On Mon, Sep 01, 2025 at 09:55:47PM -0700, Amirreza Zarrabi wrote:
> This patch series introduces a Trusted Execution Environment (TEE)
> driver for Qualcomm TEE (QTEE). QTEE enables Trusted Applications (TAs)
> and services to run securely. It uses an object-based interface, where
> each service is an object with sets of operations. Clients can invoke
> these operations on objects, which can generate results, including other
> objects. For example, an object can load a TA and return another object
> that represents the loaded TA, allowing access to its services.
>
> Kernel and userspace services are also available to QTEE through a
> similar approach. QTEE makes callback requests that are converted into
> object invocations. These objects can represent services within the
> kernel or userspace process.
>
> Note: This patch series focuses on QTEE objects and userspace services.
>
> Linux already provides a TEE subsystem, which is described in [1]. The
> tee subsystem provides a generic ioctl interface, TEE_IOC_INVOKE, which
> can be used by userspace to talk to a TEE backend driver. We extend the
> Linux TEE subsystem to understand object parameters and an ioctl call so
> client can invoke objects in QTEE:
>
> - TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_*
> - TEE_IOC_OBJECT_INVOKE
>
> The existing ioctl calls TEE_IOC_SUPPL_RECV and TEE_IOC_SUPPL_SEND are
> used for invoking services in the userspace process by QTEE.
>
> The TEE backend driver uses the QTEE Transport Message to communicate
> with QTEE. Interactions through the object INVOKE interface are
> translated into QTEE messages. Likewise, object invocations from QTEE
> for userspace objects are converted into SEND/RECV ioctl calls to
> supplicants.
>
> The details of QTEE Transport Message to communicate with QTEE is
> available in [PATCH 12/12] Documentation: tee: Add Qualcomm TEE driver.
>
> You can run basic tests with following steps:
> git clone https://github.com/quic/quic-teec.git
> cd quic-teec
> mkdir build
> cmake .. -DCMAKE_TOOLCHAIN_FILE=CMakeToolchain.txt -DBUILD_UNITTEST=ON
>
> https://github.com/quic/quic-teec/blob/main/README.md lists dependencies
> needed to build the above.
>
> More comprehensive tests are availabe at
> https://github.com/qualcomm/minkipc.
>
> root@qcom-armv8a:~# qtee_supplicant &
> root@qcom-armv8a:~# qtee_supplicant: process entry PPID = 378
> Total listener services to start = 4
> Opening CRequestTABuffer_open
> Path /data/
> register_service ::Opening CRegisterTABufCBO_UID
> Calling TAbufCBO Register
> QTEE_SUPPLICANT RUNNING
>
> root@qcom-armv8a:~# smcinvoke_client -c /data 1
> Run callback obj test...
> Load /data/tzecotestapp.mbn, size 52192, buf 0x1e44ba0.
> System Time: 2024-02-27 17:26:31
> PASSED - Callback tests with Buffer inputs.
> PASSED - Callback tests with Remote and Callback object inputs.
> PASSED - Callback tests with Memory Object inputs.
> TEST PASSED!
> root@qcom-armv8a:~#
> root@qcom-armv8a:~# smcinvoke_client -m /data 1
> Run memory obj test...
> Load /data/tzecotestapp.mbn, size 52192, buf 0x26cafba0.
> System Time: 2024-02-27 17:26:39
> PASSED - Single Memory Object access Test.
> PASSED - Two Memory Object access Test.
> TEST PASSED!
>
> This series has been tested for QTEE object invocations, including
> loading a TA, requesting services from the TA, memory sharing, and
> handling callback requests to a supplicant.
>
> Tested platforms: sm8650-mtp, sm8550-qrd, sm8650-qrd, sm8650-hdk
>
> [1] https://www.kernel.org/doc/Documentation/tee.txt
>
> Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com>
>
> Changes in v9:
> - Remove unnecessary logging in qcom_scm_probe().
> - Replace the platform_device_alloc()/add() sequence with
> platform_device_register_data().
> - Fixed sparse warning.
> - Fixed documentation typo.
> - Link to v8:
> https://lore.kernel.org/r/20250820-qcom-tee-using-tee-ss-without-mem-obj-v8…
>
> Changes in v8:
> - Check if arguments to qcom_scm_qtee_invoke_smc() and
> qcom_scm_qtee_callback_response() are NULL.
> - Add CPU_BIG_ENDIAN as a dependency to Kconfig.
> - Fixed kernel bot errors.
> - Link to v7:
> https://lore.kernel.org/r/20250812-qcom-tee-using-tee-ss-without-mem-obj-v7…
>
> Changes in v7:
> - Updated copyrights.
> - Updated Acked-by: tags.
> - Fixed kernel bot errors.
