1# OP-TEE - version 2.2.0 2 3[Link][github_commits_2_2_0] to a list of all commits between this release and 4the previous one (2.1.0). 5 6Please note: this release is API-compatible with the previous one, but the 7Secure Storage internal format is not compatible due to commit 8[fde4a75][commit_fde4a75] ("storage: encrypt the FEK with a TA-specific key"). 9 10[commit_fde4a75]: https://github.com/OP-TEE/optee_os/commit/fde4a75 11 12## New features 13 14* New supported platforms: 15 * Freescale i.MX6 Quad SABRE Lite & SD 16 * HiSilicon D02 17 * Raspberry Pi3 18 * Renesas RCAR H3 19 * STMicroelectronics b2260 - h410 20 21* Pager: Support paging of read/write pages by encrypting them with AES-GCM. 22 Support paging of user TAs. Add global setting for TZSRAM size 23 (CFG_CORE_TZSRAM_EMUL_SIZE), defaults to 300K. 24 25* Support for more than 8 CPU cores 26 27* Added SPI framework and PL022 driver 28 29* GPIO: framework supports multiple instances, PL061 driver now has get/set 30 interrupt and mode control functions 31 32* Secure storage: Encrypt the File Encryption Key with a TA-specific key for 33 better TA isolation. Add build-time and run-time support for multiple storage 34 backends. Add SQLite backend. 35 36* Trusted User Interface: some code is introduced to support the implementation 37 of TUI. This includes: a generic framebuffer driver, display and serial 38 abstractions, and drivers for PL111 (LCD) / PL050 (KMI) / TZC400 and PS2 39 mouse. 40 41* AES acceleration using ARMv8-A Cryptographic Extensions instructions is 42 now supported in AArch32 mode 43 44* Add support for GCC flags: -fsanitize=undefined and -fsanitize=kernel-address 45 46* Use a global setting for core heap size (CFG_CORE_HEAP_SIZE), 64K by default. 47 48* Add macros to unwind and print the call stack of TEE core 49 50* Libtomcrypt: sync with the latest `develop` branch. 51 52* The Trusted Application SDK (ta_dev_kit.mk) can produce libraries (.a) 53 54* Rework assertions and TEE core panics and properly honor NDEBUG 55 56## Bug fixes 57 58* Fix incorrect algorithm passed to cipher.final() 59 60* scripts: support Python 2.x and 3.x 61 62* Secure storage: Add proper locking to support concurrent access. Fix sign 63 extension bug with offset parameter of syscall storage_obj_seek which could 64 cause errors in Aarch32 mode. Fix reading beyond end of file. 65 66* Aarch64: mask all maskable exceptions before doing a normal return from call. 67 68* Device Tree: add no-map property to OP-TEE node in reserved-memory. 69 70* LibTomcrypt: fix CVE-2016-6129 71 72## Known issues 73 74* New issues open on GitHub 75 * [#1093][issue1093] rcar-h3: xtest 6010 hangs 76 * [#1092][issue1092] rcar-h3: xtest 4010 fails 77 * [#1081][issue1081] Bad mapping of TA secure memref parameters 78 * [#1071][issue1071] __data_end may not correctly represent text start position when using CFG_WITH_PAGER 79 * [#1069][issue1069] armv7/Aarch32: crash in stack unwind (DPRINT_STACK()) 80 81## Tested on 82 83In the list below, _standard_ means that the `xtest` program passed with 84its default configuration, while _extended_ means it was run successfully 85with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 86v1.1.0.4. 87 88If a platform is not listed, it means the release was not tested on this 89platform. 90 91<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 92* d02: extended 93* hikey: extended 94* imx-mx6qsabrelite: standard 95* imx-mx6qsabresd: standard 96* rcar-h3: standard, pass except issues [#1092][issue1092] and [#1093][issue1093] 97* rpi3: standard 98* stm-b2260: standard 99* stm-cannes: standard 100* ti-dra7xx: standard 101* vexpress-fvp: standard 102* vexpress-juno: standard 103* vexpress-qemu_armv8a: standard 104* vexpress-qemu_virt: extended 105* zynqmp-zcu102: standard 106 107[github_commits_2_2_0]: https://github.com/OP-TEE/optee_os/compare/2.1.0...2.2.0 108[issue1081]: https://github.com/OP-TEE/optee_os/issues/1081 109[issue1071]: https://github.com/OP-TEE/optee_os/issues/1071 110[issue1069]: https://github.com/OP-TEE/optee_os/issues/1069 111[issue1092]: https://github.com/OP-TEE/optee_os/issues/1092 112[issue1093]: https://github.com/OP-TEE/optee_os/issues/1093 113 114# OP-TEE - version 2.1.0 115 116## New features 117 118* New supported platforms: 119 * Xilinx Zynq UltraScale+ MPSOC 120 * Spreadtrum SC9860 121 122* GCC5 support 123 124* Non Linear Mapping support: In OP-TEE kernel mode, the physical to virtual 125 addresses was linear until this release, meaning the virtual addresses 126 were equal to the physical addresses. This is no more the case in this 127 release. 