1# OP-TEE - version 2.5.0 2 3[Link][github_commits_2_5_0] to a list of all commits between this release and 4the previous one (2.4.0). 5 6## New features 7 8* New supported platform: i.MX7D ([#1639]) 9* Secure storage: anti-rollback protection for REE FS using RPMB FS ([#1630]) 10* Assign non-secure DDR configuration from DT if CFG_DT=y ([#1623]) 11* Add new image format: split image into three separate binaries suitable for 12 upcoming ARM Trusted Firmware ([#1589]). 13* Make alignment check configurable ([#1586]) 14* drivers: add TZC380 driver ([#1578]) 15* plat-imx: PSCI CPU off ([#1577]) 16* 64-bit paging on QEMU v8 and HiKey ([#1575], [#1592]) 17* Benchmark framework ([#1365]) 18* Dump call stack of user TAs on abort ([#1552]) 19* plat-hikey: enable Secure Data Path ([#1440]) 20* Add interface to load and decrypt/authenticate user TAs ([#1513]) 21* plat-ti: add secure paging support ([#1493]) 22* plat-ti: add OTP hardware key support ([#1492]) 23* Support ARM GICv3 ([#1465]) 24 25## Removed features 26 27* stm-orly2 is not supported anymore ([#1650]) 28* Remove secure storage based on SQL FS (`CFG_SQL_FS=y`) ([#1490]) 29* Remove support for mapping user TAs with 1 MiB or 2 MiB granularity 30 (`CFG_SMALL_PAGE_USER_TA=n`) ([#1559]). TAs are always mapped using small 31 pages. 32 33## Bug fixes 34 35* Reduce size of non-pageable code ([#1621]) 36* Ignore `TA_FLAG_MULTI_SESSION` and `TA_FLAG_INSTANCE_KEEP_ALIVE` when 37 `TA_FLAG_SINGLE_INSTANCE` is not set ([#1574]) 38* libutee: remove buffering for AES GCM (PR#1573) and AES CTR ([#1580]) 39* Fix ROUNDUP()/ROUNDDOWN() macros ([#1519]) 40* Do not touch other bits in GICD_CTLR ([#1508]) 41* Fix build issue with `DEBUG=y` and `CFG_TEE_CORE_LOG_LEVEL=0` ([#1502]) 42* crypto: do not restrict hash size when algorithm is ECDSA ([#1497]) 43 44## Security fixes or enhancements 45 46- crypto: fix RSA key leakage after fault injection attack 47 ([OP-TEE-2016-0003][OP-TEE-2016-0003]) ([#1610]) 48* crypto: fix RSA key leakage after side channel attack 49 ([OP-TEE-2016-0002][OP-TEE-2016-0002]) ([#1610]) 50* Make pager aliased pages not always writable ([#1551]) 51* Support for no-exec RO and RW data ([#1459], [#1550]) 52 53## New issues 54 55* armv7: some platform-specific code (`plat_cpu_reset_early()`) overwrites 56SCTLR bits configured by generic code. This affects alignment checks (`SCTLR.A`) 57and write-implies-no-exec (`SCTLR.WXN`, `SCTLR.UWXN`), which can therefore not 58be configured via the compile-time `CFG_` variables. 59* armv7: plat-imx: Cortex-A9 cores should enable branch prediction (`SCLTR.Z`) 60for improved performance. 61* [#1656] qemu_armv8a: init hangs when secure data path and pager are both 62 enabled. 63 64## Tested on 65 66In the list below, _standard_ means that the `xtest` program passed with 67its default configuration, while _extended_ means it was run successfully 68with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 69v1.1.0.4. 70 71If a platform is not listed, it means the release was not tested on this 72platform. 73 74<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 75* d02: extended 76* hikey: extended 77* imx-mx6ulevk: standard 78* imx-mx6ullevk: standard 79* imx-mx7dsabresd: standard 80* ls-ls1021atwr: standard 81* mediatek-mt8173: standard 82* rcar-h3: standard 83* rpi3: standard 84* stm-b2260: extended 85* stm-cannes: extended 86* ti-am43xx: standard 87* ti-am57xx: standard 88* ti-dra7xx: standard 89* vexpress-fvp: standard 90* vexpress-juno: standard 91* vexpress-qemu_armv8a: standard 92* vexpress-qemu_virt: standard 93 94[github_commits_2_5_0]: https://github.com/OP-TEE/optee_os/compare/2.4.0...2.5.0-rc1 95[#1656]: https://github.com/OP-TEE/optee_os/issues/1656 96[#1650]: https://github.com/OP-TEE/optee_os/pull/1650 97[#1639]: https://github.com/OP-TEE/optee_os/pull/1639 98[#1630]: https://github.com/OP-TEE/optee_os/pull/1630 99[#1623]: https://github.com/OP-TEE/optee_os/pull/1623 100[#1621]: https://github.com/OP-TEE/optee_os/pull/1621 101[#1610]: https://github.com/OP-TEE/optee_os/pull/1610 102[#1592]: https://github.com/OP-TEE/optee_os/pull/1592 103[#1589]: https://github.com/OP-TEE/optee_os/pull/1589 104[#1586]: https://github.com/OP-TEE/optee_os/pull/1586 105[#1580]: https://github.com/OP-TEE/optee_os/pull/1580 106[#1578]: https://github.com/OP-TEE/optee_os/pull/1578 107[#1577]: https://github.com/OP-TEE/optee_os/pull/1577 108[#1574]: https://github.com/OP-TEE/optee_os/pull/1574 109[#1559]: https://github.com/OP-TEE/optee_os/pull/1559 110[#1551]: https://github.com/OP-TEE/optee_os/pull/1551 111[#1550]: https://github.com/OP-TEE/optee_os/pull/1550 112[#1519]: https://github.com/OP-TEE/optee_os/pull/1519 113[#1502]: https://github.com/OP-TEE/optee_os/pull/1502 114[#1365]: https://github.com/OP-TEE/optee_os/pull/1365 115[#1552]: https://github.com/OP-TEE/optee_os/pull/1552 116[#1513]: https://github.com/OP-TEE/optee_os/pull/1513 117[#1508]: https://github.com/OP-TEE/optee_os/pull/1508 118[#1493]: https://github.com/OP-TEE/optee_os/pull/1493 119[#1497]: https://github.com/OP-TEE/optee_os/pull/1497 120[#1492]: https://github.com/OP-TEE/optee_os/pull/1492 121[#1490]: https://github.com/OP-TEE/optee_os/pull/1490 122[#1465]: https://github.com/OP-TEE/optee_os/pull/1465 123[#1459]: https://github.com/OP-TEE/optee_os/pull/1459 124[#1440]: https://github.com/OP-TEE/optee_os/pull/1440 125[OP-TEE-2016-0003]: https://www.op-tee.org/security-advisories/ 126[OP-TEE-2016-0002]: https://www.op-tee.org/security-advisories/ 127 128# OP-TEE - version 2.4.0 129 130[Link][github_commits_2_4_0] to a list of all commits between this release and 131the previous one (2.3.0). 132 133Please note: this release is API-compatible with the previous one, but the 134Secure Storage internal format for the REE and SQL FS is not compatible due to 135commits [a238b74][commit_a238b74] ("core: REE FS: use the new hash tree 136interface") and [44e900e][commit_44e900e] ("core: SQL FS: use the new hash tree 137interface"). 138 139## New features 140 141* Add porting guidelines 142 143* Add support for Secure Data Path which allows Client and Trusted Applications 144 to share references to secure memory 145 146* New supported platform: Texas Instruments AM57xx (`PLATFORM=ti-am57xx`) 147 148* ARMv7-A: add support for platform services in secure monitor and add these 149 services for the DRA7xx platform 150 151* SPI framework and PL022 driver cleanup and improvements 152 153* Use CNTPCT (when available) to add entropy to the software PRNG 154 155* Add GlobalPlatform Socket API for UDP and TCP (IPv4 and IPv6) 156 157* DRA7: add TRNG driver, enable GICv2 driver 158 159* Support load address larger than 4G 160 161* libutee: preserve error code when calling TEE_Panic() for easier 162 troubleshooting 163 164* Support TA profiling with gprof (-pg compiler switch) 165 166* Optimize the ELF loader for TAs when pager is enabled 167 168* Update documentation 169 170* Add paged secure shared memory that can be transferred between TAs as 171 needed 172 173* Introduce MOBJ abstraction 174 175* i.MX6: add PSCI "on" function 176 177* arm32: introduce PSCI framework 178 179## Bug fixes 180 181* Secure storage: improve integrity checking of the REE and SQL filesystems by 182 adding a hash tree on the internal data structures. Any external modification 183 is detected, except full rollback. Fixes [#1188][issue1188]. 184 185* The linux driver will set the 'privileged' flag (TEE_GEN_CAP_PRIVILEGED) on 186 the device intended for use by tee-supplicant. Fixes [#1199][issue1199]. 187 188* RPMB: don't try to program the RPMB key by default 189 190* Fix "make clean" error cases 191 192* Fix issue when resetting persistent storage enumerator [#1332][issue1332] 193 194* Fix TA panic when doing AES CTS with specific buffer sizes 195 [#1203][issue1203]. 196 197## Known issues 198 199* On RPi3 xtest sometimes stall (rcu_sched self-detected stall on CPU) [#1353][issue1353] 200* For multi-core PSCI support is to be added for ls1021atwr in OP-TEE. 201* USB keyboard cannot be used to stop the u-boot timeout ([build issue131]). 202* Travis service (build.git) seems unstable from time to time. 203 204## Tested on 205 206In the list below, _standard_ means that the `xtest` program passed with 207its default configuration, while _extended_ means it was run successfully 208with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 209v1.1.0.4. 210 211If a platform is not listed, it means the release was not tested on this 212platform. 