1# OP-TEE - version 3.9.0 (2020-04-22) 2 3- Links to the release pages, commits and pull requests merged into this release for: 4 - OP-TEE/optee_os: [release page][OP_TEE_optee_os_release_3_9_0], [commits][OP_TEE_optee_os_commits_3_9_0] and [pull requests][OP_TEE_optee_os_pr_3_9_0] 5 - OP-TEE/optee_client: [release page][OP_TEE_optee_client_release_3_9_0], [commits][OP_TEE_optee_client_commits_3_9_0] and [pull requests][OP_TEE_optee_client_pr_3_9_0] 6 - OP-TEE/optee_test: [release page][OP_TEE_optee_test_release_3_9_0], [commits][OP_TEE_optee_test_commits_3_9_0] and [pull requests][OP_TEE_optee_test_pr_3_9_0] 7 - OP-TEE/build: [release page][OP_TEE_build_release_3_9_0], [commits][OP_TEE_build_commits_3_9_0] and [pull requests][OP_TEE_build_pr_3_9_0] 8 - linaro-swg/optee_examples: [release page][linaro_swg_optee_examples_release_3_9_0], [commits][linaro_swg_optee_examples_commits_3_9_0] and [pull requests][linaro_swg_optee_examples_pr_3_9_0] 9 10 11[OP_TEE_optee_os_release_3_9_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.9.0 12[OP_TEE_optee_os_commits_3_9_0]: https://github.com/OP-TEE/optee_os/compare/3.8.0...3.9.0 13[OP_TEE_optee_os_pr_3_9_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-05-22 14 15[OP_TEE_optee_client_release_3_9_0]: https://github.com/OP-TEE/optee_client/releases/tag/3.9.0 16[OP_TEE_optee_client_commits_3_9_0]: https://github.com/OP-TEE/optee_client/compare/3.8.0...3.9.0 17[OP_TEE_optee_client_pr_3_9_0]: https://github.com/OP-TEE/optee_client/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-05-22 18 19[OP_TEE_optee_test_release_3_9_0]: https://github.com/OP-TEE/optee_test/releases/tag/3.9.0 20[OP_TEE_optee_test_commits_3_9_0]: https://github.com/OP-TEE/optee_test/compare/3.8.0...3.9.0 21[OP_TEE_optee_test_pr_3_9_0]: https://github.com/OP-TEE/optee_test/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-05-22 22 23[OP_TEE_build_release_3_9_0]: https://github.com/OP-TEE/build/releases/tag/3.9.0 24[OP_TEE_build_commits_3_9_0]: https://github.com/OP-TEE/build/compare/3.8.0...3.9.0 25[OP_TEE_build_pr_3_9_0]: https://github.com/OP-TEE/build/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-05-22 26 27[linaro_swg_optee_examples_release_3_9_0]: https://github.com/linaro-swg/optee_examples/releases/tag/3.9.0 28[linaro_swg_optee_examples_commits_3_9_0]: https://github.com/linaro-swg/optee_examples/compare/3.8.0...3.9.0 29[linaro_swg_optee_examples_pr_3_9_0]: https://github.com/linaro-swg/optee_examples/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-05-22 30 31# OP-TEE - version 3.8.0 (2020-01-24) 32 33- Links to the release pages, commits and pull requests merged into this release for: 34 - OP-TEE/optee_os: [release page][OP_TEE_optee_os_release_3_8_0], [commits][OP_TEE_optee_os_commits_3_8_0] and [pull requests][OP_TEE_optee_os_pr_3_8_0] 35 - OP-TEE/optee_client: [release page][OP_TEE_optee_client_release_3_8_0], [commits][OP_TEE_optee_client_commits_3_8_0] and [pull requests][OP_TEE_optee_client_pr_3_8_0] 36 - OP-TEE/optee_test: [release page][OP_TEE_optee_test_release_3_8_0], [commits][OP_TEE_optee_test_commits_3_8_0] and [pull requests][OP_TEE_optee_test_pr_3_8_0] 37 - OP-TEE/build: [release page][OP_TEE_build_release_3_8_0], [commits][OP_TEE_build_commits_3_8_0] and [pull requests][OP_TEE_build_pr_3_8_0] 38 - linaro-swg/optee_examples: [release page][linaro_swg_optee_examples_release_3_8_0], [commits][linaro_swg_optee_examples_commits_3_8_0] and [pull requests][linaro_swg_optee_examples_pr_3_8_0] 39 40 41[OP_TEE_optee_os_release_3_8_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.8.0 42[OP_TEE_optee_os_commits_3_8_0]: https://github.com/OP-TEE/optee_os/compare/3.7.0...3.8.0 43[OP_TEE_optee_os_pr_3_8_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2020-01-24..2020-01-24 44 45[OP_TEE_optee_client_release_3_8_0]: https://github.com/OP-TEE/optee_client/releases/tag/3.8.0 46[OP_TEE_optee_client_commits_3_8_0]: https://github.com/OP-TEE/optee_client/compare/3.7.0...3.8.0 47[OP_TEE_optee_client_pr_3_8_0]: https://github.com/OP-TEE/optee_client/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2020-01-24 48 49[OP_TEE_optee_test_release_3_8_0]: https://github.com/OP-TEE/optee_test/releases/tag/3.8.0 50[OP_TEE_optee_test_commits_3_8_0]: https://github.com/OP-TEE/optee_test/compare/3.7.0...3.8.0 51[OP_TEE_optee_test_pr_3_8_0]: https://github.com/OP-TEE/optee_test/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2020-01-24 52 53[OP_TEE_build_release_3_8_0]: https://github.com/OP-TEE/build/releases/tag/3.8.0 54[OP_TEE_build_commits_3_8_0]: https://github.com/OP-TEE/build/compare/3.7.0...3.8.0 55[OP_TEE_build_pr_3_8_0]: https://github.com/OP-TEE/build/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2020-01-24 56 57[linaro_swg_optee_examples_release_3_8_0]: https://github.com/linaro-swg/optee_examples/releases/tag/3.8.0 58[linaro_swg_optee_examples_commits_3_8_0]: https://github.com/linaro-swg/optee_examples/compare/3.7.0...3.8.0 59[linaro_swg_optee_examples_pr_3_8_0]: https://github.com/linaro-swg/optee_examples/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2020-01-24 60 61# OP-TEE - version 3.7.0 (2019-10-18) 62 63- Links to the release pages, commits and pull requests merged into this release for: 64 - OP-TEE/optee_os: [release page][OP_TEE_optee_os_release_3_7_0], [commits][OP_TEE_optee_os_commits_3_7_0] and [pull requests][OP_TEE_optee_os_pr_3_7_0] 65 - OP-TEE/optee_client: [release page][OP_TEE_optee_client_release_3_7_0], [commits][OP_TEE_optee_client_commits_3_7_0] and [pull requests][OP_TEE_optee_client_pr_3_7_0] 66 - OP-TEE/optee_test: [release page][OP_TEE_optee_test_release_3_7_0], [commits][OP_TEE_optee_test_commits_3_7_0] and [pull requests][OP_TEE_optee_test_pr_3_7_0] 67 - OP-TEE/build: [release page][OP_TEE_build_release_3_7_0], [commits][OP_TEE_build_commits_3_7_0] and [pull requests][OP_TEE_build_pr_3_7_0] 68 - linaro-swg/optee_examples: [release page][linaro_swg_optee_examples_release_3_7_0], [commits][linaro_swg_optee_examples_commits_3_7_0] and [pull requests][linaro_swg_optee_examples_pr_3_7_0] 69 70 71[OP_TEE_optee_os_release_3_7_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.7.0 72[OP_TEE_optee_os_commits_3_7_0]: https://github.com/OP-TEE/optee_os/compare/3.6.0...3.7.0 73[OP_TEE_optee_os_pr_3_7_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 74 75[OP_TEE_optee_client_release_3_7_0]: https://github.com/OP-TEE/optee_client/releases/tag/3.7.0 76[OP_TEE_optee_client_commits_3_7_0]: https://github.com/OP-TEE/optee_client/compare/3.6.0...3.7.0 77[OP_TEE_optee_client_pr_3_7_0]: https://github.com/OP-TEE/optee_client/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 78 79[OP_TEE_optee_test_release_3_7_0]: https://github.com/OP-TEE/optee_test/releases/tag/3.7.0 80[OP_TEE_optee_test_commits_3_7_0]: https://github.com/OP-TEE/optee_test/compare/3.6.0...3.7.0 81[OP_TEE_optee_test_pr_3_7_0]: https://github.com/OP-TEE/optee_test/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 82 83[OP_TEE_build_release_3_7_0]: https://github.com/OP-TEE/build/releases/tag/3.7.0 84[OP_TEE_build_commits_3_7_0]: https://github.com/OP-TEE/build/compare/3.6.0...3.7.0 85[OP_TEE_build_pr_3_7_0]: https://github.com/OP-TEE/build/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 86 87[linaro_swg_optee_examples_release_3_7_0]: https://github.com/linaro-swg/optee_examples/releases/tag/3.7.0 88[linaro_swg_optee_examples_commits_3_7_0]: https://github.com/linaro-swg/optee_examples/compare/3.6.0...3.7.0 89[linaro_swg_optee_examples_pr_3_7_0]: https://github.com/linaro-swg/optee_examples/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-07-05..2019-10-18 90 91# OP-TEE - version 3.6.0 (2019-07-05) 92 93- Link to the GitHub [release page][github_release_3_6_0]. 94- Links to the [commits][github_commits_3_6_0] and 95[pull requests][github_pr_3_6_0] merged into this release. 96 97[github_release_3_6_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.6.0 98[github_commits_3_6_0]: https://github.com/OP-TEE/optee_os/compare/3.5.0...3.6.0 99[github_pr_3_6_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-04-26..2019-07-05 100 101# OP-TEE - version 3.5.0 (2019-04-26) 102 103- Link to the GitHub [release page][github_release_3_5_0]. 104- Links to the [commits][github_commits_3_5_0] and 105[pull requests][github_pr_3_5_0] merged into this release. 106 107[github_release_3_5_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.5.0 108[github_commits_3_5_0]: https://github.com/OP-TEE/optee_os/compare/3.4.0...3.5.0 109[github_pr_3_5_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2019-01-26..2019-04-26 110 111# OP-TEE - version 3.4.0 (2019-01-25) 112 113- Link to the GitHub [release page][github_release_3_4_0]. 114- Links to the [commits][github_commits_3_4_0] and 115[pull requests][github_pr_3_4_0] merged into this release. 116 117[github_release_3_4_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.4.0 118[github_commits_3_4_0]: https://github.com/OP-TEE/optee_os/compare/3.3.0...3.4.0 119[github_pr_3_4_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-10-12..2019-01-25 120 121# OP-TEE - version 3.3.0 (2018-10-12) 122 123- Link to the GitHub [release page][github_release_3_3_0]. 124- Links to the [commits][github_commits_3_3_0] and 125[pull requests][github_pr_3_3_0] merged into this release. 126 127[github_release_3_3_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.3.0 128[github_commits_3_3_0]: https://github.com/OP-TEE/optee_os/compare/3.2.0...3.3.0 129[github_pr_3_3_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-07-04..2018-10-12 130 131# OP-TEE - version 3.2.0 (2018-07-04) 132 133- Link to the GitHub [release page][github_release_3_2_0]. 134- Links to the [commits][github_commits_3_2_0] and 135[pull requests][github_pr_3_2_0] merged into this release. 136 137## Known issues 138 139* HiKey960: assertion in bget create_free_block() \[memalign() self-test\] ([#2414]) 140* D02: assertion '!have_spinlock()' ([#2437]) 141 142[github_commits_3_2_0]: https://github.com/OP-TEE/optee_os/compare/3.1.0...3.2.0 143[github_pr_3_2_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-04-13..2018-07-04 144[github_release_3_2_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.2.0 145[#2414]: https://github.com/OP-TEE/optee_os/issues/2414 146[#2437]: https://github.com/OP-TEE/optee_os/issues/2437 147 148# OP-TEE - version 3.1.0 (2018-04-13) 149 150- Link to the GitHub [release page][github_release_3_1_0]. 151- Links to the [commits][github_commits_3_1_0] and 152[pull requests][github_pr_3_1_0] merged into this release. 153 154[github_commits_3_1_0]: https://github.com/OP-TEE/optee_os/compare/3.0.0...3.1.0 155[github_pr_3_1_0]: https://github.com/OP-TEE/optee_os/pulls?q=is%3Apr+is%3Amerged+base%3Amaster+merged%3A2018-01-26..2018-04-13 156[github_release_3_1_0]: https://github.com/OP-TEE/optee_os/releases/tag/3.1.0 157 158# OP-TEE - version 3.0.0 (2018-01-26) 159 160[Link][github_commits_3_0_0] to a list of all commits between this release and 161the previous one (2.6.0). 162 163About backwards compatibility: Trusted Applications built with OP-TEE 2.5.0 or 164earlier will not run properly with a *debug* build of this release due 165to commit [0e1c6e8e][commit_0e1c6e8e] ("Dump call stack on TA panic"). 166Non-debug builds are not affected. 167 168## New features 169 170* New supported platforms: Armada 3700 ([#1946]), Poplar ([#1999]), 64-bit 171 support for FSL ls1012ardb ([#1941]), i.MX6SX Sabreauto ([#1974]). 172* arm32: sm: init CNTVOFF ([#2052]) 173* Debug/info/error traces: make output more compact ([#2011]) 174* tzc380: implement new functions ([#1994]) 175* Secure Data Path: add pseudo-TA to convert VA to PA (#1993]) 176* Pager: use NEON AES GCM implementation ([#1959]) 177* Crypto: add optimized AES GCM implementation using NEON ([#1949]) 178* Add support for using secure storage for TA anti-rollback ([#1928]) 179* Crypto: replace struct crypto_ops with function interface ([#1923], 180 [#1931]) 181* aosp_optee.mk: define OPTEE_BIN ([#1922]) 182* Add build option to allow concurrent execution of single-instance TAs 183 ([#1915]) 184* Pager: support for address sanitizer ([#1856]) 185* Pager: make memory between CFG_TEE_RAM_START and TEE load address usable by 186 pager ([#1826]) 187 188## Bug fixes 189 190* Fix crash in tee_mmu_final() on TA loading error ([#2092]) 191* LibTomCrypt: fix issue causing invalid output when using AES CTR with 192hardware acceleration (CFG_CRYPTO_WITH_CE) ([#2086]) 193* pl310: fix cache sync ([#2035]) 194* tzc380: do not write reserved bits ([#1994]) 195* Fix potential double free in ta_open() ([#1970]) 196* libfdt: fix undefined behaviour in fdt_offset_ptr() ([#1969]) 197* imx_wdog: fix register access ([#1966]) 198* Secure storage: fix potential memory leak after early return ([#1961]) 199* LibTomCrypt: fix double free in dsa_import() ([#1963]) 200* RPMB: fix TA independance issue in secure storage ([#1921]) 201* RPMB: return TEE_ERROR_ACCESS_CONFLICT instead of panicking when a TA 202 attempts to create an existing persistent object without the overwrite flag 203 ([#1919]) 204* PSCI: pass non-secure context to psci_system_suspend() ([#1916]) 205* Fix "Argument list too long" during "make clean" ([#1897]) 206 207## Security fixes 208 209* Mitigations and hardening against the Spectre and Meltdown vulnerabilities 210 (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754). 211 212## Known issues 213 214* Secure storage (REE FS): storage size not updated after 215TEE_TruncateObjectData() ([#2094]) 216* Possible deadlock with CFG_WITH_PAGER=y when loading a TA and not enough 217page tables are available in pgt_cache ([#2080]) 218 219## Tested on 220 221The release was tested successfully on the platforms listed below. 