviour when `CSS_USE_SCMI_SDS_DRIVER` is not set 2038 2039 In `juno_pm.c` the `css_scmi_override_pm_ops` function was used regardless 2040 of whether the build flag was set. The original behaviour has been restored 2041 in the case where the build flag is not set. 2042- Tools 2043 - fiptool: Incorrect UUID parsing of blob parameters 2044 - doimage: Incorrect object rules in Makefile 2045 2046### Deprecations 2047 2048- Common Code 2049 - `plat_crash_console_init` function 2050 - `plat_crash_console_putc` function 2051 - `plat_crash_console_flush` function 2052 - `finish_console_register` macro 2053- AArch64-specific Code 2054 - helpers: `get_afflvl_shift` 2055 - helpers: `mpidr_mask_lower_afflvls` 2056 - helpers: `eret` 2057- Secure Partition Manager (SPM) 2058 - Boot-info structure 2059 2060### Known Issues 2061 2062- Build System Issues 2063 - dtb: DTB creation not supported when building on a Windows host. 2064 2065 This step in the build process is skipped when running on a Windows host. A 2066 known issue from the 1.6 release. 2067- Platform Issues 2068 - arm/juno: System suspend from Linux does not function as documented in the 2069 user guide 2070 2071 Following the instructions provided in the user guide document does not 2072 result in the platform entering system suspend state as expected. A message 2073 relating to the hdlcd driver failing to suspend will be emitted on the Linux 2074 terminal. 2075 2076 - arm/juno: The firmware update use-cases do not work with motherboard 2077 firmware version \< v1.5.0 (the reset reason is not preserved). The Linaro 2078 18.04 release has MB v1.4.9. The MB v1.5.0 is available in Linaro 18.10 2079 release. 2080 2081 - mediatek/mt6795: This platform does not build in this release 2082 2083## 2.0 (2018-10-02) 2084 2085### New Features 2086 2087- Removal of a number of deprecated APIs 2088 2089 - A new Platform Compatibility Policy document has been created which 2090 references a wiki page that maintains a listing of deprecated interfaces and 2091 the release after which they will be removed. 2092 - All deprecated interfaces except the MULTI_CONSOLE_API have been removed 2093 from the code base. 2094 - Various Arm and partner platforms have been updated to remove the use of 2095 removed APIs in this release. 2096 - This release is otherwise unchanged from 1.6 release 2097 2098### Issues resolved since last release 2099 2100- No issues known at 1.6 release resolved in 2.0 release 2101 2102### Known Issues 2103 2104- DTB creation not supported when building on a Windows host. This step in the 2105 build process is skipped when running on a Windows host. Known issue from 1.6 2106 version. 2107- As a result of removal of deprecated interfaces the Nvidia Tegra, Marvell 2108 Armada 8K and MediaTek MT6795 platforms do not build in this release. Also 2109 MediaTek MT8173, NXP QorIQ LS1043A, NXP i.MX8QX, NXP i.MX8QMa, Rockchip 2110 RK3328, Rockchip RK3368 and Rockchip RK3399 platforms have not been confirmed 2111 to be working after the removal of the deprecated interfaces although they do 2112 build. 2113 2114## 1.6 (2018-09-21) 2115 2116### New Features 2117 2118- Addressing Speculation Security Vulnerabilities 2119 2120 - Implement static workaround for CVE-2018-3639 for AArch32 and AArch64 2121 - Add support for dynamic mitigation for CVE-2018-3639 2122 - Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 2123 - Ensure {{ SDEI }} handler executes with CVE-2018-3639 mitigation enabled 2124 2125- Introduce RAS handling on AArch64 2126 2127 - Some RAS extensions are mandatory for Armv8.2 CPUs, with others mandatory 2128 for Armv8.4 CPUs however, all extensions are also optional extensions to the 2129 base Armv8.0 architecture. 2130 - The Armv8 RAS Extensions introduced Standard Error Records which are a set 2131 of standard registers to configure RAS node policy and allow RAS Nodes to 2132 record and expose error information for error handling agents. 2133 - Capabilities are provided to support RAS Node enumeration and iteration 2134 along with individual interrupt registrations and fault injections support. 2135 - Introduce handlers for Uncontainable errors, Double Faults and EL3 External 2136 Aborts 2137 2138- Enable Memory Partitioning And Monitoring (MPAM) for lower EL's 2139 2140 - Memory Partitioning And Monitoring is an Armv8.4 feature that enables 2141 various memory system components and resources to define partitions. 2142 Software running at various ELs can then assign themselves to the desired 2143 partition to control their performance aspects. 2144 - When ENABLE_MPAM_FOR_LOWER_ELS is set to 1, EL3 allows lower ELs to access 2145 their own MPAM registers without trapping to EL3. This patch however, 2146 doesn't make use of partitioning in EL3; platform initialisation code should 2147 configure and use partitions in EL3 if required. 2148 2149- Introduce ROM Lib Feature 2150 2151 - Support combining several libraries into a self-called "romlib" image, that 2152 may be shared across images to reduce memory footprint. The romlib image is 2153 stored in ROM but is accessed through a jump-table that may be stored in 2154 read-write memory, allowing for the library code to be patched. 2155 2156- Introduce Backtrace Feature 2157 2158 - This function displays the backtrace, the current EL and security state to 2159 allow a post-processing tool to choose the right binary to interpret the 2160 dump. 2161 - Print backtrace in assert() and panic() to the console. 2162 2163- Code hygiene changes and alignment with MISRA C-2012 guideline with fixes 2164 addressing issues complying to the following rules: 2165 2166 - MISRA rules 4.9, 5.1, 5.3, 5.7, 8.2-8.5, 8.8, 8.13, 9.3, 10.1, 10.3-10.4, 2167 10.8, 11.3, 11.6, 12.1, 14.4, 15.7, 16.1-16.7, 17.7-17.8, 20.7, 20.10, 2168 20.12, 21.1, 21.15, 22.7 2169 - Clean up the usage of void pointers to access symbols 2170 - Increase usage of static qualifier to locally used functions and data 2171 - Migrated to use of u_register_t for register read/write to better match 2172 AArch32 and AArch64 type sizes 2173 - Use int-ll64 for both AArch32 and AArch64 to assist in consistent format 2174 strings between architectures 2175 - Clean up TF-A libc by removing non arm copyrighted implementations and 2176 replacing them with modified FreeBSD and SCC implementations 2177 2178- Various changes to support Clang linker and assembler 2179 2180 - The clang assembler/preprocessor is used when Clang is selected. However, 2181 the clang linker is not used because it is unable to link TF-A objects due 2182 to immaturity of clang linker functionality at this time. 2183 2184- Refactor support APIs into Libraries 2185 2186 - Evolve libfdt, mbed TLS library and standard C library sources as proper 2187 libraries that TF-A may be linked against. 2188 2189- CPU Enhancements 2190 2191 - Add CPU support for Cortex-Ares and Cortex-A76 2192 - Add AMU support for Cortex-Ares 2193 - Add initial CPU support for Cortex-Deimos 2194 - Add initial CPU support for Cortex-Helios 2195 - Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 2196 - Implement Cortex-Ares erratum 1043202 workaround 2197 - Implement DSU erratum 936184 workaround 2198 - Check presence of fix for errata 843419 in Cortex-A53 2199 - Check presence of fix for errata 835769 in Cortex-A53 2200 2201- Translation Tables Enhancements 2202 2203 - The xlat v2 library has been refactored in order to be reused by different 2204 TF components at different EL's including the addition of EL2. Some 2205 refactoring to make the code more generic and less specific to TF, in order 2206 to reuse the library outside of this project. 2207 2208- SPM Enhancements 2209 2210 - General cleanups and refactoring to pave the way to multiple partitions 2211 support 2212 2213- SDEI Enhancements 2214 2215 - Allow platforms to define explicit events 2216 - Determine client EL from NS context's SCR_EL3 2217 - Make dispatches synchronous 2218 - Introduce jump primitives for BL31 2219 - Mask events after CPU wakeup in {{ SDEI }} dispatcher to conform to the 2220 specification 2221 2222- Misc TF-A Core Common Code Enhancements 2223 2224 - Add support for eXecute In Place (XIP) memory in BL2 2225 - Add support for the SMC Calling Convention 2.0 2226 - Introduce External Abort handling on AArch64 External Abort routed to EL3 2227 was reported as an unhandled exception and caused a panic. This change 2228 enables Trusted Firmware-A to handle External Aborts routed to EL3. 2229 - Save value of ACTLR_EL1 implementation-defined register in the CPU context 2230 structure rather than forcing it to 0. 2231 - Introduce ARM_LINUX_KERNEL_AS_BL33 build option, which allows BL31 to 2232 directly jump to a Linux kernel. This makes for a quicker and simpler boot 2233 flow, which might be useful in some test environments. 2234 - Add dynamic configurations for BL31, BL32 and BL33 enabling support for 2235 Chain of Trust (COT). 2236 - Make TF UUID RFC 4122 compliant 2237 2238- New Platform Support 2239 2240 - Arm SGI-575 2241 - Arm SGM-775 2242 - Allwinner sun50i_64 2243 - Allwinner sun50i_h6 2244 - NXP QorIQ LS1043A 2245 - NXP i.MX8QX 2246 - NXP i.MX8QM 2247 - NXP i.MX7Solo WaRP7 2248 - TI K3 2249 - Socionext Synquacer SC2A11 2250 - Marvell Armada 8K 2251 - STMicroelectronics STM32MP1 2252 2253- Misc Generic Platform Common Code Enhancements 2254 2255 - Add MMC framework that supports both eMMC and SD card devices 2256 2257- Misc Arm Platform Common Code Enhancements 2258 2259 - Demonstrate PSCI MEM_PROTECT from el3_runtime 2260 - Provide RAS support 2261 - Migrate AArch64 port to the multi console driver. The old API is deprecated 2262 and will eventually be removed. 2263 - Move BL31 below BL2 to enable BL2 overlay resulting in changes in the layout 2264 of BL images in memory to enable more efficient use of available space. 2265 - Add cpp build processing for dtb that allows processing device tree with 2266 external includes. 