On Tue, Jun 10, 2025 at 03:13:49PM +0200, Jens Wiklander wrote:

From: Etienne Carriere etienne.carriere@foss.st.com

Add a userspace API to create a tee_shm object that refers to a dmabuf reference.

Userspace registers the dmabuf file descriptor as in a tee_shm object. The registration is completed with a tee_shm returned file descriptor.

Userspace is free to close the dmabuf file descriptor after it has been registered since all the resources are now held via the new tee_shm object.

Closing the tee_shm file descriptor will eventually release all resources used by the tee_shm object when all references are released.

The new IOCTL, TEE_IOC_SHM_REGISTER_FD, supports dmabuf references to physically contiguous memory buffers. Dmabuf references acquired from the TEE DMA-heap can be used as protected memory for Secure Video Path and such use cases. It depends on the TEE and the TEE driver if dmabuf references acquired by other means can be used.

A new tee_shm flag is added to identify tee_shm objects built from a registered dmabuf, TEE_SHM_DMA_BUF.

Signed-off-by: Etienne Carriere etienne.carriere@foss.st.com Signed-off-by: Olivier Masse olivier.masse@nxp.com Signed-off-by: Jens Wiklander jens.wiklander@linaro.org

---

drivers/tee/tee_core.c | 63 +++++++++++++++++++++- drivers/tee/tee_private.h | 10 ++++ drivers/tee/tee_shm.c | 106 ++++++++++++++++++++++++++++++++++++-- include/linux/tee_core.h | 1 + include/linux/tee_drv.h | 10 ++++ include/uapi/linux/tee.h | 31 +++++++++++ 6 files changed, 217 insertions(+), 4 deletions(-)

diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c index 5259b8223c27..0e9d9e5872a4 100644 --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -353,11 +353,49 @@ tee_ioctl_shm_register(struct tee_context *ctx, return ret; } +static int +tee_ioctl_shm_register_fd(struct tee_context *ctx,

• 	  struct tee_ioctl_shm_register_fd_data __user *udata)
  

+{

• struct tee_ioctl_shm_register_fd_data data;
• struct tee_shm *shm;
• long ret;
• if (copy_from_user(&data, udata, sizeof(data)))

• return -EFAULT;
  

• /* Currently no input flags are supported */
• if (data.flags)

• return -EINVAL;
  

• shm = tee_shm_register_fd(ctx, data.fd);
• if (IS_ERR(shm))

• return -EINVAL;
  

• data.id = shm->id;
• data.flags = shm->flags;
• data.size = shm->size;
• if (copy_to_user(udata, &data, sizeof(data)))

• ret = -EFAULT;
  

• else

• ret = tee_shm_get_fd(shm);
  

• /*

• * When user space closes the file descriptor the shared memory
  

• * should be freed or if tee_shm_get_fd() failed then it will
  

• * be freed immediately.
  

• */
  

• tee_shm_put(shm);
• return ret;

+}

static int param_from_user_memref(struct tee_context *ctx, struct tee_param_memref *memref, struct tee_ioctl_param *ip) { struct tee_shm *shm;

• size_t offs = 0;

/* * If a NULL pointer is passed to a TA in the TEE, @@ -388,6 +426,26 @@ static int param_from_user_memref(struct tee_context *ctx, tee_shm_put(shm); return -EINVAL; }

• if (shm->flags & TEE_SHM_DMA_BUF) {
  

• 	struct tee_shm_dmabuf_ref *ref;
  

• 	ref = container_of(shm, struct tee_shm_dmabuf_ref, shm);
  

• 	if (ref->parent_shm) {
  

• 		/*
  

• 		 * The shm already has one reference to
  

• 		 * ref->parent_shm so we are clear of 0.
  

• 		 * We're getting another reference since
  

• 		 * this shm will be used in the parameter
  

• 		 * list instead of the shm we got with
  

• 		 * tee_shm_get_from_id() above.
  

• 		 */
  

• 		refcount_inc(&ref->parent_shm->refcount);
  

• 		tee_shm_put(shm);
  

• 		shm = ref->parent_shm;
  

• 		offs = ref->offset;
  

• 	}
  

• }
  

  } else if (ctx->cap_memref_null) { /* Pass NULL pointer to OP-TEE */ shm = NULL;

@@ -395,7 +453,7 @@ static int param_from_user_memref(struct tee_context *ctx, return -EINVAL; }

• memref->shm_offs = ip->a;

• memref->shm_offs = ip->a + offs; memref->size = ip->b; memref->shm = shm;

@@ -841,6 +899,8 @@ static long tee_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) return tee_ioctl_shm_alloc(ctx, uarg); case TEE_IOC_SHM_REGISTER: return tee_ioctl_shm_register(ctx, uarg);

• case TEE_IOC_SHM_REGISTER_FD:

• return tee_ioctl_shm_register_fd(ctx, uarg);
  

  case TEE_IOC_OPEN_SESSION: return tee_ioctl_open_session(ctx, uarg); case TEE_IOC_INVOKE:

@@ -1300,3 +1360,4 @@ MODULE_AUTHOR("Linaro"); MODULE_DESCRIPTION("TEE Driver"); MODULE_VERSION("1.0"); MODULE_LICENSE("GPL v2"); +MODULE_IMPORT_NS("DMA_BUF"); diff --git a/drivers/tee/tee_private.h b/drivers/tee/tee_private.h index 6c6ff5d5eed2..308467705da6 100644 --- a/drivers/tee/tee_private.h +++ b/drivers/tee/tee_private.h @@ -13,6 +13,16 @@ #include <linux/mutex.h> #include <linux/types.h> +/* extra references appended to shm object for registered shared memory */ +struct tee_shm_dmabuf_ref {

• struct tee_shm shm;
• size_t offset;
• struct dma_buf *dmabuf;
• struct dma_buf_attachment *attach;
• struct sg_table *sgt;
• struct tee_shm *parent_shm;

+};

int tee_shm_get_fd(struct tee_shm *shm); bool tee_device_get(struct tee_device *teedev); diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index daf6e5cfd59a..e63095e84644 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -4,6 +4,7 @@ */ #include <linux/anon_inodes.h> #include <linux/device.h> +#include <linux/dma-buf.h> #include <linux/idr.h> #include <linux/io.h> #include <linux/mm.h> @@ -45,7 +46,21 @@ static void release_registered_pages(struct tee_shm *shm) static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm) {

• if (shm->flags & TEE_SHM_POOL) {

• void *p = shm;
• if (shm->flags & TEE_SHM_DMA_BUF) {

• struct tee_shm_dmabuf_ref *ref;
  

• ref = container_of(shm, struct tee_shm_dmabuf_ref, shm);
  

• p = ref;
  

• if (ref->attach) {
  

• 	dma_buf_unmap_attachment(ref->attach, ref->sgt,
  

• 				 DMA_BIDIRECTIONAL);
  

• 	dma_buf_detach(ref->dmabuf, ref->attach);
  

• }
  

• dma_buf_put(ref->dmabuf);
  

• } else if (shm->flags & TEE_SHM_POOL) { teedev->pool->ops->free(teedev->pool, shm); } else if (shm->flags & TEE_SHM_DYNAMIC) { int rc = teedev->desc->ops->shm_unregister(shm->ctx, shm);

@@ -59,7 +74,7 @@ static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm) teedev_ctx_put(shm->ctx);

• kfree(shm);

• kfree(p);

tee_device_put(teedev); } @@ -169,7 +184,7 @@ struct tee_shm *tee_shm_alloc_user_buf(struct tee_context *ctx, size_t size)

• tee_client_invoke_func(). The memory allocated is later freed with a
• call to tee_shm_free().