222 223<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 224* d02 225* hikey 226* hikey-hikey960 227* imx-mx6ulevk 228* imx-mx7dsabresd 229* marvell-armada7k8k 230* marvell-armada3700 231* mediatek-mt8173 232* rcar-salvator_m3 233* rockchip-rk322x 234* rpi3 235* sam 236* ti 237* vexpress-juno 238* vexpress-qemu_armv8a 239* vexpress-qemu_virt 240 241[commit_0e1c6e8e]: https://github.com/OP-TEE/optee_os/commit/0e1c6e8e 242[github_commits_3_0_0]: https://github.com/OP-TEE/optee_os/compare/2.6.0...3.0.0 243[#2092]: https://github.com/OP-TEE/optee_os/pull/2092 244[#2086]: https://github.com/OP-TEE/optee_os/pull/2086 245[#2094]: https://github.com/OP-TEE/optee_os/issues/2094 246[#2080]: https://github.com/OP-TEE/optee_os/issues/2080 247[#2052]: https://github.com/OP-TEE/optee_os/pull/2052 248[#2035]: https://github.com/OP-TEE/optee_os/pull/2035 249[#2011]: https://github.com/OP-TEE/optee_os/pull/2011 250[#1999]: https://github.com/OP-TEE/optee_os/pull/1999 251[#1994]: https://github.com/OP-TEE/optee_os/pull/1994 252[#1993]: https://github.com/OP-TEE/optee_os/pull/1993 253[#1974]: https://github.com/OP-TEE/optee_os/pull/1974 254[#1970]: https://github.com/OP-TEE/optee_os/pull/1970 255[#1969]: https://github.com/OP-TEE/optee_os/pull/1969 256[#1966]: https://github.com/OP-TEE/optee_os/pull/1966 257[#1963]: https://github.com/OP-TEE/optee_os/pull/1963 258[#1961]: https://github.com/OP-TEE/optee_os/pull/1961 259[#1959]: https://github.com/OP-TEE/optee_os/pull/1959 260[#1949]: https://github.com/OP-TEE/optee_os/pull/1949 261[#1946]: https://github.com/OP-TEE/optee_os/pull/1946 262[#1941]: https://github.com/OP-TEE/optee_os/pull/1941 263[#1931]: https://github.com/OP-TEE/optee_os/pull/1931 264[#1928]: https://github.com/OP-TEE/optee_os/pull/1928 265[#1923]: https://github.com/OP-TEE/optee_os/pull/1923 266[#1922]: https://github.com/OP-TEE/optee_os/pull/1922 267[#1921]: https://github.com/OP-TEE/optee_os/pull/1921 268[#1919]: https://github.com/OP-TEE/optee_os/pull/1919 269[#1916]: https://github.com/OP-TEE/optee_os/pull/1916 270[#1915]: https://github.com/OP-TEE/optee_os/pull/1915 271[#1897]: https://github.com/OP-TEE/optee_os/pull/1897 272[#1856]: https://github.com/OP-TEE/optee_os/pull/1856 273[#1826]: https://github.com/OP-TEE/optee_os/pull/1826 274 275# OP-TEE - version 2.6.0 276 277[Link][github_commits_2_6_0] to a list of all commits between this release and 278the previous one (2.5.0). 279 280## New features 281 282* New supported platforms: Atmel SAMA5 ([#1714]), HiSilicon HiKey960 ([#1684]), 283 Rockchip RK322X ([#1666]), NXP LS1043A-RDB/LS1046A-RDB ([#1787]), Marvell 284 Armada 70x0/80x0 ([#1807]). 285* Dynamic shared memory (non-contiguous, non-secure memory can be mapped into 286 Trusted Applications VA space) ([#1631]) 287* Dump TA call stack on panic ([#1858]) 288* i.MX: PSCI reset ([#1849]) 289* plat-ti: AM43xx: suspend/resume support ([#1822]) 290* QEMU SMP support ([#1820]) 291* plat-ti: AM43xx: disable TRNG ([#1816]) 292* plat-ti: enable Secure Data Path by default ([#1815]) 293* Improve symbolize.py ([#1778], [#1767], [#1766]) 294* Early TAs (TAs linked in tee.bin) ([#1733]) 295* Suspend/resume framework for arm32 and imx7d support ([#1729]) 296* RK322X PSCI version, features and suspend support ([#1720]) 297* arm32: handle aborts in system mode ([#1703]) 298* i.MX: add SNVS SRTC support ([#1700]) 299* GCC7 support ([#1693]) 300* Improve detection of programming errors in locking code ([#1671], [#1670]) 301* Support TEE RAM size larger than page directory size ([#1669]) 302 303## Removed features 304 305* Remove TUI code ([#1842]) 306 307## Bug fixes 308 309* Add missing synchronization barrier in core_mmu_map_pages() ([#1827]) 310* Secure storage: REE FS: fix bug in error path ([#1801]) 311* ASAN bug fixes ([#1799]) 312* Fix race in core_mmu_user_mapping_is_active() ([#1785]) 313* libutee: printf() and puts() fixes, add putchar() ([#1759], [#1754]) 314* arm32: GICv3: fix FIQ masking in IRQ/ABT/SVC/UND handlers ([#1748]) 315* arm32: preserve r12 in native_intr_handler() ([#1682]) 316* arm64: fix print_kernel_stack() ([#1664]) 317* benchmark: fix core data-abort ([#1658]) 318 319## Security fixes or enhancements 320 321* crypto: fix software PRNG weaknesses 322 ([OP-TEE-2017-0001][OP-TEE-2017-0001]) ([#1843]) 323 324## Tested on 325 326The release was tested successfully on the platforms listed below. 327If a platform is not listed, it means the release was not tested on this 328platform. 329 330<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 331* d02 332* hikey 333* hikey-hikey960 334* imx-mx6ulevk 335* imx-mx7dsabresd 336* ls-ls1021a??? (single core) 337* ls-ls1043ardb 338* ls-ls1046ardb 339* mediatek-mt8173 340* rcar 341* rockchip-rk322x 342* rpi3 343* sam 344* stm-b2260 345* stm-cannes 346* ti-??? 347* vexpress-fvp 348* vexpress-juno 349* vexpress-qemu_armv8a 350* vexpress-qemu_virt 351 352[github_commits_2_6_0]: https://github.com/OP-TEE/optee_os/compare/2.5.0...2.6.0 353[#1858]: https://github.com/OP-TEE/optee_os/issues/1858 354[#1849]: https://github.com/OP-TEE/optee_os/issues/1849 355[#1843]: https://github.com/OP-TEE/optee_os/issues/1843 356[#1842]: https://github.com/OP-TEE/optee_os/issues/1842 357[#1827]: https://github.com/OP-TEE/optee_os/issues/1827 358[#1822]: https://github.com/OP-TEE/optee_os/issues/1822 359[#1820]: https://github.com/OP-TEE/optee_os/issues/1820 360[#1816]: https://github.com/OP-TEE/optee_os/issues/1816 361[#1815]: https://github.com/OP-TEE/optee_os/issues/1815 362[#1807]: https://github.com/OP-TEE/optee_os/issues/1807 363[#1801]: https://github.com/OP-TEE/optee_os/issues/1801 364[#1799]: https://github.com/OP-TEE/optee_os/issues/1799 365[#1787]: https://github.com/OP-TEE/optee_os/issues/1787 366[#1785]: https://github.com/OP-TEE/optee_os/issues/1785 367[#1778]: https://github.com/OP-TEE/optee_os/issues/1778 368[#1767]: https://github.com/OP-TEE/optee_os/issues/1767 369[#1766]: https://github.com/OP-TEE/optee_os/issues/1766 370[#1759]: https://github.com/OP-TEE/optee_os/issues/1759 371[#1754]: https://github.com/OP-TEE/optee_os/issues/1754 372[#1748]: https://github.com/OP-TEE/optee_os/issues/1748 373[#1733]: https://github.com/OP-TEE/optee_os/issues/1733 374[#1729]: https://github.com/OP-TEE/optee_os/issues/1729 375[#1720]: https://github.com/OP-TEE/optee_os/issues/1720 376[#1714]: https://github.com/OP-TEE/optee_os/issues/1714 377[#1703]: https://github.com/OP-TEE/optee_os/issues/1703 378[#1700]: https://github.com/OP-TEE/optee_os/issues/1700 379[#1693]: https://github.com/OP-TEE/optee_os/issues/1693 380[#1684]: https://github.com/OP-TEE/optee_os/issues/1684 381[#1682]: https://github.com/OP-TEE/optee_os/issues/1682 382[#1671]: https://github.com/OP-TEE/optee_os/issues/1671 383[#1670]: https://github.com/OP-TEE/optee_os/issues/1670 384[#1669]: https://github.com/OP-TEE/optee_os/issues/1669 385[#1666]: https://github.com/OP-TEE/optee_os/issues/1666 386[#1664]: https://github.com/OP-TEE/optee_os/issues/1664 387[#1658]: https://github.com/OP-TEE/optee_os/issues/1658 388[#1631]: https://github.com/OP-TEE/optee_os/issues/1631 389[OP-TEE-2017-0001]: https://www.op-tee.org/security-advisories/ 390 391# OP-TEE - version 2.5.0 392 393[Link][github_commits_2_5_0] to a list of all commits between this release and 394the previous one (2.4.0). 