+ op-tee@lists.trustedfirmware.org, Jens Wiklander jens.wiklander@oss.qualcomm.com
On 11-11-2026 07:47 pm, Harshal Dev wrote:
Qualcomm platforms such as the IQ-9075 EVK now boot with both Qualcomm Trusted Execution Environment (QTEE) and OP-TEE [1]. However, the Qualcomm Inline Crypto Engine (ICE) driver currently only makes SCM calls into QTEE. With the arrival of ICE support on OPTEE [2,3] for Qualcomm platforms, there is a need for TrustZone (TZ) agnostic APIs which re-direct the call to the correct TZ at runtime to request programming of the secure interfaces on the ICE hardware block. This patch series adds such TZ agnostic APIs to the ICE driver for requesting secure services from either QTEE or OP-TEE depending on whether an SCM driver back-end or a TEE client driver back-end is registered with it at runtime. This series is logically similar to the one introduced for Peripheral Authentication Service (PAS) [3] which was recently merged to provide a generic PAS service for both QTEE and OP-TEE.
Apart from introducing a TEE bus based client driver for ICE, this series also adds support for optionally registering a TEE device which represents a particular TEE (QTEE or OPTEE) on the platform bus to enable drivers such as ICE which poll on the availability of a TEE interface to be notified.
The ICE driver is an independent platform driver which polls on the availability of a TEE interface (SCM driver) before checking if the ICE secure service is supported by QTEE by querying qcom_scm_is_available(). The TEE subsystem currently does not provide any mechanism to notify the availability of a TEE interface, i.e. whether QCOMTEE or OPTEE have probed. Without the introduction of such a notification mechanism the ICE driver would indefinitely defer probe until the OPTEE ICE Pseudo TA becomes available on the TEE bus implying that for OPTEE builds without the ICE PTA enabled, the dependent UFS/SDHC storage driver will fail to come online.
The TEE bus based client driver introduced in this series which registers with the ICE driver has an ABI with OP-TEE that is 1-1 identical with the SCM driver's ICE ABI with QTEE. This is because both TEEs implement logically similar drivers with the exception that OP-TEE currently does not have Hardware Key Manager v2 support and so the inline encryption functionality with OP-TEE is currently limited to Qualcomm platforms with only Hardware Key Manager v1.
Validation: This series has been validated on a LeMans IQ-9075 EVK device by attempting file system encryption via the fscrypt tool.
Merge Strategy: All patches in this series except one touch Qualcomm firmware and soc drivers. Hence, it should go via the QCOM-SoC tree. Request the TEE subsystem maintainers to provide an Acknowledgement for this.
[1] https://ldts.github.io/qcom-buildroot/index.html [2] https://github.com/OP-TEE/optee_os/pull/7906 (In review) [3] https://github.com/OP-TEE/optee_os/pull/8137 (Draft, depends on PR#7906) [4] https://lore.kernel.org/all/20260702115835.167602-1-sumit.garg@kernel.org/
Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com
Changes in v2:
- Merged the furnctionality of the middleware ICE service into the ICE driver as requested by Eric.
- Introduced tee_platform_device_register() to fix the issue of indefinite probe defer in the ICE driver when ICE PTA is not enabled in OPTEE as pointed out by Eric.
- Fixed type "Psuedo" in ICE TEE back-end commit.
- Fixed space based indentation with tab in ICE back-end Kconfig.
- Ensure tee_shm_get_va() failure is checked and ERR_PTR() returned.
- Validate out_shm size everywhere in qcom_ice_tee.c
- Zero the memory holding the key when TEE invoke call fails.
- Check failure from qcom_ice_tz_ops_register() during probe.
- Cross-check out_size and lt_key_size in qcom_ice_tee_generate_key().
- Always return 0 when qcom_ice_tee_probe() is success.
- Did not collect tags from Abel since significant rework undertaken.
- Link to v1: https://lore.kernel.org/r/20261021-ice-migrate-tee-svc-v1-0-b035be7aab0a@oss...
Harshal Dev (6): soc: qcom: ice: Add TZ agnostic re-direction functions firmware: qcom_scm: Transition to ICE TZ agnostic operations firmware: qcom: Add a TEE bus based ICE back-end tee: optee: Register TEE devices on the platform bus soc: qcom: ice: Migrate to the TZ agnostic ICE APIs firmware: qcom: scm: Drop exported ICE wrapper functions
MAINTAINERS | 8 + drivers/firmware/qcom/Kconfig | 9 + drivers/firmware/qcom/Makefile | 1 + drivers/firmware/qcom/qcom_ice_tee.c | 443 +++++++++++++++++++++++++++++ drivers/firmware/qcom/qcom_scm.c | 90 +++--- drivers/soc/qcom/Kconfig | 1 + drivers/soc/qcom/ice.c | 173 +++++++++-- drivers/tee/optee/ffa_abi.c | 8 + drivers/tee/optee/smc_abi.c | 8 + drivers/tee/tee_core.c | 21 ++ include/linux/firmware/qcom/qcom_ice_tee.h | 10 + include/linux/firmware/qcom/qcom_scm.h | 20 -- include/linux/tee_core.h | 9 + include/soc/qcom/ice.h | 56 ++++ 14 files changed, 784 insertions(+), 73 deletions(-)
base-commit: 8f7df005a7564bd7ffa75da9c3085d5b996f1e16 change-id: 20261021-ice-migrate-tee-svc-a5cd6959ae36
Best regards,