128 129* Font rendering routines have been introduced in order to ease an 130 implementation of Trusted UI. 131 132* File Storage: Possibility to use the normal world filesystem and the RPMB 133 implementations simultaneously. 134 135* AOSP: There is a [local manifest][aosp_local_manifest] to build OP-TEE into an AOSP build, running on HiKey. 136 Please refer to the README in that repo for instructions. 137 138* OpenEmbedded: In addition to the makefile-based build described in the optee_os README, there is an 139 [OpenEmbedded-based build][oe_build] that supports Qemu (32-bit), FVP (64-bit), and HiKey (64-bit). 140 Please refer to the README in that repo for instructions. 141 142* [Link][github_commits_2_1_0] to a list of all commits between this and 143 previous release. 144 145 146## Tested on 147Definitions: 148 149| Type | Meaning | 150| ---- | ------- | 151| Standard tests | The [optee_test][optee_test] project. | 152| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 153 154* ARM Juno Board (vexpress-juno), standard. 155* Foundation Models (vexpress-fvp), standard tests + extended tests, 156 using FVP ARM V8 Foundation Platformr0p0 (platform build 10.0.37) 157* FSL i.MX6 UltraLite EVK (imx), standard. 158* FSL ls1021a (ls-ls1021atwr), standard tests. 159* HiKey (hikey), standard + extended tests. 160* QEMU (vexpress-qemu), standard + extended tests. 161* Xilinx Zynq UltraScale+ MPSOC, standard tests 162 163Note that the following platform has not been tested: 164* MTK8173-EVB (mediatek-mt8173) 165 166 167## Known issues 168* Issue(s) open on GitHub 169 * [#868][pr868]: python-wand font generation sometimes times out 170 * [#863][pr863]: "double free or corruption" error when building optee_os 171 * [#858][pr858]: UUIDs in binary format have wrong endinanness 172 * [#857][pr857]: Formatting of UUIDs is incorrect 173 * [#847][pr847]: optee_os panic(TEE-CORE: Assertion) 174 * [#838][pr838]: TUI font rendering is _very_ slow 175 * [#814][pr814]: Persistent objects : save informations after close 176 * [#665][pr665]: xtest 1013 stalled on HiKey when log levels are 4 and optee_os is on its own UART 177 * [#506][pr506]: tee-supplicant panic & ta panic 178 179[github_commits_2_1_0]: https://github.com/OP-TEE/optee_os/compare/2.0.0...2.1.0 180[pr868]: https://github.com/OP-TEE/optee_os/issues/868 181[pr863]: https://github.com/OP-TEE/optee_os/issues/863 182[pr858]: https://github.com/OP-TEE/optee_os/issues/858 183[pr857]: https://github.com/OP-TEE/optee_os/issues/857 184[pr847]: https://github.com/OP-TEE/optee_os/issues/847 185[pr838]: https://github.com/OP-TEE/optee_os/issues/838 186[pr814]: https://github.com/OP-TEE/optee_os/issues/814 187[pr665]: https://github.com/OP-TEE/optee_os/issues/665 188[aosp_local_manifest]: https://github.com/linaro-swg/optee_android_manifest 189[oe_build]: https://github.com/linaro-swg/oe-optee 190 191# OP-TEE - version 2.0.0 192 193## New features 194 195* Generic driver: A new generic TEE driver is in the process of being 196 [upstreamed][gendrv_v9]. 197 In this release, [OP-TEE/optee_linuxdriver][optee_linuxdriver] is no more used. 198 Instead, linux v4.5 is being patched using the proposed Generic TEE Driver, 199 as it can be found in [https://github.com/linaro-swg/linux/tree/optee][linux_optee] 200 201* RPMB support: Secure Storage can now use Replay Protected Memory Block (RPMB) partition 202 of an eMMC device. Check the [full documentation][rpmb_doc] 203 204* Hard-float ABI is now available. 205 206* [Link][github_commits_2_0_0] to a list of all commits between this and 207 previous release. 