- OP-TEE - lists.trustedfirmware.org

[PATCH] tee: optee: release the supplicant when its device file is closed

by Arun Iyengar via B4 Relay

From: Arun Iyengar <aiyengar1990(a)gmail.com> optee_supp_release() runs only on the context's last reference, which RPC shared memory can hold. If tee-supplicant exits during an RPC, the next request waits forever and a new tee-supplicant gets -EBUSY. Detach the supplicant in .close_context instead. Fixes: 217e0250cccb ("tee: use reference counting for tee_context") Signed-off-by: Arun Iyengar <aiyengar1990(a)gmail.com> --- Tested on an Orange Pi 5 (RK3588S, SMC ABI), 7.3-based KASAN + lockdep kernel: tee-supplicant stopped and restarted during fTPM NV writes, no hung task; the fTPM TA then stays dead until a reboot. FF-A is build-tested only. Developed with Claude (Anthropic), which wrote the code and the commit message. I reviewed it. --- drivers/tee/optee/core.c | 4 +--- drivers/tee/optee/ffa_abi.c | 3 ++- drivers/tee/optee/optee_private.h | 2 +- drivers/tee/optee/smc_abi.c | 3 ++- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c index a52c1f498b99..f446b40d7827 100644 --- a/drivers/tee/optee/core.c +++ b/drivers/tee/optee/core.c @@ -184,12 +184,10 @@ void optee_release(struct tee_context *ctx) optee_release_helper(ctx, optee_close_session_helper); } -void optee_release_supp(struct tee_context *ctx) +void optee_close_context_supp(struct tee_context *ctx) { struct optee *optee = tee_get_drvdata(ctx->teedev); - optee_release_helper(ctx, optee_close_session_helper); - optee_supp_release(&optee->supp); } diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c index 702da7d98fbc..155ce9856de9 100644 --- a/drivers/tee/optee/ffa_abi.c +++ b/drivers/tee/optee/ffa_abi.c @@ -957,7 +957,8 @@ static const struct tee_driver_ops optee_ffa_supp_ops = { .get_version = optee_ffa_get_version, .get_tee_revision = optee_get_revision, .open = optee_ffa_open, - .release = optee_release_supp, + .close_context = optee_close_context_supp, + .release = optee_release, .supp_recv = optee_supp_recv, .supp_send = optee_supp_send, .shm_register = optee_ffa_shm_register, /* same as for clnt ops */ diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h index 94a4f251f5cf..6495e0f07deb 100644 --- a/drivers/tee/optee/optee_private.h +++ b/drivers/tee/optee/optee_private.h @@ -370,7 +370,7 @@ void optee_set_dev_group(struct optee *optee); void optee_remove_common(struct optee *optee); int optee_open(struct tee_context *ctx, bool cap_memref_null); void optee_release(struct tee_context *ctx); -void optee_release_supp(struct tee_context *ctx); +void optee_close_context_supp(struct tee_context *ctx); static inline void optee_from_msg_param_value(struct tee_param *p, u32 attr, const struct optee_msg_param *mp) diff --git a/drivers/tee/optee/smc_abi.c b/drivers/tee/optee/smc_abi.c index 51624443359b..0278dc6b0119 100644 --- a/drivers/tee/optee/smc_abi.c +++ b/drivers/tee/optee/smc_abi.c @@ -1264,7 +1264,8 @@ static const struct tee_driver_ops optee_supp_ops = { .get_version = optee_get_version, .get_tee_revision = optee_get_revision, .open = optee_smc_open, - .release = optee_release_supp, + .close_context = optee_close_context_supp, + .release = optee_release, .supp_recv = optee_supp_recv, .supp_send = optee_supp_send, .shm_register = optee_shm_register_supp, --- base-commit: e21989d08e0d6abacfff71387d0cb36dd96a4079 change-id: 20261115-optee-supp-close-45df0ffe66b3 Best regards, -- Arun Iyengar <aiyengar1990(a)gmail.com>