2267 - Extend FIP io driver to support multiple FIP devices 2268 - Add support for SCMI AP core configuration protocol v1.0 2269 - Use SCMI AP core protocol to set the warm boot entrypoint 2270 - Add support to Mbed TLS drivers for shared heap among different BL images to 2271 help optimise memory usage 2272 - Enable non-secure access to UART1 through a build option to support a serial 2273 debug port for debugger connection 2274 2275- Enhancements for Arm Juno Platform 2276 2277 - Add support for TrustZone Media Protection 1 (TZMP1) 2278 2279- Enhancements for Arm FVP Platform 2280 2281 - Dynamic_config: remove the FVP dtb files 2282 - Set DYNAMIC_WORKAROUND_CVE_2018_3639=1 on FVP by default 2283 - Set the ability to dynamically disable Trusted Boot Board authentication to 2284 be off by default with DYN_DISABLE_AUTH 2285 - Add librom enhancement support in FVP 2286 - Support shared Mbed TLS heap between BL1 and BL2 that allow a reduction in 2287 BL2 size for FVP 2288 2289- Enhancements for Arm SGI/SGM Platform 2290 2291 - Enable ARM_PLAT_MT flag for SGI-575 2292 - Add dts files to enable support for dynamic config 2293 - Add RAS support 2294 - Support shared Mbed TLS heap for SGI and SGM between BL1 and BL2 2295 2296- Enhancements for Non Arm Platforms 2297 2298 - Raspberry Pi Platform 2299 - Hikey Platforms 2300 - Xilinx Platforms 2301 - QEMU Platform 2302 - Rockchip rk3399 Platform 2303 - TI Platforms 2304 - Socionext Platforms 2305 - Allwinner Platforms 2306 - NXP Platforms 2307 - NVIDIA Tegra Platform 2308 - Marvell Platforms 2309 - STMicroelectronics STM32MP1 Platform 2310 2311### Issues resolved since last release 2312 2313- No issues known at 1.5 release resolved in 1.6 release 2314 2315### Known Issues 2316 2317- DTB creation not supported when building on a Windows host. This step in the 2318 build process is skipped when running on a Windows host. Known issue from 1.5 2319 version. 2320 2321## 1.5 (2018-03-20) 2322 2323### New features 2324 2325- Added new firmware support to enable RAS (Reliability, Availability, and 2326 Serviceability) functionality. 2327 2328 - Secure Partition Manager (SPM): A Secure Partition is a software execution 2329 environment instantiated in S-EL0 that can be used to implement simple 2330 management and security services. The SPM is the firmware component that is 2331 responsible for managing a Secure Partition. 2332 2333 - SDEI dispatcher: Support for interrupt-based {{ SDEI }} events and all 2334 interfaces as defined by the {{ SDEI }} specification v1.0, see 2335 [SDEI Specification] 2336 2337 - Exception Handling Framework (EHF): Framework that allows dispatching of EL3 2338 interrupts to their registered handlers which are registered based on their 2339 priorities. Facilitates firmware-first error handling policy where 2340 asynchronous exceptions may be routed to EL3. 2341 2342 Integrated the TSPD with EHF. 2343 2344- Updated PSCI support: 2345 2346 - Implemented PSCI v1.1 optional features `MEM_PROTECT` and `SYSTEM_RESET2`. 2347 The supported PSCI version was updated to v1.1. 2348 2349 - Improved PSCI STAT timestamp collection, including moving accounting for 2350 retention states to be inside the locks and fixing handling of wrap-around 2351 when calculating residency in AArch32 execution state. 2352 2353 - Added optional handler for early suspend that executes when suspending to a 2354 power-down state and with data caches enabled. 2355 2356 This may provide a performance improvement on platforms where it is safe to 2357 perform some or all of the platform actions from `pwr_domain_suspend` with 2358 the data caches enabled. 2359 2360- Enabled build option, BL2_AT_EL3, for BL2 to allow execution at EL3 without 2361 any dependency on TF BL1. 2362 2363 This allows platforms which already have a non-TF Boot ROM to directly load 2364 and execute BL2 and subsequent BL stages without need for BL1. This was not 2365 previously possible because BL2 executes at S-EL1 and cannot jump straight to 2366 EL3. 2367 2368- Implemented support for SMCCC v1.1, including `SMCCC_VERSION` and 2369 `SMCCC_ARCH_FEATURES`. 2370 2371 Additionally, added support for `SMCCC_VERSION` in PSCI features to enable 2372 discovery of the SMCCC version via PSCI feature call. 2373 2374- Added Dynamic Configuration framework which enables each of the boot loader 2375 stages to be dynamically configured at runtime if required by the platform. 2376 The boot loader stage may optionally specify a firmware configuration file 2377 and/or hardware configuration file that can then be shared with the next boot 2378 loader stage. 2379 2380 Introduced a new BL handover interface that essentially allows passing of 4 2381 arguments between the different BL stages. 2382 2383 Updated cert_create and fip_tool to support the dynamic configuration files. 2384 The COT also updated to support these new files. 2385 2386- Code hygiene changes and alignment with MISRA guideline: 2387 2388 - Fix use of undefined macros. 2389 - Achieved compliance with Mandatory MISRA coding rules. 2390 - Achieved compliance for following Required MISRA rules for the default build 2391 configurations on FVP and Juno platforms : 7.3, 8.3, 8.4, 8.5 and 8.8. 2392 2393- Added support for Armv8.2-A architectural features: 2394 2395 - Updated translation table set-up to set the CnP (Common not Private) bit for 2396 secure page tables so that multiple PEs in the same Inner Shareable domain 2397 can use the same translation table entries for a given stage of translation 2398 in a particular translation regime. 2399 - Extended the supported values of ID_AA64MMFR0_EL1.PARange to include the 2400 52-bit Physical Address range. 2401 - Added support for the Scalable Vector Extension to allow Normal world 2402 software to access SVE functionality but disable access to SVE, SIMD and 2403 floating point functionality from the Secure world in order to prevent 2404 corruption of the Z-registers. 2405 2406- Added support for Armv8.4-A architectural feature Activity Monitor Unit (AMU) 2407 2408 extensions. 2409 2410 In addition to the v8.4 architectural extension, AMU support on Cortex-A75 was 2411 implemented. 2412 2413- Enhanced OP-TEE support to enable use of pageable OP-TEE image. The Arm 2414 standard platforms are updated to load up to 3 images for OP-TEE; header, 2415 pager image and paged image. 2416 2417 The chain of trust is extended to support the additional images. 2418 2419- Enhancements to the translation table library: 2420 2421 - Introduced APIs to get and set the memory attributes of a region. 2422 - Added support to manage both privilege levels in translation regimes that 2423 describe translations for 2 Exception levels, specifically the EL1&0 2424 translation regime, and extended the memory map region attributes to include 2425 specifying Non-privileged access. 2426 - Added support to specify the granularity of the mappings of each region, for 2427 instance a 2MB region can be specified to be mapped with 4KB page tables 2428 instead of a 2MB block. 2429 - Disabled the higher VA range to avoid unpredictable behaviour if there is an 2430 attempt to access addresses in the higher VA range. 2431 - Added helpers for Device and Normal memory MAIR encodings that align with 2432 the Arm Architecture Reference Manual for Armv8-A (Arm DDI0487B.b). 2433 - Code hygiene including fixing type length and signedness of constants, 2434 refactoring of function to enable the MMU, removing all instances where the 2435 virtual address space is hardcoded and added comments that document 2436 alignment needed between memory attributes and attributes specified in 2437 TCR_ELx. 2438 2439- Updated GIC support: 2440 2441 - Introduce new APIs for GICv2 and GICv3 that provide the capability to 2442 specify interrupt properties rather than list of interrupt numbers alone. 2443 The Arm platforms and other upstream platforms are migrated to use interrupt 2444 properties. 2445 2446 - Added helpers to save / restore the GICv3 context, specifically the 2447 Distributor and Redistributor contexts and architectural parts of the ITS 2448 power management. The Distributor and Redistributor helpers also support the 2449 implementation-defined part of GIC-500 and GIC-600. 2450 2451 Updated the Arm FVP platform to save / restore the GICv3 context on system 2452 suspend / resume as an example of how to use the helpers. 2453 2454 Introduced a new TZC secured DDR carve-out for use by Arm platforms for 2455 storing EL3 runtime data such as the GICv3 register context. 2456 2457- Added support for Armv7-A architecture via build option ARM_ARCH_MAJOR=7. This 2458 includes following features: 2459 2460 - Updates GICv2 driver to manage GICv1 with security extensions. 2461 - Software implementation for 32bit division. 2462 - Enabled use of generic timer for platforms that do not set 2463 ARM_CORTEX_Ax=yes. 2464 - Support for Armv7-A Virtualization extensions \[DDI0406C_C\]. 2465 - Support for both Armv7-A platforms that only have 32-bit addressing and 2466 Armv7-A platforms that support large page addressing. 2467 - Included support for following Armv7 CPUs: Cortex-A12, Cortex-A17, 2468 Cortex-A7, Cortex-A5, Cortex-A9, Cortex-A15. 2469 - Added support in QEMU for Armv7-A/Cortex-A15. 2470 2471- Enhancements to Firmware Update feature: 2472 2473 - Updated the FWU documentation to describe the additional images needed for 2474 Firmware update, and how they are used for both the Juno platform and the 2475 Arm FVP platforms. 2476 2477- Enhancements to Trusted Board Boot feature: 2478 2479 - Added support to cert_create tool for RSA PKCS1# v1.5 and SHA384, SHA512 and 2480 SHA256. 2481 - For Arm platforms added support to use ECDSA keys. 2482 - Enhanced the mbed TLS wrapper layer to include support for both RSA and 2483 ECDSA to enable runtime selection between RSA and ECDSA keys. 2484 2485- Added support for secure interrupt handling in AArch32 sp_min, hardcoded to 2486 only handle FIQs. 2487 2488- Added support to allow a platform to load images from multiple boot sources, 2489 for example from a second flash drive. 2490 2491- Added a logging framework that allows platforms to reduce the logging level at 2492 runtime and additionally the prefix string can be defined by the platform. 2493 2494- Further improvements to register initialisation: 2495 2496 - Control register PMCR_EL0 / PMCR is set to prohibit cycle counting in the 2497 secure world. This register is added to the list of registers that are saved 2498 and restored during world switch. 2499 - When EL3 is running in AArch32 execution state, the Non-secure version of 2500 SCTLR is explicitly initialised during the warmboot flow rather than relying 2501 on the hardware to set the correct reset values. 