- OP-TEE - lists.trustedfirmware.org

[PATCH] tee: qcom: initialize result before use in release worker

by Amirreza Zarrabi

Initialize result to 0 so the error path doesn't read it uninitialized when the invoke fails. Fixes a Smatch warning. Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/op-tee/7c1e0de2-7d42-4c6b-92fe-0e4fe5d650b5@oss.qua… Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver") Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> --- drivers/tee/qcomtee/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tee/qcomtee/core.c b/drivers/tee/qcomtee/core.c index b6715ada7700..ecd04403591c 100644 --- a/drivers/tee/qcomtee/core.c +++ b/drivers/tee/qcomtee/core.c @@ -82,7 +82,7 @@ static void qcomtee_do_release_qtee_object(struct work_struct *work) { struct qcomtee_object *object; struct qcomtee *qcomtee; - int ret, result; + int ret, result = 0; /* RELEASE does not require any argument. */ struct qcomtee_arg args[] = { { .type = QCOMTEE_ARG_TYPE_INV } }; --- base-commit: ab40c92c74c6b0c611c89516794502b3a3173966 change-id: 20251110-qcom-tee-fix-warning-3d58d74a22d8 Best regards, -- Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com>

11 months, 1 week

2
4
0 0

[PATCH v2] tee: fix uninitialized pointers with free attribute

by Ally Heev

Uninitialized pointers with `__free` attribute can cause undefined behavior as the memory assigned randomly to the pointer is freed automatically when the pointer goes out of scope. tee doesn't have any bugs related to this as of now, but it is better to initialize and assign pointers with `__free` attribute in one statement to ensure proper scope-based cleanup Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/ Signed-off-by: Ally Heev <allyheev(a)gmail.com> --- Changes in v2: - initializing variables to NULL at the declaration - Link to v1: https://lore.kernel.org/r/20251105-aheev-uninitialized-free-attr-tee-v1-1-2… --- drivers/tee/qcomtee/call.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c index ac134452cc9cfd384c28d41547545f2c5748d86c..65f9140d4e1f8909d072004fd24730543e320d74 100644 --- a/drivers/tee/qcomtee/call.c +++ b/drivers/tee/qcomtee/call.c @@ -645,7 +645,7 @@ static void qcomtee_get_version(struct tee_device *teedev, static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id, u32 *version) { - struct qcomtee_object_invoke_ctx *oic __free(kfree); + struct qcomtee_object_invoke_ctx *oic __free(kfree) = NULL; struct qcomtee_object *client_env, *service; struct qcomtee_arg u[3] = { 0 }; int result; --- base-commit: c9cfc122f03711a5124b4aafab3211cf4d35a2ac change-id: 20251105-aheev-uninitialized-free-attr-tee-0221e45ec5a2 Best regards, -- Ally Heev <allyheev(a)gmail.com>

11 months, 2 weeks

2
1
0 0

[bug report] tee: add Qualcomm TEE driver

by Dan Carpenter

Hello Amirreza Zarrabi, Commit d6e290837e50 ("tee: add Qualcomm TEE driver") from Sep 11, 2025 (linux-next), leads to the following Smatch static checker warning: drivers/tee/qcomtee/core.c:104 qcomtee_do_release_qtee_object() error: uninitialized symbol 'result'. drivers/tee/qcomtee/core.c 81 static void qcomtee_do_release_qtee_object(struct work_struct *work) 82 { 83 struct qcomtee_object *object; 84 struct qcomtee *qcomtee; 85 int ret, result; 86 87 /* RELEASE does not require any argument. */ 88 struct qcomtee_arg args[] = { { .type = QCOMTEE_ARG_TYPE_INV } }; 89 90 object = container_of(work, struct qcomtee_object, work); 91 qcomtee = tee_get_drvdata(object->info.qcomtee_async_ctx->teedev); 92 /* Get the TEE context used for asynchronous operations. */ 93 qcomtee->oic.ctx = object->info.qcomtee_async_ctx; 94 95 ret = qcomtee_object_do_invoke_internal(&qcomtee->oic, object, 96 QCOMTEE_MSG_OBJECT_OP_RELEASE, 97 args, &result); 98 99 /* Is it safe to retry the release? */ 100 if (ret && ret != -ENODEV) { 101 queue_work(qcomtee->wq, &object->work); 102 } else { 103 if (ret || result) --> 104 pr_err("%s release failed, ret = %d (%x)\n", 105 qcomtee_object_name(object), ret, result); ^^^^^^ result could be uninitialized if ret is non-zero. 106 qcomtee_qtee_object_free(object); 107 } 108 } regards, dan carpenter