> - Link to v6:
> https://lore.kernel.org/r/20250713-qcom-tee-using-tee-ss-without-mem-obj-v6…
>
> Changes in v6:
> - Relocate QTEE version into the driver's main service structure.
> - Simplfies qcomtee_objref_to_arg() and qcomtee_objref_from_arg().
> - Enhanced the return logic of qcomtee_object_do_invoke_internal().
> - Improve comments and remove redundant checks.
> - Improve helpers in qcomtee_msh.h to use GENMASK() and FIELD_GET().
> - updated Tested-by:, Acked-by:, and Reviewed-by: tags
> - Link to v5:
> https://lore.kernel.org/r/20250526-qcom-tee-using-tee-ss-without-mem-obj-v5…
>
> Changes in v5:
> - Remove references to kernel services and public APIs.
> - Support auto detection for failing devices (e.g., RB1, RB4).
> - Add helpers for obtaining client environment and service objects.
> - Query the QTEE version and print it.
> - Move remaining static variables, including the object table, to struct
> qcomtee.
> - Update TEE_MAX_ARG_SIZE to 4096.
> - Add a dependancy to QCOM_TZMEM_MODE_SHMBRIDGE in Kconfig
> - Reorganize code by removing release.c and qcom_scm.c.
> - Add more error messages and improve comments.
> - updated Tested-by:, Acked-by:, and Reviewed-by: tags
> - Link to v4: https://lore.kernel.org/r/20250428-qcom-tee-using-tee-ss-without-mem-obj-v4…
>
> Changes in v4:
> - Move teedev_ctx_get/put and tee_device_get/put to tee_core.h.
> - Rename object to id in struct tee_ioctl_object_invoke_arg.
> - Replace spinlock with mutex for qtee_objects_idr.
> - Move qcomtee_object_get to qcomtee_user/memobj_param_to_object.
> - More code cleanup following the comments.
> - Cleanup documentations.
> - Update MAINTAINERS file.
> - Link to v3: https://lore.kernel.org/r/20250327-qcom-tee-using-tee-ss-without-mem-obj-v3…
>
> Changes in v3:
> - Export shm_bridge create/delete APIs.
> - Enable support for QTEE memory objects.
> - Update the memory management code to use the TEE subsystem for all
> allocations using the pool.
> - Move all driver states into the driver's main service struct.
> - Add more documentations.
> - Link to v2: https://lore.kernel.org/r/20250202-qcom-tee-using-tee-ss-without-mem-obj-v2…
>
> Changes in v2:
> - Clean up commit messages and comments.
> - Use better names such as ubuf instead of membuf or QCOMTEE prefix
> instead of QCOM_TEE, or names that are more consistent with other
> TEE-backend drivers such as qcomtee_context_data instead of
> qcom_tee_context.
> - Drop the DTS patch and instantiate the device from the scm driver.
> - Use a single structure for all driver's internal states.
> - Drop srcu primitives and use the existing mutex for synchronization
> between the supplicant and QTEE.
> - Directly use tee_context to track the lifetime of qcomtee_context_data.
> - Add close_context() to be called when the user closes the tee_context.
> - Link to v1: https://lore.kernel.org/r/20241202-qcom-tee-using-tee-ss-without-mem-obj-v1…
>
> Changes in v1:
> - It is a complete rewrite to utilize the TEE subsystem.
> - Link to RFC: https://lore.kernel.org/all/20240702-qcom-tee-object-and-ioctls-v1-0-633c3d…
>
> ---
> Amirreza Zarrabi (11):
> tee: allow a driver to allocate a tee_device without a pool
> tee: add close_context to TEE driver operation
> tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF
> tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF
> tee: increase TEE_MAX_ARG_SIZE to 4096
> firmware: qcom: scm: add support for object invocation
> firmware: qcom: tzmem: export shm_bridge create/delete
These two patches are for code maintained by me, the rest by Jens. So we
will have to dance to get this merged.
Is there are reason why these two are in the middle of the series? Do
they need to come after the first 5 but before the next 3?
