Linaro-mm-sig September 2025

linaro-mm-sig@lists.linaro.org

15 participants
28 discussions

[PATCH v2 00/10] vfio/pci: Allow MMIO regions to be exported through dma-buf

by Leon Romanovsky

Changelog: v2: * Added extra patch which adds new CONFIG, so next patches can reuse it. * Squashed "PCI/P2PDMA: Remove redundant bus_offset from map state" into the other patch. * Fixed revoke calls to be aligned with true->false semantics. * Extended p2pdma_providers to be per-BAR and not global to whole device. * Fixed possible race between dmabuf states and revoke. * Moved revoke to PCI BAR zap block. v1: https://lore.kernel.org/all/cover.1754311439.git.leon@kernel.org * Changed commit messages. * Reused DMA_ATTR_MMIO attribute. * Returned support for multiple DMA ranges per-dMABUF. v0: https://lore.kernel.org/all/cover.1753274085.git.leonro@nvidia.com --------------------------------------------------------------------------- Based on "[PATCH v6 00/16] dma-mapping: migrate to physical address-based API" https://lore.kernel.org/all/cover.1757423202.git.leonro@nvidia.com/ series. --------------------------------------------------------------------------- This series extends the VFIO PCI subsystem to support exporting MMIO regions from PCI device BARs as dma-buf objects, enabling safe sharing of non-struct page memory with controlled lifetime management. This allows RDMA and other subsystems to import dma-buf FDs and build them into memory regions for PCI P2P operations. The series supports a use case for SPDK where a NVMe device will be owned by SPDK through VFIO but interacting with a RDMA device. The RDMA device may directly access the NVMe CMB or directly manipulate the NVMe device's doorbell using PCI P2P. However, as a general mechanism, it can support many other scenarios with VFIO. This dmabuf approach can be usable by iommufd as well for generic and safe P2P mappings. In addition to the SPDK use-case mentioned above, the capability added in this patch series can also be useful when a buffer (located in device memory such as VRAM) needs to be shared between any two dGPU devices or instances (assuming one of them is bound to VFIO PCI) as long as they are P2P DMA compatible. The implementation provides a revocable attachment mechanism using dma-buf move operations. MMIO regions are normally pinned as BARs don't change physical addresses, but access is revoked when the VFIO device is closed or a PCI reset is issued. This ensures kernel self-defense against potentially hostile userspace. The series includes significant refactoring of the PCI P2PDMA subsystem to separate core P2P functionality from memory allocation features, making it more modular and suitable for VFIO use cases that don't need struct page support. ----------------------------------------------------------------------- The series is based originally on https://lore.kernel.org/all/20250307052248.405803-1-vivek.kasireddy@intel.c… but heavily rewritten to be based on DMA physical API. ----------------------------------------------------------------------- The WIP branch can be found here: https://git.kernel.org/pub/scm/linux/kernel/git/leon/linux-rdma.git/log/?h=… Thanks Leon Romanovsky (8): PCI/P2PDMA: Separate the mmap() support from the core logic PCI/P2PDMA: Simplify bus address mapping API PCI/P2PDMA: Refactor to separate core P2P functionality from memory allocation PCI/P2PDMA: Export pci_p2pdma_map_type() function types: move phys_vec definition to common header vfio/pci: Add dma-buf export config for MMIO regions vfio/pci: Enable peer-to-peer DMA transactions by default vfio/pci: Add dma-buf export support for MMIO regions :wqa Vivek Kasireddy (2): vfio: Export vfio device get and put registration helpers vfio/pci: Share the core device pointer while invoking feature functions block/blk-mq-dma.c | 7 +- drivers/iommu/dma-iommu.c | 4 +- drivers/pci/p2pdma.c | 165 ++++++++---- drivers/vfio/pci/Kconfig | 20 ++ drivers/vfio/pci/Makefile | 2 + drivers/vfio/pci/vfio_pci_config.c | 22 +- drivers/vfio/pci/vfio_pci_core.c | 59 +++-- drivers/vfio/pci/vfio_pci_dmabuf.c | 398 +++++++++++++++++++++++++++++ drivers/vfio/pci/vfio_pci_priv.h | 23 ++ drivers/vfio/vfio_main.c | 2 + include/linux/pci-p2pdma.h | 114 +++++---- include/linux/types.h | 5 + include/linux/vfio.h | 2 + include/linux/vfio_pci_core.h | 4 + include/uapi/linux/vfio.h | 25 ++ kernel/dma/direct.c | 4 +- mm/hmm.c | 2 +- 17 files changed, 734 insertions(+), 124 deletions(-) create mode 100644 drivers/vfio/pci/vfio_pci_dmabuf.c -- 2.51.0

1 week, 2 days

Re: [PATCH v11 2/9] dma-buf: dma-heap: export declared functions

by T.J. Mercier

On Wed, Aug 13, 2025 at 11:13 PM Sumit Garg <sumit.garg(a)kernel.org> wrote: > > On Wed, Aug 13, 2025 at 08:02:51AM +0200, Jens Wiklander wrote: > > Export the dma-buf heap functions to allow them to be used by the OP-TEE > > driver. The OP-TEE driver wants to register and manage specific secure > > DMA heaps with it. > > > > Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> > > Reviewed-by: Sumit Garg <sumit.garg(a)oss.qualcomm.com> > > --- > > drivers/dma-buf/dma-heap.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > Can we get an ack from DMAbuf maintainers here? With that we should be > able to queue this patch-set for linux-next targetting the 6.18 merge > window. > > -Sumit Reviewed-by: T.J. Mercier <tjmercier(a)google.com> Sorry I haven't been able to participate much upstream lately. > > > diff --git a/drivers/dma-buf/dma-heap.c b/drivers/dma-buf/dma-heap.c > > index 3cbe87d4a464..cdddf0e24dce 100644 > > --- a/drivers/dma-buf/dma-heap.c > > +++ b/drivers/dma-buf/dma-heap.c > > @@ -202,6 +202,7 @@ void *dma_heap_get_drvdata(struct dma_heap *heap) > > { > > return heap->priv; > > } > > +EXPORT_SYMBOL(dma_heap_get_drvdata); > > > > /** > > * dma_heap_get_name - get heap name > > @@ -214,6 +215,7 @@ const char *dma_heap_get_name(struct dma_heap *heap) > > { > > return heap->name; > > } > > +EXPORT_SYMBOL(dma_heap_get_name); > > > > /** > > * dma_heap_add - adds a heap to dmabuf heaps > > @@ -303,6 +305,7 @@ struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info) > > kfree(heap); > > return err_ret; > > } > > +EXPORT_SYMBOL(dma_heap_add); > > > > static char *dma_heap_devnode(const struct device *dev, umode_t *mode) > > { > > -- > > 2.43.0 > >