• • @returns a pointer to 'struct tee_shm'

• • @returns a pointer to 'struct tee_shm' on success, and ERR_PTR on failure
  */

struct tee_shm *tee_shm_alloc_kernel_buf(struct tee_context *ctx, size_t size) { @@ -179,6 +194,91 @@ struct tee_shm *tee_shm_alloc_kernel_buf(struct tee_context *ctx, size_t size) } EXPORT_SYMBOL_GPL(tee_shm_alloc_kernel_buf); +struct tee_shm *tee_shm_register_fd(struct tee_context *ctx, int fd) +{

• struct tee_shm_dmabuf_ref *ref;
• int rc;
• if (!tee_device_get(ctx->teedev))

• return ERR_PTR(-EINVAL);
  

• teedev_ctx_get(ctx);
• ref = kzalloc(sizeof(*ref), GFP_KERNEL);
• if (!ref) {

• rc = -ENOMEM;
  

• goto err_put_tee;
  

• }
• refcount_set(&ref->shm.refcount, 1);
• ref->shm.ctx = ctx;
• ref->shm.id = -1;
• ref->shm.flags = TEE_SHM_DMA_BUF;
• ref->dmabuf = dma_buf_get(fd);
• if (IS_ERR(ref->dmabuf)) {

• rc = PTR_ERR(ref->dmabuf);
  

• goto err_kfree_ref;
  

• }
• rc = tee_heap_update_from_dma_buf(ctx->teedev, ref->dmabuf,

• 			  &ref->offset, &ref->shm,
  

• 			  &ref->parent_shm);
  

• if (!rc)

• goto out;
  

One odd thing I find here, why do we bail out on success case here? Don't we need the DMA buffer attach and map APIs to be invoked on success case here?

-Sumit

• if (rc != -EINVAL)

• goto err_put_dmabuf;
  

• ref->attach = dma_buf_attach(ref->dmabuf, &ctx->teedev->dev);
• if (IS_ERR(ref->attach)) {

• rc = PTR_ERR(ref->attach);
  

• goto err_put_dmabuf;
  

• }
• ref->sgt = dma_buf_map_attachment(ref->attach, DMA_BIDIRECTIONAL);
• if (IS_ERR(ref->sgt)) {

• rc = PTR_ERR(ref->sgt);
  

• goto err_detach;
  

• }
• if (sg_nents(ref->sgt->sgl) != 1) {

• rc = -EINVAL;
  

• goto err_unmap_attachement;
  

• }
• ref->shm.paddr = page_to_phys(sg_page(ref->sgt->sgl));
• ref->shm.size = ref->sgt->sgl->length;

+out:

• mutex_lock(&ref->shm.ctx->teedev->mutex);
• ref->shm.id = idr_alloc(&ref->shm.ctx->teedev->idr, &ref->shm,

• 		1, 0, GFP_KERNEL);
  

• mutex_unlock(&ref->shm.ctx->teedev->mutex);
• if (ref->shm.id < 0) {

• rc = ref->shm.id;
  

• if (ref->attach)
  

• 	goto err_unmap_attachement;
  

• goto err_put_dmabuf;
  

• }
• return &ref->shm;

+err_unmap_attachement:

• dma_buf_unmap_attachment(ref->attach, ref->sgt, DMA_BIDIRECTIONAL);

+err_detach:

• dma_buf_detach(ref->dmabuf, ref->attach);

+err_put_dmabuf:

• dma_buf_put(ref->dmabuf);

+err_kfree_ref:

• kfree(ref);

+err_put_tee:

• teedev_ctx_put(ctx);
• tee_device_put(ctx->teedev);
• return ERR_PTR(rc);

+} +EXPORT_SYMBOL_GPL(tee_shm_register_fd);

/**

• tee_shm_alloc_priv_buf() - Allocate shared memory for a privately shared

• 	      kernel buffer
  

diff --git a/include/linux/tee_core.h b/include/linux/tee_core.h index 22e03d897dc3..f17710196c4c 100644 --- a/include/linux/tee_core.h +++ b/include/linux/tee_core.h @@ -28,6 +28,7 @@ #define TEE_SHM_USER_MAPPED BIT(1) /* Memory mapped in user space */ #define TEE_SHM_POOL BIT(2) /* Memory allocated from pool */ #define TEE_SHM_PRIV BIT(3) /* Memory private to TEE driver */ +#define TEE_SHM_DMA_BUF BIT(4) /* Memory with dma-buf handle */ #define TEE_DEVICE_FLAG_REGISTERED 0x1 #define TEE_MAX_DEV_NAME_LEN 32 diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h index a54c203000ed..824f1251de60 100644 --- a/include/linux/tee_drv.h +++ b/include/linux/tee_drv.h @@ -116,6 +116,16 @@ struct tee_shm *tee_shm_alloc_kernel_buf(struct tee_context *ctx, size_t size); struct tee_shm *tee_shm_register_kernel_buf(struct tee_context *ctx, void *addr, size_t length); +/**

• • tee_shm_register_fd() - Register shared memory from file descriptor
• • @ctx: Context that allocates the shared memory
• • @fd: Shared memory file descriptor reference
• • @returns a pointer to 'struct tee_shm' on success, and ERR_PTR on failure
• */

+struct tee_shm *tee_shm_register_fd(struct tee_context *ctx, int fd);

/**

• tee_shm_free() - Free shared memory
• @shm: Handle to shared memory to free

diff --git a/include/uapi/linux/tee.h b/include/uapi/linux/tee.h index d0430bee8292..d843cf980d98 100644 --- a/include/uapi/linux/tee.h +++ b/include/uapi/linux/tee.h @@ -378,6 +378,37 @@ struct tee_ioctl_shm_register_data { __s32 id; }; +/**

• • struct tee_ioctl_shm_register_fd_data - Shared memory registering argument
• • @fd: [in] File descriptor identifying dmabuf reference
• • @size: [out] Size of referenced memory
• • @flags: [in] Flags to/from allocation.
• • @id: [out] Identifier of the shared memory
• • The flags field should currently be zero as input. Updated by the call
• • with actual flags as defined by TEE_IOCTL_SHM_* above.
• • This structure is used as argument for TEE_IOC_SHM_REGISTER_FD below.
• */

+struct tee_ioctl_shm_register_fd_data {

• __s64 fd;
• __u64 size;
• __u32 flags;
• __s32 id;

+};

+/**

• • TEE_IOC_SHM_REGISTER_FD - register a shared memory from a file descriptor
• • Returns a file descriptor on success or < 0 on failure
• • The returned file descriptor refers to the shared memory object in the
• • kernel. The supplied file deccriptor can be closed if it's not needed
• • for other purposes. The shared memory is freed when the descriptor is
• • closed.
• */

+#define TEE_IOC_SHM_REGISTER_FD _IOWR(TEE_IOC_MAGIC, TEE_IOC_BASE + 8, \

• 		     struct tee_ioctl_shm_register_fd_data)
  

/**

• TEE_IOC_SHM_REGISTER - Register shared memory argument

-- 2.43.0

On Tue, Jun 17, 2025 at 1:32 PM Sumit Garg sumit.garg@kernel.org wrote:

On Tue, Jun 10, 2025 at 03:13:50PM +0200, Jens Wiklander wrote:

...

Add tee_shm_alloc_dma_mem() to allocate DMA memory. The memory is represented by a tee_shm object using the new flag TEE_SHM_DMA_MEM to identify it as DMA memory. The allocated memory will later be lent to the TEE to be used as protected memory.

Signed-off-by: Jens Wiklander jens.wiklander@linaro.org

drivers/tee/tee_shm.c | 85 +++++++++++++++++++++++++++++++++++++++- include/linux/tee_core.h | 5 +++ 2 files changed, 88 insertions(+), 2 deletions(-)

diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index e63095e84644..60b0f3932cee 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -5,6 +5,8 @@ #include <linux/anon_inodes.h> #include <linux/device.h> #include <linux/dma-buf.h> +#include <linux/dma-mapping.h> +#include <linux/highmem.h> #include <linux/idr.h> #include <linux/io.h> #include <linux/mm.h> @@ -13,9 +15,14 @@ #include <linux/tee_core.h> #include <linux/uaccess.h> #include <linux/uio.h> -#include <linux/highmem.h> #include "tee_private.h"

+struct tee_shm_dma_mem {

• struct tee_shm shm;
  

• dma_addr_t dma_addr;
  

• struct page *page;
  

+};

static void shm_put_kernel_pages(struct page **pages, size_t page_count) { size_t n; @@ -48,7 +55,16 @@ static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm) { void *p = shm;

• if (shm->flags & TEE_SHM_DMA_BUF) {
  

• if (shm->flags & TEE_SHM_DMA_MEM) {
  

+#if IS_ENABLED(CONFIG_TEE_DMABUF_HEAPS)

nit: this config check can be merged into the above if check.

