On Qualcomm SoC based platforms, UEFI stores EFI variables within the Replay Protected Memory Block (RPMB) located within either the UFS, eMMC or SPI-NOR storage. The RPMB key which is one-time programmed into the storage controller to allow authentication of the RPMB frames is generated by and only available to the Qualcomm Trusted Execution Environment (QTEE). Thus, only QTEE can prepare the RPMB frames which will be accepted by the storage controller.
The legacy QSEECOM protocol used for communicating with the QTEE is deprecated and replaced with the use-case agnostic SMCInvoke protocol starting with the Qualcomm SM8x50 series. On platforms where the QSEECOM protocol still works (the QSEECOM driver probes) the driver does not support a listener interface with QTEE to enable writing of non-volatile EFI variables (via listener requests to Linux from QTEE) to the RPMB for UFS and eMMC storage. (Qualcomm Compute platforms with SPI-NOR storage are an exception to this and work with QSEECOM, see the NOTE below)
Therefore on such platforms, a TEE client driver (which communicates with QTEE via the SMCInvoke protocol implemented by the QCOMTEE driver registered with the TEE subsystem) must be used to update such EFI variables through the RPMB service hosted in the QTEE supplicant user-space daemon [1] which forwards RPMB packets to the RPMB device.
This series introduces such a uefisecapp TEE client driver for the aforementioned Qualcomm platforms which installs efi-var operations _if_ the QCOMTEE driver registers support for an object-IPC based uefisecapp service on the TEE bus during its probe. Only new QTEE firmware versions available at [2] provide access to the uefisecapp service via the SMCInvoke protocol.
Thus, QCOMTEE now maintains a static list of always-available object-IPC based secure services exposed by QTEE. These services are implemented either within the QTEE kernel or within a pre-loaded Trusted Application (TA) usually loaded by the bootloader. The uefisecapp TA is an example of a preloaded TA loaded by UEFI. A static list is required since QTEE does not yet expose any way to dynamically query and enumerate the services exposed by it.
To facilitate object-IPC interactions from the kernel-space, this series also introduces a tee_client_object_invoke_func() to allow invocation of TEE objects similar to the existing tee_client_invoke_func() API exported by the TEE subsystem which allows invocation of TEE functions. Some suporting changes are also introduced to track and handle operations for TEE contexts opened from the kernel-space in the back-end QCOM-TEE driver.
Finally and as previously mentioned, access to the object-IPC based uefisecapp service is restricted on older QTEE firmware versions. A new QTEE firmware release must be picked up from QArtifactory [2] for all upstream supported Qualcomm SoCs to enable access to uefisecapp service via the TEE client driver.
This patch series has been validated on Kodiak RB3Gen2 platform with UFS storage by attempting to read/write EFI variables via the efivar tool [3] after mounting the efivarfs filesystem. See [4] for an example.
NOTE: Since Compute platforms do not have a firmware running on their SPI-NOR storage controller which must be programmed with a RPMB key, QTEE has a SPI-NOR driver which holds the key, and so the QSEECOM driver can be used for updating EFI variables on these platforms because QTEE never makes a listener request to Linux (QTEE doesn't need the Linux SPI-NOR driver). Such platforms are outlined in the following static list [5].
Merge Strategy:
This patch series could either be taken from the OP-TEE tree or the QCOM soc tree. I would prefer it to be picked by the OP-TEE tree since all except the uefisecapp TEE client driver patch in this series make changes relevant to the TEE subsystem. It would be great if the QCOM soc tree maintainers can Ack the uefisecapp driver patch.
[1] https://github.com/qualcomm/minkipc [2] https://shorturl.at/zQU07 [3] https://github.com/rhboot/efivar [4] https://docs.qualcomm.com/doc/80-70020-27/topic/manage_uefi_environment_vari... [5] https://elixir.bootlin.com/linux/v7.3-rc5/source/drivers/firmware/qcom/qcom_...
Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com --- Changes in v5: - Fixed comment in qcomtee_object.h to drop '+'. - Removed duplicate function doc for tee_generate_uuid_v5() in .c file. - Fixed qtee_register_services() doc. - Dropped unused QTEE_UUID_NS_NAME_SIZE macro. - Optimized qcomtee_uefi_query_variable_info() to drop redundant stack variables. - Migrated to block comment format everywhere in qcom_tee_uefisecapp.c. - Drop comments which highlight obvious stuff in qcomtee_uefisecapp_probe(). - Collected Reviewed-by tags from Amir. - Link to v4: https://lore.kernel.org/r/20261006-qcom_uefisecapp_migrate_qcomtee-v4-0-bf1c...
Changes in v4: - Fixed kernel test robot warnings with gcc v16.1.0 [-Wvla-larger-than]. - Update parameter docs for qcomtee_object_invoke() and param_to/from_args(). - Split the defconfig change enabling the UefiSecApp TEE driver into a separate commit. - Use pr_debug() instead of pr_err() when QTEE says it does not implement a service being enumerated. - Re-name qtee_enumerate_service*() functions to qtee_register_service*(). - Collected Reviewed/Acked-by tags from Sumit. - Link to v3: https://lore.kernel.org/r/20261001-qcom_uefisecapp_migrate_qcomtee-v3-0-13df...
Changes in v3: - Updated the cover letter and commit messages to highlight the following: 1. Only QTEE has the ability to prepare RPMB frames since it generates and holds the RPMB key. 2. The QSEECOM protocol is deprecated on new platforms and so this series migrates the uefisecapp to SMCInvoke which is a use-case agnostic, transport focused and easier to maintain protocol. - Use single if statement to update both flags and addr/uaddr. - Remove redundant use of new error variable in qcomtee_get_qtee_feature_list(). - Minor fixes such as concise error prints and use of better error codes. - Fix a double free in qtee_enumerate_service(). - Re-org the qcomtee_enumerate_services() function to re-use the same oic and client_env object. - Remove depends on !QCOM_QSEECOM_UEFISECAPP from Kconfig since both drivers can co-exist even on platforms that support both QSEECOM and SMCInvoke protocols. - Update the Kconfig description to better help the user understand when to enable the TEE based uefisecapp driver. - Removed qcom_tee_uefisecapp.h file and inline the header in qcom_tee_uefisecapp.c - Rebased patch series onto the latest linux next tag: next-20260930. - Link to v2: https://lore.kernel.org/r/20260722-qcom_uefisecapp_migrate_qcomtee-v2-0-b8a8...
Changes in v2: - Drop using MSB of the object_id to distingush kernel and user object invoke contexts. - Introduce enum tee_object_invoke_origin to check the context of object invocation. - Link to v1: https://lore.kernel.org/r/20260707-qcom_uefisecapp_migrate_qcomtee-v1-0-f659...
--- Amirreza Zarrabi (2): tee: Add kernel client object invoke helper tee: qcomtee: Allow object invokes from kernel clients
Harshal Dev (5): tee: qcomtee: Track the object invocation context tee: Export uuidv5 generation for TEE backends tee: qcomtee: Add support for registering QTEE services on TEE bus firmware: qcom: Add support for TEE based EFI-var client driver arm64: defconfig: Enable UefiSecApp TEE client driver for Qualcomm SoCs
MAINTAINERS | 6 + arch/arm64/configs/defconfig | 1 + drivers/firmware/qcom/Kconfig | 31 ++ drivers/firmware/qcom/Makefile | 1 + drivers/firmware/qcom/qcom_tee_uefisecapp.c | 644 ++++++++++++++++++++++++++++ drivers/tee/qcomtee/call.c | 210 ++++++++- drivers/tee/qcomtee/core.c | 9 +- drivers/tee/qcomtee/qcomtee.h | 10 + drivers/tee/qcomtee/qcomtee_msg.h | 1 + drivers/tee/qcomtee/qcomtee_object.h | 16 +- drivers/tee/tee_core.c | 34 +- include/linux/tee_core.h | 23 +- include/linux/tee_drv.h | 18 +- 13 files changed, 959 insertions(+), 45 deletions(-) --- base-commit: 6c2cb8b8b843d216ab549b678a0d8831c43153e0 change-id: 20260408-qcom_uefisecapp_migrate_qcomtee-13869d45e014
Best regards,
QCOMTEE needs to distinguish between object invocations arriving from kernel clients and user-space clients in order to correctly marshal UBUF parameters and decide whether certain operations should be permitted.
Introduce an enum tee_object_invoke_origin to allow clients to indicate the context of the TEE object invocation, and add a kernel_ctx flag to the QCOMTEE context so the TEE back-end can track it.
Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com Reviewed-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com --- drivers/tee/qcomtee/call.c | 12 +++++++++--- drivers/tee/qcomtee/qcomtee_object.h | 8 ++++++-- drivers/tee/tee_core.c | 3 ++- include/linux/tee_core.h | 8 +++++++- 4 files changed, 24 insertions(+), 7 deletions(-)
diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c index 4a597eeaf174..3de54af45719 100644 --- a/drivers/tee/qcomtee/call.c +++ b/drivers/tee/qcomtee/call.c @@ -388,20 +388,26 @@ static int qcomtee_root_object_check(u32 op, struct tee_param *params, * @ctx: TEE context. * @arg: ioctl arguments. * @params: parameters for the object. + * @origin: origin of the object invocation (kernel or user-space). * * Return: On success, returns 0; on failure, returns < 0. */ static int qcomtee_object_invoke(struct tee_context *ctx, struct tee_ioctl_object_invoke_arg *arg, - struct tee_param *params) + struct tee_param *params, + enum tee_object_invoke_origin origin) { struct qcomtee_context_data *ctxdata = ctx->data; struct qcomtee_object *object; + bool kernel_ctx = false; int i, ret, result;
if (qcomtee_params_check(params, arg->num_params)) return -EINVAL;
+ if (origin == TEE_OBJECT_INVOKE_KERNEL) + kernel_ctx = true; + /* First, handle reserved operations: */ if (arg->op == QCOMTEE_MSG_OBJECT_OP_RELEASE) { del_qtee_object(arg->id, ctxdata); @@ -411,7 +417,7 @@ static int qcomtee_object_invoke(struct tee_context *ctx,
/* Otherwise, invoke a QTEE object: */ struct qcomtee_object_invoke_ctx *oic __free(kfree) = - qcomtee_object_invoke_ctx_alloc(ctx); + qcomtee_object_invoke_ctx_alloc(ctx, kernel_ctx); if (!oic) return -ENOMEM;
@@ -648,7 +654,7 @@ static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id, int result;
struct qcomtee_object_invoke_ctx *oic __free(kfree) = - qcomtee_object_invoke_ctx_alloc(ctx); + qcomtee_object_invoke_ctx_alloc(ctx, true); if (!oic) return;
diff --git a/drivers/tee/qcomtee/qcomtee_object.h b/drivers/tee/qcomtee/qcomtee_object.h index d5de02dcef3b..5f40617361fc 100644 --- a/drivers/tee/qcomtee/qcomtee_object.h +++ b/drivers/tee/qcomtee/qcomtee_object.h @@ -147,6 +147,7 @@ static inline int qcomtee_args_len(struct qcomtee_arg *args) * struct qcomtee_object_invoke_ctx - QTEE context for object invocation. * @ctx: TEE context for this invocation. * @flags: flags for the invocation context. + * @kernel_ctx: flag that indicates this context is owned by a kernel client. * @errno: error code for the invocation. * @object: current object invoked in this callback context. * @u: array of arguments for the current invocation (+1 for ending arg). @@ -159,6 +160,7 @@ static inline int qcomtee_args_len(struct qcomtee_arg *args) struct qcomtee_object_invoke_ctx { struct tee_context *ctx; unsigned long flags; + bool kernel_ctx; int errno;
struct qcomtee_object *object; @@ -173,13 +175,15 @@ struct qcomtee_object_invoke_ctx { };
static inline struct qcomtee_object_invoke_ctx * -qcomtee_object_invoke_ctx_alloc(struct tee_context *ctx) +qcomtee_object_invoke_ctx_alloc(struct tee_context *ctx, bool kernel_ctx) { struct qcomtee_object_invoke_ctx *oic;
oic = kzalloc_obj(*oic); - if (oic) + if (oic) { oic->ctx = ctx; + oic->kernel_ctx = kernel_ctx; + } return oic; }
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c index 1aac50c7c1de..30901390149c 100644 --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -701,7 +701,8 @@ static int tee_ioctl_object_invoke(struct tee_context *ctx, goto out; }
- rc = ctx->teedev->desc->ops->object_invoke_func(ctx, &arg, params); + rc = ctx->teedev->desc->ops->object_invoke_func(ctx, &arg, params, + TEE_OBJECT_INVOKE_USERSPACE); if (rc) goto out;
diff --git a/include/linux/tee_core.h b/include/linux/tee_core.h index f993d5118edd..bcb5418d6fdc 100644 --- a/include/linux/tee_core.h +++ b/include/linux/tee_core.h @@ -73,6 +73,11 @@ struct tee_device { struct tee_shm_pool *pool; };
+enum tee_object_invoke_origin { + TEE_OBJECT_INVOKE_USERSPACE, + TEE_OBJECT_INVOKE_KERNEL, +}; + /** * struct tee_driver_ops - driver operations vtable * @get_version: returns version of driver @@ -117,7 +122,8 @@ struct tee_driver_ops { struct tee_param *param); int (*object_invoke_func)(struct tee_context *ctx, struct tee_ioctl_object_invoke_arg *arg, - struct tee_param *param); + struct tee_param *param, + enum tee_object_invoke_origin origin); int (*cancel_req)(struct tee_context *ctx, u32 cancel_id, u32 session); int (*supp_recv)(struct tee_context *ctx, u32 *func, u32 *num_params, struct tee_param *param);
On 15-10-2026 17:09, Harshal Dev wrote:
QCOMTEE needs to distinguish between object invocations arriving from kernel clients and user-space clients in order to correctly marshal UBUF parameters and decide whether certain operations should be permitted.
Introduce an enum tee_object_invoke_origin to allow clients to indicate the context of the TEE object invocation, and add a kernel_ctx flag to the QCOMTEE context so the TEE back-end can track it.
Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com Reviewed-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com
Tested-by: Kuldeep Singh kuldeep.singh@oss.qualcomm.com #on Glymur-crd
From: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
Kernel clients can open a TEE context and invoke regular TA commands through tee_client_invoke_func(). However, there is currently no equivalent helper for invoking TEE objects.
Add tee_client_object_invoke_func() as a kernel client API for issuing object invocation requests. The helper checks that the backend provides object_invoke_func() before forwarding the request by setting the origin as TEE_OBJECT_INVOKE_KERNEL. This allows TEE backends to support privileged object-based calls from the kernel-space.
Co-developed-by: Harshal Dev harshal.dev@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com Reviewed-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com --- drivers/tee/tee_core.c | 12 ++++++++++++ include/linux/tee_drv.h | 13 +++++++++++++ 2 files changed, 25 insertions(+)
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c index 30901390149c..a03a3d645dd1 100644 --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -1404,6 +1404,18 @@ int tee_client_invoke_func(struct tee_context *ctx, } EXPORT_SYMBOL_GPL(tee_client_invoke_func);
+int tee_client_object_invoke_func(struct tee_context *ctx, + struct tee_ioctl_object_invoke_arg *arg, + struct tee_param *param) +{ + if (!ctx->teedev->desc->ops->object_invoke_func) + return -EINVAL; + + return ctx->teedev->desc->ops->object_invoke_func(ctx, arg, param, + TEE_OBJECT_INVOKE_KERNEL); +} +EXPORT_SYMBOL_GPL(tee_client_object_invoke_func); + int tee_client_cancel_req(struct tee_context *ctx, struct tee_ioctl_cancel_arg *arg) { diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h index f3c5e106d853..369c87ad0205 100644 --- a/include/linux/tee_drv.h +++ b/include/linux/tee_drv.h @@ -283,6 +283,19 @@ int tee_client_invoke_func(struct tee_context *ctx, struct tee_ioctl_invoke_arg *arg, struct tee_param *param);
+/** + * tee_client_object_invoke_func() - Invoke a TEE object from kernel space + * @ctx: TEE Context + * @arg: Invoke arguments, see description of + * struct tee_ioctl_object_invoke_arg + * @param: Parameters for the object invocation + * + * Return: On success, returns 0; on failure, returns < 0. + */ +int tee_client_object_invoke_func(struct tee_context *ctx, + struct tee_ioctl_object_invoke_arg *arg, + struct tee_param *param); + /** * tee_client_cancel_req() - Request cancellation of the previous open-session * or invoke-command operations in a Trusted Application
On 15-10-2026 17:09, Harshal Dev wrote:
From: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
Kernel clients can open a TEE context and invoke regular TA commands through tee_client_invoke_func(). However, there is currently no equivalent helper for invoking TEE objects.
Add tee_client_object_invoke_func() as a kernel client API for issuing object invocation requests. The helper checks that the backend provides object_invoke_func() before forwarding the request by setting the origin as TEE_OBJECT_INVOKE_KERNEL. This allows TEE backends to support privileged object-based calls from the kernel-space.
Co-developed-by: Harshal Dev harshal.dev@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com Reviewed-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
Tested-by: Kuldeep Singh kuldeep.singh@oss.qualcomm.com #on Glymur-crd
Hi Harshal,
On 10/15/2026 10:39 PM, Harshal Dev wrote:
From: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
Kernel clients can open a TEE context and invoke regular TA commands through tee_client_invoke_func(). However, there is currently no equivalent helper for invoking TEE objects.
Add tee_client_object_invoke_func() as a kernel client API for issuing object invocation requests. The helper checks that the backend provides object_invoke_func() before forwarding the request by setting the origin as TEE_OBJECT_INVOKE_KERNEL. This allows TEE backends to support privileged object-based calls from the kernel-space.
Co-developed-by: Harshal Dev harshal.dev@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com Reviewed-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
I did not notice this patch has my signed-off tag already. You can drop my Reviewed-by tag.
- Amir
drivers/tee/tee_core.c | 12 ++++++++++++ include/linux/tee_drv.h | 13 +++++++++++++ 2 files changed, 25 insertions(+)
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c index 30901390149c..a03a3d645dd1 100644 --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -1404,6 +1404,18 @@ int tee_client_invoke_func(struct tee_context *ctx, } EXPORT_SYMBOL_GPL(tee_client_invoke_func); +int tee_client_object_invoke_func(struct tee_context *ctx,
struct tee_ioctl_object_invoke_arg *arg,struct tee_param *param)+{
- if (!ctx->teedev->desc->ops->object_invoke_func)
return -EINVAL;- return ctx->teedev->desc->ops->object_invoke_func(ctx, arg, param,
TEE_OBJECT_INVOKE_KERNEL);+} +EXPORT_SYMBOL_GPL(tee_client_object_invoke_func);
int tee_client_cancel_req(struct tee_context *ctx, struct tee_ioctl_cancel_arg *arg) { diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h index f3c5e106d853..369c87ad0205 100644 --- a/include/linux/tee_drv.h +++ b/include/linux/tee_drv.h @@ -283,6 +283,19 @@ int tee_client_invoke_func(struct tee_context *ctx, struct tee_ioctl_invoke_arg *arg, struct tee_param *param); +/**
- tee_client_object_invoke_func() - Invoke a TEE object from kernel space
- @ctx: TEE Context
- @arg: Invoke arguments, see description of
struct tee_ioctl_object_invoke_arg
- @param: Parameters for the object invocation
- Return: On success, returns 0; on failure, returns < 0.
- */
+int tee_client_object_invoke_func(struct tee_context *ctx,
struct tee_ioctl_object_invoke_arg *arg,struct tee_param *param);/**
- tee_client_cancel_req() - Request cancellation of the previous open-session
- or invoke-command operations in a Trusted Application
Hi Amir,
On 26-10-2026 08:39 am, Amirreza Zarrabi wrote:
Hi Harshal,
On 10/15/2026 10:39 PM, Harshal Dev wrote:
From: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
Kernel clients can open a TEE context and invoke regular TA commands through tee_client_invoke_func(). However, there is currently no equivalent helper for invoking TEE objects.
