[PATCH 0/1] arm64: dts: qcom: sdm845-sony-tama: Enable UFS host controller and PHY

[PATCH 0/1] arm64: dts: qcom: sdm845-sony-tama: Enable UFS host controller and PHY

[Shujath Mohd]

This patch enables the UFS host controller and PHY on Sony Xperia Tama
devices.

UFS is currently disabled in the Tama device tree with the following
warning:

    /* BIG WARNING! DO NOT TOUCH UFS, YOUR DEVICE WILL DIE! */

This restriction was introduced because of a known UFS behaviour on
these devices. While investigating whether the historical restriction
is still required on production Tama devices, I tested the UFS
controller without the historical UFS quirks.

The UFS controller and PHY successfully initialize when the required
reset GPIO and regulator supplies are described in the device tree.

The required hardware configuration is:

- UFS reset GPIO: TLMM GPIO 150, active low
- UFS VCC: vreg_l20a_2p7, maximum 600 mA
- UFS PHY VDDA: vreg_l1a_0p9
- UFS PHY PLL: vreg_l26a_1p2

I tested this configuration on all three Sony Tama variants:

- Xperia XZ2 Compact (Akari)
- Xperia XZ2 (Akatsuki)
- Xperia XZ3 (Apollo)

Each device was rebooted repeatedly with UFS enabled. I did not observe
UFS data loss or corruption during testing.

As part of the investigation, I used EDL mode to access the UFS device
and dump LUN0, LUN1 and LUN2. This provided an independent way to inspect
the UFS storage while investigating the historical restriction.

The EDL/UFS access was based on work related to CVE-2021-30327 and its
SDM845 implementation in the katana project. This gave me enough
confidence to investigate the historical UFS restriction and test the
mainline kernel with UFS enabled.

The testing indicates that the historical UFS restriction is not
required for these production Tama devices when the required UFS
hardware configuration is provided.

This patch only enables the existing UFS controller and PHY nodes and
provides their required GPIO and regulator configuration. It does not
add or modify any UFS driver quirks.

Shujath Mohd (1):
  arm64: dts: qcom: sdm845-sony-tama: Enable UFS host controller and PHY

 .../boot/dts/qcom/sdm845-sony-xperia-tama.dtsi | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

-- 
2.55.0

[PATCH 1/1] arm64: dts: qcom: sdm845-sony-tama: Enable UFS host controller and PHY

[Shujath Mohd]

Enable the UFS host controller and PHY on Sony Xperia Tama devices.

Provide the UFS reset GPIO and required VCC, VDDA-PHY, and VDDA-PLL
regulators so that the UFS controller and PHY can initialize correctly.

The UFS host controller and PHY have been tested on the Akari, Apollo,
and Akatsuki devices across multiple reboots without observing UFS data
loss or corruption.

Fixes: 30a7f99befc6 ("arm64: dts: qcom: Add support for SONY Xperia XZ2 / XZ2C / XZ3 (Tama platform)")

Signed-off-by: Shujath Mohd <shujath@outlook.in>
---
 .../boot/dts/qcom/sdm845-sony-xperia-tama.dtsi | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi b/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi
index 84842e5f77a0..9ee62abd9180 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi
@@ -792,9 +792,21 @@ &uart9 {
 	status = "okay";
 };
 
-/* BIG WARNING! DO NOT TOUCH UFS, YOUR DEVICE WILL DIE! */
-&ufs_mem_hc { status = "disabled"; };
-&ufs_mem_phy { status = "disabled"; };
+&ufs_mem_hc {
+	status = "okay";
+
+	reset-gpios = <&tlmm 150 GPIO_ACTIVE_LOW>;
+
+	vcc-supply = <&vreg_l20a_2p7>;
+	vcc-max-microamp = <600000>;
+};
+
+&ufs_mem_phy {
+	status = "okay";
+
+	vdda-phy-supply = <&vreg_l1a_0p9>;
+	vdda-pll-supply = <&vreg_l26a_1p2>;
+};
 
 &usb_1 {
 	status = "okay";
-- 
2.55.0

Re: [PATCH 1/1] arm64: dts: qcom: sdm845-sony-tama: Enable UFS host controller and PHY

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Enabling the UFS controller on the Sony Xperia Tama platform without the required driver workaround risks erasing the bootloader and permanently hard-bricking the device.
--

commit 91d507f63b9143b3c7a96ab7389c84dca2784cd5
Author: Shujath Mohd <shujath@outlook.in>
Subject: arm64: dts: qcom: sdm845-sony-tama: Enable UFS host controller and PHY

This commit enables the UFS host controller and PHY on Sony Xperia Tama
devices. It removes the previous status disabled guard and configures the
necessary regulators and reset GPIOs.

> diff --git a/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi b/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi
> --- a/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi
> +++ b/arch/arm64/boot/dts/qcom/sdm845-sony-xperia-tama.dtsi
[ ... ]
> @@ -774,9 +774,21 @@ &uart9 {
>  	status = "okay";
>  };
>  
> -/* BIG WARNING! DO NOT TOUCH UFS, YOUR DEVICE WILL DIE! */
> -&ufs_mem_hc { status = "disabled"; };
> -&ufs_mem_phy { status = "disabled"; };
> +&ufs_mem_hc {
> +	status = "okay";
> +
> +	reset-gpios = <&tlmm 150 GPIO_ACTIVE_LOW>;

[Severity: Critical]
Does enabling the UFS controller here on the Sony Xperia Tama platform
without the required driver workaround risk erasing the bootloader and
permanently hard-bricking the device?

The original commit (30a7f99befc6) that introduced the platform explicitly
documented that sending a specific UFS command on these devices effectively
erases the bootloader. If the system or a user issues that UFS command,
such as via block discard, secure erase, firmware upgrade, or during
specific error-recovery paths, the device becomes unbootable. Userspace
operations such as fstrim or background kernel maintenance tasks can trigger
these commands.

Is the required downstream UFS driver workaround (kholk/kernel@2e7a9ee)
ported to the mainline drivers/ufs/ core? Removing the status="disabled"
protection without the driver-level mitigation active appears to expose
users of this device to a known hardware brick, even if normal boot and
reboot cycles appear stable.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/PUZPR01MB514158F5EDA660AC85FA8D5BC3BB2@PUZPR01MB5141.apcprd01.prod.exchangelabs.com?part=1