1# OP-TEE - version 3.10.0 (2020-08-21) 2 3- Links to the release pages, commits and pull requests merged into this release for: 4 - OP-TEE/optee_os: [release page][OP_TEE_optee_os_release_3_10_0], [commits][OP_TEE_optee_os_commits_3_10_0] and [pull requests][OP_TEE_optee_os_pr_3_10_0] 5 - OP-TEE/optee_client: [release page][OP_TEE_optee_client_release_3_10_0], [commits][OP_TEE_optee_client_commits_3_10_0] and [pull requests][OP_TEE_optee_client_pr_3_10_0] 6 - OP-TEE/optee_test: [release page][OP_TEE_optee_test_release_3_10_0], [commits][OP_TEE_optee_test_commits_3_10_0] and [pull requests][OP_TEE_optee_test_pr_3_10_0] 7 - OP-TEE/build: [release page][OP_TEE_build_release_3_10_0], [commits][OP_TEE_build_commits_3_10_0] and [pull requests][OP_TEE_build_pr_3_10_0] 8 - linaro-swg/optee_examples: [release page][linaro_swg_optee_examples_release_3_10_0], [commits][linaro_swg_optee_examples_commits_3_10_0] and [pull requests][linaro_swg_optee_examples_pr_3_10_0] 9 10 11[OP_TEE_optee_os_release_3_10_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.10.0 12[OP_TEE_optee_os_commits_3_10_0]: https://github.com/OP-TEE/optee_os/compare/3.9.0...3.10.0 13[OP_TEE_optee_os_pr_3_10_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-04-22..2020-08-21 14 15[OP_TEE_optee_client_release_3_10_0]: https://github.com/OP-TEE/optee_client/releases/tag/3.10.0 16[OP_TEE_optee_client_commits_3_10_0]: https://github.com/OP-TEE/optee_client/compare/3.9.0...3.10.0 17[OP_TEE_optee_client_pr_3_10_0]: https://github.com/OP-TEE/optee_client/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-04-22..2020-08-21 18 19[OP_TEE_optee_test_release_3_10_0]: https://github.com/OP-TEE/optee_test/releases/tag/3.10.0 20[OP_TEE_optee_test_commits_3_10_0]: https://github.com/OP-TEE/optee_test/compare/3.9.0...3.10.0 21[OP_TEE_optee_test_pr_3_10_0]: https://github.com/OP-TEE/optee_test/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-04-22..2020-08-21 22 23[OP_TEE_build_release_3_10_0]: https://github.com/OP-TEE/build/releases/tag/3.10.0 24[OP_TEE_build_commits_3_10_0]: https://github.com/OP-TEE/build/compare/3.9.0...3.10.0 25[OP_TEE_build_pr_3_10_0]: https://github.com/OP-TEE/build/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-04-22..2020-08-21 26 27[linaro_swg_optee_examples_release_3_10_0]: https://github.com/linaro-swg/optee_examples/releases/tag/3.10.0 28[linaro_swg_optee_examples_commits_3_10_0]: https://github.com/linaro-swg/optee_examples/compare/3.9.0...3.10.0 29[linaro_swg_optee_examples_pr_3_10_0]: https://github.com/linaro-swg/optee_examples/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-04-22..2020-08-21 30 31# OP-TEE - version 3.9.0 (2020-04-22) 32 33- Links to the release pages, commits and pull requests merged into this release for: 34 - OP-TEE/optee_os: [release page][OP_TEE_optee_os_release_3_9_0], [commits][OP_TEE_optee_os_commits_3_9_0] and [pull requests][OP_TEE_optee_os_pr_3_9_0] 35 - OP-TEE/optee_client: [release page][OP_TEE_optee_client_release_3_9_0], [commits][OP_TEE_optee_client_commits_3_9_0] and [pull requests][OP_TEE_optee_client_pr_3_9_0] 36 - OP-TEE/optee_test: [release page][OP_TEE_optee_test_release_3_9_0], [commits][OP_TEE_optee_test_commits_3_9_0] and [pull requests][OP_TEE_optee_test_pr_3_9_0] 37 - OP-TEE/build: [release page][OP_TEE_build_release_3_9_0], [commits][OP_TEE_build_commits_3_9_0] and [pull requests][OP_TEE_build_pr_3_9_0] 38 - linaro-swg/optee_examples: [release page][linaro_swg_optee_examples_release_3_9_0], [commits][linaro_swg_optee_examples_commits_3_9_0] and [pull requests][linaro_swg_optee_examples_pr_3_9_0] 39 40 41[OP_TEE_optee_os_release_3_9_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.9.0 42[OP_TEE_optee_os_commits_3_9_0]: https://github.com/OP-TEE/optee_os/compare/3.8.0...3.9.0 43[OP_TEE_optee_os_pr_3_9_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-05-22 44 45[OP_TEE_optee_client_release_3_9_0]: https://github.com/OP-TEE/optee_client/releases/tag/3.9.0 46[OP_TEE_optee_client_commits_3_9_0]: https://github.com/OP-TEE/optee_client/compare/3.8.0...3.9.0 47[OP_TEE_optee_client_pr_3_9_0]: https://github.com/OP-TEE/optee_client/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-05-22 48 49[OP_TEE_optee_test_release_3_9_0]: https://github.com/OP-TEE/optee_test/releases/tag/3.9.0 50[OP_TEE_optee_test_commits_3_9_0]: https://github.com/OP-TEE/optee_test/compare/3.8.0...3.9.0 51[OP_TEE_optee_test_pr_3_9_0]: https://github.com/OP-TEE/optee_test/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-05-22 52 53[OP_TEE_build_release_3_9_0]: https://github.com/OP-TEE/build/releases/tag/3.9.0 54[OP_TEE_build_commits_3_9_0]: https://github.com/OP-TEE/build/compare/3.8.0...3.9.0 55[OP_TEE_build_pr_3_9_0]: https://github.com/OP-TEE/build/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-05-22 56 57[linaro_swg_optee_examples_release_3_9_0]: https://github.com/linaro-swg/optee_examples/releases/tag/3.9.0 58[linaro_swg_optee_examples_commits_3_9_0]: https://github.com/linaro-swg/optee_examples/compare/3.8.0...3.9.0 59[linaro_swg_optee_examples_pr_3_9_0]: https://github.com/linaro-swg/optee_examples/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-05-22 60 61# OP-TEE - version 3.8.0 (2020-01-24) 62 63- Links to the release pages, commits and pull requests merged into this release for: 64 - OP-TEE/optee_os: [release page][OP_TEE_optee_os_release_3_8_0], [commits][OP_TEE_optee_os_commits_3_8_0] and [pull requests][OP_TEE_optee_os_pr_3_8_0] 65 - OP-TEE/optee_client: [release page][OP_TEE_optee_client_release_3_8_0], [commits][OP_TEE_optee_client_commits_3_8_0] and [pull requests][OP_TEE_optee_client_pr_3_8_0] 66 - OP-TEE/optee_test: [release page][OP_TEE_optee_test_release_3_8_0], [commits][OP_TEE_optee_test_commits_3_8_0] and [pull requests][OP_TEE_optee_test_pr_3_8_0] 67 - OP-TEE/build: [release page][OP_TEE_build_release_3_8_0], [commits][OP_TEE_build_commits_3_8_0] and [pull requests][OP_TEE_build_pr_3_8_0] 68 - linaro-swg/optee_examples: [release page][linaro_swg_optee_examples_release_3_8_0], [commits][linaro_swg_optee_examples_commits_3_8_0] and [pull requests][linaro_swg_optee_examples_pr_3_8_0] 69 70 71[OP_TEE_optee_os_release_3_8_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.8.0 72[OP_TEE_optee_os_commits_3_8_0]: https://github.com/OP-TEE/optee_os/compare/3.7.0...3.8.0 73[OP_TEE_optee_os_pr_3_8_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-01-24 74 75[OP_TEE_optee_client_release_3_8_0]: https://github.com/OP-TEE/optee_client/releases/tag/3.8.0 76[OP_TEE_optee_client_commits_3_8_0]: https://github.com/OP-TEE/optee_client/compare/3.7.0...3.8.0 77[OP_TEE_optee_client_pr_3_8_0]: https://github.com/OP-TEE/optee_client/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2020-01-24 78 79[OP_TEE_optee_test_release_3_8_0]: https://github.com/OP-TEE/optee_test/releases/tag/3.8.0 80[OP_TEE_optee_test_commits_3_8_0]: https://github.com/OP-TEE/optee_test/compare/3.7.0...3.8.0 81[OP_TEE_optee_test_pr_3_8_0]: https://github.com/OP-TEE/optee_test/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2020-01-24 82 83[OP_TEE_build_release_3_8_0]: https://github.com/OP-TEE/build/releases/tag/3.8.0 84[OP_TEE_build_commits_3_8_0]: https://github.com/OP-TEE/build/compare/3.7.0...3.8.0 85[OP_TEE_build_pr_3_8_0]: https://github.com/OP-TEE/build/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2020-01-24 