On Wed, Sep 02, 2026 at 12:38:26PM -0500, Rob Herring wrote:
On Wed, Sep 02, 2026 at 11:47:11AM +0100, Vincent Donnefort wrote:
When memory is lent to the Secure world via FF-A, fatal CPU speculative reads from Non-Secure can still occur as long as it retains a cacheable mapping to that memory. Introduce the "arm,ffa-lend-pool" reserved-memory CMA driver to unmap pages before lending (ffa_prepare_lend()) and restore them upon reclaim (ffa_lend_reclaimed()). Devices bind to the pool via the "memory-region" DT property or via ffa_lend_pool_attach().
reserved-memory { #address-cells = <0x2>; #size-cells = <0x2>; ranges;
ffa_lend: ffa-lend-pool { compatible = "arm,ffa-lend-pool";Needs a binding schema...
Ack
reusable; ll-map; size = <0x0 0x4000000>; };};
Signed-off-by: Vincent Donnefort vdonnefort@google.com
[...]
+static int __init ffa_lend_pool_setup(unsigned long node, struct reserved_mem *rmem) +{
- struct cma *cma;
- int ret;
- if (!of_get_flat_dt_prop(node, "reusable", NULL) ||
of_get_flat_dt_prop(node, "no-map", NULL)) {pr_err("FF-A lend pool: node must be 'reusable' and not 'no-map'\n");return -EINVAL;Your schema should enforce/check this.
[...]
+static const struct reserved_mem_ops ffa_lend_pool_ops = {
- .node_init = ffa_lend_pool_setup,
- .device_init = ffa_lend_pool_device_init,
- .device_release = ffa_lend_pool_device_release,
+}; +RESERVEDMEM_OF_DECLARE(ffa_lend_pool, "arm,ffa-lend-pool", &ffa_lend_pool_ops);
Do you need this early? If not, you can create a platform driver for "arm,ffa-lend-pool". ramoops is implemented that way for example.
Rob
Only memblock_mark_llmap() must be called very early.
The rest just need to be in place before the TEE driver probed. So a platform driver should work.
Thanks!