- OP-TEE - lists.trustedfirmware.org

[PATCH 1/3] tee: qcomtee: call: Fix confusing cleanup.h syntax

by Krzysztof Kozlowski

Initializing automatic __free variables to NULL without need (e.g. branches with different allocations), followed by actual allocation is in contrary to explicit coding rules guiding cleanup.h: "Given that the "__free(...) = NULL" pattern for variables defined at the top of the function poses this potential interdependency problem the recommendation is to always define and assign variables in one statement and not group variable definitions at the top of the function when __free() is used." Code does not have a bug, but is less readable and uses discouraged coding practice, so fix that by moving declaration to the place of assignment. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> --- drivers/tee/qcomtee/call.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c index 65f9140d4e1f..8f8830f0df26 100644 --- a/drivers/tee/qcomtee/call.c +++ b/drivers/tee/qcomtee/call.c @@ -395,9 +395,7 @@ static int qcomtee_object_invoke(struct tee_context *ctx, struct tee_ioctl_object_invoke_arg *arg, struct tee_param *params) { - struct qcomtee_object_invoke_ctx *oic __free(kfree) = NULL; struct qcomtee_context_data *ctxdata = ctx->data; - struct qcomtee_arg *u __free(kfree) = NULL; struct qcomtee_object *object; int i, ret, result; @@ -412,12 +410,14 @@ static int qcomtee_object_invoke(struct tee_context *ctx, } /* Otherwise, invoke a QTEE object: */ - oic = qcomtee_object_invoke_ctx_alloc(ctx); + struct qcomtee_object_invoke_ctx *oic __free(kfree) = + qcomtee_object_invoke_ctx_alloc(ctx); if (!oic) return -ENOMEM; /* +1 for ending QCOMTEE_ARG_TYPE_INV. */ - u = kcalloc(arg->num_params + 1, sizeof(*u), GFP_KERNEL); + struct qcomtee_arg *u __free(kfree) = kcalloc(arg->num_params + 1, sizeof(*u), + GFP_KERNEL); if (!u) return -ENOMEM; @@ -562,9 +562,8 @@ static int qcomtee_supp_send(struct tee_context *ctx, u32 errno, u32 num_params, static int qcomtee_open(struct tee_context *ctx) { - struct qcomtee_context_data *ctxdata __free(kfree) = NULL; - - ctxdata = kzalloc(sizeof(*ctxdata), GFP_KERNEL); + struct qcomtee_context_data *ctxdata __free(kfree) = kzalloc(sizeof(*ctxdata), + GFP_KERNEL); if (!ctxdata) return -ENOMEM; @@ -645,12 +644,12 @@ static void qcomtee_get_version(struct tee_device *teedev, static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id, u32 *version) { - struct qcomtee_object_invoke_ctx *oic __free(kfree) = NULL; struct qcomtee_object *client_env, *service; struct qcomtee_arg u[3] = { 0 }; int result; - oic = qcomtee_object_invoke_ctx_alloc(ctx); + struct qcomtee_object_invoke_ctx *oic __free(kfree) = + qcomtee_object_invoke_ctx_alloc(ctx); if (!oic) return; -- 2.51.0

5 months, 3 weeks

5
14
0 0

Preparing for OP-TEE 4.9.0

by Jens Wiklander

[BCC all OP-TEE maintainers] Hi OP-TEE maintainers & contributors, OP-TEE version 4.9.0 is now scheduled for release on 2026-01-16. So, now is a good time to start testing the master branch across various platforms and report or fix any bugs. The GitHub pull request for collecting Tested-by tags or any other comments is https://github.com/OP-TEE/optee_os/pull/7666. I have now created the 4.9.0-rc1 tags in the various OP-TEE gits. Please proceed with the testing. You can find more information related to releases here: https://optee.readthedocs.io/en/latest/general/releases.html Thanks, Jens

6 months

1
0
0 0

build breakage with SCMI

by Dan Carpenter

When I try building with `make run WITH_SCMI=y` then the build fails: core/lib/scmi-server/scmi_server.c: In function ‘scmi_server_initialize’: core/lib/scmi-server/scmi_server.c:83:22: error: implicit declaration of function ‘scmi_configure’ [-Wimplicit-function-declaration] 83 | rc = scmi_configure(cfg); | ^~~~~~~~~~~~~~ This was introduced in commit ce6ea4112008 ("scmi-server: configure SCP-firmware from DT"). A grep for scmi_configure() turns up empty. Was part of the commit missing? regards, dan carpenter

