1# OP-TEE - version 3.7.0 (2019-10-18) 2 3- Links to the release pages, commits and pull requests merged into this release for: 4 - OP-TEE/optee_os: [release page][OP_TEE_optee_os_release_3_7_0], [commits][OP_TEE_optee_os_commits_3_7_0] and [pull requests][OP_TEE_optee_os_pr_3_7_0] 5 - OP-TEE/optee_client: [release page][OP_TEE_optee_client_release_3_7_0], [commits][OP_TEE_optee_client_commits_3_7_0] and [pull requests][OP_TEE_optee_client_pr_3_7_0] 6 - OP-TEE/optee_test: [release page][OP_TEE_optee_test_release_3_7_0], [commits][OP_TEE_optee_test_commits_3_7_0] and [pull requests][OP_TEE_optee_test_pr_3_7_0] 7 - OP-TEE/build: [release page][OP_TEE_build_release_3_7_0], [commits][OP_TEE_build_commits_3_7_0] and [pull requests][OP_TEE_build_pr_3_7_0] 8 - linaro-swg/optee_examples: [release page][linaro_swg_optee_examples_release_3_7_0], [commits][linaro_swg_optee_examples_commits_3_7_0] and [pull requests][linaro_swg_optee_examples_pr_3_7_0] 9 10 11[OP_TEE_optee_os_release_3_7_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.7.0 12[OP_TEE_optee_os_commits_3_7_0]: https://github.com/OP-TEE/optee_os/compare/3.6.0...3.7.0 13[OP_TEE_optee_os_pr_3_7_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 14 15[OP_TEE_optee_client_release_3_7_0]: https://github.com/OP-TEE/optee_client/releases/tag/3.7.0 16[OP_TEE_optee_client_commits_3_7_0]: https://github.com/OP-TEE/optee_client/compare/3.6.0...3.7.0 17[OP_TEE_optee_client_pr_3_7_0]: https://github.com/OP-TEE/optee_client/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 18 19[OP_TEE_optee_test_release_3_7_0]: https://github.com/OP-TEE/optee_test/releases/tag/3.7.0 20[OP_TEE_optee_test_commits_3_7_0]: https://github.com/OP-TEE/optee_test/compare/3.6.0...3.7.0 21[OP_TEE_optee_test_pr_3_7_0]: https://github.com/OP-TEE/optee_test/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 22 23[OP_TEE_build_release_3_7_0]: https://github.com/OP-TEE/build/releases/tag/3.7.0 24[OP_TEE_build_commits_3_7_0]: https://github.com/OP-TEE/build/compare/3.6.0...3.7.0 25[OP_TEE_build_pr_3_7_0]: https://github.com/OP-TEE/build/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 26 27[linaro_swg_optee_examples_release_3_7_0]: https://github.com/linaro-swg/optee_examples/releases/tag/3.7.0 28[linaro_swg_optee_examples_commits_3_7_0]: https://github.com/linaro-swg/optee_examples/compare/3.6.0...3.7.0 29[linaro_swg_optee_examples_pr_3_7_0]: https://github.com/linaro-swg/optee_examples/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 30 31# OP-TEE - version 3.6.0 (2019-07-05) 32 33- Link to the GitHub [release page][github_release_3_6_0]. 34- Links to the [commits][github_commits_3_6_0] and 35[pull requests][github_pr_3_6_0] merged into this release. 36 37[github_release_3_6_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.6.0 38[github_commits_3_6_0]: https://github.com/OP-TEE/optee_os/compare/3.5.0...3.6.0 39[github_pr_3_6_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-04-26..2019-07-05 40 41# OP-TEE - version 3.5.0 (2019-04-26) 42 43- Link to the GitHub [release page][github_release_3_5_0]. 44- Links to the [commits][github_commits_3_5_0] and 45[pull requests][github_pr_3_5_0] merged into this release. 46 47[github_release_3_5_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.5.0 48[github_commits_3_5_0]: https://github.com/OP-TEE/optee_os/compare/3.4.0...3.5.0 49[github_pr_3_5_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-01-26..2019-04-26 50 51# OP-TEE - version 3.4.0 (2019-01-25) 52 53- Link to the GitHub [release page][github_release_3_4_0]. 54- Links to the [commits][github_commits_3_4_0] and 55[pull requests][github_pr_3_4_0] merged into this release. 56 57[github_release_3_4_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.4.0 58[github_commits_3_4_0]: https://github.com/OP-TEE/optee_os/compare/3.3.0...3.4.0 59[github_pr_3_4_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-10-12..2019-01-25 60 61# OP-TEE - version 3.3.0 (2018-10-12) 62 63- Link to the GitHub [release page][github_release_3_3_0]. 64- Links to the [commits][github_commits_3_3_0] and 65[pull requests][github_pr_3_3_0] merged into this release. 66 67[github_release_3_3_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.3.0 68[github_commits_3_3_0]: https://github.com/OP-TEE/optee_os/compare/3.2.0...3.3.0 69[github_pr_3_3_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-07-04..2018-10-12 70 71# OP-TEE - version 3.2.0 (2018-07-04) 72 73- Link to the GitHub [release page][github_release_3_2_0]. 74- Links to the [commits][github_commits_3_2_0] and 75[pull requests][github_pr_3_2_0] merged into this release. 76 77## Known issues 78 79* HiKey960: assertion in bget create_free_block() \[memalign() self-test\] ([#2414]) 80* D02: assertion '!have_spinlock()' ([#2437]) 81 82[github_commits_3_2_0]: https://github.com/OP-TEE/optee_os/compare/3.1.0...3.2.0 83[github_pr_3_2_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-04-13..2018-07-04 84[github_release_3_2_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.2.0 85[#2414]: https://github.com/OP-TEE/optee_os/issues/2414 86[#2437]: https://github.com/OP-TEE/optee_os/issues/2437 87 88# OP-TEE - version 3.1.0 (2018-04-13) 89 90- Link to the GitHub [release page][github_release_3_1_0]. 91- Links to the [commits][github_commits_3_1_0] and 92[pull requests][github_pr_3_1_0] merged into this release. 93 94[github_commits_3_1_0]: https://github.com/OP-TEE/optee_os/compare/3.0.0...3.1.0 95[github_pr_3_1_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-01-26..2018-04-13 96[github_release_3_1_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.1.0 97 98# OP-TEE - version 3.0.0 (2018-01-26) 99 100[Link][github_commits_3_0_0] to a list of all commits between this release and 101the previous one (2.6.0). 102 103About backwards compatibility: Trusted Applications built with OP-TEE 2.5.0 or 104earlier will not run properly with a *debug* build of this release due 105to commit [0e1c6e8e][commit_0e1c6e8e] ("Dump call stack on TA panic"). 106Non-debug builds are not affected. 107 108## New features 109 110* New supported platforms: Armada 3700 ([#1946]), Poplar ([#1999]), 64-bit 111 support for FSL ls1012ardb ([#1941]), i.MX6SX Sabreauto ([#1974]). 