Add tee_client_object_invoke_func() as a kernel client API for issuing object invocation requests. The helper checks that the backend provides object_invoke_func() before forwarding the request by setting the origin as TEE_OBJECT_INVOKE_KERNEL. This allows TEE backends to support privileged object-based calls from the kernel-space.
Co-developed-by: Harshal Dev harshal.dev@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com Reviewed-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
I did not notice this patch has my signed-off tag already. You can drop my Reviewed-by tag.
Makes sense, I did not notice this because b4 applied it automatically.
Ack.
Regards, Harshal
- Amir
From: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
QCOMTEE currently treats UBUF parameters as userspace addresses and applies userspace restrictions when invoking the root object. This is not suitable for object invocation requests issued by kernel clients.
Use the kernel_ctx flag to distinguish kernel client requests from userspace requests. For kernel contexts, do not mark UBUF parameters as user addresses, and allow permitted root-object operations to proceed without applying the userspace-only checks.
This allows in-kernel users of tee_client_object_invoke_func() to issue object invocation requests through the qcomtee backend.
Co-developed-by: Harshal Dev harshal.dev@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com Acked-by: Sumit Garg sumit.garg@oss.qualcomm.com Reviewed-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com --- drivers/tee/qcomtee/call.c | 38 ++++++++++++++++++++++++------------ drivers/tee/qcomtee/qcomtee_object.h | 5 +++-- include/linux/tee_drv.h | 5 ++++- 3 files changed, 32 insertions(+), 16 deletions(-)
diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c index 3de54af45719..c97afaa1b4aa 100644 --- a/drivers/tee/qcomtee/call.c +++ b/drivers/tee/qcomtee/call.c @@ -193,7 +193,7 @@ int qcomtee_objref_from_arg(struct tee_param *param, struct qcomtee_arg *arg, * @u: QTEE arguments. * @params: TEE parameters. * @num_params: number of elements in the parameter array. - * @ctx: context in which the conversion should happen. + * @oic: context to use for the current invocation. * * It assumes @u has at least @num_params + 1 entries and has been initialized * with %QCOMTEE_ARG_TYPE_INV as &struct qcomtee_arg.type. @@ -202,7 +202,7 @@ int qcomtee_objref_from_arg(struct tee_param *param, struct qcomtee_arg *arg, */ static int qcomtee_params_to_args(struct qcomtee_arg *u, struct tee_param *params, int num_params, - struct tee_context *ctx) + struct qcomtee_object_invoke_ctx *oic) { int i;
@@ -210,8 +210,14 @@ static int qcomtee_params_to_args(struct qcomtee_arg *u, switch (params[i].attr) { case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT: case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT: - u[i].flags = QCOMTEE_ARG_FLAGS_UADDR; - u[i].b.uaddr = params[i].u.ubuf.uaddr; + if (oic->kernel_ctx) { + u[i].flags = 0; + u[i].b.addr = params[i].u.ubuf.addr; + } else { + u[i].flags = QCOMTEE_ARG_FLAGS_UADDR; + u[i].b.uaddr = params[i].u.ubuf.uaddr; + } + u[i].b.size = params[i].u.ubuf.size;
if (params[i].attr == @@ -223,7 +229,7 @@ static int qcomtee_params_to_args(struct qcomtee_arg *u, break; case TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_INPUT: u[i].type = QCOMTEE_ARG_TYPE_IO; - if (qcomtee_objref_to_arg(&u[i], ¶ms[i], ctx)) + if (qcomtee_objref_to_arg(&u[i], ¶ms[i], oic->ctx)) goto out_failed;
break; @@ -260,7 +266,7 @@ static int qcomtee_params_to_args(struct qcomtee_arg *u, * @params: TEE parameters. * @u: QTEE arguments. * @num_params: number of elements in the parameter array. - * @ctx: context in which the conversion should happen. + * @oic: context to use for the current invocation. * * @u should have already been initialized by qcomtee_params_to_args(). * This also represents the end of a QTEE invocation that started with @@ -270,7 +276,7 @@ static int qcomtee_params_to_args(struct qcomtee_arg *u, */ static int qcomtee_params_from_args(struct tee_param *params, struct qcomtee_arg *u, int num_params, - struct tee_context *ctx) + struct qcomtee_object_invoke_ctx *oic) { int i, np;
@@ -288,7 +294,8 @@ static int qcomtee_params_from_args(struct tee_param *params, break; case QCOMTEE_ARG_TYPE_OO: /* TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_OUTPUT */ - if (qcomtee_objref_from_arg(¶ms[np], &u[np], ctx)) + if (qcomtee_objref_from_arg(¶ms[np], &u[np], + oic->ctx)) goto out_failed;
break; @@ -304,7 +311,7 @@ static int qcomtee_params_from_args(struct tee_param *params, /* Undo qcomtee_objref_from_arg(). */ for (i = 0; i < np; i++) { if (params[i].attr == TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_OUTPUT) - qcomtee_context_del_qtee_object(¶ms[i], ctx); + qcomtee_context_del_qtee_object(¶ms[i], oic->ctx); }
/* Release any IO and OO objects not processed. */ @@ -357,7 +364,8 @@ static int qcomtee_params_check(struct tee_param *params, int num_params) }
/* Check if an operation on ROOT_QCOMTEE_OBJECT from userspace is permitted. */ -static int qcomtee_root_object_check(u32 op, struct tee_param *params, +static int qcomtee_root_object_check(struct qcomtee_object_invoke_ctx *oic, + u32 op, struct tee_param *params, int num_params) { /* Some privileged operations recognized by QTEE. */ @@ -366,6 +374,9 @@ static int qcomtee_root_object_check(u32 op, struct tee_param *params, op == QCOMTEE_ROOT_OP_ADCI_SHUTDOWN) return -EINVAL;
+ if (oic->kernel_ctx) + return 0; + /* * QCOMTEE_ROOT_OP_REG_WITH_CREDENTIALS is to register with QTEE * by passing a credential object as input OBJREF. TEE_OBJREF_NULL as a @@ -430,7 +441,8 @@ static int qcomtee_object_invoke(struct tee_context *ctx, /* Get an object to invoke. */ if (arg->id == TEE_OBJREF_NULL) { /* Use ROOT if TEE_OBJREF_NULL is invoked. */ - if (qcomtee_root_object_check(arg->op, params, arg->num_params)) + if (qcomtee_root_object_check(oic, arg->op, params, + arg->num_params)) return -EINVAL;
object = ROOT_QCOMTEE_OBJECT; @@ -438,7 +450,7 @@ static int qcomtee_object_invoke(struct tee_context *ctx, return -EINVAL; }
- ret = qcomtee_params_to_args(u, params, arg->num_params, ctx); + ret = qcomtee_params_to_args(u, params, arg->num_params, oic); if (ret) goto out;
@@ -456,7 +468,7 @@ static int qcomtee_object_invoke(struct tee_context *ctx,
if (!result) { /* Assume service is UNAVAIL if unable to process the result. */ - if (qcomtee_params_from_args(params, u, arg->num_params, ctx)) + if (qcomtee_params_from_args(params, u, arg->num_params, oic)) result = QCOMTEE_MSG_ERROR_UNAVAIL; } else { /* diff --git a/drivers/tee/qcomtee/qcomtee_object.h b/drivers/tee/qcomtee/qcomtee_object.h index 5f40617361fc..a241ab657318 100644 --- a/drivers/tee/qcomtee/qcomtee_object.h +++ b/drivers/tee/qcomtee/qcomtee_object.h @@ -113,8 +113,9 @@ struct qcomtee_buffer { * @b: address and size if the type of argument is a buffer. * @o: object instance if the type of argument is an object. * - * &qcomtee_arg.flags only accepts %QCOMTEE_ARG_FLAGS_UADDR for now, which - * states that &qcomtee_arg.b contains a userspace address in uaddr. + * If %QCOMTEE_ARG_FLAGS_UADDR is set in &qcomtee_arg.flags then it implies + * that &qcomtee_arg.b contains a userspace address in uaddr. + * Otherwise, &qcomtee_arg.b contains a kernel address in addr. */ struct qcomtee_arg { enum qcomtee_arg_type type; diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h index 369c87ad0205..367208210a32 100644 --- a/include/linux/tee_drv.h +++ b/include/linux/tee_drv.h @@ -83,7 +83,10 @@ struct tee_param_memref { };
struct tee_param_ubuf { - void __user *uaddr; + union { + void *addr; + void __user *uaddr; + }; size_t size; };
On 15-10-2026 17:09, Harshal Dev wrote:
From: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
QCOMTEE currently treats UBUF parameters as userspace addresses and applies userspace restrictions when invoking the root object. This is not suitable for object invocation requests issued by kernel clients.
Use the kernel_ctx flag to distinguish kernel client requests from userspace requests. For kernel contexts, do not mark UBUF parameters as user addresses, and allow permitted root-object operations to proceed without applying the userspace-only checks.
This allows in-kernel users of tee_client_object_invoke_func() to issue object invocation requests through the qcomtee backend.
Co-developed-by: Harshal Dev harshal.dev@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com Acked-by: Sumit Garg sumit.garg@oss.qualcomm.com Reviewed-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
Tested-by: Kuldeep Singh kuldeep.singh@oss.qualcomm.com #on Glymur-crd
Hi Harshal,
On 10/15/2026 10:39 PM, Harshal Dev wrote:
From: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
QCOMTEE currently treats UBUF parameters as userspace addresses and applies userspace restrictions when invoking the root object. This is not suitable for object invocation requests issued by kernel clients.
Use the kernel_ctx flag to distinguish kernel client requests from userspace requests. For kernel contexts, do not mark UBUF parameters as user addresses, and allow permitted root-object operations to proceed without applying the userspace-only checks.
This allows in-kernel users of tee_client_object_invoke_func() to issue object invocation requests through the qcomtee backend.
Co-developed-by: Harshal Dev harshal.dev@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com Acked-by: Sumit Garg sumit.garg@oss.qualcomm.com Reviewed-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
Same here.
- Amir
drivers/tee/qcomtee/call.c | 38 ++++++++++++++++++++++++------------ drivers/tee/qcomtee/qcomtee_object.h | 5 +++-- include/linux/tee_drv.h | 5 ++++- 3 files changed, 32 insertions(+), 16 deletions(-)
diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c index 3de54af45719..c97afaa1b4aa 100644 --- a/drivers/tee/qcomtee/call.c +++ b/drivers/tee/qcomtee/call.c @@ -193,7 +193,7 @@ int qcomtee_objref_from_arg(struct tee_param *param, struct qcomtee_arg *arg,
- @u: QTEE arguments.
- @params: TEE parameters.
- @num_params: number of elements in the parameter array.
- @ctx: context in which the conversion should happen.
- @oic: context to use for the current invocation.
- It assumes @u has at least @num_params + 1 entries and has been initialized
- with %QCOMTEE_ARG_TYPE_INV as &struct qcomtee_arg.type.
@@ -202,7 +202,7 @@ int qcomtee_objref_from_arg(struct tee_param *param, struct qcomtee_arg *arg, */ static int qcomtee_params_to_args(struct qcomtee_arg *u, struct tee_param *params, int num_params,
struct tee_context *ctx)
struct qcomtee_object_invoke_ctx *oic){ int i; @@ -210,8 +210,14 @@ static int qcomtee_params_to_args(struct qcomtee_arg *u, switch (params[i].attr) { case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT: case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT:
u[i].flags = QCOMTEE_ARG_FLAGS_UADDR;u[i].b.uaddr = params[i].u.ubuf.uaddr;
if (oic->kernel_ctx) {u[i].flags = 0;u[i].b.addr = params[i].u.ubuf.addr;} else {u[i].flags = QCOMTEE_ARG_FLAGS_UADDR;u[i].b.uaddr = params[i].u.ubuf.uaddr;}u[i].b.size = params[i].u.ubuf.size;if (params[i].attr == @@ -223,7 +229,7 @@ static int qcomtee_params_to_args(struct qcomtee_arg *u, break; case TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_INPUT: u[i].type = QCOMTEE_ARG_TYPE_IO;
if (qcomtee_objref_to_arg(&u[i], ¶ms[i], ctx))
if (qcomtee_objref_to_arg(&u[i], ¶ms[i], oic->ctx)) goto out_failed;break; @@ -260,7 +266,7 @@ static int qcomtee_params_to_args(struct qcomtee_arg *u,
- @params: TEE parameters.
- @u: QTEE arguments.
- @num_params: number of elements in the parameter array.
- @ctx: context in which the conversion should happen.
- @oic: context to use for the current invocation.
- @u should have already been initialized by qcomtee_params_to_args().
- This also represents the end of a QTEE invocation that started with
@@ -270,7 +276,7 @@ static int qcomtee_params_to_args(struct qcomtee_arg *u, */ static int qcomtee_params_from_args(struct tee_param *params, struct qcomtee_arg *u, int num_params,
struct tee_context *ctx)
struct qcomtee_object_invoke_ctx *oic){ int i, np; @@ -288,7 +294,8 @@ static int qcomtee_params_from_args(struct tee_param *params, break; case QCOMTEE_ARG_TYPE_OO: /* TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_OUTPUT */
if (qcomtee_objref_from_arg(¶ms[np], &u[np], ctx))
if (qcomtee_objref_from_arg(¶ms[np], &u[np],oic->ctx)) goto out_failed;break; @@ -304,7 +311,7 @@ static int qcomtee_params_from_args(struct tee_param *params, /* Undo qcomtee_objref_from_arg(). */ for (i = 0; i < np; i++) { if (params[i].attr == TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_OUTPUT)
qcomtee_context_del_qtee_object(¶ms[i], ctx);
qcomtee_context_del_qtee_object(¶ms[i], oic->ctx);/* Release any IO and OO objects not processed. */ @@ -357,7 +364,8 @@ static int qcomtee_params_check(struct tee_param *params, int num_params) } /* Check if an operation on ROOT_QCOMTEE_OBJECT from userspace is permitted. */ -static int qcomtee_root_object_check(u32 op, struct tee_param *params, +static int qcomtee_root_object_check(struct qcomtee_object_invoke_ctx *oic,
u32 op, struct tee_param *params, int num_params){ /* Some privileged operations recognized by QTEE. */ @@ -366,6 +374,9 @@ static int qcomtee_root_object_check(u32 op, struct tee_param *params, op == QCOMTEE_ROOT_OP_ADCI_SHUTDOWN) return -EINVAL;
- if (oic->kernel_ctx)
return 0;- /*
- QCOMTEE_ROOT_OP_REG_WITH_CREDENTIALS is to register with QTEE
- by passing a credential object as input OBJREF. TEE_OBJREF_NULL as a
@@ -430,7 +441,8 @@ static int qcomtee_object_invoke(struct tee_context *ctx, /* Get an object to invoke. */ if (arg->id == TEE_OBJREF_NULL) { /* Use ROOT if TEE_OBJREF_NULL is invoked. */
if (qcomtee_root_object_check(arg->op, params, arg->num_params))
if (qcomtee_root_object_check(oic, arg->op, params,arg->num_params)) return -EINVAL;object = ROOT_QCOMTEE_OBJECT; @@ -438,7 +450,7 @@ static int qcomtee_object_invoke(struct tee_context *ctx, return -EINVAL; }
- ret = qcomtee_params_to_args(u, params, arg->num_params, ctx);
- ret = qcomtee_params_to_args(u, params, arg->num_params, oic); if (ret) goto out;
@@ -456,7 +468,7 @@ static int qcomtee_object_invoke(struct tee_context *ctx, if (!result) { /* Assume service is UNAVAIL if unable to process the result. */
if (qcomtee_params_from_args(params, u, arg->num_params, ctx))
if (qcomtee_params_from_args(params, u, arg->num_params, oic)) result = QCOMTEE_MSG_ERROR_UNAVAIL;diff --git a/drivers/tee/qcomtee/qcomtee_object.h b/drivers/tee/qcomtee/qcomtee_object.h index 5f40617361fc..a241ab657318 100644 --- a/drivers/tee/qcomtee/qcomtee_object.h +++ b/drivers/tee/qcomtee/qcomtee_object.h @@ -113,8 +113,9 @@ struct qcomtee_buffer {
- @b: address and size if the type of argument is a buffer.
- @o: object instance if the type of argument is an object.
- &qcomtee_arg.flags only accepts %QCOMTEE_ARG_FLAGS_UADDR for now, which
- states that &qcomtee_arg.b contains a userspace address in uaddr.
- If %QCOMTEE_ARG_FLAGS_UADDR is set in &qcomtee_arg.flags then it implies
- that &qcomtee_arg.b contains a userspace address in uaddr.
*/
- Otherwise, &qcomtee_arg.b contains a kernel address in addr.
struct qcomtee_arg { enum qcomtee_arg_type type; diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h index 369c87ad0205..367208210a32 100644 --- a/include/linux/tee_drv.h +++ b/include/linux/tee_drv.h @@ -83,7 +83,10 @@ struct tee_param_memref { }; struct tee_param_ubuf {
- void __user *uaddr;
- union {
void *addr;void __user *uaddr;- }; size_t size;
};
Hi Amir,
On 26-10-2026 08:45 am, Amirreza Zarrabi wrote:
Hi Harshal,
On 10/15/2026 10:39 PM, Harshal Dev wrote:
From: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
QCOMTEE currently treats UBUF parameters as userspace addresses and applies userspace restrictions when invoking the root object. This is not suitable for object invocation requests issued by kernel clients.
Use the kernel_ctx flag to distinguish kernel client requests from userspace requests. For kernel contexts, do not mark UBUF parameters as user addresses, and allow permitted root-object operations to proceed without applying the userspace-only checks.
This allows in-kernel users of tee_client_object_invoke_func() to issue object invocation requests through the qcomtee backend.
Co-developed-by: Harshal Dev harshal.dev@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com Acked-by: Sumit Garg sumit.garg@oss.qualcomm.com Reviewed-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com
Same here.
Ack.
Regards, Harshal
- Amir
Export the uuidv5() function defined in the TEE core to all TEE backends. This enables the TEE backend drivers to generate a UUID for identifying and registering their secure services on the TEE bus.
Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com Reviewed-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com --- drivers/tee/tee_core.c | 19 ++++--------------- include/linux/tee_core.h | 15 +++++++++++++++ 2 files changed, 19 insertions(+), 15 deletions(-)
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c index a03a3d645dd1..2d678d414edb 100644 --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -134,20 +134,8 @@ static int tee_release(struct inode *inode, struct file *filp) return 0; }
-/** - * uuid_v5() - Calculate UUIDv5 - * @uuid: Resulting UUID - * @ns: Name space ID for UUIDv5 function - * @name: Name for UUIDv5 function - * @size: Size of name - * - * UUIDv5 is specific in RFC 4122. - * - * This implements section (for SHA-1): - * 4.3. Algorithm for Creating a Name-Based UUID - */ -static void uuid_v5(uuid_t *uuid, const uuid_t *ns, const void *name, - size_t size) +void tee_generate_uuid_v5(uuid_t *uuid, const uuid_t *ns, const void *name, + size_t size) { unsigned char hash[SHA1_DIGEST_SIZE]; struct sha1_ctx ctx; @@ -163,6 +151,7 @@ static void uuid_v5(uuid_t *uuid, const uuid_t *ns, const void *name, uuid->b[6] = (hash[6] & 0x0F) | 0x50; uuid->b[8] = (hash[8] & 0x3F) | 0x80; } +EXPORT_SYMBOL_GPL(tee_generate_uuid_v5);
int tee_session_calc_client_uuid(uuid_t *uuid, u32 connection_method, const u8 connection_data[TEE_IOCTL_UUID_LEN]) @@ -228,7 +217,7 @@ int tee_session_calc_client_uuid(uuid_t *uuid, u32 connection_method, goto out_free_name; }
- uuid_v5(uuid, &tee_client_uuid_ns, name, name_len); + tee_generate_uuid_v5(uuid, &tee_client_uuid_ns, name, name_len); out_free_name: kfree(name);
diff --git a/include/linux/tee_core.h b/include/linux/tee_core.h index bcb5418d6fdc..a3f4f88b8423 100644 --- a/include/linux/tee_core.h +++ b/include/linux/tee_core.h @@ -272,6 +272,21 @@ void tee_device_set_dev_groups(struct tee_device *teedev, int tee_session_calc_client_uuid(uuid_t *uuid, u32 connection_method, const u8 connection_data[TEE_IOCTL_UUID_LEN]);
+/** + * tee_generate_uuid_v5() - Calculate UUIDv5 + * @uuid: Resulting UUID + * @ns: Name space ID for UUIDv5 function + * @name: Name for UUIDv5 function + * @size: Size of name + * + * UUIDv5 is specific in RFC 4122. + * + * This implements section (for SHA-1): + * 4.3. Algorithm for Creating a Name-Based UUID + */ +void tee_generate_uuid_v5(uuid_t *uuid, const uuid_t *ns, const void *name, + size_t size); + /** * struct tee_shm_pool - shared memory pool * @ops: operations
On 15-10-2026 17:09, Harshal Dev wrote:
Export the uuidv5() function defined in the TEE core to all TEE backends. This enables the TEE backend drivers to generate a UUID for identifying and registering their secure services on the TEE bus.
Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com Reviewed-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com
Tested-by: Kuldeep Singh kuldeep.singh@oss.qualcomm.com #on Glymur-crd
QTEE exposes certain secure services implemented either within the QTEE kernel or via pre-loaded Trusted Applications (TAs). Such always-available services can be readily accessed by TEE client drivers via QTEE's object-IPC protocol if the service is registered as a device on the TEE bus.
One such service is the EFI-variables service, implemented by the uefisecapp TA which enables kernel clients to access EFI variables at runtime.
Maintain a static list of such always-available secure services and add support for the QCOMTEE driver to register these services as devices on the TEE bus during probe.
Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com --- drivers/tee/qcomtee/call.c | 160 ++++++++++++++++++++++++++++++++++- drivers/tee/qcomtee/core.c | 9 +- drivers/tee/qcomtee/qcomtee.h | 10 +++ drivers/tee/qcomtee/qcomtee_msg.h | 1 + drivers/tee/qcomtee/qcomtee_object.h | 3 +- 5 files changed, 176 insertions(+), 7 deletions(-)
diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c index c97afaa1b4aa..47d8a4f9a159 100644 --- a/drivers/tee/qcomtee/call.c +++ b/drivers/tee/qcomtee/call.c @@ -676,9 +676,13 @@ static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id,
/* Get ''FeatureVersions Service'' object. */ service = qcomtee_object_get_service(oic, client_env, - QCOMTEE_FEATURE_VER_UID); - if (service == NULL_QCOMTEE_OBJECT) + QCOMTEE_FEATURE_VER_UID, + &result); + if (service == NULL_QCOMTEE_OBJECT) { + if (result) + pr_err("FeatureVersions Service unavailable (%d)\n", result); goto out_failed; + }
/* IB: Feature to query. */ u[0].b.addr = &id; @@ -698,6 +702,155 @@ static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id, qcomtee_object_put(client_env); }
+/** + * is_qcomtee_service_available() - Check if the QTEE service identified by the UID + * is available. + * @oic: context to use for the current invocation. + * @client_env: Client environment object. + * @service_name: Name of the QTEE service. + * @uid: 32-bit UID of the service. + * + * Returns true if the service exists and is available. + * Returns false if a service is not exposed by QTEE. + */ +static bool is_qcomtee_service_available(struct qcomtee_object_invoke_ctx *oic, + struct qcomtee_object *client_env, + const char *service_name, u32 uid) +{ + struct qcomtee_object *service; + int error = 0; + bool ret = false; + + /* Get service object corresponding to the uid. */ + service = qcomtee_object_get_service(oic, client_env, uid, &error); + if (service != NULL_QCOMTEE_OBJECT) { + qcomtee_object_put(service); + ret = true; + } + + /* When we fail to get the service, QTEE provides the reason. */ + if (error) + pr_debug("%s is unavailable (%d)\n", service_name, error); + + return ret; +} + +/* + * QTEE Service UUID name space identifier + * + * A random UUID that is allocated as a name space identifier for forming UUID's + * representing secure services exposed by QTEE. + */ +static const uuid_t qtee_service_uuid_ns = UUID_INIT(0xe1b48857, 0x6154, 0x49f9, + 0x93, 0x4e, 0xa2, 0xf2, + 0x0a, 0xba, 0x98, 0x42); + +static const struct qtee_service qtee_services[] = { + { "qcom.tz.uefisecapp", + QCOMTEE_UEFI_SEC_UID } +}; + +static void qtee_release_service(struct device *dev) +{ + struct tee_client_device *qtee_service = to_tee_client_device(dev); + + kfree(qtee_service); +} + +/** + * qtee_register_service() - Register a given QTEE service on the TEE bus as a + * TEE client device. + * @oic: context to use for the current invocation. + * @client_env: Client environment object. + * @service_name: Name of the QTEE service to be enumerated. + * @uid: 32-bit UID used by QTEE to identify the service. + * + * Returns 0 on success and < 0 on failure. + */ +static int qtee_register_service(struct qcomtee_object_invoke_ctx *oic, + struct qcomtee_object *client_env, + const char *service_name, + const u32 uid) +{ + struct tee_client_device *qtee_service; + uuid_t service_uuid; + int rc; + + if (!is_qcomtee_service_available(oic, client_env, service_name, uid)) + return -EOPNOTSUPP; + + tee_generate_uuid_v5(&service_uuid, &qtee_service_uuid_ns, service_name, + strlen(service_name)); + + qtee_service = kzalloc_obj(*qtee_service); + if (!qtee_service) + return -ENOMEM; + + qtee_service->dev.bus = &tee_bus_type; + qtee_service->dev.release = qtee_release_service; + if (dev_set_name(&qtee_service->dev, "qtee-svc-%pUb", &service_uuid)) { + kfree(qtee_service); + return -ENOMEM; + } + uuid_copy(&qtee_service->id.uuid, &service_uuid); + + rc = device_register(&qtee_service->dev); + if (rc) { + pr_err("QTEE service registration failed, err: %d\n", rc); + put_device(&qtee_service->dev); + return rc; + } + + return 0; +} + +/** + * qtee_register_services() - Register the secure services exposed by QTEE + * as mentioned in 'qtee_services' list. + * @ctx: TEE context. + * + * Not all versions of QTEE support a given service. Hence, we try to + * enumerate as many services from the 'qtee_services' list as possible. + * Not being able to enumerate a service shouldn't cause the driver probe + * to fail since none of the services in the list are mandatory for + * establishing communication with QTEE. + */ +static void qtee_register_services(struct tee_context *ctx) +{ + u32 idx; + struct qcomtee_object *client_env; + + struct qcomtee_object_invoke_ctx *oic __free(kfree) = + qcomtee_object_invoke_ctx_alloc(ctx, true); + if (!oic) + return; + + client_env = qcomtee_object_get_client_env(oic); + if (client_env == NULL_QCOMTEE_OBJECT) + return; + + for (idx = 0; idx < ARRAY_SIZE(qtee_services); idx++) + qtee_register_service(oic, client_env, + qtee_services[idx].name, + qtee_services[idx].uid); + + qcomtee_object_put(client_env); +} + +static int qtee_unregister_service(struct device *dev, void *data) +{ + if (!strncmp(dev_name(dev), "qtee-svc", strlen("qtee-svc"))) + device_unregister(dev); + + return 0; +} + +static void qtee_unregister_services(void) +{ + bus_for_each_dev(&tee_bus_type, NULL, NULL, + qtee_unregister_service); +} + static const struct tee_driver_ops qcomtee_ops = { .get_version = qcomtee_get_version, .open = qcomtee_open, @@ -779,6 +932,8 @@ static int qcomtee_probe(struct platform_device *pdev) QTEE_VERSION_GET_MINOR(qcomtee->qtee_version), QTEE_VERSION_GET_PATCH(qcomtee->qtee_version));
+ qtee_register_services(qcomtee->ctx); + return 0;
err_dest_wq: @@ -808,6 +963,7 @@ static void qcomtee_remove(struct platform_device *pdev) { struct qcomtee *qcomtee = platform_get_drvdata(pdev);
+ qtee_unregister_services(); teedev_close_context(qcomtee->ctx); /* Wait for RELEASE operations to be processed for QTEE objects. */ tee_device_unregister(qcomtee->teedev); diff --git a/drivers/tee/qcomtee/core.c b/drivers/tee/qcomtee/core.c index 60fe3b5776e3..4a523a95bf0e 100644 --- a/drivers/tee/qcomtee/core.c +++ b/drivers/tee/qcomtee/core.c @@ -898,19 +898,20 @@ qcomtee_object_get_client_env(struct qcomtee_object_invoke_ctx *oic)
struct qcomtee_object * qcomtee_object_get_service(struct qcomtee_object_invoke_ctx *oic, - struct qcomtee_object *client_env, u32 uid) + struct qcomtee_object *client_env, u32 uid, + int *result) { struct qcomtee_arg u[3] = { 0 }; - int ret, result; + int ret;
u[0].b.addr = &uid; u[0].b.size = sizeof(uid); u[0].type = QCOMTEE_ARG_TYPE_IB; u[1].type = QCOMTEE_ARG_TYPE_OO; ret = qcomtee_object_do_invoke(oic, client_env, QCOMTEE_CLIENT_ENV_OPEN, - u, &result); + u, result);
- if (ret || result) + if (ret || *result) return NULL_QCOMTEE_OBJECT;
return u[1].o; diff --git a/drivers/tee/qcomtee/qcomtee.h b/drivers/tee/qcomtee/qcomtee.h index f39bf63fd1c2..b1fe1d317150 100644 --- a/drivers/tee/qcomtee/qcomtee.h +++ b/drivers/tee/qcomtee/qcomtee.h @@ -39,6 +39,16 @@ struct qcomtee { u32 qtee_version; };
+/** + * struct qtee_service - A secure service exposed by QTEE identified by a 32-bit UID. + * @name: Name of the QTEE service. + * @uid: 32-bit UID used by QTEE to identify the service. + */ +struct qtee_service { + const char *name; + const u32 uid; +}; + void qcomtee_fetch_async_reqs(struct qcomtee_object_invoke_ctx *oic); struct qcomtee_object *qcomtee_idx_erase(struct qcomtee_object_invoke_ctx *oic, u32 idx); diff --git a/drivers/tee/qcomtee/qcomtee_msg.h b/drivers/tee/qcomtee/qcomtee_msg.h index 5d7b21fdd368..9278a361dc70 100644 --- a/drivers/tee/qcomtee/qcomtee_msg.h +++ b/drivers/tee/qcomtee/qcomtee_msg.h @@ -105,6 +105,7 @@ union qcomtee_msg_arg { #define QTEE_VERSION_GET_MINOR(x) (((x) >> 12) & 0xffU) #define QTEE_VERSION_GET_PATCH(x) ((x) >> 0 & 0xfffU)
+#define QCOMTEE_UEFI_SEC_UID 413 /* Response types as returned from qcomtee_object_invoke_ctx_invoke(). */
/* The message contains a callback request. */ diff --git a/drivers/tee/qcomtee/qcomtee_object.h b/drivers/tee/qcomtee/qcomtee_object.h index a241ab657318..e2f2508aad8f 100644 --- a/drivers/tee/qcomtee/qcomtee_object.h +++ b/drivers/tee/qcomtee/qcomtee_object.h @@ -317,6 +317,7 @@ qcomtee_object_get_client_env(struct qcomtee_object_invoke_ctx *oic);
struct qcomtee_object * qcomtee_object_get_service(struct qcomtee_object_invoke_ctx *oic, - struct qcomtee_object *client_env, u32 uid); + struct qcomtee_object *client_env, u32 uid, + int *result);
#endif /* QCOMTEE_OBJECT_H */
On 15-10-2026 17:09, Harshal Dev wrote:
QTEE exposes certain secure services implemented either within the QTEE kernel or via pre-loaded Trusted Applications (TAs). Such always-available services can be readily accessed by TEE client drivers via QTEE's object-IPC protocol if the service is registered as a device on the TEE bus.
One such service is the EFI-variables service, implemented by the uefisecapp TA which enables kernel clients to access EFI variables at runtime.
Maintain a static list of such always-available secure services and add support for the QCOMTEE driver to register these services as devices on the TEE bus during probe.
Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com
Tested-by: Kuldeep Singh kuldeep.singh@oss.qualcomm.com #on Glymur-crd
Hi Harshal,
On 10/15/2026 10:39 PM, Harshal Dev wrote:
QTEE exposes certain secure services implemented either within the QTEE kernel or via pre-loaded Trusted Applications (TAs). Such always-available services can be readily accessed by TEE client drivers via QTEE's object-IPC protocol if the service is registered as a device on the TEE bus.
One such service is the EFI-variables service, implemented by the uefisecapp TA which enables kernel clients to access EFI variables at runtime.
Maintain a static list of such always-available secure services and add support for the QCOMTEE driver to register these services as devices on the TEE bus during probe.
Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com
drivers/tee/qcomtee/call.c | 160 ++++++++++++++++++++++++++++++++++- drivers/tee/qcomtee/core.c | 9 +- drivers/tee/qcomtee/qcomtee.h | 10 +++ drivers/tee/qcomtee/qcomtee_msg.h | 1 + drivers/tee/qcomtee/qcomtee_object.h | 3 +- 5 files changed, 176 insertions(+), 7 deletions(-)
diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c index c97afaa1b4aa..47d8a4f9a159 100644 --- a/drivers/tee/qcomtee/call.c +++ b/drivers/tee/qcomtee/call.c @@ -676,9 +676,13 @@ static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id, /* Get ''FeatureVersions Service'' object. */ service = qcomtee_object_get_service(oic, client_env,
QCOMTEE_FEATURE_VER_UID);- if (service == NULL_QCOMTEE_OBJECT)
QCOMTEE_FEATURE_VER_UID,&result);- if (service == NULL_QCOMTEE_OBJECT) {
if (result)pr_err("FeatureVersions Service unavailable (%d)\n", result);- }
/* IB: Feature to query. */ u[0].b.addr = &id; @@ -698,6 +702,155 @@ static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id, qcomtee_object_put(client_env); } +/**
- is_qcomtee_service_available() - Check if the QTEE service identified by the UID
- is available.
- @oic: context to use for the current invocation.
- @client_env: Client environment object.
- @service_name: Name of the QTEE service.
- @uid: 32-bit UID of the service.
- Returns true if the service exists and is available.
- Returns false if a service is not exposed by QTEE.
- */
+static bool is_qcomtee_service_available(struct qcomtee_object_invoke_ctx *oic,
struct qcomtee_object *client_env,const char *service_name, u32 uid)+{
- struct qcomtee_object *service;
- int error = 0;
- bool ret = false;
- /* Get service object corresponding to the uid. */
- service = qcomtee_object_get_service(oic, client_env, uid, &error);
- if (service != NULL_QCOMTEE_OBJECT) {
qcomtee_object_put(service);ret = true;- }
- /* When we fail to get the service, QTEE provides the reason. */
- if (error)
pr_debug("%s is unavailable (%d)\n", service_name, error);- return ret;
+}
+/*
- QTEE Service UUID name space identifier
- A random UUID that is allocated as a name space identifier for forming UUID's
- representing secure services exposed by QTEE.
- */
+static const uuid_t qtee_service_uuid_ns = UUID_INIT(0xe1b48857, 0x6154, 0x49f9,
0x93, 0x4e, 0xa2, 0xf2,0x0a, 0xba, 0x98, 0x42);+static const struct qtee_service qtee_services[] = {
- { "qcom.tz.uefisecapp",
QCOMTEE_UEFI_SEC_UID }+};
+static void qtee_release_service(struct device *dev) +{
- struct tee_client_device *qtee_service = to_tee_client_device(dev);
- kfree(qtee_service);
+}
+/**
- qtee_register_service() - Register a given QTEE service on the TEE bus as a
- TEE client device.
- @oic: context to use for the current invocation.
- @client_env: Client environment object.
- @service_name: Name of the QTEE service to be enumerated.
- @uid: 32-bit UID used by QTEE to identify the service.
- Returns 0 on success and < 0 on failure.
- */
+static int qtee_register_service(struct qcomtee_object_invoke_ctx *oic,
struct qcomtee_object *client_env,const char *service_name,const u32 uid)+{
- struct tee_client_device *qtee_service;
- uuid_t service_uuid;
- int rc;
- if (!is_qcomtee_service_available(oic, client_env, service_name, uid))
return -EOPNOTSUPP;- tee_generate_uuid_v5(&service_uuid, &qtee_service_uuid_ns, service_name,
strlen(service_name));- qtee_service = kzalloc_obj(*qtee_service);
- if (!qtee_service)
return -ENOMEM;- qtee_service->dev.bus = &tee_bus_type;
- qtee_service->dev.release = qtee_release_service;
- if (dev_set_name(&qtee_service->dev, "qtee-svc-%pUb", &service_uuid)) {
kfree(qtee_service);return -ENOMEM;- }
- uuid_copy(&qtee_service->id.uuid, &service_uuid);
- rc = device_register(&qtee_service->dev);
- if (rc) {
pr_err("QTEE service registration failed, err: %d\n", rc);put_device(&qtee_service->dev);return rc;- }
- return 0;
+}
+/**
- qtee_register_services() - Register the secure services exposed by QTEE
- as mentioned in 'qtee_services' list.
- @ctx: TEE context.
- Not all versions of QTEE support a given service. Hence, we try to
- enumerate as many services from the 'qtee_services' list as possible.
- Not being able to enumerate a service shouldn't cause the driver probe
- to fail since none of the services in the list are mandatory for
- establishing communication with QTEE.
- */
+static void qtee_register_services(struct tee_context *ctx) +{
- u32 idx;
- struct qcomtee_object *client_env;
- struct qcomtee_object_invoke_ctx *oic __free(kfree) =
qcomtee_object_invoke_ctx_alloc(ctx, true);- if (!oic)
return;- client_env = qcomtee_object_get_client_env(oic);
- if (client_env == NULL_QCOMTEE_OBJECT)
return;- for (idx = 0; idx < ARRAY_SIZE(qtee_services); idx++)
qtee_register_service(oic, client_env,qtee_services[idx].name,qtee_services[idx].uid);- qcomtee_object_put(client_env);
+}
+static int qtee_unregister_service(struct device *dev, void *data) +{
- if (!strncmp(dev_name(dev), "qtee-svc", strlen("qtee-svc")))
device_unregister(dev);- return 0;
+}
+static void qtee_unregister_services(void) +{
- bus_for_each_dev(&tee_bus_type, NULL, NULL,
qtee_unregister_service);+}
static const struct tee_driver_ops qcomtee_ops = { .get_version = qcomtee_get_version, .open = qcomtee_open, @@ -779,6 +932,8 @@ static int qcomtee_probe(struct platform_device *pdev) QTEE_VERSION_GET_MINOR(qcomtee->qtee_version), QTEE_VERSION_GET_PATCH(qcomtee->qtee_version));
- qtee_register_services(qcomtee->ctx);
- return 0;
err_dest_wq: @@ -808,6 +963,7 @@ static void qcomtee_remove(struct platform_device *pdev) { struct qcomtee *qcomtee = platform_get_drvdata(pdev);
- qtee_unregister_services(); teedev_close_context(qcomtee->ctx); /* Wait for RELEASE operations to be processed for QTEE objects. */ tee_device_unregister(qcomtee->teedev);
diff --git a/drivers/tee/qcomtee/core.c b/drivers/tee/qcomtee/core.c index 60fe3b5776e3..4a523a95bf0e 100644 --- a/drivers/tee/qcomtee/core.c +++ b/drivers/tee/qcomtee/core.c @@ -898,19 +898,20 @@ qcomtee_object_get_client_env(struct qcomtee_object_invoke_ctx *oic) struct qcomtee_object * qcomtee_object_get_service(struct qcomtee_object_invoke_ctx *oic,
struct qcomtee_object *client_env, u32 uid)
struct qcomtee_object *client_env, u32 uid,int *result){ struct qcomtee_arg u[3] = { 0 };
- int ret, result;
- int ret;
Please initialize *result, otherwise for instance, on mem allocation failure, qcomtee_object_do_invoke returns with errno. The caller checks the return value + result and may print garbage.
