1# Change log 2 3## v2.7 4#### Highlights 5 6* Boot protocol (FF-A v1.1 EAC0) 7 * The SPMC primarily supports passing the SP manifest address at boot time. 8 * In a secure partition package, partition manifest and image offsets are 9 configurable. 10 * Allows for larger partition manifest sizes. 11* Setup and discovery (FF-A v1.1 EAC0) 12 * FFA_VERSION is forwarded from SPMD to SPMC. SPMC records the version of 13 a normal world endpoint. 14 * Added UUID to partition info descriptors. 15 * Introduced count flag to FFA_PARTITION_INFO_GET. 16* Interrupt handling (FF-A v1.1 Beta0) 17 * Physical GIC registers trapped when accessed from secure partitions. 18 * Priority mask register saved/restored on world switches. 19 * Interrupts masked before resuming a pre-empted vCPU. 20 * Implemented implicit secure interrupt completion signal. 21 * Allow unused GICR frame for non-existent PEs. 22* Notifications (FF-A v1.1 EAC0) 23 * Implemented notification pending interrupt and additional test coverage. 24* MTE stack tagging 25 * Implemented FEAT_MTE2 stack tagging support at S-EL2. 26 * Core stacks marked as normal tagged memory. A synchronous abort triggers 27 on a load/store tag check failure. 28 * This permits detection of wrong operations affecting buffers allocated 29 from the stack. 30* FF-A v1.0 compliance 31 * Check composite memory region offset is defined in FF-A memory sharing. 32 * Check sender and receiver memory attributes in a FF-A memory sharing 33 operation match the attributes expected in the Hafnium implementation. 34 * Fix clear memory bit use in FF-A memory sharing from NWd to SWd. 35 * Prevent FF-A memory sharing from a SP to a NS endpoint. 36 * Reject a FF-A memory retrieve operation with the 'Address Range Alignment 37 Hint' bit set (not supported by the implementation). 38 * Refine usage of FF-A memory sharing 'clear memory flag'. 39* Misc 40 * Improved extended memory address ranges support: 41 * 52 bits PA (FEAT_LPA/FEAT_LPA2) architecture extension detected 42 results in limiting the EL2 Stage-1 physical address range to 48 bits. 43 * In the FF-A memory sharing operations, harden address width checks on 44 buffer mapping. 45 * Improved MP SP and S-EL0 partitions support 46 * The physical core index is passed to a SP vCPU0 on booting. 47 * Added MP SP and S-EL0 partitions boot test coverage. 48 * Emulate SMCCC VERSION to the primary VM. 49 * Memory config registers (non-secure and secure virtualization control and 50 translation table base) moved to the vCPU context. 51 * EL2 stage 1 mapping extended to 1TB to support systems with physical 52 address space larger than 512GB. 53 * FFA_RUN ABI hardened to check the vCPU index matches the PE index onto 54 which a vCPU is requested to run. 55 * Fixed missing ISB after CPTR_EL2 update upon PE initialization. 56 * Fixed stage 2 default shareability to inner shareable (from non-shareable) 57 to better support vCPU migration. 58 * Fixed manifest structure allocation from BSS rather than stack 59 at initialization. 60 * Fixed an issue with FF-A memory reclaim executed after memory donate 61 resulting in a returned error code. 62* Build and test environment 63 * Add the ability to use an out-of-tree toolchain. 64 * Primary intent is to permit building Hafnium on Aarch64 hosts. 65 * CI runs using the toolchain versioned in prebuilts submodule. 66 A developer can still use this version as well. 67 * Introduce an assert macro enabled by a build option on the command line. 68 Assertions are checked by default. Production builds can optionally 69 disable assertions. 70 * Added manifest options to permit loading VMs using an FF-A manifest. 71* CI 72 * Added job running the Hypervisor + SPMC configuration on patch 73 submissions. 74 * FVP 75 * Enable secure memory option. 76 * Remove restriction on speculative execution options. 77 * Updated to use model version 11.17 build 21. 78 * Updated linux submodule to v5.10. 79 * VHE EL0 partitions tests automated through jenkins. 80 81#### Known limitations: 82* FF-A v1.1 EAC0 implementation is partial mainly on interrupt handling and 83 memory sharing. 84* Hafnium limits physical interrupt IDs to 64. The legacy virtual interrupt 85 controller driver limits to 64. The recent addition of physical interrupt 86 handling in the SPMC through the GIC assumes a 1:1 mapping of a physical 87 interrupt ID to a virtual interrupt ID. 88* Secure timer virtualization is not supported. 