112* arm32: sm: init CNTVOFF ([#2052]) 113* Debug/info/error traces: make output more compact ([#2011]) 114* tzc380: implement new functions ([#1994]) 115* Secure Data Path: add pseudo-TA to convert VA to PA (#1993]) 116* Pager: use NEON AES GCM implementation ([#1959]) 117* Crypto: add optimized AES GCM implementation using NEON ([#1949]) 118* Add support for using secure storage for TA anti-rollback ([#1928]) 119* Crypto: replace struct crypto_ops with function interface ([#1923], 120 [#1931]) 121* aosp_optee.mk: define OPTEE_BIN ([#1922]) 122* Add build option to allow concurrent execution of single-instance TAs 123 ([#1915]) 124* Pager: support for address sanitizer ([#1856]) 125* Pager: make memory between CFG_TEE_RAM_START and TEE load address usable by 126 pager ([#1826]) 127 128## Bug fixes 129 130* Fix crash in tee_mmu_final() on TA loading error ([#2092]) 131* LibTomCrypt: fix issue causing invalid output when using AES CTR with 132hardware acceleration (CFG_CRYPTO_WITH_CE) ([#2086]) 133* pl310: fix cache sync ([#2035]) 134* tzc380: do not write reserved bits ([#1994]) 135* Fix potential double free in ta_open() ([#1970]) 136* libfdt: fix undefined behaviour in fdt_offset_ptr() ([#1969]) 137* imx_wdog: fix register access ([#1966]) 138* Secure storage: fix potential memory leak after early return ([#1961]) 139* LibTomCrypt: fix double free in dsa_import() ([#1963]) 140* RPMB: fix TA independance issue in secure storage ([#1921]) 141* RPMB: return TEE_ERROR_ACCESS_CONFLICT instead of panicking when a TA 142 attempts to create an existing persistent object without the overwrite flag 143 ([#1919]) 144* PSCI: pass non-secure context to psci_system_suspend() ([#1916]) 145* Fix "Argument list too long" during "make clean" ([#1897]) 146 147## Security fixes 148 149* Mitigations and hardening against the Spectre and Meltdown vulnerabilities 150 (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754). 151 152## Known issues 153 154* Secure storage (REE FS): storage size not updated after 155TEE_TruncateObjectData() ([#2094]) 156* Possible deadlock with CFG_WITH_PAGER=y when loading a TA and not enough 157page tables are available in pgt_cache ([#2080]) 158 159## Tested on 160 161The release was tested successfully on the platforms listed below. 162 163<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 164* d02 165* hikey 166* hikey-hikey960 167* imx-mx6ulevk 168* imx-mx7dsabresd 169* marvell-armada7k8k 170* marvell-armada3700 171* mediatek-mt8173 172* rcar-salvator_m3 173* rockchip-rk322x 174* rpi3 175* sam 176* ti 177* vexpress-juno 178* vexpress-qemu_armv8a 179* vexpress-qemu_virt 180 181[commit_0e1c6e8e]: https://github.com/OP-TEE/optee_os/commit/0e1c6e8e 182[github_commits_3_0_0]: https://github.com/OP-TEE/optee_os/compare/2.6.0...3.0.0 183[#2092]: https://github.com/OP-TEE/optee_os/pull/2092 184[#2086]: https://github.com/OP-TEE/optee_os/pull/2086 185[#2094]: https://github.com/OP-TEE/optee_os/issues/2094 186[#2080]: https://github.com/OP-TEE/optee_os/issues/2080 187[#2052]: https://github.com/OP-TEE/optee_os/pull/2052 188[#2035]: https://github.com/OP-TEE/optee_os/pull/2035 189[#2011]: https://github.com/OP-TEE/optee_os/pull/2011 190[#1999]: https://github.com/OP-TEE/optee_os/pull/1999 191[#1994]: https://github.com/OP-TEE/optee_os/pull/1994 192[#1993]: https://github.com/OP-TEE/optee_os/pull/1993 193[#1974]: https://github.com/OP-TEE/optee_os/pull/1974 194[#1970]: https://github.com/OP-TEE/optee_os/pull/1970 195[#1969]: https://github.com/OP-TEE/optee_os/pull/1969 196[#1966]: https://github.com/OP-TEE/optee_os/pull/1966 197[#1963]: https://github.com/OP-TEE/optee_os/pull/1963 198[#1961]: https://github.com/OP-TEE/optee_os/pull/1961 199[#1959]: https://github.com/OP-TEE/optee_os/pull/1959 200[#1949]: https://github.com/OP-TEE/optee_os/pull/1949 201[#1946]: https://github.com/OP-TEE/optee_os/pull/1946 202[#1941]: https://github.com/OP-TEE/optee_os/pull/1941 203[#1931]: https://github.com/OP-TEE/optee_os/pull/1931 204[#1928]: https://github.com/OP-TEE/optee_os/pull/1928 205[#1923]: https://github.com/OP-TEE/optee_os/pull/1923 206[#1922]: https://github.com/OP-TEE/optee_os/pull/1922 207[#1921]: https://github.com/OP-TEE/optee_os/pull/1921 208[#1919]: https://github.com/OP-TEE/optee_os/pull/1919 209[#1916]: https://github.com/OP-TEE/optee_os/pull/1916 210[#1915]: https://github.com/OP-TEE/optee_os/pull/1915 211[#1897]: https://github.com/OP-TEE/optee_os/pull/1897 212[#1856]: https://github.com/OP-TEE/optee_os/pull/1856 213[#1826]: https://github.com/OP-TEE/optee_os/pull/1826 214 215# OP-TEE - version 2.6.0 216 217[Link][github_commits_2_6_0] to a list of all commits between this release and 218the previous one (2.5.0). 219 220## New features 221 222* New supported platforms: Atmel SAMA5 ([#1714]), HiSilicon HiKey960 ([#1684]), 223 Rockchip RK322X ([#1666]), NXP LS1043A-RDB/LS1046A-RDB ([#1787]), Marvell 224 Armada 70x0/80x0 ([#1807]). 225* Dynamic shared memory (non-contiguous, non-secure memory can be mapped into 226 Trusted Applications VA space) ([#1631]) 227* Dump TA call stack on panic ([#1858]) 228* i.MX: PSCI reset ([#1849]) 229* plat-ti: AM43xx: suspend/resume support ([#1822]) 230* QEMU SMP support ([#1820]) 231* plat-ti: AM43xx: disable TRNG ([#1816]) 232* plat-ti: enable Secure Data Path by default ([#1815]) 233* Improve symbolize.py ([#1778], [#1767], [#1766]) 234* Early TAs (TAs linked in tee.bin) ([#1733]) 235* Suspend/resume framework for arm32 and imx7d support ([#1729]) 236* RK322X PSCI version, features and suspend support ([#1720]) 237* arm32: handle aborts in system mode ([#1703]) 238* i.MX: add SNVS SRTC support ([#1700]) 239* GCC7 support ([#1693]) 240* Improve detection of programming errors in locking code ([#1671], [#1670]) 241* Support TEE RAM size larger than page directory size ([#1669]) 242 243## Removed features 244 245* Remove TUI code ([#1842]) 246 247## Bug fixes 248 249* Add missing synchronization barrier in core_mmu_map_pages() ([#1827]) 250* Secure storage: REE FS: fix bug in error path ([#1801]) 251* ASAN bug fixes ([#1799]) 252* Fix race in core_mmu_user_mapping_is_active() ([#1785]) 253* libutee: printf() and puts() fixes, add putchar() ([#1759], [#1754]) 254* arm32: GICv3: fix FIQ masking in IRQ/ABT/SVC/UND handlers ([#1748]) 255* arm32: preserve r12 in native_intr_handler() ([#1682]) 256* arm64: fix print_kernel_stack() ([#1664]) 257* benchmark: fix core data-abort ([#1658]) 258 259## Security fixes or enhancements 260 261* crypto: fix software PRNG weaknesses 262 ([OP-TEE-2017-0001][OP-TEE-2017-0001]) ([#1843]) 263 264## Tested on 265 266The release was tested successfully on the platforms listed below. 