- Amir
u[0].b.addr = &uid; u[0].b.size = sizeof(uid); u[0].type = QCOMTEE_ARG_TYPE_IB; u[1].type = QCOMTEE_ARG_TYPE_OO; ret = qcomtee_object_do_invoke(oic, client_env, QCOMTEE_CLIENT_ENV_OPEN,
u, &result);
u, result);
- if (ret || result)
- if (ret || *result) return NULL_QCOMTEE_OBJECT;
return u[1].o; diff --git a/drivers/tee/qcomtee/qcomtee.h b/drivers/tee/qcomtee/qcomtee.h index f39bf63fd1c2..b1fe1d317150 100644 --- a/drivers/tee/qcomtee/qcomtee.h +++ b/drivers/tee/qcomtee/qcomtee.h @@ -39,6 +39,16 @@ struct qcomtee { u32 qtee_version; }; +/**
- struct qtee_service - A secure service exposed by QTEE identified by a 32-bit UID.
- @name: Name of the QTEE service.
- @uid: 32-bit UID used by QTEE to identify the service.
- */
+struct qtee_service {
- const char *name;
- const u32 uid;
+};
void qcomtee_fetch_async_reqs(struct qcomtee_object_invoke_ctx *oic); struct qcomtee_object *qcomtee_idx_erase(struct qcomtee_object_invoke_ctx *oic, u32 idx); diff --git a/drivers/tee/qcomtee/qcomtee_msg.h b/drivers/tee/qcomtee/qcomtee_msg.h index 5d7b21fdd368..9278a361dc70 100644 --- a/drivers/tee/qcomtee/qcomtee_msg.h +++ b/drivers/tee/qcomtee/qcomtee_msg.h @@ -105,6 +105,7 @@ union qcomtee_msg_arg { #define QTEE_VERSION_GET_MINOR(x) (((x) >> 12) & 0xffU) #define QTEE_VERSION_GET_PATCH(x) ((x) >> 0 & 0xfffU) +#define QCOMTEE_UEFI_SEC_UID 413 /* Response types as returned from qcomtee_object_invoke_ctx_invoke(). */ /* The message contains a callback request. */ diff --git a/drivers/tee/qcomtee/qcomtee_object.h b/drivers/tee/qcomtee/qcomtee_object.h index a241ab657318..e2f2508aad8f 100644 --- a/drivers/tee/qcomtee/qcomtee_object.h +++ b/drivers/tee/qcomtee/qcomtee_object.h @@ -317,6 +317,7 @@ qcomtee_object_get_client_env(struct qcomtee_object_invoke_ctx *oic); struct qcomtee_object * qcomtee_object_get_service(struct qcomtee_object_invoke_ctx *oic,
struct qcomtee_object *client_env, u32 uid);
struct qcomtee_object *client_env, u32 uid,int *result);#endif /* QCOMTEE_OBJECT_H */
Hi Amir,
On 26-10-2026 09:21 am, Amirreza Zarrabi wrote:
Hi Harshal,
On 10/15/2026 10:39 PM, Harshal Dev wrote:
QTEE exposes certain secure services implemented either within the QTEE kernel or via pre-loaded Trusted Applications (TAs). Such always-available services can be readily accessed by TEE client drivers via QTEE's object-IPC protocol if the service is registered as a device on the TEE bus.
One such service is the EFI-variables service, implemented by the uefisecapp TA which enables kernel clients to access EFI variables at runtime.
Maintain a static list of such always-available secure services and add support for the QCOMTEE driver to register these services as devices on the TEE bus during probe.
Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com
drivers/tee/qcomtee/call.c | 160 ++++++++++++++++++++++++++++++++++- drivers/tee/qcomtee/core.c | 9 +- drivers/tee/qcomtee/qcomtee.h | 10 +++ drivers/tee/qcomtee/qcomtee_msg.h | 1 + drivers/tee/qcomtee/qcomtee_object.h | 3 +- 5 files changed, 176 insertions(+), 7 deletions(-)
[...]
diff --git a/drivers/tee/qcomtee/core.c b/drivers/tee/qcomtee/core.c index 60fe3b5776e3..4a523a95bf0e 100644 --- a/drivers/tee/qcomtee/core.c +++ b/drivers/tee/qcomtee/core.c @@ -898,19 +898,20 @@ qcomtee_object_get_client_env(struct qcomtee_object_invoke_ctx *oic) struct qcomtee_object * qcomtee_object_get_service(struct qcomtee_object_invoke_ctx *oic,
struct qcomtee_object *client_env, u32 uid)
struct qcomtee_object *client_env, u32 uid,int *result){ struct qcomtee_arg u[3] = { 0 };
- int ret, result;
- int ret;
Please initialize *result, otherwise for instance, on mem allocation failure, qcomtee_object_do_invoke returns with errno. The caller checks the return value + result and may print garbage.
Ack, will initialize here and omit in the caller.
Regards, Harshal
- Amir
On Qualcomm SoC based platforms, UEFI stores EFI variables within the Replay Protected Memory Block (RPMB) located within either the UFS, eMMC or SPI-NOR storage. The RPMB key which is one-time programmed into the storage controller to allow authentication of the RPMB frames is generated by and only available to the Qualcomm Trusted Execution Environment (QTEE).
The legacy QSEECOM protocol used for communicating with the QTEE is deprecated and replaced with the use-case agnostic SMCInvoke protocol starting with the Qualcomm SM8x50 series. On platforms where the QSEECOM driver still probes, it does not support a listener interface with QTEE to enable writing of non-volatile EFI variables to the RPMB for UFS and eMMC storage. Therefore on such platforms, a TEE client driver which communicates with QTEE via the SMCInvoke protocol implemented by the QCOMTEE driver (and registered with the TEE subsystem) must be used to update such EFI variables.
Add support for a TEE based uefisecapp client driver which installs efivar operations after obtaining an object reference to the uefisecapp service. This enables the kernel/user-space to access or modify both volatile EFI variables stored by the Secure Application (in-memory) and non-volatile ones stored within RPMB.
Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com --- MAINTAINERS | 6 + drivers/firmware/qcom/Kconfig | 31 ++ drivers/firmware/qcom/Makefile | 1 + drivers/firmware/qcom/qcom_tee_uefisecapp.c | 644 ++++++++++++++++++++++++++++ 4 files changed, 682 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS index 30c1cdd0fb38..7ccedad8d388 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -22981,6 +22981,12 @@ L: linux-arm-msm@vger.kernel.org S: Maintained F: drivers/firmware/qcom/qcom_qseecom_uefisecapp.c
+QUALCOMM TEE UEFISECAPP DRIVER +M: Harshal Dev harshal.dev@oss.qualcomm.com +L: linux-arm-msm@vger.kernel.org +S: Maintained +F: drivers/firmware/qcom/qcom_tee_uefisecapp.c + QUALCOMM PINCTRL DRIVERS M: Bartosz Golaszewski brgl@kernel.org L: linux-arm-msm@vger.kernel.org diff --git a/drivers/firmware/qcom/Kconfig b/drivers/firmware/qcom/Kconfig index 3ad22f8fc3e5..694d98fef4f4 100644 --- a/drivers/firmware/qcom/Kconfig +++ b/drivers/firmware/qcom/Kconfig @@ -79,4 +79,35 @@ config QCOM_QSEECOM_UEFISECAPP Select Y here to provide access to EFI variables on the aforementioned platforms.
+config QCOM_TEE_UEFISECAPP + tristate "Qualcomm TEE UEFI Secure App client driver" + depends on QCOMTEE + depends on EFI + help + The QSEECOM protocol used for communicating with the Qualcomm Trusted + Execution Environment (QTEE) is deprecated and replaced with the SMCInvoke + protocol starting with the Qualcomm SM8x50 series. On platforms where the + QSEECOM protocol still works (the QSEECOM driver probes) the driver does + not support a listener interface with QTEE to enable writing of + non-volatile EFI variables (via listener requests to Linux) in the Replay + Protected Memory Block (RPMB) located on UFS/eMMC storage. + Therefore on such platforms, the TEE based uefisecapp client driver + (which communicates with QTEE via the SMCInvoke protocol) must be used + to update such EFI variables through the RPMB service hosted in the QTEE + supplicant user-space daemon (github.com/qualcomm/minkipc) which forwards + RPMB packets to the RPMB device. + NOTE: Qualcomm Compute platforms with SPI-NOR storage are an exception to + this scenario. Since they do not have a firmware running on their SPI-NOR + storage controller which must be programmed with a RPMB key, QTEE has a + SPI-NOR driver which holds the key, and so the QSEECOM driver can be used + for updating EFI variables on these platforms because QTEE never makes a + listener request to Linux (QTEE doesn't need the Linux SPI-NOR driver). + + This module provides a TEE client driver for uefisecapp, installing efivar + operations to allow the kernel and user-space access to EFI variables. + + Select m here to provide access to EFI variables on the aforementioned + platforms if your Linux distribution has QTEE supplicant installed and + running. + endmenu diff --git a/drivers/firmware/qcom/Makefile b/drivers/firmware/qcom/Makefile index 88ce74d74c3e..237192b74de3 100644 --- a/drivers/firmware/qcom/Makefile +++ b/drivers/firmware/qcom/Makefile @@ -9,5 +9,6 @@ CFLAGS_qcom_scm-smc.o := -I$(src) obj-$(CONFIG_QCOM_TZMEM) += qcom_tzmem.o obj-$(CONFIG_QCOM_QSEECOM) += qcom_qseecom.o obj-$(CONFIG_QCOM_QSEECOM_UEFISECAPP) += qcom_qseecom_uefisecapp.o +obj-$(CONFIG_QCOM_TEE_UEFISECAPP) += qcom_tee_uefisecapp.o obj-$(CONFIG_QCOM_PAS) += qcom_pas.o obj-$(CONFIG_QCOM_PAS_TEE) += qcom_pas_tee.o diff --git a/drivers/firmware/qcom/qcom_tee_uefisecapp.c b/drivers/firmware/qcom/qcom_tee_uefisecapp.c new file mode 100644 index 000000000000..bcd025f929fc --- /dev/null +++ b/drivers/firmware/qcom/qcom_tee_uefisecapp.c @@ -0,0 +1,644 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#include <linux/efi.h> +#include <linux/tee.h> +#include <linux/tee_drv.h> +#include <linux/ucs2_string.h> + +#define QCOMTEE_OP_CLIENT_ENV_OPEN 0 +#define QCOMTEE_ROOT_OP_REG_WITH_CREDENTIALS 5 + +/* Each service exposed by QTEE is identified by a 32-bit UID */ +#define QCOMTEE_UEFI_SEC_UID 413 + +/* Operations supported by the UEFI Sec App service */ +#define QCOMTEE_UEFI_SEC_OP_GET_VAR 0 +#define QCOMTEE_UEFI_SEC_OP_SET_VAR 1 +#define QCOMTEE_UEFI_SEC_OP_QUERY_VAR_INFO 2 +#define QCOMTEE_UEFI_SEC_OP_GET_NEXT_VAR_NAME 3 + +#define QCOMTEE_GET_VAR_NPARAMS 5 +#define QCOMTEE_SET_VAR_NPARAMS 4 +#define QCOMTEE_QUERY_VAR_NPARAMS 2 +#define QCOMTEE_GET_NEXT_VAR_NPARAMS 4 +#define QCOMTEE_GET_UEFI_SVC_NPARAMS 2 +#define QCOMTEE_GET_CLIENT_ENV_NPARAMS 2 + +/* Error codes returned by the UEFI Sec App service */ +#define QCOMTEE_UEFI_SEC_SUCCESS 0 +#define QCOMTEE_UEFI_SEC_ERROR_INVALID_PARAMETER 10 +#define QCOMTEE_UEFI_SEC_ERROR_UNSUPPORTED 11 +#define QCOMTEE_UEFI_SEC_ERROR_WRITE_PROTECTED 12 +#define QCOMTEE_UEFI_SEC_ERROR_SECURITY_VIOLATION 13 +#define QCOMTEE_UEFI_SEC_ERROR_DEVICE_ERROR 14 +#define QCOMTEE_UEFI_SEC_ERROR_OUT_OF_RESOURCES 15 +#define QCOMTEE_UEFI_SEC_ERROR_VOLUME_CORRUPTED 16 +#define QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT 17 +#define QCOMTEE_UEFI_SEC_ERROR_NOT_FOUND 18 +#define QCOMTEE_UEFI_SEC_ERROR_ALREADY_STARTED 19 + +/* Operations for objects are 32-bit. QCOMTEE transport uses the upper 16 bits. */ +#define QCOMTEE_MSG_OBJECT_OP_MASK GENMASK(15, 0) +#define QCOMTEE_MSG_OBJECT_OP_RELEASE (QCOMTEE_MSG_OBJECT_OP_MASK - 0) + +/** + * struct qcomtee_uefisec_app - An instance of UEFI Secure Application. + * @dev: TEE client device on the TEE bus which represents uefisecapp. + * @ctx: The context opened with the TEE subsystem by the uefisecapp client. + * @uefisec_svc_obj: A TEE object representing the uefisecapp service. + * @efivars: EFI variables registered with the EFI subsystem. + */ +struct qcomtee_uefisec_app { + struct device *dev; + struct tee_context *ctx; + struct tee_param_objref uefisec_svc_obj; + struct efivars efivars; +}; + +#define UEFISECAPP_UUID \ + UUID_INIT(0x01f95dcd, 0x2d7e, 0x58be, \ + 0xa1, 0x43, 0x81, 0x32, 0xa1, 0x72, 0xdb, 0x7d) + +/* Short-hands for these long attribute names */ +#define UBUF_INPUT TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT +#define UBUF_OUTPUT TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT +#define OBJREF_INPUT TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_INPUT +#define OBJREF_OUTPUT TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_OUTPUT + +/* Init instance of 'struct tee_param_objref'. */ +#define SET_TEE_PARAM_OBJREF(param, attri, obj_id, obj_flag) do { \ + (param).attr = (attri); \ + (param).u.objref.id = (obj_id); \ + (param).u.objref.flags = (obj_flag); \ + } while (0) + +/* Init instance of 'struct tee_param_ubuf'. */ +#define SET_TEE_PARAM_UBUF(param, attri, ubuff) do { \ + (param).attr = (attri); \ + (param).u.ubuf = (ubuff); \ + } while (0) + +#define TEE_PARAM_UBUF(x) ((struct tee_param_ubuf){ .addr = &(x), sizeof(x) }) + +#define SET_INVOKE_ARG(arg, object_id, opp, nparam) do { \ + (arg).id = (object_id); \ + (arg).op = (opp); \ + (arg).num_params = (nparam); \ + } while (0) + +static inline efi_status_t uefisecapp_err_to_efi_status(u32 err) +{ + switch (err) { + case QCOMTEE_UEFI_SEC_SUCCESS: + return EFI_SUCCESS; + + case QCOMTEE_UEFI_SEC_ERROR_INVALID_PARAMETER: + return EFI_INVALID_PARAMETER; + + case QCOMTEE_UEFI_SEC_ERROR_UNSUPPORTED: + return EFI_UNSUPPORTED; + + case QCOMTEE_UEFI_SEC_ERROR_WRITE_PROTECTED: + return EFI_WRITE_PROTECTED; + + case QCOMTEE_UEFI_SEC_ERROR_SECURITY_VIOLATION: + return EFI_SECURITY_VIOLATION; + + case QCOMTEE_UEFI_SEC_ERROR_DEVICE_ERROR: + return EFI_DEVICE_ERROR; + + case QCOMTEE_UEFI_SEC_ERROR_OUT_OF_RESOURCES: + return EFI_OUT_OF_RESOURCES; + + case QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT: + return EFI_BUFFER_TOO_SMALL; + + case QCOMTEE_UEFI_SEC_ERROR_NOT_FOUND: + return EFI_NOT_FOUND; + + /* No matching on EFI_* list. */ + case QCOMTEE_UEFI_SEC_ERROR_ALREADY_STARTED: /* EFI_ALREADY_STARTED. */ + case QCOMTEE_UEFI_SEC_ERROR_VOLUME_CORRUPTED: /* EFI_VOLUME_CORRUPTED. */ + default: + return EFI_DEVICE_ERROR; + } +} + +/* + * This singleton is implicitly protected against concurrent access via + * efivar_lock() implemented by the efivar framework. + */ +static struct qcomtee_uefisec_app uefisec_app; + +static int qcuefi_get_variable(struct tee_param_ubuf in_variable, efi_guid_t *guid, + struct tee_param_ubuf in_attributes, + struct tee_param_ubuf *data, + u32 *out_attributes, u32 *out_errno) +{ + int ret; + struct tee_ioctl_object_invoke_arg inv_arg; + u64 obj_id = uefisec_app.uefisec_svc_obj.id; + struct tee_param param[QCOMTEE_GET_VAR_NPARAMS]; + + struct { + efi_guid_t guid; + u32 in_data_size; + } in_cong = { 0 }; + + struct { + u32 out_data_size; + u32 attributes; + u32 errno; + } out_cong = { 0 }; + + in_cong.guid = *guid; + in_cong.in_data_size = data->size; + + memset(&inv_arg, 0, sizeof(inv_arg)); + memset(¶m, 0, sizeof(param)); + + SET_INVOKE_ARG(inv_arg, obj_id, + QCOMTEE_UEFI_SEC_OP_GET_VAR, + QCOMTEE_GET_VAR_NPARAMS); + SET_TEE_PARAM_UBUF(param[0], UBUF_INPUT, TEE_PARAM_UBUF(in_cong)); + SET_TEE_PARAM_UBUF(param[1], UBUF_INPUT, in_variable); + SET_TEE_PARAM_UBUF(param[2], UBUF_INPUT, in_attributes); + SET_TEE_PARAM_UBUF(param[3], UBUF_OUTPUT, TEE_PARAM_UBUF(out_cong)); + SET_TEE_PARAM_UBUF(param[4], UBUF_OUTPUT, *data); + + ret = tee_client_object_invoke_func(uefisec_app.ctx, &inv_arg, param); + if (ret < 0 || inv_arg.ret != 0) { + dev_err(uefisec_app.dev, "QCOMTEE_UEFI_SEC_OP_GET_VAR invoke ret: %d, err: 0x%x\n", + ret, inv_arg.ret); + return ret ?: inv_arg.ret; + } + + data->size = out_cong.out_data_size; + *out_attributes = out_cong.attributes; + *out_errno = out_cong.errno; + + return ret; +} + +static efi_status_t qcomtee_uefi_get_variable(efi_char16_t *name, efi_guid_t *guid, + u32 *attr, unsigned long *data_size, + void *data) +{ + int ret; + u32 in_attr, out_attributes, out_errno; + struct tee_param_ubuf in_data, in_var, in_attributes; + + if (!name || !guid) + return EFI_INVALID_PARAMETER; + + /* + * 'attr' can be NULL, however an input attribute is always expected + * by UefiSecApp TA + */ + in_attr = 0; + if (attr) + in_attr = *attr; + + in_data = (struct tee_param_ubuf){ .addr = data, *data_size }; + in_var = (struct tee_param_ubuf){ .addr = name, + (ucs2_strlen(name) + 1) * sizeof(*name) }; + in_attributes = (struct tee_param_ubuf){ .addr = &in_attr, sizeof(u32) }; + + /* On SUCCESS, 'data' member of 'in_data' has already been updated. */ + ret = qcuefi_get_variable(in_var, guid, in_attributes, &in_data, + &out_attributes, &out_errno); + + if (ret) + return EFI_DEVICE_ERROR; + + if (!out_errno || out_errno == QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT) { + /* If 'attr' is NULL 'out_attributes' is not updated. */ + if (attr) + *attr = out_attributes; + + *data_size = in_data.size; + } + + return uefisecapp_err_to_efi_status(out_errno); +} + +static int qcuefi_set_variable(struct tee_param_ubuf in_variable, efi_guid_t *guid, + u32 attributes, struct tee_param_ubuf data, + u32 *out_errno) +{ + int ret; + struct tee_ioctl_object_invoke_arg inv_arg; + u64 obj_id = uefisec_app.uefisec_svc_obj.id; + struct tee_param param[QCOMTEE_SET_VAR_NPARAMS]; + + struct { + efi_guid_t guid; + u32 attributes; + u32 in_data_size; + } in_cong = { 0 }; + + in_cong.guid = *guid; + in_cong.attributes = attributes; + in_cong.in_data_size = data.size; + + memset(&inv_arg, 0, sizeof(inv_arg)); + memset(¶m, 0, sizeof(param)); + + SET_INVOKE_ARG(inv_arg, obj_id, + QCOMTEE_UEFI_SEC_OP_SET_VAR, + QCOMTEE_SET_VAR_NPARAMS); + SET_TEE_PARAM_UBUF(param[0], UBUF_INPUT, TEE_PARAM_UBUF(in_cong)); + SET_TEE_PARAM_UBUF(param[1], UBUF_INPUT, in_variable); + SET_TEE_PARAM_UBUF(param[2], UBUF_INPUT, data); + SET_TEE_PARAM_UBUF(param[3], UBUF_OUTPUT, TEE_PARAM_UBUF(*out_errno)); + + ret = tee_client_object_invoke_func(uefisec_app.ctx, &inv_arg, param); + if (ret < 0 || inv_arg.ret != 0) { + dev_err(uefisec_app.dev, "QCOMTEE_UEFI_SEC_OP_SET_VAR invoke ret: %d, err: 0x%x\n", + ret, inv_arg.ret); + return ret ?: inv_arg.ret; + } + + return ret; +} + +static efi_status_t qcomtee_uefi_set_variable(efi_char16_t *name, efi_guid_t *guid, + u32 attr, unsigned long data_size, + void *data) +{ + int ret; + u32 out_errno; + struct tee_param_ubuf in_data, in_var; + + if (!name || !guid) + return EFI_INVALID_PARAMETER; + + in_data = (struct tee_param_ubuf){ .addr = data, data_size }; + in_var = (struct tee_param_ubuf){ .addr = name, + (ucs2_strlen(name) + 1) * sizeof(*name) }; + + ret = qcuefi_set_variable(in_var, guid, attr, in_data, &out_errno); + if (ret) + return EFI_DEVICE_ERROR; + + return uefisecapp_err_to_efi_status(out_errno); +} + +static int qcuefi_get_next_variable(struct tee_param_ubuf in_variable, efi_guid_t *guid, + struct tee_param_ubuf *out_variable, + efi_guid_t *out_vendor_guid, u32 *out_errno) +{ + int ret; + struct tee_ioctl_object_invoke_arg inv_arg; + u64 obj_id = uefisec_app.uefisec_svc_obj.id; + struct tee_param param[QCOMTEE_GET_NEXT_VAR_NPARAMS]; + + struct { + efi_guid_t guid; + u32 in_data_size; + } in_cong = { 0 }; + + struct { + efi_guid_t guid; + u32 out_data_size; + u32 errno; + } out_cong = { 0 }; + + /* Pass size of available buffer */ + in_cong.in_data_size = out_variable->size; + in_cong.guid = *guid; + + memset(&inv_arg, 0, sizeof(inv_arg)); + memset(¶m, 0, sizeof(param)); + + SET_INVOKE_ARG(inv_arg, obj_id, + QCOMTEE_UEFI_SEC_OP_GET_NEXT_VAR_NAME, + QCOMTEE_GET_NEXT_VAR_NPARAMS); + SET_TEE_PARAM_UBUF(param[0], UBUF_INPUT, TEE_PARAM_UBUF(in_cong)); + SET_TEE_PARAM_UBUF(param[1], UBUF_INPUT, in_variable); + SET_TEE_PARAM_UBUF(param[2], UBUF_OUTPUT, TEE_PARAM_UBUF(out_cong)); + SET_TEE_PARAM_UBUF(param[3], UBUF_OUTPUT, *out_variable); + + ret = tee_client_object_invoke_func(uefisec_app.ctx, &inv_arg, param); + if (ret < 0 || inv_arg.ret != 0) { + dev_err(uefisec_app.dev, "QCOMTEE_UEFI_SEC_OP_GET_NEXT_VAR_NAME invoke ret: %d, err: 0x%x\n", + ret, inv_arg.ret); + return ret ?: inv_arg.ret; + } + + /* + * UefiSecApp TA does not touch 'out_variable.size'. Update it here. + * On SUCCESS (!out_errno), 'out_data_size' is length of name in + * 'out_variable.addr'. + * On failure (out_errno == QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT), + * 'out_data_size' is actual name length. + * Otherwise, it's undefined. + */ + out_variable->size = out_cong.out_data_size; + *out_vendor_guid = out_cong.guid; + *out_errno = out_cong.errno; + + return ret; +} + +static efi_status_t qcomtee_uefi_get_next_variable(unsigned long *name_size, + efi_char16_t *name, + efi_guid_t *guid) +{ + int ret; + u32 out_errno; + efi_guid_t out_guid; + struct tee_param_ubuf in_var, out_var; + + if (!name_size || !name || !guid) + return EFI_INVALID_PARAMETER; + + if (*name_size == 0) + return EFI_INVALID_PARAMETER; + + /* + * For 'in_var', 'name_size' is not necessarily size of 'name'; + * could be size of buffer where 'name' has been stored. TA expects a + * NULL-terminated string in 'name' and ignores the size. + * For 'out_var', 'name_size' is size of buffer pointed by 'name'. + */ + in_var = (struct tee_param_ubuf){ .addr = name, *name_size }; + out_var = (struct tee_param_ubuf){ .addr = name, *name_size }; + + ret = qcuefi_get_next_variable(in_var, guid, &out_var, &out_guid, + &out_errno); + if (ret) + return EFI_DEVICE_ERROR; + + if (!out_errno) + *guid = out_guid; + + if (!out_errno || out_errno == QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT) + *name_size = out_var.size; + + /* On SUCCESS, 'name' stores the next variable name. */ + return uefisecapp_err_to_efi_status(out_errno); +} + +static int qcuefi_query_variable_info(u32 attributes, + u64 *maximum_variable_storage_size, + u64 *remaining_variable_storage_size, + u64 *maximum_variable_size, u32 *out_errno) +{ + int ret; + struct tee_ioctl_object_invoke_arg inv_arg; + u64 obj_id = uefisec_app.uefisec_svc_obj.id; + struct tee_param param[QCOMTEE_QUERY_VAR_NPARAMS]; + + struct { + u64 max_var_storage_size; + u64 remaining_var_storage_size; + u64 maximum_var_size; + u32 errno; + } out_cong = { 0 }; + + memset(&inv_arg, 0, sizeof(inv_arg)); + memset(¶m, 0, sizeof(param)); + + SET_INVOKE_ARG(inv_arg, obj_id, + QCOMTEE_UEFI_SEC_OP_QUERY_VAR_INFO, + QCOMTEE_QUERY_VAR_NPARAMS); + SET_TEE_PARAM_UBUF(param[0], UBUF_INPUT, TEE_PARAM_UBUF(attributes)); + SET_TEE_PARAM_UBUF(param[1], UBUF_OUTPUT, TEE_PARAM_UBUF(out_cong)); + + ret = tee_client_object_invoke_func(uefisec_app.ctx, &inv_arg, param); + if (ret < 0 || inv_arg.ret != 0) { + dev_err(uefisec_app.dev, "QCOMTEE_UEFI_SEC_OP_QUERY_VAR_INFO invoke ret: %d, err: 0x%x\n", + ret, inv_arg.ret); + return ret ?: inv_arg.ret; + } + + *out_errno = out_cong.errno; + if (!*out_errno) { + *maximum_variable_storage_size = out_cong.max_var_storage_size; + *remaining_variable_storage_size = out_cong.remaining_var_storage_size; + *maximum_variable_size = out_cong.maximum_var_size; + } + + return ret; +} + +static efi_status_t qcomtee_uefi_query_variable_info(u32 attr, u64 *storage_space, + u64 *remaining_space, + u64 *max_variable_size) +{ + int ret; + u32 out_errno; + + if (!storage_space || !remaining_space || !max_variable_size) + return EFI_INVALID_PARAMETER; + + ret = qcuefi_query_variable_info(attr, + storage_space, + remaining_space, + max_variable_size, + &out_errno); + + if (ret) + return EFI_DEVICE_ERROR; + + return uefisecapp_err_to_efi_status(out_errno); +} + +/** + * qcomtee_release_object() - Release an object returned by QTEE. + * + * Each object returned by QTEE repesents a secure service exposed to the + * client. Whenever an secure service is opened, QTEE may allocate resources + * on the client's behalf. Therefore, once the client is done accessing the + * secure service, the object representing it should be explicitly released + * so that QTEE can release the associated resources as well. + * + * @ctx: TEE context. + * @object: The object to release. + */ +static void qcomtee_release_object(struct tee_context *ctx, + struct tee_param_objref object) +{ + struct tee_ioctl_object_invoke_arg inv_arg; + + memset(&inv_arg, 0, sizeof(inv_arg)); + SET_INVOKE_ARG(inv_arg, object.id, QCOMTEE_MSG_OBJECT_OP_RELEASE, 0); + tee_client_object_invoke_func(ctx, &inv_arg, NULL); +} + +/** + * qcomtee_get_uefisec_svc_obj() - Get a UEFI Secure App service object to + * begin communication with the service. + * @ctx: TEE context. + * @client_env_obj: The client environment object returned earlier by QTEE. + * @uefisec_svc_obj: The UEFI Secure App service object. + * + * Returns 0 on success. + * Returns < 0 if client environment object invocation failed. + * Returns > 0 if client environment invocation was success but UEFI Secure App + * service object could not be returned for some other reason (represented by the + * returned value) + */ +static int qcomtee_get_uefisec_svc_obj(struct tee_context *ctx, + struct tee_param_objref client_env_obj, + struct tee_param_objref *uefisec_svc_obj) +{ + int ret; + struct tee_ioctl_object_invoke_arg inv_arg; + u64 obj_id = client_env_obj.id; + struct tee_param param[QCOMTEE_GET_UEFI_SVC_NPARAMS]; + u32 uefisec_uid = QCOMTEE_UEFI_SEC_UID; + + memset(&inv_arg, 0, sizeof(inv_arg)); + memset(¶m, 0, sizeof(param)); + + SET_INVOKE_ARG(inv_arg, obj_id, + QCOMTEE_OP_CLIENT_ENV_OPEN, + QCOMTEE_GET_UEFI_SVC_NPARAMS); + SET_TEE_PARAM_UBUF(param[0], UBUF_INPUT, TEE_PARAM_UBUF(uefisec_uid)); + SET_TEE_PARAM_OBJREF(param[1], OBJREF_OUTPUT, 0, 0); + + ret = tee_client_object_invoke_func(ctx, &inv_arg, param); + if (ret < 0 || inv_arg.ret != 0) { + dev_err(uefisec_app.dev, "QCOMTEE_CLIENT_ENV_OPEN invoke ret: %d, err: 0x%x\n", + ret, inv_arg.ret); + return ret ?: inv_arg.ret; + } + + *uefisec_svc_obj = param[1].u.objref; + return ret; +} + +/** + * qcomtee_get_client_env_obj() - Get a client environment object to begin + * object exchange with QTEE. + * @ctx: TEE context. + * @client_env_obj: The client environment object returned by QTEE. + * + * Returns 0 on success. + * Returns < 0 if root object invocation failed. + * Returns > 0 if root object invocation was success but client environment + * object could not be returned for some other reason (represented by the + * returned value) + */ +static int qcomtee_get_client_env_obj(struct tee_context *ctx, + struct tee_param_objref *client_env_obj) +{ + int ret; + struct tee_ioctl_object_invoke_arg inv_arg; + struct tee_param param[QCOMTEE_GET_CLIENT_ENV_NPARAMS]; + + memset(&inv_arg, 0, sizeof(inv_arg)); + memset(¶m, 0, sizeof(param)); + + SET_INVOKE_ARG(inv_arg, TEE_OBJREF_NULL, + QCOMTEE_ROOT_OP_REG_WITH_CREDENTIALS, + QCOMTEE_GET_CLIENT_ENV_NPARAMS); + SET_TEE_PARAM_OBJREF(param[0], OBJREF_INPUT, TEE_OBJREF_NULL, 0); + SET_TEE_PARAM_OBJREF(param[1], OBJREF_OUTPUT, 0, 0); + + ret = tee_client_object_invoke_func(ctx, &inv_arg, param); + if (ret < 0 || inv_arg.ret != 0) { + dev_err(uefisec_app.dev, "QCOMTEE_ROOT_OP_REG_WITH_CREDENTIALS invoke ret: %d, err: 0x%x\n", + ret, inv_arg.ret); + return ret ?: inv_arg.ret; + } + + *client_env_obj = param[1].u.objref; + return ret; +} + +static const struct efivar_operations qcom_efivar_ops = { + .get_variable = qcomtee_uefi_get_variable, + .set_variable = qcomtee_uefi_set_variable, + .get_next_variable = qcomtee_uefi_get_next_variable, + .query_variable_info = qcomtee_uefi_query_variable_info, +}; + +static int qcomtee_ctx_match(struct tee_ioctl_version_data *ver, + const void *data) +{ + return (ver->impl_id == TEE_IMPL_ID_QTEE); +} + +static int qcomtee_uefisecapp_probe(struct tee_client_device *tee_dev) +{ + int ret, err; + struct tee_param_objref client_env_obj; + struct tee_param_objref uefisec_svc_obj; + + uefisec_app.dev = &tee_dev->dev; + /* Open context with QCOMTEE driver */ + uefisec_app.ctx = tee_client_open_context(NULL, qcomtee_ctx_match, NULL, + NULL); + if (IS_ERR(uefisec_app.ctx)) + return -ENODEV; + + ret = qcomtee_get_client_env_obj(uefisec_app.ctx, &client_env_obj); + if (ret) { + err = -EINVAL; + goto err_get_client_env; + } + + ret = qcomtee_get_uefisec_svc_obj(uefisec_app.ctx, client_env_obj, + &uefisec_svc_obj); + if (ret) { + err = -EINVAL; + goto err_get_uefisec_svc; + } + uefisec_app.uefisec_svc_obj = uefisec_svc_obj; + + ret = efivars_register(&uefisec_app.efivars, &qcom_efivar_ops); + if (ret) { + err = ret; + goto err_efi_vars_reg; + } + + /* + * We don't need to keep a reference to this object anymore, we only + * needed it to obtain the uefisec_svc object. + */ + qcomtee_release_object(uefisec_app.ctx, client_env_obj); + return 0; + +err_efi_vars_reg: + qcomtee_release_object(uefisec_app.ctx, uefisec_svc_obj); +err_get_uefisec_svc: + qcomtee_release_object(uefisec_app.ctx, client_env_obj); +err_get_client_env: + tee_client_close_context(uefisec_app.ctx); + + return err; +} + +static void qcomtee_uefisecapp_remove(struct tee_client_device *tee_dev) +{ + efivars_unregister(&uefisec_app.efivars); + qcomtee_release_object(uefisec_app.ctx, uefisec_app.uefisec_svc_obj); + tee_client_close_context(uefisec_app.ctx); +} + +static const struct tee_client_device_id qcomtee_uefisecapp_id_table[] = { + {UEFISECAPP_UUID}, + {} +}; +MODULE_DEVICE_TABLE(tee, qcomtee_uefisecapp_id_table); + +static struct tee_client_driver qcomtee_uefisecapp_driver = { + .id_table = qcomtee_uefisecapp_id_table, + .probe = qcomtee_uefisecapp_probe, + .remove = qcomtee_uefisecapp_remove, + .driver = { + .name = "qcom-tee-uefisecapp", + }, +}; + +module_tee_client_driver(qcomtee_uefisecapp_driver); + +MODULE_AUTHOR("Qualcomm"); +MODULE_DESCRIPTION("TEE client driver for Qualcomm TEE UEFI Secure App"); +MODULE_LICENSE("GPL");
Hi Harshal,
On 10/15/2026 10:39 PM, Harshal Dev wrote:
On Qualcomm SoC based platforms, UEFI stores EFI variables within the Replay Protected Memory Block (RPMB) located within either the UFS, eMMC or SPI-NOR storage. The RPMB key which is one-time programmed into the storage controller to allow authentication of the RPMB frames is generated by and only available to the Qualcomm Trusted Execution Environment (QTEE).
The legacy QSEECOM protocol used for communicating with the QTEE is deprecated and replaced with the use-case agnostic SMCInvoke protocol starting with the Qualcomm SM8x50 series. On platforms where the QSEECOM driver still probes, it does not support a listener interface with QTEE to enable writing of non-volatile EFI variables to the RPMB for UFS and eMMC storage. Therefore on such platforms, a TEE client driver which communicates with QTEE via the SMCInvoke protocol implemented by the QCOMTEE driver (and registered with the TEE subsystem) must be used to update such EFI variables.
Add support for a TEE based uefisecapp client driver which installs efivar operations after obtaining an object reference to the uefisecapp service. This enables the kernel/user-space to access or modify both volatile EFI variables stored by the Secure Application (in-memory) and non-volatile ones stored within RPMB.
Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com
MAINTAINERS | 6 + drivers/firmware/qcom/Kconfig | 31 ++ drivers/firmware/qcom/Makefile | 1 + drivers/firmware/qcom/qcom_tee_uefisecapp.c | 644 ++++++++++++++++++++++++++++ 4 files changed, 682 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS index 30c1cdd0fb38..7ccedad8d388 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -22981,6 +22981,12 @@ L: linux-arm-msm@vger.kernel.org S: Maintained F: drivers/firmware/qcom/qcom_qseecom_uefisecapp.c +QUALCOMM TEE UEFISECAPP DRIVER +M: Harshal Dev harshal.dev@oss.qualcomm.com +L: linux-arm-msm@vger.kernel.org +S: Maintained +F: drivers/firmware/qcom/qcom_tee_uefisecapp.c
QUALCOMM PINCTRL DRIVERS M: Bartosz Golaszewski brgl@kernel.org L: linux-arm-msm@vger.kernel.org diff --git a/drivers/firmware/qcom/Kconfig b/drivers/firmware/qcom/Kconfig index 3ad22f8fc3e5..694d98fef4f4 100644 --- a/drivers/firmware/qcom/Kconfig +++ b/drivers/firmware/qcom/Kconfig @@ -79,4 +79,35 @@ config QCOM_QSEECOM_UEFISECAPP Select Y here to provide access to EFI variables on the aforementioned platforms. +config QCOM_TEE_UEFISECAPP
- tristate "Qualcomm TEE UEFI Secure App client driver"
- depends on QCOMTEE
- depends on EFI
- help
The QSEECOM protocol used for communicating with the Qualcomm TrustedExecution Environment (QTEE) is deprecated and replaced with the SMCInvokeprotocol starting with the Qualcomm SM8x50 series. On platforms where theQSEECOM protocol still works (the QSEECOM driver probes) the driver doesnot support a listener interface with QTEE to enable writing ofnon-volatile EFI variables (via listener requests to Linux) in the ReplayProtected Memory Block (RPMB) located on UFS/eMMC storage.Therefore on such platforms, the TEE based uefisecapp client driver(which communicates with QTEE via the SMCInvoke protocol) must be usedto update such EFI variables through the RPMB service hosted in the QTEEsupplicant user-space daemon (github.com/qualcomm/minkipc) which forwardsRPMB packets to the RPMB device.NOTE: Qualcomm Compute platforms with SPI-NOR storage are an exception tothis scenario. Since they do not have a firmware running on their SPI-NORstorage controller which must be programmed with a RPMB key, QTEE has aSPI-NOR driver which holds the key, and so the QSEECOM driver can be usedfor updating EFI variables on these platforms because QTEE never makes alistener request to Linux (QTEE doesn't need the Linux SPI-NOR driver).This module provides a TEE client driver for uefisecapp, installing efivaroperations to allow the kernel and user-space access to EFI variables.Select m here to provide access to EFI variables on the aforementionedplatforms if your Linux distribution has QTEE supplicant installed andrunning.endmenu diff --git a/drivers/firmware/qcom/Makefile b/drivers/firmware/qcom/Makefile index 88ce74d74c3e..237192b74de3 100644 --- a/drivers/firmware/qcom/Makefile +++ b/drivers/firmware/qcom/Makefile @@ -9,5 +9,6 @@ CFLAGS_qcom_scm-smc.o := -I$(src) obj-$(CONFIG_QCOM_TZMEM) += qcom_tzmem.o obj-$(CONFIG_QCOM_QSEECOM) += qcom_qseecom.o obj-$(CONFIG_QCOM_QSEECOM_UEFISECAPP) += qcom_qseecom_uefisecapp.o +obj-$(CONFIG_QCOM_TEE_UEFISECAPP) += qcom_tee_uefisecapp.o obj-$(CONFIG_QCOM_PAS) += qcom_pas.o obj-$(CONFIG_QCOM_PAS_TEE) += qcom_pas_tee.o diff --git a/drivers/firmware/qcom/qcom_tee_uefisecapp.c b/drivers/firmware/qcom/qcom_tee_uefisecapp.c new file mode 100644 index 000000000000..bcd025f929fc --- /dev/null +++ b/drivers/firmware/qcom/qcom_tee_uefisecapp.c @@ -0,0 +1,644 @@ +// SPDX-License-Identifier: GPL-2.0-only +/*
- Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
- */
+#include <linux/efi.h> +#include <linux/tee.h> +#include <linux/tee_drv.h> +#include <linux/ucs2_string.h>
+#define QCOMTEE_OP_CLIENT_ENV_OPEN 0 +#define QCOMTEE_ROOT_OP_REG_WITH_CREDENTIALS 5
+/* Each service exposed by QTEE is identified by a 32-bit UID */ +#define QCOMTEE_UEFI_SEC_UID 413
+/* Operations supported by the UEFI Sec App service */ +#define QCOMTEE_UEFI_SEC_OP_GET_VAR 0 +#define QCOMTEE_UEFI_SEC_OP_SET_VAR 1 +#define QCOMTEE_UEFI_SEC_OP_QUERY_VAR_INFO 2 +#define QCOMTEE_UEFI_SEC_OP_GET_NEXT_VAR_NAME 3
+#define QCOMTEE_GET_VAR_NPARAMS 5 +#define QCOMTEE_SET_VAR_NPARAMS 4 +#define QCOMTEE_QUERY_VAR_NPARAMS 2 +#define QCOMTEE_GET_NEXT_VAR_NPARAMS 4 +#define QCOMTEE_GET_UEFI_SVC_NPARAMS 2 +#define QCOMTEE_GET_CLIENT_ENV_NPARAMS 2
+/* Error codes returned by the UEFI Sec App service */ +#define QCOMTEE_UEFI_SEC_SUCCESS 0 +#define QCOMTEE_UEFI_SEC_ERROR_INVALID_PARAMETER 10 +#define QCOMTEE_UEFI_SEC_ERROR_UNSUPPORTED 11 +#define QCOMTEE_UEFI_SEC_ERROR_WRITE_PROTECTED 12 +#define QCOMTEE_UEFI_SEC_ERROR_SECURITY_VIOLATION 13 +#define QCOMTEE_UEFI_SEC_ERROR_DEVICE_ERROR 14 +#define QCOMTEE_UEFI_SEC_ERROR_OUT_OF_RESOURCES 15 +#define QCOMTEE_UEFI_SEC_ERROR_VOLUME_CORRUPTED 16 +#define QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT 17 +#define QCOMTEE_UEFI_SEC_ERROR_NOT_FOUND 18 +#define QCOMTEE_UEFI_SEC_ERROR_ALREADY_STARTED 19
+/* Operations for objects are 32-bit. QCOMTEE transport uses the upper 16 bits. */ +#define QCOMTEE_MSG_OBJECT_OP_MASK GENMASK(15, 0) +#define QCOMTEE_MSG_OBJECT_OP_RELEASE (QCOMTEE_MSG_OBJECT_OP_MASK - 0)
+/**
- struct qcomtee_uefisec_app - An instance of UEFI Secure Application.
- @dev: TEE client device on the TEE bus which represents uefisecapp.
- @ctx: The context opened with the TEE subsystem by the uefisecapp client.
- @uefisec_svc_obj: A TEE object representing the uefisecapp service.
- @efivars: EFI variables registered with the EFI subsystem.
- */
+struct qcomtee_uefisec_app {
- struct device *dev;
- struct tee_context *ctx;
- struct tee_param_objref uefisec_svc_obj;
- struct efivars efivars;
+};
+#define UEFISECAPP_UUID \
- UUID_INIT(0x01f95dcd, 0x2d7e, 0x58be, \
0xa1, 0x43, 0x81, 0x32, 0xa1, 0x72, 0xdb, 0x7d)+/* Short-hands for these long attribute names */ +#define UBUF_INPUT TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT +#define UBUF_OUTPUT TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT +#define OBJREF_INPUT TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_INPUT +#define OBJREF_OUTPUT TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_OUTPUT
+/* Init instance of 'struct tee_param_objref'. */ +#define SET_TEE_PARAM_OBJREF(param, attri, obj_id, obj_flag) do { \
(param).attr = (attri); \(param).u.objref.id = (obj_id); \(param).u.objref.flags = (obj_flag); \- } while (0)
+/* Init instance of 'struct tee_param_ubuf'. */ +#define SET_TEE_PARAM_UBUF(param, attri, ubuff) do { \
(param).attr = (attri); \(param).u.ubuf = (ubuff); \- } while (0)
+#define TEE_PARAM_UBUF(x) ((struct tee_param_ubuf){ .addr = &(x), sizeof(x) })
+#define SET_INVOKE_ARG(arg, object_id, opp, nparam) do { \
(arg).id = (object_id); \(arg).op = (opp); \(arg).num_params = (nparam); \- } while (0)
+static inline efi_status_t uefisecapp_err_to_efi_status(u32 err) +{
- switch (err) {
- case QCOMTEE_UEFI_SEC_SUCCESS:
return EFI_SUCCESS;- case QCOMTEE_UEFI_SEC_ERROR_INVALID_PARAMETER:
return EFI_INVALID_PARAMETER;- case QCOMTEE_UEFI_SEC_ERROR_UNSUPPORTED:
return EFI_UNSUPPORTED;- case QCOMTEE_UEFI_SEC_ERROR_WRITE_PROTECTED:
return EFI_WRITE_PROTECTED;- case QCOMTEE_UEFI_SEC_ERROR_SECURITY_VIOLATION:
return EFI_SECURITY_VIOLATION;- case QCOMTEE_UEFI_SEC_ERROR_DEVICE_ERROR:
return EFI_DEVICE_ERROR;- case QCOMTEE_UEFI_SEC_ERROR_OUT_OF_RESOURCES:
return EFI_OUT_OF_RESOURCES;- case QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT:
return EFI_BUFFER_TOO_SMALL;- case QCOMTEE_UEFI_SEC_ERROR_NOT_FOUND:
return EFI_NOT_FOUND;- /* No matching on EFI_* list. */
- case QCOMTEE_UEFI_SEC_ERROR_ALREADY_STARTED: /* EFI_ALREADY_STARTED. */
- case QCOMTEE_UEFI_SEC_ERROR_VOLUME_CORRUPTED: /* EFI_VOLUME_CORRUPTED. */
- default:
return EFI_DEVICE_ERROR;- }
+}
+/*
- This singleton is implicitly protected against concurrent access via
- efivar_lock() implemented by the efivar framework.
- */
+static struct qcomtee_uefisec_app uefisec_app;
+static int qcuefi_get_variable(struct tee_param_ubuf in_variable, efi_guid_t *guid,
struct tee_param_ubuf in_attributes,struct tee_param_ubuf *data,u32 *out_attributes, u32 *out_errno)+{
- int ret;
- struct tee_ioctl_object_invoke_arg inv_arg;
- u64 obj_id = uefisec_app.uefisec_svc_obj.id;
- struct tee_param param[QCOMTEE_GET_VAR_NPARAMS];
- struct {
efi_guid_t guid;u32 in_data_size;- } in_cong = { 0 };
- struct {
u32 out_data_size;u32 attributes;u32 errno;- } out_cong = { 0 };
- in_cong.guid = *guid;
- in_cong.in_data_size = data->size;
- memset(&inv_arg, 0, sizeof(inv_arg));
- memset(¶m, 0, sizeof(param));
- SET_INVOKE_ARG(inv_arg, obj_id,
QCOMTEE_UEFI_SEC_OP_GET_VAR,QCOMTEE_GET_VAR_NPARAMS);- SET_TEE_PARAM_UBUF(param[0], UBUF_INPUT, TEE_PARAM_UBUF(in_cong));
- SET_TEE_PARAM_UBUF(param[1], UBUF_INPUT, in_variable);
- SET_TEE_PARAM_UBUF(param[2], UBUF_INPUT, in_attributes);
- SET_TEE_PARAM_UBUF(param[3], UBUF_OUTPUT, TEE_PARAM_UBUF(out_cong));
- SET_TEE_PARAM_UBUF(param[4], UBUF_OUTPUT, *data);
- ret = tee_client_object_invoke_func(uefisec_app.ctx, &inv_arg, param);
- if (ret < 0 || inv_arg.ret != 0) {
dev_err(uefisec_app.dev, "QCOMTEE_UEFI_SEC_OP_GET_VAR invoke ret: %d, err: 0x%x\n",ret, inv_arg.ret);return ret ?: inv_arg.ret;- }
- data->size = out_cong.out_data_size;
- *out_attributes = out_cong.attributes;
- *out_errno = out_cong.errno;
- return ret;
+}
+static efi_status_t qcomtee_uefi_get_variable(efi_char16_t *name, efi_guid_t *guid,
u32 *attr, unsigned long *data_size,void *data)+{
- int ret;
- u32 in_attr, out_attributes, out_errno;
- struct tee_param_ubuf in_data, in_var, in_attributes;
- if (!name || !guid)
return EFI_INVALID_PARAMETER;- /*
* 'attr' can be NULL, however an input attribute is always expected* by UefiSecApp TA*/
You are enforceing a poliy on the arguments of a cb which is called publicly, are you sure all callers understand that this output value is optional? it is not specified anywhere as far as I can see. This seesm to be a TA thing.
- in_attr = 0;
- if (attr)
in_attr = *attr;- in_data = (struct tee_param_ubuf){ .addr = data, *data_size };
- in_var = (struct tee_param_ubuf){ .addr = name,
(ucs2_strlen(name) + 1) * sizeof(*name) };- in_attributes = (struct tee_param_ubuf){ .addr = &in_attr, sizeof(u32) };
- /* On SUCCESS, 'data' member of 'in_data' has already been updated. */
- ret = qcuefi_get_variable(in_var, guid, in_attributes, &in_data,
&out_attributes, &out_errno);- if (ret)
return EFI_DEVICE_ERROR;- if (!out_errno || out_errno == QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT) {
/* If 'attr' is NULL 'out_attributes' is not updated. */if (attr)*attr = out_attributes;*data_size = in_data.size;- }
- return uefisecapp_err_to_efi_status(out_errno);
+}
+static int qcuefi_set_variable(struct tee_param_ubuf in_variable, efi_guid_t *guid,
u32 attributes, struct tee_param_ubuf data,u32 *out_errno)+{
- int ret;
- struct tee_ioctl_object_invoke_arg inv_arg;
- u64 obj_id = uefisec_app.uefisec_svc_obj.id;
- struct tee_param param[QCOMTEE_SET_VAR_NPARAMS];
- struct {
efi_guid_t guid;u32 attributes;u32 in_data_size;- } in_cong = { 0 };
- in_cong.guid = *guid;
- in_cong.attributes = attributes;
- in_cong.in_data_size = data.size;
- memset(&inv_arg, 0, sizeof(inv_arg));
- memset(¶m, 0, sizeof(param));
- SET_INVOKE_ARG(inv_arg, obj_id,
QCOMTEE_UEFI_SEC_OP_SET_VAR,QCOMTEE_SET_VAR_NPARAMS);- SET_TEE_PARAM_UBUF(param[0], UBUF_INPUT, TEE_PARAM_UBUF(in_cong));
- SET_TEE_PARAM_UBUF(param[1], UBUF_INPUT, in_variable);
- SET_TEE_PARAM_UBUF(param[2], UBUF_INPUT, data);
- SET_TEE_PARAM_UBUF(param[3], UBUF_OUTPUT, TEE_PARAM_UBUF(*out_errno));
- ret = tee_client_object_invoke_func(uefisec_app.ctx, &inv_arg, param);
- if (ret < 0 || inv_arg.ret != 0) {
dev_err(uefisec_app.dev, "QCOMTEE_UEFI_SEC_OP_SET_VAR invoke ret: %d, err: 0x%x\n",ret, inv_arg.ret);return ret ?: inv_arg.ret;- }
- return ret;
+}
+static efi_status_t qcomtee_uefi_set_variable(efi_char16_t *name, efi_guid_t *guid,
u32 attr, unsigned long data_size,void *data)+{
- int ret;
- u32 out_errno;
- struct tee_param_ubuf in_data, in_var;
- if (!name || !guid)
return EFI_INVALID_PARAMETER;- in_data = (struct tee_param_ubuf){ .addr = data, data_size };
- in_var = (struct tee_param_ubuf){ .addr = name,
(ucs2_strlen(name) + 1) * sizeof(*name) };- ret = qcuefi_set_variable(in_var, guid, attr, in_data, &out_errno);
- if (ret)
return EFI_DEVICE_ERROR;- return uefisecapp_err_to_efi_status(out_errno);
+}
+static int qcuefi_get_next_variable(struct tee_param_ubuf in_variable, efi_guid_t *guid,
struct tee_param_ubuf *out_variable,efi_guid_t *out_vendor_guid, u32 *out_errno)+{
- int ret;
- struct tee_ioctl_object_invoke_arg inv_arg;
- u64 obj_id = uefisec_app.uefisec_svc_obj.id;
- struct tee_param param[QCOMTEE_GET_NEXT_VAR_NPARAMS];
- struct {
efi_guid_t guid;u32 in_data_size;- } in_cong = { 0 };
- struct {
efi_guid_t guid;u32 out_data_size;u32 errno;- } out_cong = { 0 };
- /* Pass size of available buffer */
- in_cong.in_data_size = out_variable->size;
- in_cong.guid = *guid;
- memset(&inv_arg, 0, sizeof(inv_arg));
- memset(¶m, 0, sizeof(param));
- SET_INVOKE_ARG(inv_arg, obj_id,
QCOMTEE_UEFI_SEC_OP_GET_NEXT_VAR_NAME,QCOMTEE_GET_NEXT_VAR_NPARAMS);- SET_TEE_PARAM_UBUF(param[0], UBUF_INPUT, TEE_PARAM_UBUF(in_cong));
- SET_TEE_PARAM_UBUF(param[1], UBUF_INPUT, in_variable);
- SET_TEE_PARAM_UBUF(param[2], UBUF_OUTPUT, TEE_PARAM_UBUF(out_cong));
- SET_TEE_PARAM_UBUF(param[3], UBUF_OUTPUT, *out_variable);
- ret = tee_client_object_invoke_func(uefisec_app.ctx, &inv_arg, param);
- if (ret < 0 || inv_arg.ret != 0) {
dev_err(uefisec_app.dev, "QCOMTEE_UEFI_SEC_OP_GET_NEXT_VAR_NAME invoke ret: %d, err: 0x%x\n",ret, inv_arg.ret);return ret ?: inv_arg.ret;- }
- /*
* UefiSecApp TA does not touch 'out_variable.size'. Update it here.* On SUCCESS (!out_errno), 'out_data_size' is length of name in* 'out_variable.addr'.* On failure (out_errno == QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT),* 'out_data_size' is actual name length.* Otherwise, it's undefined.*/- out_variable->size = out_cong.out_data_size;
- *out_vendor_guid = out_cong.guid;
- *out_errno = out_cong.errno;
- return ret;
+}
+static efi_status_t qcomtee_uefi_get_next_variable(unsigned long *name_size,
efi_char16_t *name,efi_guid_t *guid)+{
- int ret;
- u32 out_errno;
- efi_guid_t out_guid;
- struct tee_param_ubuf in_var, out_var;
- if (!name_size || !name || !guid)
return EFI_INVALID_PARAMETER;- if (*name_size == 0)
return EFI_INVALID_PARAMETER;- /*
* For 'in_var', 'name_size' is not necessarily size of 'name';* could be size of buffer where 'name' has been stored. TA expects a* NULL-terminated string in 'name' and ignores the size.* For 'out_var', 'name_size' is size of buffer pointed by 'name'.*/- in_var = (struct tee_param_ubuf){ .addr = name, *name_size };
- out_var = (struct tee_param_ubuf){ .addr = name, *name_size };
- ret = qcuefi_get_next_variable(in_var, guid, &out_var, &out_guid,
&out_errno);- if (ret)
return EFI_DEVICE_ERROR;- if (!out_errno)
*guid = out_guid;- if (!out_errno || out_errno == QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT)
*name_size = out_var.size;- /* On SUCCESS, 'name' stores the next variable name. */
- return uefisecapp_err_to_efi_status(out_errno);
+}
+static int qcuefi_query_variable_info(u32 attributes,
u64 *maximum_variable_storage_size,u64 *remaining_variable_storage_size,u64 *maximum_variable_size, u32 *out_errno)+{
- int ret;
- struct tee_ioctl_object_invoke_arg inv_arg;
- u64 obj_id = uefisec_app.uefisec_svc_obj.id;
- struct tee_param param[QCOMTEE_QUERY_VAR_NPARAMS];
- struct {
u64 max_var_storage_size;u64 remaining_var_storage_size;u64 maximum_var_size;u32 errno;- } out_cong = { 0 };
- memset(&inv_arg, 0, sizeof(inv_arg));
- memset(¶m, 0, sizeof(param));
- SET_INVOKE_ARG(inv_arg, obj_id,
QCOMTEE_UEFI_SEC_OP_QUERY_VAR_INFO,QCOMTEE_QUERY_VAR_NPARAMS);- SET_TEE_PARAM_UBUF(param[0], UBUF_INPUT, TEE_PARAM_UBUF(attributes));
- SET_TEE_PARAM_UBUF(param[1], UBUF_OUTPUT, TEE_PARAM_UBUF(out_cong));
- ret = tee_client_object_invoke_func(uefisec_app.ctx, &inv_arg, param);
- if (ret < 0 || inv_arg.ret != 0) {
dev_err(uefisec_app.dev, "QCOMTEE_UEFI_SEC_OP_QUERY_VAR_INFO invoke ret: %d, err: 0x%x\n",ret, inv_arg.ret);return ret ?: inv_arg.ret;- }
- *out_errno = out_cong.errno;
- if (!*out_errno) {
*maximum_variable_storage_size = out_cong.max_var_storage_size;*remaining_variable_storage_size = out_cong.remaining_var_storage_size;*maximum_variable_size = out_cong.maximum_var_size;- }
- return ret;
+}
+static efi_status_t qcomtee_uefi_query_variable_info(u32 attr, u64 *storage_space,
u64 *remaining_space,u64 *max_variable_size)+{
- int ret;
- u32 out_errno;
- if (!storage_space || !remaining_space || !max_variable_size)
return EFI_INVALID_PARAMETER;- ret = qcuefi_query_variable_info(attr,
storage_space,remaining_space,max_variable_size,&out_errno);- if (ret)
return EFI_DEVICE_ERROR;- return uefisecapp_err_to_efi_status(out_errno);
+}
+/**
- qcomtee_release_object() - Release an object returned by QTEE.
