Qualcomm TEE (QTEE) hosts Trusted Applications (TAs) and services in
the secure world, accessed via objects. A QTEE client can invoke these
objects to request services. Similarly, QTEE can request services from
the nonsecure world using objects exported to the secure world.
Add low-level primitives to facilitate the invocation of objects hosted
in QTEE, as well as those hosted in the nonsecure world.
If support for object invocation is available, the qcom_scm allocates
a dedicated child platform device. The driver for this device communicates
with QTEE using low-level primitives.
Tested-by: Neil Armstrong <neil.armstrong@linaro.org>
Tested-by: Harshal Dev <quic_hdev@quicinc.com>
Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
---
drivers/firmware/qcom/qcom_scm.c | 124 +++++++++++++++++++++++++++++++++
drivers/firmware/qcom/qcom_scm.h | 7 ++
include/linux/firmware/qcom/qcom_scm.h | 6 ++
3 files changed, 137 insertions(+)
diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
index edeae6cdcf31..739ee9819549 100644
--- a/drivers/firmware/qcom/qcom_scm.c
+++ b/drivers/firmware/qcom/qcom_scm.c
@@ -2094,6 +2094,127 @@ static int qcom_scm_qseecom_init(struct qcom_scm *scm)
#endif /* CONFIG_QCOM_QSEECOM */
+/**
+ * qcom_scm_qtee_invoke_smc() - Invoke a QTEE object.
+ * @inbuf: start address of memory area used for inbound buffer.
+ * @inbuf_size: size of the memory area used for inbound buffer.
+ * @outbuf: start address of memory area used for outbound buffer.
+ * @outbuf_size: size of the memory area used for outbound buffer.
+ * @result: result of QTEE object invocation.
+ * @response_type: response type returned by QTEE.
+ *
+ * @response_type determines how the contents of @inbuf and @outbuf
+ * should be processed.
+ *
+ * Return: On success, return 0 or <0 on failure.
+ */
+int qcom_scm_qtee_invoke_smc(phys_addr_t inbuf, size_t inbuf_size,
+ phys_addr_t outbuf, size_t outbuf_size,
+ u64 *result, u64 *response_type)
+{
+ struct qcom_scm_desc desc = {
+ .svc = QCOM_SCM_SVC_SMCINVOKE,
+ .cmd = QCOM_SCM_SMCINVOKE_INVOKE,
+ .owner = ARM_SMCCC_OWNER_TRUSTED_OS,
+ .args[0] = inbuf,
+ .args[1] = inbuf_size,
+ .args[2] = outbuf,
+ .args[3] = outbuf_size,
+ .arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_RW, QCOM_SCM_VAL,
+ QCOM_SCM_RW, QCOM_SCM_VAL),
+ };
+ struct qcom_scm_res res;
+ int ret;
+
+ ret = qcom_scm_call(__scm->dev, &desc, &res);
+ if (ret)
+ return ret;
+
+ if (response_type)
+ *response_type = res.result[0];
+
+ if (result)
+ *result = res.result[1];
+
+ return 0;
+}
+EXPORT_SYMBOL(qcom_scm_qtee_invoke_smc);
+
+/**
+ * qcom_scm_qtee_callback_response() - Submit response for callback request.
+ * @buf: start address of memory area used for outbound buffer.
+ * @buf_size: size of the memory area used for outbound buffer.
+ * @result: Result of QTEE object invocation.
+ * @response_type: Response type returned by QTEE.
+ *
+ * @response_type determines how the contents of @buf should be processed.
+ *
+ * Return: On success, return 0 or <0 on failure.