1 week, 3 days

Re: [PATCH v11 05/11] tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF

by Jens Wiklander

Hi Amir, On Thu, Sep 11, 2025 at 5:41 AM Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> wrote: > > For drivers that can transfer data to the TEE without using shared > memory from client, it is necessary to receive the user address > directly, bypassing any processing by the TEE subsystem. Introduce > TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT/OUTPUT/INOUT to represent > userspace buffers. > > Reviewed-by: Sumit Garg <sumit.garg(a)oss.qualcomm.com> > Tested-by: Neil Armstrong <neil.armstrong(a)linaro.org> > Tested-by: Harshal Dev <quic_hdev(a)quicinc.com> > Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> > --- > drivers/tee/tee_core.c | 33 +++++++++++++++++++++++++++++++++ > include/linux/tee_drv.h | 6 ++++++ > include/uapi/linux/tee.h | 22 ++++++++++++++++------ > 3 files changed, 55 insertions(+), 6 deletions(-) > > diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c > index f8534a00c56c..bb2e3a6c23a3 100644 > --- a/drivers/tee/tee_core.c > +++ b/drivers/tee/tee_core.c > @@ -457,6 +457,17 @@ static int params_from_user(struct tee_context *ctx, struct tee_param *params, > params[n].u.value.b = ip.b; > params[n].u.value.c = ip.c; > break; > + case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT: > + case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT: > + case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT: > + params[n].u.ubuf.uaddr = u64_to_user_ptr(ip.a); > + params[n].u.ubuf.size = ip.b; > + > + if (!access_ok(params[n].u.ubuf.uaddr, > + params[n].u.ubuf.size)) > + return -EFAULT; > + > + break; > case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT: > case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT: > case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT: > @@ -490,6 +501,11 @@ static int params_to_user(struct tee_ioctl_param __user *uparams, > put_user(p->u.value.c, &up->c)) > return -EFAULT; > break; > + case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT: > + case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT: > + if (put_user((u64)p->u.ubuf.size, &up->b)) > + return -EFAULT; > + break; > case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT: > case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT: > if (put_user((u64)p->u.memref.size, &up->b)) > @@ -690,6 +706,13 @@ static int params_to_supp(struct tee_context *ctx, > ip.b = p->u.value.b; > ip.c = p->u.value.c; > break; > + case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT: > + case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT: > + case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT: > + ip.a = (__force u64)p->u.ubuf.uaddr; There's a warning on arm32: drivers/tee/tee_core.c: In function 'params_to_supp': drivers/tee/tee_core.c:821:32: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] 821 | ip.a = (__force u64)p->u.ubuf.uaddr; I think you need to cast to unsigned long instead. Cheers, Jens > + ip.b = p->u.ubuf.size; > + ip.c = 0; > + break; > case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT: > case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT: > case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT: > @@ -792,6 +815,16 @@ static int params_from_supp(struct tee_param *params, size_t num_params, > p->u.value.b = ip.b; > p->u.value.c = ip.c; > break; > + case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT: > + case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT: > + p->u.ubuf.uaddr = u64_to_user_ptr(ip.a); > + p->u.ubuf.size = ip.b; > + > + if (!access_ok(params[n].u.ubuf.uaddr, > + params[n].u.ubuf.size)) > + return -EFAULT; > + > + break; > case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT: > case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT: > /* > diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h > index 824f1251de60..7915e8869cbd 100644 > --- a/include/linux/tee_drv.h > +++ b/include/linux/tee_drv.h > @@ -82,6 +82,11 @@ struct tee_param_memref { > struct tee_shm *shm; > }; > > +struct tee_param_ubuf { > + void __user *uaddr; > + size_t size; > +}; > + > struct tee_param_value { > u64 a; > u64 b; > @@ -92,6 +97,7 @@ struct tee_param { > u64 attr; > union { > struct tee_param_memref memref; > + struct tee_param_ubuf ubuf; > struct tee_param_value value; > } u; > }; > diff --git a/include/uapi/linux/tee.h b/include/uapi/linux/tee.h > index d843cf980d98..0e3b735dcfca 100644 > --- a/include/uapi/linux/tee.h > +++ b/include/uapi/linux/tee.h > @@ -151,6 +151,13 @@ struct tee_ioctl_buf_data { > #define TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT 6 > #define TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT 7 /* input and output */ > > +/* > + * These defines userspace buffer parameters. > + */ > +#define TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT 8 > +#define TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT 9 > +#define TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT 10 /* input and output */ > + > /* > * Mask for the type part of the attribute, leaves room for more types > */ > @@ -186,14 +193,17 @@ struct tee_ioctl_buf_data { > /** > * struct tee_ioctl_param - parameter > * @attr: attributes > - * @a: if a memref, offset into the shared memory object, else a value parameter > - * @b: if a memref, size of the buffer, else a value parameter > + * @a: if a memref, offset into the shared memory object, > + * else if a ubuf, address of the user buffer, > + * else a value parameter > + * @b: if a memref or ubuf, size of the buffer, else a value parameter > * @c: if a memref, shared memory identifier, else a value parameter > * > - * @attr & TEE_PARAM_ATTR_TYPE_MASK indicates if memref or value is used in > - * the union. TEE_PARAM_ATTR_TYPE_VALUE_* indicates value and > - * TEE_PARAM_ATTR_TYPE_MEMREF_* indicates memref. TEE_PARAM_ATTR_TYPE_NONE > - * indicates that none of the members are used. > + * @attr & TEE_PARAM_ATTR_TYPE_MASK indicates if memref, ubuf, or value is > + * used in the union. TEE_PARAM_ATTR_TYPE_VALUE_* indicates value, > + * TEE_PARAM_ATTR_TYPE_MEMREF_* indicates memref, and TEE_PARAM_ATTR_TYPE_UBUF_* > + * indicates ubuf. TEE_PARAM_ATTR_TYPE_NONE indicates that none of the members > + * are used. > * > * Shared memory is allocated with TEE_IOC_SHM_ALLOC which returns an > * identifier representing the shared memory object. A memref can reference > > -- > 2.34.1 >