208 209 210## Tested on 211Definitions: 212 213| Type | Meaning | 214| ---- | ------- | 215| Standard tests | The [optee_test][optee_test] project. | 216| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 217 218* ARM Juno Board (vexpress-juno), standard. 219* Foundation Models (vexpress-fvp), standard tests + extended tests, 220 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 221* FSL ls1021a (ls-ls1021atwr), standard. 222* HiKey (hikey), standard. 223* MTK8173-EVB (mediatek-mt8173), standard. 224* QEMU (vexpress-qemu), standard + extended tests. 225* STM Cannes (stm-cannes), standard + extended tests. 226 227## Known issues 228* Issue(s) open on GitHub 229 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 230 * [#506][pr506]: tee-supplicant panic & ta panic 231 232[github_commits_2_0_0]: https://github.com/OP-TEE/optee_os/compare/1.1.0...2.0.0 233[rpmb_doc]: https://github.com/OP-TEE/optee_os/blob/master/documentation/secure_storage_rpmb.md 234[optee_linuxdriver]: https://github.com/OP-TEE/optee_linuxdriver 235[gendrv_v9]: https://lkml.org/lkml/2016/4/1/205 236[linux_optee]: https://github.com/linaro-swg/linux/tree/optee 237 238 239# OP-TEE - version 1.1.0 240 241 242## New features 243 244* Softfloat library: floating point support is now available in 32bits TA. 245 246* Support running 64-bits TA: on ARMv8-A platform, TA can be compiled in 247 AArch32 and/or in AArch64 in case the core is compiled in AArch64. 248 An example can be found in HiKey configuration file. Using the following 249 excerpt code, the user TA libraries are compiled in both AArch32 and 250 AArch64, and can be found in `out/arm-plat-hikey/export-ta_arm32` and 251 `out/arm-plat-hikey/export-ta_arm64` 252 253``` 254 ta-targets = ta_arm32 255 ta-targets += ta_arm64 256``` 257 258* Concurrent TA support: multiple TA can run in parallel on 259 several cores. 260 261* New tests added in xtest test suite: concurrent TA (xtest 1013), 262 floating point tests (xtest 1006 and os_test TA) and corruption 263 file storage (xtest 20000) 264 265* [Link][github_commits_1_1_0] to a list of all commits between this and 266 previous release. 267 268 269## Tested on 270Definitions: 271 272| Type | Meaning | 273| ---- | ------- | 274| Standard tests | The [optee_test][optee_test] project. | 275| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 276| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 277 278* Foundation Models (vexpress-fvp), standard tests + extended tests, 279 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 280* HiKey (hikey), standard + extended tests. 281* MT8173 (mediatek), standard tests. 282* QEMU (vexpress-qemu), standard + extended tests. 283* STM Cannes (stm-cannes), standard + extended tests. 284 285## Known issues 286* Secure Storage is implemented, but note that anti-rollback protection 287 is not implemented yet. 288 289* Issue(s) open on GitHub 290 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 291 * [#296][pr296]: Connecting RPMB to the storage APIs. 292 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 293 * [#506][pr506]: tee-supplicant panic & ta panic 294 295[prld40]: https://github.com/OP-TEE/optee_linuxdriver/issues/40 296[pr506]: https://github.com/OP-TEE/optee_os/issues/506 297[github_commits_1_1_0]: https://github.com/OP-TEE/optee_os/compare/1.0.1...1.1.0 298 299 300 301# OP-TEE - version 1.0.0 302 303OP-TEE is now maintained by Linaro. Contributors do not need to 304sign a CLA anymore, but must follow the rules of the [DCO][DCO] 305(Developer Certificate of Origin) instead. 306 307 308## New features 309 310* Add hardware support for Texas Instruments DRA7xx, ARMv7 (plat-ti) 311 312* GlobalPlatform™ TEE Internal Core API Specification v1.1, 313 including ECC algorithms. 314 315* Secure Storage: Files stored by the REE are now encrypted. Operations 316 are made atomic in order to prevent inconsistencies in case of errors 317 during the storage operations. [Slides][LCStorage] describing the 318 Secure Storage have been presented at the Linaro Connect SFO15. 319 320* Change of format of the Trusted Applications: they follow a 321 [signed ELF format][elf] 322 323* Rework thread [synchronization][synchro] in optee_os. 324 325* Use of ARMv8 native cryptographic support. 