2502 2503- Enhanced support for Arm platforms: 2504 2505 - Introduced driver for Shared-Data-Structure (SDS) framework which is used 2506 for communication between SCP and the AP CPU, replacing Boot-Over_MHU (BOM) 2507 protocol. 2508 2509 The Juno platform is migrated to use SDS with the SCMI support added in v1.3 2510 and is set as default. 2511 2512 The driver can be found in the plat/arm/css/drivers folder. 2513 2514 - Improved memory usage by only mapping TSP memory region when the TSPD has 2515 been included in the build. This reduces the memory footprint and avoids 2516 unnecessary memory being mapped. 2517 2518 - Updated support for multi-threading CPUs for FVP platforms - always check 2519 the MT field in MPDIR and access the bit fields accordingly. 2520 2521 - Support building for platforms that model DynamIQ configuration by 2522 implementing all CPUs in a single cluster. 2523 2524 - Improved nor flash driver, for instance clearing status registers before 2525 sending commands. Driver can be found plat/arm/board/common folder. 2526 2527- Enhancements to QEMU platform: 2528 2529 - Added support for TBB. 2530 - Added support for using OP-TEE pageable image. 2531 - Added support for LOAD_IMAGE_V2. 2532 - Migrated to use translation table library v2 by default. 2533 - Added support for SEPARATE_CODE_AND_RODATA. 2534 2535- Applied workarounds CVE-2017-5715 on Arm Cortex-A57, -A72, -A73 and -A75, and 2536 for Armv7-A CPUs Cortex-A9, -A15 and -A17. 2537 2538- Applied errata workaround for Arm Cortex-A57: 859972. 2539 2540- Applied errata workaround for Arm Cortex-A72: 859971. 2541 2542- Added support for Poplar 96Board platform. 2543 2544- Added support for Raspberry Pi 3 platform. 2545 2546- Added Call Frame Information (CFI) assembler directives to the vector entries 2547 which enables debuggers to display the backtrace of functions that triggered a 2548 synchronous abort. 2549 2550- Added ability to build dtb. 2551 2552- Added support for pre-tool (cert_create and fiptool) image processing enabling 2553 compression of the image files before processing by cert_create and fiptool. 2554 2555 This can reduce fip size and may also speed up loading of images. The image 2556 verification will also get faster because certificates are generated based on 2557 compressed images. 2558 2559 Imported zlib 1.2.11 to implement gunzip() for data compression. 2560 2561- Enhancements to fiptool: 2562 2563 - Enabled the fiptool to be built using Visual Studio. 2564 - Added padding bytes at the end of the last image in the fip to be facilitate 2565 transfer by DMA. 2566 2567### Issues resolved since last release 2568 2569- TF-A can be built with optimisations disabled (-O0). 2570- Memory layout updated to enable Trusted Board Boot on Juno platform when 2571 running TF-A in AArch32 execution mode (resolving [tf-issue#501]). 2572 2573### Known Issues 2574 2575- DTB creation not supported when building on a Windows host. This step in the 2576 build process is skipped when running on a Windows host. 2577 2578## 1.4 (2017-07-07) 2579 2580### New features 2581 2582- Enabled support for platforms with hardware assisted coherency. 2583 2584 A new build option HW_ASSISTED_COHERENCY allows platforms to take advantage of 2585 the following optimisations: 2586 2587 - Skip performing cache maintenance during power-up and power-down. 2588 - Use spin-locks instead of bakery locks. 2589 - Enable data caches early on warm-booted CPUs. 2590 2591- Added support for Cortex-A75 and Cortex-A55 processors. 2592 2593 Both Cortex-A75 and Cortex-A55 processors use the Arm DynamIQ Shared Unit 2594 (DSU). The power-down and power-up sequences are therefore mostly managed in 2595 hardware, reducing complexity of the software operations. 2596 2597- Introduced Arm GIC-600 driver. 2598 2599 Arm GIC-600 IP complies with Arm GICv3 architecture. For FVP platforms, the 2600 GIC-600 driver is chosen when FVP_USE_GIC_DRIVER is set to FVP_GIC600. 2601 2602- Updated GICv3 support: 2603 2604 - Introduced power management APIs for GICv3 Redistributor. These APIs allow 2605 platforms to power down the Redistributor during CPU power on/off. Requires 2606 the GICv3 implementations to have power management operations. 2607 2608 Implemented the power management APIs for FVP. 2609 2610 - GIC driver data is flushed by the primary CPU so that secondary CPU do not 2611 read stale GIC data. 2612 2613- Added support for Arm System Control and Management Interface v1.0 (SCMI). 2614 2615 The SCMI driver implements the power domain management and system power 2616 management protocol of the SCMI specification (Arm DEN 0056ASCMI) for 2617 communicating with any compliant power controller. 2618 2619 Support is added for the Juno platform. The driver can be found in the 2620 plat/arm/css/drivers folder. 2621 2622- Added support to enable pre-integration of TBB with the Arm TrustZone 2623 CryptoCell product, to take advantage of its hardware Root of Trust and crypto 2624 acceleration services. 2625 2626- Enabled Statistical Profiling Extensions for lower ELs. 2627 2628 The firmware support is limited to the use of SPE in the Non-secure state and 2629 accesses to the SPE specific registers from S-EL1 will trap to EL3. 2630 2631 The SPE are architecturally specified for AArch64 only. 2632 2633- Code hygiene changes aligned with MISRA guidelines: 2634 2635 - Fixed signed / unsigned comparison warnings in the translation table 2636 library. 2637 - Added U(\_x) macro and together with the existing ULL(\_x) macro fixed some 2638 of the signed-ness defects flagged by the MISRA scanner. 2639 2640- Enhancements to Firmware Update feature: 2641 2642 - The FWU logic now checks for overlapping images to prevent execution of 2643 unauthenticated arbitrary code. 2644 - Introduced new FWU_SMC_IMAGE_RESET SMC that changes the image loading state 2645 machine to go from COPYING, COPIED or AUTHENTICATED states to RESET state. 2646 Previously, this was only possible when the authentication of an image 2647 failed or when the execution of the image finished. 2648 - Fixed integer overflow which addressed TFV-1: Malformed Firmware Update SMC 2649 can result in copy of unexpectedly large data into secure memory. 2650 2651- Introduced support for Arm Compiler 6 and LLVM (clang). 2652 2653 TF-A can now also be built with the Arm Compiler 6 or the clang compilers. The 2654 assembler and linker must be provided by the GNU toolchain. 2655 2656 Tested with Arm CC 6.7 and clang 3.9.x and 4.0.x. 2657 2658- Memory footprint improvements: 2659 2660 - Introduced `tf_snprintf`, a reduced version of `snprintf` which has support 2661 for a limited set of formats. 2662 2663 The mbedtls driver is updated to optionally use `tf_snprintf` instead of 2664 `snprintf`. 2665 2666 - The `assert()` is updated to no longer print the function name, and 2667 additional logging options are supported via an optional platform define 2668 `PLAT_LOG_LEVEL_ASSERT`, which controls how verbose the assert output is. 2669 2670- Enhancements to TF-A support when running in AArch32 execution state: 2671 2672 - Support booting SP_MIN and BL33 in AArch32 execution mode on Juno. Due to 2673 hardware limitations, BL1 and BL2 boot in AArch64 state and there is 2674 additional trampoline code to warm reset into SP_MIN in AArch32 execution 2675 state. 2676 - Added support for Arm Cortex-A53/57/72 MPCore processors including the 2677 errata workarounds that are already implemented for AArch64 execution state. 2678 - For FVP platforms, added AArch32 Trusted Board Boot support, including the 2679 Firmware Update feature. 2680 2681- Introduced Arm SiP service for use by Arm standard platforms. 2682 2683 - Added new Arm SiP Service SMCs to enable the Non-secure world to read PMF 2684 timestamps. 2685 2686 Added PMF instrumentation points in TF-A in order to quantify the overall 2687 time spent in the PSCI software implementation. 2688 2689 - Added new Arm SiP service SMC to switch execution state. 2690 2691 This allows the lower exception level to change its execution state from 2692 AArch64 to AArch32, or vice verse, via a request to EL3. 2693 2694- Migrated to use SPDX\[0\] license identifiers to make software license 2695 auditing simpler. 2696 2697 \:::\{note} Files that have been imported by FreeBSD have not been modified. 2698 \::: 2699 2700 \[0\]: <https://spdx.org/> 2701 2702- Enhancements to the translation table library: 2703 2704 - Added version 2 of translation table library that allows different 2705 translation tables to be modified by using different 'contexts'. Version 1 2706 of the translation table library only allows the current EL's translation 2707 tables to be modified. 2708 2709 Version 2 of the translation table also added support for dynamic regions; 2710 regions that can be added and removed dynamically whilst the MMU is enabled. 2711 Static regions can only be added or removed before the MMU is enabled. 2712 2713 The dynamic mapping functionality is enabled or disabled when compiling by 2714 setting the build option PLAT_XLAT_TABLES_DYNAMIC to 1 or 0. This can be 2715 done per-image. 2716 2717 - Added support for translation regimes with two virtual address spaces such 2718 as the one shared by EL1 and EL0. 2719 2720 The library does not support initializing translation tables for EL0 2721 software. 2722 2723 - Added support to mark the translation tables as non-cacheable using an 2724 additional build option `XLAT_TABLE_NC`. 2725 2726- Added support for GCC stack protection. A new build option 2727 ENABLE_STACK_PROTECTOR was introduced that enables compilation of all BL 2728 images with one of the GCC -fstack-protector-\* options. 2729 2730 A new platform function plat_get_stack_protector_canary() was introduced that 2731 returns a value used to initialize the canary for stack corruption detection. 2732 For increased effectiveness of protection platforms must provide an 2733 implementation that returns a random value. 2734 2735- Enhanced support for Arm platforms: 2736 2737 - Added support for multi-threading CPUs, indicated by `MT` field in MPDIR. A 2738 new build flag `ARM_PLAT_MT` is added, and when enabled, the functions 2739 accessing MPIDR assume that the `MT` bit is set for the platform and access 2740 the bit fields accordingly. 