No, because dma_free_pages() is only defined if CONFIG_TEE_DMABUF_HEAPS is enabled.

...

•         struct tee_shm_dma_mem *dma_mem;
  

•         dma_mem = container_of(shm, struct tee_shm_dma_mem, shm);
  

•         p = dma_mem;
  

•         dma_free_pages(&teedev->dev, shm->size, dma_mem->page,
  

•                        dma_mem->dma_addr, DMA_BIDIRECTIONAL);
  

+#endif

• } else if (shm->flags & TEE_SHM_DMA_BUF) {
  

Do we need a similar config check for this flag too?

No, because DMA_SHARED_BUFFER is selected, so the dma_buf functions are defined.

Cheers, Jens

With these addressed, feel free to add:

Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com

-Sumit

...

          struct tee_shm_dmabuf_ref *ref;

          ref = container_of(shm, struct tee_shm_dmabuf_ref, shm);

@@ -303,6 +319,71 @@ struct tee_shm *tee_shm_alloc_priv_buf(struct tee_context *ctx, size_t size) } EXPORT_SYMBOL_GPL(tee_shm_alloc_priv_buf);

+#if IS_ENABLED(CONFIG_TEE_DMABUF_HEAPS) +/**

• • tee_shm_alloc_dma_mem() - Allocate DMA memory as shared memory object
• • @ctx: Context that allocates the shared memory
• • @page_count: Number of pages
• • The allocated memory is expected to be lent (made inaccessible to the
• • kernel) to the TEE while it's used and returned (accessible to the
• • kernel again) before it's freed.
• • This function should normally only be used internally in the TEE
• • drivers.
• • @returns a pointer to 'struct tee_shm'
• */

+struct tee_shm *tee_shm_alloc_dma_mem(struct tee_context *ctx,

•                               size_t page_count)
  

+{

• struct tee_device *teedev = ctx->teedev;
  

• struct tee_shm_dma_mem *dma_mem;
  

• dma_addr_t dma_addr;
  

• struct page *page;
  

• if (!tee_device_get(teedev))
  

•         return ERR_PTR(-EINVAL);
  

• page = dma_alloc_pages(&teedev->dev, page_count * PAGE_SIZE,
  

•                        &dma_addr, DMA_BIDIRECTIONAL, GFP_KERNEL);
  

• if (!page)
  

•         goto err_put_teedev;
  

• dma_mem = kzalloc(sizeof(*dma_mem), GFP_KERNEL);
  

• if (!dma_mem)
  

•         goto err_free_pages;
  

• refcount_set(&dma_mem->shm.refcount, 1);
  

• dma_mem->shm.ctx = ctx;
  

• dma_mem->shm.paddr = page_to_phys(page);
  

• dma_mem->dma_addr = dma_addr;
  

• dma_mem->page = page;
  

• dma_mem->shm.size = page_count * PAGE_SIZE;
  

• dma_mem->shm.flags = TEE_SHM_DMA_MEM;
  

• teedev_ctx_get(ctx);
  

• return &dma_mem->shm;
  

+err_free_pages:

• dma_free_pages(&teedev->dev, page_count * PAGE_SIZE, page, dma_addr,
  

•                DMA_BIDIRECTIONAL);
  

+err_put_teedev:

• tee_device_put(teedev);
  

• return ERR_PTR(-ENOMEM);
  

+} +EXPORT_SYMBOL_GPL(tee_shm_alloc_dma_mem); +#else +struct tee_shm *tee_shm_alloc_dma_mem(struct tee_context *ctx,

•                               size_t page_count)
  

+{

• return ERR_PTR(-EINVAL);
  

+} +EXPORT_SYMBOL_GPL(tee_shm_alloc_dma_mem); +#endif

int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align, int (*shm_register)(struct tee_context *ctx, struct tee_shm *shm, diff --git a/include/linux/tee_core.h b/include/linux/tee_core.h index f17710196c4c..e46a53e753af 100644 --- a/include/linux/tee_core.h +++ b/include/linux/tee_core.h @@ -29,6 +29,8 @@ #define TEE_SHM_POOL BIT(2) /* Memory allocated from pool */ #define TEE_SHM_PRIV BIT(3) /* Memory private to TEE driver */ #define TEE_SHM_DMA_BUF BIT(4) /* Memory with dma-buf handle */ +#define TEE_SHM_DMA_MEM BIT(5) /* Memory allocated with */

•                                 /* dma_alloc_pages() */
  
  

#define TEE_DEVICE_FLAG_REGISTERED 0x1 #define TEE_MAX_DEV_NAME_LEN 32 @@ -310,6 +312,9 @@ void *tee_get_drvdata(struct tee_device *teedev); */ struct tee_shm *tee_shm_alloc_priv_buf(struct tee_context *ctx, size_t size);

+struct tee_shm *tee_shm_alloc_dma_mem(struct tee_context *ctx,

•                               size_t page_count);
  

int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align, int (*shm_register)(struct tee_context *ctx, struct tee_shm *shm, -- 2.43.0

On Tue, Jun 10, 2025 at 03:13:51PM +0200, Jens Wiklander wrote:

Add support in the OP-TEE backend driver for protected memory allocation. The support is limited to only the SMC ABI and for secure video buffers.

OP-TEE is probed for the range of protected physical memory and a memory pool allocator is initialized if OP-TEE have support for such memory.

Signed-off-by: Jens Wiklander jens.wiklander@linaro.org

drivers/tee/optee/Kconfig | 5 +++ drivers/tee/optee/core.c | 10 +++++ drivers/tee/optee/optee_private.h | 2 + drivers/tee/optee/smc_abi.c | 70 ++++++++++++++++++++++++++++++- 4 files changed, 85 insertions(+), 2 deletions(-)

Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com

-Sumit

diff --git a/drivers/tee/optee/Kconfig b/drivers/tee/optee/Kconfig index 7bb7990d0b07..50d2051f7f20 100644 --- a/drivers/tee/optee/Kconfig +++ b/drivers/tee/optee/Kconfig @@ -25,3 +25,8 @@ config OPTEE_INSECURE_LOAD_IMAGE Additional documentation on kernel security risks are at Documentation/tee/op-tee.rst.

+config OPTEE_STATIC_PROTMEM_POOL

• bool
• depends on HAS_IOMEM && TEE_DMABUF_HEAPS
• default y

diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c index c75fddc83576..4b14a7ac56f9 100644 --- a/drivers/tee/optee/core.c +++ b/drivers/tee/optee/core.c @@ -56,6 +56,15 @@ int optee_rpmb_intf_rdev(struct notifier_block *intf, unsigned long action, return 0; } +int optee_set_dma_mask(struct optee *optee, u_int pa_width) +{

• u64 mask = DMA_BIT_MASK(min(64, pa_width));
• optee->teedev->dev.dma_mask = &optee->teedev->dev.coherent_dma_mask;
• return dma_set_mask_and_coherent(&optee->teedev->dev, mask);

+}

static void optee_bus_scan(struct work_struct *work) { WARN_ON(optee_enumerate_devices(PTA_CMD_GET_DEVICES_SUPP)); @@ -181,6 +190,7 @@ void optee_remove_common(struct optee *optee) tee_device_unregister(optee->supp_teedev); tee_device_unregister(optee->teedev);

• tee_device_unregister_all_dma_heaps(optee->teedev); tee_shm_pool_free(optee->pool); optee_supp_uninit(&optee->supp); mutex_destroy(&optee->call_queue.mutex);

diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h index dc0f355ef72a..5e3c34802121 100644 --- a/drivers/tee/optee/optee_private.h +++ b/drivers/tee/optee/optee_private.h @@ -272,6 +272,8 @@ struct optee_call_ctx { extern struct blocking_notifier_head optee_rpmb_intf_added; +int optee_set_dma_mask(struct optee *optee, u_int pa_width);

int optee_notif_init(struct optee *optee, u_int max_key); void optee_notif_uninit(struct optee *optee); int optee_notif_wait(struct optee *optee, u_int key, u32 timeout); diff --git a/drivers/tee/optee/smc_abi.c b/drivers/tee/optee/smc_abi.c index f0c3ac1103bb..cf106d15e64e 100644 --- a/drivers/tee/optee/smc_abi.c +++ b/drivers/tee/optee/smc_abi.c @@ -1584,6 +1584,68 @@ static inline int optee_load_fw(struct platform_device *pdev, } #endif +static struct tee_protmem_pool *static_protmem_pool_init(struct optee *optee) +{ +#if IS_ENABLED(CONFIG_OPTEE_STATIC_PROTMEM_POOL)

• union {

• struct arm_smccc_res smccc;
  

• struct optee_smc_get_protmem_config_result result;
  

• } res;
• struct tee_protmem_pool *pool;
• void *p;
• int rc;
• optee->smc.invoke_fn(OPTEE_SMC_GET_PROTMEM_CONFIG, 0, 0, 0, 0,

• 	     0, 0, 0, &res.smccc);
  

• if (res.result.status != OPTEE_SMC_RETURN_OK)

• return ERR_PTR(-EINVAL);
  

• rc = optee_set_dma_mask(optee, res.result.pa_width);
• if (rc)

• return ERR_PTR(rc);
  

• /*

• * Map the memory as uncached to make sure the kernel can work with
  

• * __pfn_to_page() and friends since that's needed when passing the
  

• * protected DMA-buf to a device. The memory should otherwise not
  

• * be touched by the kernel since it's likely to cause an external
  

• * abort due to the protection status.
  

• */
  

• p = devm_memremap(&optee->teedev->dev, res.result.start,

• 	  res.result.size, MEMREMAP_WC);
  

• if (IS_ERR(p))

• return p;
  

• pool = tee_protmem_static_pool_alloc(res.result.start, res.result.size);
• if (IS_ERR(pool))

• devm_memunmap(&optee->teedev->dev, p);
  

• return pool;

+#else

• return ERR_PTR(-EINVAL);

+#endif +}

+static int optee_protmem_pool_init(struct optee *optee) +{

• enum tee_dma_heap_id heap_id = TEE_DMA_HEAP_SECURE_VIDEO_PLAY;
• struct tee_protmem_pool *pool = ERR_PTR(-EINVAL);
• int rc;
• if (!(optee->smc.sec_caps & OPTEE_SMC_SEC_CAP_PROTMEM))

• return 0;
  

• pool = static_protmem_pool_init(optee);
• if (IS_ERR(pool))

• return PTR_ERR(pool);
  

• rc = tee_device_register_dma_heap(optee->teedev, heap_id, pool);
• if (rc)

• pool->ops->destroy_pool(pool);
  

• return rc;

+}

static int optee_probe(struct platform_device *pdev) { optee_invoke_fn *invoke_fn; @@ -1679,7 +1741,7 @@ static int optee_probe(struct platform_device *pdev) optee = kzalloc(sizeof(*optee), GFP_KERNEL); if (!optee) { rc = -ENOMEM;

• goto err_free_pool;
  

• goto err_free_shm_pool;
  

  }

optee->ops = &optee_ops; @@ -1752,6 +1814,9 @@ static int optee_probe(struct platform_device *pdev) pr_info("Asynchronous notifications enabled\n"); }

• if (optee_protmem_pool_init(optee))

• pr_info("Protected memory service not available\n");
  

• /*
  • Ensure that there are no pre-existing shm objects before enabling
  • the shm cache so that there's no chance of receiving an invalid

@@ -1787,6 +1852,7 @@ static int optee_probe(struct platform_device *pdev) optee_disable_shm_cache(optee); optee_smc_notif_uninit_irq(optee); optee_unregister_devices();

• tee_device_unregister_all_dma_heaps(optee->teedev);

err_notif_uninit: optee_notif_uninit(optee); err_close_ctx: @@ -1803,7 +1869,7 @@ static int optee_probe(struct platform_device *pdev) tee_device_unregister(optee->teedev); err_free_optee: kfree(optee); -err_free_pool: +err_free_shm_pool: tee_shm_pool_free(pool); if (memremaped_shm) memunmap(memremaped_shm); -- 2.43.0

Hi Amir,

On Tue, Jun 24, 2025 at 8:54 AM Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com wrote:

Hi Jens,

On 6/10/2025 11:13 PM, Jens Wiklander wrote:

...

Add support in the OP-TEE backend driver for protected memory allocation. The support is limited to only the SMC ABI and for secure video buffers.

OP-TEE is probed for the range of protected physical memory and a memory pool allocator is initialized if OP-TEE have support for such memory.

Signed-off-by: Jens Wiklander jens.wiklander@linaro.org

drivers/tee/optee/Kconfig | 5 +++ drivers/tee/optee/core.c | 10 +++++ drivers/tee/optee/optee_private.h | 2 + drivers/tee/optee/smc_abi.c | 70 ++++++++++++++++++++++++++++++- 4 files changed, 85 insertions(+), 2 deletions(-)

diff --git a/drivers/tee/optee/Kconfig b/drivers/tee/optee/Kconfig index 7bb7990d0b07..50d2051f7f20 100644 --- a/drivers/tee/optee/Kconfig +++ b/drivers/tee/optee/Kconfig @@ -25,3 +25,8 @@ config OPTEE_INSECURE_LOAD_IMAGE

    Additional documentation on kernel security risks are at
    Documentation/tee/op-tee.rst.

+config OPTEE_STATIC_PROTMEM_POOL

• bool
  

• depends on HAS_IOMEM && TEE_DMABUF_HEAPS
  

• default y
  

diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c index c75fddc83576..4b14a7ac56f9 100644 --- a/drivers/tee/optee/core.c +++ b/drivers/tee/optee/core.c @@ -56,6 +56,15 @@ int optee_rpmb_intf_rdev(struct notifier_block *intf, unsigned long action, return 0; }

+int optee_set_dma_mask(struct optee *optee, u_int pa_width) +{

• u64 mask = DMA_BIT_MASK(min(64, pa_width));
  

nit: Why not dma_coerce_mask_and_coherent() instead of bellow?

Good point, I'll update in the next version.

Thanks, Jens

• Amir

...

