• Maximilian Luz's avatar
    firmware: qcom: uefisecapp: Fix memory related IO errors and crashes · ed09f81e
    Maximilian Luz authored
    It turns out that while the QSEECOM APP_SEND command has specific fields
    for request and response buffers, uefisecapp expects them both to be in
    a single memory region. Failure to adhere to this has (so far) resulted
    in either no response being written to the response buffer (causing an
    EIO to be emitted down the line), the SCM call to fail with EINVAL
    (i.e., directly from TZ/firmware), or the device to be hard-reset.
    
    While this issue can be triggered deterministically, in the current form
    it seems to happen rather sporadically (which is why it has gone
    unnoticed during earlier testing). This is likely due to the two
    kzalloc() calls (for request and response) being directly after each
    other. Which means that those likely return consecutive regions most of
    the time, especially when not much else is going on in the system.
    
    Fix this by allocating a single memory region for both request and
    response buffers, properly aligning both structs inside it. This
    unfortunately also means that the qcom_scm_qseecom_app_send() interface
    needs to be restructured, as it should no longer map the DMA regions
    separately. Therefore, move the responsibility of DMA allocation (or
    mapping) to the caller.
    
    Fixes: 759e7a2b ("firmware: Add support for Qualcomm UEFI Secure Application")
    Cc: stable@vger.kernel.org  # 6.7
    Tested-by: default avatarJohan Hovold <johan+linaro@kernel.org>
    Reviewed-by: default avatarJohan Hovold <johan+linaro@kernel.org>
    Signed-off-by: default avatarMaximilian Luz <luzmaximilian@gmail.com>
    Tested-by: Konrad Dybcio <konrad.dybcio@linaro.org> # X13s
    Link: https://lore.kernel.org/r/20240406130125.1047436-1-luzmaximilian@gmail.comSigned-off-by: default avatarBjorn Andersson <andersson@kernel.org>
    ed09f81e
qcom_scm.c 48.3 KB