1# OP-TEE - version 3.1.0 (2018-04-13) 2 3- Link to the GitHub [release page][github_release_3_1_0]. 4- Links to the [commits][github_commits_3_1_0] and 5[pull requests][github_pr_3_1_0] merged into this release. 6 7[github_commits_3_1_0]: https://github.com/OP-TEE/optee_os/compare/3.0.0...3.1.0 8[github_pr_3_1_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-01-26..2018-04-13 9[github_release_3_1_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.1.0 10 11# OP-TEE - version 3.0.0 (2018-01-26) 12 13[Link][github_commits_3_0_0] to a list of all commits between this release and 14the previous one (2.6.0). 15 16About backwards compatibility: Trusted Applications built with OP-TEE 2.5.0 or 17earlier will not run properly with a *debug* build of this release due 18to commit [0e1c6e8e][commit_0e1c6e8e] ("Dump call stack on TA panic"). 19Non-debug builds are not affected. 20 21## New features 22 23* New supported platforms: Armada 3700 ([#1946]), Poplar ([#1999]), 64-bit 24 support for FSL ls1012ardb ([#1941]), i.MX6SX Sabreauto ([#1974]). 25* arm32: sm: init CNTVOFF ([#2052]) 26* Debug/info/error traces: make output more compact ([#2011]) 27* tzc380: implement new functions ([#1994]) 28* Secure Data Path: add pseudo-TA to convert VA to PA (#1993]) 29* Pager: use NEON AES GCM implementation ([#1959]) 30* Crypto: add optimized AES GCM implementation using NEON ([#1949]) 31* Add support for using secure storage for TA anti-rollback ([#1928]) 32* Crypto: replace struct crypto_ops with function interface ([#1923], 33 [#1931]) 34* aosp_optee.mk: define OPTEE_BIN ([#1922]) 35* Add build option to allow concurrent execution of single-instance TAs 36 ([#1915]) 37* Pager: support for address sanitizer ([#1856]) 38* Pager: make memory between CFG_TEE_RAM_START and TEE load address usable by 39 pager ([#1826]) 40 41## Bug fixes 42 43* Fix crash in tee_mmu_final() on TA loading error ([#2092]) 44* LibTomCrypt: fix issue causing invalid output when using AES CTR with 45hardware acceleration (CFG_CRYPTO_WITH_CE) ([#2086]) 46* pl310: fix cache sync ([#2035]) 47* tzc380: do not write reserved bits ([#1994]) 48* Fix potential double free in ta_open() ([#1970]) 49* libfdt: fix undefined behaviour in fdt_offset_ptr() ([#1969]) 50* imx_wdog: fix register access ([#1966]) 51* Secure storage: fix potential memory leak after early return ([#1961]) 52* LibTomCrypt: fix double free in dsa_import() ([#1963]) 53* RPMB: fix TA independance issue in secure storage ([#1921]) 54* RPMB: return TEE_ERROR_ACCESS_CONFLICT instead of panicking when a TA 55 attempts to create an existing persistent object without the overwrite flag 56 ([#1919]) 57* PSCI: pass non-secure context to psci_system_suspend() ([#1916]) 58* Fix "Argument list too long" during "make clean" ([#1897]) 59 60## Security fixes 61 62* Mitigations and hardening against the Spectre and Meltdown vulnerabilities 63 (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754). 64 65## Known issues 66 67* Secure storage (REE FS): storage size not updated after 68TEE_TruncateObjectData() ([#2094]) 69* Possible deadlock with CFG_WITH_PAGER=y when loading a TA and not enough 70page tables are available in pgt_cache ([#2080]) 71 72## Tested on 73 74The release was tested successfully on the platforms listed below. 75 76<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 77* d02 78* hikey 79* hikey-hikey960 80* imx-mx6ulevk 81* imx-mx7dsabresd 82* marvell-armada7k8k 83* marvell-armada3700 84* mediatek-mt8173 85* rcar-salvator_m3 86* rockchip-rk322x 87* rpi3 88* sam 89* ti 90* vexpress-juno 91* vexpress-qemu_armv8a 92* vexpress-qemu_virt 93 94[commit_0e1c6e8e]: https://github.com/OP-TEE/optee_os/commit/0e1c6e8e 95[github_commits_3_0_0]: https://github.com/OP-TEE/optee_os/compare/2.6.0...3.0.0 96[#2092]: https://github.com/OP-TEE/optee_os/pull/2092 97[#2086]: https://github.com/OP-TEE/optee_os/pull/2086 98[#2094]: https://github.com/OP-TEE/optee_os/issues/2094 99[#2080]: https://github.com/OP-TEE/optee_os/issues/2080 100[#2052]: https://github.com/OP-TEE/optee_os/pull/2052 101[#2035]: https://github.com/OP-TEE/optee_os/pull/2035 102[#2011]: https://github.com/OP-TEE/optee_os/pull/2011 103[#1999]: https://github.com/OP-TEE/optee_os/pull/1999 104[#1994]: https://github.com/OP-TEE/optee_os/pull/1994 105[#1993]: https://github.com/OP-TEE/optee_os/pull/1993 106[#1974]: https://github.com/OP-TEE/optee_os/pull/1974 107[#1970]: https://github.com/OP-TEE/optee_os/pull/1970 108[#1969]: https://github.com/OP-TEE/optee_os/pull/1969 109[#1966]: https://github.com/OP-TEE/optee_os/pull/1966 110[#1963]: https://github.com/OP-TEE/optee_os/pull/1963 111[#1961]: https://github.com/OP-TEE/optee_os/pull/1961 112[#1959]: https://github.com/OP-TEE/optee_os/pull/1959 113[#1949]: https://github.com/OP-TEE/optee_os/pull/1949 114[#1946]: https://github.com/OP-TEE/optee_os/pull/1946 115[#1941]: https://github.com/OP-TEE/optee_os/pull/1941 116[#1931]: https://github.com/OP-TEE/optee_os/pull/1931 117[#1928]: https://github.com/OP-TEE/optee_os/pull/1928 118[#1923]: https://github.com/OP-TEE/optee_os/pull/1923 119[#1922]: https://github.com/OP-TEE/optee_os/pull/1922 120[#1921]: https://github.com/OP-TEE/optee_os/pull/1921 121[#1919]: https://github.com/OP-TEE/optee_os/pull/1919 122[#1916]: https://github.com/OP-TEE/optee_os/pull/1916 123[#1915]: https://github.com/OP-TEE/optee_os/pull/1915 124[#1897]: https://github.com/OP-TEE/optee_os/pull/1897 125[#1856]: https://github.com/OP-TEE/optee_os/pull/1856 126[#1826]: https://github.com/OP-TEE/optee_os/pull/1826 127 128# OP-TEE - version 2.6.0 129 130[Link][github_commits_2_6_0] to a list of all commits between this release and 131the previous one (2.5.0). 