2741 2742 Also, a new API `plat_arm_get_cpu_pe_count` is added when `ARM_PLAT_MT` is 2743 enabled, returning the Processing Element count within the physical CPU 2744 corresponding to `mpidr`. 2745 2746 - The Arm platforms migrated to use version 2 of the translation tables. 2747 2748 - Introduced a new Arm platform layer API `plat_arm_psci_override_pm_ops` 2749 which allows Arm platforms to modify `plat_arm_psci_pm_ops` and therefore 2750 dynamically define PSCI capability. 2751 2752 - The Arm platforms migrated to use IMAGE_LOAD_V2 by default. 2753 2754- Enhanced reporting of errata workaround status with the following policy: 2755 2756 - If an errata workaround is enabled: 2757 2758 - If it applies (i.e. the CPU is affected by the errata), an INFO message is 2759 printed, confirming that the errata workaround has been applied. 2760 - If it does not apply, a VERBOSE message is printed, confirming that the 2761 errata workaround has been skipped. 2762 2763 - If an errata workaround is not enabled, but would have applied had it been, 2764 a WARN message is printed, alerting that errata workaround is missing. 2765 2766- Added build options ARM_ARCH_MAJOR and ARM_ARM_MINOR to choose the 2767 architecture version to target TF-A. 2768 2769- Updated the spin lock implementation to use the more efficient CAS (Compare 2770 And Swap) instruction when available. This instruction was introduced in 2771 Armv8.1-A. 2772 2773- Applied errata workaround for Arm Cortex-A53: 855873. 2774 2775- Applied errata workaround for Arm-Cortex-A57: 813419. 2776 2777- Enabled all A53 and A57 errata workarounds for Juno, both in AArch64 and 2778 AArch32 execution states. 2779 2780- Added support for Socionext UniPhier SoC platform. 2781 2782- Added support for Hikey960 and Hikey platforms. 2783 2784- Added support for Rockchip RK3328 platform. 2785 2786- Added support for NVidia Tegra T186 platform. 2787 2788- Added support for Designware emmc driver. 2789 2790- Imported libfdt v1.4.2 that addresses buffer overflow in fdt_offset_ptr(). 2791 2792- Enhanced the CPU operations framework to allow power handlers to be registered 2793 on per-level basis. This enables support for future CPUs that have multiple 2794 threads which might need powering down individually. 2795 2796- Updated register initialisation to prevent unexpected behaviour: 2797 2798 - Debug registers MDCR-EL3/SDCR and MDCR_EL2/HDCR are initialised to avoid 2799 unexpected traps into the higher exception levels and disable secure 2800 self-hosted debug. Additionally, secure privileged external debug on Juno is 2801 disabled by programming the appropriate Juno SoC registers. 2802 - EL2 and EL3 configurable controls are initialised to avoid unexpected traps 2803 in the higher exception levels. 2804 - Essential control registers are fully initialised on EL3 start-up, when 2805 initialising the non-secure and secure context structures and when preparing 2806 to leave EL3 for a lower EL. This gives better alignment with the Arm ARM 2807 which states that software must initialise RES0 and RES1 fields with 0 / 1. 2808 2809- Enhanced PSCI support: 2810 2811 - Introduced new platform interfaces that decouple PSCI stat residency 2812 calculation from PMF, enabling platforms to use alternative methods of 2813 capturing timestamps. 2814 - PSCI stat accounting performed for retention/standby states when requested 2815 at multiple power levels. 2816 2817- Simplified fiptool to have a single linked list of image descriptors. 2818 2819- For the TSP, resolved corruption of pre-empted secure context by aborting any 2820 pre-empted SMC during PSCI power management requests. 2821 2822### Issues resolved since last release 2823 2824- TF-A can be built with the latest mbed TLS version (v2.4.2). The earlier 2825 version 2.3.0 cannot be used due to build warnings that the TF-A build system 2826 interprets as errors. 2827- TBBR, including the Firmware Update feature is now supported on FVP platforms 2828 when running TF-A in AArch32 state. 2829- The version of the AEMv8 Base FVP used in this release has resolved the issue 2830 of the model executing a reset instead of terminating in response to a 2831 shutdown request using the PSCI SYSTEM_OFF API. 2832 2833### Known Issues 2834 2835- Building TF-A with compiler optimisations disabled (-O0) fails. 2836- Trusted Board Boot currently does not work on Juno when running Trusted 2837 Firmware in AArch32 execution state due to error when loading the sp_min to 2838 memory because of lack of free space available. See [tf-issue#501] for more 2839 details. 2840- The errata workaround for A53 errata 843419 is only available from binutils 2841 2.26 and is not present in GCC4.9. If this errata is applicable to the 2842 platform, please use GCC compiler version of at least 5.0. See [PR#1002] for 2843 more details. 2844 2845## 1.3 (2016-10-13) 2846 2847### New features 2848 2849- Added support for running TF-A in AArch32 execution state. 2850 2851 The PSCI library has been refactored to allow integration with **EL3 Runtime 2852 Software**. This is software that is executing at the highest secure privilege 2853 which is EL3 in AArch64 or Secure SVC/Monitor mode in AArch32. See 2854 \{ref}`PSCI Library Integration guide for Armv8-A AArch32 systems`. 2855 2856 Included is a minimal AArch32 Secure Payload, **SP-MIN**, that illustrates the 2857 usage and integration of the PSCI library with EL3 Runtime Software running in 2858 AArch32 state. 2859 2860 Booting to the BL1/BL2 images as well as booting straight to the Secure 2861 Payload is supported. 2862 2863- Improvements to the initialization framework for the PSCI service and Arm 2864 Standard Services in general. 2865 2866 The PSCI service is now initialized as part of Arm Standard Service 2867 initialization. This consolidates the initializations of any Arm Standard 2868 Service that may be added in the future. 2869 2870 A new function `get_arm_std_svc_args()` is introduced to get arguments 2871 corresponding to each standard service and must be implemented by the EL3 2872 Runtime Software. 2873 2874 For PSCI, a new versioned structure `psci_lib_args_t` is introduced to 2875 initialize the PSCI Library. **Note** this is a compatibility break due to the 2876 change in the prototype of `psci_setup()`. 2877 2878- To support AArch32 builds of BL1 and BL2, implemented a new, alternative 2879 firmware image loading mechanism that adds flexibility. 2880 2881 The current mechanism has a hard-coded set of images and execution order 2882 (BL31, BL32, etc). The new mechanism is data-driven by a list of image 2883 descriptors provided by the platform code. 2884 2885 Arm platforms have been updated to support the new loading mechanism. 2886 2887 The new mechanism is enabled by a build flag (`LOAD_IMAGE_V2`) which is 2888 currently off by default for the AArch64 build. 2889 2890 **Note** `TRUSTED_BOARD_BOOT` is currently not supported when `LOAD_IMAGE_V2` 2891 is enabled. 2892 2893- Updated requirements for making contributions to TF-A. 2894 2895 Commits now must have a 'Signed-off-by:' field to certify that the 2896 contribution has been made under the terms of the 2897 {download}`Developer Certificate of Origin <../dco.txt>`. 2898 2899 A signed CLA is no longer required. 2900 2901 The {ref}`Contributor's Guide` has been updated to reflect this change. 2902 2903- Introduced Performance Measurement Framework (PMF) which provides support for 2904 capturing, storing, dumping and retrieving time-stamps to measure the 2905 execution time of critical paths in the firmware. This relies on defining 2906 fixed sample points at key places in the code. 2907 2908- To support the QEMU platform port, imported libfdt v1.4.1 from 2909 <https://git.kernel.org/pub/scm/utils/dtc/dtc.git> 2910 2911- Updated PSCI support: 2912 2913 - Added support for PSCI NODE_HW_STATE API for Arm platforms. 2914 - New optional platform hook, `pwr_domain_pwr_down_wfi()`, in `plat_psci_ops` 2915 to enable platforms to perform platform-specific actions needed to enter 2916 powerdown, including the 'wfi' invocation. 2917 - PSCI STAT residency and count functions have been added on Arm platforms by 2918 using PMF. 2919 2920- Enhancements to the translation table library: 2921 2922 - Limited memory mapping support for region overlaps to only allow regions to 2923 overlap that are identity mapped or have the same virtual to physical 2924 address offset, and overlap completely but must not cover the same area. 2925 2926 This limitation will enable future enhancements without having to support 2927 complex edge cases that may not be necessary. 2928 2929 - The initial translation lookup level is now inferred from the virtual 2930 address space size. Previously, it was hard-coded. 2931 2932 - Added support for mapping Normal, Inner Non-cacheable, Outer Non-cacheable 2933 memory in the translation table library. 2934 2935 This can be useful to map a non-cacheable memory region, such as a DMA 2936 buffer. 2937 2938 - Introduced the MT_EXECUTE/MT_EXECUTE_NEVER memory mapping attributes to 2939 specify the access permissions for instruction execution of a memory region. 2940 2941- Enabled support to isolate code and read-only data on separate memory pages, 2942 allowing independent access control to be applied to each. 2943 2944- Enabled SCR_EL3.SIF (Secure Instruction Fetch) bit in BL1 and BL31 common 2945 architectural setup code, preventing fetching instructions from non-secure 2946 memory when in secure state. 2947 2948- Enhancements to FIP support: 2949 2950 - Replaced `fip_create` with `fiptool` which provides a more consistent and 2951 intuitive interface as well as additional support to remove an image from a 2952 FIP file. 2953 - Enabled printing the SHA256 digest with info command, allowing quick 2954 verification of an image within a FIP without having to extract the image 2955 and running sha256sum on it. 2956 - Added support for unpacking the contents of an existing FIP file into the 2957 working directory. 2958 - Aligned command line options for specifying images to use same naming 2959 convention as specified by TBBR and already used in cert_create tool. 2960 2961- Refactored the TZC-400 driver to also support memory controllers that 2962 integrate TZC functionality, for example Arm CoreLink DMC-500. Also added 2963 DMC-500 specific support. 