1Revision history for seL4 2 3For more information see the release notes at https://docs.sel4.systems/sel4_release/ 4 5This file should be word wrapped to 120 characters 6 7The upcoming release notes should indicate whether it is a SOURCE COMPATIBLE, BINARY COMPATIBLE or BREAKING change. As 8changes are added the compatibility information should be updated. 9 10--- 11Upcoming release: BINARY COMPATIBLE 12 13## Changes 14 15 16## Upgrade Notes 17--- 1810.1.1 2018-11-12: BINARY COMPATIBLE 19 20## Changes 21 * Remove theoretical uninitialised variable use in infer_cpu_gic_id for binary translation validation 22 23## Upgrade Notes 24 * 10.1.0 has a known broken test in the proofs. 10.1.1 fixes this test. 25 26--- 2710.1.0 2018-11-07: SOURCE COMPATIBLE 28 29## Changes 30 31 * structures in the boot info are not declared 'packed' 32 - these were previously packed (in the GCC attribute sense) 33 - some field lengths are tweaked to avoid padding 34 - this is a source-compatible change 35 * ARM platforms can now set the trigger of an IRQ Handler capability 36 - seL4_IRQControl_GetTrigger allows users to obtain an IRQ Handler capability 37 and set the trigger (edge or level) in the interrupt controller. 38 * Initial support for NVIDIA Jetson TX2 (ARMv8a, Cortex A57) 39 * AARCH64 support added for raspberry pi 3 platform. 40 * Code generation now use jinja2 instead of tempita. 41 * AARCH32 HYP support added for running multiple ARM VMs 42 * AARCH32 HYP VCPU registers updated. 43 * A new invocation for setting TLSBase on all platforms. 44 - seL4_TCB_SetTLSBase 45 * Kbuild/Kconfig/Makefile build system removed. 46 47--- 4810.0.0 2018-05-28: BREAKING 49 50- Final version of the kernel which supports integration with Kbuild based projects 51- Future versions, including this one, provide a CMake based build system 52 53For more information see https://docs.sel4.systems/Developing/Building. 54 55## Changes 56 57 * x86 IO ports now have an explicit IOPortControl capability to gate their creation. IOPort capabilities may now only 58 be created through the IOPortControl capability that is passed to the rootserver. Additionally IOPort capabilities 59 may not be derived to have smaller ranges and the IOPortControl will not issue overlapping IOPorts 60 * 32-bit support added for the initial prototype RISC-V architecture port 61 62## Upgrade Notes 63 64 * A rootserver must now create IOPort capabilities from the provided IOPortControl capability. As IOPorts can not 65 have their ranges further restricted after creation it must create capabilities with the final desired granularity, 66 remembering that since ranges cannot overlap you cannot issue a larger and smaller range that have any IO ports 67 in common. 68 69--- 709.0.1 2018-04-18: BINARY COMPATIBLE 71 72## Changes 73 * On 64-bit architectures, the `label` field of `seL4_MessageInfo` is now 52 bits wide. User-level programs 74 which use any of the following functions may break, if the program relies on these functions to mask the 75 `label` field to the previous width of 20 bits. 76 - `seL4_MessageInfo_new` 77 - `seL4_MessageInfo_get_label` 78 - `seL4_MessageInfo_set_label` 79 * Initial prototype RISC-V architecture port. This port currently only supports running in 64-bit mode without FPU or 80 or multicore support on the Spike simulation platform. There is *no verification* for this platform. 81 82## Upgrade Notes 83--- 849.0.0 2018-04-11: BREAKING 85 86= Changes = 87 * Debugging option on x86 for syscall interface to read/write MSRs (this is an, equally dangerous, alternative to 88 dangerous code injection) 89 * Mitigation for Meltdown (https://meltdownattack.com) on x86-64 implemented. Mitigation is via a form of kernel 90 page table isolation through the use of a Static Kernel Image with Microstate (SKIM) window that is used for 91 trapping to and from the kernel address space. This can be enabled/disabled through the build configuration 92 depending on whether you are running on vulnerable hardware or not. 93 * Mitigation for Spectre (https://spectreattack.com) on x86 against the kernel implemented. Default is software 94 mitigation and is the best performing so users need to do nothing. This does *not* prevent user processes from 95 exploiting each other. 96 * x86 configuration option for performing branch prediction barrier on context switch to prevent Spectre style 97 attacks between user processes using the indirect branch predictor 98 * x86 configuration option for flushing the RSB on context switch to prevent Spectre style attacks between user 99 processes using the RSB 100 * Define extended bootinfo header for the x86 TSC frequency 101 * x86 TSC frequency exported in extended bootinfo header 102 * `archInfo` is no longer a member of the bootinfo struct. Its only use was for TSC frequency on x86, which 103 can now be retrieved through the extended bootinfo 104 * Invocations to set thread priority and maximum control priority (MCP) have changed. 105 - For both invocations, users must now provide a TCB capability `auth` 106 - The requested MCP/priority is checked against the MCP of the `auth` capability. 107 - Previous behavior checked against the invoked TCB, which could be subject to the confused deputy 108 problem. 109 * seL4_TCB_Configure no longer takes prio, mcp as an argument. Instead these fields must be set separately 110 with seL4_TCB_SetPriority and seL4_TCB_SetMCPriority. 111 * seL4_TCB_SetPriority and seL4_TCB_SetMCPriority now take seL4_Word instead of seL4_Uint8. 112 - seL4_MaxPrio remains at 255. 113 * seL4_TCB_SetSchedParams is a new method where MCP and priority can be set in the same sytsem call. 114 * Size of the TCB object is increased for some build configurations 115 116= Upgrade notes = 117 * seL4_TCB_Configure calls that set priority should be changed to explicitly call seL4_TCB_SetSchedParams 118 or SetPriority 119 * seL4_TCB_Configure calls that set MCP should be changed to explicitly call seL4_TCB_SetSchedParams 120 or seL4_TCB_SetMCPriority 121 122--- 1238.0.0 2018-01-17 124 125= Changes = 126 * Support for additional zynq platform Zynq UltraScale+ MPSoC (Xilinx ZCU102, ARMv8a, Cortex A53) 127 * Support for multiboot2 bootloaders on x86 (contributed change from Genode Labs) 128 * Deprecate seL4_CapData_t type and functions related to it 129 * A fastpath improvement means that when there are two runnable threads and the target thread is the highest priority 130in the scheduler, the fastpath will be hit. Previously the fastpath would not be used on IPC from a high priority 131thread to a low priority thread. 132 * As a consequence of the above change, scheduling behaviour has changed in the case where a non-blocking IPC is sent 133between two same priority threads: the sender will be scheduled, rather than the destination. 134 * Benchmarking support for armv8/aarch64 is now available. 135 * Additional x86 extra bootinfo type for retrieving frame buffer information from multiboot 2 136 * Debugging option to export x86 Performance-Monitoring Counters to user level 137 138= Upgrade notes = 139 * seL4_CapData_t should be replaced with just seL4_Word. Construction of badges should just be `x` instead of 140 `seL4_CapData_Badge_new(x)` and guards should be `seL4_CNode_CapData_new(x, y)` instead of 141 `seL4_CapData_Guard_new(x, y)` 142 * Code that relied on non-blocking IPC to switch between threads of the same priority may break. 143 144--- 1457.0.0 2017-09-05 146 147= Changes = 148 * Support for building standalone ia32 kernel added 149 * ia32: Set sensible defaults for FS and GS selectors 150 * aarch64: Use tpidrro_el0 for IPC buffer instead of tpidr_el0 151 * More seL4 manual documentation added for aarch64 object invocations 152 * Default NUM_DOMAINS set to 16 for x86-64 standalone builds 153 * libsel4: Return seL4_Error in invocation stubs in 8fb06eecff9 ''' This is a source code level breaking change ''' 154 * Add a CMake based build system 155 * x86: Increase TCB size for debug builds 156 * libsel4: x86: Remove nested struct declarations ''' This is a source code level breaking change ''' 157 * Bugfix: x86: Unmap pages when delete non final frame caps 158 159= Upgrade notes = 160 * This release is not source compatible with previous releases. 161 * seL4 invocations that previously returned long now return seL4_Error which is an enum. Our libraries have already 162 been updated to reflect this change, but in other places where seL4 invocations are used directly, the return types 163 will need to be updated to reflect this change. 164 * On x86 some structs in the Bootinfo have been rearranged. This only affects seL4_VBEModeInfoBlock_t which is used if 165 VESA BIOS Extensions (VBE) information is being used. 166 167= Known issues = 168 * One of our tests is non-deterministicly becoming unresponsive on the SMP release build on the Sabre IMX.6 platform, 169 which is a non verified configuration of the kernel. We are working on fixing this problem, and will likely do a 170 point release once it is fixed. 171 172--- 173For previous releases see https://docs.sel4.systems/sel4_release/ 174