7 hours, 8 minutes

1
0
0 0

Re: [PATCH v2 4/6] tee: optee: Register TEE devices on the platform bus

by Harshal Dev

+ op-tee(a)lists.trustedfirmware.org, Jens Wiklander <jens.wiklander(a)oss.qualcomm.com> On 11-11-2026 07:47 pm, Harshal Dev wrote: > The Qualcomm Inline Crypto Engine (ICE) driver is an independent platform > driver which polls on availability of a TEE interface (SCM driver) before > checking if the ICE secure service is supported by QTEE by querying the > qcom_scm_ice_available() API. > > The TEE subsystem currently does not provide any way to notify regarding > the availability of a TEE interface, i.e. whether QCOMTEE or OPTEE have > probed. And so when migrating to the TEE subsystem via an ICE TEE client > driver, ICE needs to defer probe until the OPTEE ICE Pseudo TA becomes > available on the TEE bus. This means that for OPTEE builds without the > ICE PTA, the ICE driver would indefintely defer probe and the dependent > UFS/SDHC storage driver will fail to come online. > > Add support for optionally registering the back-end TEE devices which > represent a particular TEE (say OPTEE) on the platform bus via the > tee_platform_device_register() API. This allows drivers which poll on > TEE secure interface availability to be notified even if the TEE service > itself is not supported. > > Signed-off-by: Harshal Dev <harshal.dev(a)oss.qualcomm.com> > --- > MAINTAINERS | 1 + > drivers/firmware/qcom/qcom_ice_tee.c | 41 ++++++++++++++++++++++++++++++ > drivers/soc/qcom/Kconfig | 1 + > drivers/soc/qcom/ice.c | 9 ++++++- > drivers/tee/optee/ffa_abi.c | 8 ++++++ > drivers/tee/optee/smc_abi.c | 8 ++++++ > drivers/tee/tee_core.c | 21 +++++++++++++++ > include/linux/firmware/qcom/qcom_ice_tee.h | 10 ++++++++ > include/linux/tee_core.h | 9 +++++++ > 9 files changed, 107 insertions(+), 1 deletion(-) > > diff --git a/MAINTAINERS b/MAINTAINERS > index 1132e456488b..06dba76996b8 100644 > --- a/MAINTAINERS > +++ b/MAINTAINERS > @@ -23013,6 +23013,7 @@ L: linux-arm-msm(a)vger.kernel.org > L: linux-crypto(a)vger.kernel.org > S: Maintained > F: drivers/firmware/qcom/qcom_ice_tee.c > +F: include/linux/firmware/qcom/qcom_ice_tee.h > > QUALCOMM INTERCONNECT BWMON DRIVER > M: Krzysztof Kozlowski <krzk(a)kernel.org> > diff --git a/drivers/firmware/qcom/qcom_ice_tee.c b/drivers/firmware/qcom/qcom_ice_tee.c > index 694aa05847f0..39f7094439d9 100644 > --- a/drivers/firmware/qcom/qcom_ice_tee.c > +++ b/drivers/firmware/qcom/qcom_ice_tee.c > @@ -5,6 +5,7 @@ > > #include <linux/kernel.h> > #include <linux/module.h> > +#include <linux/platform_device.h> > #include <linux/slab.h> > #include <linux/tee_drv.h> > #include <linux/uuid.h> > @@ -22,6 +23,9 @@ > > #define TEE_NUM_PARAMS 4 > > +/* This represents the back-end OPTEE device */ > +static struct device *__teedev; > + > struct qcom_ice_tee_private { > struct device *dev; > struct tee_context *ctx; > @@ -281,6 +285,18 @@ static int qcom_ice_tee_import_key(struct device *dev, > lt_key, lt_key_size); > } > > +bool qcom_ice_tee_is_available(void) > +{ > + /* > + * Paired with smp_load_acquire() in qcom_ice_plat_probe(). > + * > + * This marks the availability of the OPTEE interface informing the > + * polling ICE driver that the platform supports a TEE. > + */ > + return !!smp_load_acquire(&__teedev); > +} > +EXPORT_SYMBOL_GPL(qcom_ice_tee_is_available); > + > static bool qcom_ice_tee_has_wrapped_key_support(struct device *dev) > { > struct qcom_ice_tee_private *data = dev_get_drvdata(dev); > @@ -398,5 +414,30 @@ static struct tee_client_driver qcom_ice_tee_driver = { > > module_tee_client_driver(qcom_ice_tee_driver); > > +static int qcom_ice_plat_probe(struct platform_device *pdev) > +{ > + /* Paired with smp_load_acquire() in qcom_ice_tee_is_available() */ > + smp_store_release(&__teedev, &pdev->dev); > + return 0; > +} > + > +static const struct platform_device_id qcom_ice_plat_id_table[] = { > + { > + .name = "optee", > + }, > + { } > +}; > +MODULE_DEVICE_TABLE(platform, qcom_ice_plat_id_table); > + > +static struct platform_driver qcom_ice_plat_driver = { > + .probe = qcom_ice_plat_probe, > + .id_table = qcom_ice_plat_id_table, > + .driver = { > + .name = "qcom-ice-plat", > + }, > +}; > + > +module_platform_driver(qcom_ice_plat_driver); > + > MODULE_LICENSE("GPL"); > MODULE_DESCRIPTION("Qualcomm ICE TEE driver"); > diff --git a/drivers/soc/qcom/Kconfig b/drivers/soc/qcom/Kconfig > index 535c8619197b..8dc75c252f52 100644 > --- a/drivers/soc/qcom/Kconfig > +++ b/drivers/soc/qcom/Kconfig > @@ -296,6 +296,7 @@ endif > config QCOM_INLINE_CRYPTO_ENGINE > tristate > select QCOM_SCM > + select QCOM_ICE_TEE > > config QCOM_KRYO_L2_ACCESSORS > bool > diff --git a/drivers/soc/qcom/ice.c b/drivers/soc/qcom/ice.c > index 452896b1858f..4844621b7497 100644 > --- a/drivers/soc/qcom/ice.c > +++ b/drivers/soc/qcom/ice.c > @@ -18,6 +18,7 @@ > #include <linux/platform_device.h> > #include <linux/xarray.h> > > +#include <linux/firmware/qcom/qcom_ice_tee.h> > #include <linux/firmware/qcom/qcom_scm.h> > > #include <soc/qcom/ice.h> > @@ -132,7 +133,13 @@ static bool qcom_ice_tz_ops_registered(void) > > static bool qcom_ice_tz_is_available(void) > { > - return qcom_scm_is_available(); > + /* > + * Both back-ends should be available before we check for > + * qcom_ice_tz_ops_registered(), otherwise we could pre-maturely > + * assume that TZ does not provide any ICE secure interface. > + */ > + return (qcom_scm_is_available() & qcom_ice_tee_is_available()); > + > } > > static int qcom_ice_tz_invalidate_key(u32 index) > diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c > index 702da7d98fbc..2c0065f3d9e4 100644 > --- a/drivers/tee/optee/ffa_abi.c > +++ b/drivers/tee/optee/ffa_abi.c > @@ -1177,6 +1177,14 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) > if (rc) > goto err_unregister_devices; > > + /* > + * Device should only be visible on the platform bus once the > + * child devices have already been enumerated on the TEE bus. > + */ > + rc = tee_platform_device_register(optee->teedev, "optee"); > + if (rc) > + goto err_unregister_devices; > + > INIT_WORK(&optee->rpmb_scan_bus_work, optee_bus_scan_rpmb); > optee->rpmb_intf.notifier_call = optee_rpmb_intf_rdev; > blocking_notifier_chain_register(&optee_rpmb_intf_added, > diff --git a/drivers/tee/optee/smc_abi.c b/drivers/tee/optee/smc_abi.c > index 51624443359b..85ee76173982 100644 > --- a/drivers/tee/optee/smc_abi.c > +++ b/drivers/tee/optee/smc_abi.c > @@ -1920,6 +1920,14 @@ static int optee_probe(struct platform_device *pdev) > if (rc) > goto err_disable_shm_cache; > > + /* > + * Device should only be visible on the platform bus once the > + * child devices have already been enumerated on the TEE bus. > + */ > + rc = tee_platform_device_register(optee->teedev, "optee"); > + if (rc) > + goto err_disable_shm_cache; > + > INIT_WORK(&optee->rpmb_scan_bus_work, optee_bus_scan_rpmb); > optee->rpmb_intf.notifier_call = optee_rpmb_intf_rdev; > blocking_notifier_chain_register(&optee_rpmb_intf_added, > diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c > index 1aac50c7c1de..0d3c266b29c7 100644 > --- a/drivers/tee/tee_core.c > +++ b/drivers/tee/tee_core.c > @@ -10,6 +10,7 @@ > #include <linux/fs.h> > #include <linux/idr.h> > #include <linux/module.h> > +#include <linux/platform_device.h> > #include <linux/overflow.h> > #include <linux/slab.h> > #include <linux/tee_core.h> > @@ -1225,6 +1226,26 @@ int tee_device_register(struct tee_device *teedev) > } > EXPORT_SYMBOL_GPL(tee_device_register); > > +static void plat_tee_free(void *data) > +{ > + struct platform_device *plat_dev = data; > + > + platform_device_unregister(plat_dev); > +} > + > +int tee_platform_device_register(struct tee_device *teedev, const char *teename) > +{ > + struct platform_device *plat_dev; > + > + plat_dev = platform_device_register_data(&teedev->dev, teename, > + PLATFORM_DEVID_NONE, NULL, 0); > + if (IS_ERR(plat_dev)) > + return PTR_ERR(plat_dev); > + > + devm_add_action_or_reset(&teedev->dev, plat_tee_free, plat_dev); > + return 0; > +} > + > void tee_device_put(struct tee_device *teedev) > { > mutex_lock(&teedev->mutex); > diff --git a/include/linux/firmware/qcom/qcom_ice_tee.h b/include/linux/firmware/qcom/qcom_ice_tee.h > new file mode 100644 > index 000000000000..a5906c5d4e39 > --- /dev/null > +++ b/include/linux/firmware/qcom/qcom_ice_tee.h > @@ -0,0 +1,10 @@ > +/* SPDX-License-Identifier: GPL-2.0-only */ > +/* > + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. > + */ > +#ifndef __QCOM_ICE_TEE > +#define __QCOM_ICE_TEE > + > +bool qcom_ice_tee_is_available(void); > + > +#endif /* __QCOM_ICE_TEE */ > diff --git a/include/linux/tee_core.h b/include/linux/tee_core.h > index f993d5118edd..d5310b404c1e 100644 > --- a/include/linux/tee_core.h > +++ b/include/linux/tee_core.h > @@ -205,6 +205,15 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc, > */ > int tee_device_register(struct tee_device *teedev); > > +/** > + * tee_platform_device_register() - Registers a TEE platform device > + * @teedev: Device to register > + * @teename: Name of the TEE the device represents > + * > + * @returns: < 0 on failure > + */ > +int tee_platform_device_register(struct tee_device *teedev, const char *teename); > + > /** > * tee_device_unregister() - Removes a TEE device > * @teedev: Device to unregister >