213 214<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 215* d02: extended 216* hikey: extended 217* imx-mx6ulevk: standard 218* ls-ls1021atwr: standard (single core) 219* mediatek-mt8173: standard 220* rcar-h3: standard 221* rpi3: standard 222* stm-b2260: extended 223* ti-dra7xx: standard 224* vexpress-fvp: standard 225* vexpress-juno: standard 226* vexpress-qemu_armv8a: standard 227* vexpress-qemu_virt: standard 228* zynqmp-zc1751_dc1: standard 229* zynqmp-zc1751_dc2: standard 230* zynqmp-zcu102: standard 231 232[github_commits_2_4_0]: https://github.com/OP-TEE/optee_os/compare/2.3.0...2.4.0 233[issue1332]: https://github.com/OP-TEE/optee_os/issues/1332 234[issue1353]: https://github.com/OP-TEE/optee_os/issues/1353 235[build issue131]: https://github.com/OP-TEE/build/issues/131 236[commit_a238b74]: https://github.com/OP-TEE/optee_os/commit/a238b744b1b3 237[commit_44e900e]: https://github.com/OP-TEE/optee_os/commit/44e900eabfc1 238 239# OP-TEE - version 2.3.0 240 241[Link][github_commits_2_3_0] to a list of all commits between this release and 242the previous one (2.2.0). 243 244Please note: this release is API-compatible with the previous one, but the 245Secure Storage internal format for the REE FS is not compatible due to commit 246[361fb3e][commit_361fb3e] ("core: REE FS: use a single file per object"). 247 248[commit_361fb3e]: https://github.com/OP-TEE/optee_os/commit/361fb3e 249 250## New features 251 252* New supported platform: Xilinx Zynq 7000 ZC702 (`PLATFORM=zynq7k-zc702`) 253 254* Add debug assertions to spinlocks and mutexes 255 256* Add more CP15 register access macros for Cortex-A9 257 258* ARMv7-A: redesign secure monitor to make it easier to register services 259 260* ARMv7-A: cleanup boot arguments 261 262* libutee: extend `TEE_CheckMemoryAccessRights()` with 263 `TEE_MEMORY_ACCESS_SECURE` and `TEE_MEMORY_ACCESS_NONSECURE` 264 265* plat-hikey: enable SPI by default and add sample test code 266 267* Consider `CFLAGS_ta_arm64` and `CFLAGS_ta_arm32` when building TAs 268 269* Secure storage refactoring 270 - Simplify interface with tee-supplicant. Minimize round trips with normal 271 world, especially by adding a cache for FS RPC payload data. 272 - REE FS: use a single file per object, remove block cache. 273 274* Print call stack in panic() 275 276## Bug fixes 277 278* Fix UUID encoding when communicating with normal world (use big endian 279 mode instead of native endianness). Related to this, the string format 280 for UUIDs has changed in tee-supplicant, so that TA file names now follow 281 the format defined in RFC4122 (a missing hyphen was added). The old format 282 is still supported, but deprecated, and will likely be removed with the 283 next major release. 284 285* Drop write permission to non-writable ELF segments after TA loading is 286 complete. 287 288* mm: fix confusing memory mapping debug traces 289 290* plat-ti: fix issues with MMU mapping 291 292* crypto: fix clearing of big numbers 293 294* build: allow spaces and double quotes in CFG_ variables 295 296* mm: use paddr_t to support both 32- and 64-bit architectures properly. 297 Resolves 32-bit truncation error when pool is at top of 32 bit address 298 space on 64-bit architecture. 299 300* plat-stm: support pager. Fix pager on ARMv7-A SMP boards. 301 302* Fix debug output of Trusted Applications (remove "ERROR: TEE-CORE:" prefix) 303 304* Do not consider TA memref parameters as TA private memory 305 306* crypto: fix `cipher_final()` which would not call `cbc_done()` for CBC_MAC 307 algorithms 308 309* fix for 16-way PL310 310 311* arm32: fix call stack unwinding (`print_stack()`) 312 313* arm32: fix spinlock assembly code 314 315* plat-stm, plat-imx: fix SCR initalization 316 317* Fix user L1 MMU entries calculation (non-LPAE), allowing TTBCR.N values 318 other than 7. 319 320* mtk-mt8173: fix panic caused by incorrect size of SHMEM 321 322* plat-stm: fix RNG driver (non-flat mapping) 323 324## Known issues 325 326* New issues open on GitHub 327 * [#1203][issue1203] AES-CTS mode will fail when inlen=0x100, in_incr=0x80 328 * [#1199][issue1199] Both tee and teepriv reported GlobalPlatform compliant 329 * [#1188][issue1188] Secure storage (SQL FS and REE FS): blocks not tied to 330 current meta header 331 * [#1172][issue1172] paddr_t should be larger than 32 bits when 332 CFG_WITH_LPAE is enabled 333 334## Tested on 335 336In the list below, _standard_ means that the `xtest` program passed with 337its default configuration, while _extended_ means it was run successfully 338with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 339v1.1.0.4. 