+ */
+int qcom_scm_qtee_callback_response(phys_addr_t buf, size_t buf_size,
+ u64 *result, u64 *response_type)
+{
+ struct qcom_scm_desc desc = {
+ .svc = QCOM_SCM_SVC_SMCINVOKE,
+ .cmd = QCOM_SCM_SMCINVOKE_CB_RSP,
+ .owner = ARM_SMCCC_OWNER_TRUSTED_OS,
+ .args[0] = buf,
+ .args[1] = buf_size,
+ .arginfo = QCOM_SCM_ARGS(2, QCOM_SCM_RW, QCOM_SCM_VAL),
+ };
+ struct qcom_scm_res res;
+ int ret;
+
+ ret = qcom_scm_call(__scm->dev, &desc, &res);
+ if (ret)
+ return ret;
+
+ if (response_type)
+ *response_type = res.result[0];
+
+ if (result)
+ *result = res.result[1];
+
+ return 0;
+}
+EXPORT_SYMBOL(qcom_scm_qtee_callback_response);
+
+static void qcom_scm_qtee_free(void *data)
+{
+ struct platform_device *qtee_dev = data;
+
+ platform_device_unregister(qtee_dev);
+}
+
+static void qcom_scm_qtee_init(struct qcom_scm *scm)
+{
+ struct platform_device *qtee_dev;
+ u64 result, response_type;
+ int ret;
+
+ /*
+ * Probe for smcinvoke support. This will fail due to invalid buffers,
+ * but first, it checks whether the call is supported in QTEE syscall
+ * handler. If it is not supported, -EIO is returned.
+ */
+ ret = qcom_scm_qtee_invoke_smc(0, 0, 0, 0, &result, &response_type);
+ if (ret == -EIO)
+ return;
+
+ /* Setup QTEE interface device. */
+ qtee_dev = platform_device_register_data(scm->dev, "qcomtee",
+ PLATFORM_DEVID_NONE, NULL, 0);
+ if (IS_ERR(qtee_dev)) {
+ dev_err(scm->dev, "qcomtee: register failed: %d\n",
+ PTR_ERR(qtee_dev));
+ return;
+ }
+
+ ret = devm_add_action_or_reset(scm->dev, qcom_scm_qtee_free, qtee_dev);
+ if (ret)
+ dev_err(scm->dev, "qcomtee: add action failed: %d\n", ret);
+}
+
/**
* qcom_scm_is_available() - Checks if SCM is available
*/
@@ -2326,6 +2447,9 @@ static int qcom_scm_probe(struct platform_device *pdev)
ret = qcom_scm_qseecom_init(scm);
WARN(ret < 0, "failed to initialize qseecom: %d\n", ret);
+ /* Initialize the QTEE object interface. */
+ qcom_scm_qtee_init(scm);
+
return 0;
}
diff --git a/drivers/firmware/qcom/qcom_scm.h b/drivers/firmware/qcom/qcom_scm.h
index 0e8dd838099e..a56c8212cc0c 100644
--- a/drivers/firmware/qcom/qcom_scm.h
+++ b/drivers/firmware/qcom/qcom_scm.h
@@ -156,6 +156,13 @@ int qcom_scm_shm_bridge_enable(struct device *scm_dev);
#define QCOM_SCM_SVC_GPU 0x28
#define QCOM_SCM_SVC_GPU_INIT_REGS 0x01
+/* ARM_SMCCC_OWNER_TRUSTED_OS calls */
+
+#define QCOM_SCM_SVC_SMCINVOKE 0x06
+#define QCOM_SCM_SMCINVOKE_INVOKE_LEGACY 0x00
+#define QCOM_SCM_SMCINVOKE_CB_RSP 0x01
+#define QCOM_SCM_SMCINVOKE_INVOKE 0x02
+
/* common error codes */
#define QCOM_SCM_V2_EBUSY -12
#define QCOM_SCM_ENOMEM -5
diff --git a/include/linux/firmware/qcom/qcom_scm.h b/include/linux/firmware/qcom/qcom_scm.h
index 0f667bf1d4d9..a55ca771286b 100644
--- a/include/linux/firmware/qcom/qcom_scm.h
+++ b/include/linux/firmware/qcom/qcom_scm.h
@@ -175,4 +175,10 @@ static inline int qcom_scm_qseecom_app_send(u32 app_id,
#endif /* CONFIG_QCOM_QSEECOM */
+int qcom_scm_qtee_invoke_smc(phys_addr_t inbuf, size_t inbuf_size,
+ phys_addr_t outbuf, size_t outbuf_size,
+ u64 *result, u64 *response_type);
+int qcom_scm_qtee_callback_response(phys_addr_t buf, size_t buf_size,
+ u64 *result, u64 *response_type);
+
#endif
--
2.34.1On Mon, Sep 01, 2025 at 09:55:53PM -0700, Amirreza Zarrabi wrote:
> Qualcomm TEE (QTEE) hosts Trusted Applications (TAs) and services in
> the secure world, accessed via objects. A QTEE client can invoke these
> objects to request services. Similarly, QTEE can request services from
> the nonsecure world using objects exported to the secure world.