267If a platform is not listed, it means the release was not tested on this 268platform. 269 270<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 271* d02 272* hikey 273* hikey-hikey960 274* imx-mx6ulevk 275* imx-mx7dsabresd 276* ls-ls1021a??? (single core) 277* ls-ls1043ardb 278* ls-ls1046ardb 279* mediatek-mt8173 280* rcar 281* rockchip-rk322x 282* rpi3 283* sam 284* stm-b2260 285* stm-cannes 286* ti-??? 287* vexpress-fvp 288* vexpress-juno 289* vexpress-qemu_armv8a 290* vexpress-qemu_virt 291 292[github_commits_2_6_0]: https://github.com/OP-TEE/optee_os/compare/2.5.0...2.6.0 293[#1858]: https://github.com/OP-TEE/optee_os/issues/1858 294[#1849]: https://github.com/OP-TEE/optee_os/issues/1849 295[#1843]: https://github.com/OP-TEE/optee_os/issues/1843 296[#1842]: https://github.com/OP-TEE/optee_os/issues/1842 297[#1827]: https://github.com/OP-TEE/optee_os/issues/1827 298[#1822]: https://github.com/OP-TEE/optee_os/issues/1822 299[#1820]: https://github.com/OP-TEE/optee_os/issues/1820 300[#1816]: https://github.com/OP-TEE/optee_os/issues/1816 301[#1815]: https://github.com/OP-TEE/optee_os/issues/1815 302[#1807]: https://github.com/OP-TEE/optee_os/issues/1807 303[#1801]: https://github.com/OP-TEE/optee_os/issues/1801 304[#1799]: https://github.com/OP-TEE/optee_os/issues/1799 305[#1787]: https://github.com/OP-TEE/optee_os/issues/1787 306[#1785]: https://github.com/OP-TEE/optee_os/issues/1785 307[#1778]: https://github.com/OP-TEE/optee_os/issues/1778 308[#1767]: https://github.com/OP-TEE/optee_os/issues/1767 309[#1766]: https://github.com/OP-TEE/optee_os/issues/1766 310[#1759]: https://github.com/OP-TEE/optee_os/issues/1759 311[#1754]: https://github.com/OP-TEE/optee_os/issues/1754 312[#1748]: https://github.com/OP-TEE/optee_os/issues/1748 313[#1733]: https://github.com/OP-TEE/optee_os/issues/1733 314[#1729]: https://github.com/OP-TEE/optee_os/issues/1729 315[#1720]: https://github.com/OP-TEE/optee_os/issues/1720 316[#1714]: https://github.com/OP-TEE/optee_os/issues/1714 317[#1703]: https://github.com/OP-TEE/optee_os/issues/1703 318[#1700]: https://github.com/OP-TEE/optee_os/issues/1700 319[#1693]: https://github.com/OP-TEE/optee_os/issues/1693 320[#1684]: https://github.com/OP-TEE/optee_os/issues/1684 321[#1682]: https://github.com/OP-TEE/optee_os/issues/1682 322[#1671]: https://github.com/OP-TEE/optee_os/issues/1671 323[#1670]: https://github.com/OP-TEE/optee_os/issues/1670 324[#1669]: https://github.com/OP-TEE/optee_os/issues/1669 325[#1666]: https://github.com/OP-TEE/optee_os/issues/1666 326[#1664]: https://github.com/OP-TEE/optee_os/issues/1664 327[#1658]: https://github.com/OP-TEE/optee_os/issues/1658 328[#1631]: https://github.com/OP-TEE/optee_os/issues/1631 329[OP-TEE-2017-0001]: https://www.op-tee.org/security-advisories/ 330 331# OP-TEE - version 2.5.0 332 333[Link][github_commits_2_5_0] to a list of all commits between this release and 334the previous one (2.4.0). 335 336## New features 337 338* New supported platform: i.MX7D ([#1639]) 339* Secure storage: anti-rollback protection for REE FS using RPMB FS ([#1630]) 340* Assign non-secure DDR configuration from DT if CFG_DT=y ([#1623]) 341* Add new image format: split image into three separate binaries suitable for 342 upcoming ARM Trusted Firmware ([#1589]). 343* Make alignment check configurable ([#1586]) 344* drivers: add TZC380 driver ([#1578]) 345* plat-imx: PSCI CPU off ([#1577]) 346* 64-bit paging on QEMU v8 and HiKey ([#1575], [#1592]) 347* Benchmark framework ([#1365]) 348* Dump call stack of user TAs on abort ([#1552]) 349* plat-hikey: enable Secure Data Path ([#1440]) 350* Add interface to load and decrypt/authenticate user TAs ([#1513]) 351* plat-ti: add secure paging support ([#1493]) 352* plat-ti: add OTP hardware key support ([#1492]) 353* Support ARM GICv3 ([#1465]) 354 355## Removed features 356 357* stm-orly2 is not supported anymore ([#1650]) 358* Remove secure storage based on SQL FS (`CFG_SQL_FS=y`) ([#1490]) 359* Remove support for mapping user TAs with 1 MiB or 2 MiB granularity 360 (`CFG_SMALL_PAGE_USER_TA=n`) ([#1559]). TAs are always mapped using small 361 pages. 362 363## Bug fixes 364 365* Reduce size of non-pageable code ([#1621]) 366* Ignore `TA_FLAG_MULTI_SESSION` and `TA_FLAG_INSTANCE_KEEP_ALIVE` when 367 `TA_FLAG_SINGLE_INSTANCE` is not set ([#1574]) 368* libutee: remove buffering for AES GCM (PR#1573) and AES CTR ([#1580]) 369* Fix ROUNDUP()/ROUNDDOWN() macros ([#1519]) 370* Do not touch other bits in GICD_CTLR ([#1508]) 371* Fix build issue with `DEBUG=y` and `CFG_TEE_CORE_LOG_LEVEL=0` ([#1502]) 372* crypto: do not restrict hash size when algorithm is ECDSA ([#1497]) 373 374## Security fixes or enhancements 375 376- crypto: fix RSA key leakage after fault injection attack 377 ([OP-TEE-2016-0003][OP-TEE-2016-0003]) ([#1610]) 378* crypto: fix RSA key leakage after side channel attack 379 ([OP-TEE-2016-0002][OP-TEE-2016-0002]) ([#1610]) 380* Make pager aliased pages not always writable ([#1551]) 381* Support for no-exec RO and RW data ([#1459], [#1550]) 382 383## New issues 384 385* armv7: some platform-specific code (`plat_cpu_reset_early()`) overwrites 386SCTLR bits configured by generic code. This affects alignment checks (`SCTLR.A`) 387and write-implies-no-exec (`SCTLR.WXN`, `SCTLR.UWXN`), which can therefore not 388be configured via the compile-time `CFG_` variables. 389* armv7: plat-imx: Cortex-A9 cores should enable branch prediction (`SCLTR.Z`) 390for improved performance. 391* [#1656] qemu_armv8a: init hangs when secure data path and pager are both 392 enabled. 393 394## Tested on 395 396In the list below, _standard_ means that the `xtest` program passed with 397its default configuration, while _extended_ means it was run successfully 398with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 399v1.1.0.4. 400 401If a platform is not listed, it means the release was not tested on this 402platform. 