linux-kernel - Re: [PATCH 2/2] firmware: qcom: scm: rework QSEECOM allowlist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAA8EJpqwY+kuOV1xu4vw8pC5AFhpK+J7P9mnyLeHfaf=CJkRMw@mail.gmail.com>
Date: Mon, 4 Nov 2024 11:34:57 +0000
From: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
To: Konrad Dybcio <konrad.dybcio@....qualcomm.com>
Cc: Bjorn Andersson <andersson@...nel.org>, Konrad Dybcio <konradybcio@...nel.org>, 
	linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] firmware: qcom: scm: rework QSEECOM allowlist

On Mon, 4 Nov 2024 at 11:24, Konrad Dybcio
<konrad.dybcio@....qualcomm.com> wrote:
>
> On 3.11.2024 4:37 PM, Dmitry Baryshkov wrote:
> > Listing individual machines in qcom_scm_qseecom_allowlist doesn't scale.
> > Allow it to function as allow and disallow list at the same time by the
> > means of the match->data and list the SoC families instead of devices.
> >
> > In case a particular device has buggy or incompatible firmware user
> > still can disable QSEECOM by specifying qcom_scm.qseecom=off kernel
> > param and (in the longer term) adding machine-specific entry to the
> > qcom_scm_qseecom_allowlist table.
> >
> > Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
> > ---
> >  drivers/firmware/qcom/qcom_scm.c | 37 ++++++++++++++++++++-----------------
> >  1 file changed, 20 insertions(+), 17 deletions(-)
> >
> > diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
> > index 9fed03d0a4b7e5709edf2db9a58b5326301008b4..6f70fbb0ddfbf88542ff2b3ed2bc372c2f3ce9eb 100644
> > --- a/drivers/firmware/qcom/qcom_scm.c
> > +++ b/drivers/firmware/qcom/qcom_scm.c
> > @@ -1743,28 +1743,23 @@ module_param(qseecom, charp, 0);
> >
> >  /*
> >   * We do not yet support re-entrant calls via the qseecom interface. To prevent
> > - * any potential issues with this, only allow validated machines for now. Users
> > + * any potential issues with this, only allow validated platforms for now. Users
> >   * still can manually enable or disable it via the qcom_scm.qseecom modparam.
> > + *
> > + * To disable QSEECOM for a particular machine, add compatible entry and set
>                                                        ^ a
>
> > + * data to (void *)false.
> >   */
> >  static const struct of_device_id qcom_scm_qseecom_allowlist[] __maybe_unused = {
> > -     { .compatible = "dell,xps13-9345" },
> > -     { .compatible = "lenovo,flex-5g" },
> > -     { .compatible = "lenovo,thinkpad-t14s" },
> > -     { .compatible = "lenovo,thinkpad-x13s", },
> > -     { .compatible = "lenovo,yoga-slim7x" },
> > -     { .compatible = "microsoft,arcata", },
> > -     { .compatible = "microsoft,romulus13", },
> > -     { .compatible = "microsoft,romulus15", },
> > -     { .compatible = "qcom,sc8180x-primus" },
> > -     { .compatible = "qcom,x1e80100-crd" },
> > -     { .compatible = "qcom,x1e80100-qcp" },
> > +     { .compatible = "qcom,sc8180x", .data = (void *)true },
> > +     { .compatible = "qcom,sc8280xp", .data = (void *)true },
> > +     { .compatible = "qcom,x1e80100", .data = (void *)true },
> >       { }
> >  };
>
> + Steev I think you had some unhappy machine
>
> And maybe 8180 Primus?

I don't think I understand this comment, could you please explain?

-- 
With best wishes
Dmitry