Regards,
Bjorn
> tee: add Qualcomm TEE driver
> tee: qcom: add primordial object
> tee: qcom: enable TEE_IOC_SHM_ALLOC ioctl
> Documentation: tee: Add Qualcomm TEE driver
>
> Documentation/tee/index.rst | 1 +
> Documentation/tee/qtee.rst | 96 ++++
> MAINTAINERS | 7 +
> drivers/firmware/qcom/qcom_scm.c | 124 +++++
> drivers/firmware/qcom/qcom_scm.h | 7 +
> drivers/firmware/qcom/qcom_tzmem.c | 63 ++-
> drivers/tee/Kconfig | 1 +
> drivers/tee/Makefile | 1 +
> drivers/tee/qcomtee/Kconfig | 12 +
> drivers/tee/qcomtee/Makefile | 9 +
> drivers/tee/qcomtee/async.c | 182 ++++++
> drivers/tee/qcomtee/call.c | 820 +++++++++++++++++++++++++++
> drivers/tee/qcomtee/core.c | 915 +++++++++++++++++++++++++++++++
> drivers/tee/qcomtee/mem_obj.c | 169 ++++++
> drivers/tee/qcomtee/primordial_obj.c | 113 ++++
> drivers/tee/qcomtee/qcomtee.h | 185 +++++++
> drivers/tee/qcomtee/qcomtee_msg.h | 304 ++++++++++
> drivers/tee/qcomtee/qcomtee_object.h | 316 +++++++++++
> drivers/tee/qcomtee/shm.c | 150 +++++
> drivers/tee/qcomtee/user_obj.c | 692 +++++++++++++++++++++++
> drivers/tee/tee_core.c | 127 ++++-
> drivers/tee/tee_private.h | 6 -
> include/linux/firmware/qcom/qcom_scm.h | 6 +
> include/linux/firmware/qcom/qcom_tzmem.h | 15 +
> include/linux/tee_core.h | 54 +-
> include/linux/tee_drv.h | 12 +
> include/uapi/linux/tee.h | 56 +-
> 27 files changed, 4415 insertions(+), 28 deletions(-)
> ---
> base-commit: 33bcf93b9a6b028758105680f8b538a31bc563cf
> change-id: 20241202-qcom-tee-using-tee-ss-without-mem-obj-362c66340527
>
> Best regards,
> --
> Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com>
>
On Tue, Sep 9, 2025 at 6:34 AM Sumit Garg <sumit.garg(a)kernel.org> wrote:
>
> On Tue, Aug 12, 2025 at 05:35:29PM -0700, Amirreza Zarrabi wrote:
> > This patch series introduces a Trusted Execution Environment (TEE)
> > driver for Qualcomm TEE (QTEE). QTEE enables Trusted Applications (TAs)
> > and services to run securely. It uses an object-based interface, where
> > each service is an object with sets of operations. Clients can invoke
> > these operations on objects, which can generate results, including other
> > objects. For example, an object can load a TA and return another object
> > that represents the loaded TA, allowing access to its services.
> >
> > Kernel and userspace services are also available to QTEE through a
> > similar approach. QTEE makes callback requests that are converted into
> > object invocations. These objects can represent services within the
> > kernel or userspace process.
> >
> > Note: This patch series focuses on QTEE objects and userspace services.
> >
> > Linux already provides a TEE subsystem, which is described in [1]. The
> > tee subsystem provides a generic ioctl interface, TEE_IOC_INVOKE, which
> > can be used by userspace to talk to a TEE backend driver. We extend the
> > Linux TEE subsystem to understand object parameters and an ioctl call so
> > client can invoke objects in QTEE:
> >
> > - TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_*
> > - TEE_IOC_OBJECT_INVOKE
> >
> > The existing ioctl calls TEE_IOC_SUPPL_RECV and TEE_IOC_SUPPL_SEND are
> > used for invoking services in the userspace process by QTEE.
> >
> > The TEE backend driver uses the QTEE Transport Message to communicate
> > with QTEE. Interactions through the object INVOKE interface are
> > translated into QTEE messages. Likewise, object invocations from QTEE
> > for userspace objects are converted into SEND/RECV ioctl calls to
> > supplicants.
> >
> > The details of QTEE Transport Message to communicate with QTEE is
> > available in [PATCH 12/12] Documentation: tee: Add Qualcomm TEE driver.
> >
> > You can run basic tests with following steps:
> > git clone https://github.com/quic/quic-teec.git
> > cd quic-teec
> > mkdir build
> > cmake .. -DCMAKE_TOOLCHAIN_FILE=CMakeToolchain.txt -DBUILD_UNITTEST=ON
> >
> > https://github.com/quic/quic-teec/blob/main/README.md lists dependencies
> > needed to build the above.
> >
> > More comprehensive tests are availabe at
> > https://github.com/qualcomm/minkipc.
> >
> > root@qcom-armv8a:~# qtee_supplicant &
> > root@qcom-armv8a:~# qtee_supplicant: process entry PPID = 378
> > Total listener services to start = 4
> > Opening CRequestTABuffer_open
> > Path /data/
> > register_service ::Opening CRegisterTABufCBO_UID
> > Calling TAbufCBO Register
> > QTEE_SUPPLICANT RUNNING
> >
> > root@qcom-armv8a:~# smcinvoke_client -c /data 1
> > Run callback obj test...
> > Load /data/tzecotestapp.mbn, size 52192, buf 0x1e44ba0.
> > System Time: 2024-02-27 17:26:31
> > PASSED - Callback tests with Buffer inputs.
> > PASSED - Callback tests with Remote and Callback object inputs.
> > PASSED - Callback tests with Memory Object inputs.
> > TEST PASSED!