1 day, 19 hours

1
1
0 0

[PATCH] tee: shm: sync DMA memory for the device before it is lent

by Tyler Baker

tee_shm_alloc_dma_mem() returns dma_alloc_pages() memory without the dma_sync_single_for_device() that the DMA API requires before a device uses it. dma_alloc_pages() zeroes the pages through the cacheable linear map, so the zeroes can still be dirty in the cache when the optee protected memory pool lends the pages and a Secure Data Path TA writes them through its secure mapping. A later eviction of those lines overwrites the TA's data. On an Eliza EVK with OP-TEE as the FF-A SPMC, a TA decrypts into a protected buffer, a read of all RAM through /proc/kcore evicts the lines, and the TA's digest of the buffer no longer matches: frame 0: 0e534d8c..., reference d98ddba1... Sync the allocation for the device before returning it. Fixes: ab09dd6d9201 ("tee: add tee_shm_alloc_dma_mem()") Cc: stable(a)vger.kernel.org Signed-off-by: Tyler Baker <tyler.baker(a)oss.qualcomm.com> --- Vincent's direct-map series [1] cleans the range in dma_zap_direct_map() before the lend, which also covers this when it can unmap. It returns -ENODEV without any cache maintenance when there is no lendable pool and the direct map cannot change (arm64 with rodata=noalias or rodata=off), and it is not a stable candidate. On a dma-coherent TEE device the sync does nothing. teedev->dev is not configured from firmware, so it is not coherent today. Without the fix the TA's data is lost: https://lava.infra.foundries.io/scheduler/job/554467#L2262 With it, the data is intact after the scan and 50 lend rounds: https://lava.infra.foundries.io/scheduler/job/563840#L1979 https://lava.infra.foundries.io/scheduler/job/563840#L2008 [1] https://lore.kernel.org/all/20261111110738.872947-1-vdonnefort@google.com/ --- drivers/tee/tee_shm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 5c47a36916c45..70a273a425f88 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -297,6 +297,9 @@ struct tee_shm *tee_shm_alloc_dma_mem(struct tee_context *ctx, if (!page) goto err_put_teedev; + dma_sync_single_for_device(&teedev->dev, dma_addr, + page_count * PAGE_SIZE, DMA_BIDIRECTIONAL); + dma_mem = kzalloc_obj(*dma_mem); if (!dma_mem) goto err_free_pages; --- base-commit: e21989d08e0d6abacfff71387d0cb36dd96a4079 change-id: 20261113-tee-shm-dma-sync-12f58435b81e Best regards, -- Tyler Baker <tyler.baker(a)oss.qualcomm.com>

