linux-stable.git/drivers/firmware/qcom, branch linux-6.16.y Linux kernel stable tree firmware: qcom: scm: request the waitqueue irq *after* initializing SCM 2025-09-04T14:55:51+00:00 Bartosz Golaszewski bartosz.golaszewski@linaro.org 2025-06-30T12:12:05+00:00 4e06c33aaa5ddcec2c01fed66082053153b19ebd commit 7ab36b51c6bee56e1a1939063dd10d602fe49d13 upstream. There's a subtle race in the SCM driver: we assign the __scm pointer before requesting the waitqueue interrupt. Assigning __scm marks the SCM API as ready to accept calls. It's possible that a user makes a call right after we set __scm and the firmware raises an interrupt before the driver's ready to service it. Move the __scm assignment after we request the interrupt. This has the added benefit of allowing us to drop the goto label. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-4-fa3851c98611@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 7ab36b51c6bee56e1a1939063dd10d602fe49d13 upstream.

There's a subtle race in the SCM driver: we assign the __scm pointer
before requesting the waitqueue interrupt. Assigning __scm marks the SCM
API as ready to accept calls. It's possible that a user makes a call
right after we set __scm and the firmware raises an interrupt before the
driver's ready to service it. Move the __scm assignment after we request
the interrupt.

This has the added benefit of allowing us to drop the goto label.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-4-fa3851c98611@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
firmware: qcom: scm: initialize tzmem before marking SCM as available 2025-09-04T14:55:51+00:00 Bartosz Golaszewski bartosz.golaszewski@linaro.org 2025-06-30T12:12:04+00:00 bcd14791ba62d2eaf85b27dc90ca71a96753639b commit 87be3e7a2d0030cda6314d2ec96b37991f636ccd upstream. Now that qcom_scm_shm_bridge_enable() uses the struct device passed to it as argument to make the QCOM_SCM_MP_SHM_BRIDGE_ENABLE SCM call, we can move the TZMem initialization before the assignment of the __scm pointer in the SCM driver (which marks SCM as ready to users) thus fixing the potential race between consumer calls and the memory pool initialization. Reported-by: Johan Hovold <johan+linaro@kernel.org> Closes: https://lore.kernel.org/all/20250120151000.13870-1-johan+linaro@kernel.org/ Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-3-fa3851c98611@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 87be3e7a2d0030cda6314d2ec96b37991f636ccd upstream.

Now that qcom_scm_shm_bridge_enable() uses the struct device passed to
it as argument to make the QCOM_SCM_MP_SHM_BRIDGE_ENABLE SCM call, we
can move the TZMem initialization before the assignment of the __scm
pointer in the SCM driver (which marks SCM as ready to users) thus
fixing the potential race between consumer calls and the memory pool
initialization.

Reported-by: Johan Hovold <johan+linaro@kernel.org>
Closes: https://lore.kernel.org/all/20250120151000.13870-1-johan+linaro@kernel.org/
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-3-fa3851c98611@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
firmware: qcom: scm: take struct device as argument in SHM bridge enable 2025-09-04T14:55:51+00:00 Bartosz Golaszewski bartosz.golaszewski@linaro.org 2025-06-30T12:12:03+00:00 6e7c7570cec6a6ba5acd7491920d3036120047e9 commit dc3f4e75c54c19bad9a70419afae00ce6baf3ebf upstream. qcom_scm_shm_bridge_enable() is used early in the SCM initialization routine. It makes an SCM call and so expects the internal __scm pointer in the SCM driver to be assigned. For this reason the tzmem memory pool is allocated *after* this pointer is assigned. However, this can lead to a crash if another consumer of the SCM API makes a call using the memory pool between the assignment of the __scm pointer and the initialization of the tzmem memory pool. As qcom_scm_shm_bridge_enable() is a special case, not meant to be called by ordinary users, pull it into the local SCM header. Make it take struct device as argument. This is the device that will be used to make the SCM call as opposed to the global __scm pointer. This will allow us to move the tzmem initialization *before* the __scm assignment in the core SCM driver. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-2-fa3851c98611@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit dc3f4e75c54c19bad9a70419afae00ce6baf3ebf upstream.

qcom_scm_shm_bridge_enable() is used early in the SCM initialization
routine. It makes an SCM call and so expects the internal __scm pointer
in the SCM driver to be assigned. For this reason the tzmem memory pool
is allocated *after* this pointer is assigned. However, this can lead to
a crash if another consumer of the SCM API makes a call using the memory
pool between the assignment of the __scm pointer and the initialization
of the tzmem memory pool.

As qcom_scm_shm_bridge_enable() is a special case, not meant to be
called by ordinary users, pull it into the local SCM header. Make it
take struct device as argument. This is the device that will be used to
make the SCM call as opposed to the global __scm pointer. This will
allow us to move the tzmem initialization *before* the __scm assignment
in the core SCM driver.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-2-fa3851c98611@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
firmware: qcom: scm: remove unused arguments from SHM bridge routines 2025-09-04T14:55:51+00:00 Bartosz Golaszewski bartosz.golaszewski@linaro.org 2025-06-30T12:12:02+00:00 617ad64abf488e898a6b6c73c4ddf42a67385bf7 commit 23972da96e1eee7f10c8ef641d56202ab9af8ba7 upstream. qcom_scm_shm_bridge_create() and qcom_scm_shm_bridge_delete() take struct device as argument but don't use it. Remove it from these functions' prototypes. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-1-fa3851c98611@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 23972da96e1eee7f10c8ef641d56202ab9af8ba7 upstream.

qcom_scm_shm_bridge_create() and qcom_scm_shm_bridge_delete() take
struct device as argument but don't use it. Remove it from these
functions' prototypes.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-1-fa3851c98611@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
docs: firmware: qcom_scm: Fix kernel-doc warning 2025-05-19T23:04:28+00:00 Unnathi Chalicheemala unnathi.chalicheemala@oss.qualcomm.com 2025-04-03T20:38:24+00:00 936badf282388be78094e55bd5e2c96f86635e48 Add description for members of qcom_scm_desc struct to avoid: drivers/firmware/qcom/qcom_scm.h:56: warning: Function parameter or struct member 'svc' not described in 'qcom_scm_desc' drivers/firmware/qcom/qcom_scm.h:56: warning: Function parameter or struct member 'cmd' not described in 'qcom_scm_desc' drivers/firmware/qcom/qcom_scm.h:56: warning: Function parameter or struct member 'owner' not described in 'qcom_scm_desc' Signed-off-by: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20250403-fix_scm_doc_warn-v1-1-9cd36345db77@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org> 
Add description for members of qcom_scm_desc struct to avoid:

drivers/firmware/qcom/qcom_scm.h:56: warning: Function parameter or struct
member 'svc' not described in 'qcom_scm_desc'

drivers/firmware/qcom/qcom_scm.h:56: warning: Function parameter or struct
member 'cmd' not described in 'qcom_scm_desc'

drivers/firmware/qcom/qcom_scm.h:56: warning: Function parameter or struct
member 'owner' not described in 'qcom_scm_desc'

Signed-off-by: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250403-fix_scm_doc_warn-v1-1-9cd36345db77@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
firmware: qcom: scm: Allow QSEECOM for HP EliteBook Ultra G1q 2025-05-14T20:52:59+00:00 Juerg Haefliger juerg.haefliger@canonical.com 2025-04-29T14:49:57+00:00 eb47bca4cc8ab06bd25385c87406e0f27ebdbf07 This is required to get access to efivars and uefi boot loader support. Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com> Link: https://lore.kernel.org/r/20250429144957.2088284-5-juerg.haefliger@canonical.com Signed-off-by: Bjorn Andersson <andersson@kernel.org> 
This is required to get access to efivars and uefi boot loader support.

Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
Link: https://lore.kernel.org/r/20250429144957.2088284-5-juerg.haefliger@canonical.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
firmware: qcom: tzmem: disable sm7150 platform 2025-05-09T22:12:55+00:00 Danila Tikhonov danila@jiaxyga.com 2025-04-22T21:31:33+00:00 db3de3ff2611fd1da2267a5a92ee86b463e555f6 The SHM bridge makes the SM7150 devices reset while probing the RMTFS (in qcom_scm_assign_mem()). Blacklist the SHM Bridge on corresponding platforms using SoC-level compat string. Signed-off-by: Danila Tikhonov <danila@jiaxyga.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20250422213137.80366-13-danila@jiaxyga.com Signed-off-by: Bjorn Andersson <andersson@kernel.org> 
The SHM bridge makes the SM7150 devices reset while probing the RMTFS
(in qcom_scm_assign_mem()). Blacklist the SHM Bridge on corresponding
platforms using SoC-level compat string.

Signed-off-by: Danila Tikhonov <danila@jiaxyga.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250422213137.80366-13-danila@jiaxyga.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 2025-05-06T20:14:26+00:00 Aleksandrs Vinarskis alex.vinarskis@gmail.com 2025-04-26T12:57:59+00:00 56c8edc6eeaa16f777b1c030aad12e2e8da92104 Allow particular machine accessing eg. efivars. Signed-off-by: Aleksandrs Vinarskis <alex.vinarskis@gmail.com> Link: https://lore.kernel.org/r/20250426130203.37659-4-alex.vinarskis@gmail.com Signed-off-by: Bjorn Andersson <andersson@kernel.org> 
Allow particular machine accessing eg. efivars.

Signed-off-by: Aleksandrs Vinarskis <alex.vinarskis@gmail.com>
Link: https://lore.kernel.org/r/20250426130203.37659-4-alex.vinarskis@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
firmware: qcom: uefisecapp: fix efivars registration race 2025-02-08T17:38:03+00:00 Johan Hovold johan+linaro@kernel.org 2025-01-20T15:10:00+00:00 da8d493a80993972c427002684d0742560f3be4a Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access. Make sure that all resources have been set up before registering the efivars. Fixes: 6612103ec35a ("firmware: qcom: qseecom: convert to using the TZ allocator") Cc: stable@vger.kernel.org # 6.11 Cc: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Link: https://lore.kernel.org/r/20250120151000.13870-1-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson <andersson@kernel.org> 
Since the conversion to using the TZ allocator, the efivars service is
registered before the memory pool has been allocated, something which
can lead to a NULL-pointer dereference in case of a racing EFI variable
access.

Make sure that all resources have been set up before registering the
efivars.

Fixes: 6612103ec35a ("firmware: qcom: qseecom: convert to using the TZ allocator")
Cc: stable@vger.kernel.org	# 6.11
Cc: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://lore.kernel.org/r/20250120151000.13870-1-johan+linaro@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
firmware: qcom: scm: Fix error code in probe() 2025-02-05T03:16:02+00:00 Dan Carpenter dan.carpenter@linaro.org 2025-01-15T06:52:53+00:00 7f048b202333b967782a98aa21bb3354dc379bbf Set the error code if devm_qcom_tzmem_pool_new() fails. Don't return success. Fixes: 1e76b546e6fc ("firmware: qcom: scm: Cleanup global '__scm' on probe failures") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/a0845467-4f83-4070-ab1e-ff7e6764609f@stanley.mountain Signed-off-by: Bjorn Andersson <andersson@kernel.org> 
Set the error code if devm_qcom_tzmem_pool_new() fails.  Don't return
success.

Fixes: 1e76b546e6fc ("firmware: qcom: scm: Cleanup global '__scm' on probe failures")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/a0845467-4f83-4070-ab1e-ff7e6764609f@stanley.mountain
Signed-off-by: Bjorn Andersson <andersson@kernel.org>