89* The security state of memory or device region cannot be specified in a SP 90 manifest. 91 92## v2.6 93#### Highlights 94* FF-A Setup and discovery 95 * FF-A build time version updated to v1.1. 96 * Managed exit and notifications feature support enabled in SP manifests. 97 * Updated FFA_FEATURES to permit discovery of managed exit, schedule receiver, 98 and notification pending interrupt IDs. 99 * FFA_PARTITION_INFO_GET updated to permit managed exit and notification 100 support discovery. 101 * FFA_SPM_ID_GET added to permit discovering the SPMC endpoint ID (or the 102 SPMD ID at the secure physical FF-A instance). 103 * FFA_RXTX_UNMAP implementation added. 104* FF-A v1.1 notifications 105 * Added ABIs permitting VM (or OS kernel) to SP, and SP to SP asynchronous 106 signaling. 107 * Added generation of scheduler receiver (NS physical) and notification 108 pending (secure virtual) interrupts. 109 * The schedule receiver interrupt is donated from the secure world SGI 110 interrupt ID range. 111* FF-A v1.1 interrupt handling 112 * Added a GIC driver at S-EL2 permitting to trap and handle non-secure and 113 secure interrupts while the secure world runs. 114 * Added forwarding and handling of a secure interrupt while the normal world 115 runs. 116 * Added secure interrupt forwarding to the secure partition that had the 117 interrupt registered in its partition manifest. 118 * The interrupt deactivation happens through the Hafnium para-virtualized 119 interrupt controller interface. 120 * vCPU states, run time models and SP scheduling model are revisited as per 121 FF-A v1.1 Beta0 specification (see 'Known limitations' section below). 122* S-EL0 partitions support 123 * Added support for VHE architecture extension in the secure world (through 124 a build option). 125 * A partition bootstraps as an S-EL0 partition based on the exception-level 126 field in the FF-A manifest. 127 * It permits the implementation of applications on top of Hafnium without 128 relying on an operating system at S-EL1. 129 * It leverages the EL2&0 Stage-1 translation regime. Apps use FF-A 130 ABIs through the SVC conduit. 131 * Added FF-A v1.1 FFA_MEM_PERM_GET/SET ABIs permitting run-time update of 132 memory region permissions. 133 * It supersedes the existing S-EL1 shim architecture (without removing its 134 support). 135 * S-EL1 SP, S-EL0 SP or former S-EL0 SP+shim can all co-exist in the same 136 system. 137* SVE 138 * Support for saving/restoring the SVE live state such that S-EL2/Hafnium 139 preserves the normal world state on world switches. 140 * Secure partitions are permitted to use FP/SIMD while normal world uses 141 SVE/SIMD/FP on the same core. 142 * The SVE NS live state comprises FPCR/FPSR/FFR/p[16]/Z[32] registers. 143* LLVM/Clang 12 144 * The toolchain stored in prebuilts submodule is updated to LLVM 12.0.5. 145 * Build/static analyzer fixes done in the top and third party projects. 146 * Linux sources (used by the test infrastructure) are updated to 5.4.148. 147 The linux test kernel module build is updated to only depend on LLVM 148 toolchain. 149* Hafnium CI improvements 150 * Added two configurations permitting Hafnium testing in the secure world. 151 * First configuration launches both the Hypervisor in the normal world 152 and the SPMC in the secure world. This permits thorough FF-A ABI testing 153 among normal and secure world endpoints. 154 * The second configuration launches the SPMC alone for component testing 155 or SP to SP ABI testing. 156 * Hafnium CI Qemu version updated to v6.0.0 (implements VHE and FEAT_SEL2 157 extensions). 158* FF-A compliance fixes 159 * Added checks for valid memory permissions values in manifest memory and 160 device regions declarations. 161 * FFA_FEATURES fixed to state indirect messages are not supported by 162 the SPMC. 163 * Limit an SP to emit a direct request to another SP only. 164 * Memory sharing: fixed input validation and return values. 165 * FFA_RXTX_MAP fixed returned error codes. 166 * FFA_MSG_WAIT input parameters check hardened. 167 168#### Known limitations: 169* S-EL0 partitions/VHE: the feature is in an experimental stage and not all use 170 cases have been implemented or tested. Normal world to SP and SP to SP memory 171 sharing is not tested. Interrupt handling is not tested. 