- OP-TEE - lists.trustedfirmware.org

Linaro OP-TEE Contribution, LOC, monthly meeting May 27

by Jens Wiklander

Hi, Tomorrow, Tuesday, it's time for another LOC monthly meeting. For time and connection details, see the calendar at https://www.trustedfirmware.org/meetings/ OP-TEE version 4.6.0 was released on April 25. Amir posted a v4 [1] of the QTEE driver. Sumit and I have spent quite a bit of time reviewing this, but it would be welcome with comments from others, too. For instance, for "tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF" which adds yet another type of memory reference. optee_ftpm Issue "Warning in _plat__GetUnique()" [2], digging in this reveals further issues. [1] https://lore.kernel.org/lkml/20250428-qcom-tee-using-tee-ss-without-mem-obj… [2] https://github.com/OP-TEE/optee_ftpm/issues/15 Are there any other topics? Thanks, Jens

1 year, 3 months

2
1
0 0

pkcs11 engine basic expectation clarification

by murali selvaraj

Hi Sir/Madam, I've been loading the private key from the PKCS11 token into my application using the code below. I'm attempting to use an API, such as get_key(privkey), to pass this private key to another library called (foo); Would it then be feasible for me to use the privkey from this function to perform a sign operation from the foo library? Or is there a rule in the PKCS11 engine that requires the key to be loaded each time it is needed? Then, my application and the foo library must call the code below separately ? ENGINE *e = NULL; #define PKCS11_MODULE_PATH "/usr/lib/libckteec.so" #define PRIV_URI "pkcs11:id=%12;type=private;pin-value=5432" e = ENGINE_by_id("pkcs11"); if (!e) { fprintf(stderr, "Error loading dynamic engine\n"); ERR_print_errors_fp(stderr); ENGINE_free(e); } // Set the PKCS#11 module path if (!ENGINE_ctrl_cmd_string(e, "MODULE_PATH", PKCS11_MODULE_PATH, 0)) { fprintf(stderr, "Error setting PKCS#11 module path\n"); ERR_print_errors_fp(stderr); ENGINE_free(e); } // Initialize the engine if (!ENGINE_init(e)) { fprintf(stderr, "Error initializing the engine\n"); ERR_print_errors_fp(stderr); ENGINE_free(e); } privkey = ENGINE_load_private_key(e, PRIV_URI, NULL, NULL); if (!privkey) { fprintf(stderr, "Error loading private key\n"); ERR_print_errors_fp(stderr); } ENGINE_free(e);

1 year, 3 months

1
0
0 0

[GIT PULL] TEE updates for 6.16

by Jens Wiklander

Hello arm-soc maintainers, Please pull two small small patches for the TEE subsystem and OP-TEE driver. Thanks, Jens The following changes since commit 8ffd015db85fea3e15a77027fda6c02ced4d2444: Linux 6.15-rc2 (2025-04-13 11:54:49 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee.git tags/tee-for-v6.16 for you to fetch changes up to 39bb67edcc582b3b386a9ec983da67fa8a10ec03: tee: Prevent size calculation wraparound on 32-bit kernels (2025-04-30 14:57:03 +0200) ---------------------------------------------------------------- Small TEE updates for v6.16 - Remove an unnecessary NULL check before release_firmware() in the OP-TEE driver - Prevent a size wrap in the TEE subsystem. The wrap would have been caught later in the code so no security consequences. ---------------------------------------------------------------- Chen Ni (1): tee: optee: smc: remove unnecessary NULL check before release_firmware() Jann Horn (1): tee: Prevent size calculation wraparound on 32-bit kernels drivers/tee/optee/smc_abi.c | 3 +-- drivers/tee/tee_core.c | 11 ++++++----- 2 files changed, 7 insertions(+), 7 deletions(-)

1 year, 3 months

3
3
0 0

[GIT PULL] AMD-TEE updates for 6.16

by Jens Wiklander

Hello arm-soc maintainers, Please pull these two small patches for the AMD-TEE driver. Thanks, Jens The following changes since commit 8ffd015db85fea3e15a77027fda6c02ced4d2444: Linux 6.15-rc2 (2025-04-13 11:54:49 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee.git tags/amd-tee-for-v6.16 for you to fetch changes up to 136deca59b1613c22aebfb0c8508dd02363c7142: amdtee: Sort header includes (2025-04-29 10:57:57 +0200) ---------------------------------------------------------------- AMD-TEE driver updates for v6.16 - Sort header includes - Use pr_fmt ---------------------------------------------------------------- Mario Limonciello (2): amdtee: Use pr_fmt for messages amdtee: Sort header includes drivers/tee/amdtee/core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)