1 week, 3 days

[PATCH v4] Documentation: dma-buf: heaps: Add naming guidelines

by Maxime Ripard

We've discussed a number of times of how some heap names are bad, but not really what makes a good heap name. Let's document what we expect the heap names to look like. Reviewed-by: Andrew Davis <afd(a)ti.com> Reviewed-by: Bagas Sanjaya <bagasdotme(a)gmail.com> Signed-off-by: Maxime Ripard <mripard(a)kernel.org> --- Changes in v4: - Dropped *all* the cacheable mentions - Link to v3: https://lore.kernel.org/r/20250717-dma-buf-heap-names-doc-v3-1-d2dbb4b95ef6… Changes in v3: - Grammar, spelling fixes - Remove the cacheable / uncacheable name suggestion - Link to v2: https://lore.kernel.org/r/20250616-dma-buf-heap-names-doc-v2-1-8ae43174cdbf… Changes in v2: - Added justifications for each requirement / suggestions - Added a mention and example of buffer attributes - Link to v1: https://lore.kernel.org/r/20250520-dma-buf-heap-names-doc-v1-1-ab31f74809ee… --- Documentation/userspace-api/dma-buf-heaps.rst | 35 +++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/Documentation/userspace-api/dma-buf-heaps.rst b/Documentation/userspace-api/dma-buf-heaps.rst index 535f49047ce6450796bf4380c989e109355efc05..1ced2720f929432661182f1a3a88aa1ff80bd6af 100644 --- a/Documentation/userspace-api/dma-buf-heaps.rst +++ b/Documentation/userspace-api/dma-buf-heaps.rst @@ -21,5 +21,40 @@ following heaps: usually created either through the kernel commandline through the `cma` parameter, a memory region Device-Tree node with the `linux,cma-default` property set, or through the `CMA_SIZE_MBYTES` or `CMA_SIZE_PERCENTAGE` Kconfig options. Depending on the platform, it might be called ``reserved``, ``linux,cma``, or ``default-pool``. + +Naming Convention +================= + +``dma-buf`` heaps name should meet a number of constraints: + +- The name must be stable, and must not change from one version to the other. + Userspace identifies heaps by their name, so if the names ever change, we + would be likely to introduce regressions. + +- The name must describe the memory region the heap will allocate from, and + must uniquely identify it in a given platform. Since userspace applications + use the heap name as the discriminant, it must be able to tell which heap it + wants to use reliably if there's multiple heaps. + +- The name must not mention implementation details, such as the allocator. The + heap driver will change over time, and implementation details when it was + introduced might not be relevant in the future. + +- The name should describe properties of the buffers that would be allocated. + Doing so will make heap identification easier for userspace. Such properties + are: + + - ``contiguous`` for physically contiguous buffers; + + - ``protected`` for encrypted buffers not accessible the OS; + +- The name may describe intended usage. Doing so will make heap identification + easier for userspace applications and users. + +For example, assuming a platform with a reserved memory region located +at the RAM address 0x42000000, intended to allocate video framebuffers, +physically contiguous, and backed by the CMA kernel allocator, good +names would be ``memory@42000000-contiguous`` or ``video@42000000``, but +``cma-video`` wouldn't. --- base-commit: 038d61fd642278bab63ee8ef722c50d10ab01e8f change-id: 20250520-dma-buf-heap-names-doc-31261aa0cfe6 Best regards, -- Maxime Ripard <mripard(a)kernel.org>

1 week, 4 days

Re: [PATCH v9 00/11] Trusted Execution Environment (TEE) driver for Qualcomm TEE (QTEE)

by Bjorn Andersson

On Mon, Sep 01, 2025 at 09:55:47PM -0700, Amirreza Zarrabi wrote: > This patch series introduces a Trusted Execution Environment (TEE) > driver for Qualcomm TEE (QTEE). QTEE enables Trusted Applications (TAs) > and services to run securely. It uses an object-based interface, where > each service is an object with sets of operations. Clients can invoke > these operations on objects, which can generate results, including other > objects. For example, an object can load a TA and return another object > that represents the loaded TA, allowing access to its services. > > Kernel and userspace services are also available to QTEE through a > similar approach. QTEE makes callback requests that are converted into > object invocations. These objects can represent services within the > kernel or userspace process. > > Note: This patch series focuses on QTEE objects and userspace services. > > Linux already provides a TEE subsystem, which is described in [1]. The > tee subsystem provides a generic ioctl interface, TEE_IOC_INVOKE, which > can be used by userspace to talk to a TEE backend driver. We extend the > Linux TEE subsystem to understand object parameters and an ioctl call so > client can invoke objects in QTEE: > > - TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_* > - TEE_IOC_OBJECT_INVOKE > > The existing ioctl calls TEE_IOC_SUPPL_RECV and TEE_IOC_SUPPL_SEND are > used for invoking services in the userspace process by QTEE. > > The TEE backend driver uses the QTEE Transport Message to communicate > with QTEE. Interactions through the object INVOKE interface are > translated into QTEE messages. Likewise, object invocations from QTEE > for userspace objects are converted into SEND/RECV ioctl calls to > supplicants. > > The details of QTEE Transport Message to communicate with QTEE is > available in [PATCH 12/12] Documentation: tee: Add Qualcomm TEE driver. > > You can run basic tests with following steps: > git clone https://github.com/quic/quic-teec.git > cd quic-teec > mkdir build > cmake .. -DCMAKE_TOOLCHAIN_FILE=CMakeToolchain.txt -DBUILD_UNITTEST=ON > > https://github.com/quic/quic-teec/blob/main/README.md lists dependencies > needed to build the above. > > More comprehensive tests are availabe at > https://github.com/qualcomm/minkipc. > > root@qcom-armv8a:~# qtee_supplicant & > root@qcom-armv8a:~# qtee_supplicant: process entry PPID = 378 > Total listener services to start = 4 > Opening CRequestTABuffer_open > Path /data/ > register_service ::Opening CRegisterTABufCBO_UID > Calling TAbufCBO Register > QTEE_SUPPLICANT RUNNING > > root@qcom-armv8a:~# smcinvoke_client -c /data 1 > Run callback obj test... > Load /data/tzecotestapp.mbn, size 52192, buf 0x1e44ba0. > System Time: 2024-02-27 17:26:31 > PASSED - Callback tests with Buffer inputs. > PASSED - Callback tests with Remote and Callback object inputs. > PASSED - Callback tests with Memory Object inputs. > TEST PASSED! > root@qcom-armv8a:~# > root@qcom-armv8a:~# smcinvoke_client -m /data 1 > Run memory obj test... > Load /data/tzecotestapp.mbn, size 52192, buf 0x26cafba0. > System Time: 2024-02-27 17:26:39 > PASSED - Single Memory Object access Test. > PASSED - Two Memory Object access Test. > TEST PASSED! > > This series has been tested for QTEE object invocations, including > loading a TA, requesting services from the TA, memory sharing, and > handling callback requests to a supplicant. > > Tested platforms: sm8650-mtp, sm8550-qrd, sm8650-qrd, sm8650-hdk > > [1] https://www.kernel.org/doc/Documentation/tee.txt > > Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> > > Changes in v9: > - Remove unnecessary logging in qcom_scm_probe(). > - Replace the platform_device_alloc()/add() sequence with > platform_device_register_data(). > - Fixed sparse warning. > - Fixed documentation typo. > - Link to v8: > https://lore.kernel.org/r/20250820-qcom-tee-using-tee-ss-without-mem-obj-v8… > > Changes in v8: > - Check if arguments to qcom_scm_qtee_invoke_smc() and > qcom_scm_qtee_callback_response() are NULL. > - Add CPU_BIG_ENDIAN as a dependency to Kconfig. > - Fixed kernel bot errors. > - Link to v7: > https://lore.kernel.org/r/20250812-qcom-tee-using-tee-ss-without-mem-obj-v7… > > Changes in v7: > - Updated copyrights. > - Updated Acked-by: tags. > - Fixed kernel bot errors. > - Link to v6: > https://lore.kernel.org/r/20250713-qcom-tee-using-tee-ss-without-mem-obj-v6… > > Changes in v6: > - Relocate QTEE version into the driver's main service structure. > - Simplfies qcomtee_objref_to_arg() and qcomtee_objref_from_arg(). > - Enhanced the return logic of qcomtee_object_do_invoke_internal(). > - Improve comments and remove redundant checks. > - Improve helpers in qcomtee_msh.h to use GENMASK() and FIELD_GET(). > - updated Tested-by:, Acked-by:, and Reviewed-by: tags > - Link to v5: > https://lore.kernel.org/r/20250526-qcom-tee-using-tee-ss-without-mem-obj-v5… > > Changes in v5: > - Remove references to kernel services and public APIs. > - Support auto detection for failing devices (e.g., RB1, RB4). > - Add helpers for obtaining client environment and service objects. > - Query the QTEE version and print it. > - Move remaining static variables, including the object table, to struct > qcomtee. > - Update TEE_MAX_ARG_SIZE to 4096. > - Add a dependancy to QCOM_TZMEM_MODE_SHMBRIDGE in Kconfig > - Reorganize code by removing release.c and qcom_scm.c. > - Add more error messages and improve comments. > - updated Tested-by:, Acked-by:, and Reviewed-by: tags > - Link to v4: https://lore.kernel.org/r/20250428-qcom-tee-using-tee-ss-without-mem-obj-v4… > > Changes in v4: > - Move teedev_ctx_get/put and tee_device_get/put to tee_core.h. > - Rename object to id in struct tee_ioctl_object_invoke_arg. > - Replace spinlock with mutex for qtee_objects_idr. > - Move qcomtee_object_get to qcomtee_user/memobj_param_to_object. > - More code cleanup following the comments. > - Cleanup documentations. > - Update MAINTAINERS file. > - Link to v3: https://lore.kernel.org/r/20250327-qcom-tee-using-tee-ss-without-mem-obj-v3… > > Changes in v3: > - Export shm_bridge create/delete APIs. > - Enable support for QTEE memory objects. > - Update the memory management code to use the TEE subsystem for all > allocations using the pool. > - Move all driver states into the driver's main service struct. > - Add more documentations. > - Link to v2: https://lore.kernel.org/r/20250202-qcom-tee-using-tee-ss-without-mem-obj-v2… > > Changes in v2: > - Clean up commit messages and comments. > - Use better names such as ubuf instead of membuf or QCOMTEE prefix > instead of QCOM_TEE, or names that are more consistent with other > TEE-backend drivers such as qcomtee_context_data instead of > qcom_tee_context. > - Drop the DTS patch and instantiate the device from the scm driver. > - Use a single structure for all driver's internal states. > - Drop srcu primitives and use the existing mutex for synchronization > between the supplicant and QTEE. > - Directly use tee_context to track the lifetime of qcomtee_context_data. > - Add close_context() to be called when the user closes the tee_context. > - Link to v1: https://lore.kernel.org/r/20241202-qcom-tee-using-tee-ss-without-mem-obj-v1… > > Changes in v1: > - It is a complete rewrite to utilize the TEE subsystem. > - Link to RFC: https://lore.kernel.org/all/20240702-qcom-tee-object-and-ioctls-v1-0-633c3d… > > --- > Amirreza Zarrabi (11): > tee: allow a driver to allocate a tee_device without a pool > tee: add close_context to TEE driver operation > tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF > tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF > tee: increase TEE_MAX_ARG_SIZE to 4096 > firmware: qcom: scm: add support for object invocation > firmware: qcom: tzmem: export shm_bridge create/delete These two patches are for code maintained by me, the rest by Jens. So we will have to dance to get this merged. Is there are reason why these two are in the middle of the series? Do they need to come after the first 5 but before the next 3? Regards, Bjorn > tee: add Qualcomm TEE driver > tee: qcom: add primordial object > tee: qcom: enable TEE_IOC_SHM_ALLOC ioctl > Documentation: tee: Add Qualcomm TEE driver > > Documentation/tee/index.rst | 1 + > Documentation/tee/qtee.rst | 96 ++++ > MAINTAINERS | 7 + > drivers/firmware/qcom/qcom_scm.c | 124 +++++ > drivers/firmware/qcom/qcom_scm.h | 7 + > drivers/firmware/qcom/qcom_tzmem.c | 63 ++- > drivers/tee/Kconfig | 1 + > drivers/tee/Makefile | 1 + > drivers/tee/qcomtee/Kconfig | 12 + > drivers/tee/qcomtee/Makefile | 9 + > drivers/tee/qcomtee/async.c | 182 ++++++ > drivers/tee/qcomtee/call.c | 820 +++++++++++++++++++++++++++ > drivers/tee/qcomtee/core.c | 915 +++++++++++++++++++++++++++++++ > drivers/tee/qcomtee/mem_obj.c | 169 ++++++ > drivers/tee/qcomtee/primordial_obj.c | 113 ++++ > drivers/tee/qcomtee/qcomtee.h | 185 +++++++ > drivers/tee/qcomtee/qcomtee_msg.h | 304 ++++++++++ > drivers/tee/qcomtee/qcomtee_object.h | 316 +++++++++++ > drivers/tee/qcomtee/shm.c | 150 +++++ > drivers/tee/qcomtee/user_obj.c | 692 +++++++++++++++++++++++ > drivers/tee/tee_core.c | 127 ++++- > drivers/tee/tee_private.h | 6 - > include/linux/firmware/qcom/qcom_scm.h | 6 + > include/linux/firmware/qcom/qcom_tzmem.h | 15 + > include/linux/tee_core.h | 54 +- > include/linux/tee_drv.h | 12 + > include/uapi/linux/tee.h | 56 +- > 27 files changed, 4415 insertions(+), 28 deletions(-) > --- > base-commit: 33bcf93b9a6b028758105680f8b538a31bc563cf > change-id: 20241202-qcom-tee-using-tee-ss-without-mem-obj-362c66340527 > > Best regards, > -- > Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> >

