Merge pull request #475 from danh-arm/dh/v1.2-final
Final v1.2 release changes
diff --git a/Makefile b/Makefile
index c2922a0..500b0fc 100644
--- a/Makefile
+++ b/Makefile
@@ -32,7 +32,7 @@
# Trusted Firmware Version
#
VERSION_MAJOR := 1
-VERSION_MINOR := 1
+VERSION_MINOR := 2
# Default goal is build all images
.DEFAULT_GOAL := all
diff --git a/docs/change-log.md b/docs/change-log.md
index c7b5508..627b1c2 100644
--- a/docs/change-log.md
+++ b/docs/change-log.md
@@ -1,3 +1,158 @@
+ARM Trusted Firmware - version 1.2
+==================================
+
+New features
+------------
+
+* The Trusted Board Boot implementation on ARM platforms now conforms to the
+ mandatory requirements of the TBBR specification.
+
+ In particular, the boot process is now guarded by a Trusted Watchdog, which
+ will reset the system in case of an authentication or loading error. On ARM
+ platforms, a secure instance of ARM SP805 is used as the Trusted Watchdog.
+
+ Also, a firmware update process has been implemented. It enables
+ authenticated firmware to update firmware images from external interfaces to
+ SoC Non-Volatile memories. This feature functions even when the current
+ firmware in the system is corrupt or missing; it therefore may be used as
+ a recovery mode.
+
+* Improvements have been made to the Certificate Generation Tool
+ (`cert_create`) as follows.
+
+ * Added support for the Firmware Update process by extending the Chain
+ of Trust definition in the tool to include the Firmware Update
+ certificate and the required extensions.
+
+ * Introduced a new API that allows one to specify command line options in
+ the Chain of Trust description. This makes the declaration of the tool's
+ arguments more flexible and easier to extend.
+
+ * The tool has been reworked to follow a data driven approach, which
+ makes it easier to maintain and extend.
+
+* Extended the FIP tool (`fip_create`) to support the new set of images
+ involved in the Firmware Update process.
+
+* Various memory footprint improvements. In particular:
+
+ * The bakery lock structure for coherent memory has been optimised.
+
+ * The mbed TLS SHA1 functions are not needed, as SHA256 is used to
+ generate the certificate signature. Therefore, they have been compiled
+ out, reducing the memory footprint of BL1 and BL2 by approximately
+ 6 KB.
+
+ * On ARM development platforms, each BL stage now individually defines
+ the number of regions that it needs to map in the MMU.
+
+* Added the following new design documents:
+
+ * [Authentication framework]
+ * [Firmware Update]
+ * [TF Reset Design]
+ * [Power Domain Topology Design]
+
+* Applied the new image terminology to the code base and documentation, as
+ described on the [TF wiki on GitHub][TF Image Terminology].
+
+* The build system has been reworked to improve readability and facilitate
+ adding future extensions.
+
+* On ARM standard platforms, BL31 uses the boot console during cold boot
+ but switches to the runtime console for any later logs at runtime. The TSP
+ uses the runtime console for all output.
+
+* Implemented a basic NOR flash driver for ARM platforms. It programs the
+ device using CFI (Common Flash Interface) standard commands.
+
+* Implemented support for booting EL3 payloads on ARM platforms, which
+ reduces the complexity of developing EL3 baremetal code by doing essential
+ baremetal initialization.
+
+* Provided separate drivers for GICv3 and GICv2. These expect the entire
+ software stack to use either GICv2 or GICv3; hybrid GIC software systems
+ are no longer supported and the legacy ARM GIC driver has been deprecated.
+
+* Added support for Juno r1 and r2. A single set of Juno TF binaries can run
+ on Juno r0, r1 and r2 boards. Note that this TF version depends on a Linaro
+ release that does *not* contain Juno r2 support.
+
+* Added support for MediaTek mt8173 platform.
+
+* Implemented a generic driver for ARM CCN IP.
+
+* Major rework of the PSCI implementation.
+
+ * Added framework to handle composite power states.
+
+ * Decoupled the notions of affinity instances (which describes the
+ hierarchical arrangement of cores) and of power domain topology, instead
+ of assuming a one-to-one mapping.
+
+ * Better alignment with version 1.0 of the PSCI specification.