>
> Add low-level primitives to facilitate the invocation of objects hosted
> in QTEE, as well as those hosted in the nonsecure world.
>
> If support for object invocation is available, the qcom_scm allocates
> a dedicated child platform device. The driver for this device communicates
> with QTEE using low-level primitives.
>
> Tested-by: Neil Armstrong <neil.armstrong@linaro.org>
> Tested-by: Harshal Dev <quic_hdev@quicinc.com>
> Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
> ---
> drivers/firmware/qcom/qcom_scm.c | 124 +++++++++++++++++++++++++++++++++
> drivers/firmware/qcom/qcom_scm.h | 7 ++
> include/linux/firmware/qcom/qcom_scm.h | 6 ++
> 3 files changed, 137 insertions(+)
>
> diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
> index edeae6cdcf31..739ee9819549 100644
> --- a/drivers/firmware/qcom/qcom_scm.c
> +++ b/drivers/firmware/qcom/qcom_scm.c
> @@ -2094,6 +2094,127 @@ static int qcom_scm_qseecom_init(struct qcom_scm *scm)
>
> #endif /* CONFIG_QCOM_QSEECOM */
>
> +/**
> + * qcom_scm_qtee_invoke_smc() - Invoke a QTEE object.
> + * @inbuf: start address of memory area used for inbound buffer.
> + * @inbuf_size: size of the memory area used for inbound buffer.
> + * @outbuf: start address of memory area used for outbound buffer.
> + * @outbuf_size: size of the memory area used for outbound buffer.
> + * @result: result of QTEE object invocation.
> + * @response_type: response type returned by QTEE.
> + *
> + * @response_type determines how the contents of @inbuf and @outbuf
> + * should be processed.
> + *
> + * Return: On success, return 0 or <0 on failure.
> + */
> +int qcom_scm_qtee_invoke_smc(phys_addr_t inbuf, size_t inbuf_size,
> + phys_addr_t outbuf, size_t outbuf_size,
> + u64 *result, u64 *response_type)
> +{
> + struct qcom_scm_desc desc = {
> + .svc = QCOM_SCM_SVC_SMCINVOKE,
> + .cmd = QCOM_SCM_SMCINVOKE_INVOKE,
> + .owner = ARM_SMCCC_OWNER_TRUSTED_OS,
> + .args[0] = inbuf,
> + .args[1] = inbuf_size,
> + .args[2] = outbuf,
> + .args[3] = outbuf_size,
> + .arginfo = QCOM_SCM_ARGS(4, QCOM_SCM_RW, QCOM_SCM_VAL,
> + QCOM_SCM_RW, QCOM_SCM_VAL),
> + };
> + struct qcom_scm_res res;
> + int ret;
> +
> + ret = qcom_scm_call(__scm->dev, &desc, &res);
> + if (ret)
> + return ret;
> +
> + if (response_type)
> + *response_type = res.result[0];
> +
> + if (result)
> + *result = res.result[1];
> +
> + return 0;
> +}
> +EXPORT_SYMBOL(qcom_scm_qtee_invoke_smc);
> +
> +/**
> + * qcom_scm_qtee_callback_response() - Submit response for callback request.
> + * @buf: start address of memory area used for outbound buffer.
> + * @buf_size: size of the memory area used for outbound buffer.
> + * @result: Result of QTEE object invocation.
> + * @response_type: Response type returned by QTEE.
> + *
> + * @response_type determines how the contents of @buf should be processed.
> + *
> + * Return: On success, return 0 or <0 on failure.