403 404<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 405* d02: extended 406* hikey: extended 407* imx-mx6ulevk: standard 408* imx-mx6ullevk: standard 409* imx-mx7dsabresd: standard 410* ls-ls1021atwr: standard 411* mediatek-mt8173: standard 412* rcar-h3: standard 413* rpi3: standard 414* stm-b2260: extended 415* stm-cannes: extended 416* ti-am43xx: standard 417* ti-am57xx: standard 418* ti-dra7xx: standard 419* vexpress-fvp: standard 420* vexpress-juno: standard 421* vexpress-qemu_armv8a: standard 422* vexpress-qemu_virt: standard 423 424[github_commits_2_5_0]: https://github.com/OP-TEE/optee_os/compare/2.4.0...2.5.0-rc1 425[#1656]: https://github.com/OP-TEE/optee_os/issues/1656 426[#1650]: https://github.com/OP-TEE/optee_os/pull/1650 427[#1639]: https://github.com/OP-TEE/optee_os/pull/1639 428[#1630]: https://github.com/OP-TEE/optee_os/pull/1630 429[#1623]: https://github.com/OP-TEE/optee_os/pull/1623 430[#1621]: https://github.com/OP-TEE/optee_os/pull/1621 431[#1610]: https://github.com/OP-TEE/optee_os/pull/1610 432[#1592]: https://github.com/OP-TEE/optee_os/pull/1592 433[#1589]: https://github.com/OP-TEE/optee_os/pull/1589 434[#1586]: https://github.com/OP-TEE/optee_os/pull/1586 435[#1580]: https://github.com/OP-TEE/optee_os/pull/1580 436[#1578]: https://github.com/OP-TEE/optee_os/pull/1578 437[#1577]: https://github.com/OP-TEE/optee_os/pull/1577 438[#1574]: https://github.com/OP-TEE/optee_os/pull/1574 439[#1559]: https://github.com/OP-TEE/optee_os/pull/1559 440[#1551]: https://github.com/OP-TEE/optee_os/pull/1551 441[#1550]: https://github.com/OP-TEE/optee_os/pull/1550 442[#1519]: https://github.com/OP-TEE/optee_os/pull/1519 443[#1502]: https://github.com/OP-TEE/optee_os/pull/1502 444[#1365]: https://github.com/OP-TEE/optee_os/pull/1365 445[#1552]: https://github.com/OP-TEE/optee_os/pull/1552 446[#1513]: https://github.com/OP-TEE/optee_os/pull/1513 447[#1508]: https://github.com/OP-TEE/optee_os/pull/1508 448[#1493]: https://github.com/OP-TEE/optee_os/pull/1493 449[#1497]: https://github.com/OP-TEE/optee_os/pull/1497 450[#1492]: https://github.com/OP-TEE/optee_os/pull/1492 451[#1490]: https://github.com/OP-TEE/optee_os/pull/1490 452[#1465]: https://github.com/OP-TEE/optee_os/pull/1465 453[#1459]: https://github.com/OP-TEE/optee_os/pull/1459 454[#1440]: https://github.com/OP-TEE/optee_os/pull/1440 455[OP-TEE-2016-0003]: https://www.op-tee.org/security-advisories/ 456[OP-TEE-2016-0002]: https://www.op-tee.org/security-advisories/ 457 458# OP-TEE - version 2.4.0 459 460[Link][github_commits_2_4_0] to a list of all commits between this release and 461the previous one (2.3.0). 462 463Please note: this release is API-compatible with the previous one, but the 464Secure Storage internal format for the REE and SQL FS is not compatible due to 465commits [a238b74][commit_a238b74] ("core: REE FS: use the new hash tree 466interface") and [44e900e][commit_44e900e] ("core: SQL FS: use the new hash tree 467interface"). 468 469## New features 470 471* Add porting guidelines 472 473* Add support for Secure Data Path which allows Client and Trusted Applications 474 to share references to secure memory 475 476* New supported platform: Texas Instruments AM57xx (`PLATFORM=ti-am57xx`) 477 478* ARMv7-A: add support for platform services in secure monitor and add these 479 services for the DRA7xx platform 480 481* SPI framework and PL022 driver cleanup and improvements 482 483* Use CNTPCT (when available) to add entropy to the software PRNG 484 485* Add GlobalPlatform Socket API for UDP and TCP (IPv4 and IPv6) 486 487* DRA7: add TRNG driver, enable GICv2 driver 488 489* Support load address larger than 4G 490 491* libutee: preserve error code when calling TEE_Panic() for easier 492 troubleshooting 493 494* Support TA profiling with gprof (-pg compiler switch) 495 496* Optimize the ELF loader for TAs when pager is enabled 497 498* Update documentation 499 500* Add paged secure shared memory that can be transferred between TAs as 501 needed 502 503* Introduce MOBJ abstraction 504 505* i.MX6: add PSCI "on" function 506 507* arm32: introduce PSCI framework 508 509## Bug fixes 510 511* Secure storage: improve integrity checking of the REE and SQL filesystems by 512 adding a hash tree on the internal data structures. Any external modification 513 is detected, except full rollback. Fixes [#1188][issue1188]. 514 515* The linux driver will set the 'privileged' flag (TEE_GEN_CAP_PRIVILEGED) on 516 the device intended for use by tee-supplicant. Fixes [#1199][issue1199]. 517 518* RPMB: don't try to program the RPMB key by default 519 520* Fix "make clean" error cases 521 522* Fix issue when resetting persistent storage enumerator [#1332][issue1332] 523 524* Fix TA panic when doing AES CTS with specific buffer sizes 525 [#1203][issue1203]. 526 527## Known issues 528 529* On RPi3 xtest sometimes stall (rcu_sched self-detected stall on CPU) [#1353][issue1353] 530* For multi-core PSCI support is to be added for ls1021atwr in OP-TEE. 531* USB keyboard cannot be used to stop the u-boot timeout ([build issue131]). 532* Travis service (build.git) seems unstable from time to time. 533 534## Tested on 535 536In the list below, _standard_ means that the `xtest` program passed with 537its default configuration, while _extended_ means it was run successfully 538with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 539v1.1.0.4. 540 541If a platform is not listed, it means the release was not tested on this 542platform. 543 544<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 545* d02: extended 546* hikey: extended 547* imx-mx6ulevk: standard 548* ls-ls1021atwr: standard (single core) 549* mediatek-mt8173: standard 550* rcar-h3: standard 551* rpi3: standard 552* stm-b2260: extended 553* ti-dra7xx: standard 554* vexpress-fvp: standard 555* vexpress-juno: standard 556* vexpress-qemu_armv8a: standard 557* vexpress-qemu_virt: standard 558* zynqmp-zc1751_dc1: standard 559* zynqmp-zc1751_dc2: standard 560* zynqmp-zcu102: standard 561 562[github_commits_2_4_0]: https://github.com/OP-TEE/optee_os/compare/2.3.0...2.4.0 563[issue1332]: https://github.com/OP-TEE/optee_os/issues/1332 564[issue1353]: https://github.com/OP-TEE/optee_os/issues/1353 565[build issue131]: https://github.com/OP-TEE/build/issues/131 566[commit_a238b74]: https://github.com/OP-TEE/optee_os/commit/a238b744b1b3 567[commit_44e900e]: https://github.com/OP-TEE/optee_os/commit/44e900eabfc1 568 569# OP-TEE - version 2.3.0 570 571[Link][github_commits_2_3_0] to a list of all commits between this release and 572the previous one (2.2.0). 