- OP-TEE - lists.trustedfirmware.org

[PATCH RFC v3 0/9] tee: optee: add RPMI backend support on RISC-V

by Amirreza Zarrabi

This series adds an RPMI backend to the OP-TEE driver for RISC-V. It builds on the separately posted RPMI TEE transport series [1], which provides service discovery, synchronous calls, memory parcels and asynchronous signals. This revision is effectively a full rewrite of the original RFC. The generic RPMI transport has been separated from the OP-TEE backend, and the backend has been reworked around the service bus and a new OP-TEE control ABI. Unlike v1, the OP-TEE backend no longer manages SBI MPXY mailbox channels or implements RPMI TEE service-group operations directly. It binds to the OP-TEE service UUID on the RPMI TEE bus and uses the transport's public operations. No additional OP-TEE device-tree node is required. The backend reuses the common OP-TEE session, shared-memory, argument cache, call queue and RPC infrastructure. Shared memory is represented by RPMI parcel IDs and nonces. Yielding calls pass command and RPC buffer ranges within a parcel and resume suspended execution using an opaque token returned by OP-TEE. The OP-TEE control ABI uses fixed-width little-endian messages carried in TEE_CALL payloads rather than reproducing FF-A's register-based message layout. Asynchronous notifications use an allocated TEE-to-REE signal as a bottom-half doorbell, while ordinary logical notifications continue through the common RPC path. Matching OP-TEE OS support has been implemented locally. OpenSBI integration and end-to-end validation remain pending. This remains an RFC for review of the backend integration and Linux-to-OP-TEE protocol. This series depends on: - The RPMI TEE transport series [1]. - The OP-TEE notification bitmap fix, which allocates space for the inclusive maximum notification key [2]. [1] https://lore.kernel.org/op-tee/20261007-riscv-rpmi-tee-abi-v2-0-45939a13d22… [2] https://lore.kernel.org/op-tee/20261009-fix-tee-max-keys-v1-1-1462d96bf438@… Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> --- Changes in v3: - Use GlobalPlatform TEE result codes for OP-TEE control responses, keeping them separate from RPMI transport errors. - Combine the parcel ID and nonce into a single 64-bit global_id. - Make resume tokens opaque 32-bit values and track initial versus resumed calls separately. - Remove unnecessary __packed annotations from the OP-TEE ABI structures. - Share the global-ID-to-SHM mapping implementation between the FF-A and RPMI backends. - Replace the fixed SHM nonce with a per-instance IDA allocator; reuse nonces after successful reclamation. - Report the maximum notification key instead of a notification count, and use the negotiated maximum during initialization. - Consume capability-exchange results during probe. - Remove cleanup macros and use explicit resource-management paths. - Use rc consistently for Linux error returns. - Replace unnecessary unaligned accesses with endian conversions for naturally aligned ABI fields. - Link to v2: https://lore.kernel.org/r/20261005-rpmi-tee-service-grp-dev-v2-0-72f222e23e… Changes in v2: - Effectively rewrite the backend around the separately posted RPMI TEE transport and a new OP-TEE control ABI. - Remove backend-owned per-hart mailbox channels and the OP-TEE-specific device-tree binding. - Replace the register-like control payload with fixed-width messages, explicit command/RPC buffer ranges and opaque resume tokens. - Add a parcel-reference parameter layout carrying the parcel ID, nonce, and 64-bit offset and size without changing parameter size. - Make argument-offset support part of the baseline ABI and retain the common shared argument cache. - Use a transport-allocated signal for asynchronous bottom-half notifications. - Link to v1: https://lore.kernel.org/r/20260912-rpmi-tee-service-grp-dev-v1-0-1d1d35c2a8… --- Amirreza Zarrabi (9): tee: optee: share the global shared-memory ID mapping tee: optee: allow RPMI transport builds on RISC-V tee: optee: define the RPMI control and parcel-reference ABI tee: optee: add RPMI shared-memory and parameter support tee: optee: add RPMI dynamic shared-memory pool tee: optee: add RPMI RPC handling tee: optee: execute yielding RPMI calls tee: optee: bind RPMI services and negotiate backend capabilities tee: optee: support RPMI asynchronous notification doorbells drivers/tee/Kconfig | 3 +- drivers/tee/optee/Kconfig | 3 +- drivers/tee/optee/Makefile | 2 + drivers/tee/optee/call.c | 2 + drivers/tee/optee/core.c | 10 +- drivers/tee/optee/ffa_abi.c | 133 +---- drivers/tee/optee/optee_msg.h | 23 +- drivers/tee/optee/optee_private.h | 73 ++- drivers/tee/optee/optee_rpmi.h | 263 ++++++++++ drivers/tee/optee/rpmi_abi.c | 972 +++++++++++++++++++++++++++++++++++++ drivers/tee/optee/shm_handle_map.c | 138 ++++++ 11 files changed, 1498 insertions(+), 124 deletions(-) --- base-commit: bf1ee2bd5c2da8992f33c8950ef194aaff74ed6c change-id: 20260912-rpmi-tee-service-grp-dev-b2ce2f63e0df Best regards, -- Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com>