> > root@qcom-armv8a:~#
> > root@qcom-armv8a:~# smcinvoke_client -m /data 1
> > Run memory obj test...
> > Load /data/tzecotestapp.mbn, size 52192, buf 0x26cafba0.
> > System Time: 2024-02-27 17:26:39
> > PASSED - Single Memory Object access Test.
> > PASSED - Two Memory Object access Test.
> > TEST PASSED!
> >
> > This series has been tested for QTEE object invocations, including
> > loading a TA, requesting services from the TA, memory sharing, and
> > handling callback requests to a supplicant.
> >
> > Tested platforms: sm8650-mtp, sm8550-qrd, sm8650-qrd, sm8650-hdk
> >
> > [1] https://www.kernel.org/doc/Documentation/tee.txt
> >
> > Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com>
> >
>
> At this point, I think this series is ready to be applied to linux-next.
There are still some warnings in "[PATCH v9 06/11] firmware: qcom:
scm: add support for object invocation"
/Jens
>
> > Changes in v7:
> > - Updated copyrights.
> > - Updated Acked-by: tags.
> > - Fixed kernel bot errors.
> > - Link to v6:
> > https://lore.kernel.org/r/20250713-qcom-tee-using-tee-ss-without-mem-obj-v6…
> >
> > Changes in v6:
> > - Relocate QTEE version into the driver's main service structure.
> > - Simplfies qcomtee_objref_to_arg() and qcomtee_objref_from_arg().
> > - Enhanced the return logic of qcomtee_object_do_invoke_internal().
> > - Improve comments and remove redundant checks.
> > - Improve helpers in qcomtee_msh.h to use GENMASK() and FIELD_GET().
> > - updated Tested-by:, Acked-by:, and Reviewed-by: tags
> > - Link to v5:
> > https://lore.kernel.org/r/20250526-qcom-tee-using-tee-ss-without-mem-obj-v5…
> >
> > Changes in v5:
> > - Remove references to kernel services and public APIs.
> > - Support auto detection for failing devices (e.g., RB1, RB4).
> > - Add helpers for obtaining client environment and service objects.
> > - Query the QTEE version and print it.
> > - Move remaining static variables, including the object table, to struct
> > qcomtee.
> > - Update TEE_MAX_ARG_SIZE to 4096.
> > - Add a dependancy to QCOM_TZMEM_MODE_SHMBRIDGE in Kconfig
> > - Reorganize code by removing release.c and qcom_scm.c.
> > - Add more error messages and improve comments.
> > - updated Tested-by:, Acked-by:, and Reviewed-by: tags
> > - Link to v4: https://lore.kernel.org/r/20250428-qcom-tee-using-tee-ss-without-mem-obj-v4…
> >
> > Changes in v4:
> > - Move teedev_ctx_get/put and tee_device_get/put to tee_core.h.
> > - Rename object to id in struct tee_ioctl_object_invoke_arg.
> > - Replace spinlock with mutex for qtee_objects_idr.
> > - Move qcomtee_object_get to qcomtee_user/memobj_param_to_object.
> > - More code cleanup following the comments.
> > - Cleanup documentations.
> > - Update MAINTAINERS file.
> > - Link to v3: https://lore.kernel.org/r/20250327-qcom-tee-using-tee-ss-without-mem-obj-v3…
> >
> > Changes in v3:
> > - Export shm_bridge create/delete APIs.
> > - Enable support for QTEE memory objects.
> > - Update the memory management code to use the TEE subsystem for all
> > allocations using the pool.
> > - Move all driver states into the driver's main service struct.
> > - Add more documentations.
> > - Link to v2: https://lore.kernel.org/r/20250202-qcom-tee-using-tee-ss-without-mem-obj-v2…
> >
> > Changes in v2:
> > - Clean up commit messages and comments.
> > - Use better names such as ubuf instead of membuf or QCOMTEE prefix
> > instead of QCOM_TEE, or names that are more consistent with other
> > TEE-backend drivers such as qcomtee_context_data instead of
> > qcom_tee_context.
> > - Drop the DTS patch and instantiate the device from the scm driver.
> > - Use a single structure for all driver's internal states.
> > - Drop srcu primitives and use the existing mutex for synchronization
> > between the supplicant and QTEE.
> > - Directly use tee_context to track the lifetime of qcomtee_context_data.
> > - Add close_context() to be called when the user closes the tee_context.
> > - Link to v1: https://lore.kernel.org/r/20241202-qcom-tee-using-tee-ss-without-mem-obj-v1…
> >
> > Changes in v1:
> > - It is a complete rewrite to utilize the TEE subsystem.
