1ARM Trusted Firmware - version 1.0 2================================== 3 4New features 5------------ 6 7* It is now possible to map higher physical addresses using non-flat virtual 8 to physical address mappings in the MMU setup. 9 10* Wider use is now made of the per-CPU data cache in BL3-1 to store: 11 12 * Pointers to the non-secure and secure security state contexts. 13 14 * A pointer to the CPU-specific operations. 15 16 * A pointer to PSCI specific information (for example the current power 17 state). 18 19 * A crash reporting buffer. 20 21* The following RAM usage improvements result in a BL3-1 RAM usage reduction 22 from 96KB to 56KB (for FVP with TSPD), and a total RAM usage reduction 23 across all images from 208KB to 88KB, compared to the previous release. 24 25 * Removed the separate `early_exception` vectors from BL3-1 (2KB code size 26 saving). 27 28 * Removed NSRAM from the FVP memory map, allowing the removal of one 29 (4KB) translation table. 30 31 * Eliminated the internal `psci_suspend_context` array, saving 2KB. 32 33 * Correctly dimensioned the PSCI `aff_map_node` array, saving 1.5KB in the 34 FVP port. 35 36 * Removed calling CPU mpidr from the bakery lock API, saving 160 bytes. 37 38 * Removed current CPU mpidr from PSCI common code, saving 160 bytes. 39 40 * Inlined the mmio accessor functions, saving 360 bytes. 41 42 * Fully reclaimed all BL1 RW memory and BL2 memory on the FVP port by 43 overlaying the BL3-1/BL3-2 NOBITS sections on top of these at runtime. 44 45 * Made storing the FP register context optional, saving 0.5KB per context 46 (8KB on the FVP port, with TSPD enabled and running on 8 CPUs). 47 48 * Implemented a leaner `tf_printf()` function, allowing the stack to be 49 greatly reduced. 50 51 * Removed coherent stacks from the codebase. Stacks allocated in normal 52 memory are now used before and after the MMU is enabled. This saves 768 53 bytes per CPU in BL3-1. 54 55 * Reworked the crash reporting in BL3-1 to use less stack. 56 57 * Optimized the EL3 register state stored in the `cpu_context` structure 58 so that registers that do not change during normal execution are 59 re-initialized each time during cold/warm boot, rather than restored 60 from memory. This saves about 1.2KB. 61 62 * As a result of some of the above, reduced the runtime stack size in all 63 BL images. For BL3-1, this saves 1KB per CPU. 64 65* PSCI SMC handler improvements to correctly handle calls from secure states 66 and from AArch32. 67 68* CPU contexts are now initialized from the `entry_point_info`. BL3-1 fully 69 determines the exception level to use for the non-trusted firmware (BL3-3) 70 based on the SPSR value provided by the BL2 platform code (or otherwise 71 provided to BL3-1). This allows platform code to directly run non-trusted 72 firmware payloads at either EL2 or EL1 without requiring an EL2 stub or OS 73 loader. 74 75* Code refactoring improvements: 76 77 * Refactored `fvp_config` into a common platform header. 78 79 * Refactored the fvp gic code to be a generic driver that no longer has an 80 explicit dependency on platform code. 81 82 * Refactored the CCI-400 driver to not have dependency on platform code. 83 84 * Simplified the IO driver so it's no longer necessary to call `io_init()` 85 and moved all the IO storage framework code to one place. 86 87 * Simplified the interface the the TZC-400 driver. 88 89 * Clarified the platform porting interface to the TSP. 90 91 * Reworked the TSPD setup code to support the alternate BL3-2 92 intialization flow where BL3-1 generic code hands control to BL3-2, 93 rather than expecting the TSPD to hand control directly to BL3-2. 94 95 * Considerable rework to PSCI generic code to support CPU specific 96 operations. 97 98* Improved console log output, by: 99 100 * Adding the concept of debug log levels. 101 102 * Rationalizing the existing debug messages and adding new ones. 103 104 * Printing out the version of each BL stage at runtime. 105 106 * Adding support for printing console output from assembler code, 107 including when a crash occurs before the C runtime is initialized. 108 109* Moved up to the latest versions of the FVPs, toolchain, EDK2, kernel, Linaro 110 file system and DS-5. 111 112* On the FVP port, made the use of the Trusted DRAM region optional at build 113 time (off by default). Normal platforms will not have such a "ready-to-use" 114 DRAM area so it is not a good example to use it. 115 116* Added support for PSCI `SYSTEM_OFF` and `SYSTEM_RESET` APIs. 117 118* Added support for CPU specific reset sequences, power down sequences and 119 register dumping during crash reporting. The CPU specific reset sequences 120 include support for errata workarounds. 