86 87[linaro_swg_optee_examples_release_3_8_0]: https://github.com/linaro-swg/optee_examples/releases/tag/3.8.0 88[linaro_swg_optee_examples_commits_3_8_0]: https://github.com/linaro-swg/optee_examples/compare/3.7.0...3.8.0 89[linaro_swg_optee_examples_pr_3_8_0]: https://github.com/linaro-swg/optee_examples/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2020-01-24 90 91# OP-TEE - version 3.7.0 (2019-10-18) 92 93- Links to the release pages, commits and pull requests merged into this release for: 94 - OP-TEE/optee_os: [release page][OP_TEE_optee_os_release_3_7_0], [commits][OP_TEE_optee_os_commits_3_7_0] and [pull requests][OP_TEE_optee_os_pr_3_7_0] 95 - OP-TEE/optee_client: [release page][OP_TEE_optee_client_release_3_7_0], [commits][OP_TEE_optee_client_commits_3_7_0] and [pull requests][OP_TEE_optee_client_pr_3_7_0] 96 - OP-TEE/optee_test: [release page][OP_TEE_optee_test_release_3_7_0], [commits][OP_TEE_optee_test_commits_3_7_0] and [pull requests][OP_TEE_optee_test_pr_3_7_0] 97 - OP-TEE/build: [release page][OP_TEE_build_release_3_7_0], [commits][OP_TEE_build_commits_3_7_0] and [pull requests][OP_TEE_build_pr_3_7_0] 98 - linaro-swg/optee_examples: [release page][linaro_swg_optee_examples_release_3_7_0], [commits][linaro_swg_optee_examples_commits_3_7_0] and [pull requests][linaro_swg_optee_examples_pr_3_7_0] 99 100 101[OP_TEE_optee_os_release_3_7_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.7.0 102[OP_TEE_optee_os_commits_3_7_0]: https://github.com/OP-TEE/optee_os/compare/3.6.0...3.7.0 103[OP_TEE_optee_os_pr_3_7_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 104 105[OP_TEE_optee_client_release_3_7_0]: https://github.com/OP-TEE/optee_client/releases/tag/3.7.0 106[OP_TEE_optee_client_commits_3_7_0]: https://github.com/OP-TEE/optee_client/compare/3.6.0...3.7.0 107[OP_TEE_optee_client_pr_3_7_0]: https://github.com/OP-TEE/optee_client/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 108 109[OP_TEE_optee_test_release_3_7_0]: https://github.com/OP-TEE/optee_test/releases/tag/3.7.0 110[OP_TEE_optee_test_commits_3_7_0]: https://github.com/OP-TEE/optee_test/compare/3.6.0...3.7.0 111[OP_TEE_optee_test_pr_3_7_0]: https://github.com/OP-TEE/optee_test/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 112 113[OP_TEE_build_release_3_7_0]: https://github.com/OP-TEE/build/releases/tag/3.7.0 114[OP_TEE_build_commits_3_7_0]: https://github.com/OP-TEE/build/compare/3.6.0...3.7.0 115[OP_TEE_build_pr_3_7_0]: https://github.com/OP-TEE/build/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 116 117[linaro_swg_optee_examples_release_3_7_0]: https://github.com/linaro-swg/optee_examples/releases/tag/3.7.0 118[linaro_swg_optee_examples_commits_3_7_0]: https://github.com/linaro-swg/optee_examples/compare/3.6.0...3.7.0 119[linaro_swg_optee_examples_pr_3_7_0]: https://github.com/linaro-swg/optee_examples/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 120 121# OP-TEE - version 3.6.0 (2019-07-05) 122 123- Link to the GitHub [release page][github_release_3_6_0]. 124- Links to the [commits][github_commits_3_6_0] and 125[pull requests][github_pr_3_6_0] merged into this release. 126 127[github_release_3_6_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.6.0 128[github_commits_3_6_0]: https://github.com/OP-TEE/optee_os/compare/3.5.0...3.6.0 129[github_pr_3_6_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-04-26..2019-07-05 130 131# OP-TEE - version 3.5.0 (2019-04-26) 132 133- Link to the GitHub [release page][github_release_3_5_0]. 134- Links to the [commits][github_commits_3_5_0] and 135[pull requests][github_pr_3_5_0] merged into this release. 136 137[github_release_3_5_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.5.0 138[github_commits_3_5_0]: https://github.com/OP-TEE/optee_os/compare/3.4.0...3.5.0 139[github_pr_3_5_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-01-26..2019-04-26 140 141# OP-TEE - version 3.4.0 (2019-01-25) 142 143- Link to the GitHub [release page][github_release_3_4_0]. 144- Links to the [commits][github_commits_3_4_0] and 145[pull requests][github_pr_3_4_0] merged into this release. 146 147[github_release_3_4_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.4.0 148[github_commits_3_4_0]: https://github.com/OP-TEE/optee_os/compare/3.3.0...3.4.0 149[github_pr_3_4_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-10-12..2019-01-25 150 151# OP-TEE - version 3.3.0 (2018-10-12) 152 153- Link to the GitHub [release page][github_release_3_3_0]. 154- Links to the [commits][github_commits_3_3_0] and 155[pull requests][github_pr_3_3_0] merged into this release. 156 157[github_release_3_3_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.3.0 158[github_commits_3_3_0]: https://github.com/OP-TEE/optee_os/compare/3.2.0...3.3.0 159[github_pr_3_3_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-07-04..2018-10-12 160 161# OP-TEE - version 3.2.0 (2018-07-04) 162 163- Link to the GitHub [release page][github_release_3_2_0]. 164- Links to the [commits][github_commits_3_2_0] and 165[pull requests][github_pr_3_2_0] merged into this release. 166 167## Known issues 168 169* HiKey960: assertion in bget create_free_block() \[memalign() self-test\] ([#2414]) 170* D02: assertion '!have_spinlock()' ([#2437]) 171 172[github_commits_3_2_0]: https://github.com/OP-TEE/optee_os/compare/3.1.0...3.2.0 173[github_pr_3_2_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-04-13..2018-07-04 174[github_release_3_2_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.2.0 175[#2414]: https://github.com/OP-TEE/optee_os/issues/2414 176[#2437]: https://github.com/OP-TEE/optee_os/issues/2437 177 178# OP-TEE - version 3.1.0 (2018-04-13) 179 180- Link to the GitHub [release page][github_release_3_1_0]. 181- Links to the [commits][github_commits_3_1_0] and 182[pull requests][github_pr_3_1_0] merged into this release. 183 184[github_commits_3_1_0]: https://github.com/OP-TEE/optee_os/compare/3.0.0...3.1.0 185[github_pr_3_1_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-01-26..2018-04-13 186[github_release_3_1_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.1.0 187 188# OP-TEE - version 3.0.0 (2018-01-26) 189 190[Link][github_commits_3_0_0] to a list of all commits between this release and 191the previous one (2.6.0). 192 193About backwards compatibility: Trusted Applications built with OP-TEE 2.5.0 or 194earlier will not run properly with a *debug* build of this release due 195to commit [0e1c6e8e][commit_0e1c6e8e] ("Dump call stack on TA panic"). 196Non-debug builds are not affected. 197 198## New features 199 200* New supported platforms: Armada 3700 ([#1946]), Poplar ([#1999]), 64-bit 201 support for FSL ls1012ardb ([#1941]), i.MX6SX Sabreauto ([#1974]). 