2 days, 2 hours

1
0
0 0

[RFC PATCH v2 0/3] uid_r: convert tun, ivpu and tee

by Jan Koester

Hi, Building the UUID/GUID id RFC (uid_r v2, <cover.1792552161.git.jan.koester(a)tuxist.de>) with a distribution config instead of the one I had tested with turned up three users of kuid_t/kgid_t it doesn't build with: kuid_t is a tagged union now and has no .val, and it no longer fits READ_ONCE()/WRITE_ONCE(). 1/3 tun: TUNSETOWNER/TUNSETGROUP write the owner and group under RTNL, tun_fill_info() may read them without it. Mark that read as data_race() instead of READ_ONCE(). Only classic ids from make_kuid()/make_kgid() are ever stored there. 2/3 accel/ivpu: the per-user context limits are keyed by __kuid_val(). UUID and GUID users share the (uid_t)-1 bucket, which only makes the limit stricter for them. 3/3 tee: the TEE_IOCTL_LOGIN_USER client UUID is derived from the classic uid. With __kuid_val() alone every UUID or GUID user would get the same one and could act as any other such user towards the TEE, so those logins are refused with -EPERM, like ublk refuses unprivileged devices to them in the series. These belong into the series before the patch that lets kuid_t and kgid_t hold a UUID or a GUID and will be folded in there in v3; I'm sending them now so that the reviewers of these drivers see what uid_r means for them. Jan Koester (3): tun: read the owner and group without READ_ONCE() accel/ivpu: key user limits by __kuid_val() tee: refuse user logins of UUID and GUID users drivers/accel/ivpu/ivpu_drv.c | 2 +- drivers/net/tun.c | 8 ++++---- drivers/tee/tee_core.c | 13 +++++++++++-- 3 files changed, 16 insertions(+), 7 deletions(-) -- 2.53.0

2 days, 16 hours

2
1
0 0

[PATCH v3 0/8] arm64: Unmap FF-A lent memory from direct map

by Vincent Donnefort

This series is a follow-up to the discussion that has started here [1]. When memory is lent to the Secure world via FF-A, CPU speculative accesses from NS to the lent pages can still occur as long as it retains a cacheable mapping to it. Ideally, lent memory would be "no-map" but that would mean giving up MiBs of useful memory, so let's try to do better with the help of a CMA pool. On arm64, modifying the direct map at runtime is generally restricted because the linear map defaults to block mapping and splitting blocks at runtime may trigger fatal page fault, unless the CPU implements BBML3 or the entire direct map was mapped at page granularity from boot. Forcing last-level mappings system-wide incurs a severe penalty we want to avoid. Instead, this series introduces targeted last-level mappings for designated memory regions, along with a generic "lendable-dma-pool" CMA driver to manage unmapping and remapping on lend/reclaim transitions: 1. memblock: - Introduce MEMBLOCK_PTEMAP to force PTE mappings only for a specific region. 2. dma-mapping: - Introduce the "lendable-dma-pool" CMA reserved-memory driver, along with generic dma_zap_direct_map() and dma_restore_direct_map() APIs to unmap pages from the direct map and restore them. 3. arm64 direct map support: - Implement the "lendable-dma-pool" hooks. 4. OP-TEE support: - Hook OP-TEE dynamic protected memory allocation (tee_shm_alloc_dma_mem()) to dma_zap_direct_map() and dma_restore_direct_map(). Testing: ======== Tested with QEMU v8 using OP-TEE OS (built with CFG_CORE_DYN_PROTMEM=y) under both SMC and FF-A transports [2] static void dump_direct_map(const char *label) { printf("\n=== %s ===\n", label); fflush(stdout); system("sed -n '/Linear Mapping start/,/Linear Mapping end/p' /sys/kernel/debug/kernel_page_tables"); fflush(stdout); } int main(int argc, char *argv[]) { int heap_fd; int dmabuf_fd; struct dma_heap_allocation_data data = { 0 }; size_t size = 1024 * 1024; /* 1MB */ if (argc > 1) size = strtoul(argv[1], NULL, 0); dump_direct_map("BEFORE ALLOCATION"); heap_fd = open("/dev/dma_heap/protected,secure-video", O_RDWR); if (heap_fd < 0) { perror("open /dev/dma_heap/protected,secure-video"); return 1; } printf("\nOpened /dev/dma_heap/protected,secure-video\n"); printf("Allocating %zu bytes of protected memory via DMA heap...\n", size); data.len = size; data.fd_flags = O_RDWR | O_CLOEXEC; if (ioctl(heap_fd, DMA_HEAP_IOCTL_ALLOC, &data) < 0) { perror("ioctl DMA_HEAP_IOCTL_ALLOC"); close(heap_fd); return 1; } dmabuf_fd = data.fd; printf("Successfully allocated %zu bytes! dmabuf_fd = %d\n", size, dmabuf_fd); dump_direct_map("DURING LEND (EXPECT HOLE IN DIRECT MAP)"); printf("\nReleasing dmabuf_fd...\n"); close(dmabuf_fd); close(heap_fd); dump_direct_map("AFTER RECLAIM (RESTORED DIRECT MAP)"); return 0; } [1] https://lore.kernel.org/all/20260807-tegra-vpr-v4-7-5510d16af89e@nvidia.com/ [2] https://optee.readthedocs.io/en/latest/building/gits/build.html#qemu-v8 Changelog: v3: - Replace "arm,ffa-lend-pool" and OP-TEE "memory-region" DT binding with generic "lendable-dma-pool" compatible with "linux,cma-default" (Sumit). - move conflict check to flag-setting time in memblock_setclr_flag() (Mike) - Rebase onto v7.4-rc1. v2 (https://lore.kernel.org/all/20260921110050.3977591-1-vdonnefort@google.com/): - Rename MEMBLOCK_LLMAP to MEMBLOCK_PTEMAP (Mike) - Warn on conflicting MEMBLOCK_NOMAP and MEMBLOCK_PTEMAP flags (Mike) - Drop DT "ll-map" property and mark MEMBLOCK_PTEMAP from ffa_lend_pool_setup() (Rob, Thierry) - Drop "reusable" and "no-map" property checks from ffa_lend_pool_setup() (Rob) - dt-bindings: Document arm,ffa-lend-pool (Rob) - Rework the Optee support with a separate ffa_lend_pool.c file. - use walk_kernel_page_table_range_lockless() for can_set_direct_map_range() to fix folded page table (Sashiko) - Add missing TLB flush in ffa_prepare_lend() - Disable hibernation - Rebase on linux-next (next-20260918) to use the new set_direct_map*() ranges (Mike) v1 (https://lore.kernel.org/all/20260902104712.2399797-1-vdonnefort@google.com/) Vincent Donnefort (8): memblock: Introduce MEMBLOCK_PTEMAP arm64: Add support for MEMBLOCK_PTEMAP dma-contiguous: Expose rmem_cma_ops dt-bindings: reserved-memory: Add lendable-dma-pool dma-mapping: Introduce lendable-dma-pool arm64: Introduce direct_map_is_ptemap() arm64: Add support for lendable-dma-pool optee: Add support for lendable-dma-pool .../reserved-memory/lendable-dma-pool.yaml | 58 +++++ arch/arm64/Kconfig | 1 + arch/arm64/include/asm/set_memory.h | 6 + arch/arm64/mm/dma-mapping.c | 71 +++++ arch/arm64/mm/mmu.c | 22 +- arch/arm64/mm/pageattr.c | 121 ++++++++- drivers/tee/optee/protmem.c | 48 +++- include/linux/dma-map-ops.h | 9 + include/linux/dma-mapping.h | 16 ++ include/linux/memblock.h | 9 + kernel/dma/Kconfig | 3 + kernel/dma/Makefile | 1 + kernel/dma/contiguous.c | 4 +- kernel/dma/contiguous.h | 10 + kernel/dma/lendable.c | 243 ++++++++++++++++++ mm/memblock.c | 39 ++- 16 files changed, 630 insertions(+), 31 deletions(-) create mode 100644 Documentation/devicetree/bindings/reserved-memory/lendable-dma-pool.yaml create mode 100644 kernel/dma/contiguous.h create mode 100644 kernel/dma/lendable.c base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4 -- 2.56.0.542.g3ef89b7020-goog