326 327* [OP-TEE/optee_test][optee_test] test suite is released. 328 329* Introduce [OP-TEE/manifest][manifest] and [OP-TEE/build][build] 330 to setup and build QEMU, FVP, HiKey and Mediatek platforms. Setup scripts 331 that used to be in optee_os have been removed, except for Juno board. 332 333* [Link][github_commits_1_0_0] to a list of all commits between this and 334 previous release. 335 336 337## Tested on 338Definitions: 339 340| Type | Meaning | 341| ---- | ------- | 342| Standard tests | The [optee_test][optee_test] project. | 343| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 344| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 345 346* ARM Juno Board (vexpress-juno), standard + extended tests. 347* Foundation Models (vexpress-fvp), standard tests. 348* HiKey (hikey), standard + extended tests. 349* MT8173 (mediatek), standard tests. 350* QEMU (vexpress-qemu), standard + extended tests. 351* STM Cannes (stm-cannes), standard + extended tests. 352 353## Known issues 354* Secure Storage is implemented, but note that anti-rollback protection 355 is not implemented yet. 356 357* Issue(s) open on GitHub 358 * [#210][pr210]: libteec.so 32-bit does not communicate well 359 with 64-bit kernel module 360 * [#296][pr296]: Connecting RPMB to the storage APIs. 361 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 362 * [#494][pr494]: HiKey: xtest 7671 fails (1.0.0-rc2) 363 364[pr210]: https://github.com/OP-TEE/optee_os/issues/210 365[pr296]: https://github.com/OP-TEE/optee_os/issues/296 366[pr493]: https://github.com/OP-TEE/optee_os/issues/493 367[pr494]: https://github.com/OP-TEE/optee_os/issues/494 368[github_commits_1_0_0]: https://github.com/OP-TEE/optee_os/compare/0.3.0...1.0.0 369[DCO]: https://github.com/OP-TEE/optee_os/blob/master/Notice.md#contributions 370[LCStorage]: http://www.slideshare.net/linaroorg/sfo15503-secure-storage-in-optee 371[synchro]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#4-thread-handling 372[elf]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#format 373[optee_test]: https://github.com/OP-TEE/optee_test 374[manifest]: https://github.com/OP-TEE/manifest 375[build]: https://github.com/OP-TEE/build 376 377 378 379# OP-TEE - version 0.3.0 380 381## New features 382 383* Add hardware support for 384 * Mediatek MT8173 Board, ARMv8-A (plat-mediatek) 385 * Hisilicon HiKey Board, ARMv8-A (plat-hikey) 386* AArch64 build of optee_os is now possible through the configuration `CFG_ARM64_core=y` 387* Secure Storage: Data can be encrypted prior to their storage in the non-secure. 388 Build is configured using `CFG_ENC_FS=y` 389* A generic boot scheme can be used. Boot configuration is commonalized. This helps 390 new board support. It is applied on plat-hikey, plat-vexpress, plat-mediatek, plat-stm 391 and plat-vexpress. 392 393## Tested on 394Definitions: 395 396| Type | Meaning | 397| ---- | ------- | 398| Standard tests | The optee_test project. | 399| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 400| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 401 402* ARM Juno Board (vexpress-juno), standard tests. 403* Foundation Models (vexpress-fvp), standard tests. 404* HiKey (hikey), standard tests. 405* MT8173 (mediatek), standard tests. 406* QEMU (vexpress-qemu), standard + extended tests. 407* STM Cannes (stm-cannes), standard + extended tests. 408 409------------------------------------------- 410 411# OP-TEE - version 0.2.0 412 413## New features 414 415### Linux Driver Refactoring 416 417Linux Driver has been refactored. It is now split in two parts: 418* optee.ko, the generic Linux driver. It contains all functionality 419 common to all backends. 420* optee_armtz.ko, a specific backend dedicated to the TrustZone optee. 421 It depends on optee.ko. 422 423Loading the TrustZone optee linux driver module is now performed using 424 425 modprobe optee_armtz 426 427Thanks to the dependency between the generic and the backend modules, optee.ko is then automatically loaded. 