573 574Please note: this release is API-compatible with the previous one, but the 575Secure Storage internal format for the REE FS is not compatible due to commit 576[361fb3e][commit_361fb3e] ("core: REE FS: use a single file per object"). 577 578[commit_361fb3e]: https://github.com/OP-TEE/optee_os/commit/361fb3e 579 580## New features 581 582* New supported platform: Xilinx Zynq 7000 ZC702 (`PLATFORM=zynq7k-zc702`) 583 584* Add debug assertions to spinlocks and mutexes 585 586* Add more CP15 register access macros for Cortex-A9 587 588* ARMv7-A: redesign secure monitor to make it easier to register services 589 590* ARMv7-A: cleanup boot arguments 591 592* libutee: extend `TEE_CheckMemoryAccessRights()` with 593 `TEE_MEMORY_ACCESS_SECURE` and `TEE_MEMORY_ACCESS_NONSECURE` 594 595* plat-hikey: enable SPI by default and add sample test code 596 597* Consider `CFLAGS_ta_arm64` and `CFLAGS_ta_arm32` when building TAs 598 599* Secure storage refactoring 600 - Simplify interface with tee-supplicant. Minimize round trips with normal 601 world, especially by adding a cache for FS RPC payload data. 602 - REE FS: use a single file per object, remove block cache. 603 604* Print call stack in panic() 605 606## Bug fixes 607 608* Fix UUID encoding when communicating with normal world (use big endian 609 mode instead of native endianness). Related to this, the string format 610 for UUIDs has changed in tee-supplicant, so that TA file names now follow 611 the format defined in RFC4122 (a missing hyphen was added). The old format 612 is still supported, but deprecated, and will likely be removed with the 613 next major release. 614 615* Drop write permission to non-writable ELF segments after TA loading is 616 complete. 617 618* mm: fix confusing memory mapping debug traces 619 620* plat-ti: fix issues with MMU mapping 621 622* crypto: fix clearing of big numbers 623 624* build: allow spaces and double quotes in CFG_ variables 625 626* mm: use paddr_t to support both 32- and 64-bit architectures properly. 627 Resolves 32-bit truncation error when pool is at top of 32 bit address 628 space on 64-bit architecture. 629 630* plat-stm: support pager. Fix pager on ARMv7-A SMP boards. 631 632* Fix debug output of Trusted Applications (remove "ERROR: TEE-CORE:" prefix) 633 634* Do not consider TA memref parameters as TA private memory 635 636* crypto: fix `cipher_final()` which would not call `cbc_done()` for CBC_MAC 637 algorithms 638 639* fix for 16-way PL310 640 641* arm32: fix call stack unwinding (`print_stack()`) 642 643* arm32: fix spinlock assembly code 644 645* plat-stm, plat-imx: fix SCR initalization 646 647* Fix user L1 MMU entries calculation (non-LPAE), allowing TTBCR.N values 648 other than 7. 649 650* mtk-mt8173: fix panic caused by incorrect size of SHMEM 651 652* plat-stm: fix RNG driver (non-flat mapping) 653 654## Known issues 655 656* New issues open on GitHub 657 * [#1203][issue1203] AES-CTS mode will fail when inlen=0x100, in_incr=0x80 658 * [#1199][issue1199] Both tee and teepriv reported GlobalPlatform compliant 659 * [#1188][issue1188] Secure storage (SQL FS and REE FS): blocks not tied to 660 current meta header 661 * [#1172][issue1172] paddr_t should be larger than 32 bits when 662 CFG_WITH_LPAE is enabled 663 664## Tested on 665 666In the list below, _standard_ means that the `xtest` program passed with 667its default configuration, while _extended_ means it was run successfully 668with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 669v1.1.0.4. 670 671If a platform is not listed, it means the release was not tested on this 672platform. 673 674<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 675* d02: extended 676* hikey: extended 677* imx-mx6ulevk: standard 678* ls-ls1021atwr: standard 679* mediatek-mt8173: standard 680* rcar-h3: standard 681* rpi3: standard 682* stm-b2260: extended 683* stm-cannes: extended 684* ti-dra7xx: standard 685* vexpress-fvp: standard 686* vexpress-juno: standard 687* vexpress-qemu_armv8a: standard 688* vexpress-qemu_virt: extended 689* zynqmp-zcu102: standard 690 691[github_commits_2_3_0]: https://github.com/OP-TEE/optee_os/compare/2.2.0...2.3.0 692[issue1172]: https://github.com/OP-TEE/optee_os/issues/1172 693[issue1188]: https://github.com/OP-TEE/optee_os/issues/1188 694[issue1199]: https://github.com/OP-TEE/optee_os/issues/1199 695[issue1203]: https://github.com/OP-TEE/optee_os/issues/1203 696 697# OP-TEE - version 2.2.0 698 699[Link][github_commits_2_2_0] to a list of all commits between this release and 700the previous one (2.1.0). 701 702Please note: this release is API-compatible with the previous one, but the 703Secure Storage internal format is not compatible due to commit 704[fde4a75][commit_fde4a75] ("storage: encrypt the FEK with a TA-specific key"). 705 706[commit_fde4a75]: https://github.com/OP-TEE/optee_os/commit/fde4a75 707 708## New features 709 710* New supported platforms: 711 * Freescale i.MX6 Quad SABRE Lite & SD 712 * HiSilicon D02 713 * Raspberry Pi3 714 * Renesas RCAR H3 715 * STMicroelectronics b2260 - h410 716 717* Pager: Support paging of read/write pages by encrypting them with AES-GCM. 718 Support paging of user TAs. Add global setting for TZSRAM size 719 (CFG_CORE_TZSRAM_EMUL_SIZE), defaults to 300K. 720 721* Support for more than 8 CPU cores 722 723* Added SPI framework and PL022 driver 724 725* GPIO: framework supports multiple instances, PL061 driver now has get/set 726 interrupt and mode control functions 727 728* Secure storage: Encrypt the File Encryption Key with a TA-specific key for 729 better TA isolation. Add build-time and run-time support for multiple storage 730 backends. Add SQLite backend. 731 732* Trusted User Interface: some code is introduced to support the implementation 733 of TUI. This includes: a generic framebuffer driver, display and serial 734 abstractions, and drivers for PL111 (LCD) / PL050 (KMI) / TZC400 and PS2 735 mouse. 736 737* AES acceleration using ARMv8-A Cryptographic Extensions instructions is 738 now supported in AArch32 mode 739 740* Add support for GCC flags: -fsanitize=undefined and -fsanitize=kernel-address 741 742* Use a global setting for core heap size (CFG_CORE_HEAP_SIZE), 64K by default. 743 744* Add macros to unwind and print the call stack of TEE core 745 746* Libtomcrypt: sync with the latest `develop` branch. 