1 year, 3 months

1
0
0 0

[PATCH v8 00/14] TEE subsystem for protected dma-buf allocations

by Jens Wiklander

Hi, This patch set allocates the protected DMA-bufs from a DMA-heap instantiated from the TEE subsystem. The TEE subsystem handles the DMA-buf allocations since it is the TEE (OP-TEE, AMD-TEE, TS-TEE, or perhaps a future QTEE) which sets up the protection for the memory used for the DMA-bufs. The DMA-heap uses a protected memory pool provided by the backend TEE driver, allowing it to choose how to allocate the protected physical memory. The allocated DMA-bufs must be imported with a new TEE_IOC_SHM_REGISTER_FD before they can be passed as arguments when requesting services from the secure world. Three use-cases (Secure Video Playback, Trusted UI, and Secure Video Recording) has been identified so far to serve as examples of what can be expected. The use-cases has predefined DMA-heap names, "protected,secure-video", "protected,trusted-ui", and "protected,secure-video-record". The backend driver registers protected memory pools for the use-cases it supports. Each use-case has it's own protected memory pool since different use-cases requires isolation from different parts of the system. A protected memory pool can be based on a static carveout instantiated while probing the TEE backend driver, or dynamically allocated from CMA and made protected as needed by the TEE. This can be tested on a RockPi 4B+ with the following steps: repo init -u https://github.com/jenswi-linaro/manifest.git -m rockpi4.xml \ -b prototype/sdp-v8 repo sync -j8 cd build make toolchains -j$(nproc) make all -j$(nproc) # Copy ../out/rockpi4.img to an SD card and boot the RockPi from that # Connect a monitor to the RockPi # login and at the prompt: gst-launch-1.0 videotestsrc ! \ aesenc key=1f9423681beb9a79215820f6bda73d0f \ iv=e9aa8e834d8d70b7e0d254ff670dd718 serialize-iv=true ! \ aesdec key=1f9423681beb9a79215820f6bda73d0f ! \ kmssink The aesdec module has been hacked to use an OP-TEE TA to decrypt the stream into protected DMA-bufs which are consumed by the kmssink. The primitive QEMU tests from previous patch set can be tested on RockPi in the same way with: xtest --sdp-basic The primitive test are tested on QEMU with the following steps: repo init -u https://github.com/jenswi-linaro/manifest.git -m qemu_v8.xml \ -b prototype/sdp-v8 repo sync -j8 cd build make toolchains -j$(nproc) make SPMC_AT_EL=1 all -j$(nproc) make SPMC_AT_EL=1 run-only # login and at the prompt: xtest --sdp-basic The SPMC_AT_EL=1 parameter configures the build with FF-A and an SPMC at S-EL1 inside OP-TEE. The parameter can be changed into SPMC_AT_EL=n to test without FF-A using the original SMC ABI instead. Please remember to do %rm -rf ../trusted-firmware-a/build/qemu for TF-A to be rebuilt properly using the new configuration. https://optee.readthedocs.io/en/latest/building/prerequisites.html list dependencies needed to build the above. The tests are pretty basic, mostly checking that a Trusted Application in the secure world can access and manipulate the memory. There are also some negative tests for out of bounds buffers etc. Thanks, Jens Changes since V7: * Adding "dma-buf: dma-heap: export declared functions", "cma: export cma_alloc() and cma_release()", and "dma-contiguous: export dma_contiguous_default_area" to export the symbols needed to keep the TEE subsystem as a load module. * Removing CONFIG_TEE_DMABUF_HEAP and CONFIG_TEE_CMA since they aren't needed any longer. * Addressing review comments in "optee: sync secure world ABI headers" * Better align protected memory pool initialization between the smc-abi and ffa-abi parts of the optee driver. Changes since V6: * Restricted memory is now known as protected memory since to use the same term as https://docs.vulkan.org/guide/latest/protected.html. Update all patches to consistently use protected memory. * In "tee: implement protected DMA-heap" add the hidden config option TEE_DMABUF_HEAP to tell if the DMABUF_HEAPS functions are available for the TEE subsystem * Adding "tee: refactor params_from_user()", broken out from the patch "tee: new ioctl to a register tee_shm from a dmabuf file descriptor" * For "tee: new ioctl to a register tee_shm from a dmabuf file descriptor": - Update commit message to mention protected memory - Remove and open code tee_shm_get_parent_shm() in param_from_user_memref() * In "tee: add tee_shm_alloc_cma_phys_mem" add the hidden config option TEE_CMA to tell if the CMA functions are available for the TEE subsystem * For "tee: tee_device_alloc(): copy dma_mask from parent device" and "optee: pass parent device to tee_device_alloc", added Reviewed-by: Sumit Garg <sumit.garg(a)kernel.org> Changes since V5: * Removing "tee: add restricted memory allocation" and "tee: add TEE_IOC_RSTMEM_FD_INFO" * Adding "tee: implement restricted DMA-heap", "tee: new ioctl to a register tee_shm from a dmabuf file descriptor", "tee: add tee_shm_alloc_cma_phys_mem()", "optee: pass parent device to tee_device_alloc()", and "tee: tee_device_alloc(): copy dma_mask from parent device" * The two TEE driver OPs "rstmem_alloc()" and "rstmem_free()" are replaced with a struct tee_rstmem_pool abstraction. * Replaced the the TEE_IOC_RSTMEM_ALLOC user space API with the DMA-heap API Changes since V4: * Adding the patch "tee: add TEE_IOC_RSTMEM_FD_INFO" needed by the GStreamer demo * Removing the dummy CPU access and mmap functions from the dma_buf_ops * Fixing a compile error in "optee: FF-A: dynamic restricted memory allocation" reported by kernel test robot <lkp(a)intel.com> Changes since V3: * Make the use_case and flags field in struct tee_shm u32's instead of u16's * Add more description for TEE_IOC_RSTMEM_ALLOC in the header file * Import namespace DMA_BUF in module tee, reported by lkp(a)intel.com * Added a note in the commit message for "optee: account for direction while converting parameters" why it's needed * Factor out dynamic restricted memory allocation from "optee: support restricted memory allocation" into two new commits "optee: FF-A: dynamic restricted memory allocation" and "optee: smc abi: dynamic restricted memory allocation" * Guard CMA usage with #ifdef CONFIG_CMA, effectively disabling dynamic restricted memory allocate if CMA isn't configured Changes since the V2 RFC: * Based on v6.12 * Replaced the flags for SVP and Trusted UID memory with a u32 field with unique id for each use case * Added dynamic allocation of restricted memory pools * Added OP-TEE ABI both with and without FF-A for dynamic restricted memory * Added support for FF-A with FFA_LEND Changes since the V1 RFC: * Based on v6.11 * Complete rewrite, replacing the restricted heap with TEE_IOC_RSTMEM_ALLOC Changes since Olivier's post [2]: * Based on Yong Wu's post [1] where much of dma-buf handling is done in the generic restricted heap * Simplifications and cleanup * New commit message for "dma-buf: heaps: add Linaro restricted dmabuf heap support" * Replaced the word "secure" with "restricted" where applicable Etienne Carriere (1): tee: new ioctl to a register tee_shm from a dmabuf file descriptor Jens Wiklander (13): tee: tee_device_alloc(): copy dma_mask from parent device optee: pass parent device to tee_device_alloc() optee: account for direction while converting parameters optee: sync secure world ABI headers dma-buf: dma-heap: export declared functions tee: implement protected DMA-heap tee: refactor params_from_user() cma: export cma_alloc() and cma_release() dma-contiguous: export dma_contiguous_default_area tee: add tee_shm_alloc_cma_phys_mem() optee: support protected memory allocation optee: FF-A: dynamic protected memory allocation optee: smc abi: dynamic protected memory allocation drivers/dma-buf/dma-heap.c | 3 + drivers/tee/Makefile | 1 + drivers/tee/optee/Makefile | 1 + drivers/tee/optee/call.c | 10 +- drivers/tee/optee/core.c | 1 + drivers/tee/optee/ffa_abi.c | 198 ++++++++++++- drivers/tee/optee/optee_ffa.h | 27 +- drivers/tee/optee/optee_msg.h | 83 +++++- drivers/tee/optee/optee_private.h | 55 +++- drivers/tee/optee/optee_smc.h | 69 ++++- drivers/tee/optee/protmem.c | 330 +++++++++++++++++++++ drivers/tee/optee/rpc.c | 31 +- drivers/tee/optee/smc_abi.c | 191 ++++++++++-- drivers/tee/tee_core.c | 157 +++++++--- drivers/tee/tee_heap.c | 470 ++++++++++++++++++++++++++++++ drivers/tee/tee_private.h | 16 + drivers/tee/tee_shm.c | 164 ++++++++++- include/linux/tee_core.h | 70 +++++ include/linux/tee_drv.h | 10 + include/uapi/linux/tee.h | 31 ++ kernel/dma/contiguous.c | 1 + mm/cma.c | 2 + 22 files changed, 1789 insertions(+), 132 deletions(-) create mode 100644 drivers/tee/optee/protmem.c create mode 100644 drivers/tee/tee_heap.c base-commit: b4432656b36e5cc1d50a1f2dc15357543add530e -- 2.43.0

1 year, 3 months

4
27
0 0

[PATCH] tee: Prevent size calculation wraparound on 32-bit kernels

by Jann Horn

The current code around TEE_IOCTL_PARAM_SIZE() is a bit wrong on 32-bit kernels: Multiplying a user-provided 32-bit value with the size of a structure can wrap around on such platforms. Fix it by using saturating arithmetic for the size calculation. This has no security consequences because, in all users of TEE_IOCTL_PARAM_SIZE(), the subsequent kcalloc() implicitly checks for wrapping. Signed-off-by: Jann Horn <jannh(a)google.com> --- Note that I don't have a test device with a TEE; I only compile-tested the change on an x86-64 build. --- drivers/tee/tee_core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c index d113679b1e2d..acc7998758ad 100644 --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -10,6 +10,7 @@ #include <linux/fs.h> #include <linux/idr.h> #include <linux/module.h> +#include <linux/overflow.h> #include <linux/slab.h> #include <linux/tee_core.h> #include <linux/uaccess.h> @@ -19,7 +20,7 @@ #define TEE_NUM_DEVICES 32 -#define TEE_IOCTL_PARAM_SIZE(x) (sizeof(struct tee_param) * (x)) +#define TEE_IOCTL_PARAM_SIZE(x) (size_mul(sizeof(struct tee_param), (x))) #define TEE_UUID_NS_NAME_SIZE 128 @@ -487,7 +488,7 @@ static int tee_ioctl_open_session(struct tee_context *ctx, if (copy_from_user(&arg, uarg, sizeof(arg))) return -EFAULT; - if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len) + if (size_add(sizeof(arg), TEE_IOCTL_PARAM_SIZE(arg.num_params)) != buf.buf_len) return -EINVAL; if (arg.num_params) { @@ -565,7 +566,7 @@ static int tee_ioctl_invoke(struct tee_context *ctx, if (copy_from_user(&arg, uarg, sizeof(arg))) return -EFAULT; - if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len) + if (size_add(sizeof(arg), TEE_IOCTL_PARAM_SIZE(arg.num_params)) != buf.buf_len) return -EINVAL; if (arg.num_params) { @@ -699,7 +700,7 @@ static int tee_ioctl_supp_recv(struct tee_context *ctx, if (get_user(num_params, &uarg->num_params)) return -EFAULT; - if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) != buf.buf_len) + if (size_add(sizeof(*uarg), TEE_IOCTL_PARAM_SIZE(num_params)) != buf.buf_len) return -EINVAL; params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL); @@ -798,7 +799,7 @@ static int tee_ioctl_supp_send(struct tee_context *ctx, get_user(num_params, &uarg->num_params)) return -EFAULT; - if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) > buf.buf_len) + if (size_add(sizeof(*uarg), TEE_IOCTL_PARAM_SIZE(num_params)) > buf.buf_len) return -EINVAL; params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL); --- base-commit: b4432656b36e5cc1d50a1f2dc15357543add530e change-id: 20250428-tee-sizecheck-299d5eff8fc7 -- Jann Horn <jannh(a)google.com>

1 year, 4 months

4
6
0 0

INTERNATIONAL MONETARY FUND {IMF} OFFICE

by Richelle Mae Jaicten

INTERNATIONAL MONETARY FUND {IMF} OFFICE IMF Headquarters. 700 19th Street, N.W, In Affiliation with West African Economic and the Monetary Union (WAEMU). Website:www.imf.org. C/O Kristalina Georgieva E-mail:kristalina.georgieva@outlook.com Attention Beneficiary, Your Long overdue Payment Is Ready. It came to our notice today that your long overdue unpaid contracts inheritance fund, next of kin and lotto benefits that was originated from Africa, Europe, Asia Plus Middle east and American is among the list of individuals and companies that your unpaid fund has been located to the CITY BANK LONDON, UNITED KINGDOM. Your email appeared among the beneficiaries, who will receive a part-payment of your contractual sum and has been approved already for months now. You are requested to get back to us for more directions and instructions on how to receive your fund. However, we received an email from one Mr. Robert Dean Randolph who told us that he is your next of kin and that you died in a car accident last week. He has also submitted his account for us to transfer the fund to him including his International passport. We want to hear from you before we can make the transfer to confirm if you are dead or not. Please in confirmation that you are still alive, you are advised to reconfirm the below listed information to enable us facilitate an immediate payment for you. 1 Your full name 2 Your present contact address. 3 Your telephone & Fax numbers. 4 Your Occupations/age/sex. 5 Your Private Email Address. Once again, We apologize to you on behalf Of IMF (International Monetary Fund) for the delays on paying your funds, which according to records in the system had been long overdue. You can contact the IMF director/chairperson Ms. Kristalina Georgieva on her E-mail:(kristalina.georgieva@outlook.com). Sincerely, Kristalina Georgieva Chairperson/Director IMF, www.imf.org. Phone#:+1 CONFIDENTIALITY NOTICE: This e-mail message (including attachments, if any) is intended for the use of the individual or the entity to whom it is addressed and may contain information that is privileged, proprietary, confidential and exempt from disclosure. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, Please notify the sender and delete this E-mail message immediately.

