Re: [RFC PATCH v1 5/6] dt-bindings: firmware: add OP-TEE over the RISC-V RPMI TEE service group

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Local interrupts are disabled for an unbounded duration during OP-TEE calls, breaking preemption and causing lockups.
--

commit c55e76cf03e17b2745cdf1b4ab9a24f5373ec194
Author: Marouene Boubakri <marouene.boubakri@oss.nxp.com>

    dt-bindings: firmware: add OP-TEE over the RISC-V RPMI TEE service group

This commit introduces a new device tree binding for OP-TEE on RISC-V
platforms. It enables OP-TEE to run as a supervisor domain isolated by M-mode
firmware, using the RPMI TEE service group over an SBI MPXY channel.

> diff --git a/Documentation/devicetree/bindings/firmware/linaro,optee-rpmi.yaml b/Documentation/devicetree/bindings/firmware/linaro,optee-rpmi.yaml
> new file mode 100644
> index 0000000000000..1c3dffc331ff9
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/firmware/linaro,optee-rpmi.yaml
> @@ -0,0 +1,79 @@

[ ... ]

> +description: |
> +  OP-TEE is a piece of software using hardware features to provide a Trusted
> +  Execution Environment. On RISC-V, OP-TEE runs as a supervisor domain
> +  isolated from the Rich Execution Environment (REE) by the M-mode firmware.
> +
> +  The REE reaches OP-TEE through the TEE service group of the RISC-V Platform
> +  Management Interface (RPMI) [1], carried on a channel of the SBI Message
> +  Proxy (MPXY) extension [2]. Each call into OP-TEE is a TEE_CALL service

[Severity: High]
This binding relies on the SBI MPXY mailbox channel, but does the underlying
implementation cause issues with preemption?

Looking at riscv_sbi_mpxy_mbox_call() in
drivers/mailbox/riscv-sbi-mpxy-mbox.c, local interrupts are disabled for
an unbounded duration during OP-TEE calls:

drivers/mailbox/riscv-sbi-mpxy-mbox.c:riscv_sbi_mpxy_mbox_call() {
	...
	local_irq_save(flags);
	mpxy_mbox_send_rpmi_data(mchan, msg);
	local_irq_restore(flags);
	...
}

Will this cause hard lockups or RCU stalls?

Since mpxy_mbox_send_rpmi_data() issues an unbounded sbi_ecall to OP-TEE
while interrupts are masked, this seems to break OP-TEE's preemption model
(RPC_INTR).

Hardware interrupts cannot be taken by the calling CPU, so OP-TEE cannot
yield correctly to the host OS on foreign interrupts.

Since any OP-TEE invocation (e.g., from unprivileged userspace via the
/dev/tee* nodes) routes through optee_rpmi_invoke_fn() which calls
riscv_sbi_mpxy_mbox_call(), could this create a reliable local
denial-of-service vulnerability?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910012057.106966-1-marouene.boubakri@oss.nxp.com?part=5