132 133## New features 134 135* New supported platforms: Atmel SAMA5 ([#1714]), HiSilicon HiKey960 ([#1684]), 136 Rockchip RK322X ([#1666]), NXP LS1043A-RDB/LS1046A-RDB ([#1787]), Marvell 137 Armada 70x0/80x0 ([#1807]). 138* Dynamic shared memory (non-contiguous, non-secure memory can be mapped into 139 Trusted Applications VA space) ([#1631]) 140* Dump TA call stack on panic ([#1858]) 141* i.MX: PSCI reset ([#1849]) 142* plat-ti: AM43xx: suspend/resume support ([#1822]) 143* QEMU SMP support ([#1820]) 144* plat-ti: AM43xx: disable TRNG ([#1816]) 145* plat-ti: enable Secure Data Path by default ([#1815]) 146* Improve symbolize.py ([#1778], [#1767], [#1766]) 147* Early TAs (TAs linked in tee.bin) ([#1733]) 148* Suspend/resume framework for arm32 and imx7d support ([#1729]) 149* RK322X PSCI version, features and suspend support ([#1720]) 150* arm32: handle aborts in system mode ([#1703]) 151* i.MX: add SNVS SRTC support ([#1700]) 152* GCC7 support ([#1693]) 153* Improve detection of programming errors in locking code ([#1671], [#1670]) 154* Support TEE RAM size larger than page directory size ([#1669]) 155 156## Removed features 157 158* Remove TUI code ([#1842]) 159 160## Bug fixes 161 162* Add missing synchronization barrier in core_mmu_map_pages() ([#1827]) 163* Secure storage: REE FS: fix bug in error path ([#1801]) 164* ASAN bug fixes ([#1799]) 165* Fix race in core_mmu_user_mapping_is_active() ([#1785]) 166* libutee: printf() and puts() fixes, add putchar() ([#1759], [#1754]) 167* arm32: GICv3: fix FIQ masking in IRQ/ABT/SVC/UND handlers ([#1748]) 168* arm32: preserve r12 in native_intr_handler() ([#1682]) 169* arm64: fix print_kernel_stack() ([#1664]) 170* benchmark: fix core data-abort ([#1658]) 171 172## Security fixes or enhancements 173 174* crypto: fix software PRNG weaknesses 175 ([OP-TEE-2017-0001][OP-TEE-2017-0001]) ([#1843]) 176 177## Tested on 178 179The release was tested successfully on the platforms listed below. 180If a platform is not listed, it means the release was not tested on this 181platform. 182 183<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 184* d02 185* hikey 186* hikey-hikey960 187* imx-mx6ulevk 188* imx-mx7dsabresd 189* ls-ls1021a??? (single core) 190* ls-ls1043ardb 191* ls-ls1046ardb 192* mediatek-mt8173 193* rcar 194* rockchip-rk322x 195* rpi3 196* sam 197* stm-b2260 198* stm-cannes 199* ti-??? 200* vexpress-fvp 201* vexpress-juno 202* vexpress-qemu_armv8a 203* vexpress-qemu_virt 204 205[github_commits_2_6_0]: https://github.com/OP-TEE/optee_os/compare/2.5.0...2.6.0 206[#1858]: https://github.com/OP-TEE/optee_os/issues/1858 207[#1849]: https://github.com/OP-TEE/optee_os/issues/1849 208[#1843]: https://github.com/OP-TEE/optee_os/issues/1843 209[#1842]: https://github.com/OP-TEE/optee_os/issues/1842 210[#1827]: https://github.com/OP-TEE/optee_os/issues/1827 211[#1822]: https://github.com/OP-TEE/optee_os/issues/1822 212[#1820]: https://github.com/OP-TEE/optee_os/issues/1820 213[#1816]: https://github.com/OP-TEE/optee_os/issues/1816 214[#1815]: https://github.com/OP-TEE/optee_os/issues/1815 215[#1807]: https://github.com/OP-TEE/optee_os/issues/1807 216[#1801]: https://github.com/OP-TEE/optee_os/issues/1801 217[#1799]: https://github.com/OP-TEE/optee_os/issues/1799 218[#1787]: https://github.com/OP-TEE/optee_os/issues/1787 219[#1785]: https://github.com/OP-TEE/optee_os/issues/1785 220[#1778]: https://github.com/OP-TEE/optee_os/issues/1778 221[#1767]: https://github.com/OP-TEE/optee_os/issues/1767 222[#1766]: https://github.com/OP-TEE/optee_os/issues/1766 223[#1759]: https://github.com/OP-TEE/optee_os/issues/1759 224[#1754]: https://github.com/OP-TEE/optee_os/issues/1754 225[#1748]: https://github.com/OP-TEE/optee_os/issues/1748 226[#1733]: https://github.com/OP-TEE/optee_os/issues/1733 227[#1729]: https://github.com/OP-TEE/optee_os/issues/1729 228[#1720]: https://github.com/OP-TEE/optee_os/issues/1720 229[#1714]: https://github.com/OP-TEE/optee_os/issues/1714 230[#1703]: https://github.com/OP-TEE/optee_os/issues/1703 231[#1700]: https://github.com/OP-TEE/optee_os/issues/1700 232[#1693]: https://github.com/OP-TEE/optee_os/issues/1693 233[#1684]: https://github.com/OP-TEE/optee_os/issues/1684 234[#1682]: https://github.com/OP-TEE/optee_os/issues/1682 235[#1671]: https://github.com/OP-TEE/optee_os/issues/1671 236[#1670]: https://github.com/OP-TEE/optee_os/issues/1670 237[#1669]: https://github.com/OP-TEE/optee_os/issues/1669 238[#1666]: https://github.com/OP-TEE/optee_os/issues/1666 239[#1664]: https://github.com/OP-TEE/optee_os/issues/1664 240[#1658]: https://github.com/OP-TEE/optee_os/issues/1658 241[#1631]: https://github.com/OP-TEE/optee_os/issues/1631 242[OP-TEE-2017-0001]: https://www.op-tee.org/security-advisories/ 243 244# OP-TEE - version 2.5.0 245 246[Link][github_commits_2_5_0] to a list of all commits between this release and 247the previous one (2.4.0). 248 249## New features 250 251* New supported platform: i.MX7D ([#1639]) 252* Secure storage: anti-rollback protection for REE FS using RPMB FS ([#1630]) 253* Assign non-secure DDR configuration from DT if CFG_DT=y ([#1623]) 254* Add new image format: split image into three separate binaries suitable for 255 upcoming ARM Trusted Firmware ([#1589]). 256* Make alignment check configurable ([#1586]) 257* drivers: add TZC380 driver ([#1578]) 258* plat-imx: PSCI CPU off ([#1577]) 259* 64-bit paging on QEMU v8 and HiKey ([#1575], [#1592]) 260* Benchmark framework ([#1365]) 261* Dump call stack of user TAs on abort ([#1552]) 262* plat-hikey: enable Secure Data Path ([#1440]) 263* Add interface to load and decrypt/authenticate user TAs ([#1513]) 264* plat-ti: add secure paging support ([#1493]) 265* plat-ti: add OTP hardware key support ([#1492]) 266* Support ARM GICv3 ([#1465]) 267 268## Removed features 269 270* stm-orly2 is not supported anymore ([#1650]) 271* Remove secure storage based on SQL FS (`CFG_SQL_FS=y`) ([#1490]) 272* Remove support for mapping user TAs with 1 MiB or 2 MiB granularity 273 (`CFG_SMALL_PAGE_USER_TA=n`) ([#1559]). TAs are always mapped using small 274 pages. 