202* arm32: sm: init CNTVOFF ([#2052]) 203* Debug/info/error traces: make output more compact ([#2011]) 204* tzc380: implement new functions ([#1994]) 205* Secure Data Path: add pseudo-TA to convert VA to PA (#1993]) 206* Pager: use NEON AES GCM implementation ([#1959]) 207* Crypto: add optimized AES GCM implementation using NEON ([#1949]) 208* Add support for using secure storage for TA anti-rollback ([#1928]) 209* Crypto: replace struct crypto_ops with function interface ([#1923], 210 [#1931]) 211* aosp_optee.mk: define OPTEE_BIN ([#1922]) 212* Add build option to allow concurrent execution of single-instance TAs 213 ([#1915]) 214* Pager: support for address sanitizer ([#1856]) 215* Pager: make memory between CFG_TEE_RAM_START and TEE load address usable by 216 pager ([#1826]) 217 218## Bug fixes 219 220* Fix crash in tee_mmu_final() on TA loading error ([#2092]) 221* LibTomCrypt: fix issue causing invalid output when using AES CTR with 222hardware acceleration (CFG_CRYPTO_WITH_CE) ([#2086]) 223* pl310: fix cache sync ([#2035]) 224* tzc380: do not write reserved bits ([#1994]) 225* Fix potential double free in ta_open() ([#1970]) 226* libfdt: fix undefined behaviour in fdt_offset_ptr() ([#1969]) 227* imx_wdog: fix register access ([#1966]) 228* Secure storage: fix potential memory leak after early return ([#1961]) 229* LibTomCrypt: fix double free in dsa_import() ([#1963]) 230* RPMB: fix TA independance issue in secure storage ([#1921]) 231* RPMB: return TEE_ERROR_ACCESS_CONFLICT instead of panicking when a TA 232 attempts to create an existing persistent object without the overwrite flag 233 ([#1919]) 234* PSCI: pass non-secure context to psci_system_suspend() ([#1916]) 235* Fix "Argument list too long" during "make clean" ([#1897]) 236 237## Security fixes 238 239* Mitigations and hardening against the Spectre and Meltdown vulnerabilities 240 (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754). 241 242## Known issues 243 244* Secure storage (REE FS): storage size not updated after 245TEE_TruncateObjectData() ([#2094]) 246* Possible deadlock with CFG_WITH_PAGER=y when loading a TA and not enough 247page tables are available in pgt_cache ([#2080]) 248 249## Tested on 250 251The release was tested successfully on the platforms listed below. 252 253<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 254* d02 255* hikey 256* hikey-hikey960 257* imx-mx6ulevk 258* imx-mx7dsabresd 259* marvell-armada7k8k 260* marvell-armada3700 261* mediatek-mt8173 262* rcar-salvator_m3 263* rockchip-rk322x 264* rpi3 265* sam 266* ti 267* vexpress-juno 268* vexpress-qemu_armv8a 269* vexpress-qemu_virt 270 271[commit_0e1c6e8e]: https://github.com/OP-TEE/optee_os/commit/0e1c6e8e 272[github_commits_3_0_0]: https://github.com/OP-TEE/optee_os/compare/2.6.0...3.0.0 273[#2092]: https://github.com/OP-TEE/optee_os/pull/2092 274[#2086]: https://github.com/OP-TEE/optee_os/pull/2086 275[#2094]: https://github.com/OP-TEE/optee_os/issues/2094 276[#2080]: https://github.com/OP-TEE/optee_os/issues/2080 277[#2052]: https://github.com/OP-TEE/optee_os/pull/2052 278[#2035]: https://github.com/OP-TEE/optee_os/pull/2035 279[#2011]: https://github.com/OP-TEE/optee_os/pull/2011 280[#1999]: https://github.com/OP-TEE/optee_os/pull/1999 281[#1994]: https://github.com/OP-TEE/optee_os/pull/1994 282[#1993]: https://github.com/OP-TEE/optee_os/pull/1993 283[#1974]: https://github.com/OP-TEE/optee_os/pull/1974 284[#1970]: https://github.com/OP-TEE/optee_os/pull/1970 285[#1969]: https://github.com/OP-TEE/optee_os/pull/1969 286[#1966]: https://github.com/OP-TEE/optee_os/pull/1966 287[#1963]: https://github.com/OP-TEE/optee_os/pull/1963 288[#1961]: https://github.com/OP-TEE/optee_os/pull/1961 289[#1959]: https://github.com/OP-TEE/optee_os/pull/1959 290[#1949]: https://github.com/OP-TEE/optee_os/pull/1949 291[#1946]: https://github.com/OP-TEE/optee_os/pull/1946 292[#1941]: https://github.com/OP-TEE/optee_os/pull/1941 293[#1931]: https://github.com/OP-TEE/optee_os/pull/1931 294[#1928]: https://github.com/OP-TEE/optee_os/pull/1928 295[#1923]: https://github.com/OP-TEE/optee_os/pull/1923 296[#1922]: https://github.com/OP-TEE/optee_os/pull/1922 297[#1921]: https://github.com/OP-TEE/optee_os/pull/1921 298[#1919]: https://github.com/OP-TEE/optee_os/pull/1919 299[#1916]: https://github.com/OP-TEE/optee_os/pull/1916 300[#1915]: https://github.com/OP-TEE/optee_os/pull/1915 301[#1897]: https://github.com/OP-TEE/optee_os/pull/1897 302[#1856]: https://github.com/OP-TEE/optee_os/pull/1856 303[#1826]: https://github.com/OP-TEE/optee_os/pull/1826 304 305# OP-TEE - version 2.6.0 306 307[Link][github_commits_2_6_0] to a list of all commits between this release and 308the previous one (2.5.0). 309 310## New features 311 312* New supported platforms: Atmel SAMA5 ([#1714]), HiSilicon HiKey960 ([#1684]), 313 Rockchip RK322X ([#1666]), NXP LS1043A-RDB/LS1046A-RDB ([#1787]), Marvell 314 Armada 70x0/80x0 ([#1807]). 315* Dynamic shared memory (non-contiguous, non-secure memory can be mapped into 316 Trusted Applications VA space) ([#1631]) 317* Dump TA call stack on panic ([#1858]) 318* i.MX: PSCI reset ([#1849]) 319* plat-ti: AM43xx: suspend/resume support ([#1822]) 320* QEMU SMP support ([#1820]) 321* plat-ti: AM43xx: disable TRNG ([#1816]) 322* plat-ti: enable Secure Data Path by default ([#1815]) 323* Improve symbolize.py ([#1778], [#1767], [#1766]) 324* Early TAs (TAs linked in tee.bin) ([#1733]) 325* Suspend/resume framework for arm32 and imx7d support ([#1729]) 326* RK322X PSCI version, features and suspend support ([#1720]) 327* arm32: handle aborts in system mode ([#1703]) 328* i.MX: add SNVS SRTC support ([#1700]) 329* GCC7 support ([#1693]) 330* Improve detection of programming errors in locking code ([#1671], [#1670]) 331* Support TEE RAM size larger than page directory size ([#1669]) 332 333## Removed features 334 335* Remove TUI code ([#1842]) 336 337## Bug fixes 338 339* Add missing synchronization barrier in core_mmu_map_pages() ([#1827]) 340* Secure storage: REE FS: fix bug in error path ([#1801]) 341* ASAN bug fixes ([#1799]) 342* Fix race in core_mmu_user_mapping_is_active() ([#1785]) 343* libutee: printf() and puts() fixes, add putchar() ([#1759], [#1754]) 344* arm32: GICv3: fix FIQ masking in IRQ/ABT/SVC/UND handlers ([#1748]) 345* arm32: preserve r12 in native_intr_handler() ([#1682]) 346* arm64: fix print_kernel_stack() ([#1664]) 347* benchmark: fix core data-abort ([#1658]) 348 349## Security fixes or enhancements 350 351* crypto: fix software PRNG weaknesses 352 ([OP-TEE-2017-0001][OP-TEE-2017-0001]) ([#1843]) 353 354## Tested on 355 356The release was tested successfully on the platforms listed below. 357If a platform is not listed, it means the release was not tested on this 358platform. 359 360<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 361* d02 362* hikey 363* hikey-hikey960 364* imx-mx6ulevk 365* imx-mx7dsabresd 366* ls-ls1021a??? (single core) 367* ls-ls1043ardb 368* ls-ls1046ardb 369* mediatek-mt8173 370* rcar 371* rockchip-rk322x 372* rpi3 373* sam 374* stm-b2260 375* stm-cannes 376* ti-??? 