121 122* Merged the Juno port into the master branch. Added support for CPU hotplug 123 and CPU idle. Updated the user guide to describe how to build and run on the 124 Juno platform. 125 126 127Issues resolved since last release 128---------------------------------- 129 130* Removed the concept of top/bottom image loading. The image loader now 131 automatically detects the position of the image inside the current memory 132 layout and updates the layout to minimize fragementation. This resolves the 133 image loader limitations of previously releases. There are currently no 134 plans to support dynamic image loading. 135 136* CPU idle now works on the publicized version of the Foundation FVP. 137 138* All known issues relating to the compiler version used have now been 139 resolved. This TF version uses Linaro toolchain 14.07 (based on GCC 4.9). 140 141 142Known issues 143------------ 144 145* GICv3 support is experimental. The Linux kernel patches to support this are 146 not widely available. There are known issues with GICv3 initialization in 147 the ARM Trusted Firmware. 148 149* While this version greatly reduces the on-chip RAM requirements, there are 150 further RAM usage enhancements that could be made. 151 152* The firmware design documentation for the Test Secure-EL1 Payload (TSP) and 153 its dispatcher (TSPD) is incomplete. Similarly for the PSCI section. 154 155* The Juno-specific firmware design documentation is incomplete. 156 157* Some recent enhancements to the FVP port have not yet been translated into 158 the Juno port. These will be tracked via the tf-issues project. 159 160* The Linux kernel version referred to in the user guide has DVFS and HMP 161 support disabled due to some known instabilities at the time of this 162 release. A future kernel version will re-enable these features. 163 164* DS-5 v5.19 does not detect Version 5.8 of the Cortex-A57-A53 Base FVPs in 165 CADI server mode. This is because the `<SimName>` reported by the FVP in 166 this version has changed. For example, for the Cortex-A57x4-A53x4 Base FVP, 167 the `<SimName>` reported by the FVP is `FVP_Base_Cortex_A57x4_A53x4`, while 168 DS-5 expects it to be `FVP_Base_A57x4_A53x4`. 169 170 The temporary fix to this problem is to change the name of the FVP in 171 `sw/debugger/configdb/Boards/ARM FVP/Base_A57x4_A53x4/cadi_config.xml`. 172 Change the following line: 173 174 <SimName>System Generator:FVP_Base_A57x4_A53x4</SimName> 175 to 176 <SimName>System Generator:FVP_Base_Cortex-A57x4_A53x4</SimName> 177 178 A similar change can be made to the other Cortex-A57-A53 Base FVP variants. 179 180 181ARM Trusted Firmware - version 0.4 182================================== 183 184New features 185------------ 186 187* Makefile improvements: 188 189 * Improved dependency checking when building. 190 191 * Removed `dump` target (build now always produces dump files). 192 193 * Enabled platform ports to optionally make use of parts of the Trusted 194 Firmware (e.g. BL3-1 only), rather than being forced to use all parts. 195 Also made the `fip` target optional. 196 197 * Specified the full path to source files and removed use of the `vpath` 198 keyword. 199 200* Provided translation table library code for potential re-use by platforms 201 other than the FVPs. 202 203* Moved architectural timer setup to platform-specific code. 204 205* Added standby state support to PSCI cpu_suspend implementation. 206 207* SRAM usage improvements: 208 209 * Started using the `-ffunction-sections`, `-fdata-sections` and 210 `--gc-sections` compiler/linker options to remove unused code and data 211 from the images. Previously, all common functions were being built into 212 all binary images, whether or not they were actually used. 213 214 * Placed all assembler functions in their own section to allow more unused 215 functions to be removed from images. 216 217 * Updated BL1 and BL2 to use a single coherent stack each, rather than one 218 per CPU. 219 220 * Changed variables that were unnecessarily declared and initialized as 221 non-const (i.e. in the .data section) so they are either uninitialized 222 (zero init) or const. 223 224* Moved the Test Secure-EL1 Payload (BL3-2) to execute in Trusted SRAM by 225 default. The option for it to run in Trusted DRAM remains. 226 227* Implemented a TrustZone Address Space Controller (TZC-400) driver. A 228 default configuration is provided for the Base FVPs. This means the model 229 parameter `-C bp.secure_memory=1` is now supported. 230 231* Started saving the PSCI cpu_suspend 'power_state' parameter prior to 232 suspending a CPU. This allows platforms that implement multiple power-down 233 states at the same affinity level to identify a specific state. 