6 months, 2 weeks

3
3
0 0

[PATCH v1 00/17] tee: Use bus callbacks instead of driver callbacks

by Uwe Kleine-König

Hello, the objective of this series is to make tee driver stop using callbacks in struct device_driver. These were superseded by bus methods in 2006 (commit 594c8281f905 ("[PATCH] Add bus_type probe, remove, shutdown methods.")) but nobody cared to convert all subsystems accordingly. Here the tee drivers are converted. The first commit is somewhat unrelated, but simplifies the conversion (and the drivers). It introduces driver registration helpers that care about setting the bus and owner. (The latter is missing in all drivers, so by using these helpers the drivers become more correct.) The patches #4 - #17 depend on the first two, so if they should be applied to their respective subsystem trees these must contain the first two patches first. Note that after patch #2 is applied, unconverted drivers provoke a warning in driver_register(), so it would be good for the user experience if the whole series goes in during a single merge window. So I guess an immutable branch containing the frist three patches that can be merged into the other subsystem trees would be sensible. After all patches are applied, tee_bus_type can be made private to drivers/tee as it's not used in other places any more. Best regards Uwe Uwe Kleine-König (17): tee: Add some helpers to reduce boilerplate for tee client drivers tee: Add probe, remove and shutdown bus callbacks to tee_client_driver tee: Adapt documentation to cover recent additions hwrng: optee - Make use of module_tee_client_driver() hwrng: optee - Make use of tee bus methods rtc: optee: Migrate to use tee specific driver registration function rtc: optee: Make use of tee bus methods efi: stmm: Make use of module_tee_client_driver() efi: stmm: Make use of tee bus methods firmware: arm_scmi: optee: Make use of module_tee_client_driver() firmware: arm_scmi: Make use of tee bus methods firmware: tee_bnxt: Make use of module_tee_client_driver() firmware: tee_bnxt: Make use of tee bus methods KEYS: trusted: Migrate to use tee specific driver registration function KEYS: trusted: Make use of tee bus methods tpm/tpm_ftpm_tee: Make use of tee specific driver registration tpm/tpm_ftpm_tee: Make use of tee bus methods Documentation/driver-api/tee.rst | 18 +---- drivers/char/hw_random/optee-rng.c | 26 ++---- drivers/char/tpm/tpm_ftpm_tee.c | 31 +++++--- drivers/firmware/arm_scmi/transports/optee.c | 32 +++----- drivers/firmware/broadcom/tee_bnxt_fw.c | 30 ++----- drivers/firmware/efi/stmm/tee_stmm_efi.c | 25 ++---- drivers/rtc/rtc-optee.c | 27 ++----- drivers/tee/tee_core.c | 84 ++++++++++++++++++++ include/linux/tee_drv.h | 12 +++ security/keys/trusted-keys/trusted_tee.c | 17 ++-- 10 files changed, 164 insertions(+), 138 deletions(-) base-commit: 7d0a66e4bb9081d75c82ec4957c50034cb0ea449 -- 2.47.3

6 months, 2 weeks

6
47
0 0

[PATCH v2] arm64: defconfig: Enable QCOMTEE for Qualcomm SoCs

by Harshal Dev

Enable config 'm' for the QCOMTEE driver to facilitate communication with the Qualcomm Trusted Execution Environment (QTEE) on Qualcomm platforms. Signed-off-by: Harshal Dev <harshal.dev(a)oss.qualcomm.com> --- Changes in v2: - Updated CONFIG_QCOMTEE flag to 'm' since QCOMTEE can be built as a module. - Link to v1: https://lore.kernel.org/r/20251202-qcom_qcomtee_defconfig-v1-1-11bfe40a8ea4… --- arch/arm64/configs/defconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig index cdb7d69e3b24..e952d24bef77 100644 --- a/arch/arm64/configs/defconfig +++ b/arch/arm64/configs/defconfig @@ -1789,6 +1789,7 @@ CONFIG_FPGA_MGR_ZYNQMP_FPGA=m CONFIG_FPGA_MGR_VERSAL_FPGA=m CONFIG_TEE=y CONFIG_OPTEE=y +CONFIG_QCOMTEE=m CONFIG_MUX_GPIO=m CONFIG_MUX_MMIO=y CONFIG_SLIMBUS=m --- base-commit: 47b7b5e32bb7264b51b89186043e1ada4090b558 change-id: 20251202-qcom_qcomtee_defconfig-8dc0fed1411b Best regards, -- Harshal Dev <hdev(a)qti.qualcomm.com>