340 341If a platform is not listed, it means the release was not tested on this 342platform. 343 344<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 345* d02: extended 346* hikey: extended 347* imx-mx6ulevk: standard 348* ls-ls1021atwr: standard 349* mediatek-mt8173: standard 350* rcar-h3: standard 351* rpi3: standard 352* stm-b2260: extended 353* stm-cannes: extended 354* ti-dra7xx: standard 355* vexpress-fvp: standard 356* vexpress-juno: standard 357* vexpress-qemu_armv8a: standard 358* vexpress-qemu_virt: extended 359* zynqmp-zcu102: standard 360 361[github_commits_2_3_0]: https://github.com/OP-TEE/optee_os/compare/2.2.0...2.3.0 362[issue1172]: https://github.com/OP-TEE/optee_os/issues/1172 363[issue1188]: https://github.com/OP-TEE/optee_os/issues/1188 364[issue1199]: https://github.com/OP-TEE/optee_os/issues/1199 365[issue1203]: https://github.com/OP-TEE/optee_os/issues/1203 366 367# OP-TEE - version 2.2.0 368 369[Link][github_commits_2_2_0] to a list of all commits between this release and 370the previous one (2.1.0). 371 372Please note: this release is API-compatible with the previous one, but the 373Secure Storage internal format is not compatible due to commit 374[fde4a75][commit_fde4a75] ("storage: encrypt the FEK with a TA-specific key"). 375 376[commit_fde4a75]: https://github.com/OP-TEE/optee_os/commit/fde4a75 377 378## New features 379 380* New supported platforms: 381 * Freescale i.MX6 Quad SABRE Lite & SD 382 * HiSilicon D02 383 * Raspberry Pi3 384 * Renesas RCAR H3 385 * STMicroelectronics b2260 - h410 386 387* Pager: Support paging of read/write pages by encrypting them with AES-GCM. 388 Support paging of user TAs. Add global setting for TZSRAM size 389 (CFG_CORE_TZSRAM_EMUL_SIZE), defaults to 300K. 390 391* Support for more than 8 CPU cores 392 393* Added SPI framework and PL022 driver 394 395* GPIO: framework supports multiple instances, PL061 driver now has get/set 396 interrupt and mode control functions 397 398* Secure storage: Encrypt the File Encryption Key with a TA-specific key for 399 better TA isolation. Add build-time and run-time support for multiple storage 400 backends. Add SQLite backend. 401 402* Trusted User Interface: some code is introduced to support the implementation 403 of TUI. This includes: a generic framebuffer driver, display and serial 404 abstractions, and drivers for PL111 (LCD) / PL050 (KMI) / TZC400 and PS2 405 mouse. 406 407* AES acceleration using ARMv8-A Cryptographic Extensions instructions is 408 now supported in AArch32 mode 409 410* Add support for GCC flags: -fsanitize=undefined and -fsanitize=kernel-address 411 412* Use a global setting for core heap size (CFG_CORE_HEAP_SIZE), 64K by default. 413 414* Add macros to unwind and print the call stack of TEE core 415 416* Libtomcrypt: sync with the latest `develop` branch. 417 418* The Trusted Application SDK (ta_dev_kit.mk) can produce libraries (.a) 419 420* Rework assertions and TEE core panics and properly honor NDEBUG 421 422## Bug fixes 423 424* Fix incorrect algorithm passed to cipher.final() 425 426* scripts: support Python 2.x and 3.x 427 428* Secure storage: Add proper locking to support concurrent access. Fix sign 429 extension bug with offset parameter of syscall storage_obj_seek which could 430 cause errors in Aarch32 mode. Fix reading beyond end of file. 431 432* Aarch64: mask all maskable exceptions before doing a normal return from call. 433 434* Device Tree: add no-map property to OP-TEE node in reserved-memory. 435 436* LibTomcrypt: fix CVE-2016-6129 437 438## Known issues 439 440* New issues open on GitHub 441 * [#1093][issue1093] rcar-h3: xtest 6010 hangs 442 * [#1092][issue1092] rcar-h3: xtest 4010 fails 443 * [#1081][issue1081] Bad mapping of TA secure memref parameters 444 * [#1071][issue1071] __data_end may not correctly represent text start position when using CFG_WITH_PAGER 445 * [#1069][issue1069] armv7/Aarch32: crash in stack unwind (DPRINT_STACK()) 446 447## Tested on 448 449In the list below, _standard_ means that the `xtest` program passed with 450its default configuration, while _extended_ means it was run successfully 451with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 452v1.1.0.4. 453 454If a platform is not listed, it means the release was not tested on this 455platform. 456 457<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 458* d02: extended 459* hikey: extended 460* imx-mx6qsabrelite: standard 461* imx-mx6qsabresd: standard 462* rcar-h3: standard, pass except issues [#1092][issue1092] and [#1093][issue1093] 463* rpi3: standard 464* stm-b2260: standard 465* stm-cannes: standard 466* ti-dra7xx: standard 467* vexpress-fvp: standard 468* vexpress-juno: standard 469* vexpress-qemu_armv8a: standard 470* vexpress-qemu_virt: extended 471* zynqmp-zcu102: standard 472 473[github_commits_2_2_0]: https://github.com/OP-TEE/optee_os/compare/2.1.0...2.2.0 474[issue1081]: https://github.com/OP-TEE/optee_os/issues/1081 475[issue1071]: https://github.com/OP-TEE/optee_os/issues/1071 476[issue1069]: https://github.com/OP-TEE/optee_os/issues/1069 477[issue1092]: https://github.com/OP-TEE/optee_os/issues/1092 478[issue1093]: https://github.com/OP-TEE/optee_os/issues/1093 479 480# OP-TEE - version 2.1.0 481 482## New features 483 484* New supported platforms: 485 * Xilinx Zynq UltraScale+ MPSOC 486 * Spreadtrum SC9860 487 488* GCC5 support 489 490* Non Linear Mapping support: In OP-TEE kernel mode, the physical to virtual 491 addresses was linear until this release, meaning the virtual addresses 492 were equal to the physical addresses. This is no more the case in this 493 release. 494 495* Font rendering routines have been introduced in order to ease an 496 implementation of Trusted UI. 497 498* File Storage: Possibility to use the normal world filesystem and the RPMB 499 implementations simultaneously. 500 501* AOSP: There is a [local manifest][aosp_local_manifest] to build OP-TEE into an AOSP build, running on HiKey. 502 Please refer to the README in that repo for instructions. 503 504* OpenEmbedded: In addition to the makefile-based build described in the optee_os README, there is an 505 [OpenEmbedded-based build][oe_build] that supports Qemu (32-bit), FVP (64-bit), and HiKey (64-bit). 506 Please refer to the README in that repo for instructions. 507 508* [Link][github_commits_2_1_0] to a list of all commits between this and 509 previous release. 510 511 512## Tested on 513Definitions: 514 515| Type | Meaning | 516| ---- | ------- | 517| Standard tests | The [optee_test][optee_test] project. | 518| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 519 520* ARM Juno Board (vexpress-juno), standard. 521* Foundation Models (vexpress-fvp), standard tests + extended tests, 522 using FVP ARM V8 Foundation Platformr0p0 (platform build 10.0.37) 523* FSL i.MX6 UltraLite EVK (imx), standard. 524* FSL ls1021a (ls-ls1021atwr), standard tests. 525* HiKey (hikey), standard + extended tests. 526* QEMU (vexpress-qemu), standard + extended tests. 527* Xilinx Zynq UltraScale+ MPSOC, standard tests 528 529Note that the following platform has not been tested: 530* MTK8173-EVB (mediatek-mt8173) 531 532 533## Known issues 534* Issue(s) open on GitHub 535 * [#868][pr868]: python-wand font generation sometimes times out 536 * [#863][pr863]: "double free or corruption" error when building optee_os 537 * [#858][pr858]: UUIDs in binary format have wrong endinanness 538 * [#857][pr857]: Formatting of UUIDs is incorrect 539 * [#847][pr847]: optee_os panic(TEE-CORE: Assertion) 540 * [#838][pr838]: TUI font rendering is _very_ slow 541 * [#814][pr814]: Persistent objects : save informations after close 542 * [#665][pr665]: xtest 1013 stalled on HiKey when log levels are 4 and optee_os is on its own UART 543 * [#506][pr506]: tee-supplicant panic & ta panic 544 545[github_commits_2_1_0]: https://github.com/OP-TEE/optee_os/compare/2.0.0...2.1.0 546[pr868]: https://github.com/OP-TEE/optee_os/issues/868 547[pr863]: https://github.com/OP-TEE/optee_os/issues/863 548[pr858]: https://github.com/OP-TEE/optee_os/issues/858 549[pr857]: https://github.com/OP-TEE/optee_os/issues/857 550[pr847]: https://github.com/OP-TEE/optee_os/issues/847 551[pr838]: https://github.com/OP-TEE/optee_os/issues/838 552[pr814]: https://github.com/OP-TEE/optee_os/issues/814 553[pr665]: https://github.com/OP-TEE/optee_os/issues/665 554[aosp_local_manifest]: https://github.com/linaro-swg/optee_android_manifest 555[oe_build]: https://github.com/linaro-swg/oe-optee 556 557# OP-TEE - version 2.0.0 558 559## New features 560 561* Generic driver: A new generic TEE driver is in the process of being 562 [upstreamed][gendrv_v9]. 