747 748* The Trusted Application SDK (ta_dev_kit.mk) can produce libraries (.a) 749 750* Rework assertions and TEE core panics and properly honor NDEBUG 751 752## Bug fixes 753 754* Fix incorrect algorithm passed to cipher.final() 755 756* scripts: support Python 2.x and 3.x 757 758* Secure storage: Add proper locking to support concurrent access. Fix sign 759 extension bug with offset parameter of syscall storage_obj_seek which could 760 cause errors in Aarch32 mode. Fix reading beyond end of file. 761 762* Aarch64: mask all maskable exceptions before doing a normal return from call. 763 764* Device Tree: add no-map property to OP-TEE node in reserved-memory. 765 766* LibTomcrypt: fix CVE-2016-6129 767 768## Known issues 769 770* New issues open on GitHub 771 * [#1093][issue1093] rcar-h3: xtest 6010 hangs 772 * [#1092][issue1092] rcar-h3: xtest 4010 fails 773 * [#1081][issue1081] Bad mapping of TA secure memref parameters 774 * [#1071][issue1071] __data_end may not correctly represent text start position when using CFG_WITH_PAGER 775 * [#1069][issue1069] armv7/Aarch32: crash in stack unwind (DPRINT_STACK()) 776 777## Tested on 778 779In the list below, _standard_ means that the `xtest` program passed with 780its default configuration, while _extended_ means it was run successfully 781with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 782v1.1.0.4. 783 784If a platform is not listed, it means the release was not tested on this 785platform. 786 787<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 788* d02: extended 789* hikey: extended 790* imx-mx6qsabrelite: standard 791* imx-mx6qsabresd: standard 792* rcar-h3: standard, pass except issues [#1092][issue1092] and [#1093][issue1093] 793* rpi3: standard 794* stm-b2260: standard 795* stm-cannes: standard 796* ti-dra7xx: standard 797* vexpress-fvp: standard 798* vexpress-juno: standard 799* vexpress-qemu_armv8a: standard 800* vexpress-qemu_virt: extended 801* zynqmp-zcu102: standard 802 803[github_commits_2_2_0]: https://github.com/OP-TEE/optee_os/compare/2.1.0...2.2.0 804[issue1081]: https://github.com/OP-TEE/optee_os/issues/1081 805[issue1071]: https://github.com/OP-TEE/optee_os/issues/1071 806[issue1069]: https://github.com/OP-TEE/optee_os/issues/1069 807[issue1092]: https://github.com/OP-TEE/optee_os/issues/1092 808[issue1093]: https://github.com/OP-TEE/optee_os/issues/1093 809 810# OP-TEE - version 2.1.0 811 812## New features 813 814* New supported platforms: 815 * Xilinx Zynq UltraScale+ MPSOC 816 * Spreadtrum SC9860 817 818* GCC5 support 819 820* Non Linear Mapping support: In OP-TEE kernel mode, the physical to virtual 821 addresses was linear until this release, meaning the virtual addresses 822 were equal to the physical addresses. This is no more the case in this 823 release. 824 825* Font rendering routines have been introduced in order to ease an 826 implementation of Trusted UI. 827 828* File Storage: Possibility to use the normal world filesystem and the RPMB 829 implementations simultaneously. 830 831* AOSP: There is a [local manifest][aosp_local_manifest] to build OP-TEE into an AOSP build, running on HiKey. 832 Please refer to the README in that repo for instructions. 833 834* OpenEmbedded: In addition to the makefile-based build described in the optee_os README, there is an 835 [OpenEmbedded-based build][oe_build] that supports Qemu (32-bit), FVP (64-bit), and HiKey (64-bit). 836 Please refer to the README in that repo for instructions. 837 838* [Link][github_commits_2_1_0] to a list of all commits between this and 839 previous release. 840 841 842## Tested on 843Definitions: 844 845| Type | Meaning | 846| ---- | ------- | 847| Standard tests | The [optee_test][optee_test] project. | 848| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 849 850* ARM Juno Board (vexpress-juno), standard. 851* Foundation Models (vexpress-fvp), standard tests + extended tests, 852 using FVP ARM V8 Foundation Platformr0p0 (platform build 10.0.37) 853* FSL i.MX6 UltraLite EVK (imx), standard. 854* FSL ls1021a (ls-ls1021atwr), standard tests. 855* HiKey (hikey), standard + extended tests. 856* QEMU (vexpress-qemu), standard + extended tests. 857* Xilinx Zynq UltraScale+ MPSOC, standard tests 858 859Note that the following platform has not been tested: 860* MTK8173-EVB (mediatek-mt8173) 861 862 863## Known issues 864* Issue(s) open on GitHub 865 * [#868][pr868]: python-wand font generation sometimes times out 866 * [#863][pr863]: "double free or corruption" error when building optee_os 867 * [#858][pr858]: UUIDs in binary format have wrong endinanness 868 * [#857][pr857]: Formatting of UUIDs is incorrect 869 * [#847][pr847]: optee_os panic(TEE-CORE: Assertion) 870 * [#838][pr838]: TUI font rendering is _very_ slow 871 * [#814][pr814]: Persistent objects : save informations after close 872 * [#665][pr665]: xtest 1013 stalled on HiKey when log levels are 4 and optee_os is on its own UART 873 * [#506][pr506]: tee-supplicant panic & ta panic 874 875[github_commits_2_1_0]: https://github.com/OP-TEE/optee_os/compare/2.0.0...2.1.0 876[pr868]: https://github.com/OP-TEE/optee_os/issues/868 877[pr863]: https://github.com/OP-TEE/optee_os/issues/863 878[pr858]: https://github.com/OP-TEE/optee_os/issues/858 879[pr857]: https://github.com/OP-TEE/optee_os/issues/857 880[pr847]: https://github.com/OP-TEE/optee_os/issues/847 881[pr838]: https://github.com/OP-TEE/optee_os/issues/838 882[pr814]: https://github.com/OP-TEE/optee_os/issues/814 883[pr665]: https://github.com/OP-TEE/optee_os/issues/665 884[aosp_local_manifest]: https://github.com/linaro-swg/optee_android_manifest 885[oe_build]: https://github.com/linaro-swg/oe-optee 886 887# OP-TEE - version 2.0.0 888 889## New features 890 891* Generic driver: A new generic TEE driver is in the process of being 892 [upstreamed][gendrv_v9]. 893 In this release, [OP-TEE/optee_linuxdriver][optee_linuxdriver] is no more used. 894 Instead, linux v4.5 is being patched using the proposed Generic TEE Driver, 895 as it can be found in [https://github.com/linaro-swg/linux/tree/optee][linux_optee] 896 897* RPMB support: Secure Storage can now use Replay Protected Memory Block (RPMB) partition 898 of an eMMC device. Check the [full documentation][rpmb_doc] 899 900* Hard-float ABI is now available. 901 902* [Link][github_commits_2_0_0] to a list of all commits between this and 903 previous release. 