1# OP-TEE - version 3.8.0 (2020-01-24) 2 3- Links to the release pages, commits and pull requests merged into this release for: 4 - OP-TEE/optee_os: [release page][OP_TEE_optee_os_release_3_8_0], [commits][OP_TEE_optee_os_commits_3_8_0] and [pull requests][OP_TEE_optee_os_pr_3_8_0] 5 - OP-TEE/optee_client: [release page][OP_TEE_optee_client_release_3_8_0], [commits][OP_TEE_optee_client_commits_3_8_0] and [pull requests][OP_TEE_optee_client_pr_3_8_0] 6 - OP-TEE/optee_test: [release page][OP_TEE_optee_test_release_3_8_0], [commits][OP_TEE_optee_test_commits_3_8_0] and [pull requests][OP_TEE_optee_test_pr_3_8_0] 7 - OP-TEE/build: [release page][OP_TEE_build_release_3_8_0], [commits][OP_TEE_build_commits_3_8_0] and [pull requests][OP_TEE_build_pr_3_8_0] 8 - linaro-swg/optee_examples: [release page][linaro_swg_optee_examples_release_3_8_0], [commits][linaro_swg_optee_examples_commits_3_8_0] and [pull requests][linaro_swg_optee_examples_pr_3_8_0] 9 10 11[OP_TEE_optee_os_release_3_8_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.8.0 12[OP_TEE_optee_os_commits_3_8_0]: https://github.com/OP-TEE/optee_os/compare/3.7.0...3.8.0 13[OP_TEE_optee_os_pr_3_8_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-01-24 14 15[OP_TEE_optee_client_release_3_8_0]: https://github.com/OP-TEE/optee_client/releases/tag/3.8.0 16[OP_TEE_optee_client_commits_3_8_0]: https://github.com/OP-TEE/optee_client/compare/3.7.0...3.8.0 17[OP_TEE_optee_client_pr_3_8_0]: https://github.com/OP-TEE/optee_client/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2020-01-24 18 19[OP_TEE_optee_test_release_3_8_0]: https://github.com/OP-TEE/optee_test/releases/tag/3.8.0 20[OP_TEE_optee_test_commits_3_8_0]: https://github.com/OP-TEE/optee_test/compare/3.7.0...3.8.0 21[OP_TEE_optee_test_pr_3_8_0]: https://github.com/OP-TEE/optee_test/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2020-01-24 22 23[OP_TEE_build_release_3_8_0]: https://github.com/OP-TEE/build/releases/tag/3.8.0 24[OP_TEE_build_commits_3_8_0]: https://github.com/OP-TEE/build/compare/3.7.0...3.8.0 25[OP_TEE_build_pr_3_8_0]: https://github.com/OP-TEE/build/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2020-01-24 26 27[linaro_swg_optee_examples_release_3_8_0]: https://github.com/linaro-swg/optee_examples/releases/tag/3.8.0 28[linaro_swg_optee_examples_commits_3_8_0]: https://github.com/linaro-swg/optee_examples/compare/3.7.0...3.8.0 29[linaro_swg_optee_examples_pr_3_8_0]: https://github.com/linaro-swg/optee_examples/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2020-01-24 30 31# OP-TEE - version 3.7.0 (2019-10-18) 32 33- Links to the release pages, commits and pull requests merged into this release for: 34 - OP-TEE/optee_os: [release page][OP_TEE_optee_os_release_3_7_0], [commits][OP_TEE_optee_os_commits_3_7_0] and [pull requests][OP_TEE_optee_os_pr_3_7_0] 35 - OP-TEE/optee_client: [release page][OP_TEE_optee_client_release_3_7_0], [commits][OP_TEE_optee_client_commits_3_7_0] and [pull requests][OP_TEE_optee_client_pr_3_7_0] 36 - OP-TEE/optee_test: [release page][OP_TEE_optee_test_release_3_7_0], [commits][OP_TEE_optee_test_commits_3_7_0] and [pull requests][OP_TEE_optee_test_pr_3_7_0] 37 - OP-TEE/build: [release page][OP_TEE_build_release_3_7_0], [commits][OP_TEE_build_commits_3_7_0] and [pull requests][OP_TEE_build_pr_3_7_0] 38 - linaro-swg/optee_examples: [release page][linaro_swg_optee_examples_release_3_7_0], [commits][linaro_swg_optee_examples_commits_3_7_0] and [pull requests][linaro_swg_optee_examples_pr_3_7_0] 39 40 41[OP_TEE_optee_os_release_3_7_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.7.0 42[OP_TEE_optee_os_commits_3_7_0]: https://github.com/OP-TEE/optee_os/compare/3.6.0...3.7.0 43[OP_TEE_optee_os_pr_3_7_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 44 45[OP_TEE_optee_client_release_3_7_0]: https://github.com/OP-TEE/optee_client/releases/tag/3.7.0 46[OP_TEE_optee_client_commits_3_7_0]: https://github.com/OP-TEE/optee_client/compare/3.6.0...3.7.0 47[OP_TEE_optee_client_pr_3_7_0]: https://github.com/OP-TEE/optee_client/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 48 49[OP_TEE_optee_test_release_3_7_0]: https://github.com/OP-TEE/optee_test/releases/tag/3.7.0 50[OP_TEE_optee_test_commits_3_7_0]: https://github.com/OP-TEE/optee_test/compare/3.6.0...3.7.0 51[OP_TEE_optee_test_pr_3_7_0]: https://github.com/OP-TEE/optee_test/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 52 53[OP_TEE_build_release_3_7_0]: https://github.com/OP-TEE/build/releases/tag/3.7.0 54[OP_TEE_build_commits_3_7_0]: https://github.com/OP-TEE/build/compare/3.6.0...3.7.0 55[OP_TEE_build_pr_3_7_0]: https://github.com/OP-TEE/build/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 56 57[linaro_swg_optee_examples_release_3_7_0]: https://github.com/linaro-swg/optee_examples/releases/tag/3.7.0 58[linaro_swg_optee_examples_commits_3_7_0]: https://github.com/linaro-swg/optee_examples/compare/3.6.0...3.7.0 59[linaro_swg_optee_examples_pr_3_7_0]: https://github.com/linaro-swg/optee_examples/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 60 61# OP-TEE - version 3.6.0 (2019-07-05) 62 63- Link to the GitHub [release page][github_release_3_6_0]. 64- Links to the [commits][github_commits_3_6_0] and 65[pull requests][github_pr_3_6_0] merged into this release. 66 67[github_release_3_6_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.6.0 68[github_commits_3_6_0]: https://github.com/OP-TEE/optee_os/compare/3.5.0...3.6.0 69[github_pr_3_6_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-04-26..2019-07-05 70 71# OP-TEE - version 3.5.0 (2019-04-26) 72 73- Link to the GitHub [release page][github_release_3_5_0]. 74- Links to the [commits][github_commits_3_5_0] and 75[pull requests][github_pr_3_5_0] merged into this release. 76 77[github_release_3_5_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.5.0 78[github_commits_3_5_0]: https://github.com/OP-TEE/optee_os/compare/3.4.0...3.5.0 79[github_pr_3_5_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-01-26..2019-04-26 80 81# OP-TEE - version 3.4.0 (2019-01-25) 82 83- Link to the GitHub [release page][github_release_3_4_0]. 84- Links to the [commits][github_commits_3_4_0] and 85[pull requests][github_pr_3_4_0] merged into this release. 86 87[github_release_3_4_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.4.0 88[github_commits_3_4_0]: https://github.com/OP-TEE/optee_os/compare/3.3.0...3.4.0 89[github_pr_3_4_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-10-12..2019-01-25 90 91# OP-TEE - version 3.3.0 (2018-10-12) 92 93- Link to the GitHub [release page][github_release_3_3_0]. 94- Links to the [commits][github_commits_3_3_0] and 95[pull requests][github_pr_3_3_0] merged into this release. 