563 In this release, [OP-TEE/optee_linuxdriver][optee_linuxdriver] is no more used. 564 Instead, linux v4.5 is being patched using the proposed Generic TEE Driver, 565 as it can be found in [https://github.com/linaro-swg/linux/tree/optee][linux_optee] 566 567* RPMB support: Secure Storage can now use Replay Protected Memory Block (RPMB) partition 568 of an eMMC device. Check the [full documentation][rpmb_doc] 569 570* Hard-float ABI is now available. 571 572* [Link][github_commits_2_0_0] to a list of all commits between this and 573 previous release. 574 575 576## Tested on 577Definitions: 578 579| Type | Meaning | 580| ---- | ------- | 581| Standard tests | The [optee_test][optee_test] project. | 582| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 583 584* ARM Juno Board (vexpress-juno), standard. 585* Foundation Models (vexpress-fvp), standard tests + extended tests, 586 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 587* FSL ls1021a (ls-ls1021atwr), standard. 588* HiKey (hikey), standard. 589* MTK8173-EVB (mediatek-mt8173), standard. 590* QEMU (vexpress-qemu), standard + extended tests. 591* STM Cannes (stm-cannes), standard + extended tests. 592 593## Known issues 594* Issue(s) open on GitHub 595 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 596 * [#506][pr506]: tee-supplicant panic & ta panic 597 598[github_commits_2_0_0]: https://github.com/OP-TEE/optee_os/compare/1.1.0...2.0.0 599[rpmb_doc]: https://github.com/OP-TEE/optee_os/blob/master/documentation/secure_storage_rpmb.md 600[optee_linuxdriver]: https://github.com/OP-TEE/optee_linuxdriver 601[gendrv_v9]: https://lkml.org/lkml/2016/4/1/205 602[linux_optee]: https://github.com/linaro-swg/linux/tree/optee 603 604 605# OP-TEE - version 1.1.0 606 607 608## New features 609 610* Softfloat library: floating point support is now available in 32bits TA. 611 612* Support running 64-bits TA: on ARMv8-A platform, TA can be compiled in 613 AArch32 and/or in AArch64 in case the core is compiled in AArch64. 614 An example can be found in HiKey configuration file. Using the following 615 excerpt code, the user TA libraries are compiled in both AArch32 and 616 AArch64, and can be found in `out/arm-plat-hikey/export-ta_arm32` and 617 `out/arm-plat-hikey/export-ta_arm64` 618 619``` 620 ta-targets = ta_arm32 621 ta-targets += ta_arm64 622``` 623 624* Concurrent TA support: multiple TA can run in parallel on 625 several cores. 626 627* New tests added in xtest test suite: concurrent TA (xtest 1013), 628 floating point tests (xtest 1006 and os_test TA) and corruption 629 file storage (xtest 20000) 630 631* [Link][github_commits_1_1_0] to a list of all commits between this and 632 previous release. 633 634 635## Tested on 636Definitions: 637 638| Type | Meaning | 639| ---- | ------- | 640| Standard tests | The [optee_test][optee_test] project. | 641| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 642| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 643 644* Foundation Models (vexpress-fvp), standard tests + extended tests, 645 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 646* HiKey (hikey), standard + extended tests. 647* MT8173 (mediatek), standard tests. 648* QEMU (vexpress-qemu), standard + extended tests. 649* STM Cannes (stm-cannes), standard + extended tests. 650 651## Known issues 652* Secure Storage is implemented, but note that anti-rollback protection 653 is not implemented yet. 654 655* Issue(s) open on GitHub 656 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 657 * [#296][pr296]: Connecting RPMB to the storage APIs. 658 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 659 * [#506][pr506]: tee-supplicant panic & ta panic 660 661[prld40]: https://github.com/OP-TEE/optee_linuxdriver/issues/40 662[pr506]: https://github.com/OP-TEE/optee_os/issues/506 663[github_commits_1_1_0]: https://github.com/OP-TEE/optee_os/compare/1.0.1...1.1.0 664 665 666 667# OP-TEE - version 1.0.0 668 669OP-TEE is now maintained by Linaro. Contributors do not need to 670sign a CLA anymore, but must follow the rules of the [DCO][DCO] 671(Developer Certificate of Origin) instead. 672 673 674## New features 675 676* Add hardware support for Texas Instruments DRA7xx, ARMv7 (plat-ti) 677 678* GlobalPlatform™ TEE Internal Core API Specification v1.1, 679 including ECC algorithms. 