1 week, 4 days

Re: [PATCH v9 06/11] firmware: qcom: scm: add support for object invocation

by Bjorn Andersson

On Mon, Sep 01, 2025 at 09:55:53PM -0700, Amirreza Zarrabi wrote: > Qualcomm TEE (QTEE) hosts Trusted Applications (TAs) and services in > the secure world, accessed via objects. A QTEE client can invoke these > objects to request services. Similarly, QTEE can request services from > the nonsecure world using objects exported to the secure world. > > Add low-level primitives to facilitate the invocation of objects hosted > in QTEE, as well as those hosted in the nonsecure world. > > If support for object invocation is available, the qcom_scm allocates > a dedicated child platform device. The driver for this device communicates > with QTEE using low-level primitives. > > Tested-by: Neil Armstrong <neil.armstrong(a)linaro.org> > Tested-by: Harshal Dev <quic_hdev(a)quicinc.com> > Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> > --- > drivers/firmware/qcom/qcom_scm.c | 124 +++++++++++++++++++++++++++++++++ > drivers/firmware/qcom/qcom_scm.h | 7 ++ > include/linux/firmware/qcom/qcom_scm.h | 6 ++ > 3 files changed, 137 insertions(+) > > diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c > index edeae6cdcf31..739ee9819549 100644 > --- a/drivers/firmware/qcom/qcom_scm.c > +++ b/drivers/firmware/qcom/qcom_scm.c > @@ -2094,6 +2094,127 @@ static int qcom_scm_qseecom_init(struct qcom_scm *scm) > > #endif /* CONFIG_QCOM_QSEECOM */ > > +/** > + * qcom_scm_qtee_invoke_smc() - Invoke a QTEE object. > + * @inbuf: start address of memory area used for inbound buffer. > + * @inbuf_size: size of the memory area used for inbound buffer. > + * @outbuf: start address of memory area used for outbound buffer. > + * @outbuf_size: size of the memory area used for outbound buffer. > + * @result: result of QTEE object invocation. > + * @response_type: response type returned by QTEE. > + * > + * @response_type determines how the contents of @inbuf and @outbuf > + * should be processed. > + * > + * Return: On success, return 0 or <0 on failure. > + */ > +int qcom_scm_qtee_invoke_smc(phys_addr_t inbuf, size_t inbuf_size, > + phys_addr_t outbuf, size_t outbuf_size, > + u64 *result, u64 *response_type) > +{ > + struct qcom_scm_desc desc = { > + .svc = QCOM_SCM_SVC_SMCINVOKE, > + .cmd = QCOM_SCM_SMCINVOKE_INVOKE, > + .owner = ARM_SMCCC_OWNER_TRUSTED_OS, > + .args[0] = inbuf, > + .args[1] = inbuf_size, > + .args[2] = outbuf, > + .args[3] = outbuf_size, > + .arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_RW, QCOM_SCM_VAL, > + QCOM_SCM_RW, QCOM_SCM_VAL), > + }; > + struct qcom_scm_res res; > + int ret; > + > + ret = qcom_scm_call(__scm->dev, &desc, &res); > + if (ret) > + return ret; > + > + if (response_type) > + *response_type = res.result[0]; > + > + if (result) > + *result = res.result[1]; > + > + return 0; > +} > +EXPORT_SYMBOL(qcom_scm_qtee_invoke_smc); > + > +/** > + * qcom_scm_qtee_callback_response() - Submit response for callback request. > + * @buf: start address of memory area used for outbound buffer. > + * @buf_size: size of the memory area used for outbound buffer. > + * @result: Result of QTEE object invocation. > + * @response_type: Response type returned by QTEE. > + * > + * @response_type determines how the contents of @buf should be processed. > + * > + * Return: On success, return 0 or <0 on failure. > + */ > +int qcom_scm_qtee_callback_response(phys_addr_t buf, size_t buf_size, > + u64 *result, u64 *response_type) > +{ > + struct qcom_scm_desc desc = { > + .svc = QCOM_SCM_SVC_SMCINVOKE, > + .cmd = QCOM_SCM_SMCINVOKE_CB_RSP, > + .owner = ARM_SMCCC_OWNER_TRUSTED_OS, > + .args[0] = buf, > + .args[1] = buf_size, > + .arginfo = QCOM_SCM_ARGS(2, QCOM_SCM_RW, QCOM_SCM_VAL), > + }; > + struct qcom_scm_res res; > + int ret; > + > + ret = qcom_scm_call(__scm->dev, &desc, &res); > + if (ret) > + return ret; > + > + if (response_type) > + *response_type = res.result[0]; > + > + if (result) > + *result = res.result[1]; > + > + return 0; > +} > +EXPORT_SYMBOL(qcom_scm_qtee_callback_response); > + > +static void qcom_scm_qtee_free(void *data) > +{ > + struct platform_device *qtee_dev = data; > + > + platform_device_unregister(qtee_dev); > +} > + > +static void qcom_scm_qtee_init(struct qcom_scm *scm) > +{ > + struct platform_device *qtee_dev; > + u64 result, response_type; > + int ret; > + > + /* > + * Probe for smcinvoke support. This will fail due to invalid buffers, > + * but first, it checks whether the call is supported in QTEE syscall > + * handler. If it is not supported, -EIO is returned. > + */ > + ret = qcom_scm_qtee_invoke_smc(0, 0, 0, 0, &result, &response_type); > + if (ret == -EIO) > + return; > + > + /* Setup QTEE interface device. */ > + qtee_dev = platform_device_register_data(scm->dev, "qcomtee", > + PLATFORM_DEVID_NONE, NULL, 0); > + if (IS_ERR(qtee_dev)) { > + dev_err(scm->dev, "qcomtee: register failed: %d\n", > + PTR_ERR(qtee_dev)); This isn't going to fail, and all expected paths that it would fail will be -ENOMEM which already printed a warning. So, I'd suggest that you resolve the LKP build warning by dropping the print. > + return; > + } > + > + ret = devm_add_action_or_reset(scm->dev, qcom_scm_qtee_free, qtee_dev); > + if (ret) > + dev_err(scm->dev, "qcomtee: add action failed: %d\n", ret); The only possible error here is -ENOMEM, so you can skip the print. Regards, Bjorn > +} > + > /** > * qcom_scm_is_available() - Checks if SCM is available > */ > @@ -2326,6 +2447,9 @@ static int qcom_scm_probe(struct platform_device *pdev) > ret = qcom_scm_qseecom_init(scm); > WARN(ret < 0, "failed to initialize qseecom: %d\n", ret); > > + /* Initialize the QTEE object interface. */ > + qcom_scm_qtee_init(scm); > + > return 0; > } > > diff --git a/drivers/firmware/qcom/qcom_scm.h b/drivers/firmware/qcom/qcom_scm.h > index 0e8dd838099e..a56c8212cc0c 100644 > --- a/drivers/firmware/qcom/qcom_scm.h > +++ b/drivers/firmware/qcom/qcom_scm.h > @@ -156,6 +156,13 @@ int qcom_scm_shm_bridge_enable(struct device *scm_dev); > #define QCOM_SCM_SVC_GPU 0x28 > #define QCOM_SCM_SVC_GPU_INIT_REGS 0x01 > > +/* ARM_SMCCC_OWNER_TRUSTED_OS calls */ > + > +#define QCOM_SCM_SVC_SMCINVOKE 0x06 > +#define QCOM_SCM_SMCINVOKE_INVOKE_LEGACY 0x00 > +#define QCOM_SCM_SMCINVOKE_CB_RSP 0x01 > +#define QCOM_SCM_SMCINVOKE_INVOKE 0x02 > + > /* common error codes */ > #define QCOM_SCM_V2_EBUSY -12 > #define QCOM_SCM_ENOMEM -5 > diff --git a/include/linux/firmware/qcom/qcom_scm.h b/include/linux/firmware/qcom/qcom_scm.h > index 0f667bf1d4d9..a55ca771286b 100644 > --- a/include/linux/firmware/qcom/qcom_scm.h > +++ b/include/linux/firmware/qcom/qcom_scm.h > @@ -175,4 +175,10 @@ static inline int qcom_scm_qseecom_app_send(u32 app_id, > > #endif /* CONFIG_QCOM_QSEECOM */ > > +int qcom_scm_qtee_invoke_smc(phys_addr_t inbuf, size_t inbuf_size, > + phys_addr_t outbuf, size_t outbuf_size, > + u64 *result, u64 *response_type); > +int qcom_scm_qtee_callback_response(phys_addr_t buf, size_t buf_size, > + u64 *result, u64 *response_type); > + > #endif > > -- > 2.34.1 >