96 97[github_release_3_3_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.3.0 98[github_commits_3_3_0]: https://github.com/OP-TEE/optee_os/compare/3.2.0...3.3.0 99[github_pr_3_3_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-07-04..2018-10-12 100 101# OP-TEE - version 3.2.0 (2018-07-04) 102 103- Link to the GitHub [release page][github_release_3_2_0]. 104- Links to the [commits][github_commits_3_2_0] and 105[pull requests][github_pr_3_2_0] merged into this release. 106 107## Known issues 108 109* HiKey960: assertion in bget create_free_block() \[memalign() self-test\] ([#2414]) 110* D02: assertion '!have_spinlock()' ([#2437]) 111 112[github_commits_3_2_0]: https://github.com/OP-TEE/optee_os/compare/3.1.0...3.2.0 113[github_pr_3_2_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-04-13..2018-07-04 114[github_release_3_2_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.2.0 115[#2414]: https://github.com/OP-TEE/optee_os/issues/2414 116[#2437]: https://github.com/OP-TEE/optee_os/issues/2437 117 118# OP-TEE - version 3.1.0 (2018-04-13) 119 120- Link to the GitHub [release page][github_release_3_1_0]. 121- Links to the [commits][github_commits_3_1_0] and 122[pull requests][github_pr_3_1_0] merged into this release. 123 124[github_commits_3_1_0]: https://github.com/OP-TEE/optee_os/compare/3.0.0...3.1.0 125[github_pr_3_1_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-01-26..2018-04-13 126[github_release_3_1_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.1.0 127 128# OP-TEE - version 3.0.0 (2018-01-26) 129 130[Link][github_commits_3_0_0] to a list of all commits between this release and 131the previous one (2.6.0). 132 133About backwards compatibility: Trusted Applications built with OP-TEE 2.5.0 or 134earlier will not run properly with a *debug* build of this release due 135to commit [0e1c6e8e][commit_0e1c6e8e] ("Dump call stack on TA panic"). 136Non-debug builds are not affected. 137 138## New features 139 140* New supported platforms: Armada 3700 ([#1946]), Poplar ([#1999]), 64-bit 141 support for FSL ls1012ardb ([#1941]), i.MX6SX Sabreauto ([#1974]). 142* arm32: sm: init CNTVOFF ([#2052]) 143* Debug/info/error traces: make output more compact ([#2011]) 144* tzc380: implement new functions ([#1994]) 145* Secure Data Path: add pseudo-TA to convert VA to PA (#1993]) 146* Pager: use NEON AES GCM implementation ([#1959]) 147* Crypto: add optimized AES GCM implementation using NEON ([#1949]) 148* Add support for using secure storage for TA anti-rollback ([#1928]) 149* Crypto: replace struct crypto_ops with function interface ([#1923], 150 [#1931]) 151* aosp_optee.mk: define OPTEE_BIN ([#1922]) 152* Add build option to allow concurrent execution of single-instance TAs 153 ([#1915]) 154* Pager: support for address sanitizer ([#1856]) 155* Pager: make memory between CFG_TEE_RAM_START and TEE load address usable by 156 pager ([#1826]) 157 158## Bug fixes 159 160* Fix crash in tee_mmu_final() on TA loading error ([#2092]) 161* LibTomCrypt: fix issue causing invalid output when using AES CTR with 162hardware acceleration (CFG_CRYPTO_WITH_CE) ([#2086]) 163* pl310: fix cache sync ([#2035]) 164* tzc380: do not write reserved bits ([#1994]) 165* Fix potential double free in ta_open() ([#1970]) 166* libfdt: fix undefined behaviour in fdt_offset_ptr() ([#1969]) 167* imx_wdog: fix register access ([#1966]) 168* Secure storage: fix potential memory leak after early return ([#1961]) 169* LibTomCrypt: fix double free in dsa_import() ([#1963]) 170* RPMB: fix TA independance issue in secure storage ([#1921]) 171* RPMB: return TEE_ERROR_ACCESS_CONFLICT instead of panicking when a TA 172 attempts to create an existing persistent object without the overwrite flag 173 ([#1919]) 174* PSCI: pass non-secure context to psci_system_suspend() ([#1916]) 175* Fix "Argument list too long" during "make clean" ([#1897]) 176 177## Security fixes 178 179* Mitigations and hardening against the Spectre and Meltdown vulnerabilities 180 (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754). 181 182## Known issues 183 184* Secure storage (REE FS): storage size not updated after 185TEE_TruncateObjectData() ([#2094]) 186* Possible deadlock with CFG_WITH_PAGER=y when loading a TA and not enough 187page tables are available in pgt_cache ([#2080]) 188 189## Tested on 190 191The release was tested successfully on the platforms listed below. 192 193<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 194* d02 195* hikey 196* hikey-hikey960 197* imx-mx6ulevk 198* imx-mx7dsabresd 199* marvell-armada7k8k 200* marvell-armada3700 201* mediatek-mt8173 202* rcar-salvator_m3 203* rockchip-rk322x 204* rpi3 205* sam 206* ti 207* vexpress-juno 208* vexpress-qemu_armv8a 209* vexpress-qemu_virt 210 211[commit_0e1c6e8e]: https://github.com/OP-TEE/optee_os/commit/0e1c6e8e 212[github_commits_3_0_0]: https://github.com/OP-TEE/optee_os/compare/2.6.0...3.0.0 213[#2092]: https://github.com/OP-TEE/optee_os/pull/2092 214[#2086]: https://github.com/OP-TEE/optee_os/pull/2086 215[#2094]: https://github.com/OP-TEE/optee_os/issues/2094 216[#2080]: https://github.com/OP-TEE/optee_os/issues/2080 217[#2052]: https://github.com/OP-TEE/optee_os/pull/2052 218[#2035]: https://github.com/OP-TEE/optee_os/pull/2035 219[#2011]: https://github.com/OP-TEE/optee_os/pull/2011 220[#1999]: https://github.com/OP-TEE/optee_os/pull/1999 221[#1994]: https://github.com/OP-TEE/optee_os/pull/1994 222[#1993]: https://github.com/OP-TEE/optee_os/pull/1993 223[#1974]: https://github.com/OP-TEE/optee_os/pull/1974 224[#1970]: https://github.com/OP-TEE/optee_os/pull/1970 225[#1969]: https://github.com/OP-TEE/optee_os/pull/1969 226[#1966]: https://github.com/OP-TEE/optee_os/pull/1966 227[#1963]: https://github.com/OP-TEE/optee_os/pull/1963 228[#1961]: https://github.com/OP-TEE/optee_os/pull/1961 229[#1959]: https://github.com/OP-TEE/optee_os/pull/1959 230[#1949]: https://github.com/OP-TEE/optee_os/pull/1949 231[#1946]: https://github.com/OP-TEE/optee_os/pull/1946 232[#1941]: https://github.com/OP-TEE/optee_os/pull/1941 233[#1931]: https://github.com/OP-TEE/optee_os/pull/1931 234[#1928]: https://github.com/OP-TEE/optee_os/pull/1928 235[#1923]: https://github.com/OP-TEE/optee_os/pull/1923 236[#1922]: https://github.com/OP-TEE/optee_os/pull/1922 237[#1921]: https://github.com/OP-TEE/optee_os/pull/1921 238[#1919]: https://github.com/OP-TEE/optee_os/pull/1919 239[#1916]: https://github.com/OP-TEE/optee_os/pull/1916 240[#1915]: https://github.com/OP-TEE/optee_os/pull/1915 241[#1897]: https://github.com/OP-TEE/optee_os/pull/1897 242[#1856]: https://github.com/OP-TEE/optee_os/pull/1856 243[#1826]: https://github.com/OP-TEE/optee_os/pull/1826 244 245# OP-TEE - version 2.6.0 246 247[Link][github_commits_2_6_0] to a list of all commits between this release and 248the previous one (2.5.0). 