1 month

1
9
0 0

[PATCH v4 0/7] Add TEE based client driver for UEFI Secure Application

by Harshal Dev

On Qualcomm SoC based platforms, UEFI stores EFI variables within the Replay Protected Memory Block (RPMB) located within either the UFS, eMMC or SPI-NOR storage. The RPMB key which is one-time programmed into the storage controller to allow authentication of the RPMB frames is generated by and only available to the Qualcomm Trusted Execution Environment (QTEE). Thus, only QTEE can prepare the RPMB frames which will be accepted by the storage controller. The legacy QSEECOM protocol used for communicating with the QTEE is deprecated and replaced with the use-case agnostic SMCInvoke protocol starting with the Qualcomm SM8x50 series. On platforms where the QSEECOM protocol still works (the QSEECOM driver probes) the driver does not support a listener interface with QTEE to enable writing of non-volatile EFI variables (via listener requests to Linux from QTEE) to the RPMB for UFS and eMMC storage. (Qualcomm Compute platforms with SPI-NOR storage are an exception to this and work with QSEECOM, see the NOTE below) Therefore on such platforms, a TEE client driver (which communicates with QTEE via the SMCInvoke protocol implemented by the QCOMTEE driver registered with the TEE subsystem) must be used to update such EFI variables through the RPMB service hosted in the QTEE supplicant user-space daemon [1] which forwards RPMB packets to the RPMB device. This series introduces such a uefisecapp TEE client driver for the aforementioned Qualcomm platforms which installs efi-var operations _if_ the QCOMTEE driver registers support for an object-IPC based uefisecapp service on the TEE bus during its probe. Only new QTEE firmware versions available at [2] provide access to the uefisecapp service via the SMCInvoke protocol. Thus, QCOMTEE now maintains a static list of always-available object-IPC based secure services exposed by QTEE. These services are implemented either within the QTEE kernel or within a pre-loaded Trusted Application (TA) usually loaded by the bootloader. The uefisecapp TA is an example of a preloaded TA loaded by UEFI. A static list is required since QTEE does not yet expose any way to dynamically query and enumerate the services exposed by it. To facilitate object-IPC interactions from the kernel-space, this series also introduces a tee_client_object_invoke_func() to allow invocation of TEE objects similar to the existing tee_client_invoke_func() API exported by the TEE subsystem which allows invocation of TEE functions. Some suporting changes are also introduced to track and handle operations for TEE contexts opened from the kernel-space in the back-end QCOM-TEE driver. Finally and as previously mentioned, access to the object-IPC based uefisecapp service is restricted on older QTEE firmware versions. A new QTEE firmware release must be picked up from QArtifactory [2] for all upstream supported Qualcomm SoCs to enable access to uefisecapp service via the TEE client driver. This patch series has been validated on Kodiak RB3Gen2 platform with UFS storage by attempting to read/write EFI variables via the efivar tool [3] after mounting the efivarfs filesystem. See [4] for an example. NOTE: Since Compute platforms do not have a firmware running on their SPI-NOR storage controller which must be programmed with a RPMB key, QTEE has a SPI-NOR driver which holds the key, and so the QSEECOM driver can be used for updating EFI variables on these platforms because QTEE never makes a listener request to Linux (QTEE doesn't need the Linux SPI-NOR driver). Such platforms are outlined in the following static list [5]. Merge Strategy: This patch series could either be taken from the OP-TEE tree or the QCOM soc tree. I would prefer it to be picked by the OP-TEE tree