1 week, 4 days

Re: [PATCH v7 00/11] Trusted Execution Environment (TEE) driver for Qualcomm TEE (QTEE)

by Jens Wiklander

On Tue, Sep 9, 2025 at 6:34 AM Sumit Garg <sumit.garg(a)kernel.org> wrote: > > On Tue, Aug 12, 2025 at 05:35:29PM -0700, Amirreza Zarrabi wrote: > > This patch series introduces a Trusted Execution Environment (TEE) > > driver for Qualcomm TEE (QTEE). QTEE enables Trusted Applications (TAs) > > and services to run securely. It uses an object-based interface, where > > each service is an object with sets of operations. Clients can invoke > > these operations on objects, which can generate results, including other > > objects. For example, an object can load a TA and return another object > > that represents the loaded TA, allowing access to its services. > > > > Kernel and userspace services are also available to QTEE through a > > similar approach. QTEE makes callback requests that are converted into > > object invocations. These objects can represent services within the > > kernel or userspace process. > > > > Note: This patch series focuses on QTEE objects and userspace services. > > > > Linux already provides a TEE subsystem, which is described in [1]. The > > tee subsystem provides a generic ioctl interface, TEE_IOC_INVOKE, which > > can be used by userspace to talk to a TEE backend driver. We extend the > > Linux TEE subsystem to understand object parameters and an ioctl call so > > client can invoke objects in QTEE: > > > > - TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_* > > - TEE_IOC_OBJECT_INVOKE > > > > The existing ioctl calls TEE_IOC_SUPPL_RECV and TEE_IOC_SUPPL_SEND are > > used for invoking services in the userspace process by QTEE. > > > > The TEE backend driver uses the QTEE Transport Message to communicate > > with QTEE. Interactions through the object INVOKE interface are > > translated into QTEE messages. Likewise, object invocations from QTEE > > for userspace objects are converted into SEND/RECV ioctl calls to > > supplicants. > > > > The details of QTEE Transport Message to communicate with QTEE is > > available in [PATCH 12/12] Documentation: tee: Add Qualcomm TEE driver. > > > > You can run basic tests with following steps: > > git clone https://github.com/quic/quic-teec.git > > cd quic-teec > > mkdir build > > cmake .. -DCMAKE_TOOLCHAIN_FILE=CMakeToolchain.txt -DBUILD_UNITTEST=ON > > > > https://github.com/quic/quic-teec/blob/main/README.md lists dependencies > > needed to build the above. > > > > More comprehensive tests are availabe at > > https://github.com/qualcomm/minkipc. > > > > root@qcom-armv8a:~# qtee_supplicant & > > root@qcom-armv8a:~# qtee_supplicant: process entry PPID = 378 > > Total listener services to start = 4 > > Opening CRequestTABuffer_open > > Path /data/ > > register_service ::Opening CRegisterTABufCBO_UID > > Calling TAbufCBO Register > > QTEE_SUPPLICANT RUNNING > > > > root@qcom-armv8a:~# smcinvoke_client -c /data 1 > > Run callback obj test... > > Load /data/tzecotestapp.mbn, size 52192, buf 0x1e44ba0. > > System Time: 2024-02-27 17:26:31 > > PASSED - Callback tests with Buffer inputs. > > PASSED - Callback tests with Remote and Callback object inputs. > > PASSED - Callback tests with Memory Object inputs. > > TEST PASSED! > > root@qcom-armv8a:~# > > root@qcom-armv8a:~# smcinvoke_client -m /data 1 > > Run memory obj test... > > Load /data/tzecotestapp.mbn, size 52192, buf 0x26cafba0. > > System Time: 2024-02-27 17:26:39 > > PASSED - Single Memory Object access Test. > > PASSED - Two Memory Object access Test. > > TEST PASSED! > > > > This series has been tested for QTEE object invocations, including > > loading a TA, requesting services from the TA, memory sharing, and > > handling callback requests to a supplicant. > > > > Tested platforms: sm8650-mtp, sm8550-qrd, sm8650-qrd, sm8650-hdk > > > > [1] https://www.kernel.org/doc/Documentation/tee.txt > > > > Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> > > > > At this point, I think this series is ready to be applied to linux-next. There are still some warnings in "[PATCH v9 06/11] firmware: qcom: scm: add support for object invocation" /Jens > > > Changes in v7: > > - Updated copyrights. > > - Updated Acked-by: tags. > > - Fixed kernel bot errors. > > - Link to v6: > > https://lore.kernel.org/r/20250713-qcom-tee-using-tee-ss-without-mem-obj-v6… > > > > Changes in v6: > > - Relocate QTEE version into the driver's main service structure. > > - Simplfies qcomtee_objref_to_arg() and qcomtee_objref_from_arg(). > > - Enhanced the return logic of qcomtee_object_do_invoke_internal(). > > - Improve comments and remove redundant checks. > > - Improve helpers in qcomtee_msh.h to use GENMASK() and FIELD_GET(). > > - updated Tested-by:, Acked-by:, and Reviewed-by: tags > > - Link to v5: > > https://lore.kernel.org/r/20250526-qcom-tee-using-tee-ss-without-mem-obj-v5… > > > > Changes in v5: > > - Remove references to kernel services and public APIs. > > - Support auto detection for failing devices (e.g., RB1, RB4). > > - Add helpers for obtaining client environment and service objects. > > - Query the QTEE version and print it. > > - Move remaining static variables, including the object table, to struct > > qcomtee. > > - Update TEE_MAX_ARG_SIZE to 4096. > > - Add a dependancy to QCOM_TZMEM_MODE_SHMBRIDGE in Kconfig > > - Reorganize code by removing release.c and qcom_scm.c. > > - Add more error messages and improve comments. > > - updated Tested-by:, Acked-by:, and Reviewed-by: tags > > - Link to v4: https://lore.kernel.org/r/20250428-qcom-tee-using-tee-ss-without-mem-obj-v4… > > > > Changes in v4: > > - Move teedev_ctx_get/put and tee_device_get/put to tee_core.h. > > - Rename object to id in struct tee_ioctl_object_invoke_arg. > > - Replace spinlock with mutex for qtee_objects_idr. > > - Move qcomtee_object_get to qcomtee_user/memobj_param_to_object. > > - More code cleanup following the comments. > > - Cleanup documentations. > > - Update MAINTAINERS file. > > - Link to v3: https://lore.kernel.org/r/20250327-qcom-tee-using-tee-ss-without-mem-obj-v3… > > > > Changes in v3: > > - Export shm_bridge create/delete APIs. > > - Enable support for QTEE memory objects. > > - Update the memory management code to use the TEE subsystem for all > > allocations using the pool. > > - Move all driver states into the driver's main service struct. > > - Add more documentations. > > - Link to v2: https://lore.kernel.org/r/20250202-qcom-tee-using-tee-ss-without-mem-obj-v2… > > > > Changes in v2: > > - Clean up commit messages and comments. > > - Use better names such as ubuf instead of membuf or QCOMTEE prefix > > instead of QCOM_TEE, or names that are more consistent with other > > TEE-backend drivers such as qcomtee_context_data instead of > > qcom_tee_context. > > - Drop the DTS patch and instantiate the device from the scm driver. > > - Use a single structure for all driver's internal states. > > - Drop srcu primitives and use the existing mutex for synchronization > > between the supplicant and QTEE. > > - Directly use tee_context to track the lifetime of qcomtee_context_data. > > - Add close_context() to be called when the user closes the tee_context. > > - Link to v1: https://lore.kernel.org/r/20241202-qcom-tee-using-tee-ss-without-mem-obj-v1… > > > > Changes in v1: > > - It is a complete rewrite to utilize the TEE subsystem. > > - Link to RFC: https://lore.kernel.org/all/20240702-qcom-tee-object-and-ioctls-v1-0-633c3d… > > > > --- > > Amirreza Zarrabi (11): > > tee: allow a driver to allocate a tee_device without a pool > > tee: add close_context to TEE driver operation > > tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF > > tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF > > tee: increase TEE_MAX_ARG_SIZE to 4096 > > > firmware: qcom: scm: add support for object invocation > > firmware: qcom: tzmem: export shm_bridge create/delete > > Bjorn/Konrad, > > Since majority of this series belong to TEE subsystem, are you folks > fine to ack these patches for Jens to pick them up for next? > > -Sumit > > > tee: add Qualcomm TEE driver > > qcomtee: add primordial object > > qcomtee: enable TEE_IOC_SHM_ALLOC ioctl > > Documentation: tee: Add Qualcomm TEE driver > > > > > > > Documentation/tee/index.rst | 1 + > > Documentation/tee/qtee.rst | 96 ++++ > > MAINTAINERS | 7 + > > drivers/firmware/qcom/qcom_scm.c | 128 +++++ > > drivers/firmware/qcom/qcom_scm.h | 7 + > > drivers/firmware/qcom/qcom_tzmem.c | 63 ++- > > drivers/tee/Kconfig | 1 + > > drivers/tee/Makefile | 1 + > > drivers/tee/qcomtee/Kconfig | 11 + > > drivers/tee/qcomtee/Makefile | 9 + > > drivers/tee/qcomtee/async.c | 183 ++++++ > > drivers/tee/qcomtee/call.c | 820 +++++++++++++++++++++++++++ > > drivers/tee/qcomtee/core.c | 920 +++++++++++++++++++++++++++++++ > > drivers/tee/qcomtee/mem_obj.c | 169 ++++++ > > drivers/tee/qcomtee/primordial_obj.c | 116 ++++ > > drivers/tee/qcomtee/qcomtee.h | 185 +++++++ > > drivers/tee/qcomtee/qcomtee_msg.h | 300 ++++++++++ > > drivers/tee/qcomtee/qcomtee_object.h | 316 +++++++++++ > > drivers/tee/qcomtee/shm.c | 150 +++++ > > drivers/tee/qcomtee/user_obj.c | 692 +++++++++++++++++++++++ > > drivers/tee/tee_core.c | 127 ++++- > > drivers/tee/tee_private.h | 6 - > > include/linux/firmware/qcom/qcom_scm.h | 6 + > > include/linux/firmware/qcom/qcom_tzmem.h | 15 + > > include/linux/tee_core.h | 54 +- > > include/linux/tee_drv.h | 12 + > > include/uapi/linux/tee.h | 56 +- > > 27 files changed, 4423 insertions(+), 28 deletions(-) > > --- > > base-commit: 2674d1eadaa2fd3a918dfcdb6d0bb49efe8a8bb9 > > change-id: 20241202-qcom-tee-using-tee-ss-without-mem-obj-362c66340527 > > > > Best regards, > > -- > > Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> > > > >