249 250## New features 251 252* New supported platforms: Atmel SAMA5 ([#1714]), HiSilicon HiKey960 ([#1684]), 253 Rockchip RK322X ([#1666]), NXP LS1043A-RDB/LS1046A-RDB ([#1787]), Marvell 254 Armada 70x0/80x0 ([#1807]). 255* Dynamic shared memory (non-contiguous, non-secure memory can be mapped into 256 Trusted Applications VA space) ([#1631]) 257* Dump TA call stack on panic ([#1858]) 258* i.MX: PSCI reset ([#1849]) 259* plat-ti: AM43xx: suspend/resume support ([#1822]) 260* QEMU SMP support ([#1820]) 261* plat-ti: AM43xx: disable TRNG ([#1816]) 262* plat-ti: enable Secure Data Path by default ([#1815]) 263* Improve symbolize.py ([#1778], [#1767], [#1766]) 264* Early TAs (TAs linked in tee.bin) ([#1733]) 265* Suspend/resume framework for arm32 and imx7d support ([#1729]) 266* RK322X PSCI version, features and suspend support ([#1720]) 267* arm32: handle aborts in system mode ([#1703]) 268* i.MX: add SNVS SRTC support ([#1700]) 269* GCC7 support ([#1693]) 270* Improve detection of programming errors in locking code ([#1671], [#1670]) 271* Support TEE RAM size larger than page directory size ([#1669]) 272 273## Removed features 274 275* Remove TUI code ([#1842]) 276 277## Bug fixes 278 279* Add missing synchronization barrier in core_mmu_map_pages() ([#1827]) 280* Secure storage: REE FS: fix bug in error path ([#1801]) 281* ASAN bug fixes ([#1799]) 282* Fix race in core_mmu_user_mapping_is_active() ([#1785]) 283* libutee: printf() and puts() fixes, add putchar() ([#1759], [#1754]) 284* arm32: GICv3: fix FIQ masking in IRQ/ABT/SVC/UND handlers ([#1748]) 285* arm32: preserve r12 in native_intr_handler() ([#1682]) 286* arm64: fix print_kernel_stack() ([#1664]) 287* benchmark: fix core data-abort ([#1658]) 288 289## Security fixes or enhancements 290 291* crypto: fix software PRNG weaknesses 292 ([OP-TEE-2017-0001][OP-TEE-2017-0001]) ([#1843]) 293 294## Tested on 295 296The release was tested successfully on the platforms listed below. 297If a platform is not listed, it means the release was not tested on this 298platform. 299 300<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 301* d02 302* hikey 303* hikey-hikey960 304* imx-mx6ulevk 305* imx-mx7dsabresd 306* ls-ls1021a??? (single core) 307* ls-ls1043ardb 308* ls-ls1046ardb 309* mediatek-mt8173 310* rcar 311* rockchip-rk322x 312* rpi3 313* sam 314* stm-b2260 315* stm-cannes 316* ti-??? 317* vexpress-fvp 318* vexpress-juno 319* vexpress-qemu_armv8a 320* vexpress-qemu_virt 321 322[github_commits_2_6_0]: https://github.com/OP-TEE/optee_os/compare/2.5.0...2.6.0 323[#1858]: https://github.com/OP-TEE/optee_os/issues/1858 324[#1849]: https://github.com/OP-TEE/optee_os/issues/1849 325[#1843]: https://github.com/OP-TEE/optee_os/issues/1843 326[#1842]: https://github.com/OP-TEE/optee_os/issues/1842 327[#1827]: https://github.com/OP-TEE/optee_os/issues/1827 328[#1822]: https://github.com/OP-TEE/optee_os/issues/1822 329[#1820]: https://github.com/OP-TEE/optee_os/issues/1820 330[#1816]: https://github.com/OP-TEE/optee_os/issues/1816 331[#1815]: https://github.com/OP-TEE/optee_os/issues/1815 332[#1807]: https://github.com/OP-TEE/optee_os/issues/1807 333[#1801]: https://github.com/OP-TEE/optee_os/issues/1801 334[#1799]: https://github.com/OP-TEE/optee_os/issues/1799 335[#1787]: https://github.com/OP-TEE/optee_os/issues/1787 336[#1785]: https://github.com/OP-TEE/optee_os/issues/1785 337[#1778]: https://github.com/OP-TEE/optee_os/issues/1778 338[#1767]: https://github.com/OP-TEE/optee_os/issues/1767 339[#1766]: https://github.com/OP-TEE/optee_os/issues/1766 340[#1759]: https://github.com/OP-TEE/optee_os/issues/1759 341[#1754]: https://github.com/OP-TEE/optee_os/issues/1754 342[#1748]: https://github.com/OP-TEE/optee_os/issues/1748 343[#1733]: https://github.com/OP-TEE/optee_os/issues/1733 344[#1729]: https://github.com/OP-TEE/optee_os/issues/1729 345[#1720]: https://github.com/OP-TEE/optee_os/issues/1720 346[#1714]: https://github.com/OP-TEE/optee_os/issues/1714 347[#1703]: https://github.com/OP-TEE/optee_os/issues/1703 348[#1700]: https://github.com/OP-TEE/optee_os/issues/1700 349[#1693]: https://github.com/OP-TEE/optee_os/issues/1693 350[#1684]: https://github.com/OP-TEE/optee_os/issues/1684 351[#1682]: https://github.com/OP-TEE/optee_os/issues/1682 352[#1671]: https://github.com/OP-TEE/optee_os/issues/1671 353[#1670]: https://github.com/OP-TEE/optee_os/issues/1670 354[#1669]: https://github.com/OP-TEE/optee_os/issues/1669 355[#1666]: https://github.com/OP-TEE/optee_os/issues/1666 356[#1664]: https://github.com/OP-TEE/optee_os/issues/1664 357[#1658]: https://github.com/OP-TEE/optee_os/issues/1658 358[#1631]: https://github.com/OP-TEE/optee_os/issues/1631 359[OP-TEE-2017-0001]: https://www.op-tee.org/security-advisories/ 360 361# OP-TEE - version 2.5.0 362 363[Link][github_commits_2_5_0] to a list of all commits between this release and 364the previous one (2.4.0). 365 366## New features 367 368* New supported platform: i.MX7D ([#1639]) 369* Secure storage: anti-rollback protection for REE FS using RPMB FS ([#1630]) 370* Assign non-secure DDR configuration from DT if CFG_DT=y ([#1623]) 371* Add new image format: split image into three separate binaries suitable for 372 upcoming ARM Trusted Firmware ([#1589]). 373* Make alignment check configurable ([#1586]) 374* drivers: add TZC380 driver ([#1578]) 375* plat-imx: PSCI CPU off ([#1577]) 376* 64-bit paging on QEMU v8 and HiKey ([#1575], [#1592]) 377* Benchmark framework ([#1365]) 378* Dump call stack of user TAs on abort ([#1552]) 379* plat-hikey: enable Secure Data Path ([#1440]) 380* Add interface to load and decrypt/authenticate user TAs ([#1513]) 381* plat-ti: add secure paging support ([#1493]) 382* plat-ti: add OTP hardware key support ([#1492]) 383* Support ARM GICv3 ([#1465]) 384 385## Removed features 386 387* stm-orly2 is not supported anymore ([#1650]) 388* Remove secure storage based on SQL FS (`CFG_SQL_FS=y`) ([#1490]) 389* Remove support for mapping user TAs with 1 MiB or 2 MiB granularity 390 (`CFG_SMALL_PAGE_USER_TA=n`) ([#1559]). TAs are always mapped using small 391 pages. 