# Declaring secure service interface
The following alternative secure service signature is proposed as an
amendment to existing implementation.
## Individual signatures - current method
A `<service_name>_veneers.c` file is created in the `secure_fw/ns_callable`
directory, that specifies the signature for each veneer function, and calls the
secure function from the veneers. The respective
`interface/include/<service_name>_veneers.h` file with the veneer declarations
have to be created and maintained manually.
Note that at present TF-M framework limits the range of valid return values a
secure service can provide, reserving a range for framework error codes.
## Uniform signatures - proposal
The proposal is to use a uniform signature for all the secure functions of the
secure service. There are multiple advantages of this method:
- TF-M Core can do a sanity check on the access rights of the veneer
parameters, and there is no need for the secure services to make these checks
individually. Please note that in the present implementation sanity check is
only fully supported for level 1 isolation.
- The veneer declarations and implementations for the secure functions can be
generated automatically from a template (using the secure function list in the
secure service's manifest)
The signature for such secure services would look like this:
```
psa_status_t secure_function_name(struct psa_invec *in_vec, size_t in_len,
struct psa_outvec *out_vec, size_t out_len);
```
where
**Return value: **
`psa_status_t` is a status code whose values are described in PSA Firmware
Framework (as in version 1.0-beta-0 chapter 4.3.3).
**Note:**
The return value limitations imposed by TF-M framework for proprietary
secure service veneers would not apply to secure services using the uniform
signature. This is analogous to how PSA Firmware Framework handles values
returned by `psa_reply()` function.
**Arguments: **
```
/**
* A read-only input memory region provided to a RoT Service.
*/
typedef struct psa_invec {
const void *base; /*!< the start address of the memory buffer */
size_t len; /*!< the size in bytes */
} psa_invec;
/**
* A writable output memory region provided to a RoT Service.
*/
typedef struct psa_outvec {
void *base; /*!< the start address of the memory buffer */
size_t len; /*!< the size in bytes */
} psa_outvec;
/**
* in_len: the number of input parameters, i.e. psa_invecs
* out_len: the number of output parameters, i.e. psa_outvecs
*/
```
The number of vectors that can be passed to a secure service is constrained:
```
in_len + out_len <= PSA_MAX_IOVEC
```
The veneer function declarations and implementations are generated in the
`interface/include/tfm_veneers.h` and `secure_fw\ns_callable\tfm_veneers.c`
files respectively. The veneer functions are created with the name
`tfm_<secure_function_name>_veneer`
Services that implement the uniform signature do not need to manually fill
the template veneer function to call `TFM_CORE_SFN_REQUEST` macro.
# Compatibility
Note that the proposal is for the two types of services (those with proprietary
signatures and those with uniform signatures) to co-exist, with the intention of
eventually phasing out proprietary signatures in favour of the more robust,
uniform signature.