1 week, 5 days

Re: [PATCH v7 2/2] i2c: i2c-qcom-geni: Add Block event interrupt support

by kernel test robot

Hi Jyothi, kernel test robot noticed the following build warnings: [auto build test WARNING on vkoul-dmaengine/next] [also build test WARNING on andi-shyti/i2c/i2c-host linus/master v6.17-rc4 next-20250905] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Jyothi-Kumar-Seerapu/dmaengi… base: https://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine.git next patch link: https://lore.kernel.org/r/20250903073059.2151837-3-quic_jseerapu%40quicinc.… patch subject: [PATCH v7 2/2] i2c: i2c-qcom-geni: Add Block event interrupt support config: i386-allmodconfig (https://download.01.org/0day-ci/archive/20250906/202509062008.lSOdhd4U-lkp@…) compiler: gcc-13 (Debian 13.3.0-16) 13.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250906/202509062008.lSOdhd4U-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509062008.lSOdhd4U-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/i2c/busses/i2c-qcom-geni.c: In function 'geni_i2c_gpi_multi_desc_unmap': >> drivers/i2c/busses/i2c-qcom-geni.c:576:42: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] 576 | NULL, (dma_addr_t)NULL); | ^ vim +576 drivers/i2c/busses/i2c-qcom-geni.c 555 556 /** 557 * geni_i2c_gpi_multi_desc_unmap() - Unmaps DMA buffers post multi message TX transfers 558 * @gi2c: I2C dev handle 559 * @msgs: Array of I2C messages 560 * @peripheral: Pointer to gpi_i2c_config 561 */ 562 static void geni_i2c_gpi_multi_desc_unmap(struct geni_i2c_dev *gi2c, struct i2c_msg msgs[], 563 struct gpi_i2c_config *peripheral) 564 { 565 u32 msg_xfer_cnt, wr_idx = 0; 566 struct geni_i2c_gpi_multi_desc_xfer *tx_multi_xfer = &gi2c->i2c_multi_desc_config; 567 568 msg_xfer_cnt = gi2c->err ? tx_multi_xfer->msg_idx_cnt : tx_multi_xfer->irq_cnt; 569 570 /* Unmap the processed DMA buffers based on the received interrupt count */ 571 for (; tx_multi_xfer->unmap_msg_cnt < msg_xfer_cnt; tx_multi_xfer->unmap_msg_cnt++) { 572 wr_idx = tx_multi_xfer->unmap_msg_cnt; 573 geni_i2c_gpi_unmap(gi2c, &msgs[wr_idx], 574 tx_multi_xfer->dma_buf[wr_idx], 575 tx_multi_xfer->dma_addr[wr_idx], > 576 NULL, (dma_addr_t)NULL); 577 578 if (tx_multi_xfer->unmap_msg_cnt == gi2c->num_msgs - 1) { 579 kfree(tx_multi_xfer->dma_buf); 580 kfree(tx_multi_xfer->dma_addr); 581 break; 582 } 583 } 584 } 585 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

2 weeks

[PATCH 0/9] dma-buf: heaps: Add Tegra VPR support

by Thierry Reding

From: Thierry Reding <treding(a)nvidia.com> Hi, This series adds support for the video protection region (VPR) used on Tegra SoC devices. It's a special region of memory that is protected from accesses by the CPU and used to store DRM protected content (both decrypted stream data as well as decoded video frames). Patches 1 and 2 add DT binding documentation for the VPR and add the VPR to the list of memory-region items for display and host1x. Patch 3 introduces new APIs needed by the Tegra VPR implementation that allow CMA areas to be dynamically created at runtime rather than using the fixed, system-wide list. This is used in this driver specifically because it can use an arbitrary number of these areas (though they are currently limited to 4). Patch 4 adds some infrastructure for DMA heap implementations to provide information through debugfs. The Tegra VPR implementation is added in patch 5. See its commit message for more details about the specifics of this implementation. Finally, patches 6-9 add the VPR placeholder node on Tegra234 and hook it up to the host1x and GPU nodes so that they can make use of this region. Thierry Thierry Reding (9): dt-bindings: reserved-memory: Document Tegra VPR dt-bindings: display: tegra: Document memory regions mm/cma: Allow dynamically creating CMA areas dma-buf: heaps: Add debugfs support dma-buf: heaps: Add support for Tegra VPR arm64: tegra: Add VPR placeholder node on Tegra234 arm64: tegra: Add GPU node on Tegra234 arm64: tegra: Hook up VPR to host1x arm64: tegra: Hook up VPR to the GPU .../display/tegra/nvidia,tegra186-dc.yaml | 10 + .../display/tegra/nvidia,tegra20-dc.yaml | 10 +- .../display/tegra/nvidia,tegra20-host1x.yaml | 7 + .../nvidia,tegra-video-protection-region.yaml | 55 ++ arch/arm64/boot/dts/nvidia/tegra234.dtsi | 57 ++ drivers/dma-buf/dma-heap.c | 56 ++ drivers/dma-buf/heaps/Kconfig | 7 + drivers/dma-buf/heaps/Makefile | 1 + drivers/dma-buf/heaps/tegra-vpr.c | 831 ++++++++++++++++++ include/linux/cma.h | 16 + include/linux/dma-heap.h | 2 + include/trace/events/tegra_vpr.h | 57 ++ mm/cma.c | 89 +- 13 files changed, 1175 insertions(+), 23 deletions(-) create mode 100644 Documentation/devicetree/bindings/reserved-memory/nvidia,tegra-video-protection-region.yaml create mode 100644 drivers/dma-buf/heaps/tegra-vpr.c create mode 100644 include/trace/events/tegra_vpr.h -- 2.50.0

2 weeks, 2 days

Re: [PATCH 3/9] mm/cma: Allow dynamically creating CMA areas

by Thierry Reding

On Wed, Sep 03, 2025 at 09:41:18AM -0700, Frank van der Linden wrote: > On Wed, Sep 3, 2025 at 9:05 AM Thierry Reding <thierry.reding(a)gmail.com> wrote: > > > > On Tue, Sep 02, 2025 at 10:27:01AM -0700, Frank van der Linden wrote: > > > On Tue, Sep 2, 2025 at 8:46 AM Thierry Reding <thierry.reding(a)gmail.com> wrote: > > > > > > > > From: Thierry Reding <treding(a)nvidia.com> > > > > > > > > There is no technical reason why there should be a limited number of CMA > > > > regions, so extract some code into helpers and use them to create extra > > > > functions (cma_create() and cma_free()) that allow creating and freeing, > > > > respectively, CMA regions dynamically at runtime. > > > > > > > > Note that these dynamically created CMA areas are treated specially and > > > > do not contribute to the number of total CMA pages so that this count > > > > still only applies to the fixed number of CMA areas. > > > > > > > > Signed-off-by: Thierry Reding <treding(a)nvidia.com> > > > > --- > > > > include/linux/cma.h | 16 ++++++++ > > > > mm/cma.c | 89 ++++++++++++++++++++++++++++++++++----------- > > > > 2 files changed, 83 insertions(+), 22 deletions(-) > > [...] > > > I agree that supporting dynamic CMA areas would be good. However, by > > > doing it like this, these CMA areas are invisible to the rest of the > > > system. E.g. cma_for_each_area() does not know about them. It seems a > > > bit inconsistent that there will now be some areas that are globally > > > known, and some that are not. > > > > That was kind of the point of this experiment. When I started on this I > > ran into the case where I was running out of predefined CMA areas and as > > I went looking for ways on how to fix this, I realized that there's not > > much reason to keep a global list of these areas. And even less reason > > to limit the number of CMA areas to this predefined list. Very little > > code outside of the core CMA code even uses this. > > > > There's one instance of cma_for_each_area() that I don't grok. There's > > another early MMU fixup for CMA areas in 32-bit ARM that. Other than > > that there's a few places where the total CMA page count is shown for > > informational purposes and I don't know how useful that really is > > because totalcma_pages doesn't really track how many pages are used for > > CMA, but pages that could potentially be used for CMA. > > > > And that's about it. > > > > It seems like there are cases where we might really need to globally > > know about some of these areas, specifically ones that are allocated > > very early during boot and then used for very specific purposes. > > > > However, it seems to me like CMA is more universally useful than just > > for these cases and I don't see the usefulness of tracking these more > > generic uses. > > > > > I am being somewhat selfish here, as I have some WIP code that needs > > > the global list :-) But I think the inconsistency is a more general > > > point than just what I want (and the s390 code does use > > > cma_for_each_area()). Maybe you could keep maintaining a global > > > structure containing all areas? > > > > If it's really useful to be able to access all CMA areas, then we could > > easily just add them all to a global linked list upon activation (we may > > still want/need to keep the predefined list around for all those early > > allocation cases). That way we'd get the best of both worlds. > > > > > What do you think are the chances of running out of the global count > > > of areas? > > > > Well, I did run out of CMA areas during the early VPR testing because I > > was initially testing with 16 areas and a different allocation scheme > > that turned out to cause too many resizes in common cases. > > > > However, given that the default is 8 on normal systems (20 on NUMA) and > > is configurable, it means that even with restricting this to 4 for VPR > > doesn't always guarantee that all 4 are available. Again, yes, we could > > keep bumping that number, but why not turn this into something a bit > > more robust where nobody has to know or care about how many there are? > > > > > Also, you say that "these are treated specially and do not contribute > > > to the number of total CMA pages". But, if I'm reading this right, you > > > do call cma_activate_area(), which will do > > > init_cma_reserved_pageblock() for each pageblock in it. Which adjusts > > > the CMA counters for the zone they are in. But your change does not > > > adjust totalcma_pages for dynamically created areas. That seems > > > inconsistent, too. > > > > I was referring to just totalcma_pages that isn't impacted by these > > dynamically allocated regions. This is, again, because I don't see why > > that information would be useful. It's a fairly easy change to update > > that value, so if people prefer that, I can add that. > > > > I don't see an immediate connection between totalcma_pages and > > init_cma_reserved_pageblock(). I thought the latter was primarily useful > > for making sure that the CMA pages can be migrated, which is still > > critical for this use-case. > > My comment was about statistics, they would be inconsistent after your > change. E.g. currently, totalcma_pages is equal to the sum of CMA > pages in each zone. But that would no longer be true, and applications > / administrators looking at those statistics might see the > inconsistency (between meminfo and vmstat) and wonder what's going on. > It seems best to keep those numbers in sync. > > In general, I think it's fine to support dynamic allocation, and I > agree with your arguments that it doesn't seem right to set the number > of CMA areas via a config option. I would just like there to be a > canonical way to find all CMA areas. Okay, so judging by your and David's feedback, it sounds like I should add a bit of code to track dynamically allocated areas within a global list, along with the existing predefined regions and keep totalcma_pages updated so that the global view is consistent. I'll look into that. Thanks for the feedback. Thierry

2 weeks, 2 days

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig September 2025