2964 2965- Implemented generic delay timer based on the system generic counter and 2966 migrated all platforms to use it. 2967 2968- Enhanced support for Arm platforms: 2969 2970 - Updated image loading support to make SCP images (SCP_BL2 and SCP_BL2U) 2971 optional. 2972 - Enhanced topology description support to allow multi-cluster topology 2973 definitions. 2974 - Added interconnect abstraction layer to help platform ports select the right 2975 interconnect driver, CCI or CCN, for the platform. 2976 - Added support to allow loading BL31 in the TZC-secured DRAM instead of the 2977 default secure SRAM. 2978 - Added support to use a System Security Control (SSC) Registers Unit enabling 2979 TF-A to be compiled to support multiple Arm platforms and then select one at 2980 runtime. 2981 - Restricted mapping of Trusted ROM in BL1 to what is actually needed by BL1 2982 rather than entire Trusted ROM region. 2983 - Flash is now mapped as execute-never by default. This increases security by 2984 restricting the executable region to what is strictly needed. 2985 2986- Applied following erratum workarounds for Cortex-A57: 833471, 826977, 829520, 2987 828024 and 826974. 2988 2989- Added support for Mediatek MT6795 platform. 2990 2991- Added support for QEMU virtualization Armv8-A target. 2992 2993- Added support for Rockchip RK3368 and RK3399 platforms. 2994 2995- Added support for Xilinx Zynq UltraScale+ MPSoC platform. 2996 2997- Added support for Arm Cortex-A73 MPCore Processor. 2998 2999- Added support for Arm Cortex-A72 processor. 3000 3001- Added support for Arm Cortex-A35 processor. 3002 3003- Added support for Arm Cortex-A32 MPCore Processor. 3004 3005- Enabled preloaded BL33 alternative boot flow, in which BL2 does not load BL33 3006 from non-volatile storage and BL31 hands execution over to a preloaded BL33. 3007 The User Guide has been updated with an example of how to use this option with 3008 a bootwrapped kernel. 3009 3010- Added support to build TF-A on a Windows-based host machine. 3011 3012- Updated Trusted Board Boot prototype implementation: 3013 3014 - Enabled the ability for a production ROM with TBBR enabled to boot test 3015 software before a real ROTPK is deployed (e.g. manufacturing mode). Added 3016 support to use ROTPK in certificate without verifying against the platform 3017 value when `ROTPK_NOT_DEPLOYED` bit is set. 3018 - Added support for non-volatile counter authentication to the Authentication 3019 Module to protect against roll-back. 3020 3021- Updated GICv3 support: 3022 3023 - Enabled processor power-down and automatic power-on using GICv3. 3024 - Enabled G1S or G0 interrupts to be configured independently. 3025 - Changed FVP default interrupt driver to be the GICv3-only driver. **Note** 3026 the default build of TF-A will not be able to boot Linux kernel with GICv2 3027 FDT blob. 3028 - Enabled wake-up from CPU_SUSPEND to stand-by by temporarily re-routing 3029 interrupts and then restoring after resume. 3030 3031### Issues resolved since last release 3032 3033### Known issues 3034 3035- The version of the AEMv8 Base FVP used in this release resets the model 3036 instead of terminating its execution in response to a shutdown request using 3037 the PSCI `SYSTEM_OFF` API. This issue will be fixed in a future version of the 3038 model. 3039- Building TF-A with compiler optimisations disabled (`-O0`) fails. 3040- TF-A cannot be built with mbed TLS version v2.3.0 due to build warnings that 3041 the TF-A build system interprets as errors. 3042- TBBR is not currently supported when running TF-A in AArch32 state. 3043 3044## 1.2 (2015-12-22) 3045 3046### New features 3047 3048- The Trusted Board Boot implementation on Arm platforms now conforms to the 3049 mandatory requirements of the TBBR specification. 3050 3051 In particular, the boot process is now guarded by a Trusted Watchdog, which 3052 will reset the system in case of an authentication or loading error. On Arm 3053 platforms, a secure instance of Arm SP805 is used as the Trusted Watchdog. 3054 3055 Also, a firmware update process has been implemented. It enables authenticated 3056 firmware to update firmware images from external interfaces to SoC 3057 Non-Volatile memories. This feature functions even when the current firmware 3058 in the system is corrupt or missing; it therefore may be used as a recovery 3059 mode. 3060 3061- Improvements have been made to the Certificate Generation Tool (`cert_create`) 3062 as follows. 3063 3064 - Added support for the Firmware Update process by extending the Chain of 3065 Trust definition in the tool to include the Firmware Update certificate and 3066 the required extensions. 3067 - Introduced a new API that allows one to specify command line options in the 3068 Chain of Trust description. This makes the declaration of the tool's 3069 arguments more flexible and easier to extend. 3070 - The tool has been reworked to follow a data driven approach, which makes it 3071 easier to maintain and extend. 3072 3073- Extended the FIP tool (`fip_create`) to support the new set of images involved 3074 in the Firmware Update process. 3075 3076- Various memory footprint improvements. In particular: 3077 3078 - The bakery lock structure for coherent memory has been optimised. 3079 - The mbed TLS SHA1 functions are not needed, as SHA256 is used to generate 3080 the certificate signature. Therefore, they have been compiled out, reducing 3081 the memory footprint of BL1 and BL2 by approximately 6 KB. 3082 - On Arm development platforms, each BL stage now individually defines the 3083 number of regions that it needs to map in the MMU. 3084 3085- Added the following new design documents: 3086 3087 - {ref}`Authentication Framework & Chain of Trust` 3088 - {ref}`Firmware Update (FWU)` 3089 - {ref}`CPU Reset` 3090 - {ref}`PSCI Power Domain Tree Structure` 3091 3092- Applied the new image terminology to the code base and documentation, as 3093 described in the {ref}`Image Terminology` document. 3094 3095- The build system has been reworked to improve readability and facilitate 3096 adding future extensions. 3097 3098- On Arm standard platforms, BL31 uses the boot console during cold boot but 3099 switches to the runtime console for any later logs at runtime. The TSP uses 3100 the runtime console for all output. 3101 3102- Implemented a basic NOR flash driver for Arm platforms. It programs the device 3103 using CFI (Common Flash Interface) standard commands. 3104 3105- Implemented support for booting EL3 payloads on Arm platforms, which reduces 3106 the complexity of developing EL3 baremetal code by doing essential baremetal 3107 initialization. 3108 3109- Provided separate drivers for GICv3 and GICv2. These expect the entire 3110 software stack to use either GICv2 or GICv3; hybrid GIC software systems are 3111 no longer supported and the legacy Arm GIC driver has been deprecated. 3112 3113- Added support for Juno r1 and r2. A single set of Juno TF-A binaries can run 3114 on Juno r0, r1 and r2 boards. Note that this TF-A version depends on a Linaro 3115 release that does *not* contain Juno r2 support. 3116 3117- Added support for MediaTek mt8173 platform. 3118 3119- Implemented a generic driver for Arm CCN IP. 3120 3121- Major rework of the PSCI implementation. 3122 3123 - Added framework to handle composite power states. 3124 - Decoupled the notions of affinity instances (which describes the 3125 hierarchical arrangement of cores) and of power domain topology, instead of 3126 assuming a one-to-one mapping. 3127 - Better alignment with version 1.0 of the PSCI specification. 3128 3129- Added support for the SYSTEM_SUSPEND PSCI API on Arm platforms. When invoked 3130 on the last running core on a supported platform, this puts the system into a 3131 low power mode with memory retention. 3132 3133- Unified the reset handling code as much as possible across BL stages. Also 3134 introduced some build options to enable optimization of the reset path on 3135 platforms that support it. 3136 3137- Added a simple delay timer API, as well as an SP804 timer driver, which is 3138 enabled on FVP. 3139 3140- Added support for NVidia Tegra T210 and T132 SoCs. 3141 3142- Reorganised Arm platforms ports to greatly improve code shareability and 3143 facilitate the reuse of some of this code by other platforms. 3144 3145- Added support for Arm Cortex-A72 processor in the CPU specific framework. 3146 3147- Provided better error handling. Platform ports can now define their own error 3148 handling, for example to perform platform specific bookkeeping or post-error 3149 actions. 3150 3151- Implemented a unified driver for Arm Cache Coherent Interconnects used for 3152 both CCI-400 & CCI-500 IPs. Arm platforms ports have been migrated to this 3153 common driver. The standalone CCI-400 driver has been deprecated. 3154 3155### Issues resolved since last release 3156 3157- The Trusted Board Boot implementation has been redesigned to provide greater 3158 modularity and scalability. See the 3159 \{ref}`Authentication Framework & Chain of Trust` document. All missing 3160 mandatory features are now implemented. 3161- The FVP and Juno ports may now use the hash of the ROTPK stored in the Trusted 3162 Key Storage registers to verify the ROTPK. Alternatively, a development public 3163 key hash embedded in the BL1 and BL2 binaries might be used instead. The 3164 location of the ROTPK is chosen at build-time using the `ARM_ROTPK_LOCATION` 3165 build option. 3166- GICv3 is now fully supported and stable. 3167 3168### Known issues 3169 3170- The version of the AEMv8 Base FVP used in this release resets the model 3171 instead of terminating its execution in response to a shutdown request using 3172 the PSCI `SYSTEM_OFF` API. This issue will be fixed in a future version of the 3173 model. 3174- While this version has low on-chip RAM requirements, there are further RAM 3175 usage enhancements that could be made. 3176- The upstream documentation could be improved for structural consistency, 3177 clarity and completeness. In particular, the design documentation is 3178 incomplete for PSCI, the TSP(D) and the Juno platform. 3179- Building TF-A with compiler optimisations disabled (`-O0`) fails. 3180 3181## 1.1 (2015-02-04) 3182 3183### New features 3184 3185- A prototype implementation of Trusted Board Boot has been added. Boot loader 3186 images are verified by BL1 and BL2 during the cold boot path. BL1 and BL2 use 3187 the PolarSSL SSL library to verify certificates and images. The OpenSSL 3188 library is used to create the X.509 certificates. Support has been added to 3189 `fip_create` tool to package the certificates in a FIP. 3190 3191- Support for calling CPU and platform specific reset handlers upon entry into 3192 BL3-1 during the cold and warm boot paths has been added. This happens after 3193 another Boot ROM `reset_handler()` has already run. This enables a developer 3194 to perform additional actions or undo actions already performed during the 3195 first call of the reset handlers e.g. apply additional errata workarounds. 3196 3197- Support has been added to demonstrate routing of IRQs to EL3 instead of S-EL1 3198 when execution is in secure world. 3199 3200- The PSCI implementation now conforms to version 1.0 of the PSCI specification. 3201 All the mandatory APIs and selected optional APIs are supported. In 3202 particular, support for the `PSCI_FEATURES` API has been added. A capability 3203 variable is constructed during initialization by examining the `plat_pm_ops` 3204 and `spd_pm_ops` exported by the platform and the Secure Payload Dispatcher. 3205 This is used by the PSCI FEATURES function to determine which PSCI APIs are 3206 supported by the platform. 3207 3208- Improvements have been made to the PSCI code as follows. 3209 3210 - The code has been refactored to remove redundant parameters from internal 3211 functions. 3212 - Changes have been made to the code for PSCI `CPU_SUSPEND`, `CPU_ON` and 3213 `CPU_OFF` calls to facilitate an early return to the caller in case a 3214 failure condition is detected. For example, a PSCI `CPU_SUSPEND` call 3215 returns `SUCCESS` to the caller if a pending interrupt is detected early in 3216 the code path. 3217 - Optional platform APIs have been added to validate the `power_state` and 3218 `entrypoint` parameters early in PSCI `CPU_ON` and `CPU_SUSPEND` code paths. 3219 - PSCI migrate APIs have been reworked to invoke the SPD hook to determine the 3220 type of Trusted OS and the CPU it is resident on (if applicable). Also, 3221 during a PSCI `MIGRATE` call, the SPD hook to migrate the Trusted OS is 3222 invoked. 3223 3224- It is now possible to build TF-A without marking at least an extra page of 3225 memory as coherent. The build flag `USE_COHERENT_MEM` can be used to choose 3226 between the two implementations. This has been made possible through these 3227 changes. 3228 3229 - An implementation of Bakery locks, where the locks are not allocated in 3230 coherent memory has been added. 3231 - Memory which was previously marked as coherent is now kept coherent through 3232 the use of software cache maintenance operations. 3233 3234 Approximately, 4K worth of memory is saved for each boot loader stage when 3235 `USE_COHERENT_MEM=0`. Enabling this option increases the latencies associated 3236 with acquire and release of locks. It also requires changes to the platform 3237 ports. 3238 3239- It is now possible to specify the name of the FIP at build time by defining 3240 the `FIP_NAME` variable. 3241 3242- Issues with dependencies on the 'fiptool' makefile target have been rectified. 3243 The `fip_create` tool is now rebuilt whenever its source files change. 3244 3245- The BL3-1 runtime console is now also used as the crash console. The crash 3246 console is changed to SoC UART0 (UART2) from the previous FPGA UART0 (UART0) 3247 on Juno. In FVP, it is changed from UART0 to UART1. 3248 3249- CPU errata workarounds are applied only when the revision and part number 3250 match. This behaviour has been made consistent across the debug and release 3251 builds. The debug build additionally prints a warning if a mismatch is 3252 detected. 3253 3254- It is now possible to issue cache maintenance operations by set/way for a 3255 particular level of data cache. Levels 1-3 are currently supported. 3256 3257- The following improvements have been made to the FVP port. 3258 3259 - The build option `FVP_SHARED_DATA_LOCATION` which allowed relocation of 3260 shared data into the Trusted DRAM has been deprecated. Shared data is now 3261 always located at the base of Trusted SRAM. 3262 - BL2 Translation tables have been updated to map only the region of DRAM 3263 which is accessible to normal world. This is the region of the 2GB DDR-DRAM 3264 memory at 0x80000000 excluding the top 16MB. The top 16MB is accessible to 3265 only the secure world. 3266 - BL3-2 can now reside in the top 16MB of DRAM which is accessible only to the 3267 secure world. This can be done by setting the build flag 3268 `FVP_TSP_RAM_LOCATION` to the value `dram`. 3269 3270- Separate translation tables are created for each boot loader image. The 3271 `IMAGE_BLx` build options are used to do this. This allows each stage to 3272 create mappings only for areas in the memory map that it needs. 3273 3274- A Secure Payload Dispatcher (OPTEED) for the OP-TEE Trusted OS has been added. 3275 Details of using it with TF-A can be found in {ref}`OP-TEE Dispatcher` 3276 3277### Issues resolved since last release 3278 3279- The Juno port has been aligned with the FVP port as follows. 3280 3281 - Support for reclaiming all BL1 RW memory and BL2 memory by overlaying the 3282 BL3-1/BL3-2 NOBITS sections on top of them has been added to the Juno port. 3283 - The top 16MB of the 2GB DDR-DRAM memory at 0x80000000 is configured using 3284 the TZC-400 controller to be accessible only to the secure world. 3285 - The Arm GIC driver is used to configure the GIC-400 instead of using a GIC 3286 driver private to the Juno port. 3287 - PSCI `CPU_SUSPEND` calls that target a standby state are now supported. 3288 - The TZC-400 driver is used to configure the controller instead of direct 3289 accesses to the registers. 3290 3291- The Linux kernel version referred to in the user guide has DVFS and HMP 3292 support enabled. 3293 3294- DS-5 v5.19 did not detect Version 5.8 of the Cortex-A57-A53 Base FVPs in CADI 3295 server mode. This issue is not seen with DS-5 v5.20 and Version 6.2 of the 3296 Cortex-A57-A53 Base FVPs. 3297 3298### Known issues 3299 3300- The Trusted Board Boot implementation is a prototype. There are issues with 3301 the modularity and scalability of the design. Support for a Trusted Watchdog, 3302 firmware update mechanism, recovery images and Trusted debug is absent. These 3303 issues will be addressed in future releases. 3304- The FVP and Juno ports do not use the hash of the ROTPK stored in the Trusted 3305 Key Storage registers to verify the ROTPK in the `plat_match_rotpk()` 3306 function. This prevents the correct establishment of the Chain of Trust at the 3307 first step in the Trusted Board Boot process. 3308- The version of the AEMv8 Base FVP used in this release resets the model 3309 instead of terminating its execution in response to a shutdown request using 3310 the PSCI `SYSTEM_OFF` API. This issue will be fixed in a future version of the 3311 model. 3312- GICv3 support is experimental. There are known issues with GICv3 3313 initialization in the TF-A. 3314- While this version greatly reduces the on-chip RAM requirements, there are 3315 further RAM usage enhancements that could be made. 3316- The firmware design documentation for the Test Secure-EL1 Payload (TSP) and 3317 its dispatcher (TSPD) is incomplete. Similarly for the PSCI section. 3318- The Juno-specific firmware design documentation is incomplete. 3319 3320## 1.0 (2014-08-28) 3321 3322### New features 3323 3324- It is now possible to map higher physical addresses using non-flat virtual to 3325 physical address mappings in the MMU setup. 3326 3327- Wider use is now made of the per-CPU data cache in BL3-1 to store: 3328 3329 - Pointers to the non-secure and secure security state contexts. 3330 - A pointer to the CPU-specific operations. 3331 - A pointer to PSCI specific information (for example the current power 3332 state). 3333 - A crash reporting buffer. 3334 3335- The following RAM usage improvements result in a BL3-1 RAM usage reduction 3336 from 96KB to 56KB (for FVP with TSPD), and a total RAM usage reduction across 3337 all images from 208KB to 88KB, compared to the previous release. 3338 3339 - Removed the separate `early_exception` vectors from BL3-1 (2KB code size 3340 saving). 3341 - Removed NSRAM from the FVP memory map, allowing the removal of one (4KB) 3342 translation table. 3343 - Eliminated the internal `psci_suspend_context` array, saving 2KB. 3344 - Correctly dimensioned the PSCI `aff_map_node` array, saving 1.5KB in the FVP 3345 port. 3346 - Removed calling CPU mpidr from the bakery lock API, saving 160 bytes. 3347 - Removed current CPU mpidr from PSCI common code, saving 160 bytes. 3348 - Inlined the mmio accessor functions, saving 360 bytes. 3349 - Fully reclaimed all BL1 RW memory and BL2 memory on the FVP port by 3350 overlaying the BL3-1/BL3-2 NOBITS sections on top of these at runtime. 3351 - Made storing the FP register context optional, saving 0.5KB per context (8KB 3352 on the FVP port, with TSPD enabled and running on 8 CPUs). 3353 - Implemented a leaner `tf_printf()` function, allowing the stack to be 3354 greatly reduced. 3355 - Removed coherent stacks from the codebase. Stacks allocated in normal memory 3356 are now used before and after the MMU is enabled. This saves 768 bytes per 3357 CPU in BL3-1. 3358 - Reworked the crash reporting in BL3-1 to use less stack. 3359 - Optimized the EL3 register state stored in the `cpu_context` structure so 3360 that registers that do not change during normal execution are re-initialized 3361 each time during cold/warm boot, rather than restored from memory. This 3362 saves about 1.2KB. 3363 - As a result of some of the above, reduced the runtime stack size in all BL 3364 images. For BL3-1, this saves 1KB per CPU. 3365 3366- PSCI SMC handler improvements to correctly handle calls from secure states and 3367 from AArch32. 3368 3369- CPU contexts are now initialized from the `entry_point_info`. BL3-1 fully 3370 determines the exception level to use for the non-trusted firmware (BL3-3) 3371 based on the SPSR value provided by the BL2 platform code (or otherwise 3372 provided to BL3-1). This allows platform code to directly run non-trusted 3373 firmware payloads at either EL2 or EL1 without requiring an EL2 stub or OS 3374 loader. 