> + */
> +int qcom_scm_qtee_callback_response(phys_addr_t buf, size_t buf_size,
> + u64 *result, u64 *response_type)
> +{
> + struct qcom_scm_desc desc = {
> + .svc = QCOM_SCM_SVC_SMCINVOKE,
> + .cmd = QCOM_SCM_SMCINVOKE_CB_RSP,
> + .owner = ARM_SMCCC_OWNER_TRUSTED_OS,
> + .args[0] = buf,
> + .args[1] = buf_size,
> + .arginfo = QCOM_SCM_ARGS(2, QCOM_SCM_RW, QCOM_SCM_VAL),
> + };
> + struct qcom_scm_res res;
> + int ret;
> +
> + ret = qcom_scm_call(__scm->dev, &desc, &res);
> + if (ret)
> + return ret;
> +
> + if (response_type)
> + *response_type = res.result[0];
> +
> + if (result)
> + *result = res.result[1];
> +
> + return 0;
> +}
> +EXPORT_SYMBOL(qcom_scm_qtee_callback_response);
> +
> +static void qcom_scm_qtee_free(void *data)
> +{
> + struct platform_device *qtee_dev = data;
> +
> + platform_device_unregister(qtee_dev);
> +}
> +
> +static void qcom_scm_qtee_init(struct qcom_scm *scm)
> +{
> + struct platform_device *qtee_dev;
> + u64 result, response_type;
> + int ret;
> +
> + /*
> + * Probe for smcinvoke support. This will fail due to invalid buffers,
> + * but first, it checks whether the call is supported in QTEE syscall
> + * handler. If it is not supported, -EIO is returned.
> + */
> + ret = qcom_scm_qtee_invoke_smc(0, 0, 0, 0, &result, &response_type);
> + if (ret == -EIO)
> + return;
> +
> + /* Setup QTEE interface device. */
> + qtee_dev = platform_device_register_data(scm->dev, "qcomtee",
> + PLATFORM_DEVID_NONE, NULL, 0);
> + if (IS_ERR(qtee_dev)) {
> + dev_err(scm->dev, "qcomtee: register failed: %d\n",
> + PTR_ERR(qtee_dev));
This isn't going to fail, and all expected paths that it would fail will
be -ENOMEM which already printed a warning. So, I'd suggest that you
resolve the LKP build warning by dropping the print.
> + return;
> + }
> +
> + ret = devm_add_action_or_reset(scm->dev, qcom_scm_qtee_free, qtee_dev);
> + if (ret)
> + dev_err(scm->dev, "qcomtee: add action failed: %d\n", ret);
The only possible error here is -ENOMEM, so you can skip the print.
Regards,
Bjorn
> +}
> +
> /**
> * qcom_scm_is_available() - Checks if SCM is available
> */
> @@ -2326,6 +2447,9 @@ static int qcom_scm_probe(struct platform_device *pdev)
> ret = qcom_scm_qseecom_init(scm);
> WARN(ret < 0, "failed to initialize qseecom: %d\n", ret);
>
> + /* Initialize the QTEE object interface. */
> + qcom_scm_qtee_init(scm);
> +
> return 0;
> }
>
> diff --git a/drivers/firmware/qcom/qcom_scm.h b/drivers/firmware/qcom/qcom_scm.h
> index 0e8dd838099e..a56c8212cc0c 100644
> --- a/drivers/firmware/qcom/qcom_scm.h
> +++ b/drivers/firmware/qcom/qcom_scm.h
> @@ -156,6 +156,13 @@ int qcom_scm_shm_bridge_enable(struct device *scm_dev);
> #define QCOM_SCM_SVC_GPU 0x28
> #define QCOM_SCM_SVC_GPU_INIT_REGS 0x01
>
> +/* ARM_SMCCC_OWNER_TRUSTED_OS calls */
> +
> +#define QCOM_SCM_SVC_SMCINVOKE 0x06
> +#define QCOM_SCM_SMCINVOKE_INVOKE_LEGACY 0x00
> +#define QCOM_SCM_SMCINVOKE_CB_RSP 0x01
> +#define QCOM_SCM_SMCINVOKE_INVOKE 0x02
> +
> /* common error codes */
> #define QCOM_SCM_V2_EBUSY -12
> #define QCOM_SCM_ENOMEM -5
> diff --git a/include/linux/firmware/qcom/qcom_scm.h b/include/linux/firmware/qcom/qcom_scm.h
> index 0f667bf1d4d9..a55ca771286b 100644
> --- a/include/linux/firmware/qcom/qcom_scm.h
> +++ b/include/linux/firmware/qcom/qcom_scm.h
