[PATCH v5 00/12] Trusted Execution Environment (TEE) driver for Qualcomm TEE (QTEE)
Harshal Dev
quic_hdev at quicinc.com
Tue Jul 8 10:02:17 UTC 2025
On 5/27/2025 12:26 PM, Amirreza Zarrabi wrote:
> This patch series introduces a Trusted Execution Environment (TEE)
> driver for Qualcomm TEE (QTEE). QTEE enables Trusted Applications (TAs)
> and services to run securely. It uses an object-based interface, where
> each service is an object with sets of operations. Clients can invoke
> these operations on objects, which can generate results, including other
> objects. For example, an object can load a TA and return another object
> that represents the loaded TA, allowing access to its services.
>
> Kernel and userspace services are also available to QTEE through a
> similar approach. QTEE makes callback requests that are converted into
> object invocations. These objects can represent services within the
> kernel or userspace process.
>
> Note: This patch series focuses on QTEE objects and userspace services.
>
> Linux already provides a TEE subsystem, which is described in [1]. The
> tee subsystem provides a generic ioctl interface, TEE_IOC_INVOKE, which
> can be used by userspace to talk to a TEE backend driver. We extend the
> Linux TEE subsystem to understand object parameters and an ioctl call so
> client can invoke objects in QTEE:
>
> - TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_*
> - TEE_IOC_OBJECT_INVOKE
>
> The existing ioctl calls TEE_IOC_SUPPL_RECV and TEE_IOC_SUPPL_SEND are
> used for invoking services in the userspace process by QTEE.
>
> The TEE backend driver uses the QTEE Transport Message to communicate
> with QTEE. Interactions through the object INVOKE interface are
> translated into QTEE messages. Likewise, object invocations from QTEE
> for userspace objects are converted into SEND/RECV ioctl calls to
> supplicants.
>
> The details of QTEE Transport Message to communicate with QTEE is
> available in [PATCH 12/12] Documentation: tee: Add Qualcomm TEE driver.
>
> You can run basic tests with following steps:
> git clone https://github.com/quic/quic-teec.git
> cd quic-teec
> mkdir build
> cmake .. -DCMAKE_TOOLCHAIN_FILE=CMakeToolchain.txt -DBUILD_UNITTEST=ON
>
> https://github.com/quic/quic-teec/blob/main/README.md lists dependencies
> needed to build the above.
>
> This series has been tested for basic QTEE object invocations and
> callback requests, including loading a TA and requesting services form
> the TA.
>
> Tested platforms: sm8650-mtp, sm8550-qrd, sm8650-qrd, sm8650-hdk
>
> [1] https://www.kernel.org/doc/Documentation/tee.txt
>
> Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi at oss.qualcomm.com>
>
> Changes in v5:
> - Remove references to kernel services and public APIs.
> - Support auto detection for failing devices (e.g., RB1, RB4).
> - Add helpers for obtaining client environment and service objects.
> - Query the QTEE version and print it.
> - Move remaining static variables, including the object table, to struct
> qcomtee.
> - Update TEE_MAX_ARG_SIZE to 4096.
> - Add a dependancy to QCOM_TZMEM_MODE_SHMBRIDGE in Kconfig
> - Reorganize code by removing release.c and qcom_scm.c.
> - Add more error messages and improve comments.
> - updated Tested-by:, Acked-by:, and Reviewed-by: tags
> - Link to v4: https://lore.kernel.org/r/20250428-qcom-tee-using-tee-ss-without-mem-obj-v4-0-6a143640a6cb@oss.qualcomm.com
>
> Changes in v4:
> - Move teedev_ctx_get/put and tee_device_get/put to tee_core.h.
> - Rename object to id in struct tee_ioctl_object_invoke_arg.
> - Replace spinlock with mutex for qtee_objects_idr.
> - Move qcomtee_object_get to qcomtee_user/memobj_param_to_object.
> - More code cleanup following the comments.
> - Cleanup documentations.
> - Update MAINTAINERS file.
> - Link to v3: https://lore.kernel.org/r/20250327-qcom-tee-using-tee-ss-without-mem-obj-v3-0-7f457073282d@oss.qualcomm.com
>
> Changes in v3:
> - Export shm_bridge create/delete APIs.
> - Enable support for QTEE memory objects.
> - Update the memory management code to use the TEE subsystem for all
> allocations using the pool.
> - Move all driver states into the driver's main service struct.
> - Add more documentations.
> - Link to v2: https://lore.kernel.org/r/20250202-qcom-tee-using-tee-ss-without-mem-obj-v2-0-297eacd0d34f@quicinc.com
>
> Changes in v2:
> - Clean up commit messages and comments.
> - Use better names such as ubuf instead of membuf or QCOMTEE prefix
> instead of QCOM_TEE, or names that are more consistent with other
> TEE-backend drivers such as qcomtee_context_data instead of
> qcom_tee_context.
> - Drop the DTS patch and instantiate the device from the scm driver.
> - Use a single structure for all driver's internal states.
> - Drop srcu primitives and use the existing mutex for synchronization
> between the supplicant and QTEE.