395 396## New features 397 398* New supported platform: i.MX7D ([#1639]) 399* Secure storage: anti-rollback protection for REE FS using RPMB FS ([#1630]) 400* Assign non-secure DDR configuration from DT if CFG_DT=y ([#1623]) 401* Add new image format: split image into three separate binaries suitable for 402 upcoming ARM Trusted Firmware ([#1589]). 403* Make alignment check configurable ([#1586]) 404* drivers: add TZC380 driver ([#1578]) 405* plat-imx: PSCI CPU off ([#1577]) 406* 64-bit paging on QEMU v8 and HiKey ([#1575], [#1592]) 407* Benchmark framework ([#1365]) 408* Dump call stack of user TAs on abort ([#1552]) 409* plat-hikey: enable Secure Data Path ([#1440]) 410* Add interface to load and decrypt/authenticate user TAs ([#1513]) 411* plat-ti: add secure paging support ([#1493]) 412* plat-ti: add OTP hardware key support ([#1492]) 413* Support ARM GICv3 ([#1465]) 414 415## Removed features 416 417* stm-orly2 is not supported anymore ([#1650]) 418* Remove secure storage based on SQL FS (`CFG_SQL_FS=y`) ([#1490]) 419* Remove support for mapping user TAs with 1 MiB or 2 MiB granularity 420 (`CFG_SMALL_PAGE_USER_TA=n`) ([#1559]). TAs are always mapped using small 421 pages. 422 423## Bug fixes 424 425* Reduce size of non-pageable code ([#1621]) 426* Ignore `TA_FLAG_MULTI_SESSION` and `TA_FLAG_INSTANCE_KEEP_ALIVE` when 427 `TA_FLAG_SINGLE_INSTANCE` is not set ([#1574]) 428* libutee: remove buffering for AES GCM (PR#1573) and AES CTR ([#1580]) 429* Fix ROUNDUP()/ROUNDDOWN() macros ([#1519]) 430* Do not touch other bits in GICD_CTLR ([#1508]) 431* Fix build issue with `DEBUG=y` and `CFG_TEE_CORE_LOG_LEVEL=0` ([#1502]) 432* crypto: do not restrict hash size when algorithm is ECDSA ([#1497]) 433 434## Security fixes or enhancements 435 436- crypto: fix RSA key leakage after fault injection attack 437 ([OP-TEE-2016-0003][OP-TEE-2016-0003]) ([#1610]) 438* crypto: fix RSA key leakage after side channel attack 439 ([OP-TEE-2016-0002][OP-TEE-2016-0002]) ([#1610]) 440* Make pager aliased pages not always writable ([#1551]) 441* Support for no-exec RO and RW data ([#1459], [#1550]) 442 443## New issues 444 445* armv7: some platform-specific code (`plat_cpu_reset_early()`) overwrites 446SCTLR bits configured by generic code. This affects alignment checks (`SCTLR.A`) 447and write-implies-no-exec (`SCTLR.WXN`, `SCTLR.UWXN`), which can therefore not 448be configured via the compile-time `CFG_` variables. 449* armv7: plat-imx: Cortex-A9 cores should enable branch prediction (`SCLTR.Z`) 450for improved performance. 451* [#1656] qemu_armv8a: init hangs when secure data path and pager are both 452 enabled. 453 454## Tested on 455 456In the list below, _standard_ means that the `xtest` program passed with 457its default configuration, while _extended_ means it was run successfully 458with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 459v1.1.0.4. 460 461If a platform is not listed, it means the release was not tested on this 462platform. 463 464<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 465* d02: extended 466* hikey: extended 467* imx-mx6ulevk: standard 468* imx-mx6ullevk: standard 469* imx-mx7dsabresd: standard 470* ls-ls1021atwr: standard 471* mediatek-mt8173: standard 472* rcar-h3: standard 473* rpi3: standard 474* stm-b2260: extended 475* stm-cannes: extended 476* ti-am43xx: standard 477* ti-am57xx: standard 478* ti-dra7xx: standard 479* vexpress-fvp: standard 480* vexpress-juno: standard 481* vexpress-qemu_armv8a: standard 482* vexpress-qemu_virt: standard 483 484[github_commits_2_5_0]: https://github.com/OP-TEE/optee_os/compare/2.4.0...2.5.0-rc1 485[#1656]: https://github.com/OP-TEE/optee_os/issues/1656 486[#1650]: https://github.com/OP-TEE/optee_os/pull/1650 487[#1639]: https://github.com/OP-TEE/optee_os/pull/1639 488[#1630]: https://github.com/OP-TEE/optee_os/pull/1630 489[#1623]: https://github.com/OP-TEE/optee_os/pull/1623 490[#1621]: https://github.com/OP-TEE/optee_os/pull/1621 491[#1610]: https://github.com/OP-TEE/optee_os/pull/1610 492[#1592]: https://github.com/OP-TEE/optee_os/pull/1592 493[#1589]: https://github.com/OP-TEE/optee_os/pull/1589 494[#1586]: https://github.com/OP-TEE/optee_os/pull/1586 495[#1580]: https://github.com/OP-TEE/optee_os/pull/1580 496[#1578]: https://github.com/OP-TEE/optee_os/pull/1578 497[#1577]: https://github.com/OP-TEE/optee_os/pull/1577 498[#1574]: https://github.com/OP-TEE/optee_os/pull/1574 499[#1559]: https://github.com/OP-TEE/optee_os/pull/1559 500[#1551]: https://github.com/OP-TEE/optee_os/pull/1551 501[#1550]: https://github.com/OP-TEE/optee_os/pull/1550 502[#1519]: https://github.com/OP-TEE/optee_os/pull/1519 503[#1502]: https://github.com/OP-TEE/optee_os/pull/1502 504[#1365]: https://github.com/OP-TEE/optee_os/pull/1365 505[#1552]: https://github.com/OP-TEE/optee_os/pull/1552 506[#1513]: https://github.com/OP-TEE/optee_os/pull/1513 507[#1508]: https://github.com/OP-TEE/optee_os/pull/1508 508[#1493]: https://github.com/OP-TEE/optee_os/pull/1493 509[#1497]: https://github.com/OP-TEE/optee_os/pull/1497 510[#1492]: https://github.com/OP-TEE/optee_os/pull/1492 511[#1490]: https://github.com/OP-TEE/optee_os/pull/1490 512[#1465]: https://github.com/OP-TEE/optee_os/pull/1465 513[#1459]: https://github.com/OP-TEE/optee_os/pull/1459 514[#1440]: https://github.com/OP-TEE/optee_os/pull/1440 515[OP-TEE-2016-0003]: https://www.op-tee.org/security-advisories/ 516[OP-TEE-2016-0002]: https://www.op-tee.org/security-advisories/ 517 518# OP-TEE - version 2.4.0 519 520[Link][github_commits_2_4_0] to a list of all commits between this release and 521the previous one (2.3.0). 522 523Please note: this release is API-compatible with the previous one, but the 524Secure Storage internal format for the REE and SQL FS is not compatible due to 525commits [a238b74][commit_a238b74] ("core: REE FS: use the new hash tree 526interface") and [44e900e][commit_44e900e] ("core: SQL FS: use the new hash tree 527interface"). 528 529## New features 530 531* Add porting guidelines 532 533* Add support for Secure Data Path which allows Client and Trusted Applications 534 to share references to secure memory 535 536* New supported platform: Texas Instruments AM57xx (`PLATFORM=ti-am57xx`) 537 538* ARMv7-A: add support for platform services in secure monitor and add these 539 services for the DRA7xx platform 540 541* SPI framework and PL022 driver cleanup and improvements 542 543* Use CNTPCT (when available) to add entropy to the software PRNG 544 545* Add GlobalPlatform Socket API for UDP and TCP (IPv4 and IPv6) 546 547* DRA7: add TRNG driver, enable GICv2 driver 548 549* Support load address larger than 4G 550 551* libutee: preserve error code when calling TEE_Panic() for easier 552 troubleshooting 553 554* Support TA profiling with gprof (-pg compiler switch) 555 556* Optimize the ELF loader for TAs when pager is enabled 557 558* Update documentation 559 560* Add paged secure shared memory that can be transferred between TAs as 561 needed 562 563* Introduce MOBJ abstraction 564 565* i.MX6: add PSCI "on" function 566 567* arm32: introduce PSCI framework 568 569## Bug fixes 570 571* Secure storage: improve integrity checking of the REE and SQL filesystems by 572 adding a hash tree on the internal data structures. Any external modification 573 is detected, except full rollback. Fixes [#1188][issue1188]. 574 575* The linux driver will set the 'privileged' flag (TEE_GEN_CAP_PRIVILEGED) on 576 the device intended for use by tee-supplicant. Fixes [#1199][issue1199]. 577 578* RPMB: don't try to program the RPMB key by default 579 580* Fix "make clean" error cases 581 582* Fix issue when resetting persistent storage enumerator [#1332][issue1332] 583 584* Fix TA panic when doing AES CTS with specific buffer sizes 585 [#1203][issue1203]. 586 587## Known issues 588 589* On RPi3 xtest sometimes stall (rcu_sched self-detected stall on CPU) [#1353][issue1353] 590* For multi-core PSCI support is to be added for ls1021atwr in OP-TEE. 591* USB keyboard cannot be used to stop the u-boot timeout ([build issue131]). 592* Travis service (build.git) seems unstable from time to time. 593 594## Tested on 595 596In the list below, _standard_ means that the `xtest` program passed with 597its default configuration, while _extended_ means it was run successfully 598with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 599v1.1.0.4. 600 601If a platform is not listed, it means the release was not tested on this 602platform. 603 604<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 605* d02: extended 606* hikey: extended 607* imx-mx6ulevk: standard 608* ls-ls1021atwr: standard (single core) 609* mediatek-mt8173: standard 610* rcar-h3: standard 611* rpi3: standard 612* stm-b2260: extended 613* ti-dra7xx: standard 614* vexpress-fvp: standard 615* vexpress-juno: standard 616* vexpress-qemu_armv8a: standard 617* vexpress-qemu_virt: standard 618* zynqmp-zc1751_dc1: standard 619* zynqmp-zc1751_dc2: standard 620* zynqmp-zcu102: standard 621 622[github_commits_2_4_0]: https://github.com/OP-TEE/optee_os/compare/2.3.0...2.4.0 623[issue1332]: https://github.com/OP-TEE/optee_os/issues/1332 624[issue1353]: https://github.com/OP-TEE/optee_os/issues/1353 625[build issue131]: https://github.com/OP-TEE/build/issues/131 626[commit_a238b74]: https://github.com/OP-TEE/optee_os/commit/a238b744b1b3 627[commit_44e900e]: https://github.com/OP-TEE/optee_os/commit/44e900eabfc1 628 629# OP-TEE - version 2.3.0 630 631[Link][github_commits_2_3_0] to a list of all commits between this release and 632the previous one (2.2.0). 633 634Please note: this release is API-compatible with the previous one, but the 635Secure Storage internal format for the REE FS is not compatible due to commit 636[361fb3e][commit_361fb3e] ("core: REE FS: use a single file per object"). 637 638[commit_361fb3e]: https://github.com/OP-TEE/optee_os/commit/361fb3e 639 640## New features 641 642* New supported platform: Xilinx Zynq 7000 ZC702 (`PLATFORM=zynq7k-zc702`) 643 644* Add debug assertions to spinlocks and mutexes 645 646* Add more CP15 register access macros for Cortex-A9 647 648* ARMv7-A: redesign secure monitor to make it easier to register services 649 650* ARMv7-A: cleanup boot arguments 651 652* libutee: extend `TEE_CheckMemoryAccessRights()` with 653 `TEE_MEMORY_ACCESS_SECURE` and `TEE_MEMORY_ACCESS_NONSECURE` 654 655* plat-hikey: enable SPI by default and add sample test code 656 657* Consider `CFLAGS_ta_arm64` and `CFLAGS_ta_arm32` when building TAs 658 659* Secure storage refactoring 660 - Simplify interface with tee-supplicant. Minimize round trips with normal 661 world, especially by adding a cache for FS RPC payload data. 662 - REE FS: use a single file per object, remove block cache. 663 664* Print call stack in panic() 665 666## Bug fixes 667 668* Fix UUID encoding when communicating with normal world (use big endian 669 mode instead of native endianness). Related to this, the string format 670 for UUIDs has changed in tee-supplicant, so that TA file names now follow 671 the format defined in RFC4122 (a missing hyphen was added). The old format 672 is still supported, but deprecated, and will likely be removed with the 673 next major release. 674 675* Drop write permission to non-writable ELF segments after TA loading is 676 complete. 677 678* mm: fix confusing memory mapping debug traces 679 680* plat-ti: fix issues with MMU mapping 681 682* crypto: fix clearing of big numbers 683 684* build: allow spaces and double quotes in CFG_ variables 685 686* mm: use paddr_t to support both 32- and 64-bit architectures properly. 687 Resolves 32-bit truncation error when pool is at top of 32 bit address 688 space on 64-bit architecture. 689 690* plat-stm: support pager. Fix pager on ARMv7-A SMP boards. 691 692* Fix debug output of Trusted Applications (remove "ERROR: TEE-CORE:" prefix) 693 694* Do not consider TA memref parameters as TA private memory 695 696* crypto: fix `cipher_final()` which would not call `cbc_done()` for CBC_MAC 697 algorithms 698 699* fix for 16-way PL310 700 701* arm32: fix call stack unwinding (`print_stack()`) 702 703* arm32: fix spinlock assembly code 704 705* plat-stm, plat-imx: fix SCR initalization 706 707* Fix user L1 MMU entries calculation (non-LPAE), allowing TTBCR.N values 708 other than 7. 709 710* mtk-mt8173: fix panic caused by incorrect size of SHMEM 711 712* plat-stm: fix RNG driver (non-flat mapping) 713 714## Known issues 715 716* New issues open on GitHub 717 * [#1203][issue1203] AES-CTS mode will fail when inlen=0x100, in_incr=0x80 718 * [#1199][issue1199] Both tee and teepriv reported GlobalPlatform compliant 719 * [#1188][issue1188] Secure storage (SQL FS and REE FS): blocks not tied to 720 current meta header 721 * [#1172][issue1172] paddr_t should be larger than 32 bits when 722 CFG_WITH_LPAE is enabled 723 724## Tested on 725 726In the list below, _standard_ means that the `xtest` program passed with 727its default configuration, while _extended_ means it was run successfully 728with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 729v1.1.0.4. 730 731If a platform is not listed, it means the release was not tested on this 732platform. 733 734<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 735* d02: extended 736* hikey: extended 737* imx-mx6ulevk: standard 738* ls-ls1021atwr: standard 739* mediatek-mt8173: standard 740* rcar-h3: standard 741* rpi3: standard 742* stm-b2260: extended 743* stm-cannes: extended 744* ti-dra7xx: standard 745* vexpress-fvp: standard 746* vexpress-juno: standard 747* vexpress-qemu_armv8a: standard 748* vexpress-qemu_virt: extended 749* zynqmp-zcu102: standard 750 751[github_commits_2_3_0]: https://github.com/OP-TEE/optee_os/compare/2.2.0...2.3.0 752[issue1172]: https://github.com/OP-TEE/optee_os/issues/1172 753[issue1188]: https://github.com/OP-TEE/optee_os/issues/1188 754[issue1199]: https://github.com/OP-TEE/optee_os/issues/1199 755[issue1203]: https://github.com/OP-TEE/optee_os/issues/1203 756 757# OP-TEE - version 2.2.0 758 759[Link][github_commits_2_2_0] to a list of all commits between this release and 760the previous one (2.1.0). 761 762Please note: this release is API-compatible with the previous one, but the 763Secure Storage internal format is not compatible due to commit 764[fde4a75][commit_fde4a75] ("storage: encrypt the FEK with a TA-specific key"). 765 766[commit_fde4a75]: https://github.com/OP-TEE/optee_os/commit/fde4a75 767 768## New features 769 770* New supported platforms: 771 * Freescale i.MX6 Quad SABRE Lite & SD 772 * HiSilicon D02 773 * Raspberry Pi3 774 * Renesas RCAR H3 775 * STMicroelectronics b2260 - h410 776 777* Pager: Support paging of read/write pages by encrypting them with AES-GCM. 778 Support paging of user TAs. Add global setting for TZSRAM size 779 (CFG_CORE_TZSRAM_EMUL_SIZE), defaults to 300K. 780 781* Support for more than 8 CPU cores 782 783* Added SPI framework and PL022 driver 784 785* GPIO: framework supports multiple instances, PL061 driver now has get/set 786 interrupt and mode control functions 787 788* Secure storage: Encrypt the File Encryption Key with a TA-specific key for 789 better TA isolation. Add build-time and run-time support for multiple storage 790 backends. Add SQLite backend. 791 792* Trusted User Interface: some code is introduced to support the implementation 793 of TUI. This includes: a generic framebuffer driver, display and serial 794 abstractions, and drivers for PL111 (LCD) / PL050 (KMI) / TZC400 and PS2 795 mouse. 796 797* AES acceleration using ARMv8-A Cryptographic Extensions instructions is 798 now supported in AArch32 mode 799 800* Add support for GCC flags: -fsanitize=undefined and -fsanitize=kernel-address 801 802* Use a global setting for core heap size (CFG_CORE_HEAP_SIZE), 64K by default. 803 804* Add macros to unwind and print the call stack of TEE core 805 806* Libtomcrypt: sync with the latest `develop` branch. 807 808* The Trusted Application SDK (ta_dev_kit.mk) can produce libraries (.a) 809 810* Rework assertions and TEE core panics and properly honor NDEBUG 811 812## Bug fixes 813 814* Fix incorrect algorithm passed to cipher.final() 815 816* scripts: support Python 2.x and 3.x 817 818* Secure storage: Add proper locking to support concurrent access. Fix sign 819 extension bug with offset parameter of syscall storage_obj_seek which could 820 cause errors in Aarch32 mode. Fix reading beyond end of file. 821 822* Aarch64: mask all maskable exceptions before doing a normal return from call. 823 824* Device Tree: add no-map property to OP-TEE node in reserved-memory. 825 826* LibTomcrypt: fix CVE-2016-6129 827 828## Known issues 829 830* New issues open on GitHub 831 * [#1093][issue1093] rcar-h3: xtest 6010 hangs 832 * [#1092][issue1092] rcar-h3: xtest 4010 fails 833 * [#1081][issue1081] Bad mapping of TA secure memref parameters 834 * [#1071][issue1071] __data_end may not correctly represent text start position when using CFG_WITH_PAGER 835 * [#1069][issue1069] armv7/Aarch32: crash in stack unwind (DPRINT_STACK()) 836 837## Tested on 838 839In the list below, _standard_ means that the `xtest` program passed with 840its default configuration, while _extended_ means it was run successfully 841with the additional GlobalPlatform™ TEE Initial Configuration Test Suite 842v1.1.0.4. 843 844If a platform is not listed, it means the release was not tested on this 845platform. 846 847<!-- ${PLATFORM}-${PLATFORM_FLAVOR}, ordered alphabetically --> 848* d02: extended 849* hikey: extended 850* imx-mx6qsabrelite: standard 851* imx-mx6qsabresd: standard 852* rcar-h3: standard, pass except issues [#1092][issue1092] and [#1093][issue1093] 853* rpi3: standard 854* stm-b2260: standard 855* stm-cannes: standard 856* ti-dra7xx: standard 857* vexpress-fvp: standard 858* vexpress-juno: standard 859* vexpress-qemu_armv8a: standard 860* vexpress-qemu_virt: extended 861* zynqmp-zcu102: standard 862 863[github_commits_2_2_0]: https://github.com/OP-TEE/optee_os/compare/2.1.0...2.2.0 864[issue1081]: https://github.com/OP-TEE/optee_os/issues/1081 865[issue1071]: https://github.com/OP-TEE/optee_os/issues/1071 866[issue1069]: https://github.com/OP-TEE/optee_os/issues/1069 867[issue1092]: https://github.com/OP-TEE/optee_os/issues/1092 868[issue1093]: https://github.com/OP-TEE/optee_os/issues/1093 869 870# OP-TEE - version 2.1.0 871 872## New features 873 874* New supported platforms: 875 * Xilinx Zynq UltraScale+ MPSOC 876 * Spreadtrum SC9860 877 878* GCC5 support 879 880* Non Linear Mapping support: In OP-TEE kernel mode, the physical to virtual 881 addresses was linear until this release, meaning the virtual addresses 882 were equal to the physical addresses. This is no more the case in this 883 release. 884 885* Font rendering routines have been introduced in order to ease an 886 implementation of Trusted UI. 887 888* File Storage: Possibility to use the normal world filesystem and the RPMB 889 implementations simultaneously. 890 891* AOSP: There is a [local manifest][aosp_local_manifest] to build OP-TEE into an AOSP build, running on HiKey. 892 Please refer to the README in that repo for instructions. 893 894* OpenEmbedded: In addition to the makefile-based build described in the optee_os README, there is an 895 [OpenEmbedded-based build][oe_build] that supports Qemu (32-bit), FVP (64-bit), and HiKey (64-bit). 896 Please refer to the README in that repo for instructions. 897 898* [Link][github_commits_2_1_0] to a list of all commits between this and 899 previous release. 900 901 902## Tested on 903Definitions: 904 905| Type | Meaning | 906| ---- | ------- | 907| Standard tests | The [optee_test][optee_test] project. | 908| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 909 910* ARM Juno Board (vexpress-juno), standard. 911* Foundation Models (vexpress-fvp), standard tests + extended tests, 912 using FVP ARM V8 Foundation Platformr0p0 (platform build 10.0.37) 913* FSL i.MX6 UltraLite EVK (imx), standard. 914* FSL ls1021a (ls-ls1021atwr), standard tests. 915* HiKey (hikey), standard + extended tests. 916* QEMU (vexpress-qemu), standard + extended tests. 917* Xilinx Zynq UltraScale+ MPSOC, standard tests 918 919Note that the following platform has not been tested: 920* MTK8173-EVB (mediatek-mt8173) 921 922 923## Known issues 924* Issue(s) open on GitHub 925 * [#868][pr868]: python-wand font generation sometimes times out 926 * [#863][pr863]: "double free or corruption" error when building optee_os 927 * [#858][pr858]: UUIDs in binary format have wrong endinanness 928 * [#857][pr857]: Formatting of UUIDs is incorrect 929 * [#847][pr847]: optee_os panic(TEE-CORE: Assertion) 930 * [#838][pr838]: TUI font rendering is _very_ slow 931 * [#814][pr814]: Persistent objects : save informations after close 932 * [#665][pr665]: xtest 1013 stalled on HiKey when log levels are 4 and optee_os is on its own UART 933 * [#506][pr506]: tee-supplicant panic & ta panic 934 935[github_commits_2_1_0]: https://github.com/OP-TEE/optee_os/compare/2.0.0...2.1.0 936[pr868]: https://github.com/OP-TEE/optee_os/issues/868 937[pr863]: https://github.com/OP-TEE/optee_os/issues/863 938[pr858]: https://github.com/OP-TEE/optee_os/issues/858 939[pr857]: https://github.com/OP-TEE/optee_os/issues/857 940[pr847]: https://github.com/OP-TEE/optee_os/issues/847 941[pr838]: https://github.com/OP-TEE/optee_os/issues/838 942[pr814]: https://github.com/OP-TEE/optee_os/issues/814 943[pr665]: https://github.com/OP-TEE/optee_os/issues/665 944[aosp_local_manifest]: https://github.com/linaro-swg/optee_android_manifest 945[oe_build]: https://github.com/linaro-swg/oe-optee 946 947# OP-TEE - version 2.0.0 948 949## New features 950 951* Generic driver: A new generic TEE driver is in the process of being 952 [upstreamed][gendrv_v9]. 