''QUALCOMM TEE'' (QTEE) TRANSPORT MESSAGE(9)

💅 ''QUALCOMM TEE'' (QTEE) TRANSPORT MESSAGE(9)

Manual name unlocked: ''Qualcomm TEE'' (QTEE) Transport Message, and yes she's from the Kernel API Manual. Buckle up, bestie — this is the group chat where the kernel and QTEE pass notes. 💌

✨ DESCRIPTION

Okay so there are two buffers shared with QTEE: the inbound buffer and the outbound buffer. The inbound buffer is for direct object invocation. The outbound buffer is for making a request from QTEE to the kernel — i.e., a callback request. Periodt. 🫶

The unused tail of the outbound buffer is also where sending and receiving asynchronous messages happens. An asynchronous message is independent of the current object invocation (i.e., the contents of the inbound buffer) or the callback request (i.e., the head of the outbound buffer); see qcomtee_get_async_buffer. It's used by endpoints (QTEE or kernel) as an optimization to reduce the number of context switches between the secure and non-secure worlds. Lowkey iconic. 🌈

For instance, QTEE never sends an explicit callback request to release an object in the kernel. Instead, it sends asynchronous release messages in the outbound buffer when QTEE returns from the previous direct object invocation, or it appends asynchronous release messages after the current callback request. No cap. 💀

QTEE supports two types of arguments in a message: buffer arguments and object arguments. Depending on the direction of data flow, they could be:

• input buffer (IO) to QTEE
• output buffer (OB) from QTEE
• input object (IO) to QTEE
• output object (OO) from QTEE

Object arguments hold object IDs. Buffer arguments hold (offset, size) pairs into the inbound or outbound buffers. That's the notation — yes, the page literally has IO for both input buffer and input object; I don't make the rules, I just report them. 🙈

QTEE holds an object table for objects it hosts and exposes to the kernel. An object ID is an index to that object table in QTEE. Slay. 👑

Here's the format lore: for the direct object invocation message format in the inbound buffer, see struct qcomtee_msg_object_invoke. For the callback request message format in the outbound buffer, see struct qcomtee_msg_callback. For the message format for asynchronous messages in the outbound buffer, see struct qcomtee_async_msg_hdr. All the receipts are in the structs, bestie. 📚

👀 SEE ALSO

• Kernel file ./drivers/tee/qcomtee/qcomtee_msg.h
• QCOMTEE_MSG_OBJECT_NS_BIT(9)
• struct qcomtee_msg_object_invoke(9)
• struct qcomtee_msg_callback(9)

That's the whole page, bestie 💖 — source/version: ./drivers/tee/qcomtee, date: October 2026. Mwah, bye! ✨