3 days, 5 hours

2
10
0 0

[PATCH v4 0/8] memcg: dma-buf cgroup accounting and charge transfer

by Albert Esteve

Shared-memory allocator services (e.g., Android's gralloc) allocate dma-bufs on behalf of client processes in different cgroups. Today those allocations are charged to the allocator's own cgroup, leaving client cgroups with no visibility into their actual memory consumption and defeating resource limits. This series adds memory cgroup accounting for dma-buf allocations, building on T.J. Mercier's earlier series [1] and incorporating feedback from previous versions and LPC discussions [2]. Patch 1 introduces the MEMCG_DMABUF stat and reserve/cancel and uncharge helpers in mm/memcontrol.c Patch 2 wires up the charging policy: dma_buf_export() stores exp_info.memcg and updates the stat, a new charge_fd field in DMA_HEAP_IOCTL_ALLOC accepts a pidfd or cgroupfd to identify the target cgroup, and __GFP_ACCOUNT is removed from system-heap allocations to avoid double counting. Patch 3 adds DMA_BUF_IOCTL_XFER_CHARGE, a general ioctl on any dma-buf fd to transfer charges post-allocation. This covers the double-hop allocator case (SurfaceFlinger -> gralloc -> kernel) and works for buffers from any exporter (DRM, V4L2, etc.). Charging is gated by dmabuf->memcg being set at export time, ensuring that transfer is only applied for buffers backed by system memory where size reflects actual bytes. If the receiving cgroup lacks capacity for the charge, the ioctl returns -ENOMEM and the original charge is preserved. Patches 4-7 add access control for cross-cgroup charging. Letting userspace decide who to charge needs to be a privileged operation because it has material impact on OOM decission and resource limits. We gate it via LSM hooks for the two charge_fd flavours: security_dma_buf_charge_task() gates the pidfd path (target identified by task credentials) and security_dma_buf_charge_cgroup() gates the cgroupfd path (target identified by cgroup directory label), with SELinux implementations under a dma_buf object class. Patch 8 adds selftests. Known limitations: - Single-owner model: a dma-buf carries one memcg charge regardless of how many processes share it. - Only memcg accounting. CMA heaps would additionally need dmem controller integration. - If a transfer of an uncharged buffer fails, the buffer remains charged to the original cgroup. The allocator (userspace) is expected to handle this (retry, free, ...). - The LSM hooks are intentionally narrow. Broader cgroup access controls (e.g. for the memfd/kexec handover case [2]) could be a separate effort reusing the same pattern. - Only system heap sets exp_info.memcg today. Other exporters (DRM, V4L2, etc.) can opt in by setting it, but are not covered by this series. - Related to the above: lazy backing-store allocation is not supported. This can be extended later, e.g., by adding a flag on the dma-buf struct for explicitly marking when memory is committed. [1] https://lore.kernel.org/cgroups/20230109213809.418135-1-tjmercier@google.co… [2] https://lpc.events/event/20/contributions/2416/ Signed-off-by: Albert Esteve <aesteve(a)redhat.com> --- Changes in v4: - Remove memcg_account flag; exp_info.memcg != NULL is the opt-in - Centralize memcg bookkeeping in dma_buf_export() - Drop mem_cgroup_commit_dmabuf() - Make mem_cgroup_transfer_charge() generic (not dma-buf specific) - Add EXPORT_SYMBOL_GPL for reserve/cancel (system_heap is tristate) - Reorder: move xfer ioctl before LSM patches - Serialize dmabuf->memcg updates with the dma-buf resv lock instead of cmpxchg - Link to v3: https://lore.kernel.org/r/20261027-v2_20230123_tjmercier_google_com-v3-0-78… Changes in v3: - Split mem_cgroup_charge_dmabuf() into reserve/commit/cancel three-phase API - Extract mem_cgroup_get_from_fd() helper shared by allocate and xfer paths - Rename __padding to flags in struct dma_buf_transfer_charge - Fix UAF race: move mod_memcg_state() before cmpxchg in transfer - Add memcg_account opt-in flag; xfer returns -EOPNOTSUPP if unset - Wrap dma_buf_charge_cgroup hook in #ifdef CONFIG_CGROUPS - Fix TOCTOU in SELinux charge_cgroup xattr length handling - Link to v2: https://lore.kernel.org/r/20261021-v2_20230123_tjmercier_google_com-v2-0-ef… Changes in v2: - Move charge_pid_fd to charge_fd, accepting cgroupfd in addition to pidfd per Christian König. - New DMA_BUF_IOCTL_XFER_CHARGE ioctl for post-allocation charge transfer on any dma-buf, not just dma-heap buffers per Christian König and T.J. Mercier. - Moved __GFP_ACCOUNT removal to patch 1 per Barry Song. - dma-buf charge/uncharge helpers take struct dma_buf * directly to avoid the need for caller to manage size calculations. - Added test_xfer_charge_cgroupfd_self to dmabuf-heap selftests. - Added LSM and SELinux hooks for cgroupfd-based charging. - Rebased to v7.3-rc7. - Link to v1: https://lore.kernel.org/r/20260512-v2_20230123_tjmercier_google_com-v1-0-63… --- Albert Esteve (7): dma-heap: charge dma-buf memory via explicit memcg dma-buf: transfer memcg charges via DMA_BUF_IOCTL_XFER_CHARGE security: dma-buf: Add dma_buf_charge_task LSM hook security: dma-buf: Add dma_buf_charge_cgroup LSM hook selinux: Restrict cross-cgroup dma-buf charging selinux: Restrict dma-buf direct cgroup charging selftests/dmabuf-heaps: Add dma-buf memcg accounting tests T.J. Mercier (1): memcg: Add MEMCG_DMABUF accounting infrastructure Documentation/admin-guide/cgroup-v2.rst | 5 + drivers/dma-buf/dma-buf.c | 50 ++++ drivers/dma-buf/dma-heap.c | 28 +- drivers/dma-buf/heaps/cma_heap.c | 3 +- drivers/dma-buf/heaps/system_heap.c | 21 +- drivers/tee/tee_heap.c | 3 +- include/linux/dma-buf.h | 9 + include/linux/dma-heap.h | 3 +- include/linux/lsm_hook_defs.h | 4 + include/linux/memcontrol.h | 47 ++++ include/linux/security.h | 18 ++ include/uapi/linux/dma-buf.h | 26 ++ include/uapi/linux/dma-heap.h | 7 + mm/memcontrol.c | 176 +++++++++++++ security/security.c | 34 +++ security/selinux/hooks.c | 44 ++++ security/selinux/include/classmap.h | 1 + tools/testing/selftests/cgroup/Makefile | 2 +- tools/testing/selftests/cgroup/test_memcontrol.c | 290 ++++++++++++++++++++- tools/testing/selftests/dmabuf-heaps/config | 1 + tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c | 227 +++++++++++++++- tools/testing/selftests/dmabuf-heaps/vmtest.sh | 226 ++++++++++++++++ 22 files changed, 1210 insertions(+), 15 deletions(-) --- base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907 change-id: 20260508-v2_20230123_tjmercier_google_com-f44fcfb16530 Best regards, -- Albert Esteve <aesteve(a)redhat.com>