11 months, 2 weeks

3
2
0 0

[PATCH] tee: <uapi/linux/tee.h: fix all kernel-doc issues

by Randy Dunlap

Fix kernel-doc warnings so that there no other kernel-doc issues in <uapi/linux/tee.h>: - add ending ':' to some struct members as needed for kernel-doc - change struct name in kernel-doc to match the actual struct name (2x) - add a @params: kernel-doc entry multiple times Warning: tee.h:265 struct member 'ret_origin' not described in 'tee_ioctl_open_session_arg' Warning: tee.h:265 struct member 'num_params' not described in 'tee_ioctl_open_session_arg' Warning: tee.h:265 struct member 'params' not described in 'tee_ioctl_open_session_arg' Warning: tee.h:351 struct member 'num_params' not described in 'tee_iocl_supp_recv_arg' Warning: tee.h:351 struct member 'params' not described in 'tee_iocl_supp_recv_arg' Warning: tee.h:372 struct member 'num_params' not described in 'tee_iocl_supp_send_arg' Warning: tee.h:372 struct member 'params' not described in 'tee_iocl_supp_send_arg' Warning: tee.h:298: expecting prototype for struct tee_ioctl_invoke_func_arg. Prototype was for struct tee_ioctl_invoke_arg instead Warning: tee.h:473: expecting prototype for struct tee_ioctl_invoke_func_arg. Prototype was for struct tee_ioctl_object_invoke_arg instead Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> --- Cc: Jens Wiklander <jens.wiklander(a)linaro.org> Cc: Sumit Garg <sumit.garg(a)kernel.org> Cc: op-tee(a)lists.trustedfirmware.org --- include/uapi/linux/tee.h | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) --- linux-next-20251022.orig/include/uapi/linux/tee.h +++ linux-next-20251022/include/uapi/linux/tee.h @@ -249,8 +249,9 @@ struct tee_ioctl_param { * @cancel_id: [in] Cancellation id, a unique value to identify this request * @session: [out] Session id * @ret: [out] return value - * @ret_origin [out] origin of the return value - * @num_params [in] number of parameters following this struct + * @ret_origin: [out] origin of the return value + * @num_params: [in] number of &struct tee_ioctl_param entries in @params + * @params: array of ioctl parameters */ struct tee_ioctl_open_session_arg { __u8 uuid[TEE_IOCTL_UUID_LEN]; @@ -276,14 +277,14 @@ struct tee_ioctl_open_session_arg { struct tee_ioctl_buf_data) /** - * struct tee_ioctl_invoke_func_arg - Invokes a function in a Trusted - * Application + * struct tee_ioctl_invoke_arg - Invokes a function in a Trusted Application * @func: [in] Trusted Application function, specific to the TA * @session: [in] Session id * @cancel_id: [in] Cancellation id, a unique value to identify this request * @ret: [out] return value - * @ret_origin [out] origin of the return value - * @num_params [in] number of parameters following this struct + * @ret_origin: [out] origin of the return value + * @num_params: [in] number of parameters following this struct + * @params: array of ioctl parameters */ struct tee_ioctl_invoke_arg { __u32 func; @@ -338,7 +339,8 @@ struct tee_ioctl_close_session_arg { /** * struct tee_iocl_supp_recv_arg - Receive a request for a supplicant function * @func: [in] supplicant function - * @num_params [in/out] number of parameters following this struct + * @num_params: [in/out] number of &struct tee_ioctl_param entries in @params + * @params: array of ioctl parameters * * @num_params is the number of params that tee-supplicant has room to * receive when input, @num_params is the number of actual params @@ -363,7 +365,8 @@ struct tee_iocl_supp_recv_arg { /** * struct tee_iocl_supp_send_arg - Send a response to a received request * @ret: [out] return value - * @num_params [in] number of parameters following this struct + * @num_params: [in] number of &struct tee_ioctl_param entries in @params + * @params: array of ioctl parameters */ struct tee_iocl_supp_send_arg { __u32 ret; @@ -454,11 +457,13 @@ struct tee_ioctl_shm_register_fd_data { */ /** - * struct tee_ioctl_invoke_func_arg - Invokes an object in a Trusted Application + * struct tee_ioctl_object_invoke_arg - Invokes an object in a + * Trusted Application * @id: [in] Object id * @op: [in] Object operation, specific to the object * @ret: [out] return value * @num_params: [in] number of parameters following this struct + * @params: array of ioctl parameters */ struct tee_ioctl_object_invoke_arg { __u64 id;

11 months, 2 weeks

3
2
0 0

[PATCH] tee: fix uninitialized pointers with free attr

by Ally Heev

Uninitialized pointers with `__free` attribute can cause undefined behaviour as the memory assigned(randomly) to the pointer is freed automatically when the pointer goes out of scope tee doesn't have any bugs related to this as of now, but it is better to initialize and assign pointers with `__free` attr in one statement to ensure proper scope-based cleanup Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/ Signed-off-by: Ally Heev <allyheev(a)gmail.com> --- drivers/tee/qcomtee/call.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c index ac134452cc9cfd384c28d41547545f2c5748d86c..8b7b4decddd8d1811dc0a7cc46a4a4fbada45526 100644 --- a/drivers/tee/qcomtee/call.c +++ b/drivers/tee/qcomtee/call.c @@ -645,12 +645,13 @@ static void qcomtee_get_version(struct tee_device *teedev, static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id, u32 *version) { - struct qcomtee_object_invoke_ctx *oic __free(kfree); struct qcomtee_object *client_env, *service; struct qcomtee_arg u[3] = { 0 }; int result; - oic = qcomtee_object_invoke_ctx_alloc(ctx); + struct qcomtee_object_invoke_ctx *oic __free(kfree) = + qcomtee_object_invoke_ctx_alloc(ctx); + if (!oic) return; --- base-commit: c9cfc122f03711a5124b4aafab3211cf4d35a2ac change-id: 20251105-aheev-uninitialized-free-attr-tee-0221e45ec5a2 Best regards, -- Ally Heev <allyheev(a)gmail.com>

11 months, 2 weeks

3
2
0 0

[PATCH] tee: fix illegal pointer dereference in tee_shm_put()

by yangzhao

In tee_shm_put(), there is not only the NULL pointer dereference, but also the illegal pointer dereference. shutdown() ---> __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...); tee_shm_free(shm); --> tee_shm_put(shm); //crash: shm->ctx maybe NULL pointer or illegal pointer Check whether the pointer is NULL and whether the pointer address is valid. This issue occurs when rich world uses the 6.x version of the kernel and optee secure world uses a lower version (such as version 3.2), and it is highly likely to trigger a kernel panic when conducting hibernate tests. Fixes: e4a718a3a47e ("tee: fix NULL pointer dereference in tee_shm_put") Signed-off-by: yangzhao <yangzhao(a)kylinos.cn> --- drivers/tee/tee_shm.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 4a47de4bb2e5..de01d16409c1 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -722,7 +722,14 @@ void tee_shm_put(struct tee_shm *shm) struct tee_device *teedev; bool do_release = false; - if (!shm || !shm->ctx || !shm->ctx->teedev) + /* checking pointer */ + if (IS_ERR_OR_NULL(shm) || !virt_addr_valid(shm)) + return; + + if (IS_ERR_OR_NULL(shm->ctx) || !virt_addr_valid(shm->ctx)) + return; + + if (IS_ERR_OR_NULL(shm->ctx->teedev) || !virt_addr_valid(shm->ctx->teedev)) return; teedev = shm->ctx->teedev; -- 2.25.1

11 months, 2 weeks

2
3
0 0

Linaro OP-TEE Contribution, LOC, monthly meeting October 28

by Jens Wiklander

Hi, Tomorrow, Tuesday, it's time for another LOC monthly meeting. For time and connection details, see the calendar at https://www.trustedfirmware.org/meetings/ - OP-TEE version 4.8.0 has been released - We have an op-tee channel at the Trusted Firmware Discord server [1]. Last week, there was a message about improving the order of all the config options we have in OP-TEE, the CFG_* variables. In the long term, we might still aim for Kconfig, but that's quite a large step. However, there are intermediate steps that we can take. I hope we'll see more of this. Are there any other topics? [1] https://www.trustedfirmware.org/faq/ Cheers, Jens

12 months

1
0
0 0

OP-TEE 4.8.0 has been released

by Jens Wiklander

Hi, I'm pleased to announce that OP-TEE version 4.6.0 is now available. The list of changes can be found in the changelog [1]. A big thank you to everyone who participated with contributions and helping out with testing the release [2]. [1] https://github.com/OP-TEE/optee_os/blob/4.8.0/CHANGELOG.md [2] https://github.com/OP-TEE/optee_os/commit/86660925433a8d4d1b19cfa5fe940081d… Regards, Jens