172* The current implementation does not support handling a secure interrupt that 173 is triggered while currently handling a secure interrupt. This restricts to 174 scenarios described in Table 8.13 and Table 8.14 of the FF-A v1.1 Beta0 175 specification. Priority Mask Register is not saved/restored during context 176 switching while handling secure interrupt. 177* Hafnium CI: scenarios involving the Hypervisor are left as test harness 178 purposes only, not meant for production use cases. 179 180## v2.5 181#### Highlights 182* BTI/Pointer authentication support 183 * Add branch protection build option for FEAT_PAuth and FEAT_BTI to the 184 clang command line. This only affects the S-EL2 image. 185 * Enable pointer authentication by supplying a platform defined pseudo 186 random key. 187 * Enable BTI by setting the guarded page bit in MMU descriptors for 188 executable pages. 189* SMMUv3.2 S-EL2 support 190 * Add support for SMMUv3 driver to perform stage 2 translation, protection 191 and isolation of upstream peripheral device's DMA transactions. 192* FF-A v1.0 Non-secure interrupt handling 193 * Trap physical interrupts to S-EL2 when running a SP. 194 * Handle non secure interrupts that occur while an SP is executing, 195 performing managed exit if supported. 196 * Add basic support for the GICv3 interrupt controller for the AArch64 197 platform. 198* FF-A power management support at boot time 199 * Provide platform-independent power management implementations for the 200 Hypervisor and SPMC. 201 * Implement the FFA_SECONDARY_EP_REGISTER interface for an MP SP or SPMC 202 to register the secondary core cold boot entry point for each of their 203 execution contexts. 204 * Introduce a generic "SPMD handler" to process the power management events 205 that may be conveyed from SPMD to SPMC, such as core off. 206* FF-A Direct message interfaces 207 * Introduce SP to SP direct messaging. 208 * Fix bug in the MP SP to UP SP direct response handling. 209* FF-A Memory sharing interfaces 210 * Introduce SP to SP memory sharing. 211 * When a sender of a memory management operation reclaims memory, set the 212 memory regions permissions back to it's original configuration. 213 * Require default permissions to be supplied to the function 214 'ffa_memory_permissions_to_mode', so in the case where no permissions are 215 specified for a memory operation, the data and instruction permissions can 216 be set to the default. 217 * Encode Bit[63] of the memory region handle according to if the handle is 218 allocated by the Hypervisor or SPMC. 219* FF-A v1.0 spec compliance 220 * Return INVALID_PARAMETER error code instead of NOT_SUPPORTED for direct 221 messaging interfaces when an invalid sender or receiver id is given. 222 * Check that reserved parameter registers are 0 when invoking direct 223 messaging ABI interfaces. 224 * For SMC32 compliant direct message interfaces, only copy 32-bits 225 parameter values. 226 * Change the FF-A error codes to 32-bit to match the FF-A specification. 227 * Fix consistency with maintaining the calling convention bit of the 228 func id between the ffa_handler and the FFA_FEATURES function. 229* Remove primary VM dependencies in the SPMC 230 * Treat normal world as primary VM when running in the secure world. 231 * Create an SPMC boot flow. 232* Hafnium CI 233 * Enable Hafnium CI to include tests for Hafnium SPMC. 234 * Add basic exception handler to service VM's. 235* SIMD support 236 * Add saving/restoring of other world FP/NEON/SIMD state when entering and 237 exiting the SPMC. 238* SPMC early boot cache fix 239 * Import data cache clean and invalidation helpers from TF-A project and 240 provide an arch module for cache operations. 241 * Invalidate the SPMC image in the data cache at boot time to prevent 242 potential access to stale cache entries left by earlier boots stages. 243* Misc and bug fixes 244 * Complete vCPU state save prior to normal world exit. 245 * Update S-EL2 Stage-1 page table shareability from outer to inner. 246 * Add PL011 UART initialization code to set the IDRD and FBRD registers 247 according to the UART clock and baud rate specified at build time. 248 * License script checker fixes. 