953 In this release, [OP-TEE/optee_linuxdriver][optee_linuxdriver] is no more used. 954 Instead, linux v4.5 is being patched using the proposed Generic TEE Driver, 955 as it can be found in [https://github.com/linaro-swg/linux/tree/optee][linux_optee] 956 957* RPMB support: Secure Storage can now use Replay Protected Memory Block (RPMB) partition 958 of an eMMC device. Check the [full documentation][rpmb_doc] 959 960* Hard-float ABI is now available. 961 962* [Link][github_commits_2_0_0] to a list of all commits between this and 963 previous release. 964 965 966## Tested on 967Definitions: 968 969| Type | Meaning | 970| ---- | ------- | 971| Standard tests | The [optee_test][optee_test] project. | 972| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 973 974* ARM Juno Board (vexpress-juno), standard. 975* Foundation Models (vexpress-fvp), standard tests + extended tests, 976 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 977* FSL ls1021a (ls-ls1021atwr), standard. 978* HiKey (hikey), standard. 979* MTK8173-EVB (mediatek-mt8173), standard. 980* QEMU (vexpress-qemu), standard + extended tests. 981* STM Cannes (stm-cannes), standard + extended tests. 982 983## Known issues 984* Issue(s) open on GitHub 985 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 986 * [#506][pr506]: tee-supplicant panic & ta panic 987 988[github_commits_2_0_0]: https://github.com/OP-TEE/optee_os/compare/1.1.0...2.0.0 989[rpmb_doc]: https://github.com/OP-TEE/optee_os/blob/master/documentation/secure_storage_rpmb.md 990[optee_linuxdriver]: https://github.com/OP-TEE/optee_linuxdriver 991[gendrv_v9]: https://lkml.org/lkml/2016/4/1/205 992[linux_optee]: https://github.com/linaro-swg/linux/tree/optee 993 994 995# OP-TEE - version 1.1.0 996 997 998## New features 999 1000* Softfloat library: floating point support is now available in 32bits TA. 1001 1002* Support running 64-bits TA: on ARMv8-A platform, TA can be compiled in 1003 AArch32 and/or in AArch64 in case the core is compiled in AArch64. 1004 An example can be found in HiKey configuration file. Using the following 1005 excerpt code, the user TA libraries are compiled in both AArch32 and 1006 AArch64, and can be found in `out/arm-plat-hikey/export-ta_arm32` and 1007 `out/arm-plat-hikey/export-ta_arm64` 1008 1009``` 1010 ta-targets = ta_arm32 1011 ta-targets += ta_arm64 1012``` 1013 1014* Concurrent TA support: multiple TA can run in parallel on 1015 several cores. 1016 1017* New tests added in xtest test suite: concurrent TA (xtest 1013), 1018 floating point tests (xtest 1006 and os_test TA) and corruption 1019 file storage (xtest 20000) 1020 1021* [Link][github_commits_1_1_0] to a list of all commits between this and 1022 previous release. 1023 1024 1025## Tested on 1026Definitions: 1027 1028| Type | Meaning | 1029| ---- | ------- | 1030| Standard tests | The [optee_test][optee_test] project. | 1031| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1032| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1033 1034* Foundation Models (vexpress-fvp), standard tests + extended tests, 1035 using FVP ARM V8 Foundation Platformr0p0 (platform build 9.5.40) 1036* HiKey (hikey), standard + extended tests. 1037* MT8173 (mediatek), standard tests. 1038* QEMU (vexpress-qemu), standard + extended tests. 1039* STM Cannes (stm-cannes), standard + extended tests. 1040 1041## Known issues 1042* Secure Storage is implemented, but note that anti-rollback protection 1043 is not implemented yet. 1044 1045* Issue(s) open on GitHub 1046 * [#40][prld40] BUG_ON() when re-using RPC buffer to tee-supplicant 1047 * [#296][pr296]: Connecting RPMB to the storage APIs. 1048 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 1049 * [#506][pr506]: tee-supplicant panic & ta panic 1050 1051[prld40]: https://github.com/OP-TEE/optee_linuxdriver/issues/40 1052[pr506]: https://github.com/OP-TEE/optee_os/issues/506 1053[github_commits_1_1_0]: https://github.com/OP-TEE/optee_os/compare/1.0.1...1.1.0 1054 1055 1056 1057# OP-TEE - version 1.0.0 1058 1059OP-TEE is now maintained by Linaro. Contributors do not need to 1060sign a CLA anymore, but must follow the rules of the [DCO][DCO] 1061(Developer Certificate of Origin) instead. 1062 1063 1064## New features 1065 1066* Add hardware support for Texas Instruments DRA7xx, ARMv7 (plat-ti) 1067 1068* GlobalPlatform™ TEE Internal Core API Specification v1.1, 1069 including ECC algorithms. 1070 1071* Secure Storage: Files stored by the REE are now encrypted. Operations 1072 are made atomic in order to prevent inconsistencies in case of errors 1073 during the storage operations. [Slides][LCStorage] describing the 1074 Secure Storage have been presented at the Linaro Connect SFO15. 1075 1076* Change of format of the Trusted Applications: they follow a 1077 [signed ELF format][elf] 1078 1079* Rework thread [synchronization][synchro] in optee_os. 1080 1081* Use of ARMv8 native cryptographic support. 1082 1083* [OP-TEE/optee_test][optee_test] test suite is released. 1084 1085* Introduce [OP-TEE/manifest][manifest] and [OP-TEE/build][build] 1086 to setup and build QEMU, FVP, HiKey and Mediatek platforms. Setup scripts 1087 that used to be in optee_os have been removed, except for Juno board. 1088 1089* [Link][github_commits_1_0_0] to a list of all commits between this and 1090 previous release. 1091 1092 1093## Tested on 1094Definitions: 1095 1096| Type | Meaning | 1097| ---- | ------- | 1098| Standard tests | The [optee_test][optee_test] project. | 1099| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1100| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1101 1102* ARM Juno Board (vexpress-juno), standard + extended tests. 1103* Foundation Models (vexpress-fvp), standard tests. 1104* HiKey (hikey), standard + extended tests. 1105* MT8173 (mediatek), standard tests. 1106* QEMU (vexpress-qemu), standard + extended tests. 1107* STM Cannes (stm-cannes), standard + extended tests. 