[PATCH 1/1] tee: amdtee: store buffer ID in tee_shm->sec_world_id

From: Rijo Thomas

Date: Fri Mar 27 2026 - 05:29:50 EST


Drop struct amdtee_shm_data and the per-context shm_list. In
handle_map_shmem() save the returned buf_id in shm->sec_world_id
instead of allocating a list node. Use shm->sec_world_id (with
get_buffer_id() removed) in amdtee_unmap_shmem() and in call.c when
building memref params. Remove shm_list and shm_mutex from
amdtee_context_data.

Aligns amdtee with other TEE drivers (optee, tstee, qcomtee) that use
tee_shm->sec_world_id for the secure-world handle.

Signed-off-by: Rijo Thomas <Rijo-john.Thomas@xxxxxxx>
---
drivers/tee/amdtee/amdtee_private.h | 16 ---------
drivers/tee/amdtee/call.c | 2 +-
drivers/tee/amdtee/core.c | 52 +++--------------------------
3 files changed, 5 insertions(+), 65 deletions(-)

diff --git a/drivers/tee/amdtee/amdtee_private.h b/drivers/tee/amdtee/amdtee_private.h
index d87050033894..2c5ba02258b8 100644
--- a/drivers/tee/amdtee/amdtee_private.h
+++ b/drivers/tee/amdtee/amdtee_private.h
@@ -65,13 +65,9 @@ struct amdtee_session {
/**
* struct amdtee_context_data - AMD-TEE driver context data
* @sess_list: Keeps track of sessions opened in current TEE context
- * @shm_list: Keeps track of buffers allocated and mapped in current TEE
- * context
*/
struct amdtee_context_data {
struct list_head sess_list;
- struct list_head shm_list;
- struct mutex shm_mutex; /* synchronizes access to @shm_list */
};

struct amdtee_driver_data {
@@ -83,17 +79,6 @@ struct shmem_desc {
u64 size;
};

-/**
- * struct amdtee_shm_data - Shared memory data
- * @kaddr: Kernel virtual address of shared memory
- * @buf_id: Buffer id of memory mapped by TEE_CMD_ID_MAP_SHARED_MEM
- */
-struct amdtee_shm_data {
- struct list_head shm_node;
- void *kaddr;
- u32 buf_id;
-};
-
/**
* struct amdtee_ta_data - Keeps track of all TAs loaded in AMD Secure
* Processor
@@ -168,5 +153,4 @@ int handle_invoke_cmd(struct tee_ioctl_invoke_arg *arg, u32 sinfo,

struct tee_shm_pool *amdtee_config_shm(void);

-u32 get_buffer_id(struct tee_shm *shm);
#endif /*AMDTEE_PRIVATE_H*/
diff --git a/drivers/tee/amdtee/call.c b/drivers/tee/amdtee/call.c
index 441b2ceaafc3..23ccd0f037a7 100644
--- a/drivers/tee/amdtee/call.c
+++ b/drivers/tee/amdtee/call.c
@@ -45,7 +45,7 @@ static int tee_params_to_amd_params(struct tee_param *tee, u32 count,

/* It is assumed that all values are within 2^32-1 */
if (type > TEE_OP_PARAM_TYPE_VALUE_INOUT) {
- u32 buf_id = get_buffer_id(tee[i].u.memref.shm);
+ u32 buf_id = (u32)tee[i].u.memref.shm->sec_world_id;

amd->params[i].mref.buf_id = buf_id;
amd->params[i].mref.offset = tee[i].u.memref.shm_offs;
diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c
index a1347d04b3ac..0e56f4cf2697 100644
--- a/drivers/tee/amdtee/core.c
+++ b/drivers/tee/amdtee/core.c
@@ -43,8 +43,6 @@ static int amdtee_open(struct tee_context *ctx)
return -ENOMEM;

INIT_LIST_HEAD(&ctxdata->sess_list);
- INIT_LIST_HEAD(&ctxdata->shm_list);
- mutex_init(&ctxdata->shm_mutex);

ctx->data = ctxdata;
return 0;
@@ -87,7 +85,6 @@ static void amdtee_release(struct tee_context *ctx)
list_del(&sess->list_node);
release_session(sess);
}
- mutex_destroy(&ctxdata->shm_mutex);
kfree(ctxdata);

ctx->data = NULL;
@@ -152,23 +149,6 @@ static struct amdtee_session *find_session(struct amdtee_context_data *ctxdata,
return NULL;
}

-u32 get_buffer_id(struct tee_shm *shm)
-{
- struct amdtee_context_data *ctxdata = shm->ctx->data;
- struct amdtee_shm_data *shmdata;
- u32 buf_id = 0;
-
- mutex_lock(&ctxdata->shm_mutex);
- list_for_each_entry(shmdata, &ctxdata->shm_list, shm_node)
- if (shmdata->kaddr == shm->kaddr) {
- buf_id = shmdata->buf_id;
- break;
- }
- mutex_unlock(&ctxdata->shm_mutex);
-
- return buf_id;
-}
-
static DEFINE_MUTEX(drv_mutex);
static int copy_ta_binary(struct tee_context *ctx, void *ptr, void **ta,
size_t *ta_size)
@@ -342,8 +322,6 @@ int amdtee_close_session(struct tee_context *ctx, u32 session)

int amdtee_map_shmem(struct tee_shm *shm)
{
- struct amdtee_context_data *ctxdata;
- struct amdtee_shm_data *shmnode;
struct shmem_desc shmem;
int rc, count;
u32 buf_id;
@@ -351,10 +329,6 @@ int amdtee_map_shmem(struct tee_shm *shm)
if (!shm)
return -EINVAL;

- shmnode = kmalloc_obj(*shmnode);
- if (!shmnode)
- return -ENOMEM;
-
count = 1;
shmem.kaddr = shm->kaddr;
shmem.size = shm->size;
@@ -366,44 +340,26 @@ int amdtee_map_shmem(struct tee_shm *shm)
rc = handle_map_shmem(count, &shmem, &buf_id);
if (rc) {
pr_err("map_shmem failed: ret = %d\n", rc);
- kfree(shmnode);
return rc;
}

- shmnode->kaddr = shm->kaddr;
- shmnode->buf_id = buf_id;
- ctxdata = shm->ctx->data;
- mutex_lock(&ctxdata->shm_mutex);
- list_add(&shmnode->shm_node, &ctxdata->shm_list);
- mutex_unlock(&ctxdata->shm_mutex);
+ shm->sec_world_id = buf_id;

- pr_debug("buf_id :[%x] kaddr[%p]\n", shmnode->buf_id, shmnode->kaddr);
+ pr_debug("buf_id :[%x] kaddr[%p]\n", buf_id, shm->kaddr);

return 0;
}

void amdtee_unmap_shmem(struct tee_shm *shm)
{
- struct amdtee_context_data *ctxdata;
- struct amdtee_shm_data *shmnode;
u32 buf_id;

if (!shm)
return;

- buf_id = get_buffer_id(shm);
- /* Unmap the shared memory from TEE */
+ buf_id = (u32)shm->sec_world_id;
handle_unmap_shmem(buf_id);
-
- ctxdata = shm->ctx->data;
- mutex_lock(&ctxdata->shm_mutex);
- list_for_each_entry(shmnode, &ctxdata->shm_list, shm_node)
- if (buf_id == shmnode->buf_id) {
- list_del(&shmnode->shm_node);
- kfree(shmnode);
- break;
- }
- mutex_unlock(&ctxdata->shm_mutex);
+ shm->sec_world_id = 0;
}

int amdtee_invoke_func(struct tee_context *ctx,
--
2.43.0