680 681* Secure Storage: Files stored by the REE are now encrypted. Operations 682 are made atomic in order to prevent inconsistencies in case of errors 683 during the storage operations. [Slides][LCStorage] describing the 684 Secure Storage have been presented at the Linaro Connect SFO15. 685 686* Change of format of the Trusted Applications: they follow a 687 [signed ELF format][elf] 688 689* Rework thread [synchronization][synchro] in optee_os. 690 691* Use of ARMv8 native cryptographic support. 692 693* [OP-TEE/optee_test][optee_test] test suite is released. 694 695* Introduce [OP-TEE/manifest][manifest] and [OP-TEE/build][build] 696 to setup and build QEMU, FVP, HiKey and Mediatek platforms. Setup scripts 697 that used to be in optee_os have been removed, except for Juno board. 698 699* [Link][github_commits_1_0_0] to a list of all commits between this and 700 previous release. 701 702 703## Tested on 704Definitions: 705 706| Type | Meaning | 707| ---- | ------- | 708| Standard tests | The [optee_test][optee_test] project. | 709| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 710| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 711 712* ARM Juno Board (vexpress-juno), standard + extended tests. 713* Foundation Models (vexpress-fvp), standard tests. 714* HiKey (hikey), standard + extended tests. 715* MT8173 (mediatek), standard tests. 716* QEMU (vexpress-qemu), standard + extended tests. 717* STM Cannes (stm-cannes), standard + extended tests. 718 719## Known issues 720* Secure Storage is implemented, but note that anti-rollback protection 721 is not implemented yet. 722 723* Issue(s) open on GitHub 724 * [#210][pr210]: libteec.so 32-bit does not communicate well 725 with 64-bit kernel module 726 * [#296][pr296]: Connecting RPMB to the storage APIs. 727 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 728 * [#494][pr494]: HiKey: xtest 7671 fails (1.0.0-rc2) 729 730[pr210]: https://github.com/OP-TEE/optee_os/issues/210 731[pr296]: https://github.com/OP-TEE/optee_os/issues/296 732[pr493]: https://github.com/OP-TEE/optee_os/issues/493 733[pr494]: https://github.com/OP-TEE/optee_os/issues/494 734[github_commits_1_0_0]: https://github.com/OP-TEE/optee_os/compare/0.3.0...1.0.0 735[DCO]: https://github.com/OP-TEE/optee_os/blob/master/Notice.md#contributions 736[LCStorage]: http://www.slideshare.net/linaroorg/sfo15503-secure-storage-in-optee 737[synchro]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#4-thread-handling 738[elf]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#format 739[optee_test]: https://github.com/OP-TEE/optee_test 740[manifest]: https://github.com/OP-TEE/manifest 741[build]: https://github.com/OP-TEE/build 742 743 744 745# OP-TEE - version 0.3.0 746 747## New features 748 749* Add hardware support for 750 * Mediatek MT8173 Board, ARMv8-A (plat-mediatek) 751 * Hisilicon HiKey Board, ARMv8-A (plat-hikey) 752* AArch64 build of optee_os is now possible through the configuration `CFG_ARM64_core=y` 753* Secure Storage: Data can be encrypted prior to their storage in the non-secure. 754 Build is configured using `CFG_ENC_FS=y` 755* A generic boot scheme can be used. Boot configuration is commonalized. This helps 756 new board support. It is applied on plat-hikey, plat-vexpress, plat-mediatek, plat-stm 757 and plat-vexpress. 758 759## Tested on 760Definitions: 761 762| Type | Meaning | 763| ---- | ------- | 764| Standard tests | The optee_test project. | 765| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 766| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 767 768* ARM Juno Board (vexpress-juno), standard tests. 769* Foundation Models (vexpress-fvp), standard tests. 770* HiKey (hikey), standard tests. 771* MT8173 (mediatek), standard tests. 772* QEMU (vexpress-qemu), standard + extended tests. 773* STM Cannes (stm-cannes), standard + extended tests. 774 775------------------------------------------- 776 777# OP-TEE - version 0.2.0 778 779## New features 780 781### Linux Driver Refactoring 782 783Linux Driver has been refactored. It is now split in two parts: 784* optee.ko, the generic Linux driver. It contains all functionality 785 common to all backends. 786* optee_armtz.ko, a specific backend dedicated to the TrustZone optee. 787 It depends on optee.ko. 788 789Loading the TrustZone optee linux driver module is now performed using 790 791 modprobe optee_armtz 792 793Thanks to the dependency between the generic and the backend modules, optee.ko is then automatically loaded. 