linux-kernel - Re: [PATCH 2/2] firmware: qcom: scm: rework QSEECOM allowlist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <260eff7f-9243-49f5-830a-09bf7297af97@oss.qualcomm.com>
Date: Mon, 4 Nov 2024 14:31:13 +0100
From: Konrad Dybcio <konrad.dybcio@....qualcomm.com>
To: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
Cc: Bjorn Andersson <andersson@...nel.org>,
        Konrad Dybcio <konradybcio@...nel.org>, linux-arm-msm@...r.kernel.org,
        linux-kernel@...r.kernel.org, Steev Klimaszewski <steev@...i.org>
Subject: Re: [PATCH 2/2] firmware: qcom: scm: rework QSEECOM allowlist

On 4.11.2024 12:34 PM, Dmitry Baryshkov wrote:
> On Mon, 4 Nov 2024 at 11:24, Konrad Dybcio
> <konrad.dybcio@....qualcomm.com> wrote:
>>
>> On 3.11.2024 4:37 PM, Dmitry Baryshkov wrote:
>>> Listing individual machines in qcom_scm_qseecom_allowlist doesn't scale.
>>> Allow it to function as allow and disallow list at the same time by the
>>> means of the match->data and list the SoC families instead of devices.
>>>
>>> In case a particular device has buggy or incompatible firmware user
>>> still can disable QSEECOM by specifying qcom_scm.qseecom=off kernel
>>> param and (in the longer term) adding machine-specific entry to the
>>> qcom_scm_qseecom_allowlist table.
>>>
>>> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
>>> ---
>>>  drivers/firmware/qcom/qcom_scm.c | 37 ++++++++++++++++++++-----------------
>>>  1 file changed, 20 insertions(+), 17 deletions(-)
>>>
>>> diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
>>> index 9fed03d0a4b7e5709edf2db9a58b5326301008b4..6f70fbb0ddfbf88542ff2b3ed2bc372c2f3ce9eb 100644
>>> --- a/drivers/firmware/qcom/qcom_scm.c
>>> +++ b/drivers/firmware/qcom/qcom_scm.c
>>> @@ -1743,28 +1743,23 @@ module_param(qseecom, charp, 0);
>>>
>>>  /*
>>>   * We do not yet support re-entrant calls via the qseecom interface. To prevent
>>> - * any potential issues with this, only allow validated machines for now. Users
>>> + * any potential issues with this, only allow validated platforms for now. Users
>>>   * still can manually enable or disable it via the qcom_scm.qseecom modparam.
>>> + *
>>> + * To disable QSEECOM for a particular machine, add compatible entry and set
>>                                                        ^ a
>>
>>> + * data to (void *)false.
>>>   */
>>>  static const struct of_device_id qcom_scm_qseecom_allowlist[] __maybe_unused = {
>>> -     { .compatible = "dell,xps13-9345" },
>>> -     { .compatible = "lenovo,flex-5g" },
>>> -     { .compatible = "lenovo,thinkpad-t14s" },
>>> -     { .compatible = "lenovo,thinkpad-x13s", },
>>> -     { .compatible = "lenovo,yoga-slim7x" },
>>> -     { .compatible = "microsoft,arcata", },
>>> -     { .compatible = "microsoft,romulus13", },
>>> -     { .compatible = "microsoft,romulus15", },
>>> -     { .compatible = "qcom,sc8180x-primus" },
>>> -     { .compatible = "qcom,x1e80100-crd" },
>>> -     { .compatible = "qcom,x1e80100-qcp" },
>>> +     { .compatible = "qcom,sc8180x", .data = (void *)true },
>>> +     { .compatible = "qcom,sc8280xp", .data = (void *)true },
>>> +     { .compatible = "qcom,x1e80100", .data = (void *)true },
>>>       { }
>>>  };
>>
>> + Steev I think you had some unhappy machine
>>
>> And maybe 8180 Primus?
> 
> I don't think I understand this comment, could you please explain?

"maybe 8180-primus had some issues, too"

Konrad