234 235* Refactored the entire codebase to reduce the amount of nesting in header 236 files and to make the use of system/user includes more consistent. Also 237 split platform.h to separate out the platform porting declarations from the 238 required platform porting definitions and the definitions/declarations 239 specific to the platform port. 240 241* Optimized the data cache clean/invalidate operations. 242 243* Improved the BL3-1 unhandled exception handling and reporting. Unhandled 244 exceptions now result in a dump of registers to the console. 245 246* Major rework to the handover interface between BL stages, in particular the 247 interface to BL3-1. The interface now conforms to a specification and is 248 more future proof. 249 250* Added support for optionally making the BL3-1 entrypoint a reset handler 251 (instead of BL1). This allows platforms with an alternative image loading 252 architecture to re-use BL3-1 with fewer modifications to generic code. 253 254* Reserved some DDR DRAM for secure use on FVP platforms to avoid future 255 compatibility problems with non-secure software. 256 257* Added support for secure interrupts targeting the Secure-EL1 Payload (SP) 258 (using GICv2 routing only). Demonstrated this working by adding an interrupt 259 target and supporting test code to the TSP. Also demonstrated non-secure 260 interrupt handling during TSP processing. 261 262 263Issues resolved since last release 264---------------------------------- 265 266* Now support use of the model parameter `-C bp.secure_memory=1` in the Base 267 FVPs (see **New features**). 268 269* Support for secure world interrupt handling now available (see **New 270 features**). 271 272* Made enough SRAM savings (see **New features**) to enable the Test Secure-EL1 273 Payload (BL3-2) to execute in Trusted SRAM by default. 274 275* The tested filesystem used for this release (Linaro AArch64 OpenEmbedded 276 14.04) now correctly reports progress in the console. 277 278* Improved the Makefile structure to make it easier to separate out parts of 279 the Trusted Firmware for re-use in platform ports. Also, improved target 280 dependency checking. 281 282 283Known issues 284------------ 285 286* GICv3 support is experimental. The Linux kernel patches to support this are 287 not widely available. There are known issues with GICv3 initialization in 288 the ARM Trusted Firmware. 289 290* Dynamic image loading is not available yet. The current image loader 291 implementation (used to load BL2 and all subsequent images) has some 292 limitations. Changing BL2 or BL3-1 load addresses in certain ways can lead 293 to loading errors, even if the images should theoretically fit in memory. 294 295* The ARM Trusted Firmware still uses too much on-chip Trusted SRAM. A number 296 of RAM usage enhancements have been identified to rectify this situation. 297 298* CPU idle does not work on the advertised version of the Foundation FVP. 299 Some FVP fixes are required that are not available externally at the time 300 of writing. This can be worked around by disabling CPU idle in the Linux 301 kernel. 302 303* Various bugs in ARM Trusted Firmware, UEFI and the Linux kernel have been 304 observed when using Linaro toolchain versions later than 13.11. Although 305 most of these have been fixed, some remain at the time of writing. These 306 mainly seem to relate to a subtle change in the way the compiler converts 307 between 64-bit and 32-bit values (e.g. during casting operations), which 308 reveals previously hidden bugs in client code. 309 310* The firmware design documentation for the Test Secure-EL1 Payload (TSP) and 311 its dispatcher (TSPD) is incomplete. Similarly for the PSCI section. 312 313 314ARM Trusted Firmware - version 0.3 315================================== 316 317New features 318------------ 319 320* Support for Foundation FVP Version 2.0 added. 321 The documented UEFI configuration disables some devices that are unavailable 322 in the Foundation FVP, including MMC and CLCD. The resultant UEFI binary can 323 be used on the AEMv8 and Cortex-A57-A53 Base FVPs, as well as the Foundation 324 FVP. 325 326 NOTE: The software will not work on Version 1.0 of the Foundation FVP. 327 328* Enabled third party contributions. Added a new contributing.md containing 329 instructions for how to contribute and updated copyright text in all files 330 to acknowledge contributors. 331 332* The PSCI CPU_SUSPEND API has been stabilised to the extent where it can be 333 used for entry into power down states with the following restrictions: 334 - Entry into standby states is not supported. 