diff --git a/drivers/edgetpu/edgetpu-device-group.c b/drivers/edgetpu/edgetpu-device-group.c
index 4bd1be9..9b85679 100644
--- a/drivers/edgetpu/edgetpu-device-group.c
+++ b/drivers/edgetpu/edgetpu-device-group.c
@@ -141,7 +141,8 @@
 		return 0;
 
 	mailbox_id = edgetpu_group_context_id_locked(group);
-	ret = edgetpu_mailbox_activate(group->etdev, mailbox_id, group->vcid, !group->activated);
+	ret = edgetpu_mailbox_activate(group->etdev, mailbox_id, group->mbox_attr.client_priv,
+				       group->vcid, !group->activated);
 	if (ret) {
 		etdev_err(group->etdev, "activate mailbox for VCID %d failed with %d", group->vcid,
 			  ret);
diff --git a/drivers/edgetpu/edgetpu-external.c b/drivers/edgetpu/edgetpu-external.c
index b954844..c983d3c 100644
--- a/drivers/edgetpu/edgetpu-external.c
+++ b/drivers/edgetpu/edgetpu-external.c
@@ -100,7 +100,8 @@
 		req.attr = group->mbox_attr;
 	}
 
-	ret = edgetpu_mailbox_enable_ext(client, EDGETPU_MAILBOX_ID_USE_ASSOC, &req);
+	ret = edgetpu_mailbox_enable_ext(client, EDGETPU_MAILBOX_ID_USE_ASSOC, &req,
+					 group->mbox_attr.client_priv);
 	if (ret)
 		goto error_put_group;
 	mutex_lock(&group->lock);
diff --git a/drivers/edgetpu/edgetpu-kci.c b/drivers/edgetpu/edgetpu-kci.c
index 52eff65..313e9f8 100644
--- a/drivers/edgetpu/edgetpu-kci.c
+++ b/drivers/edgetpu/edgetpu-kci.c
@@ -1029,10 +1029,11 @@
 	return edgetpu_kci_send_cmd(kci, &cmd);
 }
 
-int edgetpu_kci_open_device(struct edgetpu_kci *kci, u32 mailbox_map, s16 vcid, bool first_open)
+int edgetpu_kci_open_device(struct edgetpu_kci *kci, u32 mailbox_map, u32 client_priv, s16 vcid,
+			    bool first_open)
 {
 	const struct edgetpu_kci_open_device_detail detail = {
-		.mailbox_map = mailbox_map,
+		.client_priv = client_priv,
 		.vcid = vcid,
 		.flags = (mailbox_map << 1) | first_open,
 	};
diff --git a/drivers/edgetpu/edgetpu-kci.h b/drivers/edgetpu/edgetpu-kci.h
index 4d2f4b0..2a2ff16 100644
--- a/drivers/edgetpu/edgetpu-kci.h
+++ b/drivers/edgetpu/edgetpu-kci.h
@@ -219,8 +219,8 @@
 };
 
 struct edgetpu_kci_open_device_detail {
-	/* The bit map of mailboxes to be opened. */
-	u16 mailbox_map;
+	/* The client privilege level. */
+	u16 client_priv;
 	/*
 	 * Virtual context ID @mailbox_id is associated to.
 	 * For device groups with @mailbox_detachable attribute the mailbox attached to the group
@@ -381,7 +381,8 @@
  * You usually shouldn't call this directly - consider using
  * edgetpu_mailbox_activate() or edgetpu_mailbox_activate_bulk() instead.
  */
-int edgetpu_kci_open_device(struct edgetpu_kci *kci, u32 mailbox_map, s16 vcid, bool first_open);
+int edgetpu_kci_open_device(struct edgetpu_kci *kci, u32 mailbox_map, u32 client_priv, s16 vcid,
+			    bool first_open);
 
