[PATCH v2 1/3] firmware: qcom: tzmem: Use DO_ONCE_SLEEPABLE() in qcom_tzmem_enable()

[PATCH v2 1/3] firmware: qcom: tzmem: Use DO_ONCE_SLEEPABLE() in qcom_tzmem_enable()

[Mukesh Ojha]

qcom_tzmem_enable() is called from qcom_scm_probe() in a sleepable process
context. The helper it wraps, qcom_tzmem_init(), calls
qcom_scm_shm_bridge_enable() -> qcom_scm_call(), which invokes
might_sleep() and later acquires the qcom_scm_lock mutex via
__scm_smc_do().

DO_ONCE() takes the once_lock spinlock with IRQs disabled, so invoking
qcom_tzmem_init() from inside DO_ONCE() runs a sleepable call chain in
atomic context. CONFIG_DEBUG_ATOMIC_SLEEP=y catches this on boot:

  BUG: sleeping function called from invalid context at drivers/firmware/qcom/qcom_scm.c:334
  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 49, name: kworker/u16:2
  ...
   __might_resched+0x148/0x24c
   __might_sleep+0x48/0x7c
   qcom_scm_call+0x30/0xc0
   __qcom_scm_is_call_available+0x98/0x100
   qcom_scm_shm_bridge_enable+0x60/0xbc
   qcom_tzmem_enable+0xf8/0x118
   qcom_scm_probe+0x2d0/0x680

  [ BUG: Invalid wait context ]
  ...
  kworker/u16:2/49 is trying to lock:
  ffffa83e8a485e38 (qcom_scm_lock){....}-{4:4}, at: __scm_smc_do+0x70/0x488

Switch to DO_ONCE_SLEEPABLE(), which guards the one-shot init with a
mutex-style path (__do_once_sleepable_start/done) that is safe to hold
across sleeping callees. All callers of qcom_tzmem_enable() are in
process context (driver probe), so this is safe.

Fixes: 9941fe8a04f3 ("firmware: qcom: scm: Fix tzmem state on probe retry")
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Closes: https://lore.kernel.org/lkml/5ea74dd3-7471-4c7c-9242-c2005312b1ab@samsung.com/
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
Changes in v2:
 - Rebased it.
 - link to v1 https://lore.kernel.org/all/20260806112709.4018596-1-mukesh.ojha@oss.qualcomm.com/

 drivers/firmware/qcom/qcom_tzmem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/qcom/qcom_tzmem.c b/drivers/firmware/qcom/qcom_tzmem.c
index 322fa928234b..4ba798fe01af 100644
--- a/drivers/firmware/qcom/qcom_tzmem.c
+++ b/drivers/firmware/qcom/qcom_tzmem.c
@@ -516,7 +516,7 @@ int qcom_tzmem_enable(struct device *dev)
 	static int result;
 
 	qcom_tzmem_dev = dev;
-	DO_ONCE(qcom_tzmem_do_init, &result);
+	DO_ONCE_SLEEPABLE(qcom_tzmem_do_init, &result);
 	return result;
 }
 EXPORT_SYMBOL_GPL(qcom_tzmem_enable);
-- 
2.55.0

[PATCH v2 2/3] firmware: qcom_scm: handle empty PAS resource table

[Mukesh Ojha]

The PAS resource-table query may successfully return a zero-sized
table. kmemdup() with a zero length returns ZERO_SIZE_PTR,
which is stored in rproc->table_ptr. The remoteproc core then
dereferences this invalid pointer while processing resources.

Treat a zero-sized result as an absent resource table and return
NULL after releasing the TrustZone memory buffer. This allows the
remoteproc core to skip resource-table processing.

Fixes: 8b9d2050cfa0 ("firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table")
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
Changes in v2:
 - New change.

 drivers/firmware/qcom/qcom_scm.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
index df20773dd754..b5959f833dd7 100644
--- a/drivers/firmware/qcom/qcom_scm.c
+++ b/drivers/firmware/qcom/qcom_scm.c
@@ -823,6 +823,14 @@ static void *qcom_scm_pas_get_rsc_table(struct device *dev,
 		goto free_input_rt;
 	}
 
+	*output_rt_size = size;
+
+	/* A zero-sized table means that TrustZone has no resource table. */
+	if (!size) {
+		tbl_ptr = NULL;
+		goto free_output_rt;
+	}
+
 	tbl_ptr = kmemdup(output_rt_tzm, size, GFP_KERNEL);
 	if (!tbl_ptr) {
 		qcom_tzmem_free(output_rt_tzm);
@@ -830,7 +838,7 @@ static void *qcom_scm_pas_get_rsc_table(struct device *dev,
 		goto free_input_rt;
 	}
 