+
+* Added support for the SYSTEM_SUSPEND PSCI API on ARM platforms. When invoked
+ on the last running core on a supported platform, this puts the system
+ into a low power mode with memory retention.
+
+* Unified the reset handling code as much as possible across BL stages.
+ Also introduced some build options to enable optimization of the reset path
+ on platforms that support it.
+
+* Added a simple delay timer API, as well as an SP804 timer driver, which is
+ enabled on FVP.
+
+* Added support for NVidia Tegra T210 and T132 SoCs.
+
+* Reorganised ARM platforms ports to greatly improve code shareability and
+ facilitate the reuse of some of this code by other platforms.
+
+* Added support for ARM Cortex-A72 processor in the CPU specific framework.
+
+* Provided better error handling. Platform ports can now define their own
+ error handling, for example to perform platform specific bookkeeping or
+ post-error actions.
+
+* Implemented a unified driver for ARM Cache Coherent Interconnects used for
+ both CCI-400 & CCI-500 IPs. ARM platforms ports have been migrated to this
+ common driver. The standalone CCI-400 driver has been deprecated.
+
+
+Issues resolved since last release
+----------------------------------
+
+* The Trusted Board Boot implementation has been redesigned to provide greater
+ modularity and scalability. See the [Authentication Framework] document.
+ All missing mandatory features are now implemented.
+
+* The FVP and Juno ports may now use the hash of the ROTPK stored in the
+ Trusted Key Storage registers to verify the ROTPK. Alternatively, a
+ development public key hash embedded in the BL1 and BL2 binaries might be
+ used instead. The location of the ROTPK is chosen at build-time using the
+ `ARM_ROTPK_LOCATION` build option.
+
+* GICv3 is now fully supported and stable.
+
+
+Known issues
+------------
+
+* The version of the AEMv8 Base FVP used in this release resets the model
+ instead of terminating its execution in response to a shutdown request using
+ the PSCI `SYSTEM_OFF` API. This issue will be fixed in a future version of
+ the model.
+
+* While this version has low on-chip RAM requirements, there are further
+ RAM usage enhancements that could be made.
+
+* The upstream documentation could be improved for structural consistency,
+ clarity and completeness. In particular, the design documentation is
+ incomplete for PSCI, the TSP(D) and the Juno platform.
+
+* Building TF with compiler optimisations disabled (`-O0`) fails.
+
+
ARM Trusted Firmware - version 1.1
==================================
@@ -707,4 +862,9 @@
_Copyright (c) 2013-2015, ARM Limited and Contributors. All rights reserved._
-[OP-TEE Dispatcher]: ./optee-dispatcher.md
+[OP-TEE Dispatcher]: optee-dispatcher.md
+[Power Domain Topology Design]: psci-pd-tree.md
+[TF Image Terminology]: https://github.com/ARM-software/arm-trusted-firmware/wiki/Trusted-Firmware-Image-Terminology
+[Authentication Framework]: auth-framework.md
+[Firmware Update]: firmware-update.md
+[TF Reset Design]: reset-design.md
diff --git a/readme.md b/readme.md
index 454b5f1..cc2294b 100644
--- a/readme.md
+++ b/readme.md
@@ -1,17 +1,13 @@
-ARM Trusted Firmware - version 1.1
+ARM Trusted Firmware - version 1.2
==================================
ARM Trusted Firmware provides a reference implementation of secure world
-software for [ARMv8-A], including Exception Level 3 (EL3) software. This release
-provides complete support for version 0.2 of the [PSCI] specification, initial
-support for the new version 1.0 of that specification, and prototype support for
-the Trusted Board Boot Requirements specification.
-
-The intent is to provide a reference implementation of various ARM interface
-standards, such as the Power State Coordination Interface ([PSCI]), Trusted
-Board Boot Requirements (TBBR) and [Secure Monitor] [TEE-SMC] code. As far as
-possible the code is designed for reuse or porting to other ARMv8-A model and
-hardware platforms.
+software for [ARMv8-A], including a [Secure Monitor] [TEE-SMC] executing at
+Exception Level 3 (EL3). It implements various ARM interface standards, such as
+the Power State Coordination Interface ([PSCI]), Trusted Board Boot Requirements
+(TBBR, ARM DEN0006C-1) and [SMC Calling Convention][SMCCC]. As far as possible
+the code is designed for reuse or porting to other ARMv8-A model and hardware
+platforms.