6 months, 3 weeks

2
4
0 0

[PATCH] arm64: defconfig: Enable QCOMTEE for Qualcomm SoCs

by Harshal Dev

Enable config for the QCOMTEE driver to facilitate communication with the Qualcomm Trusted Execution Environment (QTEE) on Qualcomm platforms. Signed-off-by: Harshal Dev <harshal.dev(a)oss.qualcomm.com> --- arch/arm64/configs/defconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig index cdb7d69e3b24..57b2b09d0479 100644 --- a/arch/arm64/configs/defconfig +++ b/arch/arm64/configs/defconfig @@ -1789,6 +1789,7 @@ CONFIG_FPGA_MGR_ZYNQMP_FPGA=m CONFIG_FPGA_MGR_VERSAL_FPGA=m CONFIG_TEE=y CONFIG_OPTEE=y +CONFIG_QCOMTEE=y CONFIG_MUX_GPIO=m CONFIG_MUX_MMIO=y CONFIG_SLIMBUS=m --- base-commit: 47b7b5e32bb7264b51b89186043e1ada4090b558 change-id: 20251202-qcom_qcomtee_defconfig-8dc0fed1411b Best regards, -- Harshal Dev <harshal.dev(a)oss.qualcomm.com>

6 months, 3 weeks

2
4
0 0

Linaro OP-TEE Contribution, LOC, monthly meeting November 25

by Jens Wiklander

Hi, Tomorrow, Tuesday, it's time for another LOC monthly meeting. For time and connection details, see the calendar at https://www.trustedfirmware.org/meetings/ I have a couple of small things for the agenda: - A recent patch [1] on the mailing list proposes to export the OP-TEE version info printed by the driver during boot in sysfs - Do we have any questions or issues with the proposed CFG_* variable improvements from the last LOC? Are there any other topics? Please note that the LOC in December will be cancelled. [1] https://lore.kernel.org/op-tee/20251121141230.489294-1-jj251510319013@gmail… Cheers, Jens

7 months, 1 week

1
0
0 0

[GIT PULL] QCOMTEE fixes2 for v6.18

by Jens Wiklander

Hello arm-soc maintainers, Please pull these two small fixes for the QCOMTEE driver in the TEE subsystem. Thanks, Jens The following changes since commit 3a8660878839faadb4f1a6dd72c3179c1df56787: Linux 6.18-rc1 (2025-10-12 13:42:36 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee.git tags/qcomtee-fixes2-for-6.18 for you to fetch changes up to e19d7f7e92e061707252eab2b71d2c3be09b2e96: tee: qcomtee: initialize result before use in release worker (2025-11-17 10:19:29 +0100) ---------------------------------------------------------------- QCOMTEE fixes2 for v6.18 - initialize result before use in in error path - fix uninitialized pointers with free attribute ---------------------------------------------------------------- Ally Heev (1): tee: qcomtee: fix uninitialized pointers with free attribute Amirreza Zarrabi (1): tee: qcomtee: initialize result before use in release worker drivers/tee/qcomtee/call.c | 2 +- drivers/tee/qcomtee/core.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)