377* vexpress-fvp 378* vexpress-juno 379* vexpress-qemu_armv8a 380* vexpress-qemu_virt 381 382[github_commits_2_6_0]: https://github.com/OP-TEE/optee_os/compare/2.5.0...2.6.0 383[#1858]: https://github.com/OP-TEE/optee_os/issues/1858 384[#1849]: https://github.com/OP-TEE/optee_os/issues/1849 385[#1843]: https://github.com/OP-TEE/optee_os/issues/1843 386[#1842]: https://github.com/OP-TEE/optee_os/issues/1842 387[#1827]: https://github.com/OP-TEE/optee_os/issues/1827 388[#1822]: https://github.com/OP-TEE/optee_os/issues/1822 389[#1820]: https://github.com/OP-TEE/optee_os/issues/1820 390[#1816]: https://github.com/OP-TEE/optee_os/issues/1816 391[#1815]: https://github.com/OP-TEE/optee_os/issues/1815 392[#1807]: https://github.com/OP-TEE/optee_os/issues/1807 393[#1801]: https://github.com/OP-TEE/optee_os/issues/1801 394[#1799]: https://github.com/OP-TEE/optee_os/issues/1799 395[#1787]: https://github.com/OP-TEE/optee_os/issues/1787 396[#1785]: https://github.com/OP-TEE/optee_os/issues/1785 397[#1778]: https://github.com/OP-TEE/optee_os/issues/1778 398[#1767]: https://github.com/OP-TEE/optee_os/issues/1767 399[#1766]: https://github.com/OP-TEE/optee_os/issues/1766 400[#1759]: https://github.com/OP-TEE/optee_os/issues/1759 401[#1754]: https://github.com/OP-TEE/optee_os/issues/1754 402[#1748]: https://github.com/OP-TEE/optee_os/issues/1748 403[#1733]: https://github.com/OP-TEE/optee_os/issues/1733 404[#1729]: https://github.com/OP-TEE/optee_os/issues/1729 405[#1720]: https://github.com/OP-TEE/optee_os/issues/1720 406[#1714]: https://github.com/OP-TEE/optee_os/issues/1714 407[#1703]: https://github.com/OP-TEE/optee_os/issues/1703 408[#1700]: https://github.com/OP-TEE/optee_os/issues/1700 409[#1693]: https://github.com/OP-TEE/optee_os/issues/1693 410[#1684]: https://github.com/OP-TEE/optee_os/issues/1684 411[#1682]: https://github.com/OP-TEE/optee_os/issues/1682 412[#1671]: https://github.com/OP-TEE/optee_os/issues/1671 413[#1670]: https://github.com/OP-TEE/optee_os/issues/1670 414[#1669]: https://github.com/OP-TEE/optee_os/issues/1669 415[#1666]: https://github.com/OP-TEE/optee_os/issues/1666 416[#1664]: https://github.com/OP-TEE/optee_os/issues/1664 417[#1658]: https://github.com/OP-TEE/optee_os/issues/1658 418[#1631]: https://github.com/OP-TEE/optee_os/issues/1631 419[OP-TEE-2017-0001]: https://www.op-tee.org/security-advisories/ 420 421# OP-TEE - version 2.5.0 422 423[Link][github_commits_2_5_0] to a list of all commits between this release and 424the previous one (2.4.0). 425 426## New features 427 428* New supported platform: i.MX7D ([#1639]) 429* Secure storage: anti-rollback protection for REE FS using RPMB FS ([#1630]) 430* Assign non-secure DDR configuration from DT if CFG_DT=y ([#1623]) 431* Add new image format: split image into three separate binaries suitable for 432 upcoming ARM Trusted Firmware ([#1589]). 433* Make alignment check configurable ([#1586]) 434* drivers: add TZC380 driver ([#1578]) 435* plat-imx: PSCI CPU off ([#1577]) 436* 64-bit paging on QEMU v8 and HiKey ([#1575], [#1592]) 437* Benchmark framework ([#1365]) 438* Dump call stack of user TAs on abort ([#1552]) 439* plat-hikey: enable Secure Data Path ([#1440]) 440* Add interface to load and decrypt/authenticate user TAs ([#1513]) 441* plat-ti: add secure paging support ([#1493]) 442* plat-ti: add OTP hardware key support ([#1492]) 443* Support ARM GICv3 ([#1465]) 444 445## Removed features 446 447* stm-orly2 is not supported anymore ([#1650]) 448* Remove secure storage based on SQL FS (`CFG_SQL_FS=y`) ([#1490]) 449* Remove support for mapping user TAs with 1 MiB or 2 MiB granularity 450 (`CFG_SMALL_PAGE_USER_TA=n`) ([#1559]). TAs are always mapped using small 451 pages. 452 453## Bug fixes 454 455* Reduce size of non-pageable code ([#1621]) 456* Ignore `TA_FLAG_MULTI_SESSION` and `TA_FLAG_INSTANCE_KEEP_ALIVE` when 457 `TA_FLAG_SINGLE_INSTANCE` is not set ([#1574]) 458* libutee: remove buffering for AES GCM (PR#1573) and AES CTR ([#1580]) 459* Fix ROUNDUP()/ROUNDDOWN() macros ([#1519]) 460* Do not touch other bits in GICD_CTLR ([#1508]) 461* Fix build issue with `DEBUG=y` and `CFG_TEE_CORE_LOG_LEVEL=0` ([#1502]) 462* crypto: do not restrict hash size when algorithm is ECDSA ([#1497]) 463 464## Security fixes or enhancements 465 466- crypto: fix RSA key leakage after fault injection attack 467 ([OP-TEE-2016-0003][OP-TEE-2016-0003]) ([#1610]) 468* crypto: fix RSA key leakage after side channel attack 469 ([OP-TEE-2016-0002][OP-TEE-2016-0002]) ([#1610]) 470* Make pager aliased pages not always writable ([#1551]) 471* Support for no-exec RO and RW data ([#1459], [#1550]) 472 473## New issues 474 475* armv7: some platform-specific code (`plat_cpu_reset_early()`) overwrites 476SCTLR bits configured by generic code. This affects alignment checks (`SCTLR.A`) 477and write-implies-no-exec (`SCTLR.WXN`, `SCTLR.UWXN`), which can therefore not 478be configured via the compile-time `CFG_` variables. 479* armv7: plat-imx: Cortex-A9 cores should enable branch prediction (`SCLTR.Z`) 480for improved performance. 481* [#1656] qemu_armv8a: init hangs when secure data path and pager are both 482 enabled. 483 484## Tested on 485 486In the list below, _standard_ means that the `xtest` program passed with 487its default configuration, while _extended_ means it was run successfully 488with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 489v1.1.0.4. 490 491If a platform is not listed, it means the release was not tested on this 492platform. 493 494<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 495* d02: extended 496* hikey: extended 497* imx-mx6ulevk: standard 498* imx-mx6ullevk: standard 499* imx-mx7dsabresd: standard 500* ls-ls1021atwr: standard 501* mediatek-mt8173: standard 502* rcar-h3: standard 503* rpi3: standard 504* stm-b2260: extended 505* stm-cannes: extended 506* ti-am43xx: standard 507* ti-am57xx: standard 508* ti-dra7xx: standard 509* vexpress-fvp: standard 510* vexpress-juno: standard 511* vexpress-qemu_armv8a: standard 512* vexpress-qemu_virt: standard 513 514[github_commits_2_5_0]: https://github.com/OP-TEE/optee_os/compare/2.4.0...2.5.0-rc1 515[#1656]: https://github.com/OP-TEE/optee_os/issues/1656 516[#1650]: https://github.com/OP-TEE/optee_os/pull/1650 517[#1639]: https://github.com/OP-TEE/optee_os/pull/1639 518[#1630]: https://github.com/OP-TEE/optee_os/pull/1630 519[#1623]: https://github.com/OP-TEE/optee_os/pull/1623 520[#1621]: https://github.com/OP-TEE/optee_os/pull/1621 521[#1610]: https://github.com/OP-TEE/optee_os/pull/1610 522[#1592]: https://github.com/OP-TEE/optee_os/pull/1592 523[#1589]: https://github.com/OP-TEE/optee_os/pull/1589 524[#1586]: https://github.com/OP-TEE/optee_os/pull/1586 525[#1580]: https://github.com/OP-TEE/optee_os/pull/1580 526[#1578]: https://github.com/OP-TEE/optee_os/pull/1578 527[#1577]: https://github.com/OP-TEE/optee_os/pull/1577 528[#1574]: https://github.com/OP-TEE/optee_os/pull/1574 529[#1559]: https://github.com/OP-TEE/optee_os/pull/1559 530[#1551]: https://github.com/OP-TEE/optee_os/pull/1551 531[#1550]: https://github.com/OP-TEE/optee_os/pull/1550 532[#1519]: https://github.com/OP-TEE/optee_os/pull/1519 533[#1502]: https://github.com/OP-TEE/optee_os/pull/1502 534[#1365]: https://github.com/OP-TEE/optee_os/pull/1365 535[#1552]: https://github.com/OP-TEE/optee_os/pull/1552 536[#1513]: https://github.com/OP-TEE/optee_os/pull/1513 537[#1508]: https://github.com/OP-TEE/optee_os/pull/1508 538[#1493]: https://github.com/OP-TEE/optee_os/pull/1493 539[#1497]: https://github.com/OP-TEE/optee_os/pull/1497 540[#1492]: https://github.com/OP-TEE/optee_os/pull/1492 541[#1490]: https://github.com/OP-TEE/optee_os/pull/1490 542[#1465]: https://github.com/OP-TEE/optee_os/pull/1465 543[#1459]: https://github.com/OP-TEE/optee_os/pull/1459 544[#1440]: https://github.com/OP-TEE/optee_os/pull/1440 545[OP-TEE-2016-0003]: https://www.op-tee.org/security-advisories/ 546[OP-TEE-2016-0002]: https://www.op-tee.org/security-advisories/ 547 548# OP-TEE - version 2.4.0 549 550[Link][github_commits_2_4_0] to a list of all commits between this release and 551the previous one (2.3.0). 