275 276## Bug fixes 277 278* Reduce size of non-pageable code ([#1621]) 279* Ignore `TA_FLAG_MULTI_SESSION` and `TA_FLAG_INSTANCE_KEEP_ALIVE` when 280 `TA_FLAG_SINGLE_INSTANCE` is not set ([#1574]) 281* libutee: remove buffering for AES GCM (PR#1573) and AES CTR ([#1580]) 282* Fix ROUNDUP()/ROUNDDOWN() macros ([#1519]) 283* Do not touch other bits in GICD_CTLR ([#1508]) 284* Fix build issue with `DEBUG=y` and `CFG_TEE_CORE_LOG_LEVEL=0` ([#1502]) 285* crypto: do not restrict hash size when algorithm is ECDSA ([#1497]) 286 287## Security fixes or enhancements 288 289- crypto: fix RSA key leakage after fault injection attack 290 ([OP-TEE-2016-0003][OP-TEE-2016-0003]) ([#1610]) 291* crypto: fix RSA key leakage after side channel attack 292 ([OP-TEE-2016-0002][OP-TEE-2016-0002]) ([#1610]) 293* Make pager aliased pages not always writable ([#1551]) 294* Support for no-exec RO and RW data ([#1459], [#1550]) 295 296## New issues 297 298* armv7: some platform-specific code (`plat_cpu_reset_early()`) overwrites 299SCTLR bits configured by generic code. This affects alignment checks (`SCTLR.A`) 300and write-implies-no-exec (`SCTLR.WXN`, `SCTLR.UWXN`), which can therefore not 301be configured via the compile-time `CFG_` variables. 302* armv7: plat-imx: Cortex-A9 cores should enable branch prediction (`SCLTR.Z`) 303for improved performance. 304* [#1656] qemu_armv8a: init hangs when secure data path and pager are both 305 enabled. 306 307## Tested on 308 309In the list below, _standard_ means that the `xtest` program passed with 310its default configuration, while _extended_ means it was run successfully 311with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 312v1.1.0.4. 313 314If a platform is not listed, it means the release was not tested on this 315platform. 316 317<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 318* d02: extended 319* hikey: extended 320* imx-mx6ulevk: standard 321* imx-mx6ullevk: standard 322* imx-mx7dsabresd: standard 323* ls-ls1021atwr: standard 324* mediatek-mt8173: standard 325* rcar-h3: standard 326* rpi3: standard 327* stm-b2260: extended 328* stm-cannes: extended 329* ti-am43xx: standard 330* ti-am57xx: standard 331* ti-dra7xx: standard 332* vexpress-fvp: standard 333* vexpress-juno: standard 334* vexpress-qemu_armv8a: standard 335* vexpress-qemu_virt: standard 336 337[github_commits_2_5_0]: https://github.com/OP-TEE/optee_os/compare/2.4.0...2.5.0-rc1 338[#1656]: https://github.com/OP-TEE/optee_os/issues/1656 339[#1650]: https://github.com/OP-TEE/optee_os/pull/1650 340[#1639]: https://github.com/OP-TEE/optee_os/pull/1639 341[#1630]: https://github.com/OP-TEE/optee_os/pull/1630 342[#1623]: https://github.com/OP-TEE/optee_os/pull/1623 343[#1621]: https://github.com/OP-TEE/optee_os/pull/1621 344[#1610]: https://github.com/OP-TEE/optee_os/pull/1610 345[#1592]: https://github.com/OP-TEE/optee_os/pull/1592 346[#1589]: https://github.com/OP-TEE/optee_os/pull/1589 347[#1586]: https://github.com/OP-TEE/optee_os/pull/1586 348[#1580]: https://github.com/OP-TEE/optee_os/pull/1580 349[#1578]: https://github.com/OP-TEE/optee_os/pull/1578 350[#1577]: https://github.com/OP-TEE/optee_os/pull/1577 351[#1574]: https://github.com/OP-TEE/optee_os/pull/1574 352[#1559]: https://github.com/OP-TEE/optee_os/pull/1559 353[#1551]: https://github.com/OP-TEE/optee_os/pull/1551 354[#1550]: https://github.com/OP-TEE/optee_os/pull/1550 355[#1519]: https://github.com/OP-TEE/optee_os/pull/1519 356[#1502]: https://github.com/OP-TEE/optee_os/pull/1502 357[#1365]: https://github.com/OP-TEE/optee_os/pull/1365 358[#1552]: https://github.com/OP-TEE/optee_os/pull/1552 359[#1513]: https://github.com/OP-TEE/optee_os/pull/1513 360[#1508]: https://github.com/OP-TEE/optee_os/pull/1508 361[#1493]: https://github.com/OP-TEE/optee_os/pull/1493 362[#1497]: https://github.com/OP-TEE/optee_os/pull/1497 363[#1492]: https://github.com/OP-TEE/optee_os/pull/1492 364[#1490]: https://github.com/OP-TEE/optee_os/pull/1490 365[#1465]: https://github.com/OP-TEE/optee_os/pull/1465 366[#1459]: https://github.com/OP-TEE/optee_os/pull/1459 367[#1440]: https://github.com/OP-TEE/optee_os/pull/1440 368[OP-TEE-2016-0003]: https://www.op-tee.org/security-advisories/ 369[OP-TEE-2016-0002]: https://www.op-tee.org/security-advisories/ 370 371# OP-TEE - version 2.4.0 372 373[Link][github_commits_2_4_0] to a list of all commits between this release and 374the previous one (2.3.0). 375 376Please note: this release is API-compatible with the previous one, but the 377Secure Storage internal format for the REE and SQL FS is not compatible due to 378commits [a238b74][commit_a238b74] ("core: REE FS: use the new hash tree 379interface") and [44e900e][commit_44e900e] ("core: SQL FS: use the new hash tree 380interface"). 