• optee->teedev->dev.dma_mask = &optee->teedev->dev.coherent_dma_mask;
  

• return dma_set_mask_and_coherent(&optee->teedev->dev, mask);
  

+}

static void optee_bus_scan(struct work_struct *work) { WARN_ON(optee_enumerate_devices(PTA_CMD_GET_DEVICES_SUPP)); @@ -181,6 +190,7 @@ void optee_remove_common(struct optee *optee) tee_device_unregister(optee->supp_teedev); tee_device_unregister(optee->teedev);

• tee_device_unregister_all_dma_heaps(optee->teedev);
  tee_shm_pool_free(optee->pool);
  optee_supp_uninit(&optee->supp);
  mutex_destroy(&optee->call_queue.mutex);
  

diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h index dc0f355ef72a..5e3c34802121 100644 --- a/drivers/tee/optee/optee_private.h +++ b/drivers/tee/optee/optee_private.h @@ -272,6 +272,8 @@ struct optee_call_ctx {

extern struct blocking_notifier_head optee_rpmb_intf_added;

+int optee_set_dma_mask(struct optee *optee, u_int pa_width);

int optee_notif_init(struct optee *optee, u_int max_key); void optee_notif_uninit(struct optee *optee); int optee_notif_wait(struct optee *optee, u_int key, u32 timeout); diff --git a/drivers/tee/optee/smc_abi.c b/drivers/tee/optee/smc_abi.c index f0c3ac1103bb..cf106d15e64e 100644 --- a/drivers/tee/optee/smc_abi.c +++ b/drivers/tee/optee/smc_abi.c @@ -1584,6 +1584,68 @@ static inline int optee_load_fw(struct platform_device *pdev, } #endif

+static struct tee_protmem_pool *static_protmem_pool_init(struct optee *optee) +{ +#if IS_ENABLED(CONFIG_OPTEE_STATIC_PROTMEM_POOL)

• union {
  

•         struct arm_smccc_res smccc;
  

•         struct optee_smc_get_protmem_config_result result;
  

• } res;
  

• struct tee_protmem_pool *pool;
  

• void *p;
  

• int rc;
  

• optee->smc.invoke_fn(OPTEE_SMC_GET_PROTMEM_CONFIG, 0, 0, 0, 0,
  

•                      0, 0, 0, &res.smccc);
  

• if (res.result.status != OPTEE_SMC_RETURN_OK)
  

•         return ERR_PTR(-EINVAL);
  

• rc = optee_set_dma_mask(optee, res.result.pa_width);
  

• if (rc)
  

•         return ERR_PTR(rc);
  

• /*
  

•  * Map the memory as uncached to make sure the kernel can work with
  

•  * __pfn_to_page() and friends since that's needed when passing the
  

•  * protected DMA-buf to a device. The memory should otherwise not
  

•  * be touched by the kernel since it's likely to cause an external
  

•  * abort due to the protection status.
  

•  */
  

• p = devm_memremap(&optee->teedev->dev, res.result.start,
  

•                   res.result.size, MEMREMAP_WC);
  

• if (IS_ERR(p))
  

•         return p;
  

• pool = tee_protmem_static_pool_alloc(res.result.start, res.result.size);
  

• if (IS_ERR(pool))
  

•         devm_memunmap(&optee->teedev->dev, p);
  

• return pool;
  

+#else

• return ERR_PTR(-EINVAL);
  

+#endif +}

+static int optee_protmem_pool_init(struct optee *optee) +{

• enum tee_dma_heap_id heap_id = TEE_DMA_HEAP_SECURE_VIDEO_PLAY;
  

• struct tee_protmem_pool *pool = ERR_PTR(-EINVAL);
  

• int rc;
  

• if (!(optee->smc.sec_caps & OPTEE_SMC_SEC_CAP_PROTMEM))
  

•         return 0;
  

• pool = static_protmem_pool_init(optee);
  

• if (IS_ERR(pool))
  

•         return PTR_ERR(pool);
  

• rc = tee_device_register_dma_heap(optee->teedev, heap_id, pool);
  

• if (rc)
  

•         pool->ops->destroy_pool(pool);
  

• return rc;
  

+}

static int optee_probe(struct platform_device *pdev) { optee_invoke_fn *invoke_fn; @@ -1679,7 +1741,7 @@ static int optee_probe(struct platform_device *pdev) optee = kzalloc(sizeof(*optee), GFP_KERNEL); if (!optee) { rc = -ENOMEM;

•         goto err_free_pool;
  

•         goto err_free_shm_pool;
  }
  
  optee->ops = &optee_ops;
  

@@ -1752,6 +1814,9 @@ static int optee_probe(struct platform_device *pdev) pr_info("Asynchronous notifications enabled\n"); }

• if (optee_protmem_pool_init(optee))
  

•         pr_info("Protected memory service not available\n");
  

• /*
   * Ensure that there are no pre-existing shm objects before enabling
   * the shm cache so that there's no chance of receiving an invalid
  

@@ -1787,6 +1852,7 @@ static int optee_probe(struct platform_device *pdev) optee_disable_shm_cache(optee); optee_smc_notif_uninit_irq(optee); optee_unregister_devices();

• tee_device_unregister_all_dma_heaps(optee->teedev);
  

err_notif_uninit: optee_notif_uninit(optee); err_close_ctx: @@ -1803,7 +1869,7 @@ static int optee_probe(struct platform_device *pdev) tee_device_unregister(optee->teedev); err_free_optee: kfree(optee); -err_free_pool: +err_free_shm_pool: tee_shm_pool_free(pool); if (memremaped_shm) memunmap(memremaped_shm);

On Tue, Jun 10, 2025 at 03:13:52PM +0200, Jens Wiklander wrote:

Add support in the OP-TEE backend driver dynamic protected memory allocation with FF-A.

The protected memory pools for dynamically allocated protected memory are instantiated when requested by user-space. This instantiation can fail if OP-TEE doesn't support the requested use-case of protected memory.

Restricted memory pools based on a static carveout or dynamic allocation can coexist for different use-cases. We use only dynamic allocation with FF-A.

Signed-off-by: Jens Wiklander jens.wiklander@linaro.org

drivers/tee/optee/Makefile | 1 + drivers/tee/optee/ffa_abi.c | 147 ++++++++++++- drivers/tee/optee/optee_private.h | 13 +- drivers/tee/optee/protmem.c | 335 ++++++++++++++++++++++++++++++ 4 files changed, 493 insertions(+), 3 deletions(-) create mode 100644 drivers/tee/optee/protmem.c

Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com

-Sumit

diff --git a/drivers/tee/optee/Makefile b/drivers/tee/optee/Makefile index a6eff388d300..ad7049c1c107 100644 --- a/drivers/tee/optee/Makefile +++ b/drivers/tee/optee/Makefile @@ -4,6 +4,7 @@ optee-objs += core.o optee-objs += call.o optee-objs += notif.o optee-objs += rpc.o +optee-objs += protmem.o optee-objs += supp.o optee-objs += device.o optee-objs += smc_abi.o diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c index f3af5666bb11..b9cbd733e5c6 100644 --- a/drivers/tee/optee/ffa_abi.c +++ b/drivers/tee/optee/ffa_abi.c @@ -649,6 +649,124 @@ static int optee_ffa_do_call_with_arg(struct tee_context *ctx, return optee_ffa_yielding_call(ctx, &data, rpc_arg, system_thread); } +static int do_call_lend_protmem(struct optee *optee, u64 cookie, u32 use_case) +{

• struct optee_shm_arg_entry *entry;
• struct optee_msg_arg *msg_arg;
• struct tee_shm *shm;
• u_int offs;
• int rc;
• msg_arg = optee_get_msg_arg(optee->ctx, 1, &entry, &shm, &offs);
• if (IS_ERR(msg_arg))

• return PTR_ERR(msg_arg);
  

• msg_arg->cmd = OPTEE_MSG_CMD_ASSIGN_PROTMEM;
• msg_arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
• msg_arg->params[0].u.value.a = cookie;
• msg_arg->params[0].u.value.b = use_case;
• rc = optee->ops->do_call_with_arg(optee->ctx, shm, offs, false);
• if (rc)

• goto out;
  

• if (msg_arg->ret != TEEC_SUCCESS) {

• rc = -EINVAL;
  

• goto out;
  

• }

+out:

• optee_free_msg_arg(optee->ctx, entry, offs);
• return rc;

+}

+static int optee_ffa_lend_protmem(struct optee *optee, struct tee_shm *protmem,

• 		  u16 *end_points, unsigned int ep_count,
  

• 		  u32 use_case)
  

+{

• struct ffa_device *ffa_dev = optee->ffa.ffa_dev;
• const struct ffa_mem_ops *mem_ops = ffa_dev->ops->mem_ops;
• const struct ffa_msg_ops *msg_ops = ffa_dev->ops->msg_ops;
• struct ffa_send_direct_data data;
• struct ffa_mem_region_attributes *mem_attr;
• struct ffa_mem_ops_args args = {