3 days, 5 hours

4
26
0 0

[PATCH v4 0/3] Add TPM support via Qualcomm TEE TPM TA

by Kuldeep Singh

Qualcomm platforms with a discrete TPM (dTPM) talked to it directly over a non-secure SPI channel from the kernel. Arm's Base Boot Security Requirements (BBSR) v1.4 require that access to go through TrustZone instead, so on affected Qualcomm platforms the TPM 2.0 instance is now fronted by a Trusted Application (TA) running inside Qualcomm's Trusted Execution Environment (QTEE), which talks to the dTPM (or implements an fTPM) on the kernel's behalf. This series adds a kernel driver for that TA, built on the QCOMTEE object-IPC transport (drivers/tee/qcomtee/) already used to reach other QTEE services. This patch series functionally depends on below(first 5 changes specially) for qtee service discovery. - https://lore.kernel.org/lkml/20261015-qcom_uefisecapp_migrate_qcomtee-v5-0-… Tested on Glymur-crd target with tpm2-tools utility. Validations: - Get capabilities - Random number generator - RSA key creation, encryption and decryption. Signed-off-by: Kuldeep Singh <kuldeep.singh(a)oss.qualcomm.com> --- Changes in v4: - Add new line before goto label(Jarkko). - Link to v3: https://patch.msgid.link/20261015-tpm_qcom_driver-v3-0-247c8e50250e@qti.qua… Changes in v3: - Merge tpm_qcom.h into tpm_qcom.c(Amir comments) - Update return values of functions and drop certain error prints. - Define locality_arg as default value. - Add Jarkko's tag on all but drop from 2/3 as significant changes done. - Link to v2: https://patch.msgid.link/20260907-tpm_qcom_driver-v2-0-71a6b1752da8@oss.qua… Changes in v2: - Use QCOMTEE_TPM_UID as 81 for service discovery in patch 1. - Use FIELD_GET, zero initialised array and log improvement (Konrad) - Improve commit title and other fixes (Jarkko) - Split MAINTAINERS entry as separate patch. - Link to v1: https://patch.msgid.link/20260831-tpm_qcom_driver-v1-0-6f16fa6924fa@oss.qua… To: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> To: Jens Wiklander <jenswi(a)kernel.org> To: Sumit Garg <sumit.garg(a)kernel.org> To: Peter Huewe <peterhuewe(a)gmx.de> To: Jarkko Sakkinen <jarkko(a)kernel.org> To: Jason Gunthorpe <jgg(a)ziepe.ca> To: Kuldeep Singh <kuldeep.singh(a)oss.qualcomm.com> Cc: linux-arm-msm(a)vger.kernel.org Cc: op-tee(a)lists.trustedfirmware.org Cc: linux-kernel(a)vger.kernel.org Cc: linux-integrity(a)vger.kernel.org --- Kuldeep Singh (3): tee: qcomtee: Register qcom.tz.tpm service for discovery tpm: Introduce Qualcomm TPM driver MAINTAINERS: Add Qualcomm TPM driver entry MAINTAINERS | 6 + drivers/char/tpm/Kconfig | 9 + drivers/char/tpm/Makefile | 1 + drivers/char/tpm/tpm_qcom.c | 414 ++++++++++++++++++++++++++++++++++++++ drivers/tee/qcomtee/call.c | 4 +- drivers/tee/qcomtee/qcomtee_msg.h | 2 + 6 files changed, 435 insertions(+), 1 deletion(-) --- base-commit: 2efb7a11f1aa4d2dc285fe2680cca22cb9f72f64 change-id: 20260831-tpm_qcom_driver-d21c720e73b2 prerequisite-change-id: 20260408-qcom_uefisecapp_migrate_qcomtee-13869d45e014:v5 prerequisite-patch-id: faf4520d818abf0d7533f71d9c8b9a8aade34626 prerequisite-patch-id: b487dfe2fbc076f4815dc6c73b9e68b0b78c961f prerequisite-patch-id: 9f2c4ee37ba173bdc860f253d44974379f2cf125 prerequisite-patch-id: e86905ac6289821db30fd9a17f73e276e0a88363 prerequisite-patch-id: 8777bfa2ef8344715bf972d049acb0a6ef49b136 prerequisite-patch-id: 1c7f946e770a1cbc1599f9571282c9265a6af9cd prerequisite-patch-id: 7be993abea2ca36057d9352381a5890f50996dda Best regards, -- Kuldeep Singh <kuldeep.singh(a)oss.qualcomm.com>

3 days, 6 hours

4
11
0 0

Re: [PATCH v2 0/6] Add support for a TEE agnostic Inline Crypto Engine service

by Harshal Dev

+ op-tee(a)lists.trustedfirmware.org, Jens Wiklander <jens.wiklander(a)oss.qualcomm.com> On 11-11-2026 07:47 pm, Harshal Dev wrote: > Qualcomm platforms such as the IQ-9075 EVK now boot with both Qualcomm > Trusted Execution Environment (QTEE) and OP-TEE [1]. However, the Qualcomm > Inline Crypto Engine (ICE) driver currently only makes SCM calls into QTEE. > With the arrival of ICE support on OPTEE [2,3] for Qualcomm platforms, > there is a need for TrustZone (TZ) agnostic APIs which re-direct the call > to the correct TZ at runtime to request programming of the secure interfaces > on the ICE hardware block. > > This patch series adds such TZ agnostic APIs to the ICE driver for > requesting secure services from either QTEE or OP-TEE depending on whether > an SCM driver back-end or a TEE client driver back-end is registered with > it at runtime. This series is logically similar to the one introduced for > Peripheral Authentication Service (PAS) [3] which was recently merged to > provide a generic PAS service for both QTEE and OP-TEE. > > Apart from introducing a TEE bus based client driver for ICE, this series > also adds support for optionally registering a TEE device which represents > a particular TEE (QTEE or OPTEE) on the platform bus to enable drivers such > as ICE which poll on the availability of a TEE interface to be notified. > > The ICE driver is an independent platform driver which polls on the > availability of a TEE interface (SCM driver) before checking if the ICE > secure service is supported by QTEE by querying qcom_scm_is_available(). > The TEE subsystem currently does not provide any mechanism to notify the > availability of a TEE interface, i.e. whether QCOMTEE or OPTEE have probed. > Without the introduction of such a notification mechanism the ICE driver > would indefinitely defer probe until the OPTEE ICE Pseudo TA becomes available > on the TEE bus implying that for OPTEE builds without the ICE PTA enabled, > the dependent UFS/SDHC storage driver will fail to come online. > > The TEE bus based client driver introduced in this series which registers > with the ICE driver has an ABI with OP-TEE that is 1-1 identical with the > SCM driver's ICE ABI with QTEE. This is because both TEEs implement logically > similar drivers with the exception that OP-TEE currently does not have > Hardware Key Manager v2 support and so the inline encryption functionality > with OP-TEE is currently limited to Qualcomm platforms with only Hardware > Key Manager v1. > > Validation: > This series has been validated on a LeMans IQ-9075 EVK device by attempting > file system encryption via the fscrypt tool. > > Merge Strategy: > All patches in this series except one touch Qualcomm firmware and soc drivers. > Hence, it should go via the QCOM-SoC tree. Request the TEE subsystem maintainers > to provide an Acknowledgement for this. > > [1] https://ldts.github.io/qcom-buildroot/index.html > [2] https://github.com/OP-TEE/optee_os/pull/7906 (In review) > [3] https://github.com/OP-TEE/optee_os/pull/8137 (Draft, depends on PR#7906) > [4] https://lore.kernel.org/all/20260702115835.167602-1-sumit.garg@kernel.org/ > > Signed-off-by: Harshal Dev <harshal.dev(a)oss.qualcomm.com> > --- > Changes in v2: > - Merged the furnctionality of the middleware ICE service into the ICE > driver as requested by Eric. > - Introduced tee_platform_device_register() to fix the issue of indefinite > probe defer in the ICE driver when ICE PTA is not enabled in OPTEE as > pointed out by Eric. > - Fixed type "Psuedo" in ICE TEE back-end commit. > - Fixed space based indentation with tab in ICE back-end Kconfig. > - Ensure tee_shm_get_va() failure is checked and ERR_PTR() returned. > - Validate out_shm size everywhere in qcom_ice_tee.c > - Zero the memory holding the key when TEE invoke call fails. > - Check failure from qcom_ice_tz_ops_register() during probe. > - Cross-check out_size and lt_key_size in qcom_ice_tee_generate_key(). > - Always return 0 when qcom_ice_tee_probe() is success. > - Did not collect tags from Abel since significant rework undertaken. > - Link to v1: https://lore.kernel.org/r/20261021-ice-migrate-tee-svc-v1-0-b035be7aab0a@os… > > --- > Harshal Dev (6): > soc: qcom: ice: Add TZ agnostic re-direction functions > firmware: qcom_scm: Transition to ICE TZ agnostic operations > firmware: qcom: Add a TEE bus based ICE back-end > tee: optee: Register TEE devices on the platform bus > soc: qcom: ice: Migrate to the TZ agnostic ICE APIs > firmware: qcom: scm: Drop exported ICE wrapper functions > > MAINTAINERS | 8 + > drivers/firmware/qcom/Kconfig | 9 + > drivers/firmware/qcom/Makefile | 1 + > drivers/firmware/qcom/qcom_ice_tee.c | 443 +++++++++++++++++++++++++++++ > drivers/firmware/qcom/qcom_scm.c | 90 +++--- > drivers/soc/qcom/Kconfig | 1 + > drivers/soc/qcom/ice.c | 173 +++++++++-- > drivers/tee/optee/ffa_abi.c | 8 + > drivers/tee/optee/smc_abi.c | 8 + > drivers/tee/tee_core.c | 21 ++ > include/linux/firmware/qcom/qcom_ice_tee.h | 10 + > include/linux/firmware/qcom/qcom_scm.h | 20 -- > include/linux/tee_core.h | 9 + > include/soc/qcom/ice.h | 56 ++++ > 14 files changed, 784 insertions(+), 73 deletions(-) > --- > base-commit: 8f7df005a7564bd7ffa75da9c3085d5b996f1e16 > change-id: 20261021-ice-migrate-tee-svc-a5cd6959ae36 > > Best regards,