ARM will continue development in collaboration with interested parties to
provide a full reference implementation of PSCI, TBBR and Secure Monitor code
@@ -29,51 +25,58 @@
This Release
------------
-This release is a limited functionality implementation of the Trusted Firmware.
-It provides a suitable starting point for productization. Future versions will
-contain new features, optimizations and quality improvements.
+This release provides a suitable starting point for productization of secure
+world boot and runtime firmware. Future versions will contain new features,
+optimizations and quality improvements.
+
+Users are encouraged to do their own security validation, including penetration
+testing, on any secure world code derived from ARM Trusted Firmware.
### Functionality
-* Prototype implementation of a subset of the Trusted Board Boot Requirements
- Platform Design Document (PDD). This includes packaging the various firmware
- images into a Firmware Image Package (FIP) to be loaded from non-volatile
- storage, and a prototype of authenticated boot using key certificates stored
- in the FIP.
+* Initialization of the secure world (for example, exception vectors, control
+ registers, interrupt controller and interrupts for the platform), before
+ transitioning into the normal world at the Exception Level and Register
+ Width specified by the platform.
-* Initializes the secure world (for example, exception vectors, control
- registers, GIC and interrupts for the platform), before transitioning into
- the normal world.
+* Library support for CPU specific reset and power down sequences. This
+ includes support for errata workarounds.
-* Supports both GICv2 and GICv3 initialization for use by normal world
- software.
+* Drivers for both the version 2.0 and version 3.0 ARM Generic Interrupt
+ Controller specifications (GICv2 and GICv3). The latter also enables GICv3
+ hardware systems that do not contain legacy GICv2 support.
-* Starts the normal world at the Exception Level and Register Width specified
- by the platform port. Typically this is AArch64 EL2 if available.
+* Drivers to enable standard initialization of ARM System IP, for example
+ Cache Coherent Interconnect (CCI), Cache Coherent Network (CCN), Network
+ Interconnect (NIC) and TrustZone Controller (TZC).
-* Handles SMCs (Secure Monitor Calls) conforming to the [SMC Calling
- Convention PDD] [SMCCC] using an EL3 runtime services framework.
+* SMC (Secure Monitor Call) handling, conforming to the [SMC Calling
+ Convention][SMCCC] using an EL3 runtime services framework.
-* Handles SMCs relating to the [Power State Coordination Interface PDD] [PSCI]
- for the Secondary CPU Boot, CPU Hotplug, CPU Idle and System Shutdown/Reset
- use-cases.
+* SMC handling relating to [PSCI] for the Secondary CPU Boot, CPU Hotplug,
+ CPU Idle and System Shutdown/Reset/Suspend use-cases.
+
+* Secure Monitor library code such as world switching, EL1 context management
+ and interrupt routing. This must be integrated with a Secure-EL1 Payload
+ Dispatcher (SPD) component to customize the interaction with a Secure-EL1
+ Payload (SP), for example a Secure OS.
* A Test Secure-EL1 Payload and Dispatcher to demonstrate Secure Monitor
- functionality such as world switching, EL1 context management and interrupt
- routing. This also demonstrates Secure-EL1 interaction with PSCI. Some of
- this functionality is provided in library form for re-use by other
- Secure-EL1 Payload Dispatchers.
+ functionality and Secure-EL1 interaction with PSCI.
-* Support for alternative Trusted Boot Firmware. Some platforms have their own
- Trusted Boot implementation and only require the Secure Monitor
- functionality provided by ARM Trusted Firmware.
+* SPDs for the [OP-TEE Secure OS] and [NVidia Trusted Little Kernel]
+ [NVidia TLK].
-* Isolation of memory accessible by the secure world from the normal world
- through programming of a TrustZone controller.
+* A Trusted Board Boot implementation, conforming to all mandatory TBBR
+ requirements. This includes image authentication using certificates, a
+ Firmware Update (or recovery mode) boot flow, and packaging of the various
+ firmware images into a Firmware Image Package (FIP) to be loaded from
+ non-volatile storage.