552 553Please note: this release is API-compatible with the previous one, but the 554Secure Storage internal format for the REE and SQL FS is not compatible due to 555commits [a238b74][commit_a238b74] ("core: REE FS: use the new hash tree 556interface") and [44e900e][commit_44e900e] ("core: SQL FS: use the new hash tree 557interface"). 558 559## New features 560 561* Add porting guidelines 562 563* Add support for Secure Data Path which allows Client and Trusted Applications 564 to share references to secure memory 565 566* New supported platform: Texas Instruments AM57xx (`PLATFORM=ti-am57xx`) 567 568* ARMv7-A: add support for platform services in secure monitor and add these 569 services for the DRA7xx platform 570 571* SPI framework and PL022 driver cleanup and improvements 572 573* Use CNTPCT (when available) to add entropy to the software PRNG 574 575* Add GlobalPlatform Socket API for UDP and TCP (IPv4 and IPv6) 576 577* DRA7: add TRNG driver, enable GICv2 driver 578 579* Support load address larger than 4G 580 581* libutee: preserve error code when calling TEE_Panic() for easier 582 troubleshooting 583 584* Support TA profiling with gprof (-pg compiler switch) 585 586* Optimize the ELF loader for TAs when pager is enabled 587 588* Update documentation 589 590* Add paged secure shared memory that can be transferred between TAs as 591 needed 592 593* Introduce MOBJ abstraction 594 595* i.MX6: add PSCI "on" function 596 597* arm32: introduce PSCI framework 598 599## Bug fixes 600 601* Secure storage: improve integrity checking of the REE and SQL filesystems by 602 adding a hash tree on the internal data structures. Any external modification 603 is detected, except full rollback. Fixes [#1188][issue1188]. 604 605* The linux driver will set the 'privileged' flag (TEE_GEN_CAP_PRIVILEGED) on 606 the device intended for use by tee-supplicant. Fixes [#1199][issue1199]. 607 608* RPMB: don't try to program the RPMB key by default 609 610* Fix "make clean" error cases 611 612* Fix issue when resetting persistent storage enumerator [#1332][issue1332] 613 614* Fix TA panic when doing AES CTS with specific buffer sizes 615 [#1203][issue1203]. 616 617## Known issues 618 619* On RPi3 xtest sometimes stall (rcu_sched self-detected stall on CPU) [#1353][issue1353] 620* For multi-core PSCI support is to be added for ls1021atwr in OP-TEE. 621* USB keyboard cannot be used to stop the u-boot timeout ([build issue131]). 622* Travis service (build.git) seems unstable from time to time. 623 624## Tested on 625 626In the list below, _standard_ means that the `xtest` program passed with 627its default configuration, while _extended_ means it was run successfully 628with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 629v1.1.0.4. 630 631If a platform is not listed, it means the release was not tested on this 632platform. 633 634<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 635* d02: extended 636* hikey: extended 637* imx-mx6ulevk: standard 638* ls-ls1021atwr: standard (single core) 639* mediatek-mt8173: standard 640* rcar-h3: standard 641* rpi3: standard 642* stm-b2260: extended 643* ti-dra7xx: standard 644* vexpress-fvp: standard 645* vexpress-juno: standard 646* vexpress-qemu_armv8a: standard 647* vexpress-qemu_virt: standard 648* zynqmp-zc1751_dc1: standard 649* zynqmp-zc1751_dc2: standard 650* zynqmp-zcu102: standard 651 652[github_commits_2_4_0]: https://github.com/OP-TEE/optee_os/compare/2.3.0...2.4.0 653[issue1332]: https://github.com/OP-TEE/optee_os/issues/1332 654[issue1353]: https://github.com/OP-TEE/optee_os/issues/1353 655[build issue131]: https://github.com/OP-TEE/build/issues/131 656[commit_a238b74]: https://github.com/OP-TEE/optee_os/commit/a238b744b1b3 657[commit_44e900e]: https://github.com/OP-TEE/optee_os/commit/44e900eabfc1 658 659# OP-TEE - version 2.3.0 660 661[Link][github_commits_2_3_0] to a list of all commits between this release and 662the previous one (2.2.0). 663 664Please note: this release is API-compatible with the previous one, but the 665Secure Storage internal format for the REE FS is not compatible due to commit 666[361fb3e][commit_361fb3e] ("core: REE FS: use a single file per object"). 667 668[commit_361fb3e]: https://github.com/OP-TEE/optee_os/commit/361fb3e 669 670## New features 671 672* New supported platform: Xilinx Zynq 7000 ZC702 (`PLATFORM=zynq7k-zc702`) 673 674* Add debug assertions to spinlocks and mutexes 675 676* Add more CP15 register access macros for Cortex-A9 677 678* ARMv7-A: redesign secure monitor to make it easier to register services 679 680* ARMv7-A: cleanup boot arguments 681 682* libutee: extend `TEE_CheckMemoryAccessRights()` with 683 `TEE_MEMORY_ACCESS_SECURE` and `TEE_MEMORY_ACCESS_NONSECURE` 684 685* plat-hikey: enable SPI by default and add sample test code 686 687* Consider `CFLAGS_ta_arm64` and `CFLAGS_ta_arm32` when building TAs 688 689* Secure storage refactoring 690 - Simplify interface with tee-supplicant. Minimize round trips with normal 691 world, especially by adding a cache for FS RPC payload data. 692 - REE FS: use a single file per object, remove block cache. 693 694* Print call stack in panic() 695 696## Bug fixes 697 698* Fix UUID encoding when communicating with normal world (use big endian 699 mode instead of native endianness). Related to this, the string format 700 for UUIDs has changed in tee-supplicant, so that TA file names now follow 701 the format defined in RFC4122 (a missing hyphen was added). The old format 702 is still supported, but deprecated, and will likely be removed with the 703 next major release. 704 705* Drop write permission to non-writable ELF segments after TA loading is 706 complete. 707 708* mm: fix confusing memory mapping debug traces 709 710* plat-ti: fix issues with MMU mapping 711 712* crypto: fix clearing of big numbers 713 714* build: allow spaces and double quotes in CFG_ variables 715 716* mm: use paddr_t to support both 32- and 64-bit architectures properly. 717 Resolves 32-bit truncation error when pool is at top of 32 bit address 718 space on 64-bit architecture. 719 720* plat-stm: support pager. Fix pager on ARMv7-A SMP boards. 721 722* Fix debug output of Trusted Applications (remove "ERROR: TEE-CORE:" prefix) 723 724* Do not consider TA memref parameters as TA private memory 725 726* crypto: fix `cipher_final()` which would not call `cbc_done()` for CBC_MAC 727 algorithms 728 729* fix for 16-way PL310 730 731* arm32: fix call stack unwinding (`print_stack()`) 732 733* arm32: fix spinlock assembly code 734 735* plat-stm, plat-imx: fix SCR initalization 736 737* Fix user L1 MMU entries calculation (non-LPAE), allowing TTBCR.N values 738 other than 7. 739 740* mtk-mt8173: fix panic caused by incorrect size of SHMEM 741 742* plat-stm: fix RNG driver (non-flat mapping) 743 744## Known issues 745 746* New issues open on GitHub 747 * [#1203][issue1203] AES-CTS mode will fail when inlen=0x100, in_incr=0x80 748 * [#1199][issue1199] Both tee and teepriv reported GlobalPlatform compliant 749 * [#1188][issue1188] Secure storage (SQL FS and REE FS): blocks not tied to 750 current meta header 751 * [#1172][issue1172] paddr_t should be larger than 32 bits when 752 CFG_WITH_LPAE is enabled 753 754## Tested on 755 756In the list below, _standard_ means that the `xtest` program passed with 757its default configuration, while _extended_ means it was run successfully 758with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 759v1.1.0.4. 