> > - Link to RFC: https://lore.kernel.org/all/20240702-qcom-tee-object-and-ioctls-v1-0-633c3d…
> >
> > ---
> > Amirreza Zarrabi (11):
> > tee: allow a driver to allocate a tee_device without a pool
> > tee: add close_context to TEE driver operation
> > tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF
> > tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF
> > tee: increase TEE_MAX_ARG_SIZE to 4096
>
> > firmware: qcom: scm: add support for object invocation
> > firmware: qcom: tzmem: export shm_bridge create/delete
>
> Bjorn/Konrad,
>
> Since majority of this series belong to TEE subsystem, are you folks
> fine to ack these patches for Jens to pick them up for next?
>
> -Sumit
>
> > tee: add Qualcomm TEE driver
> > qcomtee: add primordial object
> > qcomtee: enable TEE_IOC_SHM_ALLOC ioctl
> > Documentation: tee: Add Qualcomm TEE driver
>
>
>
> >
> > Documentation/tee/index.rst | 1 +
> > Documentation/tee/qtee.rst | 96 ++++
> > MAINTAINERS | 7 +
> > drivers/firmware/qcom/qcom_scm.c | 128 +++++
> > drivers/firmware/qcom/qcom_scm.h | 7 +
> > drivers/firmware/qcom/qcom_tzmem.c | 63 ++-
> > drivers/tee/Kconfig | 1 +
> > drivers/tee/Makefile | 1 +
> > drivers/tee/qcomtee/Kconfig | 11 +
> > drivers/tee/qcomtee/Makefile | 9 +
> > drivers/tee/qcomtee/async.c | 183 ++++++
> > drivers/tee/qcomtee/call.c | 820 +++++++++++++++++++++++++++
> > drivers/tee/qcomtee/core.c | 920 +++++++++++++++++++++++++++++++
> > drivers/tee/qcomtee/mem_obj.c | 169 ++++++
> > drivers/tee/qcomtee/primordial_obj.c | 116 ++++
> > drivers/tee/qcomtee/qcomtee.h | 185 +++++++
> > drivers/tee/qcomtee/qcomtee_msg.h | 300 ++++++++++
> > drivers/tee/qcomtee/qcomtee_object.h | 316 +++++++++++
> > drivers/tee/qcomtee/shm.c | 150 +++++
> > drivers/tee/qcomtee/user_obj.c | 692 +++++++++++++++++++++++
> > drivers/tee/tee_core.c | 127 ++++-
> > drivers/tee/tee_private.h | 6 -
> > include/linux/firmware/qcom/qcom_scm.h | 6 +
> > include/linux/firmware/qcom/qcom_tzmem.h | 15 +
> > include/linux/tee_core.h | 54 +-
> > include/linux/tee_drv.h | 12 +
> > include/uapi/linux/tee.h | 56 +-
> > 27 files changed, 4423 insertions(+), 28 deletions(-)
> > ---
> > base-commit: 2674d1eadaa2fd3a918dfcdb6d0bb49efe8a8bb9
> > change-id: 20241202-qcom-tee-using-tee-ss-without-mem-obj-362c66340527
> >
> > Best regards,
> > --
> > Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com>
> >
> >
Hi Jyothi,
kernel test robot noticed the following build warnings:
[auto build test WARNING on vkoul-dmaengine/next]
[also build test WARNING on andi-shyti/i2c/i2c-host linus/master v6.17-rc4 next-20250905]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Jyothi-Kumar-Seerapu/dmaengi…
base: https://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine.git next
patch link: https://lore.kernel.org/r/20250903073059.2151837-3-quic_jseerapu%40quicinc.…
patch subject: [PATCH v7 2/2] i2c: i2c-qcom-geni: Add Block event interrupt support
config: i386-allmodconfig (https://download.01.org/0day-ci/archive/20250906/202509062008.lSOdhd4U-lkp@…)
compiler: gcc-13 (Debian 13.3.0-16) 13.3.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250906/202509062008.lSOdhd4U-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509062008.lSOdhd4U-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/i2c/busses/i2c-qcom-geni.c: In function 'geni_i2c_gpi_multi_desc_unmap':
>> drivers/i2c/busses/i2c-qcom-geni.c:576:42: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
576 | NULL, (dma_addr_t)NULL);
| ^
vim +576 drivers/i2c/busses/i2c-qcom-geni.c
555
556 /**
557 * geni_i2c_gpi_multi_desc_unmap() - Unmaps DMA buffers post multi message TX transfers
558 * @gi2c: I2C dev handle
559 * @msgs: Array of I2C messages
560 * @peripheral: Pointer to gpi_i2c_config
561 */
562 static void geni_i2c_gpi_multi_desc_unmap(struct geni_i2c_dev *gi2c, struct i2c_msg msgs[],
563 struct gpi_i2c_config *peripheral)
564 {
565 u32 msg_xfer_cnt, wr_idx = 0;
566 struct geni_i2c_gpi_multi_desc_xfer *tx_multi_xfer = &gi2c->i2c_multi_desc_config;
567
568 msg_xfer_cnt = gi2c->err ? tx_multi_xfer->msg_idx_cnt : tx_multi_xfer->irq_cnt;
569
570 /* Unmap the processed DMA buffers based on the received interrupt count */
571 for (; tx_multi_xfer->unmap_msg_cnt < msg_xfer_cnt; tx_multi_xfer->unmap_msg_cnt++) {
572 wr_idx = tx_multi_xfer->unmap_msg_cnt;
573 geni_i2c_gpi_unmap(gi2c, &msgs[wr_idx],
574 tx_multi_xfer->dma_buf[wr_idx],
575 tx_multi_xfer->dma_addr[wr_idx],
> 576 NULL, (dma_addr_t)NULL);
577
578 if (tx_multi_xfer->unmap_msg_cnt == gi2c->num_msgs - 1) {
579 kfree(tx_multi_xfer->dma_buf);
580 kfree(tx_multi_xfer->dma_addr);
581 break;
582 }
583 }
584 }
585
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
From: Thierry Reding <treding(a)nvidia.com>
Hi,
This series adds support for the video protection region (VPR) used on
Tegra SoC devices. It's a special region of memory that is protected
from accesses by the CPU and used to store DRM protected content (both
decrypted stream data as well as decoded video frames).
Patches 1 and 2 add DT binding documentation for the VPR and add the VPR
to the list of memory-region items for display and host1x.
Patch 3 introduces new APIs needed by the Tegra VPR implementation that
allow CMA areas to be dynamically created at runtime rather than using
the fixed, system-wide list. This is used in this driver specifically
because it can use an arbitrary number of these areas (though they are
currently limited to 4).
Patch 4 adds some infrastructure for DMA heap implementations to provide
information through debugfs.
The Tegra VPR implementation is added in patch 5. See its commit message
for more details about the specifics of this implementation.
Finally, patches 6-9 add the VPR placeholder node on Tegra234 and hook
it up to the host1x and GPU nodes so that they can make use of this
region.
Thierry
Thierry Reding (9):
dt-bindings: reserved-memory: Document Tegra VPR
dt-bindings: display: tegra: Document memory regions
mm/cma: Allow dynamically creating CMA areas
dma-buf: heaps: Add debugfs support
dma-buf: heaps: Add support for Tegra VPR
arm64: tegra: Add VPR placeholder node on Tegra234
arm64: tegra: Add GPU node on Tegra234
arm64: tegra: Hook up VPR to host1x
arm64: tegra: Hook up VPR to the GPU
.../display/tegra/nvidia,tegra186-dc.yaml | 10 +
.../display/tegra/nvidia,tegra20-dc.yaml | 10 +-
.../display/tegra/nvidia,tegra20-host1x.yaml | 7 +
.../nvidia,tegra-video-protection-region.yaml | 55 ++
arch/arm64/boot/dts/nvidia/tegra234.dtsi | 57 ++
drivers/dma-buf/dma-heap.c | 56 ++
drivers/dma-buf/heaps/Kconfig | 7 +
drivers/dma-buf/heaps/Makefile | 1 +
drivers/dma-buf/heaps/tegra-vpr.c | 831 ++++++++++++++++++
include/linux/cma.h | 16 +
include/linux/dma-heap.h | 2 +
include/trace/events/tegra_vpr.h | 57 ++
mm/cma.c | 89 +-
13 files changed, 1175 insertions(+), 23 deletions(-)
create mode 100644 Documentation/devicetree/bindings/reserved-memory/nvidia,tegra-video-protection-region.yaml
create mode 100644 drivers/dma-buf/heaps/tegra-vpr.c
create mode 100644 include/trace/events/tegra_vpr.h
--
2.50.0
On Wed, Sep 03, 2025 at 09:41:18AM -0700, Frank van der Linden wrote:
> On Wed, Sep 3, 2025 at 9:05 AM Thierry Reding <thierry.reding(a)gmail.com> wrote:
> >
> > On Tue, Sep 02, 2025 at 10:27:01AM -0700, Frank van der Linden wrote:
> > > On Tue, Sep 2, 2025 at 8:46 AM Thierry Reding <thierry.reding(a)gmail.com> wrote:
> > > >
> > > > From: Thierry Reding <treding(a)nvidia.com>
> > > >
> > > > There is no technical reason why there should be a limited number of CMA
> > > > regions, so extract some code into helpers and use them to create extra
> > > > functions (cma_create() and cma_free()) that allow creating and freeing,
> > > > respectively, CMA regions dynamically at runtime.
> > > >
> > > > Note that these dynamically created CMA areas are treated specially and
> > > > do not contribute to the number of total CMA pages so that this count
> > > > still only applies to the fixed number of CMA areas.
