Re: [PATCH v4 3/6] firmware: qcom: scm: Add support for setting Bluetooth power modes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] TrustZone ABI Command ID collision between QCOM_SCM_PIL_PAS_BT_PWR_MODE and QCOM_SCM_PIL_PAS_GET_RSCTABLE.
--

commit 3517e2228bae4426b6fd48e30229414c0c97a8c2
Author: George Moussalem <george.moussalem@outlook.com>

firmware: qcom: scm: Add support for setting Bluetooth power modes

The Bluetooth subsystem (BTSS) on the IPQ5018 SoC supports setting power
modes which are required to be configured through a Secure Channel
Manager (SCM) call to TrustZone. However, not all Trusted Execution
Environment (QSEE) images support this call, so first check if the call
is available.

> diff --git a/drivers/firmware/qcom/qcom_scm.h b/drivers/firmware/qcom/qcom_scm.h
> index caab80a73e17f..5579df5a2aca7 100644
> --- a/drivers/firmware/qcom/qcom_scm.h
> +++ b/drivers/firmware/qcom/qcom_scm.h
> @@ -105,6 +105,7 @@ int qcom_scm_shm_bridge_enable(struct device *scm_dev);
>  #define QCOM_SCM_PIL_PAS_SHUTDOWN	0x06
>  #define QCOM_SCM_PIL_PAS_IS_SUPPORTED	0x07
>  #define QCOM_SCM_PIL_PAS_MSS_RESET	0x0a
> +#define QCOM_SCM_PIL_PAS_BT_PWR_MODE	0x21
>  #define QCOM_SCM_PIL_PAS_GET_RSCTABLE	0x21

[Severity: High]
Does this command ID definition collide with the existing
QCOM_SCM_PIL_PAS_GET_RSCTABLE?

Because both are defined as 0x21, __qcom_scm_is_call_available() will return
true on any SoC supporting GET_RSCTABLE, falsely indicating that BT_PWR_MODE
is supported.

When qcom_scm_pas_set_bluetooth_power_mode() is called, it issues a Secure
Monitor Call with 2 arguments. However, TrustZone will route this to the
GET_RSCTABLE handler, which expects 5 arguments, including physical memory
addresses.

Since the trailing arguments in the descriptor are implicitly zero-initialized,
could this cause TrustZone to attempt reading or writing at physical address
0x0, leading to memory corruption or a fatal Secure World exception?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706-ipq5018-bluetooth-v4-0-350262a30959@outlook.com?part=3