> @@ -175,4 +175,10 @@ static inline int qcom_scm_qseecom_app_send(u32 app_id,
>
> #endif /* CONFIG_QCOM_QSEECOM */
>
> +int qcom_scm_qtee_invoke_smc(phys_addr_t inbuf, size_t inbuf_size,
> + phys_addr_t outbuf, size_t outbuf_size,
> + u64 *result, u64 *response_type);
> +int qcom_scm_qtee_callback_response(phys_addr_t buf, size_t buf_size,
> + u64 *result, u64 *response_type);
> +
> #endif
>
> --
> 2.34.1
>
Hi Amirreza,
kernel test robot noticed the following build warnings:
[auto build test WARNING on 33bcf93b9a6b028758105680f8b538a31bc563cf]
url: https://github.com/intel-lab-lkp/linux/commits/Amirreza-Zarrabi/tee-allow-a-driver-to-allocate-a-tee_device-without-a-pool/20250902-125821
base: 33bcf93b9a6b028758105680f8b538a31bc563cf
patch link: https://lore.kernel.org/r/20250901-qcom-tee-using-tee-ss-without-mem-obj-v9-6-a2af23f132d5%40oss.qualcomm.com
patch subject: [PATCH v9 06/11] firmware: qcom: scm: add support for object invocation
config: i386-buildonly-randconfig-001-20250903 (https://download.01.org/0day-ci/archive/20250903/202509030554.WR3MNpCE-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250903/202509030554.WR3MNpCE-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509030554.WR3MNpCE-lkp@intel.com/
All warnings (new ones prefixed by >>):
In file included from include/linux/device.h:15,
from include/linux/dma-mapping.h:5,
from drivers/firmware/qcom/qcom_scm.c:13:
drivers/firmware/qcom/qcom_scm.c: In function 'qcom_scm_qtee_init':
>> drivers/firmware/qcom/qcom_scm.c:2208:35: warning: format '%d' expects argument of type 'int', but argument 3 has type 'long int' [-Wformat=]
2208 | dev_err(scm->dev, "qcomtee: register failed: %d\n",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/dev_printk.h:110:30: note: in definition of macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~
include/linux/dev_printk.h:154:56: note: in expansion of macro 'dev_fmt'
154 | dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~
drivers/firmware/qcom/qcom_scm.c:2208:17: note: in expansion of macro 'dev_err'
2208 | dev_err(scm->dev, "qcomtee: register failed: %d\n",
| ^~~~~~~
drivers/firmware/qcom/qcom_scm.c:2208:63: note: format string is defined here
2208 | dev_err(scm->dev, "qcomtee: register failed: %d\n",
| ~^
| |
| int
| %ld
vim +2208 drivers/firmware/qcom/qcom_scm.c
2188
2189 static void qcom_scm_qtee_init(struct qcom_scm *scm)
2190 {
2191 struct platform_device *qtee_dev;
2192 u64 result, response_type;
2193 int ret;
2194
2195 /*
2196 * Probe for smcinvoke support. This will fail due to invalid buffers,
2197 * but first, it checks whether the call is supported in QTEE syscall
2198 * handler. If it is not supported, -EIO is returned.
2199 */
2200 ret = qcom_scm_qtee_invoke_smc(0, 0, 0, 0, &result, &response_type);
2201 if (ret == -EIO)
2202 return;
2203
2204 /* Setup QTEE interface device. */
2205 qtee_dev = platform_device_register_data(scm->dev, "qcomtee",
2206 PLATFORM_DEVID_NONE, NULL, 0);
2207 if (IS_ERR(qtee_dev)) {
> 2208 dev_err(scm->dev, "qcomtee: register failed: %d\n",
2209 PTR_ERR(qtee_dev));
2210 return;
2211 }
2212
2213 ret = devm_add_action_or_reset(scm->dev, qcom_scm_qtee_free, qtee_dev);
2214 if (ret)
2215 dev_err(scm->dev, "qcomtee: add action failed: %d\n", ret);
2216 }
2217
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
© 2016 - 2026 Red Hat, Inc.