Re: [PATCH v4 1/7] tee: qcomtee: Track the object invocation context

[Amirreza Zarrabi]

Looks fine to me.

Reviewed-by: Amirreza Zarrabi <amirreza.zarrabi@xxxxxxxxxxxxxxxx>

- Amir

On 10/6/2026 10:33 PM, Harshal Dev wrote:
> QCOMTEE needs to distinguish between object invocations arriving from
> kernel clients and user-space clients in order to correctly marshal
> UBUF parameters and decide whether certain operations should be permitted.
> 
> Introduce an enum tee_object_invoke_origin to allow clients to indicate
> the context of the TEE object invocation, and add a kernel_ctx flag to the
> QCOMTEE context so the TEE back-end can track it.
> 
> Reviewed-by: Sumit Garg <sumit.garg@xxxxxxxxxxxxxxxx>
> Signed-off-by: Harshal Dev <harshal.dev@xxxxxxxxxxxxxxxx>
> ---
>  drivers/tee/qcomtee/call.c           | 12 +++++++++---
>  drivers/tee/qcomtee/qcomtee_object.h |  8 ++++++--
>  drivers/tee/tee_core.c               |  3 ++-
>  include/linux/tee_core.h             |  8 +++++++-
>  4 files changed, 24 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c
> index 4a597eeaf174..3de54af45719 100644
> --- a/drivers/tee/qcomtee/call.c
> +++ b/drivers/tee/qcomtee/call.c
> @@ -388,20 +388,26 @@ static int qcomtee_root_object_check(u32 op, struct tee_param *params,
>   * @ctx: TEE context.
>   * @arg: ioctl arguments.
>   * @params: parameters for the object.
> + * @origin: origin of the object invocation (kernel or user-space).
>   *
>   * Return: On success, returns 0; on failure, returns < 0.
>   */
>  static int qcomtee_object_invoke(struct tee_context *ctx,
>  				 struct tee_ioctl_object_invoke_arg *arg,
> -				 struct tee_param *params)
> +				 struct tee_param *params,
> +				 enum tee_object_invoke_origin origin)
>  {
>  	struct qcomtee_context_data *ctxdata = ctx->data;
>  	struct qcomtee_object *object;
> +	bool kernel_ctx = false;
>  	int i, ret, result;
>  
>  	if (qcomtee_params_check(params, arg->num_params))
>  		return -EINVAL;
>  
> +	if (origin == TEE_OBJECT_INVOKE_KERNEL)
> +		kernel_ctx = true;
> +
>  	/* First, handle reserved operations: */
>  	if (arg->op == QCOMTEE_MSG_OBJECT_OP_RELEASE) {
>  		del_qtee_object(arg->id, ctxdata);
> @@ -411,7 +417,7 @@ static int qcomtee_object_invoke(struct tee_context *ctx,
>  
>  	/* Otherwise, invoke a QTEE object: */
>  	struct qcomtee_object_invoke_ctx *oic __free(kfree) =
> -		qcomtee_object_invoke_ctx_alloc(ctx);
> +		qcomtee_object_invoke_ctx_alloc(ctx, kernel_ctx);
>  	if (!oic)
>  		return -ENOMEM;
>  
> @@ -648,7 +654,7 @@ static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id,
>  	int result;
>  
>  	struct qcomtee_object_invoke_ctx *oic __free(kfree) =
> -		qcomtee_object_invoke_ctx_alloc(ctx);
> +		qcomtee_object_invoke_ctx_alloc(ctx, true);
>  	if (!oic)
>  		return;
>  
> diff --git a/drivers/tee/qcomtee/qcomtee_object.h b/drivers/tee/qcomtee/qcomtee_object.h
> index d5de02dcef3b..5f40617361fc 100644
> --- a/drivers/tee/qcomtee/qcomtee_object.h
> +++ b/drivers/tee/qcomtee/qcomtee_object.h
> @@ -147,6 +147,7 @@ static inline int qcomtee_args_len(struct qcomtee_arg *args)
>   * struct qcomtee_object_invoke_ctx - QTEE context for object invocation.
>   * @ctx: TEE context for this invocation.
>   * @flags: flags for the invocation context.
> + * @kernel_ctx: flag that indicates this context is owned by a kernel client.
>   * @errno: error code for the invocation.
>   * @object: current object invoked in this callback context.
>   * @u: array of arguments for the current invocation (+1 for ending arg).
> @@ -159,6 +160,7 @@ static inline int qcomtee_args_len(struct qcomtee_arg *args)
>  struct qcomtee_object_invoke_ctx {
>  	struct tee_context *ctx;
>  	unsigned long flags;
> +	bool kernel_ctx;
>  	int errno;
>  
>  	struct qcomtee_object *object;
> @@ -173,13 +175,15 @@ struct qcomtee_object_invoke_ctx {
>  };
>  
>  static inline struct qcomtee_object_invoke_ctx *
> -qcomtee_object_invoke_ctx_alloc(struct tee_context *ctx)
> +qcomtee_object_invoke_ctx_alloc(struct tee_context *ctx, bool kernel_ctx)
>  {
>  	struct qcomtee_object_invoke_ctx *oic;
>  
>  	oic = kzalloc_obj(*oic);
> -	if (oic)
> +	if (oic) {
>  		oic->ctx = ctx;
> +		oic->kernel_ctx = kernel_ctx;
> +	}
>  	return oic;
>  }
>  
> diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
> index 1aac50c7c1de..30901390149c 100644
> --- a/drivers/tee/tee_core.c
> +++ b/drivers/tee/tee_core.c
> @@ -701,7 +701,8 @@ static int tee_ioctl_object_invoke(struct tee_context *ctx,
>  			goto out;
>  	}
>  
> -	rc = ctx->teedev->desc->ops->object_invoke_func(ctx, &arg, params);
> +	rc = ctx->teedev->desc->ops->object_invoke_func(ctx, &arg, params,
> +							TEE_OBJECT_INVOKE_USERSPACE);
>  	if (rc)
>  		goto out;
>  
> diff --git a/include/linux/tee_core.h b/include/linux/tee_core.h
> index f993d5118edd..bcb5418d6fdc 100644
> --- a/include/linux/tee_core.h
> +++ b/include/linux/tee_core.h
> @@ -73,6 +73,11 @@ struct tee_device {
>  	struct tee_shm_pool *pool;
>  };
>  
> +enum tee_object_invoke_origin {
> +	TEE_OBJECT_INVOKE_USERSPACE,
> +	TEE_OBJECT_INVOKE_KERNEL,
> +};
> +
>  /**
>   * struct tee_driver_ops - driver operations vtable
>   * @get_version:	returns version of driver
> @@ -117,7 +122,8 @@ struct tee_driver_ops {
>  			   struct tee_param *param);
>  	int (*object_invoke_func)(struct tee_context *ctx,
>  				  struct tee_ioctl_object_invoke_arg *arg,
> -				  struct tee_param *param);
> +				  struct tee_param *param,
> +				  enum tee_object_invoke_origin origin);
>  	int (*cancel_req)(struct tee_context *ctx, u32 cancel_id, u32 session);
>  	int (*supp_recv)(struct tee_context *ctx, u32 *func, u32 *num_params,
>  			 struct tee_param *param);
>