1108 1109## Known issues 1110* Secure Storage is implemented, but note that anti-rollback protection 1111 is not implemented yet. 1112 1113* Issue(s) open on GitHub 1114 * [#210][pr210]: libteec.so 32-bit does not communicate well 1115 with 64-bit kernel module 1116 * [#296][pr296]: Connecting RPMB to the storage APIs. 1117 * [#493][pr493]: setup_juno_optee: unable to find pre-built binaries 1118 * [#494][pr494]: HiKey: xtest 7671 fails (1.0.0-rc2) 1119 1120[pr210]: https://github.com/OP-TEE/optee_os/issues/210 1121[pr296]: https://github.com/OP-TEE/optee_os/issues/296 1122[pr493]: https://github.com/OP-TEE/optee_os/issues/493 1123[pr494]: https://github.com/OP-TEE/optee_os/issues/494 1124[github_commits_1_0_0]: https://github.com/OP-TEE/optee_os/compare/0.3.0...1.0.0 1125[DCO]: https://github.com/OP-TEE/optee_os/blob/master/Notice.md#contributions 1126[LCStorage]: http://www.slideshare.net/linaroorg/sfo15503-secure-storage-in-optee 1127[synchro]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#4-thread-handling 1128[elf]: https://github.com/OP-TEE/optee_os/blob/master/documentation/optee_design.md#format 1129[optee_test]: https://github.com/OP-TEE/optee_test 1130[manifest]: https://github.com/OP-TEE/manifest 1131[build]: https://github.com/OP-TEE/build 1132 1133 1134 1135# OP-TEE - version 0.3.0 1136 1137## New features 1138 1139* Add hardware support for 1140 * Mediatek MT8173 Board, ARMv8-A (plat-mediatek) 1141 * Hisilicon HiKey Board, ARMv8-A (plat-hikey) 1142* AArch64 build of optee_os is now possible through the configuration `CFG_ARM64_core=y` 1143* Secure Storage: Data can be encrypted prior to their storage in the non-secure. 1144 Build is configured using `CFG_ENC_FS=y` 1145* A generic boot scheme can be used. Boot configuration is commonalized. This helps 1146 new board support. It is applied on plat-hikey, plat-vexpress, plat-mediatek, plat-stm 1147 and plat-vexpress. 1148 1149## Tested on 1150Definitions: 1151 1152| Type | Meaning | 1153| ---- | ------- | 1154| Standard tests | The optee_test project. | 1155| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1156| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1157 1158* ARM Juno Board (vexpress-juno), standard tests. 1159* Foundation Models (vexpress-fvp), standard tests. 1160* HiKey (hikey), standard tests. 1161* MT8173 (mediatek), standard tests. 1162* QEMU (vexpress-qemu), standard + extended tests. 1163* STM Cannes (stm-cannes), standard + extended tests. 1164 1165------------------------------------------- 1166 1167# OP-TEE - version 0.2.0 1168 1169## New features 1170 1171### Linux Driver Refactoring 1172 1173Linux Driver has been refactored. It is now split in two parts: 1174* optee.ko, the generic Linux driver. It contains all functionality 1175 common to all backends. 1176* optee_armtz.ko, a specific backend dedicated to the TrustZone optee. 1177 It depends on optee.ko. 1178 1179Loading the TrustZone optee linux driver module is now performed using 1180 1181 modprobe optee_armtz 1182 1183Thanks to the dependency between the generic and the backend modules, optee.ko is then automatically loaded. 1184 1185### Misc new features 1186* support PL310 lock down at TEE boot 1187* add 64bits support (division / print) 1188 1189## Tested on 1190Definitions: 1191 1192| Type | Meaning | 1193| ---- | ------- | 1194| Standard tests | The optee_test project. | 1195| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.1.0.4. | 1196| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1197 1198* ARM Juno Board (vexpress-juno), standard tests + extended tests. 1199 1200* Foundation Models (vexpress-fvp), standard + extended tests. 1201 1202* QEMU (vexpress-qemu), standard + extended tests. 1203 1204* STM Cannes (stm-cannes), standard + extended tests. 1205 1206 1207## Issues resolved since last release 1208* Fix user TA trace issue, in order each TA is able to select its own trace level 1209 1210 1211------------------------------------------- 1212# OP-TEE - version 0.1.0 1213 1214## New features 1215Below is a summary of the most important features added, but at the end you will 1216find a link that present you all commits between the current and previous 1217release tag. 1218 1219* GlobalPlatform Client API v1.0 support. 1220 1221* GlobalPlatform Internal API v1.0 support. 1222 1223* GlobalPlatform Secure Elements v1.0 support. 1224 1225* Add hardware support for 1226 1227 * Allwinner A80, ARMv7-A. 1228 1229 * ARM Juno Board, ARMv8-A. 1230 1231 * Foundation Models, ARMv8-A. 1232 1233 * Fast Models, ARMv8-A. 1234 1235 * QEMU, ARMv7-A. 1236 1237 * STM Cannes, ARMv7-A. 1238 1239 * STM Orly2, ARMv7-A. 1240 1241* Add LibTomCrypt as the default software cryptographic library. 1242 1243* Add cryptographic abstraction layer in on secure side to ease the use of 1244 other cryptographic software libraries or adding support for hardware 1245 acceleration. 1246 1247* Extended cryptographic API with support for HKDF, Concat KDF and PBKDF2. 1248 1249* SHA-1 and SHA-256 ARMv8-A crypto extension implementation. 1250 1251* Enabled paging support in OP-TEE OS. 1252 1253* Add support for xtest (both standard and extended) in QEMU and FVP setup 1254 scripts. 1255 1256* Add documentation for the OS design, cryptographic abstraction layer, secure 1257 elements design, the build system, GitHub usage, key derivation extensions, 1258 ARM-Trusted Firmware usage within OP-TEE and GlobalPlatform usage within 1259 OP-TEE. 1260 1261* Integrate support for Travis CI. 1262 1263* [Link][github_commits_0_1_0] to a list of all commits between this and 1264 previous release. 1265 1266 1267## Tested on 1268Definitions: 1269 1270| Type | Meaning | 1271| ---- | ------- | 1272| Standard tests | The optee_test project. | 1273| Extended tests | optee_test with tests from the GlobalPlatform™ TEE Initial Configuration Test Suite v1.0.0. | 1274| Hello world test | Plain hello world Trusted Application such as [this][hello_world]. | 1275 1276* Allwinner A80 (plat-sunxi), hello world test. 1277 1278* ARM Juno Board (vexpress-juno), standard tests. 1279 1280* Foundation Models (plat-vexpress-fvp), standard + extended tests 1281 1282* QEMU (plat-vexpress-qemu), standard + extended tests (and Secure Elements 1283 tested separately). 1284 1285* STM Cannes (plat-stm-cannes), standard + extended tests. 1286 1287 1288## Issues resolved since last release 1289N/A since this is the first release tag on OP-TEE. 1290 1291 1292## Known issues 1293* Storage is implemented, but not "Secure storage", meaning that a client 1294 needs to do encrypt files on their own before storing the files. 1295 1296* Issue(s) open on GitHub 1297 * [#95][pr95]: An error about building the test code of libtomcrypt. 1298 1299 * [#149][pr149]: when testing optee os with arm trusted firmware (I 1300 utilized optee os tee.bin as bl32 image) on juno platform, I got an 1301 error. 1302 1303 * [#161][pr161]: tee_svc_cryp.c lacks accessibility checks on 1304 user-supplied TEE_Attributes. 1305 1306[hello_world]: https://github.com/jenswi-linaro/lcu14_optee_hello_world 1307[github_commits_0_1_0]: https://github.com/OP-TEE/optee_os/compare/b01047730e77127c23a36591643eeb8bb0487d68...999e4a6c0f64d3177fd3d0db234107b6fb860884 1308[pr95]: https://github.com/OP-TEE/optee_os/issues/95 1309[pr149]: https://github.com/OP-TEE/optee_os/issues/149 1310[pr161]: https://github.com/OP-TEE/optee_os/issues/161 1311 1312* Global Platform Device Internal Core API v1.1 1313 * [#230][pr230]: Persistent object corruption support (TEE_ERROR_CORRUPT_OBJECT/_2) 1314 * [#230][pr230]: Persistent object access support (TEE_ERROR_STORAGE_NOT_AVAILABLE/_2) 1315