• .use_txbuf = true,
  

• .tag = use_case,
  

• };
• struct page *page;
• struct scatterlist sgl;
• unsigned int n;
• int rc;
• mem_attr = kcalloc(ep_count, sizeof(*mem_attr), GFP_KERNEL);
• for (n = 0; n < ep_count; n++) {

• mem_attr[n].receiver = end_points[n];
  

• mem_attr[n].attrs = FFA_MEM_RW;
  

• }
• args.attrs = mem_attr;
• args.nattrs = ep_count;
• page = phys_to_page(protmem->paddr);
• sg_init_table(&sgl, 1);
• sg_set_page(&sgl, page, protmem->size, 0);
• args.sg = &sgl;
• rc = mem_ops->memory_lend(&args);
• kfree(mem_attr);
• if (rc)

• return rc;
  

• rc = do_call_lend_protmem(optee, args.g_handle, use_case);
• if (rc)

• goto err_reclaim;
  

• rc = optee_shm_add_ffa_handle(optee, protmem, args.g_handle);
• if (rc)

• goto err_unreg;
  

• protmem->sec_world_id = args.g_handle;
• return 0;

+err_unreg:

• data = (struct ffa_send_direct_data){

• .data0 = OPTEE_FFA_RELEASE_PROTMEM,
  

• .data1 = (u32)args.g_handle,
  

• .data2 = (u32)(args.g_handle >> 32),
  

• };
• msg_ops->sync_send_receive(ffa_dev, &data);

+err_reclaim:

• mem_ops->memory_reclaim(args.g_handle, 0);
• return rc;

+}

+static int optee_ffa_reclaim_protmem(struct optee *optee,

• 		     struct tee_shm *protmem)
  

+{

• struct ffa_device *ffa_dev = optee->ffa.ffa_dev;
• const struct ffa_msg_ops *msg_ops = ffa_dev->ops->msg_ops;
• const struct ffa_mem_ops *mem_ops = ffa_dev->ops->mem_ops;
• u64 global_handle = protmem->sec_world_id;
• struct ffa_send_direct_data data = {

• .data0 = OPTEE_FFA_RELEASE_PROTMEM,
  

• .data1 = (u32)global_handle,
  

• .data2 = (u32)(global_handle >> 32)
  

• };
• int rc;
• optee_shm_rem_ffa_handle(optee, global_handle);
• protmem->sec_world_id = 0;
• rc = msg_ops->sync_send_receive(ffa_dev, &data);
• if (rc)

• pr_err("Release SHM id 0x%llx rc %d\n", global_handle, rc);
  

• rc = mem_ops->memory_reclaim(global_handle, 0);
• if (rc)

• pr_err("mem_reclaim: 0x%llx %d", global_handle, rc);
  

• return rc;

+}

/*

• 6. Driver initialization

@@ -810,6 +928,8 @@ static const struct optee_ops optee_ffa_ops = { .do_call_with_arg = optee_ffa_do_call_with_arg, .to_msg_param = optee_ffa_to_msg_param, .from_msg_param = optee_ffa_from_msg_param,

• .lend_protmem = optee_ffa_lend_protmem,
• .reclaim_protmem = optee_ffa_reclaim_protmem,

}; static void optee_ffa_remove(struct ffa_device *ffa_dev) @@ -868,6 +988,25 @@ static int optee_ffa_async_notif_init(struct ffa_device *ffa_dev, return rc; } +static int optee_ffa_protmem_pool_init(struct optee *optee, u32 sec_caps) +{

• enum tee_dma_heap_id id = TEE_DMA_HEAP_SECURE_VIDEO_PLAY;
• struct tee_protmem_pool *pool;
• int rc = 0;
• if (sec_caps & OPTEE_FFA_SEC_CAP_PROTMEM) {

• pool = optee_protmem_alloc_dyn_pool(optee, id);
  

• if (IS_ERR(pool))
  

• 	return PTR_ERR(pool);
  

• rc = tee_device_register_dma_heap(optee->teedev, id, pool);
  

• if (rc)
  

• 	pool->ops->destroy_pool(pool);
  

• }
• return rc;

+}

static int optee_ffa_probe(struct ffa_device *ffa_dev) { const struct ffa_notifier_ops *notif_ops; @@ -918,7 +1057,7 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) optee); if (IS_ERR(teedev)) { rc = PTR_ERR(teedev);

• goto err_free_pool;
  

• goto err_free_shm_pool;
  

  } optee->teedev = teedev;

@@ -965,6 +1104,9 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) rc); }

• if (optee_ffa_protmem_pool_init(optee, sec_caps))

• pr_info("Protected memory service not available\n");
  

• rc = optee_enumerate_devices(PTA_CMD_GET_DEVICES); if (rc) goto err_unregister_devices;

@@ -978,6 +1120,7 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) err_unregister_devices: optee_unregister_devices();

• tee_device_unregister_all_dma_heaps(optee->teedev); if (optee->ffa.bottom_half_value != U32_MAX) notif_ops->notify_relinquish(ffa_dev, optee->ffa.bottom_half_value);

@@ -995,7 +1138,7 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) tee_device_unregister(optee->supp_teedev); err_unreg_teedev: tee_device_unregister(optee->teedev); -err_free_pool: +err_free_shm_pool: tee_shm_pool_free(pool); err_free_optee: kfree(optee); diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h index 5e3c34802121..68e94856205c 100644 --- a/drivers/tee/optee/optee_private.h +++ b/drivers/tee/optee/optee_private.h @@ -174,9 +174,14 @@ struct optee;

• @do_call_with_arg: enters OP-TEE in secure world
• @to_msg_param: converts from struct tee_param to OPTEE_MSG parameters
• @from_msg_param: converts from OPTEE_MSG parameters to struct tee_param

• • @lend_protmem: lends physically contiguous memory as restricted

• • 	memory, inaccessible by the kernel
    

• • @reclaim_protmem: reclaims restricted memory previously lent with

• • 	@lend_protmem() and makes it accessible by the
    

• • 	kernel again
    

  • These OPs are only supposed to be used internally in the OP-TEE driver

• • as a way of abstracting the different methogs of entering OP-TEE in

• • as a way of abstracting the different methods of entering OP-TEE in
  • secure world.
  */

struct optee_ops { @@ -189,6 +194,10 @@ struct optee_ops { int (*from_msg_param)(struct optee *optee, struct tee_param *params, size_t num_params, const struct optee_msg_param *msg_params);

• int (*lend_protmem)(struct optee *optee, struct tee_shm *protmem,

• 	    u16 *end_points, unsigned int ep_count,
  

• 	    u32 use_case);
  

• int (*reclaim_protmem)(struct optee *optee, struct tee_shm *protmem);

}; /** @@ -285,6 +294,8 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params, void optee_supp_init(struct optee_supp *supp); void optee_supp_uninit(struct optee_supp *supp); void optee_supp_release(struct optee_supp *supp); +struct tee_protmem_pool *optee_protmem_alloc_dyn_pool(struct optee *optee,

• 				      enum tee_dma_heap_id id);
  

int optee_supp_recv(struct tee_context *ctx, u32 *func, u32 *num_params, struct tee_param *param); diff --git a/drivers/tee/optee/protmem.c b/drivers/tee/optee/protmem.c new file mode 100644 index 000000000000..8f7c281fc899 --- /dev/null +++ b/drivers/tee/optee/protmem.c @@ -0,0 +1,335 @@ +// SPDX-License-Identifier: GPL-2.0-only +/*

• • Copyright (c) 2025, Linaro Limited
• */

+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

+#include <linux/errno.h> +#include <linux/genalloc.h> +#include <linux/slab.h> +#include <linux/string.h> +#include <linux/tee_core.h> +#include <linux/types.h> +#include "optee_private.h"

+struct optee_protmem_dyn_pool {

• struct tee_protmem_pool pool;
• struct gen_pool *gen_pool;
• struct optee *optee;
• size_t page_count;
• u16 *end_points;
• u_int end_point_count;
• refcount_t refcount;
• u32 use_case;
• struct tee_shm *protmem;
• /* Protects when initializing and tearing down this struct */
• struct mutex mutex;

+};

+static struct optee_protmem_dyn_pool * +to_protmem_dyn_pool(struct tee_protmem_pool *pool) +{

• return container_of(pool, struct optee_protmem_dyn_pool, pool);

+}

+static int init_dyn_protmem(struct optee_protmem_dyn_pool *rp) +{

• int rc;
• rp->protmem = tee_shm_alloc_dma_mem(rp->optee->ctx, rp->page_count);
• if (IS_ERR(rp->protmem)) {

• rc = PTR_ERR(rp->protmem);
  

• goto err_null_protmem;
  

• }
• /*

• * TODO unmap the memory range since the physical memory will
  

• * become inaccesible after the lend_protmem() call.
  