381 382## New features 383 384* Add porting guidelines 385 386* Add support for Secure Data Path which allows Client and Trusted Applications 387 to share references to secure memory 388 389* New supported platform: Texas Instruments AM57xx (`PLATFORM=ti-am57xx`) 390 391* ARMv7-A: add support for platform services in secure monitor and add these 392 services for the DRA7xx platform 393 394* SPI framework and PL022 driver cleanup and improvements 395 396* Use CNTPCT (when available) to add entropy to the software PRNG 397 398* Add GlobalPlatform Socket API for UDP and TCP (IPv4 and IPv6) 399 400* DRA7: add TRNG driver, enable GICv2 driver 401 402* Support load address larger than 4G 403 404* libutee: preserve error code when calling TEE_Panic() for easier 405 troubleshooting 406 407* Support TA profiling with gprof (-pg compiler switch) 408 409* Optimize the ELF loader for TAs when pager is enabled 410 411* Update documentation 412 413* Add paged secure shared memory that can be transferred between TAs as 414 needed 415 416* Introduce MOBJ abstraction 417 418* i.MX6: add PSCI "on" function 419 420* arm32: introduce PSCI framework 421 422## Bug fixes 423 424* Secure storage: improve integrity checking of the REE and SQL filesystems by 425 adding a hash tree on the internal data structures. Any external modification 426 is detected, except full rollback. Fixes [#1188][issue1188]. 427 428* The linux driver will set the 'privileged' flag (TEE_GEN_CAP_PRIVILEGED) on 429 the device intended for use by tee-supplicant. Fixes [#1199][issue1199]. 430 431* RPMB: don't try to program the RPMB key by default 432 433* Fix "make clean" error cases 434 435* Fix issue when resetting persistent storage enumerator [#1332][issue1332] 436 437* Fix TA panic when doing AES CTS with specific buffer sizes 438 [#1203][issue1203]. 439 440## Known issues 441 442* On RPi3 xtest sometimes stall (rcu_sched self-detected stall on CPU) [#1353][issue1353] 443* For multi-core PSCI support is to be added for ls1021atwr in OP-TEE. 444* USB keyboard cannot be used to stop the u-boot timeout ([build issue131]). 445* Travis service (build.git) seems unstable from time to time. 446 447## Tested on 448 449In the list below, _standard_ means that the `xtest` program passed with 450its default configuration, while _extended_ means it was run successfully 451with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 452v1.1.0.4. 453 454If a platform is not listed, it means the release was not tested on this 455platform. 456 457<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 458* d02: extended 459* hikey: extended 460* imx-mx6ulevk: standard 461* ls-ls1021atwr: standard (single core) 462* mediatek-mt8173: standard 463* rcar-h3: standard 464* rpi3: standard 465* stm-b2260: extended 466* ti-dra7xx: standard 467* vexpress-fvp: standard 468* vexpress-juno: standard 469* vexpress-qemu_armv8a: standard 470* vexpress-qemu_virt: standard 471* zynqmp-zc1751_dc1: standard 472* zynqmp-zc1751_dc2: standard 473* zynqmp-zcu102: standard 474 475[github_commits_2_4_0]: https://github.com/OP-TEE/optee_os/compare/2.3.0...2.4.0 476[issue1332]: https://github.com/OP-TEE/optee_os/issues/1332 477[issue1353]: https://github.com/OP-TEE/optee_os/issues/1353 478[build issue131]: https://github.com/OP-TEE/build/issues/131 479[commit_a238b74]: https://github.com/OP-TEE/optee_os/commit/a238b744b1b3 480[commit_44e900e]: https://github.com/OP-TEE/optee_os/commit/44e900eabfc1 481 482# OP-TEE - version 2.3.0 483 484[Link][github_commits_2_3_0] to a list of all commits between this release and 485the previous one (2.2.0). 486 487Please note: this release is API-compatible with the previous one, but the 488Secure Storage internal format for the REE FS is not compatible due to commit 489[361fb3e][commit_361fb3e] ("core: REE FS: use a single file per object"). 490 491[commit_361fb3e]: https://github.com/OP-TEE/optee_os/commit/361fb3e 492 493## New features 494 495* New supported platform: Xilinx Zynq 7000 ZC702 (`PLATFORM=zynq7k-zc702`) 496 497* Add debug assertions to spinlocks and mutexes 498 499* Add more CP15 register access macros for Cortex-A9 500 501* ARMv7-A: redesign secure monitor to make it easier to register services 502 503* ARMv7-A: cleanup boot arguments 504 505* libutee: extend `TEE_CheckMemoryAccessRights()` with 506 `TEE_MEMORY_ACCESS_SECURE` and `TEE_MEMORY_ACCESS_NONSECURE` 507 508* plat-hikey: enable SPI by default and add sample test code 509 510* Consider `CFLAGS_ta_arm64` and `CFLAGS_ta_arm32` when building TAs 511 512* Secure storage refactoring 513 - Simplify interface with tee-supplicant. Minimize round trips with normal 514 world, especially by adding a cache for FS RPC payload data. 515 - REE FS: use a single file per object, remove block cache. 516 517* Print call stack in panic() 518 519## Bug fixes 520 521* Fix UUID encoding when communicating with normal world (use big endian 522 mode instead of native endianness). Related to this, the string format 523 for UUIDs has changed in tee-supplicant, so that TA file names now follow 524 the format defined in RFC4122 (a missing hyphen was added). The old format 525 is still supported, but deprecated, and will likely be removed with the 526 next major release. 527 528* Drop write permission to non-writable ELF segments after TA loading is 529 complete. 530 531* mm: fix confusing memory mapping debug traces 532 533* plat-ti: fix issues with MMU mapping 534 535* crypto: fix clearing of big numbers 536 537* build: allow spaces and double quotes in CFG_ variables 538 539* mm: use paddr_t to support both 32- and 64-bit architectures properly. 540 Resolves 32-bit truncation error when pool is at top of 32 bit address 541 space on 64-bit architecture. 542 543* plat-stm: support pager. Fix pager on ARMv7-A SMP boards. 544 545* Fix debug output of Trusted Applications (remove "ERROR: TEE-CORE:" prefix) 546 547* Do not consider TA memref parameters as TA private memory 548 549* crypto: fix `cipher_final()` which would not call `cbc_done()` for CBC_MAC 550 algorithms 551 552* fix for 16-way PL310 553 554* arm32: fix call stack unwinding (`print_stack()`) 555 556* arm32: fix spinlock assembly code 557 558* plat-stm, plat-imx: fix SCR initalization 559 560* Fix user L1 MMU entries calculation (non-LPAE), allowing TTBCR.N values 561 other than 7. 562 563* mtk-mt8173: fix panic caused by incorrect size of SHMEM 564 565* plat-stm: fix RNG driver (non-flat mapping) 566 567## Known issues 568 569* New issues open on GitHub 570 * [#1203][issue1203] AES-CTS mode will fail when inlen=0x100, in_incr=0x80 571 * [#1199][issue1199] Both tee and teepriv reported GlobalPlatform compliant 572 * [#1188][issue1188] Secure storage (SQL FS and REE FS): blocks not tied to 573 current meta header 574 * [#1172][issue1172] paddr_t should be larger than 32 bits when 575 CFG_WITH_LPAE is enabled 576 577## Tested on 578 579In the list below, _standard_ means that the `xtest` program passed with 580its default configuration, while _extended_ means it was run successfully 581with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 582v1.1.0.4. 583 584If a platform is not listed, it means the release was not tested on this 585platform. 586 587<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 588* d02: extended 589* hikey: extended 590* imx-mx6ulevk: standard 591* ls-ls1021atwr: standard 592* mediatek-mt8173: standard 593* rcar-h3: standard 594* rpi3: standard 595* stm-b2260: extended 596* stm-cannes: extended 597* ti-dra7xx: standard 598* vexpress-fvp: standard 599* vexpress-juno: standard 600* vexpress-qemu_armv8a: standard 601* vexpress-qemu_virt: extended 602* zynqmp-zcu102: standard 603 604[github_commits_2_3_0]: https://github.com/OP-TEE/optee_os/compare/2.2.0...2.3.0 605[issue1172]: https://github.com/OP-TEE/optee_os/issues/1172 606[issue1188]: https://github.com/OP-TEE/optee_os/issues/1188 607[issue1199]: https://github.com/OP-TEE/optee_os/issues/1199 608[issue1203]: https://github.com/OP-TEE/optee_os/issues/1203 609 610# OP-TEE - version 2.2.0 611 612[Link][github_commits_2_2_0] to a list of all commits between this release and 613the previous one (2.1.0). 614 615Please note: this release is API-compatible with the previous one, but the 616Secure Storage internal format is not compatible due to commit 617[fde4a75][commit_fde4a75] ("storage: encrypt the FEK with a TA-specific key"). 618 619[commit_fde4a75]: https://github.com/OP-TEE/optee_os/commit/fde4a75 620 621## New features 622 623* New supported platforms: 624 * Freescale i.MX6 Quad SABRE Lite & SD 625 * HiSilicon D02 626 * Raspberry Pi3 627 * Renesas RCAR H3 628 * STMicroelectronics b2260 - h410 629 630* Pager: Support paging of read/write pages by encrypting them with AES-GCM. 631 Support paging of user TAs. Add global setting for TZSRAM size 632 (CFG_CORE_TZSRAM_EMUL_SIZE), defaults to 300K. 633 634* Support for more than 8 CPU cores 635 636* Added SPI framework and PL022 driver 637 638* GPIO: framework supports multiple instances, PL061 driver now has get/set 639 interrupt and mode control functions 640 641* Secure storage: Encrypt the File Encryption Key with a TA-specific key for 642 better TA isolation. Add build-time and run-time support for multiple storage 643 backends. Add SQLite backend. 644 645* Trusted User Interface: some code is introduced to support the implementation 646 of TUI. This includes: a generic framebuffer driver, display and serial 647 abstractions, and drivers for PL111 (LCD) / PL050 (KMI) / TZC400 and PS2 648 mouse. 649 650* AES acceleration using ARMv8-A Cryptographic Extensions instructions is 651 now supported in AArch32 mode 652 653* Add support for GCC flags: -fsanitize=undefined and -fsanitize=kernel-address 654 655* Use a global setting for core heap size (CFG_CORE_HEAP_SIZE), 64K by default. 656 657* Add macros to unwind and print the call stack of TEE core 658 659* Libtomcrypt: sync with the latest `develop` branch. 660 661* The Trusted Application SDK (ta_dev_kit.mk) can produce libraries (.a) 662 663* Rework assertions and TEE core panics and properly honor NDEBUG 664 665## Bug fixes 666 667* Fix incorrect algorithm passed to cipher.final() 668 669* scripts: support Python 2.x and 3.x 670 671* Secure storage: Add proper locking to support concurrent access. Fix sign 672 extension bug with offset parameter of syscall storage_obj_seek which could 673 cause errors in Aarch32 mode. Fix reading beyond end of file. 674 675* Aarch64: mask all maskable exceptions before doing a normal return from call. 676 677* Device Tree: add no-map property to OP-TEE node in reserved-memory. 678 679* LibTomcrypt: fix CVE-2016-6129 680 681## Known issues 682 683* New issues open on GitHub 684 * [#1093][issue1093] rcar-h3: xtest 6010 hangs 685 * [#1092][issue1092] rcar-h3: xtest 4010 fails 686 * [#1081][issue1081] Bad mapping of TA secure memref parameters 687 * [#1071][issue1071] __data_end may not correctly represent text start position when using CFG_WITH_PAGER 688 * [#1069][issue1069] armv7/Aarch32: crash in stack unwind (DPRINT_STACK()) 689 690## Tested on 691 692In the list below, _standard_ means that the `xtest` program passed with 693its default configuration, while _extended_ means it was run successfully 694with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 695v1.1.0.4. 696 697If a platform is not listed, it means the release was not tested on this 698platform. 