On 8/13/2025 7:53 PM, Konrad Dybcio wrote:
On 8/13/25 2:35 AM, Amirreza Zarrabi wrote:
Qualcomm TEE (QTEE) hosts Trusted Applications (TAs) and services in the secure world, accessed via objects. A QTEE client can invoke these objects to request services. Similarly, QTEE can request services from the nonsecure world using objects exported to the secure world.
Add low-level primitives to facilitate the invocation of objects hosted in QTEE, as well as those hosted in the nonsecure world.
If support for object invocation is available, the qcom_scm allocates a dedicated child platform device. The driver for this device communicates with QTEE using low-level primitives.
Tested-by: Neil Armstrong neil.armstrong@linaro.org Tested-by: Harshal Dev quic_hdev@quicinc.com Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
[...]
+int qcom_scm_qtee_invoke_smc(phys_addr_t inbuf, size_t inbuf_size,
phys_addr_t outbuf, size_t outbuf_size,u64 *result, u64 *response_type)+{
- struct qcom_scm_desc desc = {
.svc = QCOM_SCM_SVC_SMCINVOKE,.cmd = QCOM_SCM_SMCINVOKE_INVOKE,.owner = ARM_SMCCC_OWNER_TRUSTED_OS,.args[0] = inbuf,.args[1] = inbuf_size,.args[2] = outbuf,.args[3] = outbuf_size,.arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_RW, QCOM_SCM_VAL,QCOM_SCM_RW, QCOM_SCM_VAL),- };
- struct qcom_scm_res res;
- int ret;
- ret = qcom_scm_call(__scm->dev, &desc, &res);
- if (ret)
return ret;- *response_type = res.result[0];
- *result = res.result[1];
These are dereferenced without checking, which will surely upset static checkers (and users)
There is no consistency in qcom_scm.c; I see multiple instances where similar dereferencing is already happening in this file. However, I'll add the if (...) check to be sure. The reason I initially skipped it is that this API has a single user -- the TEE subsystem.
I see that res.result[2] should also return some (aptly named) "data" which you handled in v1, but dropped in v2 (without a comment AFAICT)
Looking at it, we could probably wrap it in qcom_scm_qseecom_call() which this seems to be fit for
I cannot use qcom_scm_qseecom_call() because this is not a qseecom transport. It's a new transport called smcinvoke, which, for instance, does not require a lock.
The data field is intended for qseecom over smcinvoke, which we will never support -- so there's no reason to return it.
- return 0;
+} +EXPORT_SYMBOL(qcom_scm_qtee_invoke_smc);
+/**
- qcom_scm_qtee_callback_response() - Submit response for callback request.
- @buf: start address of memory area used for outbound buffer.
- @buf_size: size of the memory area used for outbound buffer.
- @result: Result of QTEE object invocation.
- @response_type: Response type returned by QTEE.
- @response_type determines how the contents of @buf should be processed.
- Return: On success, return 0 or <0 on failure.
- */
+int qcom_scm_qtee_callback_response(phys_addr_t buf, size_t buf_size,
u64 *result, u64 *response_type)These should be aligned
Ack.
+{
- struct qcom_scm_desc desc = {
.svc = QCOM_SCM_SVC_SMCINVOKE,.cmd = QCOM_SCM_SMCINVOKE_CB_RSP,.owner = ARM_SMCCC_OWNER_TRUSTED_OS,.args[0] = buf,.args[1] = buf_size,.arginfo = QCOM_SCM_ARGS(2, QCOM_SCM_RW, QCOM_SCM_VAL),- };
- struct qcom_scm_res res;
- int ret;
- ret = qcom_scm_call(__scm->dev, &desc, &res);
- if (ret)
return ret;- *response_type = res.result[0];
- *result = res.result[1];
this also seems like a good candidate for qcom_scm_qseecom_call()
ditto.
[...]
/**
- qcom_scm_is_available() - Checks if SCM is available
*/ @@ -2326,6 +2444,16 @@ static int qcom_scm_probe(struct platform_device *pdev) ret = qcom_scm_qseecom_init(scm); WARN(ret < 0, "failed to initialize qseecom: %d\n", ret);
- /*
* Initialize the QTEE object interface.** This only represents the availability for QTEE object invocation* and callback support. On failure, ignore the result. Any subsystem* depending on it may fail if it tries to access this interface.*/- ret = qcom_scm_qtee_init(scm);
- WARN(ret < 0, "failed to initialize qcomtee: %d\n", ret);
This will throw a WARN on *a lot* of platforms, ranging from Chromebooks running TF-A (with a reduced SMC handler), through platforms requiring QCOM_SCM_SMCINVOKE_INVOKE_LEGACY (0x00) cmd
Are you suggesting I remove the WARN? If so, how should the user be notified? Should the error simply be ignored?
Konrad
Thanks, Amir