392 393## Bug fixes 394 395* Reduce size of non-pageable code ([#1621]) 396* Ignore `TA_FLAG_MULTI_SESSION` and `TA_FLAG_INSTANCE_KEEP_ALIVE` when 397 `TA_FLAG_SINGLE_INSTANCE` is not set ([#1574]) 398* libutee: remove buffering for AES GCM (PR#1573) and AES CTR ([#1580]) 399* Fix ROUNDUP()/ROUNDDOWN() macros ([#1519]) 400* Do not touch other bits in GICD_CTLR ([#1508]) 401* Fix build issue with `DEBUG=y` and `CFG_TEE_CORE_LOG_LEVEL=0` ([#1502]) 402* crypto: do not restrict hash size when algorithm is ECDSA ([#1497]) 403 404## Security fixes or enhancements 405 406- crypto: fix RSA key leakage after fault injection attack 407 ([OP-TEE-2016-0003][OP-TEE-2016-0003]) ([#1610]) 408* crypto: fix RSA key leakage after side channel attack 409 ([OP-TEE-2016-0002][OP-TEE-2016-0002]) ([#1610]) 410* Make pager aliased pages not always writable ([#1551]) 411* Support for no-exec RO and RW data ([#1459], [#1550]) 412 413## New issues 414 415* armv7: some platform-specific code (`plat_cpu_reset_early()`) overwrites 416SCTLR bits configured by generic code. This affects alignment checks (`SCTLR.A`) 417and write-implies-no-exec (`SCTLR.WXN`, `SCTLR.UWXN`), which can therefore not 418be configured via the compile-time `CFG_` variables. 419* armv7: plat-imx: Cortex-A9 cores should enable branch prediction (`SCLTR.Z`) 420for improved performance. 421* [#1656] qemu_armv8a: init hangs when secure data path and pager are both 422 enabled. 423 424## Tested on 425 426In the list below, _standard_ means that the `xtest` program passed with 427its default configuration, while _extended_ means it was run successfully 428with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 429v1.1.0.4. 430 431If a platform is not listed, it means the release was not tested on this 432platform. 433 434<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 435* d02: extended 436* hikey: extended 437* imx-mx6ulevk: standard 438* imx-mx6ullevk: standard 439* imx-mx7dsabresd: standard 440* ls-ls1021atwr: standard 441* mediatek-mt8173: standard 442* rcar-h3: standard 443* rpi3: standard 444* stm-b2260: extended 445* stm-cannes: extended 446* ti-am43xx: standard 447* ti-am57xx: standard 448* ti-dra7xx: standard 449* vexpress-fvp: standard 450* vexpress-juno: standard 451* vexpress-qemu_armv8a: standard 452* vexpress-qemu_virt: standard 453 454[github_commits_2_5_0]: https://github.com/OP-TEE/optee_os/compare/2.4.0...2.5.0-rc1 455[#1656]: https://github.com/OP-TEE/optee_os/issues/1656 456[#1650]: https://github.com/OP-TEE/optee_os/pull/1650 457[#1639]: https://github.com/OP-TEE/optee_os/pull/1639 458[#1630]: https://github.com/OP-TEE/optee_os/pull/1630 459[#1623]: https://github.com/OP-TEE/optee_os/pull/1623 460[#1621]: https://github.com/OP-TEE/optee_os/pull/1621 461[#1610]: https://github.com/OP-TEE/optee_os/pull/1610 462[#1592]: https://github.com/OP-TEE/optee_os/pull/1592 463[#1589]: https://github.com/OP-TEE/optee_os/pull/1589 464[#1586]: https://github.com/OP-TEE/optee_os/pull/1586 465[#1580]: https://github.com/OP-TEE/optee_os/pull/1580 466[#1578]: https://github.com/OP-TEE/optee_os/pull/1578 467[#1577]: https://github.com/OP-TEE/optee_os/pull/1577 468[#1574]: https://github.com/OP-TEE/optee_os/pull/1574 469[#1559]: https://github.com/OP-TEE/optee_os/pull/1559 470[#1551]: https://github.com/OP-TEE/optee_os/pull/1551 471[#1550]: https://github.com/OP-TEE/optee_os/pull/1550 472[#1519]: https://github.com/OP-TEE/optee_os/pull/1519 473[#1502]: https://github.com/OP-TEE/optee_os/pull/1502 474[#1365]: https://github.com/OP-TEE/optee_os/pull/1365 475[#1552]: https://github.com/OP-TEE/optee_os/pull/1552 476[#1513]: https://github.com/OP-TEE/optee_os/pull/1513 477[#1508]: https://github.com/OP-TEE/optee_os/pull/1508 478[#1493]: https://github.com/OP-TEE/optee_os/pull/1493 479[#1497]: https://github.com/OP-TEE/optee_os/pull/1497 480[#1492]: https://github.com/OP-TEE/optee_os/pull/1492 481[#1490]: https://github.com/OP-TEE/optee_os/pull/1490 482[#1465]: https://github.com/OP-TEE/optee_os/pull/1465 483[#1459]: https://github.com/OP-TEE/optee_os/pull/1459 484[#1440]: https://github.com/OP-TEE/optee_os/pull/1440 485[OP-TEE-2016-0003]: https://www.op-tee.org/security-advisories/ 486[OP-TEE-2016-0002]: https://www.op-tee.org/security-advisories/ 487 488# OP-TEE - version 2.4.0 489 490[Link][github_commits_2_4_0] to a list of all commits between this release and 491the previous one (2.3.0). 492 493Please note: this release is API-compatible with the previous one, but the 494Secure Storage internal format for the REE and SQL FS is not compatible due to 495commits [a238b74][commit_a238b74] ("core: REE FS: use the new hash tree 496interface") and [44e900e][commit_44e900e] ("core: SQL FS: use the new hash tree 497interface"). 498 499## New features 500 501* Add porting guidelines 502 503* Add support for Secure Data Path which allows Client and Trusted Applications 504 to share references to secure memory 505 506* New supported platform: Texas Instruments AM57xx (`PLATFORM=ti-am57xx`) 507 508* ARMv7-A: add support for platform services in secure monitor and add these 509 services for the DRA7xx platform 510 511* SPI framework and PL022 driver cleanup and improvements 512 513* Use CNTPCT (when available) to add entropy to the software PRNG 514 515* Add GlobalPlatform Socket API for UDP and TCP (IPv4 and IPv6) 516 517* DRA7: add TRNG driver, enable GICv2 driver 518 519* Support load address larger than 4G 520 521* libutee: preserve error code when calling TEE_Panic() for easier 522 troubleshooting 523 524* Support TA profiling with gprof (-pg compiler switch) 525 526* Optimize the ELF loader for TAs when pager is enabled 527 528* Update documentation 529 530* Add paged secure shared memory that can be transferred between TAs as 531 needed 532 533* Introduce MOBJ abstraction 534 535* i.MX6: add PSCI "on" function 536 537* arm32: introduce PSCI framework 538 539## Bug fixes 540 541* Secure storage: improve integrity checking of the REE and SQL filesystems by 542 adding a hash tree on the internal data structures. Any external modification 543 is detected, except full rollback. Fixes [#1188][issue1188]. 544 545* The linux driver will set the 'privileged' flag (TEE_GEN_CAP_PRIVILEGED) on 546 the device intended for use by tee-supplicant. Fixes [#1199][issue1199]. 547 548* RPMB: don't try to program the RPMB key by default 549 550* Fix "make clean" error cases 551 552* Fix issue when resetting persistent storage enumerator [#1332][issue1332] 553 554* Fix TA panic when doing AES CTS with specific buffer sizes 555 [#1203][issue1203]. 556 557## Known issues 558 559* On RPi3 xtest sometimes stall (rcu_sched self-detected stall on CPU) [#1353][issue1353] 560* For multi-core PSCI support is to be added for ls1021atwr in OP-TEE. 561* USB keyboard cannot be used to stop the u-boot timeout ([build issue131]). 562* Travis service (build.git) seems unstable from time to time. 563 564## Tested on 565 566In the list below, _standard_ means that the `xtest` program passed with 567its default configuration, while _extended_ means it was run successfully 568with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 569v1.1.0.4. 