760 761If a platform is not listed, it means the release was not tested on this 762platform. 763 764<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 765* d02: extended 766* hikey: extended 767* imx-mx6ulevk: standard 768* ls-ls1021atwr: standard 769* mediatek-mt8173: standard 770* rcar-h3: standard 771* rpi3: standard 772* stm-b2260: extended 773* stm-cannes: extended 774* ti-dra7xx: standard 775* vexpress-fvp: standard 776* vexpress-juno: standard 777* vexpress-qemu_armv8a: standard 778* vexpress-qemu_virt: extended 779* zynqmp-zcu102: standard 780 781[github_commits_2_3_0]: https://github.com/OP-TEE/optee_os/compare/2.2.0...2.3.0 782[issue1172]: https://github.com/OP-TEE/optee_os/issues/1172 783[issue1188]: https://github.com/OP-TEE/optee_os/issues/1188 784[issue1199]: https://github.com/OP-TEE/optee_os/issues/1199 785[issue1203]: https://github.com/OP-TEE/optee_os/issues/1203 786 787# OP-TEE - version 2.2.0 788 789[Link][github_commits_2_2_0] to a list of all commits between this release and 790the previous one (2.1.0). 791 792Please note: this release is API-compatible with the previous one, but the 793Secure Storage internal format is not compatible due to commit 794[fde4a75][commit_fde4a75] ("storage: encrypt the FEK with a TA-specific key"). 795 796[commit_fde4a75]: https://github.com/OP-TEE/optee_os/commit/fde4a75 797 798## New features 799 800* New supported platforms: 801 * Freescale i.MX6 Quad SABRE Lite & SD 802 * HiSilicon D02 803 * Raspberry Pi3 804 * Renesas RCAR H3 805 * STMicroelectronics b2260 - h410 806 807* Pager: Support paging of read/write pages by encrypting them with AES-GCM. 808 Support paging of user TAs. Add global setting for TZSRAM size 809 (CFG_CORE_TZSRAM_EMUL_SIZE), defaults to 300K. 810 811* Support for more than 8 CPU cores 812 813* Added SPI framework and PL022 driver 814 815* GPIO: framework supports multiple instances, PL061 driver now has get/set 816 interrupt and mode control functions 817 818* Secure storage: Encrypt the File Encryption Key with a TA-specific key for 819 better TA isolation. Add build-time and run-time support for multiple storage 820 backends. Add SQLite backend. 821 822* Trusted User Interface: some code is introduced to support the implementation 823 of TUI. This includes: a generic framebuffer driver, display and serial 824 abstractions, and drivers for PL111 (LCD) / PL050 (KMI) / TZC400 and PS2 825 mouse. 826 827* AES acceleration using ARMv8-A Cryptographic Extensions instructions is 828 now supported in AArch32 mode 829 830* Add support for GCC flags: -fsanitize=undefined and -fsanitize=kernel-address 831 832* Use a global setting for core heap size (CFG_CORE_HEAP_SIZE), 64K by default. 833 834* Add macros to unwind and print the call stack of TEE core 835 836* Libtomcrypt: sync with the latest `develop` branch. 837 838* The Trusted Application SDK (ta_dev_kit.mk) can produce libraries (.a) 839 840* Rework assertions and TEE core panics and properly honor NDEBUG 841 842## Bug fixes 843 844* Fix incorrect algorithm passed to cipher.final() 845 846* scripts: support Python 2.x and 3.x 847 848* Secure storage: Add proper locking to support concurrent access. Fix sign 849 extension bug with offset parameter of syscall storage_obj_seek which could 850 cause errors in Aarch32 mode. Fix reading beyond end of file. 851 852* Aarch64: mask all maskable exceptions before doing a normal return from call. 853 854* Device Tree: add no-map property to OP-TEE node in reserved-memory. 855 856* LibTomcrypt: fix CVE-2016-6129 857 858## Known issues 859 860* New issues open on GitHub 861 * [#1093][issue1093] rcar-h3: xtest 6010 hangs 862 * [#1092][issue1092] rcar-h3: xtest 4010 fails 863 * [#1081][issue1081] Bad mapping of TA secure memref parameters 864 * [#1071][issue1071] __data_end may not correctly represent text start position when using CFG_WITH_PAGER 865 * [#1069][issue1069] armv7/Aarch32: crash in stack unwind (DPRINT_STACK()) 866 867## Tested on 868 869In the list below, _standard_ means that the `xtest` program passed with 870its default configuration, while _extended_ means it was run successfully 871with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 872v1.1.0.4. 873 874If a platform is not listed, it means the release was not tested on this 875platform. 876 877<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 878* d02: extended 879* hikey: extended 880* imx-mx6qsabrelite: standard 881* imx-mx6qsabresd: standard 882* rcar-h3: standard, pass except issues [#1092][issue1092] and [#1093][issue1093] 883* rpi3: standard 884* stm-b2260: standard 885* stm-cannes: standard 886* ti-dra7xx: standard 887* vexpress-fvp: standard 888* vexpress-juno: standard 889* vexpress-qemu_armv8a: standard 890* vexpress-qemu_virt: extended 891* zynqmp-zcu102: standard 892 893[github_commits_2_2_0]: https://github.com/OP-TEE/optee_os/compare/2.1.0...2.2.0 894[issue1081]: https://github.com/OP-TEE/optee_os/issues/1081 895[issue1071]: https://github.com/OP-TEE/optee_os/issues/1071 896[issue1069]: https://github.com/OP-TEE/optee_os/issues/1069 897[issue1092]: https://github.com/OP-TEE/optee_os/issues/1092 898[issue1093]: https://github.com/OP-TEE/optee_os/issues/1093 899 900# OP-TEE - version 2.1.0 901 902## New features 903 904* New supported platforms: 905 * Xilinx Zynq UltraScale+ MPSOC 906 * Spreadtrum SC9860 907 908* GCC5 support 909 910* Non Linear Mapping support: In OP-TEE kernel mode, the physical to virtual 911 addresses was linear until this release, meaning the virtual addresses 912 were equal to the physical addresses. This is no more the case in this 913 release. 914 915* Font rendering routines have been introduced in order to ease an 916 implementation of Trusted UI. 917 918* File Storage: Possibility to use the normal world filesystem and the RPMB 919 implementations simultaneously. 920 921* AOSP: There is a [local manifest][aosp_local_manifest] to build OP-TEE into an AOSP build, running on HiKey. 922 Please refer to the README in that repo for instructions. 923 924* OpenEmbedded: In addition to the makefile-based build described in the optee_os README, there is an 925 [OpenEmbedded-based build][oe_build] that supports Qemu (32-bit), FVP (64-bit), and HiKey (64-bit). 926 Please refer to the README in that repo for instructions. 927 928* [Link][github_commits_2_1_0] to a list of all commits between this and 929 previous release. 930 931 932## Tested on 933Definitions: 934 935| Type | Meaning | 936| ---- | ------- | 937| Standard tests | The [optee_test][optee_test] project. | 938| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 939 940* ARM Juno Board (vexpress-juno), standard. 941* Foundation Models (vexpress-fvp), standard tests + extended tests, 942 using FVP ARM V8 Foundation Platformr0p0 (platform build 10.0.37) 943* FSL i.MX6 UltraLite EVK (imx), standard. 944* FSL ls1021a (ls-ls1021atwr), standard tests. 945* HiKey (hikey), standard + extended tests. 946* QEMU (vexpress-qemu), standard + extended tests. 