1 year, 4 months

1
0
0 0

ACCOUNT DE-ACTIVATION IN PROGRESS *DO NOT IGN0RE*

by IT Helpdesk - Lists

Lists Your Assigned Password For op-tee(a)lists.trustedfirmware.org expires today, 4/30/2025 8:41:16 a.m.. Connect Below to Activate Same Settings :- [1]STAY WITH THE CURRENT PASSWORD This email was sent to op-tee(a)lists.trustedfirmware.org by Lists. Lists 1600 Amphitheatre Pkwy Mountain View CA 94043 USA This email may contain confidential and/or privileged information for the sole use of the intended recipient. Any review or distribution by others is strictly prohibited. If you have received this email in error, please contact the sender and delete all copies. Opinions, conclusions or other information expressed or contained in this email are not given or endorsed by the sender unless otherwise affirmed independently by the sender. References 1. https://www.google.com/url?q=https://carnation-soft-accordion.glitch.me/&sa…

1 year, 4 months

1
0
0 0

INTERNATIONAL MONETARY FUND {IMF} OFFICE

by Richelle Mae Jaicten

INTERNATIONAL MONETARY FUND {IMF} OFFICE IMF Headquarters. 700 19th Street, N.W, In Affiliation with West African Economic and the Monetary Union (WAEMU). Website:www.imf.org. C/O Kristalina Georgieva E-mail:kristalina.georgieva@outlook.com Attention Beneficiary, Your Long overdue Payment Is Ready. It came to our notice today that your long overdue unpaid contracts inheritance fund, next of kin and lotto benefits that was originated from Africa, Europe, Asia Plus Middle east and American is among the list of individuals and companies that your unpaid fund has been located to the CITY BANK LONDON, UNITED KINGDOM. Your email appeared among the beneficiaries, who will receive a part-payment of your contractual sum and has been approved already for months now. You are requested to get back to us for more directions and instructions on how to receive your fund. However, we received an email from one Mr. Robert Dean Randolph who told us that he is your next of kin and that you died in a car accident last week. He has also submitted his account for us to transfer the fund to him including his International passport. We want to hear from you before we can make the transfer to confirm if you are dead or not. Please in confirmation that you are still alive, you are advised to reconfirm the below listed information to enable us facilitate an immediate payment for you. 1 Your full name 2 Your present contact address. 3 Your telephone & Fax numbers. 4 Your Occupations/age/sex. 5 Your Private Email Address. Once again, We apologize to you on behalf Of IMF (International Monetary Fund) for the delays on paying your funds, which according to records in the system had been long overdue. You can contact the IMF director/chairperson Ms. Kristalina Georgieva on her E-mail:(kristalina.georgieva@outlook.com). Sincerely, Kristalina Georgieva Chairperson/Director IMF, www.imf.org. Phone#:+1 CONFIDENTIALITY NOTICE: This e-mail message (including attachments, if any) is intended for the use of the individual or the entity to whom it is addressed and may contain information that is privileged, proprietary, confidential and exempt from disclosure. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, Please notify the sender and delete this E-mail message immediately.

1 year, 4 months

1
0
0 0

[PATCH 0/2] small amdtee cleanups

by Mario Limonciello

From: Mario Limonciello <mario.limonciello(a)amd.com> I just noticed a few small things for amdtee where the error messages didn't consistently use the driver name. While fixing that I noticed the headers weren't sorted. These patches fix both issues. Mario Limonciello (2): tee: Use pr_fmt for messages tee: Sort header includes drivers/tee/amdtee/core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) -- 2.43.0

1 year, 4 months

3
10
0 0

2026

2025

2024

2023

2022

2021

2020

OP-TEE