249 250#### Known limitations: 251* Secure interrupts not supported. 252* FF-A indirect message interface not supported in the secure world. 253* Only supporting models of MultiProcessor SP (vCPUs pinned to physical 254 CPUs) or UniProcessor SP (single vCPU). 255* The first secure partition booted must be a MP SP. 256* FFA_RXTX_UNMAP not implemented. 257* Use of an alternate caller provided buffer from RX/TX buffers for memory 258 sharing operations is not implemented. 259* A memory retrieve request to SPMC does not support the caller endpoint to 260 provide the range of IPA addresses to map the region to. 261 262## v2.4 263 264This is the first drop to implement the TrustZone secure side S-EL2 firmware 265(SPM Core component) complying with FF-A v1.0. 266It is a companion to the broader TF-A v2.4 release. 267The normal world Hypervisor is maintained functional along with the 268Hafnium CI test suite. 269 270#### Highlights 271* FF-A v1.0 Setup and discovery interface 272 * Hypervisor implementation re-used and extended to the SPMC and SPs. 273 * Added partition info get ABI and appropriate properties response depending 274 on partition capabilities (PVM, Secondary VM or Secure Partitions). 275 * FF-A device-tree manifest parsing. 276 * FF-A partitions can declare memory/device regions, and RX/TX buffers that 277 the SPMC sets up in the SP EL1&0 Stage-2 translation regime at boot time. 278 * FF-A IDs normal and secure world split ranges. 279 * The SPMC maps the Hypervisor (or OS kernel) RX/TX buffers as non-secure 280 buffers in its EL2 Stage-1 translation regime on FFA_RXTX_MAP ABI 281 invocation from the non-secure physical FF-A instance. 282* FF-A v1.0 Direct message interface 283 * Added implementation for the normal world Hypervisor and test cases. 284 * Implementation extended to the SPMC and SPs. 285 * Direct message requests emitted from the PVM to a Secondary VM or a 286 Secure Partition (or OS Kernel to a Secure Partition). Direct message 287 responses emitted from Secondary VMs and Secure Partitions to the PVM. 288 * The secure world represents the "other world" (normal world Hypervisor 289 or OS kernel) vCPUs in an abstract "Hypervisor VM". 290* FF-A v1.0 memory sharing 291 * Hypervisor implementation re-used and extended to the SPMC and SPs. 292 * A NS buffer can be shared/lent/donated by a VM to a SP (or OS Kernel 293 to a SP). 294 * The secure world configures Stage-1 NS IPA output to access the NS PA 295 space. 296 * The secure world represents the "other world" (normal world Hypervisor 297 or OS kernel) memory pages in an abstract "Hypervisor VM" and tracks 298 memory sharing permissions from incoming normal world requests. 299* Secure world enablement 300 * Secure Partitions booted in sequence on their primary execution context, 301 according to the boot order field in their partition manifest. 302 This happens during the secure boot process before the normal world 303 actually runs. 304 * The SPMC implements the logic to receive FF-A messages through the EL3 305 SPMD, process them, and either return to the SPMD (and normal world) or 306 resume a Secure Partition. 307 * Extract NS bit from HPFAR_EL2 on Stage-2 page fault. 308 * Prevent setup of LOR regions in SWd. 309 * Avoid direct PSCI calls down to EL3. 310* Platforms 311 * Added Arm FVP secure Hafnium build support. 312 * Added Arm TC0 "Total Compute" secure Hafnium build support. 313* Other improvements 314 * Re-hosting to trustedfirmware.org 315 * busy_secondary timer increased to improve CI stability. 316 * Removed legacy Hypervisor calls. 317 * Fix CPTR_EL2 TTA bit position. 318 * Report FAR_EL2 on injecting EL1 exception. 319#### Known limitations: 320* Not all fields of the FF-A manifest are actually processed by the Hafnium 321 device-tree parser. 322* SP to SP communication not supported. 323* SP to SP memory sharing not supported. 324* S-EL1 and SIMD contexts shall be saved/restored by EL3. 325* Multi-endpoint memory sharing not supported. 326* Interrupt management limited to trapping physical interrupts to 327 the first S-EL1 SP. Physical interrupt trapping at S-EL2 planned as 328 next release improvement. 329* Validation mostly performed using first SP Execution Context (vCPU0). More 330 comprehensive multicore enablement planned as next release improvement. 331