7 months, 2 weeks

1
0
0 0

[PATCH v2] tee: qcomtee: initialize result before use in release worker

by Amirreza Zarrabi

Initialize result to 0 so the error path doesn't read it uninitialized when the invoke fails. Fixes a Smatch warning. Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/op-tee/7c1e0de2-7d42-4c6b-92fe-0e4fe5d650b5@oss.qua… Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver") Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> --- Changes in v2: - Update subject to tee: qcomtee:. - Link to v1: https://lore.kernel.org/r/20251110-qcom-tee-fix-warning-v1-1-d962f99f385d@o… --- drivers/tee/qcomtee/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tee/qcomtee/core.c b/drivers/tee/qcomtee/core.c index b6715ada7700..ecd04403591c 100644 --- a/drivers/tee/qcomtee/core.c +++ b/drivers/tee/qcomtee/core.c @@ -82,7 +82,7 @@ static void qcomtee_do_release_qtee_object(struct work_struct *work) { struct qcomtee_object *object; struct qcomtee *qcomtee; - int ret, result; + int ret, result = 0; /* RELEASE does not require any argument. */ struct qcomtee_arg args[] = { { .type = QCOMTEE_ARG_TYPE_INV } }; --- base-commit: ab40c92c74c6b0c611c89516794502b3a3173966 change-id: 20251110-qcom-tee-fix-warning-3d58d74a22d8 Best regards, -- Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com>

7 months, 2 weeks

4
3
0 0

[PATCH v2] tee: optee: prevent use-after-free when the client exits before the supplicant