> > > >
> > > > Signed-off-by: Thierry Reding <treding(a)nvidia.com>
> > > > ---
> > > > include/linux/cma.h | 16 ++++++++
> > > > mm/cma.c | 89 ++++++++++++++++++++++++++++++++++-----------
> > > > 2 files changed, 83 insertions(+), 22 deletions(-)
> > [...]
> > > I agree that supporting dynamic CMA areas would be good. However, by
> > > doing it like this, these CMA areas are invisible to the rest of the
> > > system. E.g. cma_for_each_area() does not know about them. It seems a
> > > bit inconsistent that there will now be some areas that are globally
> > > known, and some that are not.
> >
> > That was kind of the point of this experiment. When I started on this I
> > ran into the case where I was running out of predefined CMA areas and as
> > I went looking for ways on how to fix this, I realized that there's not
> > much reason to keep a global list of these areas. And even less reason
> > to limit the number of CMA areas to this predefined list. Very little
> > code outside of the core CMA code even uses this.
> >
> > There's one instance of cma_for_each_area() that I don't grok. There's
> > another early MMU fixup for CMA areas in 32-bit ARM that. Other than
> > that there's a few places where the total CMA page count is shown for
> > informational purposes and I don't know how useful that really is
> > because totalcma_pages doesn't really track how many pages are used for
> > CMA, but pages that could potentially be used for CMA.
> >
> > And that's about it.
> >
> > It seems like there are cases where we might really need to globally
> > know about some of these areas, specifically ones that are allocated
> > very early during boot and then used for very specific purposes.
> >
> > However, it seems to me like CMA is more universally useful than just
> > for these cases and I don't see the usefulness of tracking these more
> > generic uses.
> >
> > > I am being somewhat selfish here, as I have some WIP code that needs
> > > the global list :-) But I think the inconsistency is a more general
> > > point than just what I want (and the s390 code does use
> > > cma_for_each_area()). Maybe you could keep maintaining a global
> > > structure containing all areas?
> >
> > If it's really useful to be able to access all CMA areas, then we could
> > easily just add them all to a global linked list upon activation (we may
> > still want/need to keep the predefined list around for all those early
> > allocation cases). That way we'd get the best of both worlds.
> >
> > > What do you think are the chances of running out of the global count
> > > of areas?
> >
> > Well, I did run out of CMA areas during the early VPR testing because I
> > was initially testing with 16 areas and a different allocation scheme
> > that turned out to cause too many resizes in common cases.
> >
> > However, given that the default is 8 on normal systems (20 on NUMA) and
> > is configurable, it means that even with restricting this to 4 for VPR
> > doesn't always guarantee that all 4 are available. Again, yes, we could
> > keep bumping that number, but why not turn this into something a bit
> > more robust where nobody has to know or care about how many there are?
> >
> > > Also, you say that "these are treated specially and do not contribute
> > > to the number of total CMA pages". But, if I'm reading this right, you
> > > do call cma_activate_area(), which will do
> > > init_cma_reserved_pageblock() for each pageblock in it. Which adjusts
> > > the CMA counters for the zone they are in. But your change does not
> > > adjust totalcma_pages for dynamically created areas. That seems
> > > inconsistent, too.
> >
> > I was referring to just totalcma_pages that isn't impacted by these
> > dynamically allocated regions. This is, again, because I don't see why
> > that information would be useful. It's a fairly easy change to update
> > that value, so if people prefer that, I can add that.
> >
> > I don't see an immediate connection between totalcma_pages and
> > init_cma_reserved_pageblock(). I thought the latter was primarily useful
> > for making sure that the CMA pages can be migrated, which is still
> > critical for this use-case.
>
> My comment was about statistics, they would be inconsistent after your
> change. E.g. currently, totalcma_pages is equal to the sum of CMA
> pages in each zone. But that would no longer be true, and applications
> / administrators looking at those statistics might see the
> inconsistency (between meminfo and vmstat) and wonder what's going on.
> It seems best to keep those numbers in sync.
>
> In general, I think it's fine to support dynamic allocation, and I
> agree with your arguments that it doesn't seem right to set the number
> of CMA areas via a config option. I would just like there to be a
> canonical way to find all CMA areas.
Okay, so judging by your and David's feedback, it sounds like I should
add a bit of code to track dynamically allocated areas within a global
list, along with the existing predefined regions and keep totalcma_pages
updated so that the global view is consistent.
I'll look into that. Thanks for the feedback.
Thierry
On Mon, 1 Sep 2025 15:32:22 +0530 Meghana Malladi wrote:
> if (!emac->xdpi.prog && !prog)
> return 0;
>
> - WRITE_ONCE(emac->xdp_prog, prog);
> + if (netif_running(emac->ndev)) {
> + prueth_destroy_txq(emac);
> + prueth_destroy_rxq(emac);
> + }
> +
> + old_prog = xchg(&emac->xdp_prog, prog);
> + if (old_prog)
> + bpf_prog_put(old_prog);
> +
> + if (netif_running(emac->ndev)) {
> + ret = prueth_create_rxq(emac);
shutting the device down and freeing all rx memory for reconfig is not
okay. If the system is low on memory the Rx buffer allocations may fail
and system may drop off the network. You must either pre-allocate or
avoid freeing the memory, and just restart the queues.