699 700<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 701* d02: extended 702* hikey: extended 703* imx-mx6qsabrelite: standard 704* imx-mx6qsabresd: standard 705* rcar-h3: standard, pass except issues [#1092][issue1092] and [#1093][issue1093] 706* rpi3: standard 707* stm-b2260: standard 708* stm-cannes: standard 709* ti-dra7xx: standard 710* vexpress-fvp: standard 711* vexpress-juno: standard 712* vexpress-qemu_armv8a: standard 713* vexpress-qemu_virt: extended 714* zynqmp-zcu102: standard 715 716[github_commits_2_2_0]: https://github.com/OP-TEE/optee_os/compare/2.1.0...2.2.0 717[issue1081]: https://github.com/OP-TEE/optee_os/issues/1081 718[issue1071]: https://github.com/OP-TEE/optee_os/issues/1071 719[issue1069]: https://github.com/OP-TEE/optee_os/issues/1069 720[issue1092]: https://github.com/OP-TEE/optee_os/issues/1092 721[issue1093]: https://github.com/OP-TEE/optee_os/issues/1093 722 723# OP-TEE - version 2.1.0 724 725## New features 726 727* New supported platforms: 728 * Xilinx Zynq UltraScale+ MPSOC 729 * Spreadtrum SC9860 730 731* GCC5 support 732 733* Non Linear Mapping support: In OP-TEE kernel mode, the physical to virtual 734 addresses was linear until this release, meaning the virtual addresses 735 were equal to the physical addresses. This is no more the case in this 736 release. 737 738* Font rendering routines have been introduced in order to ease an 739 implementation of Trusted UI. 740 741* File Storage: Possibility to use the normal world filesystem and the RPMB 742 implementations simultaneously. 743 744* AOSP: There is a [local manifest][aosp_local_manifest] to build OP-TEE into an AOSP build, running on HiKey. 745 Please refer to the README in that repo for instructions. 746 747* OpenEmbedded: In addition to the makefile-based build described in the optee_os README, there is an 748 [OpenEmbedded-based build][oe_build] that supports Qemu (32-bit), FVP (64-bit), and HiKey (64-bit). 749 Please refer to the README in that repo for instructions. 750 751* [Link][github_commits_2_1_0] to a list of all commits between this and 752 previous release. 753 754 755## Tested on 756Definitions: 757 758| Type | Meaning | 759| ---- | ------- | 760| Standard tests | The [optee_test][optee_test] project. | 761| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 762 763* ARM Juno Board (vexpress-juno), standard. 764* Foundation Models (vexpress-fvp), standard tests + extended tests, 765 using FVP ARM V8 Foundation Platformr0p0 (platform build 10.0.37) 766* FSL i.MX6 UltraLite EVK (imx), standard. 767* FSL ls1021a (ls-ls1021atwr), standard tests. 768* HiKey (hikey), standard + extended tests. 769* QEMU (vexpress-qemu), standard + extended tests. 770* Xilinx Zynq UltraScale+ MPSOC, standard tests 771 772Note that the following platform has not been tested: 773* MTK8173-EVB (mediatek-mt8173) 774 775 776## Known issues 777* Issue(s) open on GitHub 778 * [#868][pr868]: python-wand font generation sometimes times out 779 * [#863][pr863]: "double free or corruption" error when building optee_os 780 * [#858][pr858]: UUIDs in binary format have wrong endinanness 781 * [#857][pr857]: Formatting of UUIDs is incorrect 782 * [#847][pr847]: optee_os panic(TEE-CORE: Assertion) 783 * [#838][pr838]: TUI font rendering is _very_ slow 784 * [#814][pr814]: Persistent objects : save informations after close 785 * [#665][pr665]: xtest 1013 stalled on HiKey when log levels are 4 and optee_os is on its own UART 786 * [#506][pr506]: tee-supplicant panic & ta panic 787 788[github_commits_2_1_0]: https://github.com/OP-TEE/optee_os/compare/2.0.0...2.1.0 789[pr868]: https://github.com/OP-TEE/optee_os/issues/868 790[pr863]: https://github.com/OP-TEE/optee_os/issues/863 791[pr858]: https://github.com/OP-TEE/optee_os/issues/858 792[pr857]: https://github.com/OP-TEE/optee_os/issues/857 793[pr847]: https://github.com/OP-TEE/optee_os/issues/847 794[pr838]: https://github.com/OP-TEE/optee_os/issues/838 795[pr814]: https://github.com/OP-TEE/optee_os/issues/814 796[pr665]: https://github.com/OP-TEE/optee_os/issues/665 797[aosp_local_manifest]: https://github.com/linaro-swg/optee_android_manifest 798[oe_build]: https://github.com/linaro-swg/oe-optee 799 800# OP-TEE - version 2.0.0 801 802## New features 803 804* Generic driver: A new generic TEE driver is in the process of being 805 [upstreamed][gendrv_v9]. 806 In this release, [OP-TEE/optee_linuxdriver][optee_linuxdriver] is no more used. 807 Instead, linux v4.5 is being patched using the proposed Generic TEE Driver, 808 as it can be found in [https://github.com/linaro-swg/linux/tree/optee][linux_optee] 809 810* RPMB support: Secure Storage can now use Replay Protected Memory Block (RPMB) partition 811 of an eMMC device. Check the [full documentation][rpmb_doc] 812 813* Hard-float ABI is now available. 814 815* [Link][github_commits_2_0_0] to a list of all commits between this and 816 previous release. 817 818 819## Tested on 820Definitions: 821 822| Type | Meaning | 823| ---- | ------- | 824| Standard tests | The [optee_test][optee_test] project. | 825| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 826 827* ARM Juno Board (vexpress-juno), standard. 828* Foundation Models (vexpress-fvp), standard tests + extended tests, 829 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 830* FSL ls1021a (ls-ls1021atwr), standard. 831* HiKey (hikey), standard. 832* MTK8173-EVB (mediatek-mt8173), standard. 833* QEMU (vexpress-qemu), standard + extended tests. 834* STM Cannes (stm-cannes), standard + extended tests. 835 836## Known issues 837* Issue(s) open on GitHub 838 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 839 * [#506][pr506]: tee-supplicant panic & ta panic 840 841[github_commits_2_0_0]: https://github.com/OP-TEE/optee_os/compare/1.1.0...2.0.0 842[rpmb_doc]: https://github.com/OP-TEE/optee_os/blob/master/documentation/secure_storage_rpmb.md 843[optee_linuxdriver]: https://github.com/OP-TEE/optee_linuxdriver 844[gendrv_v9]: https://lkml.org/lkml/2016/4/1/205 845[linux_optee]: https://github.com/linaro-swg/linux/tree/optee 846 847 848# OP-TEE - version 1.1.0 849 850 851## New features 852 853* Softfloat library: floating point support is now available in 32bits TA. 854 855* Support running 64-bits TA: on ARMv8-A platform, TA can be compiled in 856 AArch32 and/or in AArch64 in case the core is compiled in AArch64. 