-* Support for CPU specific reset sequences, power down sequences and register
- dumping during crash reporting. The CPU specific reset sequences include
- support for errata workarounds.
+* Support for alternative boot flows. Some platforms have their own boot
+ firmware and only require the ARM Trusted Firmware Secure Monitor
+ functionality. Other platforms require minimal initialization before
+ booting into an arbitrary EL3 payload.
For a full description of functionality and implementation details, please
see the [Firmware Design] and supporting documentation. The [Change Log]
@@ -81,33 +84,36 @@
### Platforms
-This release of the Trusted Firmware has been tested on Revision B of the
-[Juno ARM Development Platform] [Juno] with Version r0p0-00rel7 of the
-[ARM SCP Firmware] [SCP download].
+This release of the Trusted Firmware has been tested on variants r0 and r1 of
+the [Juno ARM Development Platform] [Juno] with [Linaro Release 15.10]
+[Linaro Release Notes].
The Trusted Firmware has also been tested on the 64-bit Linux versions of the
following ARM [FVP]s:
-* `Foundation_Platform` (Version 9.1, Build 9.1.33)
-* `FVP_Base_AEMv8A-AEMv8A` (Version 6.2, Build 0.8.6202)
-* `FVP_Base_Cortex-A57x4-A53x4` (Version 6.2, Build 0.8.6202)
-* `FVP_Base_Cortex-A57x1-A53x1` (Version 6.2, Build 0.8.6202)
-* `FVP_Base_Cortex-A57x2-A53x4` (Version 6.2, Build 0.8.6202)
+* `Foundation_Platform` (Version 9.4, Build 9.4.59)
+* `FVP_Base_AEMv8A-AEMv8A` (Version 7.0, Build 0.8.7004)
+* `FVP_Base_Cortex-A57x4-A53x4` (Version 7.0, Build 0.8.7004)
+* `FVP_Base_Cortex-A57x1-A53x1` (Version 7.0, Build 0.8.7004)
+* `FVP_Base_Cortex-A57x2-A53x4` (Version 7.0, Build 0.8.7004)
The Foundation FVP can be downloaded free of charge. The Base FVPs can be
licensed from ARM: see [www.arm.com/fvp] [FVP].
-### Still to Come
+This release also contains the following platform support:
-* Complete and more flexible Trusted Board Boot implementation.
+* NVidia T210 and T132 SoCs
+* MediaTek MT8173 SoC
+
+### Still to Come
* Complete implementation of the [PSCI] v1.0 specification.
-* Support for alternative types of Secure-EL1 Payloads.
+* Support for new CPUs and System IP.
-* Extending the GICv3 support to the secure world.
+* More platform support.
-* Support for new System IP devices.
+* Optimization and quality improvements.
For a full list of detailed issues in the current code, please see the [Change
Log] and the [GitHub issue tracker].
@@ -155,8 +161,10 @@
[ARMv8-A]: http://www.arm.com/products/processors/armv8-architecture.php "ARMv8-A Architecture"
[FVP]: http://www.arm.com/fvp "ARM's Fixed Virtual Platforms"
[Juno]: http://www.arm.com/products/tools/development-boards/versatile-express/juno-arm-development-platform.php "Juno ARM Development Platform"
-[SCP download]: https://silver.arm.com/download/download.tm?pv=1764630
[PSCI]: http://infocenter.arm.com/help/topic/com.arm.doc.den0022c/DEN0022C_Power_State_Coordination_Interface.pdf "Power State Coordination Interface PDD (ARM DEN 0022C)"
[SMCCC]: http://infocenter.arm.com/help/topic/com.arm.doc.den0028a/index.html "SMC Calling Convention PDD (ARM DEN 0028A)"
[TEE-SMC]: http://www.arm.com/products/processors/technologies/trustzone/tee-smc.php "Secure Monitor and TEEs"
[GitHub issue tracker]: https://github.com/ARM-software/tf-issues/issues
+[OP-TEE Secure OS]: https://github.com/OP-TEE/optee_os
+[NVidia TLK]: http://nv-tegra.nvidia.com/gitweb/?p=3rdparty/ote_partner/tlk.git;a=summary
+[Linaro Release Notes]: https://community.arm.com/docs/DOC-10952#jive_content_id_Linaro_Release_1510