12 months

1
0
0 0

[PATCH] core: Relax StMM dependency to TEE_STORAGE_PRIVATE

by Jan Kiszka

From: Jan Kiszka <jan.kiszka(a)siemens.com> This allows to run StMM without the userspace supplicant if the in-kernel RPMB service is available. Signed-off-by: Jan Kiszka <jan.kiszka(a)siemens.com> --- core/pta/device.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/pta/device.c b/core/pta/device.c index 39ad3ddda..21c13bd94 100644 --- a/core/pta/device.c +++ b/core/pta/device.c @@ -67,8 +67,8 @@ static TEE_Result get_devices(uint32_t types, add_ta(ta->flags, &ta->uuid, buf, blen, &pos, rflags); if (stmm_get_uuid()) - add_ta(TA_FLAG_DEVICE_ENUM_SUPP, stmm_get_uuid(), buf, blen, - &pos, rflags); + add_ta(TA_FLAG_DEVICE_ENUM_TEE_STORAGE_PRIVATE, + stmm_get_uuid(), buf, blen, &pos, rflags); if (IS_ENABLED(CFG_EARLY_TA)) for_each_early_ta(eta) -- 2.51.0

1 year

2
2
0 0

Re: [PATCH 0/8] sd: Add RPMB emulation to eMMC model

by Jan Kiszka

FYI: QEMU model is working fine, upstreaming started, feedback welcome. Jan On 24.08.25 09:18, Jan Kiszka wrote: > This closes an old gap in system integration testing for the very > complex ARM firmware stacks by adding fairly advanced Replay Protected > Memory Block (RPMB) emulation to the eMMC device model. Key programming > and message authentication are working, so is the write counter. Known > users are happy with the result. What is missing, but not only for RPMB- > related registers, is state persistence across QEMU restarts. This is OK > at this stage for most test scenarios, though, and could still be added > later on. > > What can already be done with it is demonstrated in the WIP branch of > isar-cip-core at [1]: TF-A + OP-TEE + StandaloneMM TA + fTPM TA, used by > U-Boot and Linux for UEFI variable storage and TPM scenarios. If you > want to try: build qemu-arm64 target for trixie with 6.12-cip *head* > kernel, enable secure boot and disk encryption, then run > > $ QEMU_PATH=/path/to/qemu-build/ ./start-qemu.sh > > Deploy snakeoil keys into PK, KEK and db after first boot to enable > secure booting: > > root@demo:~# cert-to-efi-sig-list PkKek-1-snakeoil.pem PK.esl > root@demo:~# sign-efi-sig-list -k PkKek-1-snakeoil.key -c PkKek-1-snakeoil.pem PK PK.esl PK.auth > root@demo:~# efi-updatevar -f PK.auth db > root@demo:~# efi-updatevar -f PK.auth KEK > root@demo:~# efi-updatevar -f PK.auth PK > > Note that emulation is a bit slow in general, and specifically the > partition encryption on first boot is taking 20 min. - we should > probably reduce its size or understand if there is still something to > optimize. > > Jan > > [1] https://gitlab.com/cip-project/cip-core/isar-cip-core/-/commits/wip/qemu-rp… > > Cc: "Daniel P. Berrangé" <berrange(a)redhat.com> > > Jan Kiszka (8): > hw/sd/sdcard: Fix size check for backing block image > hw/sd/sdcard: Add validation for boot-partition-size > hw/sd/sdcard: Allow user-instantiated eMMC > hw/sd/sdcard: Refactor sd_bootpart_offset > hw/sd/sdcard: Add basic support for RPMB partition > crypto/hmac: Allow to build hmac over multiple > qcrypto_gnutls_hmac_bytes[v] calls > hw/sd/sdcard: Handle RPMB MAC field > scripts: Add helper script to generate eMMC block device images > > crypto/hmac-gcrypt.c | 4 +- > crypto/hmac-glib.c | 4 +- > crypto/hmac-gnutls.c | 4 +- > crypto/hmac-nettle.c | 4 +- > hw/sd/sd.c | 314 ++++++++++++++++++++++++++++++++++++++--- > hw/sd/sdmmc-internal.h | 24 +++- > hw/sd/trace-events | 2 + > include/crypto/hmac.h | 12 ++ > scripts/mkemmc.sh | 185 ++++++++++++++++++++++++ > 9 files changed, 530 insertions(+), 23 deletions(-) > create mode 100755 scripts/mkemmc.sh > -- Siemens AG, Foundational Technologies Linux Expert Center

1 year

3
4
0 0

2026

2025

2024

2023

2022

2021

2020

OP-TEE