Re: [PATCH 2/6] tee: Add kernel client object invoke helper

[Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>]

Hi Harshal,

On 7/7/2026 4:11 PM, Harshal Dev wrote:
> From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
> 
> Kernel clients can open a TEE context and invoke regular TA commands
> through tee_client_invoke_func(). However, there is currently no
> equivalent helper for invoking TEE objects.
> 
> Add tee_client_object_invoke_func() as a kernel client API for issuing
> object invocation requests. The helper checks that the backend provides
> object_invoke_func() before setting the MSB of the object-id and forwarding
> the request. The MSB of the object-id informs the TEE backend that the
> object is invoked from a kernel context.
> 
> This allows TEE backends that support privileged object-based calls from
> the kernel-space.
> 
> Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
> Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
> ---
>  drivers/tee/tee_core.c  | 13 +++++++++++++
>  include/linux/tee_drv.h | 13 +++++++++++++
>  2 files changed, 26 insertions(+)
> 
> diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
> index 7f986d7fb47f..0783802fd010 100644
> --- a/drivers/tee/tee_core.c
> +++ b/drivers/tee/tee_core.c
> @@ -1413,6 +1413,19 @@ int tee_client_invoke_func(struct tee_context *ctx,
>  }
>  EXPORT_SYMBOL_GPL(tee_client_invoke_func);
>  
> +int tee_client_object_invoke_func(struct tee_context *ctx,
> +				  struct tee_ioctl_object_invoke_arg *arg,
> +				  struct tee_param *param)
> +{
> +	if (!ctx->teedev->desc->ops->object_invoke_func)
> +		return -EINVAL;
> +
> +	/* Indicate that this object is being invoked from a kernel context. */
> +	arg->id = arg->id | BIT(63);

Setting this bit is a qcomtee backend requirement and should not be
exposed to the TEE subsystem.

Kernel users of qcomtee_object_invoke() should use the normal object ID
value. For example, access to the initial ROOT maybe represented as
TEE_OBJREF_NULL | BIT_ULL(63), but the upper bit must be managed by the
qcomtee backend for any return object, i.e. The backend should also set
BIT_ULL(63) automatically on each returned object ID.
Callers should treat the ID as opaque and must not manipulate the upper bit directly.

> +	return ctx->teedev->desc->ops->object_invoke_func(ctx, arg, param);
> +}
> +EXPORT_SYMBOL_GPL(tee_client_object_invoke_func);
> +
>  int tee_client_cancel_req(struct tee_context *ctx,
>  			  struct tee_ioctl_cancel_arg *arg)
>  {
> diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h
> index e561a26f537a..ca99c6b747a8 100644
> --- a/include/linux/tee_drv.h
> +++ b/include/linux/tee_drv.h
> @@ -283,6 +283,19 @@ int tee_client_invoke_func(struct tee_context *ctx,
>  			   struct tee_ioctl_invoke_arg *arg,
>  			   struct tee_param *param);
>  
> +/**
> + * tee_client_object_invoke_func() - Invoke a TEE object from kernel space
> + * @ctx:    TEE Context
> + * @arg:    Invoke arguments, see description of
> + *          struct tee_ioctl_object_invoke_arg
> + * @param:  Parameters for the object invocation
> + *
> + * Return: On success, returns 0; on failure, returns < 0.
> + */
> +int tee_client_object_invoke_func(struct tee_context *ctx,
> +				  struct tee_ioctl_object_invoke_arg *arg,
> +				  struct tee_param *param);
> +
>  /**
>   * tee_client_cancel_req() - Request cancellation of the previous open-session
>   * or invoke-command operations in a Trusted Application
> 

Regards,
Amir