| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025070829-tiny-sizzling-dd49@gregkh>
Date: Tue, 8 Jul 2025 12:51:43 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Komal Bajaj <komal.bajaj@....qualcomm.com>
Cc: linux-arm-msm@...r.kernel.org, linux-usb@...r.kernel.org,
linux-kernel@...r.kernel.org,
Souradeep Chowdhury <quic_schowdhu@...cinc.com>,
Konrad Dybcio <konrad.dybcio@....qualcomm.com>
Subject: Re: [PATCH v3] usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through
secure calls
On Tue, Jul 08, 2025 at 02:22:08PM +0530, Komal Bajaj wrote:
> EUD_MODE_MANAGER2 register is mapped to a memory region that is marked
> as read-only for HLOS, enforcing access restrictions that prohibit
> direct memory-mapped writes via writel().
>
> Attempts to write to this region from HLOS can result in silent failures
> or memory access violations, particularly when toggling EUD (Embedded
> USB Debugger) state. To ensure secure register access, modify the driver
> to use qcom_scm_io_writel(), which routes the write operation to Qualcomm
> Secure Channel Monitor (SCM). SCM has the necessary permissions to access
> protected memory regions, enabling reliable control over EUD state.
>
> SC7280, the only user of EUD is also affected, indicating that this could
> never have worked on a properly fused device.
>
> Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)")
> Signed-off-by: Melody Olvera <quic_molvera@...cinc.com>
> Signed-off-by: Komal Bajaj <komal.bajaj@....qualcomm.com>
> Reviewed-by: Konrad Dybcio <konrad.dybcio@....qualcomm.com>
> ---
> drivers/usb/misc/Kconfig | 1 +
> drivers/usb/misc/qcom_eud.c | 24 ++++++++++++++++++------
> 2 files changed, 19 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
> index 6497c4e81e95..f49d5ac0e957 100644
> --- a/drivers/usb/misc/Kconfig
> +++ b/drivers/usb/misc/Kconfig
> @@ -148,6 +148,7 @@ config USB_QCOM_EUD
> tristate "QCOM Embedded USB Debugger(EUD) Driver"
> depends on ARCH_QCOM || COMPILE_TEST
> select USB_ROLE_SWITCH
> + select QCOM_SCM
> help
> This module enables support for Qualcomm Technologies, Inc.
> Embedded USB Debugger (EUD). The EUD is a control peripheral
> diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c
> index 83079c414b4f..156c4f75c3c9 100644
> --- a/drivers/usb/misc/qcom_eud.c
> +++ b/drivers/usb/misc/qcom_eud.c
> @@ -15,6 +15,7 @@
> #include <linux/slab.h>
> #include <linux/sysfs.h>
> #include <linux/usb/role.h>
> +#include <linux/firmware/qcom/qcom_scm.h>
>
> #define EUD_REG_INT1_EN_MASK 0x0024
> #define EUD_REG_INT_STATUS_1 0x0044
> @@ -34,7 +35,7 @@ struct eud_chip {
> struct device *dev;
> struct usb_role_switch *role_sw;
> void __iomem *base;
> - void __iomem *mode_mgr;
> + phys_addr_t mode_mgr;
> unsigned int int_status;
> int irq;
> bool enabled;
> @@ -43,18 +44,27 @@ struct eud_chip {
>
> static int enable_eud(struct eud_chip *priv)
> {
> + int ret;
> +
> + ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1);
> + if (ret)
> + return ret;
> +
> writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN);
> writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE,
> priv->base + EUD_REG_INT1_EN_MASK);
> - writel(1, priv->mode_mgr + EUD_REG_EUD_EN2);
>
> return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE);
> }
>
> static void disable_eud(struct eud_chip *priv)
> {
> + int ret;
> +
> + ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0);
> + if (ret)
> + return;
> writel(0, priv->base + EUD_REG_CSR_EUD_EN);
> - writel(0, priv->mode_mgr + EUD_REG_EUD_EN2);
> }
>
> static ssize_t enable_show(struct device *dev,
> @@ -178,6 +188,7 @@ static void eud_role_switch_release(void *data)
> static int eud_probe(struct platform_device *pdev)
> {
> struct eud_chip *chip;
> + struct resource *res;
> int ret;
>
> chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
> @@ -200,9 +211,10 @@ static int eud_probe(struct platform_device *pdev)
> if (IS_ERR(chip->base))
> return PTR_ERR(chip->base);
>
> - chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1);
> - if (IS_ERR(chip->mode_mgr))
> - return PTR_ERR(chip->mode_mgr);
> + res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
> + if (!res)
> + return -ENODEV;
> + chip->mode_mgr = res->start;
>
> chip->irq = platform_get_irq(pdev, 0);
> if (chip->irq < 0)
> --
> 2.48.1
>
>
Hi,
This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him
a patch that has triggered this response. He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created. Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.
You are receiving this message because of the following common error(s)
as indicated below:
- This looks like a new version of a previously submitted patch, but you
did not list below the --- line any changes from the previous version.
Please read the section entitled "The canonical patch format" in the
kernel file, Documentation/process/submitting-patches.rst for what
needs to be done here to properly describe this.
If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.
thanks,
greg k-h's patch email bot
Powered by blists - more mailing lists