- Each object returned by QTEE repesents a secure service exposed to the
- client. Whenever an secure service is opened, QTEE may allocate resources
- on the client's behalf. Therefore, once the client is done accessing the
- secure service, the object representing it should be explicitly released
- so that QTEE can release the associated resources as well.
- @ctx: TEE context.
- @object: The object to release.
- */
+static void qcomtee_release_object(struct tee_context *ctx,
struct tee_param_objref object)+{
- struct tee_ioctl_object_invoke_arg inv_arg;
- memset(&inv_arg, 0, sizeof(inv_arg));
- SET_INVOKE_ARG(inv_arg, object.id, QCOMTEE_MSG_OBJECT_OP_RELEASE, 0);
- tee_client_object_invoke_func(ctx, &inv_arg, NULL);
+}
+/**
- qcomtee_get_uefisec_svc_obj() - Get a UEFI Secure App service object to
- begin communication with the service.
- @ctx: TEE context.
- @client_env_obj: The client environment object returned earlier by QTEE.
- @uefisec_svc_obj: The UEFI Secure App service object.
- Returns 0 on success.
- Returns < 0 if client environment object invocation failed.
- Returns > 0 if client environment invocation was success but UEFI Secure App
- service object could not be returned for some other reason (represented by the
- returned value)
- */
+static int qcomtee_get_uefisec_svc_obj(struct tee_context *ctx,
struct tee_param_objref client_env_obj,struct tee_param_objref *uefisec_svc_obj)+{
- int ret;
- struct tee_ioctl_object_invoke_arg inv_arg;
- u64 obj_id = client_env_obj.id;
- struct tee_param param[QCOMTEE_GET_UEFI_SVC_NPARAMS];
- u32 uefisec_uid = QCOMTEE_UEFI_SEC_UID;
- memset(&inv_arg, 0, sizeof(inv_arg));
- memset(¶m, 0, sizeof(param));
- SET_INVOKE_ARG(inv_arg, obj_id,
QCOMTEE_OP_CLIENT_ENV_OPEN,QCOMTEE_GET_UEFI_SVC_NPARAMS);- SET_TEE_PARAM_UBUF(param[0], UBUF_INPUT, TEE_PARAM_UBUF(uefisec_uid));
- SET_TEE_PARAM_OBJREF(param[1], OBJREF_OUTPUT, 0, 0);
- ret = tee_client_object_invoke_func(ctx, &inv_arg, param);
- if (ret < 0 || inv_arg.ret != 0) {
dev_err(uefisec_app.dev, "QCOMTEE_CLIENT_ENV_OPEN invoke ret: %d, err: 0x%x\n",ret, inv_arg.ret);return ret ?: inv_arg.ret;- }
- *uefisec_svc_obj = param[1].u.objref;
- return ret;
+}
+/**
- qcomtee_get_client_env_obj() - Get a client environment object to begin
- object exchange with QTEE.
- @ctx: TEE context.
- @client_env_obj: The client environment object returned by QTEE.
- Returns 0 on success.
- Returns < 0 if root object invocation failed.
- Returns > 0 if root object invocation was success but client environment
- object could not be returned for some other reason (represented by the
- returned value)
- */
+static int qcomtee_get_client_env_obj(struct tee_context *ctx,
struct tee_param_objref *client_env_obj)+{
- int ret;
- struct tee_ioctl_object_invoke_arg inv_arg;
- struct tee_param param[QCOMTEE_GET_CLIENT_ENV_NPARAMS];
- memset(&inv_arg, 0, sizeof(inv_arg));
- memset(¶m, 0, sizeof(param));
- SET_INVOKE_ARG(inv_arg, TEE_OBJREF_NULL,
QCOMTEE_ROOT_OP_REG_WITH_CREDENTIALS,QCOMTEE_GET_CLIENT_ENV_NPARAMS);- SET_TEE_PARAM_OBJREF(param[0], OBJREF_INPUT, TEE_OBJREF_NULL, 0);
- SET_TEE_PARAM_OBJREF(param[1], OBJREF_OUTPUT, 0, 0);
- ret = tee_client_object_invoke_func(ctx, &inv_arg, param);
- if (ret < 0 || inv_arg.ret != 0) {
dev_err(uefisec_app.dev, "QCOMTEE_ROOT_OP_REG_WITH_CREDENTIALS invoke ret: %d, err: 0x%x\n",ret, inv_arg.ret);return ret ?: inv_arg.ret;- }
- *client_env_obj = param[1].u.objref;
- return ret;
+}
+static const struct efivar_operations qcom_efivar_ops = {
- .get_variable = qcomtee_uefi_get_variable,
- .set_variable = qcomtee_uefi_set_variable,
Not sure how much it is relevant, but I was looking into the efi and in efivar_set_variable_locked, saw this comment "If no _nonblocking variant exists, the ordinary one is assumed to be non-blocking." which in not the case fo us.
Does it make sense to introduce something like qcomtee_uefi_set_variable_nonblocking and return UNSUPPORTED!?
- .get_next_variable = qcomtee_uefi_get_next_variable,
- .query_variable_info = qcomtee_uefi_query_variable_info,
+};
+static int qcomtee_ctx_match(struct tee_ioctl_version_data *ver,
const void *data)+{
- return (ver->impl_id == TEE_IMPL_ID_QTEE);
+}
+static int qcomtee_uefisecapp_probe(struct tee_client_device *tee_dev) +{
- int ret, err;
- struct tee_param_objref client_env_obj;
- struct tee_param_objref uefisec_svc_obj;
- uefisec_app.dev = &tee_dev->dev;
- /* Open context with QCOMTEE driver */
- uefisec_app.ctx = tee_client_open_context(NULL, qcomtee_ctx_match, NULL,
NULL);- if (IS_ERR(uefisec_app.ctx))
return -ENODEV;- ret = qcomtee_get_client_env_obj(uefisec_app.ctx, &client_env_obj);
- if (ret) {
err = -EINVAL;goto err_get_client_env;- }
- ret = qcomtee_get_uefisec_svc_obj(uefisec_app.ctx, client_env_obj,
&uefisec_svc_obj);- if (ret) {
err = -EINVAL;goto err_get_uefisec_svc;- }
- uefisec_app.uefisec_svc_obj = uefisec_svc_obj;
- ret = efivars_register(&uefisec_app.efivars, &qcom_efivar_ops);
- if (ret) {
err = ret;goto err_efi_vars_reg;- }
- /*
* We don't need to keep a reference to this object anymore, we only* needed it to obtain the uefisec_svc object.*/- qcomtee_release_object(uefisec_app.ctx, client_env_obj);
- return 0;
+err_efi_vars_reg:
- qcomtee_release_object(uefisec_app.ctx, uefisec_svc_obj);
+err_get_uefisec_svc:
- qcomtee_release_object(uefisec_app.ctx, client_env_obj);
+err_get_client_env:
- tee_client_close_context(uefisec_app.ctx);
- return err;
+}
+static void qcomtee_uefisecapp_remove(struct tee_client_device *tee_dev) +{
- efivars_unregister(&uefisec_app.efivars);
I still have concerns about the removal path. efivars_unregister() acquires the semaphore interruptibly and can return -EINTR, for example when a signal arrives while it waits for an active EFI operation. Its return value is ignored here, so removal can release the service object and close the TEE context while the EFI provider remains registered.
Separately, efivar_lock() appears to have an existing bug: it checks __efivars->ops without first checking whether __efivars is NULL. Successful unregister sets that pointer to NULL, so subsequent access through an existing efivarfs can dereference NULL. I Feel, that needs an EFI-core fix as well. what do you think?
- Amir
- qcomtee_release_object(uefisec_app.ctx, uefisec_app.uefisec_svc_obj);
- tee_client_close_context(uefisec_app.ctx);
+}
+static const struct tee_client_device_id qcomtee_uefisecapp_id_table[] = {
- {UEFISECAPP_UUID},
- {}
+}; +MODULE_DEVICE_TABLE(tee, qcomtee_uefisecapp_id_table);
+static struct tee_client_driver qcomtee_uefisecapp_driver = {
- .id_table = qcomtee_uefisecapp_id_table,
- .probe = qcomtee_uefisecapp_probe,
- .remove = qcomtee_uefisecapp_remove,
- .driver = {
.name = "qcom-tee-uefisecapp",- },
+};
+module_tee_client_driver(qcomtee_uefisecapp_driver);
+MODULE_AUTHOR("Qualcomm"); +MODULE_DESCRIPTION("TEE client driver for Qualcomm TEE UEFI Secure App"); +MODULE_LICENSE("GPL");
Hi Amir,
On 26-10-2026 10:14 am, Amirreza Zarrabi wrote:
Hi Harshal,
On 10/15/2026 10:39 PM, Harshal Dev wrote:
On Qualcomm SoC based platforms, UEFI stores EFI variables within the Replay Protected Memory Block (RPMB) located within either the UFS, eMMC or SPI-NOR storage. The RPMB key which is one-time programmed into the storage controller to allow authentication of the RPMB frames is generated by and only available to the Qualcomm Trusted Execution Environment (QTEE).
The legacy QSEECOM protocol used for communicating with the QTEE is deprecated and replaced with the use-case agnostic SMCInvoke protocol starting with the Qualcomm SM8x50 series. On platforms where the QSEECOM driver still probes, it does not support a listener interface with QTEE to enable writing of non-volatile EFI variables to the RPMB for UFS and eMMC storage. Therefore on such platforms, a TEE client driver which communicates with QTEE via the SMCInvoke protocol implemented by the QCOMTEE driver (and registered with the TEE subsystem) must be used to update such EFI variables.
Add support for a TEE based uefisecapp client driver which installs efivar operations after obtaining an object reference to the uefisecapp service. This enables the kernel/user-space to access or modify both volatile EFI variables stored by the Secure Application (in-memory) and non-volatile ones stored within RPMB.
Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com
MAINTAINERS | 6 + drivers/firmware/qcom/Kconfig | 31 ++ drivers/firmware/qcom/Makefile | 1 + drivers/firmware/qcom/qcom_tee_uefisecapp.c | 644 ++++++++++++++++++++++++++++ 4 files changed, 682 insertions(+)
[...]
diff --git a/drivers/firmware/qcom/qcom_tee_uefisecapp.c b/drivers/firmware/qcom/qcom_tee_uefisecapp.c new file mode 100644 index 000000000000..bcd025f929fc --- /dev/null +++ b/drivers/firmware/qcom/qcom_tee_uefisecapp.c @@ -0,0 +1,644 @@ +// SPDX-License-Identifier: GPL-2.0-only +/*
- Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
- */
+#include <linux/efi.h> +#include <linux/tee.h> +#include <linux/tee_drv.h> +#include <linux/ucs2_string.h>
[...]
+static efi_status_t qcomtee_uefi_get_variable(efi_char16_t *name, efi_guid_t *guid,
u32 *attr, unsigned long *data_size,void *data)+{
- int ret;
- u32 in_attr, out_attributes, out_errno;
- struct tee_param_ubuf in_data, in_var, in_attributes;
- if (!name || !guid)
return EFI_INVALID_PARAMETER;- /*
* 'attr' can be NULL, however an input attribute is always expected* by UefiSecApp TA*/You are enforceing a poliy on the arguments of a cb which is called publicly, are you sure all callers understand that this output value is optional? it is not specified anywhere as far as I can see. This seesm to be a TA thing.
I think the way this comment is written is a bit misleading. The comment is not about the output value of attr, it is about the input value passed to this callback.
The callers of this callback either pass a NULL value for attribute or a valid value. When they pass NULL, they ignore the output since it's expected to not be set by the implementation: https://elixir.bootlin.com/linux/v7.3/source/fs/efivarfs/vars.c#L505
When they pass a valid value, they expect a valid output in return and operate on it: https://elixir.bootlin.com/linux/v7.3/source/fs/efivarfs/file.c#L108 https://elixir.bootlin.com/linux/v7.3/source/fs/efivarfs/vars.c#L531 So the value is not optional, it is set or not set as per the expectation of the caller.
- in_attr = 0;
However, the SMCInvoke transport here needs this to not be NULL, and so we force set a 0 here which is interpreted corrected by the TA as attribute not set.
I will re-phrase this comment to avoid ambiguity.
- if (attr)
in_attr = *attr;- in_data = (struct tee_param_ubuf){ .addr = data, *data_size };
- in_var = (struct tee_param_ubuf){ .addr = name,
(ucs2_strlen(name) + 1) * sizeof(*name) };- in_attributes = (struct tee_param_ubuf){ .addr = &in_attr, sizeof(u32) };
- /* On SUCCESS, 'data' member of 'in_data' has already been updated. */
- ret = qcuefi_get_variable(in_var, guid, in_attributes, &in_data,
&out_attributes, &out_errno);- if (ret)
return EFI_DEVICE_ERROR;- if (!out_errno || out_errno == QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT) {
/* If 'attr' is NULL 'out_attributes' is not updated. */if (attr)*attr = out_attributes;*data_size = in_data.size;- }
- return uefisecapp_err_to_efi_status(out_errno);
+}
[...]
+static const struct efivar_operations qcom_efivar_ops = {
- .get_variable = qcomtee_uefi_get_variable,
- .set_variable = qcomtee_uefi_set_variable,
Not sure how much it is relevant, but I was looking into the efi and in efivar_set_variable_locked, saw this comment "If no _nonblocking variant exists, the ordinary one is assumed to be non-blocking." which in not the case fo us.
Does it make sense to introduce something like qcomtee_uefi_set_variable_nonblocking and return UNSUPPORTED!?
Ack, this ensures that if a caller expects the set_variable() to land in a non-blocking call, they get returned -ENOTSUPPORTED instead of being misled. As far as I can see only the x86 pstore implementation explicitly requests a call into a non-blocking variant: https://elixir.bootlin.com/linux/v7.3/source/drivers/firmware/efi/efi-pstore...
- .get_next_variable = qcomtee_uefi_get_next_variable,
- .query_variable_info = qcomtee_uefi_query_variable_info,
+};
+static int qcomtee_ctx_match(struct tee_ioctl_version_data *ver,
const void *data)+{
- return (ver->impl_id == TEE_IMPL_ID_QTEE);
+}
+static int qcomtee_uefisecapp_probe(struct tee_client_device *tee_dev) +{
- int ret, err;
- struct tee_param_objref client_env_obj;
- struct tee_param_objref uefisec_svc_obj;
- uefisec_app.dev = &tee_dev->dev;
- /* Open context with QCOMTEE driver */
- uefisec_app.ctx = tee_client_open_context(NULL, qcomtee_ctx_match, NULL,
NULL);- if (IS_ERR(uefisec_app.ctx))
return -ENODEV;- ret = qcomtee_get_client_env_obj(uefisec_app.ctx, &client_env_obj);
- if (ret) {
err = -EINVAL;goto err_get_client_env;- }
- ret = qcomtee_get_uefisec_svc_obj(uefisec_app.ctx, client_env_obj,
&uefisec_svc_obj);- if (ret) {
err = -EINVAL;goto err_get_uefisec_svc;- }
- uefisec_app.uefisec_svc_obj = uefisec_svc_obj;
- ret = efivars_register(&uefisec_app.efivars, &qcom_efivar_ops);
- if (ret) {
err = ret;goto err_efi_vars_reg;- }
- /*
* We don't need to keep a reference to this object anymore, we only* needed it to obtain the uefisec_svc object.*/- qcomtee_release_object(uefisec_app.ctx, client_env_obj);
- return 0;
+err_efi_vars_reg:
- qcomtee_release_object(uefisec_app.ctx, uefisec_svc_obj);
+err_get_uefisec_svc:
- qcomtee_release_object(uefisec_app.ctx, client_env_obj);
+err_get_client_env:
- tee_client_close_context(uefisec_app.ctx);
- return err;
+}
+static void qcomtee_uefisecapp_remove(struct tee_client_device *tee_dev) +{
- efivars_unregister(&uefisec_app.efivars);
I still have concerns about the removal path. efivars_unregister() acquires the semaphore interruptibly and can return -EINTR, for example when a signal arrives while it waits for an active EFI operation. Its return value is ignored here, so removal can release the service object and close the TEE context while the EFI provider remains registered.
This is a valid point. But it seems like no easy solution exists here. The driver core doesn't check the value being returned from remove(), so it will always detach the driver from the device.
Currently when -EINTR is returned, the driver is removed but __efivar->ops remain set, so a subsequent call to __efivars->ops would cause a kernel panic/crash. If we check for error here and return without releasing the service object/TEE context, we still have the same issues but now also a leak; QTEE's object table still has the service object and the TEE context remains allocated (while the driver is removed and __efivars->ops remain set to a random pointers).
Everyone else is also suffering the same race: https://elixir.bootlin.com/linux/v7.3/source/drivers/firmware/efi/stmm/tee_s... https://elixir.bootlin.com/linux/v7.3/source/drivers/firmware/qcom/qcom_qsee... https://elixir.bootlin.com/linux/v7.3/source/drivers/firmware/google/gsmi.c#...
This is a framework level issue, where a fail-safe fix is to use down() instead of down_interruptible() in efivar_unregister() and pray that whoever is invoking the callback comes out soon. But at least it replaces a sure-shot kernel panic with a low probability deadlock which can be diagnosed.
I thought about other ways, like using try_module_get() from either the callbacks or the efivar_register/unregister(), but neither solve this. I can try initiating a discussion on this separately on the efivar mailing list, unless there are any other innovative suggestions for solving it from within the driver. :)
Let me know your thoughts.
Separately, efivar_lock() appears to have an existing bug: it checks __efivars->ops without first checking whether __efivars is NULL. Successful unregister sets that pointer to NULL, so subsequent access through an existing efivarfs can dereference NULL. I Feel, that needs an EFI-core fix as well. what do you think?
Ack, this is true and a fix is straightforward. I will send a patch separately if someone hasn't already sent one.
Regards, Harshal
- Amir
Hi Harshal,
On 11/3/2026 7:35 PM, Harshal Dev wrote:
Hi Amir,
On 26-10-2026 10:14 am, Amirreza Zarrabi wrote:
Hi Harshal,
On 10/15/2026 10:39 PM, Harshal Dev wrote:
On Qualcomm SoC based platforms, UEFI stores EFI variables within the Replay Protected Memory Block (RPMB) located within either the UFS, eMMC or SPI-NOR storage. The RPMB key which is one-time programmed into the storage controller to allow authentication of the RPMB frames is generated by and only available to the Qualcomm Trusted Execution Environment (QTEE).
The legacy QSEECOM protocol used for communicating with the QTEE is deprecated and replaced with the use-case agnostic SMCInvoke protocol starting with the Qualcomm SM8x50 series. On platforms where the QSEECOM driver still probes, it does not support a listener interface with QTEE to enable writing of non-volatile EFI variables to the RPMB for UFS and eMMC storage. Therefore on such platforms, a TEE client driver which communicates with QTEE via the SMCInvoke protocol implemented by the QCOMTEE driver (and registered with the TEE subsystem) must be used to update such EFI variables.
Add support for a TEE based uefisecapp client driver which installs efivar operations after obtaining an object reference to the uefisecapp service. This enables the kernel/user-space to access or modify both volatile EFI variables stored by the Secure Application (in-memory) and non-volatile ones stored within RPMB.
Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com
MAINTAINERS | 6 + drivers/firmware/qcom/Kconfig | 31 ++ drivers/firmware/qcom/Makefile | 1 + drivers/firmware/qcom/qcom_tee_uefisecapp.c | 644 ++++++++++++++++++++++++++++ 4 files changed, 682 insertions(+)
[...]
diff --git a/drivers/firmware/qcom/qcom_tee_uefisecapp.c b/drivers/firmware/qcom/qcom_tee_uefisecapp.c new file mode 100644 index 000000000000..bcd025f929fc --- /dev/null +++ b/drivers/firmware/qcom/qcom_tee_uefisecapp.c @@ -0,0 +1,644 @@ +// SPDX-License-Identifier: GPL-2.0-only +/*
- Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
- */
+#include <linux/efi.h> +#include <linux/tee.h> +#include <linux/tee_drv.h> +#include <linux/ucs2_string.h>
[...]
+static efi_status_t qcomtee_uefi_get_variable(efi_char16_t *name, efi_guid_t *guid,
u32 *attr, unsigned long *data_size,void *data)+{
- int ret;
- u32 in_attr, out_attributes, out_errno;
- struct tee_param_ubuf in_data, in_var, in_attributes;
- if (!name || !guid)
return EFI_INVALID_PARAMETER;- /*
* 'attr' can be NULL, however an input attribute is always expected* by UefiSecApp TA*/You are enforceing a poliy on the arguments of a cb which is called publicly, are you sure all callers understand that this output value is optional? it is not specified anywhere as far as I can see. This seesm to be a TA thing.
I think the way this comment is written is a bit misleading. The comment is not about the output value of attr, it is about the input value passed to this callback.
The callers of this callback either pass a NULL value for attribute or a valid value. When they pass NULL, they ignore the output since it's expected to not be set by the implementation: https://elixir.bootlin.com/linux/v7.3/source/fs/efivarfs/vars.c#L505
When they pass a valid value, they expect a valid output in return and operate on it: https://elixir.bootlin.com/linux/v7.3/source/fs/efivarfs/file.c#L108 https://elixir.bootlin.com/linux/v7.3/source/fs/efivarfs/vars.c#L531 So the value is not optional, it is set or not set as per the expectation of the caller.
- in_attr = 0;
However, the SMCInvoke transport here needs this to not be NULL, and so we force set a 0 here which is interpreted corrected by the TA as attribute not set.
I will re-phrase this comment to avoid ambiguity.
I do not believe it is comment issue. I understand attr is an optional output value which could be NULL. However, this implementation also uses attr as input.
In your provided link: https://elixir.bootlin.com/linux/v7.3/source/fs/efivarfs/file.c#L108 attr that passed to this function is from stack and uninitialized, so the TA will get garbage in in_attr based on bellow code. It this acceptable?
- if (attr)
in_attr = *attr;- in_data = (struct tee_param_ubuf){ .addr = data, *data_size };
- in_var = (struct tee_param_ubuf){ .addr = name,
(ucs2_strlen(name) + 1) * sizeof(*name) };- in_attributes = (struct tee_param_ubuf){ .addr = &in_attr, sizeof(u32) };
- /* On SUCCESS, 'data' member of 'in_data' has already been updated. */
- ret = qcuefi_get_variable(in_var, guid, in_attributes, &in_data,
&out_attributes, &out_errno);- if (ret)
return EFI_DEVICE_ERROR;- if (!out_errno || out_errno == QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT) {
/* If 'attr' is NULL 'out_attributes' is not updated. */if (attr)*attr = out_attributes;*data_size = in_data.size;- }
- return uefisecapp_err_to_efi_status(out_errno);
+}
[...]
+static const struct efivar_operations qcom_efivar_ops = {
- .get_variable = qcomtee_uefi_get_variable,
- .set_variable = qcomtee_uefi_set_variable,
Not sure how much it is relevant, but I was looking into the efi and in efivar_set_variable_locked, saw this comment "If no _nonblocking variant exists, the ordinary one is assumed to be non-blocking." which in not the case fo us.
Does it make sense to introduce something like qcomtee_uefi_set_variable_nonblocking and return UNSUPPORTED!?
Ack, this ensures that if a caller expects the set_variable() to land in a non-blocking call, they get returned -ENOTSUPPORTED instead of being misled. As far as I can see only the x86 pstore implementation explicitly requests a call into a non-blocking variant: https://elixir.bootlin.com/linux/v7.3/source/drivers/firmware/efi/efi-pstore...
- .get_next_variable = qcomtee_uefi_get_next_variable,
- .query_variable_info = qcomtee_uefi_query_variable_info,
+};
+static int qcomtee_ctx_match(struct tee_ioctl_version_data *ver,
const void *data)+{
- return (ver->impl_id == TEE_IMPL_ID_QTEE);
+}
+static int qcomtee_uefisecapp_probe(struct tee_client_device *tee_dev) +{
- int ret, err;
- struct tee_param_objref client_env_obj;
- struct tee_param_objref uefisec_svc_obj;
- uefisec_app.dev = &tee_dev->dev;
- /* Open context with QCOMTEE driver */
- uefisec_app.ctx = tee_client_open_context(NULL, qcomtee_ctx_match, NULL,
NULL);- if (IS_ERR(uefisec_app.ctx))
return -ENODEV;- ret = qcomtee_get_client_env_obj(uefisec_app.ctx, &client_env_obj);
- if (ret) {
err = -EINVAL;goto err_get_client_env;- }
- ret = qcomtee_get_uefisec_svc_obj(uefisec_app.ctx, client_env_obj,
&uefisec_svc_obj);- if (ret) {
err = -EINVAL;goto err_get_uefisec_svc;- }
- uefisec_app.uefisec_svc_obj = uefisec_svc_obj;
- ret = efivars_register(&uefisec_app.efivars, &qcom_efivar_ops);
- if (ret) {
err = ret;goto err_efi_vars_reg;- }
- /*
* We don't need to keep a reference to this object anymore, we only* needed it to obtain the uefisec_svc object.*/- qcomtee_release_object(uefisec_app.ctx, client_env_obj);
- return 0;
+err_efi_vars_reg:
- qcomtee_release_object(uefisec_app.ctx, uefisec_svc_obj);
+err_get_uefisec_svc:
- qcomtee_release_object(uefisec_app.ctx, client_env_obj);
+err_get_client_env:
- tee_client_close_context(uefisec_app.ctx);
- return err;
+}
+static void qcomtee_uefisecapp_remove(struct tee_client_device *tee_dev) +{
- efivars_unregister(&uefisec_app.efivars);
I still have concerns about the removal path. efivars_unregister() acquires the semaphore interruptibly and can return -EINTR, for example when a signal arrives while it waits for an active EFI operation. Its return value is ignored here, so removal can release the service object and close the TEE context while the EFI provider remains registered.
This is a valid point. But it seems like no easy solution exists here. The driver core doesn't check the value being returned from remove(), so it will always detach the driver from the device.
Currently when -EINTR is returned, the driver is removed but __efivar->ops remain set, so a subsequent call to __efivars->ops would cause a kernel panic/crash. If we check for error here and return without releasing the service object/TEE context, we still have the same issues but now also a leak; QTEE's object table still has the service object and the TEE context remains allocated (while the driver is removed and __efivars->ops remain set to a random pointers).
Everyone else is also suffering the same race: https://elixir.bootlin.com/linux/v7.3/source/drivers/firmware/efi/stmm/tee_s... https://elixir.bootlin.com/linux/v7.3/source/drivers/firmware/qcom/qcom_qsee... https://elixir.bootlin.com/linux/v7.3/source/drivers/firmware/google/gsmi.c#...
This is a framework level issue, where a fail-safe fix is to use down() instead of down_interruptible() in efivar_unregister() and pray that whoever is invoking the callback comes out soon. But at least it replaces a sure-shot kernel panic with a low probability deadlock which can be diagnosed.
I thought about other ways, like using try_module_get() from either the callbacks or the efivar_register/unregister(), but neither solve this. I can try initiating a discussion on this separately on the efivar mailing list, unless there are any other innovative suggestions for solving it from within the driver. :)
Let me know your thoughts.
Separately, efivar_lock() appears to have an existing bug: it checks __efivars->ops without first checking whether __efivars is NULL. Successful unregister sets that pointer to NULL, so subsequent access through an existing efivarfs can dereference NULL. I Feel, that needs an EFI-core fix as well. what do you think?
Ack, this is true and a fix is straightforward. I will send a patch separately if someone hasn't already sent one.
Regards, Harshal
Yeah, you are right. Let's ignore it for now.
Best Regards, Amir
- Amir
Hi Amir,
On 05-11-2026 11:24 am, Amirreza Zarrabi wrote:
Hi Harshal,
On 11/3/2026 7:35 PM, Harshal Dev wrote:
Hi Amir,
On 26-10-2026 10:14 am, Amirreza Zarrabi wrote:
Hi Harshal,
On 10/15/2026 10:39 PM, Harshal Dev wrote:
On Qualcomm SoC based platforms, UEFI stores EFI variables within the Replay Protected Memory Block (RPMB) located within either the UFS, eMMC or SPI-NOR storage. The RPMB key which is one-time programmed into the storage controller to allow authentication of the RPMB frames is generated by and only available to the Qualcomm Trusted Execution Environment (QTEE).
The legacy QSEECOM protocol used for communicating with the QTEE is deprecated and replaced with the use-case agnostic SMCInvoke protocol starting with the Qualcomm SM8x50 series. On platforms where the QSEECOM driver still probes, it does not support a listener interface with QTEE to enable writing of non-volatile EFI variables to the RPMB for UFS and eMMC storage. Therefore on such platforms, a TEE client driver which communicates with QTEE via the SMCInvoke protocol implemented by the QCOMTEE driver (and registered with the TEE subsystem) must be used to update such EFI variables.
Add support for a TEE based uefisecapp client driver which installs efivar operations after obtaining an object reference to the uefisecapp service. This enables the kernel/user-space to access or modify both volatile EFI variables stored by the Secure Application (in-memory) and non-volatile ones stored within RPMB.
Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com
MAINTAINERS | 6 + drivers/firmware/qcom/Kconfig | 31 ++ drivers/firmware/qcom/Makefile | 1 + drivers/firmware/qcom/qcom_tee_uefisecapp.c | 644 ++++++++++++++++++++++++++++ 4 files changed, 682 insertions(+)
[...]
diff --git a/drivers/firmware/qcom/qcom_tee_uefisecapp.c b/drivers/firmware/qcom/qcom_tee_uefisecapp.c new file mode 100644 index 000000000000..bcd025f929fc --- /dev/null +++ b/drivers/firmware/qcom/qcom_tee_uefisecapp.c @@ -0,0 +1,644 @@ +// SPDX-License-Identifier: GPL-2.0-only +/*
- Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
- */
+#include <linux/efi.h> +#include <linux/tee.h> +#include <linux/tee_drv.h> +#include <linux/ucs2_string.h>
[...]
+static efi_status_t qcomtee_uefi_get_variable(efi_char16_t *name, efi_guid_t *guid,
u32 *attr, unsigned long *data_size,void *data)+{
- int ret;
- u32 in_attr, out_attributes, out_errno;
- struct tee_param_ubuf in_data, in_var, in_attributes;
- if (!name || !guid)
return EFI_INVALID_PARAMETER;- /*
* 'attr' can be NULL, however an input attribute is always expected* by UefiSecApp TA*/You are enforceing a poliy on the arguments of a cb which is called publicly, are you sure all callers understand that this output value is optional? it is not specified anywhere as far as I can see. This seesm to be a TA thing.
I think the way this comment is written is a bit misleading. The comment is not about the output value of attr, it is about the input value passed to this callback.
The callers of this callback either pass a NULL value for attribute or a valid value. When they pass NULL, they ignore the output since it's expected to not be set by the implementation: https://elixir.bootlin.com/linux/v7.3/source/fs/efivarfs/vars.c#L505
When they pass a valid value, they expect a valid output in return and operate on it: https://elixir.bootlin.com/linux/v7.3/source/fs/efivarfs/file.c#L108 https://elixir.bootlin.com/linux/v7.3/source/fs/efivarfs/vars.c#L531 So the value is not optional, it is set or not set as per the expectation of the caller.
- in_attr = 0;
However, the SMCInvoke transport here needs this to not be NULL, and so we force set a 0 here which is interpreted corrected by the TA as attribute not set.
I will re-phrase this comment to avoid ambiguity.
I do not believe it is comment issue. I understand attr is an optional output value which could be NULL. However, this implementation also uses attr as input.
In your provided link: https://elixir.bootlin.com/linux/v7.3/source/fs/efivarfs/file.c#L108 attr that passed to this function is from stack and uninitialized, so the TA will get garbage in in_attr based on bellow code. It this acceptable?
Yes, this is acceptable. As per the specification the implementation of this API does not care whether the pointer points to a valid value or garbage because the pointer is used to populated the output and any garbage pointed by the pointer is ignored. If the pointer is not NULL, then as per the spec an output value must be returned which populates the pointed memory with an attr bitmask, please see: https://uefi.org/specs/UEFI/2.10/08_Services_Runtime_Services.html#getvariab...
The TA implementation also aligns with this expectation.
Theoretically, if the TA were to consume the value passed here, it should anyway sanitize and check the input.
- if (attr)
in_attr = *attr;- in_data = (struct tee_param_ubuf){ .addr = data, *data_size };
- in_var = (struct tee_param_ubuf){ .addr = name,
(ucs2_strlen(name) + 1) * sizeof(*name) };- in_attributes = (struct tee_param_ubuf){ .addr = &in_attr, sizeof(u32) };
- /* On SUCCESS, 'data' member of 'in_data' has already been updated. */
- ret = qcuefi_get_variable(in_var, guid, in_attributes, &in_data,
&out_attributes, &out_errno);- if (ret)
return EFI_DEVICE_ERROR;- if (!out_errno || out_errno == QCOMTEE_UEFI_SEC_ERROR_SIZE_OUT) {
/* If 'attr' is NULL 'out_attributes' is not updated. */if (attr)*attr = out_attributes;*data_size = in_data.size;- }
- return uefisecapp_err_to_efi_status(out_errno);
+}
[...]
+static const struct efivar_operations qcom_efivar_ops = {
- .get_variable = qcomtee_uefi_get_variable,
- .set_variable = qcomtee_uefi_set_variable,
Not sure how much it is relevant, but I was looking into the efi and in efivar_set_variable_locked, saw this comment "If no _nonblocking variant exists, the ordinary one is assumed to be non-blocking." which in not the case fo us.
Does it make sense to introduce something like qcomtee_uefi_set_variable_nonblocking and return UNSUPPORTED!?
Ack, this ensures that if a caller expects the set_variable() to land in a non-blocking call, they get returned -ENOTSUPPORTED instead of being misled. As far as I can see only the x86 pstore implementation explicitly requests a call into a non-blocking variant: https://elixir.bootlin.com/linux/v7.3/source/drivers/firmware/efi/efi-pstore...
- .get_next_variable = qcomtee_uefi_get_next_variable,
- .query_variable_info = qcomtee_uefi_query_variable_info,
+};
+static int qcomtee_ctx_match(struct tee_ioctl_version_data *ver,
const void *data)+{
- return (ver->impl_id == TEE_IMPL_ID_QTEE);
+}
+static int qcomtee_uefisecapp_probe(struct tee_client_device *tee_dev) +{
- int ret, err;
- struct tee_param_objref client_env_obj;
- struct tee_param_objref uefisec_svc_obj;
- uefisec_app.dev = &tee_dev->dev;
- /* Open context with QCOMTEE driver */
- uefisec_app.ctx = tee_client_open_context(NULL, qcomtee_ctx_match, NULL,
NULL);- if (IS_ERR(uefisec_app.ctx))
return -ENODEV;- ret = qcomtee_get_client_env_obj(uefisec_app.ctx, &client_env_obj);
- if (ret) {
err = -EINVAL;goto err_get_client_env;- }
- ret = qcomtee_get_uefisec_svc_obj(uefisec_app.ctx, client_env_obj,
&uefisec_svc_obj);- if (ret) {
err = -EINVAL;goto err_get_uefisec_svc;- }
- uefisec_app.uefisec_svc_obj = uefisec_svc_obj;
- ret = efivars_register(&uefisec_app.efivars, &qcom_efivar_ops);
- if (ret) {
err = ret;goto err_efi_vars_reg;- }
- /*
* We don't need to keep a reference to this object anymore, we only* needed it to obtain the uefisec_svc object.*/- qcomtee_release_object(uefisec_app.ctx, client_env_obj);
- return 0;
+err_efi_vars_reg:
- qcomtee_release_object(uefisec_app.ctx, uefisec_svc_obj);
+err_get_uefisec_svc:
- qcomtee_release_object(uefisec_app.ctx, client_env_obj);
+err_get_client_env:
- tee_client_close_context(uefisec_app.ctx);
- return err;
+}
+static void qcomtee_uefisecapp_remove(struct tee_client_device *tee_dev) +{
- efivars_unregister(&uefisec_app.efivars);
I still have concerns about the removal path. efivars_unregister() acquires the semaphore interruptibly and can return -EINTR, for example when a signal arrives while it waits for an active EFI operation. Its return value is ignored here, so removal can release the service object and close the TEE context while the EFI provider remains registered.
This is a valid point. But it seems like no easy solution exists here. The driver core doesn't check the value being returned from remove(), so it will always detach the driver from the device.
Currently when -EINTR is returned, the driver is removed but __efivar->ops remain set, so a subsequent call to __efivars->ops would cause a kernel panic/crash. If we check for error here and return without releasing the service object/TEE context, we still have the same issues but now also a leak; QTEE's object table still has the service object and the TEE context remains allocated (while the driver is removed and __efivars->ops remain set to a random pointers).
Everyone else is also suffering the same race: https://elixir.bootlin.com/linux/v7.3/source/drivers/firmware/efi/stmm/tee_s... https://elixir.bootlin.com/linux/v7.3/source/drivers/firmware/qcom/qcom_qsee... https://elixir.bootlin.com/linux/v7.3/source/drivers/firmware/google/gsmi.c#...
This is a framework level issue, where a fail-safe fix is to use down() instead of down_interruptible() in efivar_unregister() and pray that whoever is invoking the callback comes out soon. But at least it replaces a sure-shot kernel panic with a low probability deadlock which can be diagnosed.
I thought about other ways, like using try_module_get() from either the callbacks or the efivar_register/unregister(), but neither solve this. I can try initiating a discussion on this separately on the efivar mailing list, unless there are any other innovative suggestions for solving it from within the driver. :)
Let me know your thoughts.
Separately, efivar_lock() appears to have an existing bug: it checks __efivars->ops without first checking whether __efivars is NULL. Successful unregister sets that pointer to NULL, so subsequent access through an existing efivarfs can dereference NULL. I Feel, that needs an EFI-core fix as well. what do you think?
Ack, this is true and a fix is straightforward. I will send a patch separately if someone hasn't already sent one.
Regards, Harshal
Yeah, you are right. Let's ignore it for now.
Ack, I will respond here with the sent fixes along with v6 of this series.
Regards, Harshal
Best Regards, Amir
- Amir
All Qualcomm SoCs starting from SM8x50 provide access to the Qualcomm Trusted Execution Environment (QTEE) through the SMCInvoke interface implemented by the QCOM-TEE driver. QTEE runs in the Secure World domain on ARM64 CPUs and exposes secure services to Linux running in the Normal World domain.
This change enables the UefiSecApp TEE client driver as a module to provide access to UEFI variables on Qualcomm SoCs via the uefisecapp Trusted Application running in QTEE. The TEE client driver communicates with QTEE via the QCOM-TEE driver.
Access to UEFI variables has been tested on a Qualcomm RB3Gen2 board via the efivar tool.
Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com --- arch/arm64/configs/defconfig | 1 + 1 file changed, 1 insertion(+)
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig index fce418fe6ff6..a8525878c679 100644 --- a/arch/arm64/configs/defconfig +++ b/arch/arm64/configs/defconfig @@ -277,6 +277,7 @@ CONFIG_IMX_SCU=y CONFIG_QCOM_TZMEM_MODE_SHMBRIDGE=y CONFIG_QCOM_QSEECOM=y CONFIG_QCOM_QSEECOM_UEFISECAPP=y +CONFIG_QCOM_TEE_UEFISECAPP=m CONFIG_EXYNOS_ACPM_PROTOCOL=m CONFIG_TEGRA_BPMP=y CONFIG_ZYNQMP_FIRMWARE_DEBUG=y
op-tee@lists.trustedfirmware.org
-
Amirreza Zarrabi -
Harshal Dev -
Kuldeep Singh