• *
  

• * If the platform supports a hypervisor at EL2, it will unmap the
  

• * intermediate physical memory for us and stop cache pre-fetch of
  

• * the memory.
  

• */
  

• rc = rp->optee->ops->lend_protmem(rp->optee, rp->protmem,

• 			  rp->end_points,
  

• 			  rp->end_point_count, rp->use_case);
  

• if (rc)

• goto err_put_shm;
  

• rp->protmem->flags |= TEE_SHM_DYNAMIC;
• rp->gen_pool = gen_pool_create(PAGE_SHIFT, -1);
• if (!rp->gen_pool) {

• rc = -ENOMEM;
  

• goto err_reclaim;
  

• }
• rc = gen_pool_add(rp->gen_pool, rp->protmem->paddr,

• 	  rp->protmem->size, -1);
  

• if (rc)

• goto err_free_pool;
  

• refcount_set(&rp->refcount, 1);
• return 0;

+err_free_pool:

• gen_pool_destroy(rp->gen_pool);
• rp->gen_pool = NULL;

+err_reclaim:

• rp->optee->ops->reclaim_protmem(rp->optee, rp->protmem);

+err_put_shm:

• tee_shm_put(rp->protmem);

+err_null_protmem:

• rp->protmem = NULL;
• return rc;

+}

+static int get_dyn_protmem(struct optee_protmem_dyn_pool *rp) +{

• int rc = 0;
• if (!refcount_inc_not_zero(&rp->refcount)) {

• mutex_lock(&rp->mutex);
  

• if (rp->gen_pool) {
  

• 	/*
  

• 	 * Another thread has already initialized the pool
  

• 	 * before us, or the pool was just about to be torn
  

• 	 * down. Either way we only need to increase the
  

• 	 * refcount and we're done.
  

• 	 */
  

• 	refcount_inc(&rp->refcount);
  

• } else {
  

• 	rc = init_dyn_protmem(rp);
  

• }
  

• mutex_unlock(&rp->mutex);
  

• }
• return rc;

+}

+static void release_dyn_protmem(struct optee_protmem_dyn_pool *rp) +{

• gen_pool_destroy(rp->gen_pool);
• rp->gen_pool = NULL;
• rp->optee->ops->reclaim_protmem(rp->optee, rp->protmem);
• rp->protmem->flags &= ~TEE_SHM_DYNAMIC;
• WARN(refcount_read(&rp->protmem->refcount) != 1, "Unexpected refcount");
• tee_shm_put(rp->protmem);
• rp->protmem = NULL;

+}

+static void put_dyn_protmem(struct optee_protmem_dyn_pool *rp) +{

• if (refcount_dec_and_test(&rp->refcount)) {

• mutex_lock(&rp->mutex);
  

• if (rp->gen_pool)
  

• 	release_dyn_protmem(rp);
  

• mutex_unlock(&rp->mutex);
  

• }

+}

+static int protmem_pool_op_dyn_alloc(struct tee_protmem_pool *pool,

• 		     struct sg_table *sgt, size_t size,
  

• 		     size_t *offs)
  

+{

• struct optee_protmem_dyn_pool *rp = to_protmem_dyn_pool(pool);
• size_t sz = ALIGN(size, PAGE_SIZE);
• phys_addr_t pa;
• int rc;
• rc = get_dyn_protmem(rp);
• if (rc)

• return rc;
  

• pa = gen_pool_alloc(rp->gen_pool, sz);
• if (!pa) {

• rc = -ENOMEM;
  

• goto err_put;
  

• }
• rc = sg_alloc_table(sgt, 1, GFP_KERNEL);
• if (rc)

• goto err_free;
  

• sg_set_page(sgt->sgl, phys_to_page(pa), size, 0);
• *offs = pa - rp->protmem->paddr;
• return 0;

+err_free:

• gen_pool_free(rp->gen_pool, pa, size);

+err_put:

• put_dyn_protmem(rp);
• return rc;

+}

+static void protmem_pool_op_dyn_free(struct tee_protmem_pool *pool,

• 		     struct sg_table *sgt)
  

+{

• struct optee_protmem_dyn_pool *rp = to_protmem_dyn_pool(pool);
• struct scatterlist *sg;
• int i;
• for_each_sgtable_sg(sgt, sg, i)

• gen_pool_free(rp->gen_pool, sg_phys(sg), sg->length);
  

• sg_free_table(sgt);
• put_dyn_protmem(rp);

+}

+static int protmem_pool_op_dyn_update_shm(struct tee_protmem_pool *pool,

• 			  struct sg_table *sgt, size_t offs,
  

• 			  struct tee_shm *shm,
  

• 			  struct tee_shm **parent_shm)
  

+{

• struct optee_protmem_dyn_pool *rp = to_protmem_dyn_pool(pool);
• *parent_shm = rp->protmem;
• return 0;

+}

+static void pool_op_dyn_destroy_pool(struct tee_protmem_pool *pool) +{

• struct optee_protmem_dyn_pool *rp = to_protmem_dyn_pool(pool);
• mutex_destroy(&rp->mutex);
• kfree(rp);

+}

+static struct tee_protmem_pool_ops protmem_pool_ops_dyn = {

• .alloc = protmem_pool_op_dyn_alloc,
• .free = protmem_pool_op_dyn_free,
• .update_shm = protmem_pool_op_dyn_update_shm,
• .destroy_pool = pool_op_dyn_destroy_pool,

+};

+static int get_protmem_config(struct optee *optee, u32 use_case,

• 	      size_t *min_size, u_int *pa_width,
  

• 	      u16 *end_points, u_int *ep_count)
  

+{

• struct tee_param params[2] = {

• [0] = {
  

• 	.attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT,
  

• 	.u.value.a = use_case,
  

• },
  

• [1] = {
  

• 	.attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT,
  

• },
  

• };
• struct optee_shm_arg_entry *entry;
• struct tee_shm *shm_param = NULL;
• struct optee_msg_arg *msg_arg;
• struct tee_shm *shm;
• u_int offs;
• int rc;
• if (end_points && *ep_count) {

• params[1].u.memref.size = *ep_count * sizeof(*end_points);
  

• shm_param = tee_shm_alloc_priv_buf(optee->ctx,
  

• 				   params[1].u.memref.size);
  

• if (IS_ERR(shm_param))
  

• 	return PTR_ERR(shm_param);
  

• params[1].u.memref.shm = shm_param;
  

• }
• msg_arg = optee_get_msg_arg(optee->ctx, ARRAY_SIZE(params), &entry,

• 		    &shm, &offs);
  

• if (IS_ERR(msg_arg)) {

• rc = PTR_ERR(msg_arg);
  

• goto out_free_shm;
  

• }
• msg_arg->cmd = OPTEE_MSG_CMD_GET_PROTMEM_CONFIG;
• rc = optee->ops->to_msg_param(optee, msg_arg->params,

• 		      ARRAY_SIZE(params), params);
  

• if (rc)

• goto out_free_msg;
  