904 905 906## Tested on 907Definitions: 908 909| Type | Meaning | 910| ---- | ------- | 911| Standard tests | The [optee_test][optee_test] project. | 912| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 913 914* ARM Juno Board (vexpress-juno), standard. 915* Foundation Models (vexpress-fvp), standard tests + extended tests, 916 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 917* FSL ls1021a (ls-ls1021atwr), standard. 918* HiKey (hikey), standard. 919* MTK8173-EVB (mediatek-mt8173), standard. 920* QEMU (vexpress-qemu), standard + extended tests. 921* STM Cannes (stm-cannes), standard + extended tests. 922 923## Known issues 924* Issue(s) open on GitHub 925 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 926 * [#506][pr506]: tee-supplicant panic & ta panic 927 928[github_commits_2_0_0]: https://github.com/OP-TEE/optee_os/compare/1.1.0...2.0.0 929[rpmb_doc]: https://github.com/OP-TEE/optee_os/blob/master/documentation/secure_storage_rpmb.md 930[optee_linuxdriver]: https://github.com/OP-TEE/optee_linuxdriver 931[gendrv_v9]: https://lkml.org/lkml/2016/4/1/205 932[linux_optee]: https://github.com/linaro-swg/linux/tree/optee 933 934 935# OP-TEE - version 1.1.0 936 937 938## New features 939 940* Softfloat library: floating point support is now available in 32bits TA. 941 942* Support running 64-bits TA: on ARMv8-A platform, TA can be compiled in 943 AArch32 and/or in AArch64 in case the core is compiled in AArch64. 944 An example can be found in HiKey configuration file. Using the following 945 excerpt code, the user TA libraries are compiled in both AArch32 and 946 AArch64, and can be found in `out/arm-plat-hikey/export-ta_arm32` and 947 `out/arm-plat-hikey/export-ta_arm64` 948 949``` 950 ta-targets = ta_arm32 951 ta-targets += ta_arm64 952``` 953 954* Concurrent TA support: multiple TA can run in parallel on 955 several cores. 956 957* New tests added in xtest test suite: concurrent TA (xtest 1013), 958 floating point tests (xtest 1006 and os_test TA) and corruption 959 file storage (xtest 20000) 960 961* [Link][github_commits_1_1_0] to a list of all commits between this and 962 previous release. 963 964 965## Tested on 966Definitions: 967 968| Type | Meaning | 969| ---- | ------- | 970| Standard tests | The [optee_test][optee_test] project. | 971| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 972| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 973 974* Foundation Models (vexpress-fvp), standard tests + extended tests, 975 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 976* HiKey (hikey), standard + extended tests. 977* MT8173 (mediatek), standard tests. 978* QEMU (vexpress-qemu), standard + extended tests. 979* STM Cannes (stm-cannes), standard + extended tests. 980 981## Known issues 982* Secure Storage is implemented, but note that anti-rollback protection 983 is not implemented yet. 984 985* Issue(s) open on GitHub 986 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 987 * [#296][pr296]: Connecting RPMB to the storage APIs. 988 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 989 * [#506][pr506]: tee-supplicant panic & ta panic 990 991[prld40]: https://github.com/OP-TEE/optee_linuxdriver/issues/40 992[pr506]: https://github.com/OP-TEE/optee_os/issues/506 993[github_commits_1_1_0]: https://github.com/OP-TEE/optee_os/compare/1.0.1...1.1.0 994 995 996 997# OP-TEE - version 1.0.0 998 999OP-TEE is now maintained by Linaro. Contributors do not need to 1000sign a CLA anymore, but must follow the rules of the [DCO][DCO] 1001(Developer Certificate of Origin) instead. 1002 1003 1004## New features 1005 1006* Add hardware support for Texas Instruments DRA7xx, ARMv7 (plat-ti) 1007 1008* GlobalPlatform™ TEE Internal Core API Specification v1.1, 1009 including ECC algorithms. 1010 1011* Secure Storage: Files stored by the REE are now encrypted. Operations 1012 are made atomic in order to prevent inconsistencies in case of errors 1013 during the storage operations. [Slides][LCStorage] describing the 1014 Secure Storage have been presented at the Linaro Connect SFO15. 1015 1016* Change of format of the Trusted Applications: they follow a 1017 [signed ELF format][elf] 1018 1019* Rework thread [synchronization][synchro] in optee_os. 1020 1021* Use of ARMv8 native cryptographic support. 1022 1023* [OP-TEE/optee_test][optee_test] test suite is released. 1024 1025* Introduce [OP-TEE/manifest][manifest] and [OP-TEE/build][build] 1026 to setup and build QEMU, FVP, HiKey and Mediatek platforms. Setup scripts 1027 that used to be in optee_os have been removed, except for Juno board. 1028 1029* [Link][github_commits_1_0_0] to a list of all commits between this and 1030 previous release. 1031 1032 1033## Tested on 1034Definitions: 1035 1036| Type | Meaning | 1037| ---- | ------- | 1038| Standard tests | The [optee_test][optee_test] project. | 1039| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1040| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1041 1042* ARM Juno Board (vexpress-juno), standard + extended tests. 1043* Foundation Models (vexpress-fvp), standard tests. 1044* HiKey (hikey), standard + extended tests. 1045* MT8173 (mediatek), standard tests. 1046* QEMU (vexpress-qemu), standard + extended tests. 1047* STM Cannes (stm-cannes), standard + extended tests. 1048 1049## Known issues 1050* Secure Storage is implemented, but note that anti-rollback protection 1051 is not implemented yet. 1052 1053* Issue(s) open on GitHub 1054 * [#210][pr210]: libteec.so 32-bit does not communicate well 1055 with 64-bit kernel module 1056 * [#296][pr296]: Connecting RPMB to the storage APIs. 1057 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 1058 * [#494][pr494]: HiKey: xtest 7671 fails (1.0.0-rc2) 1059 1060[pr210]: https://github.com/OP-TEE/optee_os/issues/210 1061[pr296]: https://github.com/OP-TEE/optee_os/issues/296 1062[pr493]: https://github.com/OP-TEE/optee_os/issues/493 1063[pr494]: https://github.com/OP-TEE/optee_os/issues/494 1064[github_commits_1_0_0]: https://github.com/OP-TEE/optee_os/compare/0.3.0...1.0.0 1065[DCO]: https://github.com/OP-TEE/optee_os/blob/master/Notice.md#contributions 1066[LCStorage]: http://www.slideshare.net/linaroorg/sfo15503-secure-storage-in-optee 1067[synchro]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#4-thread-handling 1068[elf]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#format 1069[optee_test]: https://github.com/OP-TEE/optee_test 1070[manifest]: https://github.com/OP-TEE/manifest 1071[build]: https://github.com/OP-TEE/build 1072 1073 1074 1075# OP-TEE - version 0.3.0 1076 1077## New features 1078 1079* Add hardware support for 1080 * Mediatek MT8173 Board, ARMv8-A (plat-mediatek) 1081 * Hisilicon HiKey Board, ARMv8-A (plat-hikey) 1082* AArch64 build of optee_os is now possible through the configuration `CFG_ARM64_core=y` 1083* Secure Storage: Data can be encrypted prior to their storage in the non-secure. 