[PATCH v2] tee: optee: allow enabling the driver on RISC-V

From: marouene . boubakri

Date: Mon Sep 14 2026 - 21:54:41 EST


From: Marouene Boubakri <marouene.boubakri@xxxxxxxxxxx>

The TEE subsystem and the OP-TEE driver depend on HAVE_ARM_SMCCC, so
neither can be enabled on RISC-V, where OP-TEE is reached through the
RISC-V Platform Management Interface (RPMI) over an SBI Message Proxy
(MPXY) channel instead of the SMC Calling Convention.

Now that the Arm-specific code of the driver is only built on Arm and
the driver has an RPMI ABI, let TEE and OPTEE be enabled when the SBI
MPXY mailbox driver is.

optee_check_mem_type() only lets normal cacheable memory be registered
with OP-TEE, since OP-TEE maps registered pages as such and must not
observe mismatched memory attributes, and it only knows the Arm page
attributes. On RISC-V the memory type of a mapping is encoded in the
Svpbmt bits of the PTE (or their T-Head equivalent selected at runtime
by the _PAGE_MTMASK alternative): normal cacheable memory (PMA) has them
cleared, pgprot_writecombine() and pgprot_noncached() set them. Without
Svpbmt the memory type is defined by the PMAs alone, _PAGE_MTMASK is
empty and every mapping passes the check, as there is nothing else to
inspect.

Signed-off-by: Marouene Boubakri <marouene.boubakri@xxxxxxxxxxx>
---
drivers/tee/Kconfig | 2 +-
drivers/tee/optee/Kconfig | 2 +-
drivers/tee/optee/call.c | 8 ++++++++
3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/tee/Kconfig b/drivers/tee/Kconfig
index 98c3ad083940..6434204d899e 100644
--- a/drivers/tee/Kconfig
+++ b/drivers/tee/Kconfig
@@ -2,7 +2,7 @@
# Generic Trusted Execution Environment Configuration
menuconfig TEE
tristate "Trusted Execution Environment support"
- depends on HAVE_ARM_SMCCC || COMPILE_TEST || CPU_SUP_AMD
+ depends on HAVE_ARM_SMCCC || COMPILE_TEST || CPU_SUP_AMD || RISCV_SBI_MPXY_MBOX
select CRYPTO_LIB_SHA1
select DMA_SHARED_BUFFER
select GENERIC_ALLOCATOR
diff --git a/drivers/tee/optee/Kconfig b/drivers/tee/optee/Kconfig
index 0eaedb34673d..8998b64df5c7 100644
--- a/drivers/tee/optee/Kconfig
+++ b/drivers/tee/optee/Kconfig
@@ -2,7 +2,7 @@
# OP-TEE Trusted Execution Environment Configuration
config OPTEE
tristate "OP-TEE"
- depends on HAVE_ARM_SMCCC
+ depends on HAVE_ARM_SMCCC || RISCV_SBI_MPXY_MBOX
depends on MMU
depends on RPMB || !RPMB
help
diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
index e046aff61828..c29bff224848 100644
--- a/drivers/tee/optee/call.c
+++ b/drivers/tee/optee/call.c
@@ -604,6 +604,14 @@ static bool is_normal_memory(pgprot_t p)
#elif defined(CONFIG_ARM64)
return ((pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL)) ||
((pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL_TAGGED));
+#elif defined(CONFIG_RISCV)
+ /*
+ * Svpbmt, or the T-Head equivalent, encodes non-cacheable and I/O
+ * memory in the memory type bits of the PTE, normal cacheable memory
+ * (PMA) has them cleared. Without Svpbmt the memory type only comes
+ * from the PMAs, the mask is empty and all mappings pass the check.
+ */
+ return !(pgprot_val(p) & _PAGE_MTMASK);
#else
#error "Unsupported architecture"
#endif
--
2.34.1