857 An example can be found in HiKey configuration file. Using the following 858 excerpt code, the user TA libraries are compiled in both AArch32 and 859 AArch64, and can be found in `out/arm-plat-hikey/export-ta_arm32` and 860 `out/arm-plat-hikey/export-ta_arm64` 861 862``` 863 ta-targets = ta_arm32 864 ta-targets += ta_arm64 865``` 866 867* Concurrent TA support: multiple TA can run in parallel on 868 several cores. 869 870* New tests added in xtest test suite: concurrent TA (xtest 1013), 871 floating point tests (xtest 1006 and os_test TA) and corruption 872 file storage (xtest 20000) 873 874* [Link][github_commits_1_1_0] to a list of all commits between this and 875 previous release. 876 877 878## Tested on 879Definitions: 880 881| Type | Meaning | 882| ---- | ------- | 883| Standard tests | The [optee_test][optee_test] project. | 884| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 885| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 886 887* Foundation Models (vexpress-fvp), standard tests + extended tests, 888 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 889* HiKey (hikey), standard + extended tests. 890* MT8173 (mediatek), standard tests. 891* QEMU (vexpress-qemu), standard + extended tests. 892* STM Cannes (stm-cannes), standard + extended tests. 893 894## Known issues 895* Secure Storage is implemented, but note that anti-rollback protection 896 is not implemented yet. 897 898* Issue(s) open on GitHub 899 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 900 * [#296][pr296]: Connecting RPMB to the storage APIs. 901 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 902 * [#506][pr506]: tee-supplicant panic & ta panic 903 904[prld40]: https://github.com/OP-TEE/optee_linuxdriver/issues/40 905[pr506]: https://github.com/OP-TEE/optee_os/issues/506 906[github_commits_1_1_0]: https://github.com/OP-TEE/optee_os/compare/1.0.1...1.1.0 907 908 909 910# OP-TEE - version 1.0.0 911 912OP-TEE is now maintained by Linaro. Contributors do not need to 913sign a CLA anymore, but must follow the rules of the [DCO][DCO] 914(Developer Certificate of Origin) instead. 915 916 917## New features 918 919* Add hardware support for Texas Instruments DRA7xx, ARMv7 (plat-ti) 920 921* GlobalPlatform™ TEE Internal Core API Specification v1.1, 922 including ECC algorithms. 923 924* Secure Storage: Files stored by the REE are now encrypted. Operations 925 are made atomic in order to prevent inconsistencies in case of errors 926 during the storage operations. [Slides][LCStorage] describing the 927 Secure Storage have been presented at the Linaro Connect SFO15. 928 929* Change of format of the Trusted Applications: they follow a 930 [signed ELF format][elf] 931 932* Rework thread [synchronization][synchro] in optee_os. 933 934* Use of ARMv8 native cryptographic support. 935 936* [OP-TEE/optee_test][optee_test] test suite is released. 937 938* Introduce [OP-TEE/manifest][manifest] and [OP-TEE/build][build] 939 to setup and build QEMU, FVP, HiKey and Mediatek platforms. Setup scripts 940 that used to be in optee_os have been removed, except for Juno board. 941 942* [Link][github_commits_1_0_0] to a list of all commits between this and 943 previous release. 944 945 946## Tested on 947Definitions: 948 949| Type | Meaning | 950| ---- | ------- | 951| Standard tests | The [optee_test][optee_test] project. | 952| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 953| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 954 955* ARM Juno Board (vexpress-juno), standard + extended tests. 956* Foundation Models (vexpress-fvp), standard tests. 957* HiKey (hikey), standard + extended tests. 958* MT8173 (mediatek), standard tests. 959* QEMU (vexpress-qemu), standard + extended tests. 960* STM Cannes (stm-cannes), standard + extended tests. 961 962## Known issues 963* Secure Storage is implemented, but note that anti-rollback protection 964 is not implemented yet. 965 966* Issue(s) open on GitHub 967 * [#210][pr210]: libteec.so 32-bit does not communicate well 968 with 64-bit kernel module 969 * [#296][pr296]: Connecting RPMB to the storage APIs. 970 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 971 * [#494][pr494]: HiKey: xtest 7671 fails (1.0.0-rc2) 972 973[pr210]: https://github.com/OP-TEE/optee_os/issues/210 974[pr296]: https://github.com/OP-TEE/optee_os/issues/296 975[pr493]: https://github.com/OP-TEE/optee_os/issues/493 976[pr494]: https://github.com/OP-TEE/optee_os/issues/494 977[github_commits_1_0_0]: https://github.com/OP-TEE/optee_os/compare/0.3.0...1.0.0 978[DCO]: https://github.com/OP-TEE/optee_os/blob/master/Notice.md#contributions 979[LCStorage]: http://www.slideshare.net/linaroorg/sfo15503-secure-storage-in-optee 980[synchro]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#4-thread-handling 981[elf]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#format 982[optee_test]: https://github.com/OP-TEE/optee_test 983[manifest]: https://github.com/OP-TEE/manifest 984[build]: https://github.com/OP-TEE/build 985 986 987 988# OP-TEE - version 0.3.0 989 990## New features 991 992* Add hardware support for 993 * Mediatek MT8173 Board, ARMv8-A (plat-mediatek) 994 * Hisilicon HiKey Board, ARMv8-A (plat-hikey) 995* AArch64 build of optee_os is now possible through the configuration `CFG_ARM64_core=y` 996* Secure Storage: Data can be encrypted prior to their storage in the non-secure. 997 Build is configured using `CFG_ENC_FS=y` 998* A generic boot scheme can be used. Boot configuration is commonalized. This helps 999 new board support. It is applied on plat-hikey, plat-vexpress, plat-mediatek, plat-stm 1000 and plat-vexpress. 