428 429### Misc new features 430* support PL310 lock down at TEE boot 431* add 64bits support (division / print) 432 433## Tested on 434Definitions: 435 436| Type | Meaning | 437| ---- | ------- | 438| Standard tests | The optee_test project. | 439| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 440| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 441 442* ARM Juno Board (vexpress-juno), standard tests + extended tests. 443 444* Foundation Models (vexpress-fvp), standard + extended tests. 445 446* QEMU (vexpress-qemu), standard + extended tests. 447 448* STM Cannes (stm-cannes), standard + extended tests. 449 450 451## Issues resolved since last release 452* Fix user TA trace issue, in order each TA is able to select its own trace level 453 454 455------------------------------------------- 456#OP-TEE - version 0.1.0 457 458## New features 459Below is a summary of the most important features added, but at the end you will 460find a link that present you all commits between the current and previous 461release tag. 462 463* GlobalPlatform Client API v1.0 support. 464 465* GlobalPlatform Internal API v1.0 support. 466 467* GlobalPlatform Secure Elements v1.0 support. 468 469* Add hardware support for 470 471 * Allwinner A80, ARMv7-A. 472 473 * ARM Juno Board, ARMv8-A. 474 475 * Foundation Models, ARMv8-A. 476 477 * Fast Models, ARMv8-A. 478 479 * QEMU, ARMv7-A. 480 481 * STM Cannes, ARMv7-A. 482 483 * STM Orly2, ARMv7-A. 484 485* Add LibTomCrypt as the default software cryptographic library. 486 487* Add cryptographic abstraction layer in on secure side to ease the use of 488 other cryptographic software libraries or adding support for hardware 489 acceleration. 490 491* Extended cryptographic API with support for HKDF, Concat KDF and PBKDF2. 492 493* SHA-1 and SHA-256 ARMv8-A crypto extension implementation. 494 495* Enabled paging support in OP-TEE OS. 496 497* Add support for xtest (both standard and extended) in QEMU and FVP setup 498 scripts. 499 500* Add documentation for the OS design, cryptographic abstraction layer, secure 501 elements design, the build system, GitHub usage, key derivation extensions, 502 ARM-Trusted Firmware usage within OP-TEE and GlobalPlatform usage within 503 OP-TEE. 504 505* Integrate support for Travis CI. 506 507* [Link][github_commits_0_1_0] to a list of all commits between this and 508 previous release. 509 510 511## Tested on 512Definitions: 513 514| Type | Meaning | 515| ---- | ------- | 516| Standard tests | The optee_test project. | 517| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.0.0. | 518| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 519 520* Allwinner A80 (plat-sunxi), hello world test. 521 522* ARM Juno Board (vexpress-juno), standard tests. 523 524* Foundation Models (plat-vexpress-fvp), standard + extended tests 525 526* QEMU (plat-vexpress-qemu), standard + extended tests (and Secure Elements 527 tested separately). 528 529* STM Cannes (plat-stm-cannes), standard + extended tests. 530 531 532## Issues resolved since last release 533N/A since this is the first release tag on OP-TEE. 534 535 536## Known issues 537* Storage is implemented, but not "Secure storage", meaning that a client 538 needs to do encrypt files on their own before storing the files. 539 540* Issue(s) open on GitHub 541 * [#95][pr95]: An error about building the test code of libtomcrypt. 542 543 * [#149][pr149]: when testing optee os with arm trusted firmware (I 544 utilized optee os tee.bin as bl32 image) on juno platform, I got an 545 error. 546 547 * [#161][pr161]: tee_svc_cryp.c lacks accessibility checks on 548 user-supplied TEE_Attributes. 549 550[hello_world]: https://github.com/jenswi-linaro/lcu14_optee_hello_world 551[github_commits_0_1_0]: https://github.com/OP-TEE/optee_os/compare/b01047730e77127c23a36591643eeb8bb0487d68...999e4a6c0f64d3177fd3d0db234107b6fb860884 552[pr95]: https://github.com/OP-TEE/optee_os/issues/95 553[pr149]: https://github.com/OP-TEE/optee_os/issues/149 554[pr161]: https://github.com/OP-TEE/optee_os/issues/161 555 556* Global Platform Device Internal Core API v1.1 557 * [#230][pr230]: Persistent object corruption support (TEE_ERROR_CORRUPT_OBJECT/_2) 558 * [#230][pr230]: Persistent object access support (TEE_ERROR_STORAGE_NOT_AVAILABLE/_2) 559