-	*output_rt_size = size;
+free_output_rt:
 	qcom_tzmem_free(output_rt_tzm);
 
 free_input_rt:
-- 
2.55.0

Re: [PATCH v2 2/3] firmware: qcom_scm: handle empty PAS resource table

[Bartosz Golaszewski]

On Mon, 21 Sep 2026 21:56:35 +0200, Mukesh Ojha
<mukesh.ojha@oss.qualcomm.com> said:
> The PAS resource-table query may successfully return a zero-sized
> table. kmemdup() with a zero length returns ZERO_SIZE_PTR,
> which is stored in rproc->table_ptr. The remoteproc core then
> dereferences this invalid pointer while processing resources.
>
> Treat a zero-sized result as an absent resource table and return
> NULL after releasing the TrustZone memory buffer. This allows the
> remoteproc core to skip resource-table processing.
>
> Fixes: 8b9d2050cfa0 ("firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table")
> Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
> ---

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

Re: [PATCH v2 2/3] firmware: qcom_scm: handle empty PAS resource table

[Konrad Dybcio]

On 9/21/26 9:56 PM, Mukesh Ojha wrote:
> The PAS resource-table query may successfully return a zero-sized
> table. kmemdup() with a zero length returns ZERO_SIZE_PTR,
> which is stored in rproc->table_ptr. The remoteproc core then
> dereferences this invalid pointer while processing resources.
> 
> Treat a zero-sized result as an absent resource table and return
> NULL after releasing the TrustZone memory buffer. This allows the
> remoteproc core to skip resource-table processing.
> 
> Fixes: 8b9d2050cfa0 ("firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table")
> Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>


> Changes in v2:
>  - New change.
> 
>  drivers/firmware/qcom/qcom_scm.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
> index df20773dd754..b5959f833dd7 100644
> --- a/drivers/firmware/qcom/qcom_scm.c
> +++ b/drivers/firmware/qcom/qcom_scm.c
> @@ -823,6 +823,14 @@ static void *qcom_scm_pas_get_rsc_table(struct device *dev,
>  		goto free_input_rt;
>  	}
>  
> +	*output_rt_size = size;
> +
> +	/* A zero-sized table means that TrustZone has no resource table. */
> +	if (!size) {
> +		tbl_ptr = NULL;
> +		goto free_output_rt;
> +	}
> +
>  	tbl_ptr = kmemdup(output_rt_tzm, size, GFP_KERNEL);
>  	if (!tbl_ptr) {
>  		qcom_tzmem_free(output_rt_tzm);

^ this hunk can additionally be remodeled to jump to this new label
too

Konrad

Re: [PATCH v2 2/3] firmware: qcom_scm: handle empty PAS resource table

[Bartosz Golaszewski]

On Tue, 22 Sep 2026 12:42:57 +0200, Konrad Dybcio
<konrad.dybcio@oss.qualcomm.com> said:
> On 9/21/26 9:56 PM, Mukesh Ojha wrote:
>> The PAS resource-table query may successfully return a zero-sized
>> table. kmemdup() with a zero length returns ZERO_SIZE_PTR,
>> which is stored in rproc->table_ptr. The remoteproc core then
>> dereferences this invalid pointer while processing resources.
>>
>> Treat a zero-sized result as an absent resource table and return
>> NULL after releasing the TrustZone memory buffer. This allows the
>> remoteproc core to skip resource-table processing.
>>
>> Fixes: 8b9d2050cfa0 ("firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table")
>> Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
>> ---
>
> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
>
>
>> Changes in v2:
>>  - New change.
>>
>>  drivers/firmware/qcom/qcom_scm.c | 10 +++++++++-
>>  1 file changed, 9 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
>> index df20773dd754..b5959f833dd7 100644
>> --- a/drivers/firmware/qcom/qcom_scm.c
>> +++ b/drivers/firmware/qcom/qcom_scm.c
>> @@ -823,6 +823,14 @@ static void *qcom_scm_pas_get_rsc_table(struct device *dev,
>>  		goto free_input_rt;
>>  	}
>>
>> +	*output_rt_size = size;
>> +
>> +	/* A zero-sized table means that TrustZone has no resource table. */
>> +	if (!size) {
>> +		tbl_ptr = NULL;
>> +		goto free_output_rt;
>> +	}
>> +
>>  	tbl_ptr = kmemdup(output_rt_tzm, size, GFP_KERNEL);
>>  	if (!tbl_ptr) {
>>  		qcom_tzmem_free(output_rt_tzm);
>
> ^ this hunk can additionally be remodeled to jump to this new label
> too
>

This wouldn't be needed if with my series using cleanup.h[1] in this driver.

Just sayin'... :)

Bart

[1] https://lore.kernel.org/all/20260903-qcom-scm-code-shrink-v3-0-8237f3a654e1@oss.qualcomm.com/

[PATCH v2 3/3] firmware: qcom_scm: align PAS resource table retry

[Mukesh Ojha]

The initial PAS resource-table buffer can be too small. TrustZone
returns the required size and the wrapper retries the SCM call.
Although qcom_tzmem_alloc() aligns the allocated buffer,
the size passed to TrustZone remained unaligned.

Align the retry size to a page boundary so that both the buffer
and its advertised size satisfy the PAS/TrustZone contract.

Fixes: 8b9d2050cfa0 ("firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table")
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
---
Changes in v2:
 - New change.

 drivers/firmware/qcom/qcom_scm.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
index b5959f833dd7..f4442a70e614 100644
--- a/drivers/firmware/qcom/qcom_scm.c
+++ b/drivers/firmware/qcom/qcom_scm.c
@@ -812,12 +812,14 @@ static void *qcom_scm_pas_get_rsc_table(struct device *dev,
 	output_rt_tzm = __qcom_scm_pas_get_rsc_table(dev, ctx->pas_id,
 						     input_rt_tzm,
 						     input_rt_size, &size);
-	if (PTR_ERR(output_rt_tzm) == -EOVERFLOW)
-		/* Try again with the size requested by the TZ */
+	if (PTR_ERR(output_rt_tzm) == -EOVERFLOW) {
+		/* Try again with a page-aligned size requested by the TZ. */
+		size = PAGE_ALIGN(size);
 		output_rt_tzm = __qcom_scm_pas_get_rsc_table(dev, ctx->pas_id,
 							     input_rt_tzm,
 							     input_rt_size,
 							     &size);
+	}
 	if (IS_ERR(output_rt_tzm)) {
 		ret = PTR_ERR(output_rt_tzm);
 		goto free_input_rt;
-- 
2.55.0

Re: [PATCH v2 3/3] firmware: qcom_scm: align PAS resource table retry

[Bartosz Golaszewski]

On Mon, 21 Sep 2026 21:56:36 +0200, Mukesh Ojha
<mukesh.ojha@oss.qualcomm.com> said:
> The initial PAS resource-table buffer can be too small. TrustZone
> returns the required size and the wrapper retries the SCM call.
> Although qcom_tzmem_alloc() aligns the allocated buffer,
> the size passed to TrustZone remained unaligned.
>
> Align the retry size to a page boundary so that both the buffer
> and its advertised size satisfy the PAS/TrustZone contract.
>
> Fixes: 8b9d2050cfa0 ("firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table")
> Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
> ---

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

Re: [PATCH v2 3/3] firmware: qcom_scm: align PAS resource table retry

[Konrad Dybcio]

On 9/21/26 9:56 PM, Mukesh Ojha wrote:
> The initial PAS resource-table buffer can be too small. TrustZone
> returns the required size and the wrapper retries the SCM call.
> Although qcom_tzmem_alloc() aligns the allocated buffer,
> the size passed to TrustZone remained unaligned.
> 
> Align the retry size to a page boundary so that both the buffer
> and its advertised size satisfy the PAS/TrustZone contract.
> 
> Fixes: 8b9d2050cfa0 ("firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table")
> Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Konrad

Re: (subset) [PATCH v2 1/3] firmware: qcom: tzmem: Use DO_ONCE_SLEEPABLE() in qcom_tzmem_enable()

[Bjorn Andersson]

From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>


On Tue, 22 Sep 2026 01:26:34 +0530, Mukesh Ojha wrote:
> qcom_tzmem_enable() is called from qcom_scm_probe() in a sleepable process
> context. The helper it wraps, qcom_tzmem_init(), calls
> qcom_scm_shm_bridge_enable() -> qcom_scm_call(), which invokes
> might_sleep() and later acquires the qcom_scm_lock mutex via
> __scm_smc_do().
> 
> DO_ONCE() takes the once_lock spinlock with IRQs disabled, so invoking
> qcom_tzmem_init() from inside DO_ONCE() runs a sleepable call chain in
> atomic context. CONFIG_DEBUG_ATOMIC_SLEEP=y catches this on boot:
> 
> [...]

Applied, thanks!

[3/3] firmware: qcom_scm: align PAS resource table retry
      commit: 8b5af44f53ad08ebdf1872c36ae2b998bf22bb72

Best regards,
-- 
Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>