Re: [PATCH v5 3/6] firmware: qcom: scm: Add support for setting Bluetooth power modes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The new `QCOM_SCM_PIL_PAS_BT_PWR_MODE` macro uses the exact same command ID (`0x21`) as the existing `QCOM_SCM_PIL_PAS_GET_RSCTABLE` macro within the `QCOM_SCM_SVC_PIL` service.
--

--- Patch [3]: [PATCH v5 3/6] firmware: qcom: scm: Add support for setting Bluetooth power modes ---
commit 7001f29bdf69c1e84287e5d8734b48feda414e41
Author: George Moussalem <george.moussalem@outlook.com>

firmware: qcom: scm: Add support for setting Bluetooth power modes

The Bluetooth subsystem (BTSS) on the IPQ5018 SoC supports setting power
modes which are configured through a Secure Channel Manager (SCM) call to
TrustZone. This commit adds a function to perform this call after checking
if the feature is supported by the QSEE image.

> diff --git a/drivers/firmware/qcom/qcom_scm.h b/drivers/firmware/qcom/qcom_scm.h
> index caab80a73e17f..5579df5a2aca7 100644
> --- a/drivers/firmware/qcom/qcom_scm.h
> +++ b/drivers/firmware/qcom/qcom_scm.h
> @@ -105,6 +105,7 @@ int qcom_scm_shm_bridge_enable(struct device *scm_dev);
>  #define QCOM_SCM_PIL_PAS_SHUTDOWN	0x06
>  #define QCOM_SCM_PIL_PAS_IS_SUPPORTED	0x07
>  #define QCOM_SCM_PIL_PAS_MSS_RESET	0x0a
> +#define QCOM_SCM_PIL_PAS_BT_PWR_MODE	0x21
>  #define QCOM_SCM_PIL_PAS_GET_RSCTABLE	0x21

[Severity: High]
Is it intended for QCOM_SCM_PIL_PAS_BT_PWR_MODE to use the exact same
command ID (0x21) as QCOM_SCM_PIL_PAS_GET_RSCTABLE?

Because both definitions share 0x21 within the QCOM_SCM_SVC_PIL service,
when __qcom_scm_is_call_available() queries the firmware for
QCOM_SCM_PIL_PAS_BT_PWR_MODE, it will falsely return true on any SoC that
already supports GET_RSCTABLE.

This would allow qcom_scm_pas_set_bluetooth_power_mode() to incorrectly
proceed and execute a 2-argument SCM call to TrustZone. Could this cause
the firmware to route the call to the GET_RSCTABLE handler (which expects
5 arguments, including physical addresses for DMA), potentially leading
to a Secure World memory fault?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709-ipq5018-bluetooth-v5-0-e476c41f03b8@outlook.com?part=3