[RFC PATCH 0/2] firmware: qcom: scm: QSEECOM app loading and listener support

[Haozhen Li]

The QSEECOM interface in qcom_scm.c currently only supports interacting
with pre-loaded trusted applications via qcom_scm_qseecom_app_get_id() and
qcom_scm_qseecom_app_send(). It lacks support for loading applications at
runtime, unloading them, and servicing normal-world listener requests.

When an application requires normal-world interaction, the SMC returns
QSEECOM_RESULT_INCOMPLETE. Currently, qcom_scm_qseecom_call() issues a
WARN_ON() and returns 0 on incomplete calls, leaving the application
blocked in TrustZone and rendering subsequent QSEECOM calls unresponsive
(-EBUSY). This behavior is the primary reason the driver currently relies
on a machine allowlist (qcom_scm_qseecom_allowlist).

Design rationale:
Currently, QSEECOM expects apps to be pre-loaded by early bootloaders.
However, runtime loading via APP_START is required for modular devices
and trusted applications (e.g. fingerprint) whose lifecycles are tied to
user-space daemons or loadable drivers. Furthermore, dynamic loading and
unloading frees secure-world memory when the app is idle. We believe
providing qcom_scm_qseecom_app_load() and shutdown() within qcom_scm is
the least intrusive way to expose this firmware capability, but feedback
on whether this belongs here or should eventually hook into a higher-level
tee subsystem is very welcome.

This series implements the missing app-manager and listener commands:

Patch 1 adds qcom_scm_qseecom_app_load() and
qcom_scm_qseecom_app_shutdown() using the APP_START and APP_SHUTDOWN SMC
commands. It supports both split (.mdt) and single signed ELF images, and
enforces a <4 GiB physical address check required by the 32-bit SMC32
arguments.

Patch 2 introduces listener registration and request handling. During an
incomplete call, qcom_scm_qseecom_call() dispatches the request to the
registered listener callback and returns the result via LISTENER_RESPONSE.
An iteration limit prevents indefinite blocking in case of misbehaving
applications. The listener shared buffer is conservatively required to lie
entirely below 4 GiB, mirroring the image constraint of patch 1.

Removing the machine allowlist is deferred to follow-up work once existing
callers have been verified for re-entrancy.

This work builds upon the QSEECOM transport logic developed by Dawid Wrobel
and samcday [1], adapted to modern mainline interfaces (qcom_tzmem,
lockdep, and proper kerneldoc constraints).

In accordance with Documentation/process/generated-content.rst: an AI
assistant was used to port the transport logic onto current mainline APIs
and to draft the kerneldoc and commit messages. The architecture and code
were reviewed and validated on hardware by the author, who assumes full
DCO responsibility.

Build-tested on arm64 with defconfig and CONFIG_QCOM_QSEECOM=y (W=1 clean,
checkpatch --strict clean).

The transport logic this series ports has been exercised on hardware
before: on SDM670 through the work it derives from [1], and on sc8280xp
(huawei,gaokun3) through the equivalent out-of-tree patch. This exact
series has been boot-tested on sc8280xp (huawei,gaokun3) with an
out-of-tree client of the fingerprint trusted application: trustlet
loading and shutdown verified across multiple start/shutdown cycles
with consecutive loads succeeding (confirming that APP_SHUTDOWN releases
the secure-world memory and name), sensor initialization and image
capture stable across repeated enroll and verify transactions, and no
dmesg regressions compared to the out-of-tree baseline.

[1] https://github.com/samcday/linux
    branch codex/sargo-fingerprint-kernel11-baseline

Signed-off-by: Haozhen Li <dezige131@xxxxxxxxxxx>

Haozhen Li (2):
  firmware: qcom: scm: Add QSEECOM app loading and shutdown
  firmware: qcom: scm: Handle QSEECOM listener callbacks

 drivers/firmware/qcom/qcom_scm.c       | 394 ++++++++++++++++++++++++-
 include/linux/firmware/qcom/qcom_scm.h |  62 ++++
 2 files changed, 444 insertions(+), 12 deletions(-)


base-commit: cbbddb6b08cc9900a87cccaa9b22bbe06aa4f50a
-- 
2.43.0