570 571If a platform is not listed, it means the release was not tested on this 572platform. 573 574<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 575* d02: extended 576* hikey: extended 577* imx-mx6ulevk: standard 578* ls-ls1021atwr: standard (single core) 579* mediatek-mt8173: standard 580* rcar-h3: standard 581* rpi3: standard 582* stm-b2260: extended 583* ti-dra7xx: standard 584* vexpress-fvp: standard 585* vexpress-juno: standard 586* vexpress-qemu_armv8a: standard 587* vexpress-qemu_virt: standard 588* zynqmp-zc1751_dc1: standard 589* zynqmp-zc1751_dc2: standard 590* zynqmp-zcu102: standard 591 592[github_commits_2_4_0]: https://github.com/OP-TEE/optee_os/compare/2.3.0...2.4.0 593[issue1332]: https://github.com/OP-TEE/optee_os/issues/1332 594[issue1353]: https://github.com/OP-TEE/optee_os/issues/1353 595[build issue131]: https://github.com/OP-TEE/build/issues/131 596[commit_a238b74]: https://github.com/OP-TEE/optee_os/commit/a238b744b1b3 597[commit_44e900e]: https://github.com/OP-TEE/optee_os/commit/44e900eabfc1 598 599# OP-TEE - version 2.3.0 600 601[Link][github_commits_2_3_0] to a list of all commits between this release and 602the previous one (2.2.0). 603 604Please note: this release is API-compatible with the previous one, but the 605Secure Storage internal format for the REE FS is not compatible due to commit 606[361fb3e][commit_361fb3e] ("core: REE FS: use a single file per object"). 607 608[commit_361fb3e]: https://github.com/OP-TEE/optee_os/commit/361fb3e 609 610## New features 611 612* New supported platform: Xilinx Zynq 7000 ZC702 (`PLATFORM=zynq7k-zc702`) 613 614* Add debug assertions to spinlocks and mutexes 615 616* Add more CP15 register access macros for Cortex-A9 617 618* ARMv7-A: redesign secure monitor to make it easier to register services 619 620* ARMv7-A: cleanup boot arguments 621 622* libutee: extend `TEE_CheckMemoryAccessRights()` with 623 `TEE_MEMORY_ACCESS_SECURE` and `TEE_MEMORY_ACCESS_NONSECURE` 624 625* plat-hikey: enable SPI by default and add sample test code 626 627* Consider `CFLAGS_ta_arm64` and `CFLAGS_ta_arm32` when building TAs 628 629* Secure storage refactoring 630 - Simplify interface with tee-supplicant. Minimize round trips with normal 631 world, especially by adding a cache for FS RPC payload data. 632 - REE FS: use a single file per object, remove block cache. 633 634* Print call stack in panic() 635 636## Bug fixes 637 638* Fix UUID encoding when communicating with normal world (use big endian 639 mode instead of native endianness). Related to this, the string format 640 for UUIDs has changed in tee-supplicant, so that TA file names now follow 641 the format defined in RFC4122 (a missing hyphen was added). The old format 642 is still supported, but deprecated, and will likely be removed with the 643 next major release. 644 645* Drop write permission to non-writable ELF segments after TA loading is 646 complete. 647 648* mm: fix confusing memory mapping debug traces 649 650* plat-ti: fix issues with MMU mapping 651 652* crypto: fix clearing of big numbers 653 654* build: allow spaces and double quotes in CFG_ variables 655 656* mm: use paddr_t to support both 32- and 64-bit architectures properly. 657 Resolves 32-bit truncation error when pool is at top of 32 bit address 658 space on 64-bit architecture. 659 660* plat-stm: support pager. Fix pager on ARMv7-A SMP boards. 661 662* Fix debug output of Trusted Applications (remove "ERROR: TEE-CORE:" prefix) 663 664* Do not consider TA memref parameters as TA private memory 665 666* crypto: fix `cipher_final()` which would not call `cbc_done()` for CBC_MAC 667 algorithms 668 669* fix for 16-way PL310 670 671* arm32: fix call stack unwinding (`print_stack()`) 672 673* arm32: fix spinlock assembly code 674 675* plat-stm, plat-imx: fix SCR initalization 676 677* Fix user L1 MMU entries calculation (non-LPAE), allowing TTBCR.N values 678 other than 7. 679 680* mtk-mt8173: fix panic caused by incorrect size of SHMEM 681 682* plat-stm: fix RNG driver (non-flat mapping) 683 684## Known issues 685 686* New issues open on GitHub 687 * [#1203][issue1203] AES-CTS mode will fail when inlen=0x100, in_incr=0x80 688 * [#1199][issue1199] Both tee and teepriv reported GlobalPlatform compliant 689 * [#1188][issue1188] Secure storage (SQL FS and REE FS): blocks not tied to 690 current meta header 691 * [#1172][issue1172] paddr_t should be larger than 32 bits when 692 CFG_WITH_LPAE is enabled 693 694## Tested on 695 696In the list below, _standard_ means that the `xtest` program passed with 697its default configuration, while _extended_ means it was run successfully 698with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 699v1.1.0.4. 700 701If a platform is not listed, it means the release was not tested on this 702platform. 703 704<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 705* d02: extended 706* hikey: extended 707* imx-mx6ulevk: standard 708* ls-ls1021atwr: standard 709* mediatek-mt8173: standard 710* rcar-h3: standard 711* rpi3: standard 712* stm-b2260: extended 713* stm-cannes: extended 714* ti-dra7xx: standard 715* vexpress-fvp: standard 716* vexpress-juno: standard 717* vexpress-qemu_armv8a: standard 718* vexpress-qemu_virt: extended 719* zynqmp-zcu102: standard 720 721[github_commits_2_3_0]: https://github.com/OP-TEE/optee_os/compare/2.2.0...2.3.0 722[issue1172]: https://github.com/OP-TEE/optee_os/issues/1172 723[issue1188]: https://github.com/OP-TEE/optee_os/issues/1188 724[issue1199]: https://github.com/OP-TEE/optee_os/issues/1199 725[issue1203]: https://github.com/OP-TEE/optee_os/issues/1203 726 727# OP-TEE - version 2.2.0 728 729[Link][github_commits_2_2_0] to a list of all commits between this release and 730the previous one (2.1.0). 731 732Please note: this release is API-compatible with the previous one, but the 733Secure Storage internal format is not compatible due to commit 734[fde4a75][commit_fde4a75] ("storage: encrypt the FEK with a TA-specific key"). 735 736[commit_fde4a75]: https://github.com/OP-TEE/optee_os/commit/fde4a75 737 738## New features 739 740* New supported platforms: 741 * Freescale i.MX6 Quad SABRE Lite & SD 742 * HiSilicon D02 743 * Raspberry Pi3 744 * Renesas RCAR H3 745 * STMicroelectronics b2260 - h410 746 747* Pager: Support paging of read/write pages by encrypting them with AES-GCM. 748 Support paging of user TAs. Add global setting for TZSRAM size 749 (CFG_CORE_TZSRAM_EMUL_SIZE), defaults to 300K. 750 751* Support for more than 8 CPU cores 752 753* Added SPI framework and PL022 driver 754 755* GPIO: framework supports multiple instances, PL061 driver now has get/set 756 interrupt and mode control functions 757 758* Secure storage: Encrypt the File Encryption Key with a TA-specific key for 759 better TA isolation. Add build-time and run-time support for multiple storage 760 backends. Add SQLite backend. 