diff --git a/Makefile b/Makefile index c2922a0..500b0fc 100644 --- a/Makefile +++ b/Makefile @@ -32,7 +32,7 @@ # Trusted Firmware Version # VERSION_MAJOR := 1 -VERSION_MINOR := 1 +VERSION_MINOR := 2 # Default goal is build all images .DEFAULT_GOAL := all diff --git a/docs/change-log.md b/docs/change-log.md index c7b5508..627b1c2 100644 --- a/docs/change-log.md +++ b/docs/change-log.md @@ -1,3 +1,158 @@ +ARM Trusted Firmware - version 1.2 +================================== + +New features +------------ + +* The Trusted Board Boot implementation on ARM platforms now conforms to the + mandatory requirements of the TBBR specification. + + In particular, the boot process is now guarded by a Trusted Watchdog, which + will reset the system in case of an authentication or loading error. On ARM + platforms, a secure instance of ARM SP805 is used as the Trusted Watchdog. + + Also, a firmware update process has been implemented. It enables + authenticated firmware to update firmware images from external interfaces to + SoC Non-Volatile memories. This feature functions even when the current + firmware in the system is corrupt or missing; it therefore may be used as + a recovery mode. + +* Improvements have been made to the Certificate Generation Tool + (`cert_create`) as follows. + + * Added support for the Firmware Update process by extending the Chain + of Trust definition in the tool to include the Firmware Update + certificate and the required extensions. + + * Introduced a new API that allows one to specify command line options in + the Chain of Trust description. This makes the declaration of the tool's + arguments more flexible and easier to extend. + + * The tool has been reworked to follow a data driven approach, which + makes it easier to maintain and extend. + +* Extended the FIP tool (`fip_create`) to support the new set of images + involved in the Firmware Update process. + +* Various memory footprint improvements. In particular: + + * The bakery lock structure for coherent memory has been optimised. + + * The mbed TLS SHA1 functions are not needed, as SHA256 is used to + generate the certificate signature. Therefore, they have been compiled + out, reducing the memory footprint of BL1 and BL2 by approximately + 6 KB. + + * On ARM development platforms, each BL stage now individually defines + the number of regions that it needs to map in the MMU. + +* Added the following new design documents: + + * [Authentication framework] + * [Firmware Update] + * [TF Reset Design] + * [Power Domain Topology Design] + +* Applied the new image terminology to the code base and documentation, as + described on the [TF wiki on GitHub][TF Image Terminology]. + +* The build system has been reworked to improve readability and facilitate + adding future extensions. + +* On ARM standard platforms, BL31 uses the boot console during cold boot + but switches to the runtime console for any later logs at runtime. The TSP + uses the runtime console for all output. + +* Implemented a basic NOR flash driver for ARM platforms. It programs the + device using CFI (Common Flash Interface) standard commands. + +* Implemented support for booting EL3 payloads on ARM platforms, which + reduces the complexity of developing EL3 baremetal code by doing essential + baremetal initialization. + +* Provided separate drivers for GICv3 and GICv2. These expect the entire + software stack to use either GICv2 or GICv3; hybrid GIC software systems + are no longer supported and the legacy ARM GIC driver has been deprecated. + +* Added support for Juno r1 and r2. A single set of Juno TF binaries can run + on Juno r0, r1 and r2 boards. Note that this TF version depends on a Linaro + release that does *not* contain Juno r2 support. + +* Added support for MediaTek mt8173 platform. + +* Implemented a generic driver for ARM CCN IP. + +* Major rework of the PSCI implementation. + + * Added framework to handle composite power states. + + * Decoupled the notions of affinity instances (which describes the + hierarchical arrangement of cores) and of power domain topology, instead + of assuming a one-to-one mapping. + + * Better alignment with version 1.0 of the PSCI specification. + +* Added support for the SYSTEM_SUSPEND PSCI API on ARM platforms. When invoked + on the last running core on a supported platform, this puts the system + into a low power mode with memory retention. + +* Unified the reset handling code as much as possible across BL stages. + Also introduced some build options to enable optimization of the reset path + on platforms that support it. + +* Added a simple delay timer API, as well as an SP804 timer driver, which is + enabled on FVP. + +* Added support for NVidia Tegra T210 and T132 SoCs. + +* Reorganised ARM platforms ports to greatly improve code shareability and + facilitate the reuse of some of this code by other platforms. + +* Added support for ARM Cortex-A72 processor in the CPU specific framework. + +* Provided better error handling. Platform ports can now define their own + error handling, for example to perform platform specific bookkeeping or + post-error actions. + +* Implemented a unified driver for ARM Cache Coherent Interconnects used for + both CCI-400 & CCI-500 IPs. ARM platforms ports have been migrated to this + common driver. The standalone CCI-400 driver has been deprecated. + + +Issues resolved since last release +---------------------------------- + +* The Trusted Board Boot implementation has been redesigned to provide greater + modularity and scalability. See the [Authentication Framework] document. + All missing mandatory features are now implemented. + +* The FVP and Juno ports may now use the hash of the ROTPK stored in the + Trusted Key Storage registers to verify the ROTPK. Alternatively, a + development public key hash embedded in the BL1 and BL2 binaries might be + used instead. The location of the ROTPK is chosen at build-time using the + `ARM_ROTPK_LOCATION` build option. + +* GICv3 is now fully supported and stable. + + +Known issues +------------ + +* The version of the AEMv8 Base FVP used in this release resets the model + instead of terminating its execution in response to a shutdown request using + the PSCI `SYSTEM_OFF` API. This issue will be fixed in a future version of + the model. + +* While this version has low on-chip RAM requirements, there are further + RAM usage enhancements that could be made. + +* The upstream documentation could be improved for structural consistency, + clarity and completeness. In particular, the design documentation is + incomplete for PSCI, the TSP(D) and the Juno platform. + +* Building TF with compiler optimisations disabled (`-O0`) fails. + + ARM Trusted Firmware - version 1.1 ================================== @@ -707,4 +862,9 @@ _Copyright (c) 2013-2015, ARM Limited and Contributors. All rights reserved._ -[OP-TEE Dispatcher]: ./optee-dispatcher.md +[OP-TEE Dispatcher]: optee-dispatcher.md +[Power Domain Topology Design]: psci-pd-tree.md +[TF Image Terminology]: https://github.com/ARM-software/arm-trusted-firmware/wiki/Trusted-Firmware-Image-Terminology +[Authentication Framework]: auth-framework.md +[Firmware Update]: firmware-update.md +[TF Reset Design]: reset-design.md diff --git a/readme.md b/readme.md index 454b5f1..cc2294b 100644 --- a/readme.md +++ b/readme.md @@ -1,17 +1,13 @@ -ARM Trusted Firmware - version 1.1 +ARM Trusted Firmware - version 1.2 ================================== ARM Trusted Firmware provides a reference implementation of secure world -software for [ARMv8-A], including Exception Level 3 (EL3) software. This release -provides complete support for version 0.2 of the [PSCI] specification, initial -support for the new version 1.0 of that specification, and prototype support for -the Trusted Board Boot Requirements specification. - -The intent is to provide a reference implementation of various ARM interface -standards, such as the Power State Coordination Interface ([PSCI]), Trusted -Board Boot Requirements (TBBR) and [Secure Monitor] [TEE-SMC] code. As far as -possible the code is designed for reuse or porting to other ARMv8-A model and -hardware platforms. +software for [ARMv8-A], including a [Secure Monitor] [TEE-SMC] executing at +Exception Level 3 (EL3). It implements various ARM interface standards, such as +the Power State Coordination Interface ([PSCI]), Trusted Board Boot Requirements +(TBBR, ARM DEN0006C-1) and [SMC Calling Convention][SMCCC]. As far as possible +the code is designed for reuse or porting to other ARMv8-A model and hardware +platforms. ARM will continue development in collaboration with interested parties to provide a full reference implementation of PSCI, TBBR and Secure Monitor code @@ -29,51 +25,58 @@ This Release ------------ -This release is a limited functionality implementation of the Trusted Firmware. -It provides a suitable starting point for productization. Future versions will -contain new features, optimizations and quality improvements. +This release provides a suitable starting point for productization of secure +world boot and runtime firmware. Future versions will contain new features, +optimizations and quality improvements. + +Users are encouraged to do their own security validation, including penetration +testing, on any secure world code derived from ARM Trusted Firmware. ### Functionality -* Prototype implementation of a subset of the Trusted Board Boot Requirements - Platform Design Document (PDD). This includes packaging the various firmware - images into a Firmware Image Package (FIP) to be loaded from non-volatile - storage, and a prototype of authenticated boot using key certificates stored - in the FIP. +* Initialization of the secure world (for example, exception vectors, control + registers, interrupt controller and interrupts for the platform), before + transitioning into the normal world at the Exception Level and Register + Width specified by the platform. -* Initializes the secure world (for example, exception vectors, control - registers, GIC and interrupts for the platform), before transitioning into - the normal world. +* Library support for CPU specific reset and power down sequences. This + includes support for errata workarounds. -* Supports both GICv2 and GICv3 initialization for use by normal world - software. +* Drivers for both the version 2.0 and version 3.0 ARM Generic Interrupt + Controller specifications (GICv2 and GICv3). The latter also enables GICv3 + hardware systems that do not contain legacy GICv2 support. -* Starts the normal world at the Exception Level and Register Width specified - by the platform port. Typically this is AArch64 EL2 if available. +* Drivers to enable standard initialization of ARM System IP, for example + Cache Coherent Interconnect (CCI), Cache Coherent Network (CCN), Network + Interconnect (NIC) and TrustZone Controller (TZC). -* Handles SMCs (Secure Monitor Calls) conforming to the [SMC Calling - Convention PDD] [SMCCC] using an EL3 runtime services framework. +* SMC (Secure Monitor Call) handling, conforming to the [SMC Calling + Convention][SMCCC] using an EL3 runtime services framework. -* Handles SMCs relating to the [Power State Coordination Interface PDD] [PSCI] - for the Secondary CPU Boot, CPU Hotplug, CPU Idle and System Shutdown/Reset - use-cases. +* SMC handling relating to [PSCI] for the Secondary CPU Boot, CPU Hotplug, + CPU Idle and System Shutdown/Reset/Suspend use-cases. + +* Secure Monitor library code such as world switching, EL1 context management + and interrupt routing. This must be integrated with a Secure-EL1 Payload + Dispatcher (SPD) component to customize the interaction with a Secure-EL1 + Payload (SP), for example a Secure OS. * A Test Secure-EL1 Payload and Dispatcher to demonstrate Secure Monitor - functionality such as world switching, EL1 context management and interrupt - routing. This also demonstrates Secure-EL1 interaction with PSCI. Some of - this functionality is provided in library form for re-use by other - Secure-EL1 Payload Dispatchers. + functionality and Secure-EL1 interaction with PSCI. -* Support for alternative Trusted Boot Firmware. Some platforms have their own - Trusted Boot implementation and only require the Secure Monitor - functionality provided by ARM Trusted