since all except the uefisecapp TEE client driver patch in this series make changes relevant to the TEE subsystem. It would be great if the QCOM soc tree maintainers can Ack the uefisecapp driver patch. [1] https://github.com/qualcomm/minkipc [2] https://shorturl.at/zQU07 [3] https://github.com/rhboot/efivar [4] https://docs.qualcomm.com/doc/80-70020-27/topic/manage_uefi_environment_var… [5] https://elixir.bootlin.com/linux/v7.3-rc5/source/drivers/firmware/qcom/qcom… Signed-off-by: Harshal Dev <harshal.dev(a)oss.qualcomm.com> --- Changes in v4: - Fixed kernel test robot warnings with gcc v16.1.0 [-Wvla-larger-than]. - Update parameter docs for qcomtee_object_invoke() and param_to/from_args(). - Split the defconfig change enabling the UefiSecApp TEE driver into a separate commit. - Use pr_debug() instead of pr_err() when QTEE says it does not implement a service being enumerated. - Re-name qtee_enumerate_service*() functions to qtee_register_service*(). - Collected Reviewed/Acked-by tags from Sumit. - Link to v3: https://lore.kernel.org/r/20261001-qcom_uefisecapp_migrate_qcomtee-v3-0-13d… Changes in v3: - Updated the cover letter and commit messages to highlight the following: 1. Only QTEE has the ability to prepare RPMB frames since it generates and holds the RPMB key. 2. The QSEECOM protocol is deprecated on new platforms and so this series migrates the uefisecapp to SMCInvoke which is a use-case agnostic, transport focused and easier to maintain protocol. - Use single if statement to update both flags and addr/uaddr. - Remove redundant use of new error variable in qcomtee_get_qtee_feature_list(). - Minor fixes such as concise error prints and use of better error codes. - Fix a double free in qtee_enumerate_service(). - Re-org the qcomtee_enumerate_services() function to re-use the same oic and client_env object. - Remove depends on !QCOM_QSEECOM_UEFISECAPP from Kconfig since both drivers can co-exist even on platforms that support both QSEECOM and SMCInvoke protocols. - Update the Kconfig description to better help the user understand when to enable the TEE based uefisecapp driver. - Removed qcom_tee_uefisecapp.h file and inline the header in qcom_tee_uefisecapp.c - Rebased patch series onto the latest linux next tag: next-20260930. - Link to v2: https://lore.kernel.org/r/20260722-qcom_uefisecapp_migrate_qcomtee-v2-0-b8a… Changes in v2: - Drop using MSB of the object_id to distingush kernel and user object invoke contexts. - Introduce enum tee_object_invoke_origin to check the context of object invocation. - Link to v1: https://lore.kernel.org/r/20260707-qcom_uefisecapp_migrate_qcomtee-v1-0-f65… --- Amirreza Zarrabi (2): tee: Add kernel client object invoke helper tee: qcomtee: Allow object invokes from kernel clients Harshal Dev (5): tee: qcomtee: Track the object invocation context tee: Export uuidv5 generation for TEE backends tee: qcomtee: Add support for registering QTEE services on TEE bus firmware: qcom: Add support for TEE based EFI-var client driver arm64: defconfig: Enable UefiSecApp TEE client driver for Qualcomm SoCs MAINTAINERS | 6 + arch/arm64/configs/defconfig | 1 + drivers/firmware/qcom/Kconfig | 31 ++ drivers/firmware/qcom/Makefile | 1 + drivers/firmware/qcom/qcom_tee_uefisecapp.c | 648 ++++++++++++++++++++++++++++ drivers/tee/qcomtee/call.c | 211 ++++++++- drivers/tee/qcomtee/core.c | 9 +- drivers/tee/qcomtee/qcomtee.h | 12 + drivers/tee/qcomtee/qcomtee_msg.h | 1 + drivers/tee/qcomtee/qcomtee_object.h | 16 +- drivers/tee/tee_core.c | 24 +- include/linux/tee_core.h | 23 +- include/linux/tee_drv.h | 18 +- 13 files changed, 967 insertions(+), 34 deletions(-) --- base-commit: 6c2cb8b8b843d216ab549b678a0d8831c43153e0 change-id: 20260408-qcom_uefisecapp_migrate_qcomtee-13869d45e014 Best regards, -- Harshal Dev <harshal.dev(a)oss.qualcomm.com>

1 month

3
19
0 0

[GIT PULL] TEE fix for v7.3

by Jens Wiklander

Hello soc maintainers, Please pull this small fix for the TEE subsystem. I've only had the patch in linux-next for a day, but it has passed my local smoke tests. Thanks, Jens The following changes since commit 8d3ae59288f1e7d58d76558a6ee96d533bc5019f: Linux 7.2 (2026-08-16 14:32:26 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee.git tags/tee-fix-for-v7.3 for you to fetch changes up to b7f925fd5226deb953c8dcdc9677d3fcc2717c00: tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() (2026-10-02 13:58:48 +0200) ---------------------------------------------------------------- Reject zero-sized allocations in tee_dyn_shm_alloc_helper() ---------------------------------------------------------------- Georgiy Osokin (1): tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() drivers/tee/tee_shm.c | 4 ++++ 1 file changed, 4 insertions(+)

1 month

2
1
0 0

[PATCH RFC v2 0/8] tee: optee: add RPMI backend support on RISC-V

by Amirreza Zarrabi

This series adds an RPMI backend to the OP-TEE driver for RISC-V. It builds on the separately posted RPMI TEE transport series [1], which provides service discovery, synchronous calls, memory parcels and asynchronous signals. This revision is effectively a full rewrite of the original RFC. The generic RPMI transport has been separated from the OP-TEE backend, and the backend has been reworked around the service bus and a new OP-TEE control ABI. Unlike v1, the OP-TEE backend no longer manages SBI MPXY mailbox channels or implements RPMI TEE service-group operations directly. It binds to the OP-TEE service UUID on the RPMI TEE bus and uses the transport's public operations. No additional OP-TEE device-tree node is required. The backend reuses the common OP-TEE session, shared-memory, argument cache, call queue and RPC infrastructure. Shared memory is represented by RPMI parcel IDs and nonces. Yielding calls pass command and RPC buffer ranges within a parcel and resume suspended execution using an opaque token returned by OP-TEE. The OP-TEE control ABI uses fixed-width little-endian messages carried in TEE_CALL payloads rather than reproducing FF-A's register-based message layout. Asynchronous notifications use an allocated TEE-to-REE signal as a bottom-half doorbell, while ordinary logical notifications continue through the common RPC path. Matching OP-TEE OS support for this ABI has not yet been implemented. This remains an RFC for review of the backend integration and the Linux-to-OP-TEE protocol. [1] RPMI TEE transport dependency: https://lore.kernel.org/op-tee/20260928-riscv-rpmi-tee-abi-v1-0-04908b81d88… Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> --- Changes in v2: - Effectively rewrite the backend around the separately posted RPMI TEE transport and a new OP-TEE control ABI. - Remove backend-owned per-hart mailbox channels and the OP-TEE-specific device-tree binding. - Replace the register-like control payload with fixed-width messages, explicit command/RPC buffer ranges and opaque resume tokens. - Add a parcel-reference parameter layout carrying the parcel ID, nonce, and 64-bit offset and size without changing parameter size. - Make argument-offset support part of the baseline ABI and retain the common shared argument cache. - Use a transport-allocated signal for asynchronous bottom-half notifications. - Link to v1: https://lore.kernel.org/r/20260912-rpmi-tee-service-grp-dev-v1-0-1d1d35c2a8… --- Amirreza Zarrabi (8): tee: optee: allow RPMI transport builds on RISC-V tee: optee: define the RPMI control and parcel-reference ABI tee: optee: add RPMI shared-memory and parameter support tee: optee: add RPMI dynamic shared-memory pool tee: optee: add RPMI RPC handling tee: optee: execute yielding RPMI calls tee: optee: bind RPMI services and negotiate backend capabilities tee: optee: support RPMI asynchronous notification doorbells drivers/tee/Kconfig | 3 +- drivers/tee/optee/Kconfig | 3 +- drivers/tee/optee/Makefile | 1 + drivers/tee/optee/call.c | 2 + drivers/tee/optee/core.c | 10 +- drivers/tee/optee/optee_msg.h | 38 +- drivers/tee/optee/optee_private.h | 54 +- drivers/tee/optee/optee_rpmi.h | 234 ++++++++ drivers/tee/optee/rpmi_abi.c | 1059 +++++++++++++++++++++++++++++++++++++ 9 files changed, 1389 insertions(+), 15 deletions(-) --- base-commit: bf1ee2bd5c2da8992f33c8950ef194aaff74ed6c change-id: 20260912-rpmi-tee-service-grp-dev-b2ce2f63e0df Best regards, -- Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com>

