[PATCH v4 0/3] tee: add MbedTEE driver

[Xing Loong]

This series adds a Linux TEE driver for MbedTEE, a Trusted
Execution Environment for embedded systems
(https://github.com/mbedtee).

Two RPC transports are provided for systems where platform
firmware or board configuration has already established the
REE/TEE separation before Linux boots:

  - ARM/ARM64: SMC calls and GIC SPI notifications (TrustZone)
  - RISC-V: shared-memory ring buffers and IMSIC MSI notifications

The driver implements the TEE subsystem interface (tee_driver_ops)
and provides GlobalPlatform TEE Client API support, dynamic shared
memory registration, and tee-supplicant support for REE filesystem
and RPMB operations.

The series is structured as follows:
  [1/3] dt-bindings: vendor-prefixes: add mbedtee
  [2/3] dt-bindings: firmware: add mbedtee,tee binding
  [3/3] tee: add MbedTEE driver

---
Changes in v4:
- 0002: Move reserved-memory region descriptions into
  memory-region-names property (Rob)
- 0002: Define memory-region-names item order at top level; keep
  per-branch name count constraints (maxItems: 2 / minItems: 3) (Rob)
- 0003: Harden ring and RPC handling against malformed input:
  - Validate both ring indices; bound async ring skip and resync
    the reader on corrupt framing
  - Enforce RPC handler modes (COMPLETE_REE async-only, supplicant
    commands sync-only)
  - Reference-count rpc_call objects; fix use-after-free on
    interrupted calls; abort and free leftover calls at teardown
  - Add XA_FLAGS_LOCK_IRQ to the rpc_calls xarray
  - Fix supp_recv/supp_abort_all race; malformed supp_send unblocks
    the worker instead of hanging it
  - Reject TEE-changed parameter attributes
  - Report the wire error on failed supplicant requests; fail
    oversized requests instead of requeueing them forever
  - Wait for R2T ring space with a bounded backoff; bound
    COMPLETE_TEE retries and stop them at teardown
  - Match the supplicant context when dispatching supp_send
  - Access complete_work_pending under ring_lock
  - Serialize RPC submission against shutdown and reject new
    calls once teardown starts
  - Quiesce all RPC activity before tee_device_unregister() so
    parked waiters cannot deadlock teardown
  - Bound non-interruptible RISC-V waits so a hung TEE cannot
    block ioctls forever
  - Track closing state on sessions; reject concurrent
    close/invoke/cancel races
  - Quarantine TEE-owned call objects at release instead of
    risking a cross-world use-after-free
- Link to v3: https://lore.kernel.org/r/20260720073558.799755-1-xing.xl.loong@gmail.com/

Changes in v3:
- 0002: Drop all phandle stub nodes from examples.
- 0002: Remove redundant required: - interrupts from then branch.
- 0002: Simplify title and description.
- Link to v2: https://lore.kernel.org/r/20260702151115.544016-1-xing.xl.loong@gmail.com/
- Link to v1: https://lore.kernel.org/r/20260701132514.186953-1-xing.xl.loong@gmail.com/

Changes in v2:
- 0002: Fix DT binding review comments from Krzysztof Kozlowski:
  - Drop $nodename, "YAML devicetree binding" wording, property descriptions
  - Rename compatible string to mbedtee,tee
  - Rename memory regions: rpc-t2r-ring -> t2r-ring, rpc-t2r-shm -> t2r-shm,
    rpc-r2t-ring -> r2t-ring
  - Add memory-region / memory-region-names to required
  - Simplify allOf constraints (drop redundant else-branch items)
  - Rewrite description to describe hardware/firmware, not the binding or driver
  - Drop all irrelevant platform nodes (gic, cpus, reserved-memory)
  - Add maxItems: 1 constraint to interrupts property (Sashiko AI review)
- 0003:
  - Fix supp_release incorrectly aborting unclaimed requests on close
  - Fix potential tee_shm double-free on supp_recv error path
  - Fix async RPC ring skip leaving orphaned payload bytes
  - Fix COMPLETE_TEE retry to also handle transient -ENOMEM on RISC-V
  - Fix session leak on close_session allocation failure:
    release kernel resources before sending RPC

---
Xing Loong (3):
  dt-bindings: vendor-prefixes: add mbedtee
  dt-bindings: firmware: add mbedtee,tee binding
  tee: add MbedTEE driver

 .../bindings/firmware/mbedtee,tee.yaml        | 102 +++
 .../devicetree/bindings/vendor-prefixes.yaml  |   2 +
 Documentation/tee/index.rst                   |   1 +
 Documentation/tee/mbedtee.rst                 | 155 ++++
 MAINTAINERS                                   |   9 +
 drivers/tee/Kconfig                           |   3 +-
 drivers/tee/Makefile                          |   1 +
 drivers/tee/mbedtee/Kconfig                   |  20 +
 drivers/tee/mbedtee/Makefile                  |  11 +
 drivers/tee/mbedtee/core.c                    | 260 +++++++
 drivers/tee/mbedtee/mbedtee_drv.h             | 289 ++++++++
 drivers/tee/mbedtee/mbedtee_msg.h             | 219 ++++++
 drivers/tee/mbedtee/rpc_callee.c              | 697 ++++++++++++++++++
 drivers/tee/mbedtee/rpc_callee_arm.c          |  91 +++
 drivers/tee/mbedtee/rpc_callee_riscv.c        | 203 +++++
 drivers/tee/mbedtee/rpc_caller.c              | 697 ++++++++++++++++++
 drivers/tee/mbedtee/rpc_caller_arm.c          |  70 ++
 drivers/tee/mbedtee/rpc_caller_riscv.c        | 238 ++++++
 drivers/tee/mbedtee/shm_pool.c                | 105 +++
 drivers/tee/mbedtee/shm_pool.h                |  15 +
 drivers/tee/mbedtee/supp.c                    | 311 ++++++++
 include/uapi/linux/tee.h                      |   1 +
 22 files changed, 3499 insertions(+), 1 deletion(-)
 create mode 100644 Documentation/devicetree/bindings/firmware/mbedtee,tee.yaml
 create mode 100644 Documentation/tee/mbedtee.rst
 create mode 100644 drivers/tee/mbedtee/Kconfig
 create mode 100644 drivers/tee/mbedtee/Makefile
 create mode 100644 drivers/tee/mbedtee/core.c
 create mode 100644 drivers/tee/mbedtee/mbedtee_drv.h
 create mode 100644 drivers/tee/mbedtee/mbedtee_msg.h
 create mode 100644 drivers/tee/mbedtee/rpc_callee.c
 create mode 100644 drivers/tee/mbedtee/rpc_callee_arm.c
 create mode 100644 drivers/tee/mbedtee/rpc_callee_riscv.c
 create mode 100644 drivers/tee/mbedtee/rpc_caller.c
 create mode 100644 drivers/tee/mbedtee/rpc_caller_arm.c
 create mode 100644 drivers/tee/mbedtee/rpc_caller_riscv.c
 create mode 100644 drivers/tee/mbedtee/shm_pool.c
 create mode 100644 drivers/tee/mbedtee/shm_pool.h
 create mode 100644 drivers/tee/mbedtee/supp.c

base-commit: 03e2778d1f11de9260543f969e9e888a1c2bf830
-- 
2.43.0