• rc = optee->ops->do_call_with_arg(optee->ctx, shm, offs, false);
• if (rc)

• goto out_free_msg;
  

• if (msg_arg->ret && msg_arg->ret != TEEC_ERROR_SHORT_BUFFER) {

• rc = -EINVAL;
  

• goto out_free_msg;
  

• }
• rc = optee->ops->from_msg_param(optee, params, ARRAY_SIZE(params),

• 			msg_arg->params);
  

• if (rc)

• goto out_free_msg;
  

• if (!msg_arg->ret && end_points &&

•    *ep_count < params[1].u.memref.size / sizeof(u16)) {
  

• rc = -EINVAL;
  

• goto out_free_msg;
  

• }
• *min_size = params[0].u.value.a;
• *pa_width = params[0].u.value.c;
• *ep_count = params[1].u.memref.size / sizeof(u16);
• if (msg_arg->ret == TEEC_ERROR_SHORT_BUFFER) {

• rc = -ENOSPC;
  

• goto out_free_msg;
  

• }
• if (end_points)

• memcpy(end_points, tee_shm_get_va(shm_param, 0),
  

•        params[1].u.memref.size);
  

+out_free_msg:

• optee_free_msg_arg(optee->ctx, entry, offs);

+out_free_shm:

• if (shm_param)

• tee_shm_free(shm_param);
  

• return rc;

+}

+struct tee_protmem_pool *optee_protmem_alloc_dyn_pool(struct optee *optee,

• 				      enum tee_dma_heap_id id)
  

+{

• struct optee_protmem_dyn_pool *rp;
• size_t min_size;
• u_int pa_width;
• int rc;
• rp = kzalloc(sizeof(*rp), GFP_KERNEL);
• if (!rp)

• return ERR_PTR(-ENOMEM);
  

• rp->use_case = id;
• rc = get_protmem_config(optee, id, &min_size, &pa_width, NULL,

• 		&rp->end_point_count);
  

• if (rc) {

• if (rc != -ENOSPC)
  

• 	goto err;
  

• rp->end_points = kcalloc(rp->end_point_count,
  

• 			 sizeof(*rp->end_points), GFP_KERNEL);
  

• if (!rp->end_points) {
  

• 	rc = -ENOMEM;
  

• 	goto err;
  

• }
  

• rc = get_protmem_config(optee, id, &min_size, &pa_width,
  

• 			rp->end_points, &rp->end_point_count);
  

• if (rc)
  

• 	goto err_kfree_eps;
  

• }
• rc = optee_set_dma_mask(optee, pa_width);
• if (rc)

• goto err_kfree_eps;
  

• rp->pool.ops = &protmem_pool_ops_dyn;
• rp->optee = optee;
• rp->page_count = min_size / PAGE_SIZE;
• mutex_init(&rp->mutex);
• return &rp->pool;

+err_kfree_eps:

• kfree(rp->end_points);

+err:

• kfree(rp);
• return ERR_PTR(rc);

+}

2.43.0

On Tue, Jun 10, 2025 at 03:13:53PM +0200, Jens Wiklander wrote:

Add support in the OP-TEE backend driver for dynamic protected memory allocation using the SMC ABI.

Signed-off-by: Jens Wiklander jens.wiklander@linaro.org

drivers/tee/optee/smc_abi.c | 78 +++++++++++++++++++++++++++++++++++-- 1 file changed, 75 insertions(+), 3 deletions(-)

Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com

-Sumit

diff --git a/drivers/tee/optee/smc_abi.c b/drivers/tee/optee/smc_abi.c index cf106d15e64e..fd1d873de941 100644 --- a/drivers/tee/optee/smc_abi.c +++ b/drivers/tee/optee/smc_abi.c @@ -965,6 +965,70 @@ static int optee_smc_do_call_with_arg(struct tee_context *ctx, return rc; } +static int optee_smc_lend_protmem(struct optee *optee, struct tee_shm *protmem,

• 		  u16 *end_points, unsigned int ep_count,
  

• 		  u32 use_case)
  

+{

• struct optee_shm_arg_entry *entry;
• struct optee_msg_arg *msg_arg;
• struct tee_shm *shm;
• u_int offs;
• int rc;
• msg_arg = optee_get_msg_arg(optee->ctx, 2, &entry, &shm, &offs);
• if (IS_ERR(msg_arg))

• return PTR_ERR(msg_arg);
  

• msg_arg->cmd = OPTEE_MSG_CMD_LEND_PROTMEM;
• msg_arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
• msg_arg->params[0].u.value.a = use_case;
• msg_arg->params[1].attr = OPTEE_MSG_ATTR_TYPE_TMEM_INPUT;
• msg_arg->params[1].u.tmem.buf_ptr = protmem->paddr;
• msg_arg->params[1].u.tmem.size = protmem->size;
• msg_arg->params[1].u.tmem.shm_ref = (u_long)protmem;
• rc = optee->ops->do_call_with_arg(optee->ctx, shm, offs, false);
• if (rc)

• goto out;
  

• if (msg_arg->ret != TEEC_SUCCESS) {

• rc = -EINVAL;
  

• goto out;
  

• }
• protmem->sec_world_id = (u_long)protmem;

+out:

• optee_free_msg_arg(optee->ctx, entry, offs);
• return rc;

+}

+static int optee_smc_reclaim_protmem(struct optee *optee,

• 		     struct tee_shm *protmem)
  

+{

• struct optee_shm_arg_entry *entry;
• struct optee_msg_arg *msg_arg;
• struct tee_shm *shm;
• u_int offs;
• int rc;
• msg_arg = optee_get_msg_arg(optee->ctx, 1, &entry, &shm, &offs);
• if (IS_ERR(msg_arg))

• return PTR_ERR(msg_arg);
  

• msg_arg->cmd = OPTEE_MSG_CMD_RECLAIM_PROTMEM;
• msg_arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_RMEM_INPUT;
• msg_arg->params[0].u.rmem.shm_ref = (u_long)protmem;
• rc = optee->ops->do_call_with_arg(optee->ctx, shm, offs, false);
• if (rc)

• goto out;
  

• if (msg_arg->ret != TEEC_SUCCESS)

• rc = -EINVAL;
  

+out:

• optee_free_msg_arg(optee->ctx, entry, offs);
• return rc;

+}

/*

• 5. Asynchronous notification

*/ @@ -1216,6 +1280,8 @@ static const struct optee_ops optee_ops = { .do_call_with_arg = optee_smc_do_call_with_arg, .to_msg_param = optee_to_msg_param, .from_msg_param = optee_from_msg_param,

• .lend_protmem = optee_smc_lend_protmem,
• .reclaim_protmem = optee_smc_reclaim_protmem,

}; static int enable_async_notif(optee_invoke_fn *invoke_fn) @@ -1628,14 +1694,20 @@ static struct tee_protmem_pool *static_protmem_pool_init(struct optee *optee) static int optee_protmem_pool_init(struct optee *optee) {

• bool protm = optee->smc.sec_caps & OPTEE_SMC_SEC_CAP_PROTMEM;
• bool dyn_protm = optee->smc.sec_caps &

• 	 OPTEE_SMC_SEC_CAP_DYNAMIC_PROTMEM;
  

  enum tee_dma_heap_id heap_id = TEE_DMA_HEAP_SECURE_VIDEO_PLAY; struct tee_protmem_pool *pool = ERR_PTR(-EINVAL);

• int rc;

• int rc = -EINVAL;

• if (!(optee->smc.sec_caps & OPTEE_SMC_SEC_CAP_PROTMEM))

• if (!protm && !dyn_protm) return 0;

• pool = static_protmem_pool_init(optee);

• if (protm)

• pool = static_protmem_pool_init(optee);
  

• if (dyn_protm && IS_ERR(pool))

• pool = optee_protmem_alloc_dyn_pool(optee, heap_id);
  

  if (IS_ERR(pool)) return PTR_ERR(pool);

2.43.0