public inbox for op-tee@lists.trustedfirmware.org
 help / color / mirror / Atom feed
From: Sumit Garg via OP-TEE <op-tee@lists.trustedfirmware.org>
To: op-tee@lists.trustedfirmware.org
Cc: vbabka@suse.cz, akpm@linux-foundation.org, willy@infradead.org,
	linux-kernel@vger.kernel.org,
	"Sumit Garg" <sumit.garg@oss.qualcomm.com>,
	"Marco Felsch" <m.felsch@pengutronix.de>,
	"Sven Püschel" <s.pueschel@pengutronix.de>
Subject: [RFT PATCH] tee: shm: Remove refcounting of kernel pages
Date: Fri, 13 Feb 2026 17:03:17 +0530	[thread overview]
Message-ID: <20260213113317.1728769-1-sumit.garg@kernel.org> (raw)

From: Sumit Garg <sumit.garg@oss.qualcomm.com>

Earlier TEE subsystem assumed to refcount all the memory pages to be
shared with TEE implementation to be refcounted. However, the slab
allocations within the kernel don't allow refcounting kernel pages.

It is rather better to trust the kernel clients to not free pages while
being shared with TEE implementation. Hence, remove refcounting of kernel
pages from register_shm_helper() API.

Fixes: b9c0e49abfca ("mm: decline to manipulate the refcount on a slab page")
Reported-by: Marco Felsch <m.felsch@pengutronix.de>
Reported-by: Sven Püschel <s.pueschel@pengutronix.de>
Suggested-by: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
 drivers/tee/tee_shm.c | 29 +----------------------------
 1 file changed, 1 insertion(+), 28 deletions(-)

diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
index 4a47de4bb2e5..54e2ba3afb25 100644
--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -23,29 +23,11 @@ struct tee_shm_dma_mem {
 	struct page *page;
 };
 
-static void shm_put_kernel_pages(struct page **pages, size_t page_count)
-{
-	size_t n;
-
-	for (n = 0; n < page_count; n++)
-		put_page(pages[n]);
-}
-
-static void shm_get_kernel_pages(struct page **pages, size_t page_count)
-{
-	size_t n;
-
-	for (n = 0; n < page_count; n++)
-		get_page(pages[n]);
-}
-
 static void release_registered_pages(struct tee_shm *shm)
 {
 	if (shm->pages) {
 		if (shm->flags & TEE_SHM_USER_MAPPED)
 			unpin_user_pages(shm->pages, shm->num_pages);
-		else
-			shm_put_kernel_pages(shm->pages, shm->num_pages);
 
 		kfree(shm->pages);
 	}
@@ -477,13 +459,6 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
 		goto err_put_shm_pages;
 	}
 
-	/*
-	 * iov_iter_extract_kvec_pages does not get reference on the pages,
-	 * get a reference on them.
-	 */
-	if (iov_iter_is_kvec(iter))
-		shm_get_kernel_pages(shm->pages, num_pages);
-
 	shm->offset = off;
 	shm->size = len;
 	shm->num_pages = num_pages;
@@ -497,10 +472,8 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
 
 	return shm;
 err_put_shm_pages:
-	if (!iov_iter_is_kvec(iter))
+	if (iter_is_uvec(iter))
 		unpin_user_pages(shm->pages, shm->num_pages);
-	else
-		shm_put_kernel_pages(shm->pages, shm->num_pages);
 err_free_shm_pages:
 	kfree(shm->pages);
 err_free_shm:
-- 
2.51.0


             reply	other threads:[~2026-02-13 11:34 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-02-13 11:33 Sumit Garg via OP-TEE [this message]
2026-02-13 16:08 ` [RFT PATCH] tee: shm: Remove refcounting of kernel pages Matthew Wilcox
2026-02-16  6:12   ` Sumit Garg via OP-TEE
2026-02-14 12:32 ` kernel test robot
2026-02-15 17:53 ` kernel test robot
2026-02-17 11:01 ` Sven Püschel
2026-02-23  5:07   ` Sumit Garg via OP-TEE

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260213113317.1728769-1-sumit.garg@kernel.org \
    --to=op-tee@lists.trustedfirmware.org \
    --cc=akpm@linux-foundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=m.felsch@pengutronix.de \
    --cc=s.pueschel@pengutronix.de \
    --cc=sumit.garg@kernel.org \
    --cc=sumit.garg@oss.qualcomm.com \
    --cc=vbabka@suse.cz \
    --cc=willy@infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox