Skip to content

platforms: qcom: expand and reorganize platform documentation - #292

Open
zelvam95 wants to merge 4 commits into
OP-TEE:masterfrom
zelvam95:doc/qcom-plat-arch-doc
Open

zelvam95 wants to merge 4 commits into
OP-TEE:masterfrom
zelvam95:doc/qcom-plat-arch-doc

Conversation

@zelvam95

@zelvam95 zelvam95 commented Sep 18, 2026 •

Copy link
Copy Markdown

Summary

Update the Qualcomm platform documentation to reflect current upstream
support and clarify driver scope, authentication behavior, and platform
security responsibilities.

  • Hoya and Bobcat: Correct stale configuration references and expand
    the documentation to explain driver and service purposes and chipset
    coverage. Document Kodiak's specific software workaround to vote for
    0.95 V on the MX rail during fuse blowing, including the Command DB
    lookup and RPMh vote. Add a Hoya comparison table covering PAS
    signature-authentication support and Hardware Unique Key sources.

  • Qualcomm overview: Distinguish common features from platform-dependent
    features and provide navigation to the architecture-family pages and
    separate security topics.

  • PAS authentication: Add an architecture overview describing the
    REE-facing TA and its direct calls to the PAS core and fuse PTAs, with
    a high-level authentication and bring-up sequence diagram. Document
    chipset coverage, the kernel's EL2 execution requirement, and the
    distinction between signature verification and firmware hash checks.
    Clarify that, with authentication support enabled, signature verification
    is skipped only when secure-boot fuses explicitly report that secure
    boot is disabled; firmware hashes are still checked.

  • Security disclaimer: Add a platform-wide page explaining that product
    security depends on correctly configured secure boot and memory
    protection, including settings managed by TF-A.

  • Wildcat: Add a page for the nord chipset documenting its 18-core
    Oryon configuration and GICv4 support, and link it from the Qualcomm
    overview. Explain in the security disclaimer that Wildcat's DARE-TZ
    inline memory encryption is configured by the Trust Management Engine
    (TME), outside the OP-TEE and TF-A code covered by this documentation.

@zelvam95
zelvam95 force-pushed the doc/qcom-plat-arch-doc branch 3 times, most recently from 787f0e5 to 6deeb7c Compare September 18, 2026 18:10
@ldts

ldts commented Sep 19, 2026

Copy link
Copy Markdown
Contributor

thanks @zelvam95 for picking this up for the upcoming release. having a look now

@ldts

ldts commented Sep 19, 2026 •

Copy link
Copy Markdown
Contributor

@zelvam95 lets move PAS. We have Common Platform Support; we could have Platform Dependent Features and add PAS there ...maybe rethink the section names (Common Platform Features, Platform Dependent Features?)

For the PAS section, please mention that the architecture depends on Linux executing at EL2 so that the kernel can set up the translation tables (memory resources) required by the coprocessors to access memory.

Maybe a good idea to implement a security disclaimer just as NXP does - there seems to be an expectation from the user side that the firmware should be secure by default (which will never be the case). Also perhaps a suggestion to review the TF-A source for the platform's bl31 security settings seems appropiate as well (XPU gets enabled there for Hoya).

Still lets aim to make these reference docs as minimal as possible so they dont decay.

lets see if we can provide links to the TRMs - should be available publicly soon

@ldts

ldts commented Sep 19, 2026

Copy link
Copy Markdown
Contributor

also I am clearly not an UX designer, but could you check how scalable this format is going to be - thinking about the table.

@zelvam95
zelvam95 force-pushed the doc/qcom-plat-arch-doc branch from 6deeb7c to eb0e2db Compare September 20, 2026 17:35
Refresh driver and configuration references on the Hoya and top-level
Qualcomm pages to match the current plat-qcom implementation, which
has continued to evolve upstream.

Signed-off-by: Selvam Sathappan Periakaruppan <selvam.periakaruppan@oss.qualcomm.com>
Assisted-by: Claude:sonnet-5
@zelvam95
zelvam95 force-pushed the doc/qcom-plat-arch-doc branch from eb0e2db to 63a035c Compare September 20, 2026 17:49
@zelvam95 zelvam95 changed the title platforms: qcom: expand driver documentation and add PAS overview platforms: qcom: expand and reorganize platform documentation Sep 20, 2026
@zelvam95

Copy link
Copy Markdown
Author

@ldts, Thanks for the feedback.

Have added note on TF-A BL31 security settings and Kernel EL2 translation setup/etc..
Have made some updates to make it easy to scale to more arch/targets.

Let me know if you have any other feedback.

Comment thread architecture/platforms/qualcomm/pas_authentication.rst Outdated
@zelvam95
zelvam95 force-pushed the doc/qcom-plat-arch-doc branch 3 times, most recently from 2ae4e5a to 965d6fb Compare September 21, 2026 17:01
Explain the purpose and chipset scope of Hoya and Bobcat drivers and
services so integrators can identify the features each chipset provides.
Distinguish common from platform-dependent features in the Qualcomm
overview.

Document Kodiak's 0.95 V MX-rail workaround for fuse blowing and the
Command DB lookup followed by an RPMh vote. Add a Hoya comparison of
PAS signature-authentication support and Hardware Unique Key sources,
and explain the secure-boot fuse condition for signature enforcement.

Signed-off-by: Selvam Sathappan Periakaruppan <selvam.periakaruppan@oss.qualcomm.com>
Assisted-by: Claude:sonnet-5
Add a PAS architecture page describing the TA's direct calls to the core
and fuse PTAs. Explain the split between signature and segment-hash
verification and the secure-boot fuse policy on Lemans, and document
chipset coverage and the kernel's EL2 execution requirement.

Add a platform-wide security disclaimer explaining that OP-TEE relies on
the product's secure-boot and memory-protection configuration, including
settings in TF-A.

Link the PAS page from Hoya and the Qualcomm overview. Add the PAS and
security-disclaimer pages to the overview's security-topic toctree.

Signed-off-by: Selvam Sathappan Periakaruppan <selvam.periakaruppan@oss.qualcomm.com>
Assisted-by: Claude:sonnet-5
@zelvam95
zelvam95 force-pushed the doc/qcom-plat-arch-doc branch from 965d6fb to 5540419 Compare September 21, 2026 17:29
Add a Wildcat architecture page for Nord, documenting its 18 Oryon cores
and GICv4 configuration. Link the page from the Qualcomm architecture
list and toctree, and update the platform-support note for three
architecture families.

Explain that the Trust Management Engine (TME) configures DARE-TZ inline
memory encryption, so this setup is outside the OP-TEE and TF-A code
covered by the documentation.

Signed-off-by: Selvam Sathappan Periakaruppan <selvam.periakaruppan@oss.qualcomm.com>
Assisted-by: Claude:sonnet-5
@zelvam95
zelvam95 force-pushed the doc/qcom-plat-arch-doc branch 2 times, most recently from 10f110f to 969ee1c Compare September 21, 2026 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants