Re: [PATCH 2/6] tee: Add kernel client object invoke helper

[Harshal Dev <harshal.dev@oss.qualcomm.com>]

Hi Amir,

On 7/8/2026 11:59 AM, Amirreza Zarrabi wrote:
> Hi Harshal,
> 
> On 7/7/2026 4:11 PM, Harshal Dev wrote:
>> From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
>>
>> Kernel clients can open a TEE context and invoke regular TA commands
>> through tee_client_invoke_func(). However, there is currently no
>> equivalent helper for invoking TEE objects.
>>
>> Add tee_client_object_invoke_func() as a kernel client API for issuing
>> object invocation requests. The helper checks that the backend provides
>> object_invoke_func() before setting the MSB of the object-id and forwarding
>> the request. The MSB of the object-id informs the TEE backend that the
>> object is invoked from a kernel context.
>>
>> This allows TEE backends that support privileged object-based calls from
>> the kernel-space.
>>
>> Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
>> Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
>> ---
>>  drivers/tee/tee_core.c  | 13 +++++++++++++
>>  include/linux/tee_drv.h | 13 +++++++++++++
>>  2 files changed, 26 insertions(+)
>>
>> diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
>> index 7f986d7fb47f..0783802fd010 100644
>> --- a/drivers/tee/tee_core.c
>> +++ b/drivers/tee/tee_core.c
>> @@ -1413,6 +1413,19 @@ int tee_client_invoke_func(struct tee_context *ctx,
>>  }
>>  EXPORT_SYMBOL_GPL(tee_client_invoke_func);
>>  
>> +int tee_client_object_invoke_func(struct tee_context *ctx,
>> +				  struct tee_ioctl_object_invoke_arg *arg,
>> +				  struct tee_param *param)
>> +{
>> +	if (!ctx->teedev->desc->ops->object_invoke_func)
>> +		return -EINVAL;
>> +
>> +	/* Indicate that this object is being invoked from a kernel context. */
>> +	arg->id = arg->id | BIT(63);
> 
> Setting this bit is a qcomtee backend requirement and should not be
> exposed to the TEE subsystem.
> 
> Kernel users of qcomtee_object_invoke() should use the normal object ID
> value. For example, access to the initial ROOT maybe represented as
> TEE_OBJREF_NULL | BIT_ULL(63), but the upper bit must be managed by the
> qcomtee backend for any return object, i.e. The backend should also set
> BIT_ULL(63) automatically on each returned object ID.
> Callers should treat the ID as opaque and must not manipulate the upper bit directly.

I agree with this argument. Since we only invoke QTEE returned objects from
tee_client_object_invoke_func(), the QCOMTEE back-end should set the MSB of the object-id
when returning QTEE objects to TEE kernel client. It should also drop the MSB of the object-id
for both invoked QTEE objects and QTEE objects passed as arguments by a kernel client.

We are already taking care of dropping the MSB from the object-id for invoked QCOMTEE objects
from kernel-space. I believe the correct place for setting and unsetting the MSB for QCOMTEE
objects being passed as arguments are here:
https://elixir.bootlin.com/linux/v7.1/source/drivers/tee/qcomtee/call.c#L181
https://elixir.bootlin.com/linux/v7.1/source/drivers/tee/qcomtee/call.c#L125

Once the object-id is allocated by the back-end, we can check if the kernel_ctx flag is set
in oic. If so, we set the object-id's MSB before marshaling the object-id to a tee-param.
Similarly, when an object-id is passed by the kernel client, and kernel_ctx flag is set,
we unset the object-id's MSB before marshaling it from a tee-param.

Do let me know if you're aligned with this approach for achieving kernel context
awareness without TEE front-end or client involvement. In-effect we're offloading this
context information to QTEE object ids.

Regards,
Harshal
> 
>> +	return ctx->teedev->desc->ops->object_invoke_func(ctx, arg, param);
>> +}
>> +EXPORT_SYMBOL_GPL(tee_client_object_invoke_func);
>> +
>>  int tee_client_cancel_req(struct tee_context *ctx,
>>  			  struct tee_ioctl_cancel_arg *arg)
>>  {
>> diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h
>> index e561a26f537a..ca99c6b747a8 100644
>> --- a/include/linux/tee_drv.h
>> +++ b/include/linux/tee_drv.h
>> @@ -283,6 +283,19 @@ int tee_client_invoke_func(struct tee_context *ctx,
>>  			   struct tee_ioctl_invoke_arg *arg,
>>  			   struct tee_param *param);
>>  
>> +/**
>> + * tee_client_object_invoke_func() - Invoke a TEE object from kernel space
>> + * @ctx:    TEE Context
>> + * @arg:    Invoke arguments, see description of
>> + *          struct tee_ioctl_object_invoke_arg
>> + * @param:  Parameters for the object invocation
>> + *
>> + * Return: On success, returns 0; on failure, returns < 0.
>> + */
>> +int tee_client_object_invoke_func(struct tee_context *ctx,
>> +				  struct tee_ioctl_object_invoke_arg *arg,
>> +				  struct tee_param *param);
>> +
>>  /**
>>   * tee_client_cancel_req() - Request cancellation of the previous open-session
>>   * or invoke-command operations in a Trusted Application
>>
> 
> Regards,
> Amir
>