> - Directly use tee_context to track the lifetime of qcomtee_context_data.
> - Add close_context() to be called when the user closes the tee_context.
> - Link to v1: https://lore.kernel.org/r/20241202-qcom-tee-using-tee-ss-without-mem-obj-v1-0-f502ef01e016@quicinc.com
>
> Changes in v1:
> - It is a complete rewrite to utilize the TEE subsystem.
> - Link to RFC: https://lore.kernel.org/all/20240702-qcom-tee-object-and-ioctls-v1-0-633c3ddf57ee@quicinc.com
>
> ---
> Amirreza Zarrabi (12):
> tee: allow a driver to allocate a tee_device without a pool
> tee: add close_context to TEE driver operation
> tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF
> tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF
> tee: increase TEE_MAX_ARG_SIZE to 4096
> firmware: qcom: scm: add support for object invocation
> firmware: qcom: scm: remove unused arguments to the shm_brige
> firmware: qcom: tzmem: export shm_bridge create/delete
> tee: add Qualcomm TEE driver
> qcomtee: add primordial object
> qcomtee: enable TEE_IOC_SHM_ALLOC ioctl
> Documentation: tee: Add Qualcomm TEE driver
>
> Documentation/tee/index.rst | 1 +
> Documentation/tee/qtee.rst | 150 +++++
> MAINTAINERS | 8 +
> drivers/firmware/qcom/qcom_scm.c | 132 ++++-
> drivers/firmware/qcom/qcom_scm.h | 7 +
> drivers/firmware/qcom/qcom_tzmem.c | 57 +-
> drivers/tee/Kconfig | 1 +
> drivers/tee/Makefile | 1 +
> drivers/tee/qcomtee/Kconfig | 11 +
> drivers/tee/qcomtee/Makefile | 9 +
> drivers/tee/qcomtee/async.c | 183 ++++++
> drivers/tee/qcomtee/call.c | 833 +++++++++++++++++++++++++++
> drivers/tee/qcomtee/core.c | 930 +++++++++++++++++++++++++++++++
> drivers/tee/qcomtee/mem_obj.c | 172 ++++++
> drivers/tee/qcomtee/primordial_obj.c | 116 ++++
> drivers/tee/qcomtee/qcomtee.h | 266 +++++++++
> drivers/tee/qcomtee/qcomtee_msg.h | 251 +++++++++
> drivers/tee/qcomtee/qcomtee_object.h | 309 ++++++++++
> drivers/tee/qcomtee/shm.c | 150 +++++
> drivers/tee/qcomtee/user_obj.c | 694 +++++++++++++++++++++++
> drivers/tee/tee_core.c | 127 ++++-
> drivers/tee/tee_private.h | 6 -
> include/linux/firmware/qcom/qcom_scm.h | 10 +-
> include/linux/firmware/qcom/qcom_tzmem.h | 15 +
> include/linux/tee_core.h | 54 +-
> include/linux/tee_drv.h | 12 +
> include/uapi/linux/tee.h | 56 +-
> 27 files changed, 4528 insertions(+), 33 deletions(-)
> ---
> base-commit: 3be1a7a31fbda82f3604b6c31e4f390110de1b46
> change-id: 20241202-qcom-tee-using-tee-ss-without-mem-obj-362c66340527
>
> Best regards,
Tested-by: Harshal Dev <quic_hdev at quicinc.com> # on SM8650-MTP
root at qcom-armv8a:~# qtee_supplicant &
root at qcom-armv8a:~# qtee_supplicant: process entry PPID = 378
Total listener services to start = 4
Opening CRequestTABuffer_open
Path /data/
register_service ::Opening CRegisterTABufCBO_UID
Calling TAbufCBO Register
QTEE_SUPPLICANT RUNNING
root at qcom-armv8a:~# smcinvoke_client -c /data 1
Run callback obj test...
Load /data/tzecotestapp.mbn, size 52192, buf 0x1e44ba0.
System Time: 2024-02-27 17:26:31
PASSED - Callback tests with Buffer inputs.
PASSED - Callback tests with Remote and Callback object inputs.
PASSED - Callback tests with Memory Object inputs.
TEST PASSED!
root at qcom-armv8a:~#
root at qcom-armv8a:~# smcinvoke_client -m /data 1
Run memory obj test...
Load /data/tzecotestapp.mbn, size 52192, buf 0x26cafba0.
System Time: 2024-02-27 17:26:39
PASSED - Single Memory Object access Test.
PASSED - Two Memory Object access Test.
TEST PASSED!
root at qcom-armv8a:~#
Tested using smcinvoke_client hosted at www.github.com/qualcomm/minkipc.
The build instructions are available in the README.md file.
These test cases exchange callback and memory objects with QTEE over a Mink
Object-IPC protocol and then validate their invocation by QTEE.
Before starting the test, the tzecotestapp Trusted Application calls into
the time listener hosted by the qtee_supplicant daemon to print the system
time, which also validates qtee_supplicant's transport path through the QCOMTEE
driver.
Regards,
Harshal
More information about the dri-devel
mailing list