[PATCH] scsi: ufs: core: Register the RPMB bus before adding devices to it

[PATCH] scsi: ufs: core: Register the RPMB bus before adding devices to it

[Alexey Charkov]

ufs_rpmb_probe() puts each RPMB region device on ufs_rpmb_bus_type, but
nothing ever registers that bus. The driver core used to accept such a
device and treat it as having no bus, which hid the problem. Since commit
36f35b8df697 ("driver core: reject devices with unregistered buses"),
device_register() fails instead, so no UFS host registers its RPMB
regions any more:

  bus_add_device: cannot add device 'ufs_rpmb0' to unregistered bus 'ufs_rpmb'
  ufshcd-rockchip 2a2d0000.ufshc: Failed to register UFS RPMB device 0

Register the bus when ufshcd-core initializes, before any host driver can
probe, and unregister it on exit.

Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices")
Cc: stable@vger.kernel.org
Signed-off-by: Alexey Charkov <alchark@flipper.net>
---
 drivers/ufs/core/ufs-rpmb.c    | 10 ++++++++++
 drivers/ufs/core/ufshcd-priv.h |  9 +++++++++
 drivers/ufs/core/ufshcd.c      | 14 +++++++++++++-
 3 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
index 756673337648..591e7f2e1474 100644
--- a/drivers/ufs/core/ufs-rpmb.c
+++ b/drivers/ufs/core/ufs-rpmb.c
@@ -276,5 +276,15 @@ void ufs_rpmb_remove(struct ufs_hba *hba)
 	dev_info(hba->dev, "All UFS RPMB devices unregistered\n");
 }
 
+int __init ufs_rpmb_bus_init(void)
+{
+	return bus_register(&ufs_rpmb_bus_type);
+}
+
+void ufs_rpmb_bus_exit(void)
+{
+	bus_unregister(&ufs_rpmb_bus_type);
+}
+
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("OP-TEE UFS RPMB driver");
diff --git a/drivers/ufs/core/ufshcd-priv.h b/drivers/ufs/core/ufshcd-priv.h
index 99f654b79035..4f2661036d7b 100644
--- a/drivers/ufs/core/ufshcd-priv.h
+++ b/drivers/ufs/core/ufshcd-priv.h
@@ -499,9 +499,18 @@ static inline u32 ufshcd_mcq_get_sq_head_slot(struct ufs_hw_queue *q)
 }
 
 #if IS_ENABLED(CONFIG_RPMB)
+int ufs_rpmb_bus_init(void);
+void ufs_rpmb_bus_exit(void);
 int ufs_rpmb_probe(struct ufs_hba *hba);
 void ufs_rpmb_remove(struct ufs_hba *hba);
 #else
+static inline int ufs_rpmb_bus_init(void)
+{
+	return 0;
+}
+static inline void ufs_rpmb_bus_exit(void)
+{
+}
 static inline int ufs_rpmb_probe(struct ufs_hba *hba)
 {
 	return 0;
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index c9b2eefbd7b0..4653d497e27b 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -11687,9 +11687,20 @@ static int __init ufshcd_core_init(void)
 
 	ufs_debugfs_init();
 
+	ret = ufs_rpmb_bus_init();
+	if (ret)
+		goto err_debugfs;
+
 	ret = scsi_register_driver(&ufs_dev_wlun_template);
 	if (ret)
-		ufs_debugfs_exit();
+		goto err_rpmb_bus;
+
+	return 0;
+
+err_rpmb_bus:
+	ufs_rpmb_bus_exit();
+err_debugfs:
+	ufs_debugfs_exit();
 	return ret;
 }
 
@@ -11697,6 +11708,7 @@ static void __exit ufshcd_core_exit(void)
 {
 	ufs_debugfs_exit();
 	scsi_unregister_driver(&ufs_dev_wlun_template);
+	ufs_rpmb_bus_exit();
 }
 
 module_init(ufshcd_core_init);

---
base-commit: 793807ca13bf3072fc6d16ce6d90e9ab9beff2a5
change-id: 20261111-ufs-rpmb-bus-c8e4c1c2c49f

Best regards,
--  
Alexey Charkov <alchark@flipper.net>

Re: [PATCH] scsi: ufs: core: Register the RPMB bus before adding devices to it

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] scsi: ufs: core: bus device name collision in
  ufs_rpmb_probe()
--

commit d7d8b8a6fbcbb4705a5d1c464cb5ca946759c72a
Author: Alexey Charkov <alchark@flipper.net>

scsi: ufs: core: Register the RPMB bus before adding devices to it

This commit registers ufs_rpmb_bus_type during ufshcd-core initialization
and unregisters it on exit so that RPMB region devices can be added to the
bus.

> diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
> index 7566733376480..591e7f2e14740 100644
> --- a/drivers/ufs/core/ufs-rpmb.c
> +++ b/drivers/ufs/core/ufs-rpmb.c
> @@ -276,5 +276,15 @@ void ufs_rpmb_remove(struct ufs_hba *hba)
>  	dev_info(hba->dev, "All UFS RPMB devices unregistered\n");
>  }
>  
> +int __init ufs_rpmb_bus_init(void)
> +{
> +	return bus_register(&ufs_rpmb_bus_type);
> +}

[Severity: Medium]
With ufs_rpmb_bus_type registered, can ufs_rpmb_probe() fail with -EEXIST
on systems with more than one UFS host controller?

ufs_rpmb_probe() names each device using only the per-controller region
index:

drivers/ufs/core/ufs-rpmb.c:ufs_rpmb_probe() {
	...
		dev_set_name(&ufs_rpmb->dev, "ufs_rpmb%d", region);
	...
		ret = device_register(&ufs_rpmb->dev);
	...
}

Because bus_add_device() creates a symlink named dev_name(dev) in the
shared /sys/bus/ufs_rpmb/devices/ directory, the second controller's
"ufs_rpmb0" collides with the first controller's and leaves OP-TEE RPMB
unavailable on additional controllers.  Including hba->host->host_no in
the device name (as ufs_bsg_probe() does) would keep the names unique
across controllers.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111-ufs-rpmb-bus-v1-1-b07100e53f6c@flipper.net?part=1

Re: [PATCH] scsi: ufs: core: Register the RPMB bus before adding devices to it

[Bean Huo]

Hi Alexey,

Thanks. The code is correct, but this exact failure is already fixed in
Stanley's series, which has been on the list since September:
https://lore.kernel.org/all/20260914144910.931518-1-stanleyjhu@google.com

The order there matters. Once ufs_rpmb devices register again, which is what
your patch does, two bugs come back: a use-after-free on host unbind, and
concurrent RPMB requests that get each other's responses. Stanley measured both
with KASAN. Patches 1/3 and 2/3 fix them, and 3/3 turns registration back on
last. Taking this patch first would open that window again in mainline and in
stable.

So I would prefer to drop this one in favour of the series. If you have a board
where RPMB fails today, a Tested-by on v5 would help, please have a try
Stanley's patches. thanks


Kind regards,
Bean