761 762* Trusted User Interface: some code is introduced to support the implementation 763 of TUI. This includes: a generic framebuffer driver, display and serial 764 abstractions, and drivers for PL111 (LCD) / PL050 (KMI) / TZC400 and PS2 765 mouse. 766 767* AES acceleration using ARMv8-A Cryptographic Extensions instructions is 768 now supported in AArch32 mode 769 770* Add support for GCC flags: -fsanitize=undefined and -fsanitize=kernel-address 771 772* Use a global setting for core heap size (CFG_CORE_HEAP_SIZE), 64K by default. 773 774* Add macros to unwind and print the call stack of TEE core 775 776* Libtomcrypt: sync with the latest `develop` branch. 777 778* The Trusted Application SDK (ta_dev_kit.mk) can produce libraries (.a) 779 780* Rework assertions and TEE core panics and properly honor NDEBUG 781 782## Bug fixes 783 784* Fix incorrect algorithm passed to cipher.final() 785 786* scripts: support Python 2.x and 3.x 787 788* Secure storage: Add proper locking to support concurrent access. Fix sign 789 extension bug with offset parameter of syscall storage_obj_seek which could 790 cause errors in Aarch32 mode. Fix reading beyond end of file. 791 792* Aarch64: mask all maskable exceptions before doing a normal return from call. 793 794* Device Tree: add no-map property to OP-TEE node in reserved-memory. 795 796* LibTomcrypt: fix CVE-2016-6129 797 798## Known issues 799 800* New issues open on GitHub 801 * [#1093][issue1093] rcar-h3: xtest 6010 hangs 802 * [#1092][issue1092] rcar-h3: xtest 4010 fails 803 * [#1081][issue1081] Bad mapping of TA secure memref parameters 804 * [#1071][issue1071] __data_end may not correctly represent text start position when using CFG_WITH_PAGER 805 * [#1069][issue1069] armv7/Aarch32: crash in stack unwind (DPRINT_STACK()) 806 807## Tested on 808 809In the list below, _standard_ means that the `xtest` program passed with 810its default configuration, while _extended_ means it was run successfully 811with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 812v1.1.0.4. 813 814If a platform is not listed, it means the release was not tested on this 815platform. 816 817<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 818* d02: extended 819* hikey: extended 820* imx-mx6qsabrelite: standard 821* imx-mx6qsabresd: standard 822* rcar-h3: standard, pass except issues [#1092][issue1092] and [#1093][issue1093] 823* rpi3: standard 824* stm-b2260: standard 825* stm-cannes: standard 826* ti-dra7xx: standard 827* vexpress-fvp: standard 828* vexpress-juno: standard 829* vexpress-qemu_armv8a: standard 830* vexpress-qemu_virt: extended 831* zynqmp-zcu102: standard 832 833[github_commits_2_2_0]: https://github.com/OP-TEE/optee_os/compare/2.1.0...2.2.0 834[issue1081]: https://github.com/OP-TEE/optee_os/issues/1081 835[issue1071]: https://github.com/OP-TEE/optee_os/issues/1071 836[issue1069]: https://github.com/OP-TEE/optee_os/issues/1069 837[issue1092]: https://github.com/OP-TEE/optee_os/issues/1092 838[issue1093]: https://github.com/OP-TEE/optee_os/issues/1093 839 840# OP-TEE - version 2.1.0 841 842## New features 843 844* New supported platforms: 845 * Xilinx Zynq UltraScale+ MPSOC 846 * Spreadtrum SC9860 847 848* GCC5 support 849 850* Non Linear Mapping support: In OP-TEE kernel mode, the physical to virtual 851 addresses was linear until this release, meaning the virtual addresses 852 were equal to the physical addresses. This is no more the case in this 853 release. 854 855* Font rendering routines have been introduced in order to ease an 856 implementation of Trusted UI. 857 858* File Storage: Possibility to use the normal world filesystem and the RPMB 859 implementations simultaneously. 860 861* AOSP: There is a [local manifest][aosp_local_manifest] to build OP-TEE into an AOSP build, running on HiKey. 862 Please refer to the README in that repo for instructions. 863 864* OpenEmbedded: In addition to the makefile-based build described in the optee_os README, there is an 865 [OpenEmbedded-based build][oe_build] that supports Qemu (32-bit), FVP (64-bit), and HiKey (64-bit). 866 Please refer to the README in that repo for instructions. 867 868* [Link][github_commits_2_1_0] to a list of all commits between this and 869 previous release. 870 871 872## Tested on 873Definitions: 874 875| Type | Meaning | 876| ---- | ------- | 877| Standard tests | The [optee_test][optee_test] project. | 878| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 879 880* ARM Juno Board (vexpress-juno), standard. 881* Foundation Models (vexpress-fvp), standard tests + extended tests, 882 using FVP ARM V8 Foundation Platformr0p0 (platform build 10.0.37) 883* FSL i.MX6 UltraLite EVK (imx), standard. 884* FSL ls1021a (ls-ls1021atwr), standard tests. 885* HiKey (hikey), standard + extended tests. 886* QEMU (vexpress-qemu), standard + extended tests. 887* Xilinx Zynq UltraScale+ MPSOC, standard tests 888 889Note that the following platform has not been tested: 890* MTK8173-EVB (mediatek-mt8173) 891 892 893## Known issues 894* Issue(s) open on GitHub 895 * [#868][pr868]: python-wand font generation sometimes times out 896 * [#863][pr863]: "double free or corruption" error when building optee_os 897 * [#858][pr858]: UUIDs in binary format have wrong endinanness 898 * [#857][pr857]: Formatting of UUIDs is incorrect 899 * [#847][pr847]: optee_os panic(TEE-CORE: Assertion) 900 * [#838][pr838]: TUI font rendering is _very_ slow 901 * [#814][pr814]: Persistent objects : save informations after close 902 * [#665][pr665]: xtest 1013 stalled on HiKey when log levels are 4 and optee_os is on its own UART 903 * [#506][pr506]: tee-supplicant panic & ta panic 904 905[github_commits_2_1_0]: https://github.com/OP-TEE/optee_os/compare/2.0.0...2.1.0 906[pr868]: https://github.com/OP-TEE/optee_os/issues/868 907[pr863]: https://github.com/OP-TEE/optee_os/issues/863 908[pr858]: https://github.com/OP-TEE/optee_os/issues/858 909[pr857]: https://github.com/OP-TEE/optee_os/issues/857 910[pr847]: https://github.com/OP-TEE/optee_os/issues/847 911[pr838]: https://github.com/OP-TEE/optee_os/issues/838 912[pr814]: https://github.com/OP-TEE/optee_os/issues/814 913[pr665]: https://github.com/OP-TEE/optee_os/issues/665 914[aosp_local_manifest]: https://github.com/linaro-swg/optee_android_manifest 915[oe_build]: https://github.com/linaro-swg/oe-optee 916 917# OP-TEE - version 2.0.0 918 919## New features 920 921* Generic driver: A new generic TEE driver is in the process of being 922 [upstreamed][gendrv_v9]. 