1 month

2
20
0 0

[PATCH RFC v2 00/10] firmware: riscv: add RPMI TEE service group transport

by Amirreza Zarrabi

This RFC series adds the RISC-V RPMI TEE service group transport [1], which provides RISC-V systems a mechanism for Linux to communicate with TEE endpoints. Linux and a TEE act as endpoints of the RPMI TEE service group, while the RPMI framework in machine-mode firmware mediates communication between them over an SBI MPXY [2] mailbox channel. The series is layered as follows: - Two mailbox patches add a direct synchronous send mode (mbox_send_message_sync()) and its implementation for RPMI MPXY channels, needed because RPMI TEE requests must complete synchronously in the calling context. - The RPMI TEE bus registers one device per discovered TEE endpoint and service UUID pair, following the device-per-service model, so individual service drivers can bind independently. - The RPMI TEE transport core binds to the mailbox channel and validates the RPMI and TEE service-group versions before any discovery or service traffic is attempted. - Discovery uses PROBE_SYSTEM, PROBE_DOMAIN and PROBE_ENDPOINT to obtain the local endpoint identity and enumerate physical TEE endpoints and their services. - Memory parcel operations (lend, share, reclaim) let a consumer driver share memory with a TEE endpoint. Linux creates a parcel and the parcel identifier is then used by the consumer's own protocol to refer to that memory. - Signal buses let a consumer driver exchange asynchronous notifications with its TEE endpoint in both directions. This series only establishes the transport, bus, and discovery layer. An OP-TEE backend using these interfaces has been posted as a separate series [3]. Feedback on the overall architecture, the bus/device model, and the memory-parcel and signal-bus abstractions is especially welcome at this stage in this RFC series. [1] https://github.com/riscv-non-isa/riscv-rpmi/commits/main/src/srvgrp-tee.adoc [2] https://github.com/riscv-non-isa/riscv-sbi-doc/releases [3] https://lore.kernel.org/op-tee/20261005-rpmi-tee-service-grp-dev-v2-0-72f22… Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> --- Changes in v2: - Fix memory-block address encoding to preserve the full physical address. - Report the blocks included in the initial segmented CREATE request, rather than the total parcel block count. - Correct the CREATE block-count documentation and remove an unused include. - Stop signal retrieval during shutdown so continuously arriving signals cannot prevent the notification workqueue from draining. - Drain notification callbacks before unregistering child devices, including on partial registration failure. Keep the mailbox and signal buses available until client removal completes. - Allocate signal-bus state before firmware setup and use automatic cleanup on setup failure. - Skip disabled System-MSI nodes when locating the notification IRQ controller. - Add rpmi_tee_info_ops.msg_limits_get() to expose maximum TEE_CALL request and response payload sizes, excluding transport headers. - Cache TEE_CALL payload limits during transport initialization and reuse them for capability reporting and call bounds checking. - Include missing <linux/idr.h> for the RPMI TEE bus's IDA APIs. - Replace SYSINFO descriptor-table discovery with PROBE_SYSTEM, PROBE_DOMAIN and PROBE_ENDPOINT, and update service and feature identifiers to match the revised RPMI TEE specification. - Move discovery into discovery.c and shared internal declarations into rpmi_tee_private.h. - Store discovered endpoints and their service UUIDs in per-endpoint list entries, avoiding array reallocations. - Link to v1: https://lore.kernel.org/r/20260928-riscv-rpmi-tee-abi-v1-0-04908b81d885@oss… --- Amirreza Zarrabi (10): mailbox: add direct synchronous send support mailbox: mpxy: add direct synchronous send firmware: add RPMI TEE bus support dt-bindings: firmware: add RISC-V RPMI TEE transport firmware: add RPMI TEE transport core firmware: riscv: rpmi-tee: discover TEE endpoints firmware: riscv: rpmi-tee: register TEE services and support calls firmware: riscv: rpmi-tee: cache TEE capabilities firmware: riscv: rpmi-tee: add memory parcel operations firmware: riscv: rpmi-tee: add signal bus support .../bindings/firmware/riscv,rpmi-tee.yaml | 35 + drivers/firmware/Kconfig | 2 + drivers/firmware/Makefile | 1 + drivers/firmware/riscv_rpmi_tee/Kconfig | 8 + drivers/firmware/riscv_rpmi_tee/Makefile | 8 + drivers/firmware/riscv_rpmi_tee/bus.c | 202 +++ drivers/firmware/riscv_rpmi_tee/discovery.c | 383 +++++ drivers/firmware/riscv_rpmi_tee/driver.c | 1583 ++++++++++++++++++++ drivers/firmware/riscv_rpmi_tee/rpmi_tee_private.h | 128 ++ drivers/mailbox/mailbox.c | 72 +- drivers/mailbox/riscv-sbi-mpxy-mbox.c | 196 ++- include/linux/mailbox/riscv-rpmi-message.h | 13 + include/linux/mailbox_client.h | 3 + include/linux/mailbox_controller.h | 10 + include/linux/rpmi_tee.h | 200 +++ 15 files changed, 2772 insertions(+), 72 deletions(-) --- base-commit: 6375e61c01e93e35ee7acd336a689ac1fae4b509 change-id: 20260928-riscv-rpmi-tee-abi-603e9a3b4399 Best regards, -- Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com>

1 month

1
10
0 0

Re: [PATCH v2 0/3] Add TPM support via Qualcomm TEE TPM TA

by zeroknots

Hi Kuldeep, A data point from retail hardware, in case it is useful for this series: on an ASUS Zenbook A14 UX3407NA (Glymur, X2E-88-100, BIOS UX3407NA.315) the TPM TA is not reachable as QTEE service 81, but it is present as the QSEECOM application "qcom.tz.tpm". With the qcomtee driver on a 7.3-rc3 based kernel, QTEE reports version 5.2.0, and service discovery finds neither 81 (TPM) nor 413 (UEFI secure app). On the same boot, qseecom (version 0x1402000) works and backs efivars through "qcom.tz.uefisecapp" (app id 7). An app-id lookup for "qcom.tz.tpm" returns app id 1; a made-up name returns -ENOENT. The Windows driver for this machine agrees: QcTrEE8480.inf configures the TPM service with AppName="qcom.tz.tpm", SecureApp=1, LoadApp=0 (preloaded by firmware). The EFI configuration table carries the TPMEventLog and TPMFinalLog entries, so the firmware TPM is active. Through that app, using a QSEECOM transport (based on Xilin Wu's out-of-tree SC8280XP driver: QUERY_INFO_2 / SEND_COMMAND with a CRB-style control area, here at 0x81d10000), /dev/tpm0 works: TPM 2.0, manufacturer QCOM, vendor string "xCG fTPM", firmware 0x40000, real PCR 0-7 values, GetRandom, ECC and RSA-2048 primaries, sign and verify, and a sealed object that persists across reboots. So, as far as I can tell, retail Glymur laptops may ship firmware on which this driver finds no TPM, while the same TA is available over QSEECOM. The same applies to the prerequisite series that moves uefisecapp to QCOMTEE [1]: on this firmware service 413 is absent and EFI variables work only through the QSEECOM uefisecapp. If the QSEECOM path were dropped for Glymur, efivars would stop working on this machine, so it would be good to keep it as a fallback when the QTEE service is not found. Two questions: - Is service 81 expected to appear on retail firmware through an update, or is it specific to the CRD firmware? - Would you consider a QSEECOM-based path for such firmware? I am happy to test this series, or any other service UID you would like checked, on this machine, and to share the transport code. [1] https://lore.kernel.org/lkml/20260722-qcom_uefisecapp_migrate_qcomtee-v2-0-… Thanks, zeroknots Assisted-by: LLM (analysis and drafting; the measurements were made on the hardware and reviewed by me)

1 month, 1 week

4
4
0 0

[PATCH v2 0/3] Add TPM support via Qualcomm TEE TPM TA

by Kuldeep Singh

Qualcomm platforms with a discrete TPM (dTPM) talked to it directly over a non-secure SPI channel from the kernel. Arm's Base Boot Security Requirements (BBSR) v1.4 require that access to go through TrustZone instead, so on affected Qualcomm platforms the TPM 2.0 instance is now fronted by a Trusted Application (TA) running inside Qualcomm's Trusted Execution Environment (QTEE), which talks to the dTPM (or implements an fTPM) on the kernel's behalf. This series adds a kernel driver for that TA, built on the QCOMTEE object-IPC transport (drivers/tee/qcomtee/) already used to reach other QTEE services. This patch series functionally depends on below(patch 5/6 specifically) for qtee service discovery. - https://lore.kernel.org/lkml/20260722-qcom_uefisecapp_migrate_qcomtee-v2-0-… Tested on Glymur-crd target with tpm2-tools utility. Validations: - Get capabilities - Random number generator - RSA key creation, encryption and decryption. Signed-off-by: Kuldeep Singh <kuldeep.singh(a)oss.qualcomm.com> --- Changes in v2: - Use QCOMTEE_TPM_UID as 81 for service discovery in patch 1. - Use FIELD_GET, zero initialised array and log improvement (Konrad) - Improve commit title and other fixes (Jarkko) - Split MAINTAINERS entry as separate patch. - Link to v1: https://patch.msgid.link/20260831-tpm_qcom_driver-v1-0-6f16fa6924fa@oss.qua… To: Amirreza Zarrabi <amirreza.zarrabi(a)oss.qualcomm.com> To: Jens Wiklander <jenswi(a)kernel.org> To: Sumit Garg <sumit.garg(a)kernel.org> To: Peter Huewe <peterhuewe(a)gmx.de> To: Jarkko Sakkinen <jarkko(a)kernel.org> To: Jason Gunthorpe <jgg(a)ziepe.ca> To: Kuldeep Singh <kuldeep.singh(a)oss.qualcomm.com> Cc: linux-arm-msm(a)vger.kernel.org Cc: op-tee(a)lists.trustedfirmware.org Cc: linux-kernel(a)vger.kernel.org Cc: linux-integrity(a)vger.kernel.org --- Kuldeep Singh (3): tee: qcomtee: Register qcom.tz.tpm service for discovery tpm: Introduce Qualcomm TPM driver MAINTAINERS: Add Qualcomm TPM driver entry MAINTAINERS | 7 + drivers/char/tpm/Kconfig | 9 + drivers/char/tpm/Makefile | 1 + drivers/char/tpm/tpm_qcom.c | 354 ++++++++++++++++++++++++++++++++++++++ drivers/char/tpm/tpm_qcom.h | 83 +++++++++ drivers/tee/qcomtee/call.c | 4 +- drivers/tee/qcomtee/qcomtee_msg.h | 2 + 7 files changed, 459 insertions(+), 1 deletion(-) --- base-commit: f3e6330d7fe42b204af05a2dbc68b379e0ad179e change-id: 20260831-tpm_qcom_driver-d21c720e73b2 prerequisite-change-id: 20260408-qcom_uefisecapp_migrate_qcomtee-13869d45e014:v2 prerequisite-patch-id: 4dc81445c9baf36f420da8c2e2bed96e71b31a5b prerequisite-patch-id: b487dfe2fbc076f4815dc6c73b9e68b0b78c961f prerequisite-patch-id: c5df2b3696520a96f95b2d3535ed84cdc21cc315 prerequisite-patch-id: bbdd5327c15aeaa99ce9b74bab324a98f084ed48 prerequisite-patch-id: 07d9c4e9fe9fd61f60e3f35b30b9d81716f0734c prerequisite-patch-id: 10ff88d87586f21f3cff3f72dbd21c27adbfbbcc Best regards, -- Kuldeep Singh <kuldeep.singh(a)oss.qualcomm.com>

1 month, 1 week

4
16
0 0

[PATCH v3 0/6] Add TEE based client driver for UEFI Secure Application

by Harshal Dev

On Qualcomm SoC based platforms, UEFI stores EFI variables within the Replay Protected Memory Block (RPMB) located within either the UFS, eMMC or SPI-NOR storage. The RPMB key which is one-time programmed into the storage controller to allow authentication of the RPMB frames is generated by and only available to the Qualcomm Trusted Execution Environment (QTEE). Thus, only QTEE can prepare the RPMB frames which will be accepted by the storage controller. The legacy QSEECOM protocol used for communicating with the QTEE is deprecated and replaced with the use-case agnostic SMCInvoke protocol starting with the Qualcomm SM8x50 series. On platforms where the QSEECOM protocol still works (the QSEECOM driver probes) the driver does not support a listener interface with QTEE to enable writing of non-volatile EFI variables (via listener requests to Linux from QTEE) to the RPMB for UFS and eMMC storage. (Qualcomm Compute platforms with SPI-NOR storage are an exception to this and work with QSEECOM, see the NOTE below) Therefore on such platforms, a TEE client driver (which communicates with QTEE via the SMCInvoke protocol implemented by the QCOMTEE driver registered with the TEE subsystem) must be used to update such EFI variables through the RPMB service hosted in the QTEE supplicant user-space daemon [1] which forwards RPMB packets to the RPMB device. This series introduces such a uefisecapp TEE client driver for the aforementioned Qualcomm platforms which installs efi-var operations _if_ the QCOMTEE driver registers support for an object-IPC based uefisecapp service on the TEE bus during its probe. Only new QTEE firmware versions available at [2] provide access to the uefisecapp service via the SMCInvoke protocol. Thus, QCOMTEE now maintains a static list of always-available object-IPC based secure services exposed by QTEE. These services are implemented either within the QTEE kernel or within a pre-loaded Trusted Application (TA) usually loaded by the bootloader. The uefisecapp TA is an example of a preloaded TA loaded by UEFI. A static list is required since QTEE does not yet expose any way to dynamically query and enumerate the services exposed by it. To facilitate object-IPC interactions from the kernel-space, this series also introduces a tee_client_object_invoke_func() to allow invocation of TEE objects similar to the existing tee_client_invoke_func() API exported by the TEE subsystem which allows invocation of TEE functions. Some suporting changes are also introduced to track and handle operations for TEE contexts opened from the kernel-space in the back-end QCOM-TEE driver. Finally and as previously mentioned, access to the object-IPC based uefisecapp service is restricted on older QTEE firmware versions. A new QTEE firmware release must be picked up from QArtifactory [2] for all upstream supported Qualcomm SoCs to enable access to uefisecapp service via the TEE client driver. This patch series has been validated on Kodiak RB3Gen2 platform with UFS storage by attempting to read/write EFI variables via the efivar tool [3] after mounting the efivarfs filesystem. See [4] for an example. NOTE: Since Compute platforms do not have a firmware running on their SPI-NOR storage controller which must be programmed with a RPMB key, QTEE has a SPI-NOR driver which holds the key, and so the QSEECOM driver can be used for updating EFI variables on these platforms because QTEE never makes a listener request to Linux (QTEE doesn't need the Linux SPI-NOR driver). Such platforms are outlined in the following static list [5]. Merge Strategy: This patch series could either be taken from the OP-TEE tree or the QCOM soc tree. I would prefer it to be picked by the OP-TEE tree since all except the uefisecapp TEE client driver patch in this series make changes relevant to the TEE subsystem. It would be great if the QCOM soc tree maintainers can Ack the uefisecapp driver patch. [1] https://github.com/qualcomm/minkipc [2] https://shorturl.at/zQU07 [3] https://github.com/rhboot/efivar [4] https://docs.qualcomm.com/doc/80-70020-27/topic/manage_uefi_environment_var… [5] https://elixir.bootlin.com/linux/v7.3-rc5/source/drivers/firmware/qcom/qcom… Signed-off-by: Harshal Dev <harshal.dev(a)oss.qualcomm.com> --- Changes in v3: - Updated the cover letter and commit messages to highlight the following: 1. Only QTEE has the ability to prepare RPMB frames since it generates and holds the RPMB key. 2. The QSEECOM protocol is deprecated on new platforms and so this series migrates the uefisecapp to SMCInvoke which is a use-case agnostic, transport focused and easier to maintain protocol. - Use single if statement to update both flags and addr/uaddr. - Remove redundant use of new error variable in qcomtee_get_qtee_feature_list(). - Minor fixes such as concise error prints and use of better error codes. - Fix a double free in qtee_enumerate_service(). - Re-org the qcomtee_enumerate_services() function to re-use the same oic and client_env object. - Remove depends on !QCOM_QSEECOM_UEFISECAPP from Kconfig since both drivers can co-exist even on platforms that support both QSEECOM and SMCInvoke protocols. - Update the Kconfig description to better help the user understand when to enable the TEE based uefisecapp driver. - Removed qcom_tee_uefisecapp.h file and inline the header in qcom_tee_uefisecapp.c - Rebased patch series onto the latest linux next tag: next-20260930. - Link to v2: https://lore.kernel.org/r/20260722-qcom_uefisecapp_migrate_qcomtee-v2-0-b8a… Changes in v2: - Drop using MSB of the object_id to distingush kernel and user object invoke contexts. - Introduce enum tee_object_invoke_origin to check the context of object invocation. - Link to v1: https://lore.kernel.org/r/20260707-qcom_uefisecapp_migrate_qcomtee-v1-0-f65… --- Amirreza Zarrabi (2): tee: Add kernel client object invoke helper tee: qcomtee: Allow object invokes from kernel clients Harshal Dev (4): tee: qcomtee: Track the object invocation context tee: Export uuidv5 generation for TEE backends tee: qcomtee: Add support for registering QTEE services on TEE bus firmware: qcom: Add support for TEE based EFI-var client driver MAINTAINERS | 6 + arch/arm64/configs/defconfig | 1 + drivers/firmware/qcom/Kconfig | 31 ++ drivers/firmware/qcom/Makefile | 1 + drivers/firmware/qcom/qcom_tee_uefisecapp.c | 636 ++++++++++++++++++++++++++++ drivers/tee/qcomtee/call.c | 206 ++++++++- drivers/tee/qcomtee/core.c | 9 +- drivers/tee/qcomtee/qcomtee.h | 12 + drivers/tee/qcomtee/qcomtee_msg.h | 1 + drivers/tee/qcomtee/qcomtee_object.h | 16 +- drivers/tee/tee_core.c | 24 +- include/linux/tee_core.h | 23 +- include/linux/tee_drv.h | 18 +- 13 files changed, 952 insertions(+), 32 deletions(-) --- base-commit: 6c2cb8b8b843d216ab549b678a0d8831c43153e0 change-id: 20260408-qcom_uefisecapp_migrate_qcomtee-13869d45e014 Best regards, -- Harshal Dev <harshal.dev(a)oss.qualcomm.com>

1 month, 1 week

3
14
0 0

[GIT PULL] TEE QTEE fix for v7.3

by Jens Wiklander

Hello soc maintainers, Please pull this small kernel-doc fix for the QTEE driver in the TEE subsystem. Thanks, Jens The following changes since commit 8d3ae59288f1e7d58d76558a6ee96d533bc5019f: Linux 7.2 (2026-08-16 14:32:26 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee.git tags/qcomtee-fix-for-v7.3 for you to fetch changes up to 93847823b6761e1791a7db10f55bbd4f79fa0dbc: tee: qcomtee: fix kernel-doc warnings (2026-08-24 14:49:01 +0200) ---------------------------------------------------------------- Fix kernel-doc warnings ---------------------------------------------------------------- Babanpreet Singh (1): tee: qcomtee: fix kernel-doc warnings drivers/tee/qcomtee/async.c | 4 ++-- drivers/tee/qcomtee/qcomtee_msg.h | 2 +- drivers/tee/qcomtee/qcomtee_object.h | 1 + 3 files changed, 4 insertions(+), 3 deletions(-)

1 month, 1 week

1
0
0 0

[GIT PULL] TEE QTEE update for v7.4

by Jens Wiklander

Hello soc maintainers, Please pull this small patch for the QTEE driver in TEE subsystem. Thanks, Jens The following changes since commit 8d3ae59288f1e7d58d76558a6ee96d533bc5019f: Linux 7.2 (2026-08-16 14:32:26 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee.git tags/qcomtee-for-v7.4 for you to fetch changes up to 615970476444bdf853c7c3ecdbe809dbdca06c16: tee: qcomtee: Drop unused assignment of platform_device_id driver data (2026-09-16 10:38:46 +0200) ---------------------------------------------------------------- Drop unused assignment of platform_device_id driver data ---------------------------------------------------------------- Uwe Kleine-König (The Capable Hub) (1): tee: qcomtee: Drop unused assignment of platform_device_id driver data drivers/tee/qcomtee/call.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)

1 month, 1 week

1
0
0 0

2026

2025

2024

2023

2022

2021

2020

OP-TEE