947* Xilinx Zynq UltraScale+ MPSOC, standard tests 948 949Note that the following platform has not been tested: 950* MTK8173-EVB (mediatek-mt8173) 951 952 953## Known issues 954* Issue(s) open on GitHub 955 * [#868][pr868]: python-wand font generation sometimes times out 956 * [#863][pr863]: "double free or corruption" error when building optee_os 957 * [#858][pr858]: UUIDs in binary format have wrong endinanness 958 * [#857][pr857]: Formatting of UUIDs is incorrect 959 * [#847][pr847]: optee_os panic(TEE-CORE: Assertion) 960 * [#838][pr838]: TUI font rendering is _very_ slow 961 * [#814][pr814]: Persistent objects : save informations after close 962 * [#665][pr665]: xtest 1013 stalled on HiKey when log levels are 4 and optee_os is on its own UART 963 * [#506][pr506]: tee-supplicant panic & ta panic 964 965[github_commits_2_1_0]: https://github.com/OP-TEE/optee_os/compare/2.0.0...2.1.0 966[pr868]: https://github.com/OP-TEE/optee_os/issues/868 967[pr863]: https://github.com/OP-TEE/optee_os/issues/863 968[pr858]: https://github.com/OP-TEE/optee_os/issues/858 969[pr857]: https://github.com/OP-TEE/optee_os/issues/857 970[pr847]: https://github.com/OP-TEE/optee_os/issues/847 971[pr838]: https://github.com/OP-TEE/optee_os/issues/838 972[pr814]: https://github.com/OP-TEE/optee_os/issues/814 973[pr665]: https://github.com/OP-TEE/optee_os/issues/665 974[aosp_local_manifest]: https://github.com/linaro-swg/optee_android_manifest 975[oe_build]: https://github.com/linaro-swg/oe-optee 976 977# OP-TEE - version 2.0.0 978 979## New features 980 981* Generic driver: A new generic TEE driver is in the process of being 982 [upstreamed][gendrv_v9]. 983 In this release, [OP-TEE/optee_linuxdriver][optee_linuxdriver] is no more used. 984 Instead, linux v4.5 is being patched using the proposed Generic TEE Driver, 985 as it can be found in [https://github.com/linaro-swg/linux/tree/optee][linux_optee] 986 987* RPMB support: Secure Storage can now use Replay Protected Memory Block (RPMB) partition 988 of an eMMC device. Check the [full documentation][rpmb_doc] 989 990* Hard-float ABI is now available. 991 992* [Link][github_commits_2_0_0] to a list of all commits between this and 993 previous release. 994 995 996## Tested on 997Definitions: 998 999| Type | Meaning | 1000| ---- | ------- | 1001| Standard tests | The [optee_test][optee_test] project. | 1002| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1003 1004* ARM Juno Board (vexpress-juno), standard. 1005* Foundation Models (vexpress-fvp), standard tests + extended tests, 1006 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 1007* FSL ls1021a (ls-ls1021atwr), standard. 1008* HiKey (hikey), standard. 1009* MTK8173-EVB (mediatek-mt8173), standard. 1010* QEMU (vexpress-qemu), standard + extended tests. 1011* STM Cannes (stm-cannes), standard + extended tests. 1012 1013## Known issues 1014* Issue(s) open on GitHub 1015 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 1016 * [#506][pr506]: tee-supplicant panic & ta panic 1017 1018[github_commits_2_0_0]: https://github.com/OP-TEE/optee_os/compare/1.1.0...2.0.0 1019[rpmb_doc]: https://github.com/OP-TEE/optee_os/blob/master/documentation/secure_storage_rpmb.md 1020[optee_linuxdriver]: https://github.com/OP-TEE/optee_linuxdriver 1021[gendrv_v9]: https://lkml.org/lkml/2016/4/1/205 1022[linux_optee]: https://github.com/linaro-swg/linux/tree/optee 1023 1024 1025# OP-TEE - version 1.1.0 1026 1027 1028## New features 1029 1030* Softfloat library: floating point support is now available in 32bits TA. 1031 1032* Support running 64-bits TA: on ARMv8-A platform, TA can be compiled in 1033 AArch32 and/or in AArch64 in case the core is compiled in AArch64. 1034 An example can be found in HiKey configuration file. Using the following 1035 excerpt code, the user TA libraries are compiled in both AArch32 and 1036 AArch64, and can be found in `out/arm-plat-hikey/export-ta_arm32` and 1037 `out/arm-plat-hikey/export-ta_arm64` 1038 1039``` 1040 ta-targets = ta_arm32 1041 ta-targets += ta_arm64 1042``` 1043 1044* Concurrent TA support: multiple TA can run in parallel on 1045 several cores. 1046 1047* New tests added in xtest test suite: concurrent TA (xtest 1013), 1048 floating point tests (xtest 1006 and os_test TA) and corruption 1049 file storage (xtest 20000) 1050 1051* [Link][github_commits_1_1_0] to a list of all commits between this and 1052 previous release. 1053 1054 1055## Tested on 1056Definitions: 1057 1058| Type | Meaning | 1059| ---- | ------- | 1060| Standard tests | The [optee_test][optee_test] project. | 1061| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1062| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1063 1064* Foundation Models (vexpress-fvp), standard tests + extended tests, 1065 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 1066* HiKey (hikey), standard + extended tests. 1067* MT8173 (mediatek), standard tests. 1068* QEMU (vexpress-qemu), standard + extended tests. 1069* STM Cannes (stm-cannes), standard + extended tests. 1070 1071## Known issues 1072* Secure Storage is implemented, but note that anti-rollback protection 1073 is not implemented yet. 1074 1075* Issue(s) open on GitHub 1076 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 1077 * [#296][pr296]: Connecting RPMB to the storage APIs. 1078 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 1079 * [#506][pr506]: tee-supplicant panic & ta panic 1080 1081[prld40]: https://github.com/OP-TEE/optee_linuxdriver/issues/40 1082[pr506]: https://github.com/OP-TEE/optee_os/issues/506 1083[github_commits_1_1_0]: https://github.com/OP-TEE/optee_os/compare/1.0.1...1.1.0 1084 1085 1086 1087# OP-TEE - version 1.0.0 1088 1089OP-TEE is now maintained by Linaro. Contributors do not need to 1090sign a CLA anymore, but must follow the rules of the [DCO][DCO] 1091(Developer Certificate of Origin) instead. 1092 1093 1094## New features 1095 1096* Add hardware support for Texas Instruments DRA7xx, ARMv7 (plat-ti) 1097 1098* GlobalPlatform™ TEE Internal Core API Specification v1.1, 1099 including ECC algorithms. 1100 1101* Secure Storage: Files stored by the REE are now encrypted. Operations 1102 are made atomic in order to prevent inconsistencies in case of errors 1103 during the storage operations. [Slides][LCStorage] describing the 1104 Secure Storage have been presented at the Linaro Connect SFO15. 1105 1106* Change of format of the Trusted Applications: they follow a 1107 [signed ELF format][elf] 1108 1109* Rework thread [synchronization][synchro] in optee_os. 1110 1111* Use of ARMv8 native cryptographic support. 1112 1113* [OP-TEE/optee_test][optee_test] test suite is released. 1114 1115* Introduce [OP-TEE/manifest][manifest] and [OP-TEE/build][build] 1116 to setup and build QEMU, FVP, HiKey and Mediatek platforms. Setup scripts 1117 that used to be in optee_os have been removed, except for Juno board. 1118 1119* [Link][github_commits_1_0_0] to a list of all commits between this and 1120 previous release. 1121 1122 1123## Tested on 1124Definitions: 1125 1126| Type | Meaning | 1127| ---- | ------- | 1128| Standard tests | The [optee_test][optee_test] project. | 1129| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1130| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1131 1132* ARM Juno Board (vexpress-juno), standard + extended tests. 1133* Foundation Models (vexpress-fvp), standard tests. 1134* HiKey (hikey), standard + extended tests. 1135* MT8173 (mediatek), standard tests. 1136* QEMU (vexpress-qemu), standard + extended tests. 1137* STM Cannes (stm-cannes), standard + extended tests. 