> + if (ret) {
> + netdev_err(emac->ndev, "Failed to create RX queue: %d\n", ret);
> + return ret;
> + }
> +
> + ret = prueth_create_txq(emac);
> + if (ret) {
> + netdev_err(emac->ndev, "Failed to create TX queue: %d\n", ret);
> + prueth_destroy_rxq(emac);
> + emac->xdp_prog = NULL;
> + return ret;
> + }
> + }
>
> xdp_attachment_setup(&emac->xdpi, bpf);
On Sat, Aug 30, 2025 at 4:58 PM Barry Song <21cnbao(a)gmail.com> wrote:
>
> From: Barry Song <v-songbaohua(a)oppo.com>
>
> We can allocate high-order pages, but mapping them one by
> one is inefficient. This patch changes the code to map
> as large a chunk as possible. The code looks somewhat
> complicated mainly because supporting mmap with a
> non-zero offset is a bit tricky.
>
> Using the micro-benchmark below, we see that mmap becomes
> 3.5X faster:
...
It's been awhile since I've done mm things, so take it with a pinch of
salt, but this seems reasonable to me.
Though, one thought below...
> diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c
> index bbe7881f1360..4c782fe33fd4 100644
> --- a/drivers/dma-buf/heaps/system_heap.c
> +++ b/drivers/dma-buf/heaps/system_heap.c
> @@ -186,20 +186,35 @@ static int system_heap_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
> struct system_heap_buffer *buffer = dmabuf->priv;
> struct sg_table *table = &buffer->sg_table;
> unsigned long addr = vma->vm_start;
> - struct sg_page_iter piter;
> - int ret;
> + unsigned long pgoff = vma->vm_pgoff;
> + struct scatterlist *sg;
> + int i, ret;
> +
> + for_each_sgtable_sg(table, sg, i) {
> + unsigned long n = sg->length >> PAGE_SHIFT;
>
> - for_each_sgtable_page(table, &piter, vma->vm_pgoff) {
> - struct page *page = sg_page_iter_page(&piter);
> + if (pgoff < n)
> + break;
> + pgoff -= n;
> + }
> +
> + for (; sg && addr < vma->vm_end; sg = sg_next(sg)) {
> + unsigned long n = (sg->length >> PAGE_SHIFT) - pgoff;
> + struct page *page = sg_page(sg) + pgoff;
> + unsigned long size = n << PAGE_SHIFT;
> +
> + if (addr + size > vma->vm_end)
> + size = vma->vm_end - addr;
>
> - ret = remap_pfn_range(vma, addr, page_to_pfn(page), PAGE_SIZE,
> - vma->vm_page_prot);
> + ret = remap_pfn_range(vma, addr, page_to_pfn(page),
> + size, vma->vm_page_prot);
It feels like this sort of mapping loop for higher order pages
wouldn't be a unique pattern to just this code. Would this be better
worked into a helper so it would be more generally usable?
Otherwise,
Acked-by: John Stultz <jstultz(a)google.com>
thanks
-john
>> +>> +struct cma *__init cma_create(phys_addr_t base, phys_addr_t size,
>> + unsigned int order_per_bit, const char *name)
>> +{
>> + struct cma *cma;
>> + int ret;
>> +
>> + ret = cma_check_memory(base, size);
>> + if (ret < 0)
>> + return ERR_PTR(ret);
>> +
>> + cma = kzalloc(sizeof(*cma), GFP_KERNEL);
>> + if (!cma)
>> + return ERR_PTR(-ENOMEM);
>> +
>> + cma_init_area(cma, name, size, order_per_bit);
>> + cma->ranges[0].base_pfn = PFN_DOWN(base);
>> + cma->ranges[0].early_pfn = PFN_DOWN(base);
>> + cma->ranges[0].count = cma->count;
>> + cma->nranges = 1;
>> +
>> + cma_activate_area(cma);
>> +
>> + return cma;
>> +}
>> +
>> +void cma_free(struct cma *cma)
>> +{
>> + kfree(cma);
>> +}
>> --
>> 2.50.0
>
>
> I agree that supporting dynamic CMA areas would be good. However, by
> doing it like this, these CMA areas are invisible to the rest of the
> system. E.g. cma_for_each_area() does not know about them. It seems a
> bit inconsistent that there will now be some areas that are globally
> known, and some that are not.
Yeah, I'm not a fan of that.
What is the big problem we are trying to solve here? Why do they have to
be dynamic, why do they even have to support freeing?
--
Cheers
David / dhildenb