923 In this release, [OP-TEE/optee_linuxdriver][optee_linuxdriver] is no more used. 924 Instead, linux v4.5 is being patched using the proposed Generic TEE Driver, 925 as it can be found in [https://github.com/linaro-swg/linux/tree/optee][linux_optee] 926 927* RPMB support: Secure Storage can now use Replay Protected Memory Block (RPMB) partition 928 of an eMMC device. Check the [full documentation][rpmb_doc] 929 930* Hard-float ABI is now available. 931 932* [Link][github_commits_2_0_0] to a list of all commits between this and 933 previous release. 934 935 936## Tested on 937Definitions: 938 939| Type | Meaning | 940| ---- | ------- | 941| Standard tests | The [optee_test][optee_test] project. | 942| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 943 944* ARM Juno Board (vexpress-juno), standard. 945* Foundation Models (vexpress-fvp), standard tests + extended tests, 946 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 947* FSL ls1021a (ls-ls1021atwr), standard. 948* HiKey (hikey), standard. 949* MTK8173-EVB (mediatek-mt8173), standard. 950* QEMU (vexpress-qemu), standard + extended tests. 951* STM Cannes (stm-cannes), standard + extended tests. 952 953## Known issues 954* Issue(s) open on GitHub 955 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 956 * [#506][pr506]: tee-supplicant panic & ta panic 957 958[github_commits_2_0_0]: https://github.com/OP-TEE/optee_os/compare/1.1.0...2.0.0 959[rpmb_doc]: https://github.com/OP-TEE/optee_os/blob/master/documentation/secure_storage_rpmb.md 960[optee_linuxdriver]: https://github.com/OP-TEE/optee_linuxdriver 961[gendrv_v9]: https://lkml.org/lkml/2016/4/1/205 962[linux_optee]: https://github.com/linaro-swg/linux/tree/optee 963 964 965# OP-TEE - version 1.1.0 966 967 968## New features 969 970* Softfloat library: floating point support is now available in 32bits TA. 971 972* Support running 64-bits TA: on ARMv8-A platform, TA can be compiled in 973 AArch32 and/or in AArch64 in case the core is compiled in AArch64. 974 An example can be found in HiKey configuration file. Using the following 975 excerpt code, the user TA libraries are compiled in both AArch32 and 976 AArch64, and can be found in `out/arm-plat-hikey/export-ta_arm32` and 977 `out/arm-plat-hikey/export-ta_arm64` 978 979``` 980 ta-targets = ta_arm32 981 ta-targets += ta_arm64 982``` 983 984* Concurrent TA support: multiple TA can run in parallel on 985 several cores. 986 987* New tests added in xtest test suite: concurrent TA (xtest 1013), 988 floating point tests (xtest 1006 and os_test TA) and corruption 989 file storage (xtest 20000) 990 991* [Link][github_commits_1_1_0] to a list of all commits between this and 992 previous release. 993 994 995## Tested on 996Definitions: 997 998| Type | Meaning | 999| ---- | ------- | 1000| Standard tests | The [optee_test][optee_test] project. | 1001| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1002| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1003 1004* Foundation Models (vexpress-fvp), standard tests + extended tests, 1005 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 1006* HiKey (hikey), standard + extended tests. 1007* MT8173 (mediatek), standard tests. 1008* QEMU (vexpress-qemu), standard + extended tests. 1009* STM Cannes (stm-cannes), standard + extended tests. 1010 1011## Known issues 1012* Secure Storage is implemented, but note that anti-rollback protection 1013 is not implemented yet. 1014 1015* Issue(s) open on GitHub 1016 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 1017 * [#296][pr296]: Connecting RPMB to the storage APIs. 1018 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 1019 * [#506][pr506]: tee-supplicant panic & ta panic 1020 1021[prld40]: https://github.com/OP-TEE/optee_linuxdriver/issues/40 1022[pr506]: https://github.com/OP-TEE/optee_os/issues/506 1023[github_commits_1_1_0]: https://github.com/OP-TEE/optee_os/compare/1.0.1...1.1.0 1024 1025 1026 1027# OP-TEE - version 1.0.0 1028 1029OP-TEE is now maintained by Linaro. Contributors do not need to 1030sign a CLA anymore, but must follow the rules of the [DCO][DCO] 1031(Developer Certificate of Origin) instead. 1032 1033 1034## New features 1035 1036* Add hardware support for Texas Instruments DRA7xx, ARMv7 (plat-ti) 1037 1038* GlobalPlatform™ TEE Internal Core API Specification v1.1, 1039 including ECC algorithms. 1040 1041* Secure Storage: Files stored by the REE are now encrypted. Operations 1042 are made atomic in order to prevent inconsistencies in case of errors 1043 during the storage operations. [Slides][LCStorage] describing the 1044 Secure Storage have been presented at the Linaro Connect SFO15. 1045 1046* Change of format of the Trusted Applications: they follow a 1047 [signed ELF format][elf] 1048 1049* Rework thread [synchronization][synchro] in optee_os. 1050 1051* Use of ARMv8 native cryptographic support. 1052 1053* [OP-TEE/optee_test][optee_test] test suite is released. 1054 1055* Introduce [OP-TEE/manifest][manifest] and [OP-TEE/build][build] 1056 to setup and build QEMU, FVP, HiKey and Mediatek platforms. Setup scripts 1057 that used to be in optee_os have been removed, except for Juno board. 1058 1059* [Link][github_commits_1_0_0] to a list of all commits between this and 1060 previous release. 1061 1062 1063## Tested on 1064Definitions: 1065 1066| Type | Meaning | 1067| ---- | ------- | 1068| Standard tests | The [optee_test][optee_test] project. | 1069| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1070| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1071 1072* ARM Juno Board (vexpress-juno), standard + extended tests. 1073* Foundation Models (vexpress-fvp), standard tests. 1074* HiKey (hikey), standard + extended tests. 1075* MT8173 (mediatek), standard tests. 1076* QEMU (vexpress-qemu), standard + extended tests. 1077* STM Cannes (stm-cannes), standard + extended tests. 1078 1079## Known issues 1080* Secure Storage is implemented, but note that anti-rollback protection 1081 is not implemented yet. 1082 1083* Issue(s) open on GitHub 1084 * [#210][pr210]: libteec.so 32-bit does not communicate well 1085 with 64-bit kernel module 1086 * [#296][pr296]: Connecting RPMB to the storage APIs. 1087 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 1088 * [#494][pr494]: HiKey: xtest 7671 fails (1.0.0-rc2) 1089 1090[pr210]: https://github.com/OP-TEE/optee_os/issues/210 1091[pr296]: https://github.com/OP-TEE/optee_os/issues/296 1092[pr493]: https://github.com/OP-TEE/optee_os/issues/493 1093[pr494]: https://github.com/OP-TEE/optee_os/issues/494 1094[github_commits_1_0_0]: https://github.com/OP-TEE/optee_os/compare/0.3.0...1.0.0 1095[DCO]: https://github.com/OP-TEE/optee_os/blob/master/Notice.md#contributions 1096[LCStorage]: http://www.slideshare.net/linaroorg/sfo15503-secure-storage-in-optee 1097[synchro]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#4-thread-handling 1098[elf]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#format 1099[optee_test]: https://github.com/OP-TEE/optee_test 1100[manifest]: https://github.com/OP-TEE/manifest 1101[build]: https://github.com/OP-TEE/build 1102 1103 1104 1105# OP-TEE - version 0.3.0 1106 1107## New features 1108 1109* Add hardware support for 1110 * Mediatek MT8173 Board, ARMv8-A (plat-mediatek) 1111 * Hisilicon HiKey Board, ARMv8-A (plat-hikey) 1112* AArch64 build of optee_os is now possible through the configuration `CFG_ARM64_core=y` 1113* Secure Storage: Data can be encrypted prior to their storage in the non-secure. 