3375 3376- Code refactoring improvements: 3377 3378 - Refactored `fvp_config` into a common platform header. 3379 - Refactored the fvp gic code to be a generic driver that no longer has an 3380 explicit dependency on platform code. 3381 - Refactored the CCI-400 driver to not have dependency on platform code. 3382 - Simplified the IO driver so it's no longer necessary to call `io_init()` and 3383 moved all the IO storage framework code to one place. 3384 - Simplified the interface the the TZC-400 driver. 3385 - Clarified the platform porting interface to the TSP. 3386 - Reworked the TSPD setup code to support the alternate BL3-2 initialization 3387 flow where BL3-1 generic code hands control to BL3-2, rather than expecting 3388 the TSPD to hand control directly to BL3-2. 3389 - Considerable rework to PSCI generic code to support CPU specific operations. 3390 3391- Improved console log output, by: 3392 3393 - Adding the concept of debug log levels. 3394 - Rationalizing the existing debug messages and adding new ones. 3395 - Printing out the version of each BL stage at runtime. 3396 - Adding support for printing console output from assembler code, including 3397 when a crash occurs before the C runtime is initialized. 3398 3399- Moved up to the latest versions of the FVPs, toolchain, EDK2, kernel, Linaro 3400 file system and DS-5. 3401 3402- On the FVP port, made the use of the Trusted DRAM region optional at build 3403 time (off by default). Normal platforms will not have such a "ready-to-use" 3404 DRAM area so it is not a good example to use it. 3405 3406- Added support for PSCI `SYSTEM_OFF` and `SYSTEM_RESET` APIs. 3407 3408- Added support for CPU specific reset sequences, power down sequences and 3409 register dumping during crash reporting. The CPU specific reset sequences 3410 include support for errata workarounds. 3411 3412- Merged the Juno port into the master branch. Added support for CPU hotplug and 3413 CPU idle. Updated the user guide to describe how to build and run on the Juno 3414 platform. 3415 3416### Issues resolved since last release 3417 3418- Removed the concept of top/bottom image loading. The image loader now 3419 automatically detects the position of the image inside the current memory 3420 layout and updates the layout to minimize fragmentation. This resolves the 3421 image loader limitations of previously releases. There are currently no plans 3422 to support dynamic image loading. 3423- CPU idle now works on the publicized version of the Foundation FVP. 3424- All known issues relating to the compiler version used have now been resolved. 3425 This TF-A version uses Linaro toolchain 14.07 (based on GCC 4.9). 3426 3427### Known issues 3428 3429- GICv3 support is experimental. The Linux kernel patches to support this are 3430 not widely available. There are known issues with GICv3 initialization in the 3431 TF-A. 3432 3433- While this version greatly reduces the on-chip RAM requirements, there are 3434 further RAM usage enhancements that could be made. 3435 3436- The firmware design documentation for the Test Secure-EL1 Payload (TSP) and 3437 its dispatcher (TSPD) is incomplete. Similarly for the PSCI section. 3438 3439- The Juno-specific firmware design documentation is incomplete. 3440 3441- Some recent enhancements to the FVP port have not yet been translated into the 3442 Juno port. These will be tracked via the tf-issues project. 3443 3444- The Linux kernel version referred to in the user guide has DVFS and HMP 3445 support disabled due to some known instabilities at the time of this release. 3446 A future kernel version will re-enable these features. 3447 3448- DS-5 v5.19 does not detect Version 5.8 of the Cortex-A57-A53 Base FVPs in CADI 3449 server mode. This is because the `<SimName>` reported by the FVP in this 3450 version has changed. For example, for the Cortex-A57x4-A53x4 Base FVP, the 3451 `<SimName>` reported by the FVP is `FVP_Base_Cortex_A57x4_A53x4`, while DS-5 3452 expects it to be `FVP_Base_A57x4_A53x4`. 3453 3454 The temporary fix to this problem is to change the name of the FVP in 3455 `sw/debugger/configdb/Boards/ARM FVP/Base_A57x4_A53x4/cadi_config.xml`. Change 3456 the following line: 3457 3458 ``` 3459 <SimName>System Generator:FVP_Base_A57x4_A53x4</SimName> 3460 ``` 3461 3462 to System Generator:FVP_Base_Cortex-A57x4_A53x4 3463 3464 A similar change can be made to the other Cortex-A57-A53 Base FVP variants. 3465 3466## 0.4 (2014-06-03) 3467 3468### New features 3469 3470- Makefile improvements: 3471 3472 - Improved dependency checking when building. 3473 - Removed `dump` target (build now always produces dump files). 3474 - Enabled platform ports to optionally make use of parts of the Trusted 3475 Firmware (e.g. BL3-1 only), rather than being forced to use all parts. Also 3476 made the `fip` target optional. 3477 - Specified the full path to source files and removed use of the `vpath` 3478 keyword. 3479 3480- Provided translation table library code for potential re-use by platforms 3481 other than the FVPs. 3482 3483- Moved architectural timer setup to platform-specific code. 3484 3485- Added standby state support to PSCI cpu_suspend implementation. 3486 3487- SRAM usage improvements: 3488 3489 - Started using the `-ffunction-sections`, `-fdata-sections` and 3490 `--gc-sections` compiler/linker options to remove unused code and data from 3491 the images. Previously, all common functions were being built into all 3492 binary images, whether or not they were actually used. 3493 - Placed all assembler functions in their own section to allow more unused 3494 functions to be removed from images. 3495 - Updated BL1 and BL2 to use a single coherent stack each, rather than one per 3496 CPU. 3497 - Changed variables that were unnecessarily declared and initialized as 3498 non-const (i.e. in the .data section) so they are either uninitialized (zero 3499 init) or const. 3500 3501- Moved the Test Secure-EL1 Payload (BL3-2) to execute in Trusted SRAM by 3502 default. The option for it to run in Trusted DRAM remains. 3503 3504- Implemented a TrustZone Address Space Controller (TZC-400) driver. A default 3505 configuration is provided for the Base FVPs. This means the model parameter 3506 `-C bp.secure_memory=1` is now supported. 3507 3508- Started saving the PSCI cpu_suspend 'power_state' parameter prior to 3509 suspending a CPU. This allows platforms that implement multiple power-down 3510 states at the same affinity level to identify a specific state. 3511 3512- Refactored the entire codebase to reduce the amount of nesting in header files 3513 and to make the use of system/user includes more consistent. Also split 3514 platform.h to separate out the platform porting declarations from the required 3515 platform porting definitions and the definitions/declarations specific to the 3516 platform port. 3517 3518- Optimized the data cache clean/invalidate operations. 3519 3520- Improved the BL3-1 unhandled exception handling and reporting. Unhandled 3521 exceptions now result in a dump of registers to the console. 3522 3523- Major rework to the handover interface between BL stages, in particular the 3524 interface to BL3-1. The interface now conforms to a specification and is more 3525 future proof. 3526 3527- Added support for optionally making the BL3-1 entrypoint a reset handler 3528 (instead of BL1). This allows platforms with an alternative image loading 3529 architecture to re-use BL3-1 with fewer modifications to generic code. 3530 3531- Reserved some DDR DRAM for secure use on FVP platforms to avoid future 3532 compatibility problems with non-secure software. 3533 3534- Added support for secure interrupts targeting the Secure-EL1 Payload (SP) 3535 (using GICv2 routing only). Demonstrated this working by adding an interrupt 3536 target and supporting test code to the TSP. Also demonstrated non-secure 3537 interrupt handling during TSP processing. 3538 3539### Issues resolved since last release 3540 3541- Now support use of the model parameter `-C bp.secure_memory=1` in the Base 3542 FVPs (see **New features**). 3543- Support for secure world interrupt handling now available (see **New 3544 features**). 3545- Made enough SRAM savings (see **New features**) to enable the Test Secure-EL1 3546 Payload (BL3-2) to execute in Trusted SRAM by default. 3547- The tested filesystem used for this release (Linaro AArch64 OpenEmbedded 3548 14.04) now correctly reports progress in the console. 3549- Improved the Makefile structure to make it easier to separate out parts of the 3550 TF-A for re-use in platform ports. Also, improved target dependency checking. 3551 3552### Known issues 3553 3554- GICv3 support is experimental. The Linux kernel patches to support this are 3555 not widely available. There are known issues with GICv3 initialization in the 3556 TF-A. 3557- Dynamic image loading is not available yet. The current image loader 3558 implementation (used to load BL2 and all subsequent images) has some 3559 limitations. Changing BL2 or BL3-1 load addresses in certain ways can lead to 3560 loading errors, even if the images should theoretically fit in memory. 3561- TF-A still uses too much on-chip Trusted SRAM. A number of RAM usage 3562 enhancements have been identified to rectify this situation. 3563- CPU idle does not work on the advertised version of the Foundation FVP. Some 3564 FVP fixes are required that are not available externally at the time of 3565 writing. This can be worked around by disabling CPU idle in the Linux kernel. 3566- Various bugs in TF-A, UEFI and the Linux kernel have been observed when using 3567 Linaro toolchain versions later than 13.11. Although most of these have been 3568 fixed, some remain at the time of writing. These mainly seem to relate to a 3569 subtle change in the way the compiler converts between 64-bit and 32-bit 3570 values (e.g. during casting operations), which reveals previously hidden bugs 3571 in client code. 3572- The firmware design documentation for the Test Secure-EL1 Payload (TSP) and 3573 its dispatcher (TSPD) is incomplete. Similarly for the PSCI section. 