Re: [PATCH v3 1/6] tee: qcomtee: Track the object invocation context

[Sumit Garg <sumit.garg@kernel.org>]

On Thu, 01 Oct 2026 at 16:32:33 +0530, Harshal Dev wrote:
>QCOMTEE needs to distinguish between object invocations arriving from
>kernel clients and user-space clients in order to correctly marshal
>UBUF parameters and decide whether certain operations should be permitted.
>
>Introduce an enum tee_object_invoke_origin to allow clients to indicate
>the context of the TEE object invocation, and add a kernel_ctx flag to the
>QCOMTEE context so the TEE back-end can track it.
>
>Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
>---
> drivers/tee/qcomtee/call.c           | 11 ++++++++---
> drivers/tee/qcomtee/qcomtee_object.h |  8 ++++++--
> drivers/tee/tee_core.c               |  3 ++-
> include/linux/tee_core.h             |  8 +++++++-
> 4 files changed, 23 insertions(+), 7 deletions(-)

Looks fine to me.

Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

-Sumit

>
>diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c
>index 4a597eeaf174..a0f2992c0611 100644
>--- a/drivers/tee/qcomtee/call.c
>+++ b/drivers/tee/qcomtee/call.c
>@@ -393,15 +393,20 @@ static int qcomtee_root_object_check(u32 op, struct tee_param *params,
>  */
> static int qcomtee_object_invoke(struct tee_context *ctx,
> 				 struct tee_ioctl_object_invoke_arg *arg,
>-				 struct tee_param *params)
>+				 struct tee_param *params,
>+				 enum tee_object_invoke_origin origin)
> {
> 	struct qcomtee_context_data *ctxdata = ctx->data;
> 	struct qcomtee_object *object;
>+	bool kernel_ctx = false;
> 	int i, ret, result;
>
> 	if (qcomtee_params_check(params, arg->num_params))
> 		return -EINVAL;
>
>+	if (origin == TEE_OBJECT_INVOKE_KERNEL)
>+		kernel_ctx = true;
>+
> 	/* First, handle reserved operations: */
> 	if (arg->op == QCOMTEE_MSG_OBJECT_OP_RELEASE) {
> 		del_qtee_object(arg->id, ctxdata);
>@@ -411,7 +416,7 @@ static int qcomtee_object_invoke(struct tee_context *ctx,
>
> 	/* Otherwise, invoke a QTEE object: */
> 	struct qcomtee_object_invoke_ctx *oic __free(kfree) =
>-		qcomtee_object_invoke_ctx_alloc(ctx);
>+		qcomtee_object_invoke_ctx_alloc(ctx, kernel_ctx);
> 	if (!oic)
> 		return -ENOMEM;
>
>@@ -648,7 +653,7 @@ static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id,
> 	int result;
>
> 	struct qcomtee_object_invoke_ctx *oic __free(kfree) =
>-		qcomtee_object_invoke_ctx_alloc(ctx);
>+		qcomtee_object_invoke_ctx_alloc(ctx, true);
> 	if (!oic)
> 		return;
>
>diff --git a/drivers/tee/qcomtee/qcomtee_object.h b/drivers/tee/qcomtee/qcomtee_object.h
>index d5de02dcef3b..5f40617361fc 100644
>--- a/drivers/tee/qcomtee/qcomtee_object.h
>+++ b/drivers/tee/qcomtee/qcomtee_object.h
>@@ -147,6 +147,7 @@ static inline int qcomtee_args_len(struct qcomtee_arg *args)
>  * struct qcomtee_object_invoke_ctx - QTEE context for object invocation.
>  * @ctx: TEE context for this invocation.
>  * @flags: flags for the invocation context.
>+ * @kernel_ctx: flag that indicates this context is owned by a kernel client.
>  * @errno: error code for the invocation.
>  * @object: current object invoked in this callback context.
>  * @u: array of arguments for the current invocation (+1 for ending arg).
>@@ -159,6 +160,7 @@ static inline int qcomtee_args_len(struct qcomtee_arg *args)
> struct qcomtee_object_invoke_ctx {
> 	struct tee_context *ctx;
> 	unsigned long flags;
>+	bool kernel_ctx;
> 	int errno;
>
> 	struct qcomtee_object *object;
>@@ -173,13 +175,15 @@ struct qcomtee_object_invoke_ctx {
> };
>
> static inline struct qcomtee_object_invoke_ctx *
>-qcomtee_object_invoke_ctx_alloc(struct tee_context *ctx)
>+qcomtee_object_invoke_ctx_alloc(struct tee_context *ctx, bool kernel_ctx)
> {
> 	struct qcomtee_object_invoke_ctx *oic;
>
> 	oic = kzalloc_obj(*oic);
>-	if (oic)
>+	if (oic) {
> 		oic->ctx = ctx;
>+		oic->kernel_ctx = kernel_ctx;
>+	}
> 	return oic;
> }
>
>diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
>index 1aac50c7c1de..30901390149c 100644
>--- a/drivers/tee/tee_core.c
>+++ b/drivers/tee/tee_core.c
>@@ -701,7 +701,8 @@ static int tee_ioctl_object_invoke(struct tee_context *ctx,
> 			goto out;
> 	}
>
>-	rc = ctx->teedev->desc->ops->object_invoke_func(ctx, &arg, params);
>+	rc = ctx->teedev->desc->ops->object_invoke_func(ctx, &arg, params,
>+							TEE_OBJECT_INVOKE_USERSPACE);
> 	if (rc)
> 		goto out;
>
>diff --git a/include/linux/tee_core.h b/include/linux/tee_core.h
>index f993d5118edd..bcb5418d6fdc 100644
>--- a/include/linux/tee_core.h
>+++ b/include/linux/tee_core.h
>@@ -73,6 +73,11 @@ struct tee_device {
> 	struct tee_shm_pool *pool;
> };
>
>+enum tee_object_invoke_origin {
>+	TEE_OBJECT_INVOKE_USERSPACE,
>+	TEE_OBJECT_INVOKE_KERNEL,
>+};
>+
> /**
>  * struct tee_driver_ops - driver operations vtable
>  * @get_version:	returns version of driver
>@@ -117,7 +122,8 @@ struct tee_driver_ops {
> 			   struct tee_param *param);
> 	int (*object_invoke_func)(struct tee_context *ctx,
> 				  struct tee_ioctl_object_invoke_arg *arg,
>-				  struct tee_param *param);
>+				  struct tee_param *param,
>+				  enum tee_object_invoke_origin origin);
> 	int (*cancel_req)(struct tee_context *ctx, u32 cancel_id, u32 session);
> 	int (*supp_recv)(struct tee_context *ctx, u32 *func, u32 *num_params,
> 			 struct tee_param *param);
>
>-- 
>2.34.1
>