Hi, On Mon, Oct 12, 2026 at 9:56 PM Igor Opaniuk <[email protected]> wrote: > > When U-Boot serves OP-TEE's RPMB requests itself (CONFIG_SUPPORT_EMMC_RPMB, > drivers/tee/optee/rpmb.c), two problems show up as soon as a TA uses RPMB > secure storage while other code is using the same eMMC. Both were found > running the OP-TEE AVB TA from the Android bootmeth on QEMU virt with > QEMU's eMMC/RPMB model, but neither is specific to QEMU. > > The first patch makes the supplicant select the RPMB hardware partition > around every data request and restore the previously selected partition > afterwards. It used to switch to RPMB on first use and switch back only > when the OP-TEE session was released, so between two RPMB requests other > users of the device (libavb reading partitions, the bootmeth loading > boot images) switched the eMMC back to the user area, and the next RPMB > frames were routed to whatever partition was selected at the time, > ending in status timeouts and I/O errors. > > The second patch stops optee_rpmb_available() from announcing the RPMB > device while a supplicant RPC is being serviced. When the first eMMC > initialisation is triggered by an RPMB request, OP-TEE is blocked in that > RPC holding its RPMB mutex; the announcement opens a nested session and > OP-TEE's second thread spins on the mutex forever, since U-Boot has no > notification support to put it to sleep. > > Tested on QEMU virt (qemu_arm64_defconfig + OP-TEE, eMMC on sdhci-pci > with an RPMB partition) with OP-TEE 4.11.0-rc1: the AVB TA reads and > writes rollback indexes and the lock state while libavb verifies a > vbmeta chain, and a TA call that is the first eMMC access after reset > no longer hangs. > > Signed-off-by: Igor Opaniuk <[email protected]> > --- > Changes in v2: > - track the supplicant request inside optee_suppl_cmd() instead of > handle_rpc(), and use a local variable for the private data in > optee_rpmb_available() (Jan Kiszka) > - explain in the commit message of patch 2 how the hang is triggered, > which TAs reproduce it, and why Linux does not need the check > - Link to v1: > https://patch.msgid.link/20261011-upstream-optee_rpmb_b4-v1-0-7c63edca4...@oss.qualcomm.com > > --- > Igor Opaniuk (2): > optee: rpmb: select the RPMB partition per request > optee: do not announce RPMB from within a supplicant RPC > > drivers/tee/optee/optee_private.h | 2 ++ > drivers/tee/optee/rpmb.c | 72 > ++++++++++++++++++++++++++++----------- > drivers/tee/optee/supplicant.c | 4 +++ > 3 files changed, 58 insertions(+), 20 deletions(-) > --- > base-commit: ed869863c7e2aca50d57a05d843830dd843138c4 > change-id: 20261011-upstream-optee_rpmb_b4-ff86a4ea9039 > > Best regards, > -- > Igor Opaniuk <[email protected]> >
Gentle ping on this patch series. Please let me know if anyone has any feedback or objections.