1084 Build is configured using `CFG_ENC_FS=y` 1085* A generic boot scheme can be used. Boot configuration is commonalized. This helps 1086 new board support. It is applied on plat-hikey, plat-vexpress, plat-mediatek, plat-stm 1087 and plat-vexpress. 1088 1089## Tested on 1090Definitions: 1091 1092| Type | Meaning | 1093| ---- | ------- | 1094| Standard tests | The optee_test project. | 1095| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1096| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1097 1098* ARM Juno Board (vexpress-juno), standard tests. 1099* Foundation Models (vexpress-fvp), standard tests. 1100* HiKey (hikey), standard tests. 1101* MT8173 (mediatek), standard tests. 1102* QEMU (vexpress-qemu), standard + extended tests. 1103* STM Cannes (stm-cannes), standard + extended tests. 1104 1105------------------------------------------- 1106 1107# OP-TEE - version 0.2.0 1108 1109## New features 1110 1111### Linux Driver Refactoring 1112 1113Linux Driver has been refactored. It is now split in two parts: 1114* optee.ko, the generic Linux driver. It contains all functionality 1115 common to all backends. 1116* optee_armtz.ko, a specific backend dedicated to the TrustZone optee. 1117 It depends on optee.ko. 1118 1119Loading the TrustZone optee linux driver module is now performed using 1120 1121 modprobe optee_armtz 1122 1123Thanks to the dependency between the generic and the backend modules, optee.ko is then automatically loaded. 1124 1125### Misc new features 1126* support PL310 lock down at TEE boot 1127* add 64bits support (division / print) 1128 1129## Tested on 1130Definitions: 1131 1132| Type | Meaning | 1133| ---- | ------- | 1134| Standard tests | The optee_test project. | 1135| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1136| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1137 1138* ARM Juno Board (vexpress-juno), standard tests + extended tests. 1139 1140* Foundation Models (vexpress-fvp), standard + extended tests. 1141 1142* QEMU (vexpress-qemu), standard + extended tests. 1143 1144* STM Cannes (stm-cannes), standard + extended tests. 1145 1146 1147## Issues resolved since last release 1148* Fix user TA trace issue, in order each TA is able to select its own trace level 1149 1150 1151------------------------------------------- 1152# OP-TEE - version 0.1.0 1153 1154## New features 1155Below is a summary of the most important features added, but at the end you will 1156find a link that present you all commits between the current and previous 1157release tag. 1158 1159* GlobalPlatform Client API v1.0 support. 1160 1161* GlobalPlatform Internal API v1.0 support. 1162 1163* GlobalPlatform Secure Elements v1.0 support. 1164 1165* Add hardware support for 1166 1167 * Allwinner A80, ARMv7-A. 1168 1169 * ARM Juno Board, ARMv8-A. 1170 1171 * Foundation Models, ARMv8-A. 1172 1173 * Fast Models, ARMv8-A. 1174 1175 * QEMU, ARMv7-A. 1176 1177 * STM Cannes, ARMv7-A. 1178 1179 * STM Orly2, ARMv7-A. 1180 1181* Add LibTomCrypt as the default software cryptographic library. 1182 1183* Add cryptographic abstraction layer in on secure side to ease the use of 1184 other cryptographic software libraries or adding support for hardware 1185 acceleration. 1186 1187* Extended cryptographic API with support for HKDF, Concat KDF and PBKDF2. 1188 1189* SHA-1 and SHA-256 ARMv8-A crypto extension implementation. 1190 1191* Enabled paging support in OP-TEE OS. 1192 1193* Add support for xtest (both standard and extended) in QEMU and FVP setup 1194 scripts. 1195 1196* Add documentation for the OS design, cryptographic abstraction layer, secure 1197 elements design, the build system, GitHub usage, key derivation extensions, 1198 ARM-Trusted Firmware usage within OP-TEE and GlobalPlatform usage within 1199 OP-TEE. 1200 1201* Integrate support for Travis CI. 1202 1203* [Link][github_commits_0_1_0] to a list of all commits between this and 1204 previous release. 1205 1206 1207## Tested on 1208Definitions: 1209 1210| Type | Meaning | 1211| ---- | ------- | 1212| Standard tests | The optee_test project. | 1213| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.0.0. | 1214| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1215 1216* Allwinner A80 (plat-sunxi), hello world test. 1217 1218* ARM Juno Board (vexpress-juno), standard tests. 1219 1220* Foundation Models (plat-vexpress-fvp), standard + extended tests 1221 1222* QEMU (plat-vexpress-qemu), standard + extended tests (and Secure Elements 1223 tested separately). 1224 1225* STM Cannes (plat-stm-cannes), standard + extended tests. 1226 1227 1228## Issues resolved since last release 1229N/A since this is the first release tag on OP-TEE. 1230 1231 1232## Known issues 1233* Storage is implemented, but not "Secure storage", meaning that a client 1234 needs to do encrypt files on their own before storing the files. 1235 1236* Issue(s) open on GitHub 1237 * [#95][pr95]: An error about building the test code of libtomcrypt. 1238 1239 * [#149][pr149]: when testing optee os with arm trusted firmware (I 1240 utilized optee os tee.bin as bl32 image) on juno platform, I got an 1241 error. 1242 1243 * [#161][pr161]: tee_svc_cryp.c lacks accessibility checks on 1244 user-supplied TEE_Attributes. 1245 1246[hello_world]: https://github.com/jenswi-linaro/lcu14_optee_hello_world 1247[github_commits_0_1_0]: https://github.com/OP-TEE/optee_os/compare/b01047730e77127c23a36591643eeb8bb0487d68...999e4a6c0f64d3177fd3d0db234107b6fb860884 1248[pr95]: https://github.com/OP-TEE/optee_os/issues/95 1249[pr149]: https://github.com/OP-TEE/optee_os/issues/149 1250[pr161]: https://github.com/OP-TEE/optee_os/issues/161 1251 1252* Global Platform Device Internal Core API v1.1 1253 * [#230][pr230]: Persistent object corruption support (TEE_ERROR_CORRUPT_OBJECT/_2) 1254 * [#230][pr230]: Persistent object access support (TEE_ERROR_STORAGE_NOT_AVAILABLE/_2) 1255