1001 1002## Tested on 1003Definitions: 1004 1005| Type | Meaning | 1006| ---- | ------- | 1007| Standard tests | The optee_test project. | 1008| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1009| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1010 1011* ARM Juno Board (vexpress-juno), standard tests. 1012* Foundation Models (vexpress-fvp), standard tests. 1013* HiKey (hikey), standard tests. 1014* MT8173 (mediatek), standard tests. 1015* QEMU (vexpress-qemu), standard + extended tests. 1016* STM Cannes (stm-cannes), standard + extended tests. 1017 1018------------------------------------------- 1019 1020# OP-TEE - version 0.2.0 1021 1022## New features 1023 1024### Linux Driver Refactoring 1025 1026Linux Driver has been refactored. It is now split in two parts: 1027* optee.ko, the generic Linux driver. It contains all functionality 1028 common to all backends. 1029* optee_armtz.ko, a specific backend dedicated to the TrustZone optee. 1030 It depends on optee.ko. 1031 1032Loading the TrustZone optee linux driver module is now performed using 1033 1034 modprobe optee_armtz 1035 1036Thanks to the dependency between the generic and the backend modules, optee.ko is then automatically loaded. 1037 1038### Misc new features 1039* support PL310 lock down at TEE boot 1040* add 64bits support (division / print) 1041 1042## Tested on 1043Definitions: 1044 1045| Type | Meaning | 1046| ---- | ------- | 1047| Standard tests | The optee_test project. | 1048| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1049| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1050 1051* ARM Juno Board (vexpress-juno), standard tests + extended tests. 1052 1053* Foundation Models (vexpress-fvp), standard + extended tests. 1054 1055* QEMU (vexpress-qemu), standard + extended tests. 1056 1057* STM Cannes (stm-cannes), standard + extended tests. 1058 1059 1060## Issues resolved since last release 1061* Fix user TA trace issue, in order each TA is able to select its own trace level 1062 1063 1064------------------------------------------- 1065# OP-TEE - version 0.1.0 1066 1067## New features 1068Below is a summary of the most important features added, but at the end you will 1069find a link that present you all commits between the current and previous 1070release tag. 1071 1072* GlobalPlatform Client API v1.0 support. 1073 1074* GlobalPlatform Internal API v1.0 support. 1075 1076* GlobalPlatform Secure Elements v1.0 support. 1077 1078* Add hardware support for 1079 1080 * Allwinner A80, ARMv7-A. 1081 1082 * ARM Juno Board, ARMv8-A. 1083 1084 * Foundation Models, ARMv8-A. 1085 1086 * Fast Models, ARMv8-A. 1087 1088 * QEMU, ARMv7-A. 1089 1090 * STM Cannes, ARMv7-A. 1091 1092 * STM Orly2, ARMv7-A. 1093 1094* Add LibTomCrypt as the default software cryptographic library. 1095 1096* Add cryptographic abstraction layer in on secure side to ease the use of 1097 other cryptographic software libraries or adding support for hardware 1098 acceleration. 1099 1100* Extended cryptographic API with support for HKDF, Concat KDF and PBKDF2. 1101 1102* SHA-1 and SHA-256 ARMv8-A crypto extension implementation. 1103 1104* Enabled paging support in OP-TEE OS. 1105 1106* Add support for xtest (both standard and extended) in QEMU and FVP setup 1107 scripts. 1108 1109* Add documentation for the OS design, cryptographic abstraction layer, secure 1110 elements design, the build system, GitHub usage, key derivation extensions, 1111 ARM-Trusted Firmware usage within OP-TEE and GlobalPlatform usage within 1112 OP-TEE. 1113 1114* Integrate support for Travis CI. 1115 1116* [Link][github_commits_0_1_0] to a list of all commits between this and 1117 previous release. 1118 1119 1120## Tested on 1121Definitions: 1122 1123| Type | Meaning | 1124| ---- | ------- | 1125| Standard tests | The optee_test project. | 1126| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.0.0. | 1127| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1128 1129* Allwinner A80 (plat-sunxi), hello world test. 1130 1131* ARM Juno Board (vexpress-juno), standard tests. 1132 1133* Foundation Models (plat-vexpress-fvp), standard + extended tests 1134 1135* QEMU (plat-vexpress-qemu), standard + extended tests (and Secure Elements 1136 tested separately). 1137 1138* STM Cannes (plat-stm-cannes), standard + extended tests. 1139 1140 1141## Issues resolved since last release 1142N/A since this is the first release tag on OP-TEE. 1143 1144 1145## Known issues 1146* Storage is implemented, but not "Secure storage", meaning that a client 1147 needs to do encrypt files on their own before storing the files. 1148 1149* Issue(s) open on GitHub 1150 * [#95][pr95]: An error about building the test code of libtomcrypt. 1151 1152 * [#149][pr149]: when testing optee os with arm trusted firmware (I 1153 utilized optee os tee.bin as bl32 image) on juno platform, I got an 1154 error. 1155 1156 * [#161][pr161]: tee_svc_cryp.c lacks accessibility checks on 1157 user-supplied TEE_Attributes. 1158 1159[hello_world]: https://github.com/jenswi-linaro/lcu14_optee_hello_world 1160[github_commits_0_1_0]: https://github.com/OP-TEE/optee_os/compare/b01047730e77127c23a36591643eeb8bb0487d68...999e4a6c0f64d3177fd3d0db234107b6fb860884 1161[pr95]: https://github.com/OP-TEE/optee_os/issues/95 1162[pr149]: https://github.com/OP-TEE/optee_os/issues/149 1163[pr161]: https://github.com/OP-TEE/optee_os/issues/161 1164 1165* Global Platform Device Internal Core API v1.1 1166 * [#230][pr230]: Persistent object corruption support (TEE_ERROR_CORRUPT_OBJECT/_2) 1167 * [#230][pr230]: Persistent object access support (TEE_ERROR_STORAGE_NOT_AVAILABLE/_2) 1168