4 days, 1 hour

1
0
0 0

[PATCH v2] tee: shm: don't warn on oversized request in tee_dyn_shm_alloc_helper()

by Georgiy Osokin

tee_dyn_shm_alloc_helper() passes the size from TEE_IOC_SHM_ALLOC to alloc_pages_exact(), which needs one physically contiguous block. A size above 4 MiB (MAX_PAGE_ORDER with 4 KiB pages) is more than the page allocator can serve, so it trips its order warning; on a panic_on_warn kernel that is a panic. The size comes from userspace and the request fails with -ENOMEM anyway, so pass __GFP_NOWARN. Fixes: abd135ba215c ("tee: optee: add optee-specific shared pool implementation") Cc: stable(a)vger.kernel.org Cc: lvc-project(a)linuxtesting.org Signed-off-by: Georgiy Osokin <g.osokin(a)auroraos.dev> --- v2: Fixes now points to abd135ba215c, the commit that introduced the unchecked allocation; cf4441503e20 only moved the code. v1: https://lore.kernel.org/all/20261026105209.161195-1-g.osokin@auroraos.dev/ drivers/tee/tee_shm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index daa4af1..8b117d6 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -352,7 +352,7 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align, * and there's no need for any larger alignment. */ shm->kaddr = alloc_pages_exact(nr_pages * PAGE_SIZE, - GFP_KERNEL | __GFP_ZERO); + GFP_KERNEL | __GFP_ZERO | __GFP_NOWARN); if (!shm->kaddr) return -ENOMEM; -- 2.54.0

5 days, 2 hours

2
1
0 0

[PATCH] tee: avoid accessing dma-buf shared memory after put

by Hongyan Xu

param_from_user_memref() obtains a temporary reference to the dma-buf tee_shm wrapper by ID. If closing the shared-memory file descriptor races with the ioctl, this temporary reference can be the wrapper's last one. tee_shm_put() then frees the enclosing tee_shm_dmabuf_ref, but the function still reads ref->parent_shm and ref->offset afterwards. Save the parent pointer and offset before dropping the wrapper reference. The additional parent reference keeps the parent shared memory alive for the parameter list as before. Fixes: 146bf4e75eca ("tee: new ioctl to a register tee_shm from a dmabuf file descriptor") Cc: stable(a)vger.kernel.org Signed-off-by: Hongyan Xu <getshell(a)seu.edu.cn> --- drivers/tee/tee_core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c index 1aac50c7c1de..489c39d5b35f 100644 --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -397,6 +397,7 @@ static int param_from_user_memref(struct tee_context *ctx, } if (shm->flags & TEE_SHM_DMA_BUF) { + struct tee_shm *parent_shm; struct tee_shm_dmabuf_ref *ref; ref = container_of(shm, struct tee_shm_dmabuf_ref, shm); @@ -409,10 +410,11 @@ static int param_from_user_memref(struct tee_context *ctx, * list instead of the shm we got with * tee_shm_get_from_id() above. */ - refcount_inc(&ref->parent_shm->refcount); - tee_shm_put(shm); - shm = ref->parent_shm; + parent_shm = ref->parent_shm; offs = ref->offset; + refcount_inc(&parent_shm->refcount); + tee_shm_put(shm); + shm = parent_shm; } } } else if (ctx->cap_memref_null) { -- 2.50.1.windows.1

6 days

3
3
0 0

2026

2025

2024

2023

2022

2021

2020

OP-TEE