1138 1139## Known issues 1140* Secure Storage is implemented, but note that anti-rollback protection 1141 is not implemented yet. 1142 1143* Issue(s) open on GitHub 1144 * [#210][pr210]: libteec.so 32-bit does not communicate well 1145 with 64-bit kernel module 1146 * [#296][pr296]: Connecting RPMB to the storage APIs. 1147 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 1148 * [#494][pr494]: HiKey: xtest 7671 fails (1.0.0-rc2) 1149 1150[pr210]: https://github.com/OP-TEE/optee_os/issues/210 1151[pr296]: https://github.com/OP-TEE/optee_os/issues/296 1152[pr493]: https://github.com/OP-TEE/optee_os/issues/493 1153[pr494]: https://github.com/OP-TEE/optee_os/issues/494 1154[github_commits_1_0_0]: https://github.com/OP-TEE/optee_os/compare/0.3.0...1.0.0 1155[DCO]: https://github.com/OP-TEE/optee_os/blob/master/Notice.md#contributions 1156[LCStorage]: http://www.slideshare.net/linaroorg/sfo15503-secure-storage-in-optee 1157[synchro]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#4-thread-handling 1158[elf]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#format 1159[optee_test]: https://github.com/OP-TEE/optee_test 1160[manifest]: https://github.com/OP-TEE/manifest 1161[build]: https://github.com/OP-TEE/build 1162 1163 1164 1165# OP-TEE - version 0.3.0 1166 1167## New features 1168 1169* Add hardware support for 1170 * Mediatek MT8173 Board, ARMv8-A (plat-mediatek) 1171 * Hisilicon HiKey Board, ARMv8-A (plat-hikey) 1172* AArch64 build of optee_os is now possible through the configuration `CFG_ARM64_core=y` 1173* Secure Storage: Data can be encrypted prior to their storage in the non-secure. 1174 Build is configured using `CFG_ENC_FS=y` 1175* A generic boot scheme can be used. Boot configuration is commonalized. This helps 1176 new board support. It is applied on plat-hikey, plat-vexpress, plat-mediatek, plat-stm 1177 and plat-vexpress. 1178 1179## Tested on 1180Definitions: 1181 1182| Type | Meaning | 1183| ---- | ------- | 1184| Standard tests | The optee_test project. | 1185| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1186| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1187 1188* ARM Juno Board (vexpress-juno), standard tests. 1189* Foundation Models (vexpress-fvp), standard tests. 1190* HiKey (hikey), standard tests. 1191* MT8173 (mediatek), standard tests. 1192* QEMU (vexpress-qemu), standard + extended tests. 1193* STM Cannes (stm-cannes), standard + extended tests. 1194 1195------------------------------------------- 1196 1197# OP-TEE - version 0.2.0 1198 1199## New features 1200 1201### Linux Driver Refactoring 1202 1203Linux Driver has been refactored. It is now split in two parts: 1204* optee.ko, the generic Linux driver. It contains all functionality 1205 common to all backends. 1206* optee_armtz.ko, a specific backend dedicated to the TrustZone optee. 1207 It depends on optee.ko. 1208 1209Loading the TrustZone optee linux driver module is now performed using 1210 1211 modprobe optee_armtz 1212 1213Thanks to the dependency between the generic and the backend modules, optee.ko is then automatically loaded. 1214 1215### Misc new features 1216* support PL310 lock down at TEE boot 1217* add 64bits support (division / print) 1218 1219## Tested on 1220Definitions: 1221 1222| Type | Meaning | 1223| ---- | ------- | 1224| Standard tests | The optee_test project. | 1225| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1226| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1227 1228* ARM Juno Board (vexpress-juno), standard tests + extended tests. 1229 1230* Foundation Models (vexpress-fvp), standard + extended tests. 1231 1232* QEMU (vexpress-qemu), standard + extended tests. 1233 1234* STM Cannes (stm-cannes), standard + extended tests. 1235 1236 1237## Issues resolved since last release 1238* Fix user TA trace issue, in order each TA is able to select its own trace level 1239 1240 1241------------------------------------------- 1242# OP-TEE - version 0.1.0 1243 1244## New features 1245Below is a summary of the most important features added, but at the end you will 1246find a link that present you all commits between the current and previous 1247release tag. 1248 1249* GlobalPlatform Client API v1.0 support. 1250 1251* GlobalPlatform Internal API v1.0 support. 1252 1253* GlobalPlatform Secure Elements v1.0 support. 1254 1255* Add hardware support for 1256 1257 * Allwinner A80, ARMv7-A. 1258 1259 * ARM Juno Board, ARMv8-A. 1260 1261 * Foundation Models, ARMv8-A. 1262 1263 * Fast Models, ARMv8-A. 1264 1265 * QEMU, ARMv7-A. 1266 1267 * STM Cannes, ARMv7-A. 1268 1269 * STM Orly2, ARMv7-A. 1270 1271* Add LibTomCrypt as the default software cryptographic library. 1272 1273* Add cryptographic abstraction layer in on secure side to ease the use of 1274 other cryptographic software libraries or adding support for hardware 1275 acceleration. 1276 1277* Extended cryptographic API with support for HKDF, Concat KDF and PBKDF2. 1278 1279* SHA-1 and SHA-256 ARMv8-A crypto extension implementation. 1280 1281* Enabled paging support in OP-TEE OS. 1282 1283* Add support for xtest (both standard and extended) in QEMU and FVP setup 1284 scripts. 1285 1286* Add documentation for the OS design, cryptographic abstraction layer, secure 1287 elements design, the build system, GitHub usage, key derivation extensions, 1288 ARM-Trusted Firmware usage within OP-TEE and GlobalPlatform usage within 1289 OP-TEE. 1290 1291* Integrate support for Travis CI. 1292 1293* [Link][github_commits_0_1_0] to a list of all commits between this and 1294 previous release. 1295 1296 1297## Tested on 1298Definitions: 1299 1300| Type | Meaning | 1301| ---- | ------- | 1302| Standard tests | The optee_test project. | 1303| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.0.0. | 1304| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1305 1306* Allwinner A80 (plat-sunxi), hello world test. 1307 1308* ARM Juno Board (vexpress-juno), standard tests. 1309 1310* Foundation Models (plat-vexpress-fvp), standard + extended tests 1311 1312* QEMU (plat-vexpress-qemu), standard + extended tests (and Secure Elements 1313 tested separately). 1314 1315* STM Cannes (plat-stm-cannes), standard + extended tests. 1316 1317 1318## Issues resolved since last release 1319N/A since this is the first release tag on OP-TEE. 1320 1321 1322## Known issues 1323* Storage is implemented, but not "Secure storage", meaning that a client 1324 needs to do encrypt files on their own before storing the files. 1325 1326* Issue(s) open on GitHub 1327 * [#95][pr95]: An error about building the test code of libtomcrypt. 1328 1329 * [#149][pr149]: when testing optee os with arm trusted firmware (I 1330 utilized optee os tee.bin as bl32 image) on juno platform, I got an 1331 error. 1332 1333 * [#161][pr161]: tee_svc_cryp.c lacks accessibility checks on 1334 user-supplied TEE_Attributes. 1335 1336[hello_world]: https://github.com/jenswi-linaro/lcu14_optee_hello_world 1337[github_commits_0_1_0]: https://github.com/OP-TEE/optee_os/compare/b01047730e77127c23a36591643eeb8bb0487d68...999e4a6c0f64d3177fd3d0db234107b6fb860884 1338[pr95]: https://github.com/OP-TEE/optee_os/issues/95 1339[pr149]: https://github.com/OP-TEE/optee_os/issues/149 1340[pr161]: https://github.com/OP-TEE/optee_os/issues/161 1341 1342* Global Platform Device Internal Core API v1.1 1343 * [#230][pr230]: Persistent object corruption support (TEE_ERROR_CORRUPT_OBJECT/_2) 1344 * [#230][pr230]: Persistent object access support (TEE_ERROR_STORAGE_NOT_AVAILABLE/_2) 1345