Firmware. +* SPDs for the [OP-TEE Secure OS] and [NVidia Trusted Little Kernel] + [NVidia TLK]. -* Isolation of memory accessible by the secure world from the normal world - through programming of a TrustZone controller. +* A Trusted Board Boot implementation, conforming to all mandatory TBBR + requirements. This includes image authentication using certificates, a + Firmware Update (or recovery mode) boot flow, and packaging of the various + firmware images into a Firmware Image Package (FIP) to be loaded from + non-volatile storage. -* Support for CPU specific reset sequences, power down sequences and register - dumping during crash reporting. The CPU specific reset sequences include - support for errata workarounds. +* Support for alternative boot flows. Some platforms have their own boot + firmware and only require the ARM Trusted Firmware Secure Monitor + functionality. Other platforms require minimal initialization before + booting into an arbitrary EL3 payload. For a full description of functionality and implementation details, please see the [Firmware Design] and supporting documentation. The [Change Log] @@ -81,33 +84,36 @@ ### Platforms -This release of the Trusted Firmware has been tested on Revision B of the -[Juno ARM Development Platform] [Juno] with Version r0p0-00rel7 of the -[ARM SCP Firmware] [SCP download]. +This release of the Trusted Firmware has been tested on variants r0 and r1 of +the [Juno ARM Development Platform] [Juno] with [Linaro Release 15.10] +[Linaro Release Notes]. The Trusted Firmware has also been tested on the 64-bit Linux versions of the following ARM [FVP]s: -* `Foundation_Platform` (Version 9.1, Build 9.1.33) -* `FVP_Base_AEMv8A-AEMv8A` (Version 6.2, Build 0.8.6202) -* `FVP_Base_Cortex-A57x4-A53x4` (Version 6.2, Build 0.8.6202) -* `FVP_Base_Cortex-A57x1-A53x1` (Version 6.2, Build 0.8.6202) -* `FVP_Base_Cortex-A57x2-A53x4` (Version 6.2, Build 0.8.6202) +* `Foundation_Platform` (Version 9.4, Build 9.4.59) +* `FVP_Base_AEMv8A-AEMv8A` (Version 7.0, Build 0.8.7004) +* `FVP_Base_Cortex-A57x4-A53x4` (Version 7.0, Build 0.8.7004) +* `FVP_Base_Cortex-A57x1-A53x1` (Version 7.0, Build 0.8.7004) +* `FVP_Base_Cortex-A57x2-A53x4` (Version 7.0, Build 0.8.7004) The Foundation FVP can be downloaded free of charge. The Base FVPs can be licensed from ARM: see [www.arm.com/fvp] [FVP]. -### Still to Come +This release also contains the following platform support: -* Complete and more flexible Trusted Board Boot implementation. +* NVidia T210 and T132 SoCs +* MediaTek MT8173 SoC + +### Still to Come * Complete implementation of the [PSCI] v1.0 specification. -* Support for alternative types of Secure-EL1 Payloads. +* Support for new CPUs and System IP. -* Extending the GICv3 support to the secure world. +* More platform support. -* Support for new System IP devices. +* Optimization and quality improvements. For a full list of detailed issues in the current code, please see the [Change Log] and the [GitHub issue tracker]. @@ -155,8 +161,10 @@ [ARMv8-A]: http://www.arm.com/products/processors/armv8-architecture.php "ARMv8-A Architecture" [FVP]: http://www.arm.com/fvp "ARM's Fixed Virtual Platforms" [Juno]: http://www.arm.com/products/tools/development-boards/versatile-express/juno-arm-development-platform.php "Juno ARM Development Platform" -[SCP download]: https://silver.arm.com/download/download.tm?pv=1764630 [PSCI]: http://infocenter.arm.com/help/topic/com.arm.doc.den0022c/DEN0022C_Power_State_Coordination_Interface.pdf "Power State Coordination Interface PDD (ARM DEN 0022C)" [SMCCC]: http://infocenter.arm.com/help/topic/com.arm.doc.den0028a/index.html "SMC Calling Convention PDD (ARM DEN 0028A)" [TEE-SMC]: http://www.arm.com/products/processors/technologies/trustzone/tee-smc.php "Secure Monitor and TEEs" [GitHub issue tracker]: https://github.com/ARM-software/tf-issues/issues +[OP-TEE Secure OS]: https://github.com/OP-TEE/optee_os +[NVidia TLK]: http://nv-tegra.nvidia.com/gitweb/?p=3rdparty/ote_partner/tlk.git;a=summary +[Linaro Release Notes]: https://community.arm.com/docs/DOC-10952#jive_content_id_Linaro_Release_1510