by Amirreza Zarrabi

Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate while the supplicant is still processing its request. If the client exits first it removes the request from its queue and kfree()s it, while the request ID remains in supp->idr. A subsequent lookup on the supplicant path then dereferences freed memory, leading to a use-after-free. Serialise access to the request with supp->mutex: * Hold supp->mutex in optee_supp_recv() and optee_supp_send() while looking up and touching the request. * Let optee_supp_thrd_req() notice that the client has terminated and signal optee_supp_send() accordingly. With these changes the request cannot be freed while the supplicant still has a reference, eliminating the race. Fixes: 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> --- Changes in v2: - Replace the static variable with a sentinel value. - Fix the issue with returning the popped request to the supplicant. - Link to v1: https://lore.kernel.org/r/20250605-fix-use-after-free-v1-1-a70d23bff248@oss… --- drivers/tee/optee/supp.c | 110 ++++++++++++++++++++++++++++++++--------------- 1 file changed, 75 insertions(+), 35 deletions(-) diff --git a/drivers/tee/optee/supp.c b/drivers/tee/optee/supp.c index d0f397c90242..fa39f5f226aa 100644 --- a/drivers/tee/optee/supp.c +++ b/drivers/tee/optee/supp.c @@ -9,6 +9,7 @@ struct optee_supp_req { struct list_head link; + int id; bool in_queue; u32 func; @@ -19,6 +20,9 @@ struct optee_supp_req { struct completion c; }; +/* It is temporary request used for invalid pending request in supp->idr. */ +#define INVALID_REQ_PTR ((struct optee_supp_req *)ERR_PTR(-ENOENT)) + void optee_supp_init(struct optee_supp *supp) { memset(supp, 0, sizeof(*supp)); @@ -102,6 +106,7 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params, mutex_lock(&supp->mutex); list_add_tail(&req->link, &supp->reqs); req->in_queue = true; + req->id = -1; mutex_unlock(&supp->mutex); /* Tell an eventual waiter there's a new request */ @@ -117,21 +122,40 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params, if (wait_for_completion_killable(&req->c)) { mutex_lock(&supp->mutex); if (req->in_queue) { + /* Supplicant has not seen this request yet. */ list_del(&req->link); req->in_queue = false; + + ret = TEEC_ERROR_COMMUNICATION; + } else if (req->id == -1) { + /* + * Supplicant has processed this request. Ignore the + * kill signal for now and submit the result. + */ + ret = req->ret; + } else { + /* + * Supplicant is in the middle of processing this + * request. Replace req with INVALID_REQ_PTR so that + * the ID remains busy, causing optee_supp_send() to + * fail on the next call to supp_pop_req() with this ID. + */ + idr_replace(&supp->idr, INVALID_REQ_PTR, req->id); + ret = TEEC_ERROR_COMMUNICATION; } + mutex_unlock(&supp->mutex); - req->ret = TEEC_ERROR_COMMUNICATION; + } else { + ret = req->ret; } - ret = req->ret; kfree(req); return ret; } static struct optee_supp_req *supp_pop_entry(struct optee_supp *supp, - int num_params, int *id) + int num_params) { struct optee_supp_req *req; @@ -153,8 +177,8 @@ static struct optee_supp_req *supp_pop_entry(struct optee_supp *supp, return ERR_PTR(-EINVAL); } - *id = idr_alloc(&supp->idr, req, 1, 0, GFP_KERNEL); - if (*id < 0) + req->id = idr_alloc(&supp->idr, req, 1, 0, GFP_KERNEL); + if (req->id < 0) return ERR_PTR(-ENOMEM); list_del(&req->link); @@ -214,7 +238,6 @@ int optee_supp_recv(struct tee_context *ctx, u32 *func, u32 *num_params, struct optee *optee = tee_get_drvdata(teedev); struct optee_supp *supp = &optee->supp; struct optee_supp_req *req = NULL; - int id; size_t num_meta; int rc; @@ -223,16 +246,47 @@ int optee_supp_recv(struct tee_context *ctx, u32 *func, u32 *num_params, return rc; while (true) { - mutex_lock(&supp->mutex); - req = supp_pop_entry(supp, *num_params - num_meta, &id); - mutex_unlock(&supp->mutex); + scoped_guard(mutex, &supp->mutex) { + req = supp_pop_entry(supp, *num_params - num_meta); + if (!req) + goto wait_for_request; - if (req) { if (IS_ERR(req)) return PTR_ERR(req); - break; + + /* + * Process the request while holding the lock, + * so that optee_supp_thrd_req() doesn't pull the + * request out from under us. + */ + + if (num_meta) { + /* + * tee-supplicant support meta parameters -> + * requests can be processed asynchronously. + */ + param->attr = + TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT | + TEE_IOCTL_PARAM_ATTR_META; + param->u.value.a = req->id; + param->u.value.b = 0; + param->u.value.c = 0; + } else { + supp->req_id = req->id; + } + + *func = req->func; + *num_params = req->num_params + num_meta; + memcpy(param + num_meta, req->param, + sizeof(struct tee_param) * req->num_params); + + return 0; } + /* Check for the next request in the queue. */ + continue; + +wait_for_request: /* * If we didn't get a request we'll block in * wait_for_completion() to avoid needless spinning. @@ -245,27 +299,6 @@ int optee_supp_recv(struct tee_context *ctx, u32 *func, u32 *num_params, return -ERESTARTSYS; } - if (num_meta) { - /* - * tee-supplicant support meta parameters -> requsts can be - * processed asynchronously. - */ - param->attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT | - TEE_IOCTL_PARAM_ATTR_META; - param->u.value.a = id; - param->u.value.b = 0; - param->u.value.c = 0; - } else { - mutex_lock(&supp->mutex); - supp->req_id = id; - mutex_unlock(&supp->mutex); - } - - *func = req->func; - *num_params = req->num_params + num_meta; - memcpy(param + num_meta, req->param, - sizeof(struct tee_param) * req->num_params); - return 0; } @@ -297,12 +330,19 @@ static struct optee_supp_req *supp_pop_req(struct optee_supp *supp, if (!req) return ERR_PTR(-ENOENT); + /* optee_supp_thrd_req() already returned to optee. */ + if (IS_ERR(req)) + goto failed_req; + if ((num_params - nm) != req->num_params) return ERR_PTR(-EINVAL); + req->id = -1; + *num_meta = nm; +failed_req: idr_remove(&supp->idr, id); supp->req_id = -1; - *num_meta = nm; + return req; } @@ -328,9 +368,8 @@ int optee_supp_send(struct tee_context *ctx, u32 ret, u32 num_params, mutex_lock(&supp->mutex); req = supp_pop_req(supp, num_params, param, &num_meta); - mutex_unlock(&supp->mutex); - if (IS_ERR(req)) { + mutex_unlock(&supp->mutex); /* Something is wrong, let supplicant restart. */ return PTR_ERR(req); } @@ -358,6 +397,7 @@ int optee_supp_send(struct tee_context *ctx, u32 ret, u32 num_params, /* Let the requesting thread continue */ complete(&req->c); + mutex_unlock(&supp->mutex); return 0; } --- base-commit: 3be1a7a31fbda82f3604b6c31e4f390110de1b46 change-id: 20250604-fix-use-after-free-8ff1b5d5d774 Best regards, -- Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com>

7 months, 2 weeks

3
2
0 0

2026

2025

2024

2023

2022

2021

2020

OP-TEE