1114 Build is configured using `CFG_ENC_FS=y` 1115* A generic boot scheme can be used. Boot configuration is commonalized. This helps 1116 new board support. It is applied on plat-hikey, plat-vexpress, plat-mediatek, plat-stm 1117 and plat-vexpress. 1118 1119## Tested on 1120Definitions: 1121 1122| Type | Meaning | 1123| ---- | ------- | 1124| Standard tests | The optee_test project. | 1125| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1126| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1127 1128* ARM Juno Board (vexpress-juno), standard tests. 1129* Foundation Models (vexpress-fvp), standard tests. 1130* HiKey (hikey), standard tests. 1131* MT8173 (mediatek), standard tests. 1132* QEMU (vexpress-qemu), standard + extended tests. 1133* STM Cannes (stm-cannes), standard + extended tests. 1134 1135------------------------------------------- 1136 1137# OP-TEE - version 0.2.0 1138 1139## New features 1140 1141### Linux Driver Refactoring 1142 1143Linux Driver has been refactored. It is now split in two parts: 1144* optee.ko, the generic Linux driver. It contains all functionality 1145 common to all backends. 1146* optee_armtz.ko, a specific backend dedicated to the TrustZone optee. 1147 It depends on optee.ko. 1148 1149Loading the TrustZone optee linux driver module is now performed using 1150 1151 modprobe optee_armtz 1152 1153Thanks to the dependency between the generic and the backend modules, optee.ko is then automatically loaded. 1154 1155### Misc new features 1156* support PL310 lock down at TEE boot 1157* add 64bits support (division / print) 1158 1159## Tested on 1160Definitions: 1161 1162| Type | Meaning | 1163| ---- | ------- | 1164| Standard tests | The optee_test project. | 1165| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1166| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1167 1168* ARM Juno Board (vexpress-juno), standard tests + extended tests. 1169 1170* Foundation Models (vexpress-fvp), standard + extended tests. 1171 1172* QEMU (vexpress-qemu), standard + extended tests. 1173 1174* STM Cannes (stm-cannes), standard + extended tests. 1175 1176 1177## Issues resolved since last release 1178* Fix user TA trace issue, in order each TA is able to select its own trace level 1179 1180 1181------------------------------------------- 1182# OP-TEE - version 0.1.0 1183 1184## New features 1185Below is a summary of the most important features added, but at the end you will 1186find a link that present you all commits between the current and previous 1187release tag. 1188 1189* GlobalPlatform Client API v1.0 support. 1190 1191* GlobalPlatform Internal API v1.0 support. 1192 1193* GlobalPlatform Secure Elements v1.0 support. 1194 1195* Add hardware support for 1196 1197 * Allwinner A80, ARMv7-A. 1198 1199 * ARM Juno Board, ARMv8-A. 1200 1201 * Foundation Models, ARMv8-A. 1202 1203 * Fast Models, ARMv8-A. 1204 1205 * QEMU, ARMv7-A. 1206 1207 * STM Cannes, ARMv7-A. 1208 1209 * STM Orly2, ARMv7-A. 1210 1211* Add LibTomCrypt as the default software cryptographic library. 1212 1213* Add cryptographic abstraction layer in on secure side to ease the use of 1214 other cryptographic software libraries or adding support for hardware 1215 acceleration. 1216 1217* Extended cryptographic API with support for HKDF, Concat KDF and PBKDF2. 1218 1219* SHA-1 and SHA-256 ARMv8-A crypto extension implementation. 1220 1221* Enabled paging support in OP-TEE OS. 1222 1223* Add support for xtest (both standard and extended) in QEMU and FVP setup 1224 scripts. 1225 1226* Add documentation for the OS design, cryptographic abstraction layer, secure 1227 elements design, the build system, GitHub usage, key derivation extensions, 1228 ARM-Trusted Firmware usage within OP-TEE and GlobalPlatform usage within 1229 OP-TEE. 1230 1231* Integrate support for Travis CI. 1232 1233* [Link][github_commits_0_1_0] to a list of all commits between this and 1234 previous release. 1235 1236 1237## Tested on 1238Definitions: 1239 1240| Type | Meaning | 1241| ---- | ------- | 1242| Standard tests | The optee_test project. | 1243| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.0.0. | 1244| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1245 1246* Allwinner A80 (plat-sunxi), hello world test. 1247 1248* ARM Juno Board (vexpress-juno), standard tests. 1249 1250* Foundation Models (plat-vexpress-fvp), standard + extended tests 1251 1252* QEMU (plat-vexpress-qemu), standard + extended tests (and Secure Elements 1253 tested separately). 1254 1255* STM Cannes (plat-stm-cannes), standard + extended tests. 1256 1257 1258## Issues resolved since last release 1259N/A since this is the first release tag on OP-TEE. 1260 1261 1262## Known issues 1263* Storage is implemented, but not "Secure storage", meaning that a client 1264 needs to do encrypt files on their own before storing the files. 1265 1266* Issue(s) open on GitHub 1267 * [#95][pr95]: An error about building the test code of libtomcrypt. 1268 1269 * [#149][pr149]: when testing optee os with arm trusted firmware (I 1270 utilized optee os tee.bin as bl32 image) on juno platform, I got an 1271 error. 1272 1273 * [#161][pr161]: tee_svc_cryp.c lacks accessibility checks on 1274 user-supplied TEE_Attributes. 1275 1276[hello_world]: https://github.com/jenswi-linaro/lcu14_optee_hello_world 1277[github_commits_0_1_0]: https://github.com/OP-TEE/optee_os/compare/b01047730e77127c23a36591643eeb8bb0487d68...999e4a6c0f64d3177fd3d0db234107b6fb860884 1278[pr95]: https://github.com/OP-TEE/optee_os/issues/95 1279[pr149]: https://github.com/OP-TEE/optee_os/issues/149 1280[pr161]: https://github.com/OP-TEE/optee_os/issues/161 1281 1282* Global Platform Device Internal Core API v1.1 1283 * [#230][pr230]: Persistent object corruption support (TEE_ERROR_CORRUPT_OBJECT/_2) 1284 * [#230][pr230]: Persistent object access support (TEE_ERROR_STORAGE_NOT_AVAILABLE/_2) 1285