3574 3575## 0.3 (2014-02-28) 3576 3577### New features 3578 3579- Support for Foundation FVP Version 2.0 added. The documented UEFI 3580 configuration disables some devices that are unavailable in the Foundation 3581 FVP, including MMC and CLCD. The resultant UEFI binary can be used on the 3582 AEMv8 and Cortex-A57-A53 Base FVPs, as well as the Foundation FVP. 3583 3584 \:::\{note} The software will not work on Version 1.0 of the Foundation FVP. 3585 \::: 3586 3587- Enabled third party contributions. Added a new contributing.md containing 3588 instructions for how to contribute and updated copyright text in all files to 3589 acknowledge contributors. 3590 3591- The PSCI CPU_SUSPEND API has been stabilised to the extent where it can be 3592 used for entry into power down states with the following restrictions: 3593 3594 - Entry into standby states is not supported. 3595 - The API is only supported on the AEMv8 and Cortex-A57-A53 Base FVPs. 3596 3597- The PSCI AFFINITY_INFO api has undergone limited testing on the Base FVPs to 3598 allow experimental use. 3599 3600- Required C library and runtime header files are now included locally in TF-A 3601 instead of depending on the toolchain standard include paths. The local 3602 implementation has been cleaned up and reduced in scope. 3603 3604- Added I/O abstraction framework, primarily to allow generic code to load 3605 images in a platform-independent way. The existing image loading code has been 3606 reworked to use the new framework. Semi-hosting and NOR flash I/O drivers are 3607 provided. 3608 3609- Introduced Firmware Image Package (FIP) handling code and tools. A FIP 3610 combines multiple firmware images with a Table of Contents (ToC) into a single 3611 binary image. The new FIP driver is another type of I/O driver. The Makefile 3612 builds a FIP by default and the FVP platform code expect to load a FIP from 3613 NOR flash, although some support for image loading using semi- hosting is 3614 retained. 3615 3616 \:::\{note} Building a FIP by default is a non-backwards-compatible change. ::: 3617 3618 \:::\{note} Generic BL2 code now loads a BL3-3 (non-trusted firmware) image 3619 into DRAM instead of expecting this to be pre-loaded at known location. This 3620 is also a non-backwards-compatible change. ::: 3621 3622 \:::\{note} Some non-trusted firmware (e.g. UEFI) will need to be rebuilt so 3623 that it knows the new location to execute from and no longer needs to copy 3624 particular code modules to DRAM itself. ::: 3625 3626- Reworked BL2 to BL3-1 handover interface. A new composite structure 3627 (bl31_args) holds the superset of information that needs to be passed from BL2 3628 to BL3-1, including information on how handover execution control to BL3-2 (if 3629 present) and BL3-3 (non-trusted firmware). 3630 3631- Added library support for CPU context management, allowing the saving and 3632 restoring of 3633 3634 - Shared system registers between Secure-EL1 and EL1. 3635 - VFP registers. 3636 - Essential EL3 system registers. 3637 3638- Added a framework for implementing EL3 runtime services. Reworked the PSCI 3639 implementation to be one such runtime service. 3640 3641- Reworked the exception handling logic, making use of both SP_EL0 and SP_EL3 3642 stack pointers for determining the type of exception, managing general purpose 3643 and system register context on exception entry/exit, and handling SMCs. SMCs 3644 are directed to the correct EL3 runtime service. 3645 3646- Added support for a Test Secure-EL1 Payload (TSP) and a corresponding 3647 Dispatcher (TSPD), which is loaded as an EL3 runtime service. The TSPD 3648 implements Secure Monitor functionality such as world switching and EL1 3649 context management, and is responsible for communication with the TSP. 3650 3651 \:::\{note} The TSPD does not yet contain support for secure world interrupts. 3652 \::: 3653 3654 \:::\{note} The TSP/TSPD is not built by default. ::: 3655 3656### Issues resolved since last release 3657 3658- Support has been added for switching context between secure and normal worlds 3659 in EL3. 3660- PSCI API calls `AFFINITY_INFO` & `PSCI_VERSION` have now been tested (to a 3661 limited extent). 3662- The TF-A build artifacts are now placed in the `./build` directory and 3663 sub-directories instead of being placed in the root of the project. 3664- TF-A is now free from build warnings. Build warnings are now treated as 3665 errors. 3666- TF-A now provides C library support locally within the project to maintain 3667 compatibility between toolchains/systems. 3668- The PSCI locking code has been reworked so it no longer takes locks in an 3669 incorrect sequence. 3670- The RAM-disk method of loading a Linux file-system has been confirmed to work 3671 with the TF-A and Linux kernel version (based on version 3.13) used in this 3672 release, for both Foundation and Base FVPs. 3673 3674### Known issues 3675 3676The following is a list of issues which are expected to be fixed in the future 3677releases of TF-A. 3678 3679- The TrustZone Address Space Controller (TZC-400) is not being programmed yet. 3680 Use of model parameter `-C bp.secure_memory=1` is not supported. 3681- No support yet for secure world interrupt handling. 3682- GICv3 support is experimental. The Linux kernel patches to support this are 3683 not widely available. There are known issues with GICv3 initialization in 3684 TF-A. 3685- Dynamic image loading is not available yet. The current image loader 3686 implementation (used to load BL2 and all subsequent images) has some 3687 limitations. Changing BL2 or BL3-1 load addresses in certain ways can lead to 3688 loading errors, even if the images should theoretically fit in memory. 3689- TF-A uses too much on-chip Trusted SRAM. Currently the Test Secure-EL1 Payload 3690 (BL3-2) executes in Trusted DRAM since there is not enough SRAM. A number of 3691 RAM usage enhancements have been identified to rectify this situation. 3692- CPU idle does not work on the advertised version of the Foundation FVP. Some 3693 FVP fixes are required that are not available externally at the time of 3694 writing. 3695- Various bugs in TF-A, UEFI and the Linux kernel have been observed when using 3696 Linaro toolchain versions later than 13.11. Although most of these have been 3697 fixed, some remain at the time of writing. These mainly seem to relate to a 3698 subtle change in the way the compiler converts between 64-bit and 32-bit 3699 values (e.g. during casting operations), which reveals previously hidden bugs 3700 in client code. 3701- The tested filesystem used for this release (Linaro AArch64 OpenEmbedded 3702 14.01) does not report progress correctly in the console. It only seems to 3703 produce error output, not standard output. It otherwise appears to function 3704 correctly. Other filesystem versions on the same software stack do not exhibit 3705 the problem. 3706- The Makefile structure doesn't make it easy to separate out parts of the TF-A 3707 for re-use in platform ports, for example if only BL3-1 is required in a 3708 platform port. Also, dependency checking in the Makefile is flawed. 3709- The firmware design documentation for the Test Secure-EL1 Payload (TSP) and 3710 its dispatcher (TSPD) is incomplete. Similarly for the PSCI section. 3711 3712## 0.2 (2013-10-25) 3713 3714### New features 3715 3716- First source release. 3717- Code for the PSCI suspend feature is supplied, although this is not enabled by 3718 default since there are known issues (see below). 3719 3720### Issues resolved since last release 3721 3722- The "psci" nodes in the FDTs provided in this release now fully comply with 3723 the recommendations made in the PSCI specification. 3724 3725### Known issues 3726 3727The following is a list of issues which are expected to be fixed in the future 3728releases of TF-A. 3729 3730- The TrustZone Address Space Controller (TZC-400) is not being programmed yet. 3731 Use of model parameter `-C bp.secure_memory=1` is not supported. 3732- No support yet for secure world interrupt handling or for switching context 3733 between secure and normal worlds in EL3. 3734- GICv3 support is experimental. The Linux kernel patches to support this are 3735 not widely available. There are known issues with GICv3 initialization in 3736 TF-A. 3737- Dynamic image loading is not available yet. The current image loader 3738 implementation (used to load BL2 and all subsequent images) has some 3739 limitations. Changing BL2 or BL3-1 load addresses in certain ways can lead to 3740 loading errors, even if the images should theoretically fit in memory. 3741- Although support for PSCI `CPU_SUSPEND` is present, it is not yet stable and 3742 ready for use. 3743- PSCI API calls `AFFINITY_INFO` & `PSCI_VERSION` are implemented but have not 3744 been tested. 3745- The TF-A make files result in all build artifacts being placed in the root of 3746 the project. These should be placed in appropriate sub-directories. 3747- The compilation of TF-A is not free from compilation warnings. Some of these 3748 warnings have not been investigated yet so they could mask real bugs. 3749- TF-A currently uses toolchain/system include files like stdio.h. It should 3750 provide versions of these within the project to maintain compatibility between 3751 toolchains/systems. 3752- The PSCI code takes some locks in an incorrect sequence. This may cause 3753 problems with suspend and hotplug in certain conditions. 3754- The Linux kernel used in this release is based on version 3.12-rc4. Using this 3755 kernel with the TF-A fails to start the file-system as a RAM-disk. It fails to 3756 execute user-space `init` from the RAM-disk. As an alternative, the 3757 VirtioBlock mechanism can be used to provide a file-system to the kernel. 3758 3759______________________________________________________________________ 3760 3761*Copyright (c) 2013-2020, Arm Limited and Contributors. All rights reserved.* 3762 3763[mbed tls releases]: https://tls.mbed.org/tech-updates/releases 3764[pr#1002]: https://github.com/ARM-software/arm-trusted-firmware/pull/1002#issuecomment-312650193 3765[sdei specification]: http://infocenter.arm.com/help/topic/com.arm.doc.den0054a/ARM_DEN0054A_Software_Delegated_Exception_Interface.pdf 3766[tf-issue#501]: https://github.com/ARM-software/tf-issues/issues/501 3767