 /*
  * Inform the firmware that the VII mailboxes included in @mailbox_map are closed.
diff --git a/drivers/edgetpu/edgetpu-mailbox.c b/drivers/edgetpu/edgetpu-mailbox.c
index 5fac2a2..cd9a6b2 100644
--- a/drivers/edgetpu/edgetpu-mailbox.c
+++ b/drivers/edgetpu/edgetpu-mailbox.c
@@ -1102,7 +1102,8 @@
 	edgetpu_mailbox_external_free(group);
 }
 
-static int edgetpu_mailbox_external_enable_by_id(struct edgetpu_client *client, int mailbox_id)
+static int edgetpu_mailbox_external_enable_by_id(struct edgetpu_client *client, int mailbox_id,
+						 u32 client_priv)
 {
 	int ret;
 
@@ -1115,7 +1116,7 @@
 
 	etdev_dbg(client->etdev, "Enabling mailbox: %d\n", mailbox_id);
 
-	ret = edgetpu_mailbox_activate(client->etdev, mailbox_id, -1, false);
+	ret = edgetpu_mailbox_activate(client->etdev, mailbox_id, client_priv, -1, false);
 	if (ret)
 		etdev_err(client->etdev, "Activate mailbox %d failed: %d", mailbox_id, ret);
 	else
@@ -1162,7 +1163,8 @@
 	for (i = 0; i < ext_mailbox->count; i++)
 		mbox_map |= BIT(ext_mailbox->descriptors[i].mailbox->mailbox_id);
 
-	ret = edgetpu_mailbox_activate_bulk(ext_mailbox->etdev, mbox_map, vcid, false);
+	ret = edgetpu_mailbox_activate_bulk(ext_mailbox->etdev, mbox_map,
+					    group->mbox_attr.client_priv, vcid, false);
 
 	if (ret)
 		etdev_err(group->etdev, "Activate mailbox bulk failed: %d", ret);
@@ -1198,12 +1200,13 @@
 }
 
 int edgetpu_mailbox_enable_ext(struct edgetpu_client *client, int mailbox_id,
-			       struct edgetpu_external_mailbox_req *ext_mailbox_req)
+			       struct edgetpu_external_mailbox_req *ext_mailbox_req,
+			       u32 client_priv)
 {
 	if (mailbox_id == EDGETPU_MAILBOX_ID_USE_ASSOC)
 		return edgetpu_mailbox_external_alloc_enable(client, ext_mailbox_req);
 	else
-		return edgetpu_mailbox_external_enable_by_id(client, mailbox_id);
+		return edgetpu_mailbox_external_enable_by_id(client, mailbox_id, client_priv);
 }
 
 int edgetpu_mailbox_disable_ext(struct edgetpu_client *client, int mailbox_id)
@@ -1214,16 +1217,16 @@
 		return edgetpu_mailbox_external_disable_by_id(client, mailbox_id);
 }
 
-int edgetpu_mailbox_activate_bulk(struct edgetpu_dev *etdev, u32 mailbox_map, s16 vcid,
-				  bool first_open)
+int edgetpu_mailbox_activate_bulk(struct edgetpu_dev *etdev, u32 mailbox_map, u32 client_priv,
+				  s16 vcid, bool first_open)
 {
 	struct edgetpu_handshake *eh = &etdev->mailbox_manager->open_devices;
 	int ret = 0;
 
 	mutex_lock(&eh->lock);
 	if (mailbox_map & ~eh->fw_state)
-		ret = edgetpu_kci_open_device(etdev->kci, mailbox_map & ~eh->fw_state, vcid,
-					      first_open);
+		ret = edgetpu_kci_open_device(etdev->kci, mailbox_map & ~eh->fw_state, client_priv,
+					      vcid, first_open);
 	if (!ret) {
 		eh->state |= mailbox_map;
 		eh->fw_state |= mailbox_map;
@@ -1240,9 +1243,10 @@
 
 }
 
-int edgetpu_mailbox_activate(struct edgetpu_dev *etdev, u32 mailbox_id, s16 vcid, bool first_open)
+int edgetpu_mailbox_activate(struct edgetpu_dev *etdev, u32 mailbox_id, u32 client_priv, s16 vcid,
+			     bool first_open)
 {
-	return edgetpu_mailbox_activate_bulk(etdev, BIT(mailbox_id), vcid, first_open);
+	return edgetpu_mailbox_activate_bulk(etdev, BIT(mailbox_id), client_priv, vcid, first_open);
 }
 
 void edgetpu_mailbox_deactivate_bulk(struct edgetpu_dev *etdev, u32 mailbox_map)
diff --git a/drivers/edgetpu/edgetpu-mailbox.h b/drivers/edgetpu/edgetpu-mailbox.h
index 115341d..b03ae24 100644
--- a/drivers/edgetpu/edgetpu-mailbox.h
+++ b/drivers/edgetpu/edgetpu-mailbox.h
@@ -349,7 +349,8 @@
  * Otherwise, activate the external mailbox with id @mailbox_id.
  */
 int edgetpu_mailbox_enable_ext(struct edgetpu_client *client, int mailbox_id,
-			       struct edgetpu_external_mailbox_req *ext_mailbox_req);
+			       struct edgetpu_external_mailbox_req *ext_mailbox_req,
+			       u32 client_priv);
 
 /*
  * Notify firmware of an external mailboxes becoming inactive.
@@ -362,8 +363,8 @@
  * Returns what edgetpu_kci_open_device() returned.
  * Caller ensures device is powered on.
  */
-int edgetpu_mailbox_activate_bulk(struct edgetpu_dev *etdev, u32 mailbox_map, s16 vcid,
-				  bool first_open);
+int edgetpu_mailbox_activate_bulk(struct edgetpu_dev *etdev, u32 mailbox_map, u32 client_priv,
+				  s16 vcid, bool first_open);
 
 /*
  * Activates @mailbox_id, OPEN_DEVICE KCI will be sent.
@@ -374,7 +375,8 @@
  * Returns what edgetpu_kci_open_device() returned.
  * Caller ensures device is powered on.
  */
-int edgetpu_mailbox_activate(struct edgetpu_dev *etdev, u32 mailbox_id, s16 vcid, bool first_open);
+int edgetpu_mailbox_activate(struct edgetpu_dev *etdev, u32 mailbox_id, u32 client_priv, s16 vcid,
+			     bool first_open);
 
 /*
  * Similar to edgetpu_mailbox_activate_bulk() but sends CLOSE_DEVICE KCI with the @mailbox_map
diff --git a/drivers/edgetpu/edgetpu-mobile-platform.c b/drivers/edgetpu/edgetpu-mobile-platform.c
index 3272d4c..979c109 100644
--- a/drivers/edgetpu/edgetpu-mobile-platform.c
+++ b/drivers/edgetpu/edgetpu-mobile-platform.c
@@ -159,7 +159,7 @@
 		mutex_unlock(&etmdev->tz_mailbox_lock);
 		return -EBUSY;
 	}
-	ret = edgetpu_mailbox_enable_ext(client, EDGETPU_TZ_MAILBOX_ID, NULL);
+	ret = edgetpu_mailbox_enable_ext(client, EDGETPU_TZ_MAILBOX_ID, NULL, 0);
 	if (!ret)
 		etmdev->secure_client = client;
 	mutex_unlock(&etmdev->tz_mailbox_lock);
diff --git a/drivers/edgetpu/edgetpu.h b/drivers/edgetpu/edgetpu.h
index ad9a2ce..2be97fe 100644
--- a/drivers/edgetpu/edgetpu.h
+++ b/drivers/edgetpu/edgetpu.h
@@ -182,6 +182,7 @@
 	__u32 cmdq_tail_doorbell: 1; /* auto doorbell on cmd queue tail move */
 	/* Type of memory partitions to be used for this group, exact meaning is chip-dependent. */
 	__u32 partition_type    : 1;
+	__u32 client_priv : 1; /* client privilege level */
 };
 
 /*