335 - The API is only supported on the AEMv8 and Cortex-A57-A53 Base FVPs. 336 337* The PSCI AFFINITY_INFO api has undergone limited testing on the Base FVPs to 338 allow experimental use. 339 340* Required C library and runtime header files are now included locally in ARM 341 Trusted Firmware instead of depending on the toolchain standard include 342 paths. The local implementation has been cleaned up and reduced in scope. 343 344* Added I/O abstraction framework, primarily to allow generic code to load 345 images in a platform-independent way. The existing image loading code has 346 been reworked to use the new framework. Semi-hosting and NOR flash I/O 347 drivers are provided. 348 349* Introduced Firmware Image Package (FIP) handling code and tools. A FIP 350 combines multiple firmware images with a Table of Contents (ToC) into a 351 single binary image. The new FIP driver is another type of I/O driver. The 352 Makefile builds a FIP by default and the FVP platform code expect to load a 353 FIP from NOR flash, although some support for image loading using semi- 354 hosting is retained. 355 356 NOTE: Building a FIP by default is a non-backwards-compatible change. 357 358 NOTE: Generic BL2 code now loads a BL3-3 (non-trusted firmware) image into 359 DRAM instead of expecting this to be pre-loaded at known location. This is 360 also a non-backwards-compatible change. 361 362 NOTE: Some non-trusted firmware (e.g. UEFI) will need to be rebuilt so that 363 it knows the new location to execute from and no longer needs to copy 364 particular code modules to DRAM itself. 365 366* Reworked BL2 to BL3-1 handover interface. A new composite structure 367 (bl31_args) holds the superset of information that needs to be passed from 368 BL2 to BL3-1, including information on how handover execution control to 369 BL3-2 (if present) and BL3-3 (non-trusted firmware). 370 371* Added library support for CPU context management, allowing the saving and 372 restoring of 373 - Shared system registers between Secure-EL1 and EL1. 374 - VFP registers. 375 - Essential EL3 system registers. 376 377* Added a framework for implementing EL3 runtime services. Reworked the PSCI 378 implementation to be one such runtime service. 379 380* Reworked the exception handling logic, making use of both SP_EL0 and SP_EL3 381 stack pointers for determining the type of exception, managing general 382 purpose and system register context on exception entry/exit, and handling 383 SMCs. SMCs are directed to the correct EL3 runtime service. 384 385* Added support for a Test Secure-EL1 Payload (TSP) and a corresponding 386 Dispatcher (TSPD), which is loaded as an EL3 runtime service. The TSPD 387 implements Secure Monitor functionality such as world switching and 388 EL1 context management, and is responsible for communication with the TSP. 389 NOTE: The TSPD does not yet contain support for secure world interrupts. 390 NOTE: The TSP/TSPD is not built by default. 391 392 393Issues resolved since last release 394---------------------------------- 395 396* Support has been added for switching context between secure and normal 397 worlds in EL3. 398 399* PSCI API calls `AFFINITY_INFO` & `PSCI_VERSION` have now been tested (to 400 a limited extent). 401 402* The ARM Trusted Firmware build artifacts are now placed in the `./build` 403 directory and sub-directories instead of being placed in the root of the 404 project. 405 406* The ARM Trusted Firmware is now free from build warnings. Build warnings 407 are now treated as errors. 408 409* The ARM Trusted Firmware now provides C library support locally within the 410 project to maintain compatibility between toolchains/systems. 411 412* The PSCI locking code has been reworked so it no longer takes locks in an 413 incorrect sequence. 414 415* The RAM-disk method of loading a Linux file-system has been confirmed to 416 work with the ARM Trusted Firmware and Linux kernel version (based on 417 version 3.13) used in this release, for both Foundation and Base FVPs. 418 419 420Known issues 421------------ 422 423The following is a list of issues which are expected to be fixed in the future 424releases of the ARM Trusted Firmware. 425 426* The TrustZone Address Space Controller (TZC-400) is not being programmed 427 yet. Use of model parameter `-C bp.secure_memory=1` is not supported. 428 429* No support yet for secure world interrupt handling. 430 431* GICv3 support is experimental. The Linux kernel patches to support this are 432 not widely available. There are known issues with GICv3 initialization in 433 the ARM Trusted Firmware. 434 435* Dynamic image loading is not available yet. The current image loader 436 implementation (used to load BL2 and all subsequent images) has some 437 limitations. Changing BL2 or BL3-1 load addresses in certain ways can lead 438 to loading errors, even if the images should theoretically fit in memory. 439 440* The ARM Trusted Firmware uses too much on-chip Trusted SRAM. Currently the 441 Test Secure-EL1 Payload (BL3-2) executes in Trusted DRAM since there is not 442 enough SRAM. A number of RAM usage enhancements have been identified to 443 rectify this situation. 444 445* CPU idle does not work on the advertised version of the Foundation FVP. 446 Some FVP fixes are required that are not available externally at the time 447 of writing. 448 449* Various bugs in ARM Trusted Firmware, UEFI and the Linux kernel have been 450 observed when using Linaro toolchain versions later than 13.11. Although 451 most of these have been fixed, some remain at the time of writing. These 452 mainly seem to relate to a subtle change in the way the compiler converts 453 between 64-bit and 32-bit values (e.g. during casting operations), which 454 reveals previously hidden bugs in client code. 455 456* The tested filesystem used for this release (Linaro AArch64 OpenEmbedded 457 14.01) does not report progress correctly in the console. It only seems to 458 produce error output, not standard output. It otherwise appears to function 459 correctly. Other filesystem versions on the same software stack do not 460 exhibit the problem. 461 462* The Makefile structure doesn't make it easy to separate out parts of the 463 Trusted Firmware for re-use in platform ports, for example if only BL3-1 is 464 required in a platform port. Also, dependency checking in the Makefile is 465 flawed. 466 467* The firmware design documentation for the Test Secure-EL1 Payload (TSP) and 468 its dispatcher (TSPD) is incomplete. Similarly for the PSCI section. 469 470 471ARM Trusted Firmware - version 0.2 472================================== 473 474New features 475------------ 476 477* First source release. 478 479* Code for the PSCI suspend feature is supplied, although this is not enabled 480 by default since there are known issues (see below). 481 482 483Issues resolved since last release 484---------------------------------- 485 486* The "psci" nodes in the FDTs provided in this release now fully comply 487 with the recommendations made in the PSCI specification. 488 489 490Known issues 491------------ 492 493The following is a list of issues which are expected to be fixed in the future 494releases of the ARM Trusted Firmware. 495 496* The TrustZone Address Space Controller (TZC-400) is not being programmed 497 yet. Use of model parameter `-C bp.secure_memory=1` is not supported. 498 499* No support yet for secure world interrupt handling or for switching context 500 between secure and normal worlds in EL3. 501 502* GICv3 support is experimental. The Linux kernel patches to support this are 503 not widely available. There are known issues with GICv3 initialization in 504 the ARM Trusted Firmware. 505 506* Dynamic image loading is not available yet. The current image loader 507 implementation (used to load BL2 and all subsequent images) has some 508 limitations. Changing BL2 or BL3-1 load addresses in certain ways can lead 509 to loading errors, even if the images should theoretically fit in memory. 510 511* Although support for PSCI `CPU_SUSPEND` is present, it is not yet stable 512 and ready for use. 513 514* PSCI API calls `AFFINITY_INFO` & `PSCI_VERSION` are implemented but have not 515 been tested. 516 517* The ARM Trusted Firmware make files result in all build artifacts being 518 placed in the root of the project. These should be placed in appropriate 519 sub-directories. 520 521* The compilation of ARM Trusted Firmware is not free from compilation 522 warnings. Some of these warnings have not been investigated yet so they 523 could mask real bugs. 524 525* The ARM Trusted Firmware currently uses toolchain/system include files like 526 stdio.h. It should provide versions of these within the project to maintain 527 compatibility between toolchains/systems. 528 529* The PSCI code takes some locks in an incorrect sequence. This may cause 530 problems with suspend and hotplug in certain conditions. 531 532* The Linux kernel used in this release is based on version 3.12-rc4. Using 533 this kernel with the ARM Trusted Firmware fails to start the file-system as 534 a RAM-disk. It fails to execute user-space `init` from the RAM-disk. As an 535 alternative, the VirtioBlock mechanism can be used to provide a file-system 536 to the kernel. 537 538 539- - - - - - - - - - - - - - - - - - - - - - - - - - 540 541_Copyright (c) 2013-2014, ARM Limited and Contributors. All rights reserved._ 542