STRUCT TEE_IOCTL_PARAM(9)

💅 struct tee_ioctl_param(9) — the kernel API manual, bestie edition 🎀

okay so this is a page from the Kernel API Manual and it's literally all about struct tee_ioctl_param — yes the whole thing, one struct, one vibe ✨

---

🌸 NAME 🌸

struct tee_ioctl_param — it's a parameter. that's it. that's the name. slay 💅

---

✨ SYNOPSIS ✨

struct tee_ioctl_param {
    __u64 attr;
    __u64 a;
    __u64 b;
    __u64 c;
 };

look at her. four __u64 fields and a attr on top. iconic 🫶

---

🧚 Members 🧚

• attr — the attributes, bestie. the metadata. the vibe check of the whole struct 🌈
• a — okay so it depends: if this is a memref, it's the offset into the shared memory object. if it's a ubuf, it's the address of the user buffer. if it's an objref, it's the object identifier. otherwise? it's a value parameter. it's giving "multi-hyphenate" 💅
• b — if it's a memref or a ubuf, this is the size of the buffer. if it's an objref, these are the flags for the object. otherwise it's a value parameter. she contains multitudes 😭
• c — if it's a memref, this is the shared memory identifier. otherwise, it's a value parameter. short and sweet, periodt 💖

---

🔥 Description 🔥

so attr & TEE_PARAM_ATTR_TYPE_MASK is the moment of truth — that's what tells you if a memref, ubuf, or value is being used in the union. here's the lineup, no cap:

• TEE_PARAM_ATTR_TYPE_VALUE_* means value
• TEE_PARAM_ATTR_TYPE_MEMREF_* means memref
• TEE_PARAM_ATTR_TYPE_UBUF_* means ubuf
• TEE_PARAM_ATTR_TYPE_OBJREF_* means objref
• TEE_PARAM_ATTR_TYPE_NONE means literally none of the members are used — she's off duty, do not disturb 🙈

---

shared memory is allocated with TEE_IOC_SHM_ALLOC, and that returns an identifier representing the shared memory object. a memref can reference a part of a shared memory by specifying an offset (a) and size (b) of the object. and if you want the entire shared memory object? set the offset (a) to 0 and the size (b) to the previously returned size of the object. whole thing, no crumbs, ate 🔥

---

a client may need to present a NULL pointer in the argument passed to a trusted application in the TEE. this is also a requirement in the GlobalPlatform Client API v1.0c (section 3.2.5 memory references), which you can find at http://www.globalplatform.org/specificationsdevice.asp — go read it, iykyk 📚

⚠️ okay important one, bestie: if a NULL pointer is passed to a TA in the TEE, the (c) IOCTL parameters value must be set to TEE_MEMREF_NULL, indicating a NULL memory reference. must. not "maybe". not "if you feel like it". 💀

---

👑 SEE ALSO 👑

kernel file ./include/uapi/linux/tee.h, and like the whole extended friend group:

• struct tee_ioctl_version_data(9)
• TEE_IOC_VERSION(9)
• struct tee_ioctl_shm_alloc_data(9)
• TEE_IOC_SHM_ALLOC(9)
• struct tee_ioctl_buf_data(9)
• struct tee_ioctl_open_session_arg(9)
• TEE_IOC_OPEN_SESSION(9)
• struct tee_ioctl_invoke_arg(9)
• TEE_IOC_INVOKE(9)
• struct tee_ioctl_cancel_arg(9)
• TEE_IOC_CANCEL(9)
• struct tee_ioctl_close_session_arg(9)
• TEE_IOC_CLOSE_SESSION(9)
• struct tee_iocl_supp_recv_arg(9)
• TEE_IOC_SUPPL_RECV(9)
• struct tee_iocl_supp_send_arg(9)
• TEE_IOC_SUPPL_SEND(9)
• struct tee_ioctl_shm_register_data(9)
• struct tee_ioctl_shm_register_fd_data(9)
• TEE_IOC_SHM_REGISTER_FD(9)
• TEE_IOC_SHM_REGISTER(9)
• struct tee_ioctl_object_invoke_arg(9)

like, read them all. or at least skim. do it for me 🫶✨

---

and that's the page!! this beauty lives in ./include/uapi/linux, dated October 2026, and she's officially struct tee_ioctl_param(9) — main character energy from the first line to the last 💖🎀🦋