Re: [PATCH RESEND v7 10/10] arm64: dts: qcom: shikra: Add gpio-reserved-ranges to tlmm

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] An unintended extra leading space is present before the `gpio-reserved-ranges` property definition in `shikra-iqs-som.dtsi`, breaking standard DT indentation.

Pre-existing issues:
- [High] Missing `gpiochip_line_is_valid()` check in `msm_config_group_set()` allows secure world fault via pinconf settings.
--

--- Patch [10]: [PATCH RESEND v7 10/10] arm64: dts: qcom: shikra: Add gpio-reserved-ranges to tlmm ---
commit ed56ddbc066b2d1385abdc3ef44f21fea529dddb
Author: Komal Bajaj <komal.bajaj@oss.qualcomm.com>

arm64: dts: qcom: shikra: Add gpio-reserved-ranges to tlmm

This commit adds the gpio-reserved-ranges property to the TLMM node for both
Shikra SoM variants (CQM and IQS). These reserved GPIOs are inaccessible from
the non-secure world and dedicated to fixed functions.

> diff --git a/arch/arm64/boot/dts/qcom/shikra-cqm-som.dtsi b/arch/arm64/boot/dts/qcom/shikra-cqm-som.dtsi
> index 2fff5fe9f6d2f..8ac42ff625a0e 100644
> --- a/arch/arm64/boot/dts/qcom/shikra-cqm-som.dtsi
> +++ b/arch/arm64/boot/dts/qcom/shikra-cqm-som.dtsi
> @@ -196,6 +196,12 @@ pm4125_l22: l22 {
>  };
>  
>  &tlmm {
> +	gpio-reserved-ranges = <6 4>, /* Fingerprint SPI */
> +			       <14 4>, /* eSE SPI */
> +			       <30 2>, /* NFC SPI */
> +			       <138 1>, /* NFC Secure IO */
> +			       <155 11>; /* eMMC Boot */
> +

[Severity: High]
This is a pre-existing issue, and was not introduced by the patch under
review, but does defining these reserved ranges expose a missing validation
check in the pinctrl driver?

If a device tree node requests a pinconf setting (such as bias or drive
strength) on a pin reserved via gpio-reserved-ranges, the generic pinctrl
core (pinconf_apply_setting) bypasses pin_request and directly invokes the
driver's callback:

drivers/pinctrl/qcom/pinctrl-msm.c:msm_config_group_set()

Since msm_config_group_set() lacks a gpiochip_line_is_valid() check, it
directly reads and writes the protected TLMM registers for the secure pin,
triggering a secure world hardware fault.

Could this be triggered by a buggy OEM devicetree or a devicetree overlay
loaded from userspace?

[ ... ]

> diff --git a/arch/arm64/boot/dts/qcom/shikra-iqs-som.dtsi b/arch/arm64/boot/dts/qcom/shikra-iqs-som.dtsi
> index 657a14ca96067..4ff97945274dd 100644
> --- a/arch/arm64/boot/dts/qcom/shikra-iqs-som.dtsi
> +++ b/arch/arm64/boot/dts/qcom/shikra-iqs-som.dtsi
> @@ -218,6 +218,12 @@ pm8150_l18: l18 {
>  };
>  
>  &tlmm {
> +	 gpio-reserved-ranges = <6 4>, /* Fingerprint SPI */

[Severity: Low]
This isn't a bug, but there is an unintended extra leading space before the
gpio-reserved-ranges property.

> +			       <14 4>, /* eSE SPI */
> +			       <30 2>, /* NFC SPI */
> +			       <138 1>, /* NFC Secure IO */
> +			       <155 11>; /* eMMC Boot */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803-shikra-dt-m1-v7-0-7fec8e777076@oss.qualcomm.com?part=10