794 795### Misc new features 796* support PL310 lock down at TEE boot 797* add 64bits support (division / print) 798 799## Tested on 800Definitions: 801 802| Type | Meaning | 803| ---- | ------- | 804| Standard tests | The optee_test project. | 805| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 806| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 807 808* ARM Juno Board (vexpress-juno), standard tests + extended tests. 809 810* Foundation Models (vexpress-fvp), standard + extended tests. 811 812* QEMU (vexpress-qemu), standard + extended tests. 813 814* STM Cannes (stm-cannes), standard + extended tests. 815 816 817## Issues resolved since last release 818* Fix user TA trace issue, in order each TA is able to select its own trace level 819 820 821------------------------------------------- 822#OP-TEE - version 0.1.0 823 824## New features 825Below is a summary of the most important features added, but at the end you will 826find a link that present you all commits between the current and previous 827release tag. 828 829* GlobalPlatform Client API v1.0 support. 830 831* GlobalPlatform Internal API v1.0 support. 832 833* GlobalPlatform Secure Elements v1.0 support. 834 835* Add hardware support for 836 837 * Allwinner A80, ARMv7-A. 838 839 * ARM Juno Board, ARMv8-A. 840 841 * Foundation Models, ARMv8-A. 842 843 * Fast Models, ARMv8-A. 844 845 * QEMU, ARMv7-A. 846 847 * STM Cannes, ARMv7-A. 848 849 * STM Orly2, ARMv7-A. 850 851* Add LibTomCrypt as the default software cryptographic library. 852 853* Add cryptographic abstraction layer in on secure side to ease the use of 854 other cryptographic software libraries or adding support for hardware 855 acceleration. 856 857* Extended cryptographic API with support for HKDF, Concat KDF and PBKDF2. 858 859* SHA-1 and SHA-256 ARMv8-A crypto extension implementation. 860 861* Enabled paging support in OP-TEE OS. 862 863* Add support for xtest (both standard and extended) in QEMU and FVP setup 864 scripts. 865 866* Add documentation for the OS design, cryptographic abstraction layer, secure 867 elements design, the build system, GitHub usage, key derivation extensions, 868 ARM-Trusted Firmware usage within OP-TEE and GlobalPlatform usage within 869 OP-TEE. 870 871* Integrate support for Travis CI. 872 873* [Link][github_commits_0_1_0] to a list of all commits between this and 874 previous release. 875 876 877## Tested on 878Definitions: 879 880| Type | Meaning | 881| ---- | ------- | 882| Standard tests | The optee_test project. | 883| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.0.0. | 884| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 885 886* Allwinner A80 (plat-sunxi), hello world test. 887 888* ARM Juno Board (vexpress-juno), standard tests. 889 890* Foundation Models (plat-vexpress-fvp), standard + extended tests 891 892* QEMU (plat-vexpress-qemu), standard + extended tests (and Secure Elements 893 tested separately). 894 895* STM Cannes (plat-stm-cannes), standard + extended tests. 896 897 898## Issues resolved since last release 899N/A since this is the first release tag on OP-TEE. 900 901 902## Known issues 903* Storage is implemented, but not "Secure storage", meaning that a client 904 needs to do encrypt files on their own before storing the files. 905 906* Issue(s) open on GitHub 907 * [#95][pr95]: An error about building the test code of libtomcrypt. 908 909 * [#149][pr149]: when testing optee os with arm trusted firmware (I 910 utilized optee os tee.bin as bl32 image) on juno platform, I got an 911 error. 912 913 * [#161][pr161]: tee_svc_cryp.c lacks accessibility checks on 914 user-supplied TEE_Attributes. 915 916[hello_world]: https://github.com/jenswi-linaro/lcu14_optee_hello_world 917[github_commits_0_1_0]: https://github.com/OP-TEE/optee_os/compare/b01047730e77127c23a36591643eeb8bb0487d68...999e4a6c0f64d3177fd3d0db234107b6fb860884 918[pr95]: https://github.com/OP-TEE/optee_os/issues/95 919[pr149]: https://github.com/OP-TEE/optee_os/issues/149 920[pr161]: https://github.com/OP-TEE/optee_os/issues/161 921 922* Global Platform Device Internal Core API v1.1 923 * [#230][pr230]: Persistent object corruption support (TEE_ERROR_CORRUPT_OBJECT/_2) 924 * [#230][pr230]: Persistent object access support (TEE_ERROR_STORAGE_NOT_AVAILABLE/_2) 925