Skip to content

"Enabled hardening configs default to build. (#1223)"" #2232

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Jaihind Yadav (jaihindy) wants to merge 1 commit into
base: master
Choose a base branch
from
Open

"Enabled hardening configs default to build. (#1223)"" #2232

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions recipes-kernel/linux/linux-qcom-6.18/configs/bsp-additions.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -314,3 +314,9 @@ CONFIG_NFT_TPROXY=m
CONFIG_NFT_TUNNEL=m
CONFIG_PACKET_DIAG=y
CONFIG_VETH=m
# Disable stack erase plugin to avoid buildpath leakage in out-of-tree modules
CONFIG_KSTACK_ERASE=n
# Disabled due to TrustZone memory allocator initialization failure

@lumag Dmitry Baryshkov (lumag) Jul 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why? This would usually point out the error in the memory map. Can the boards boot with CONFIG_MEMTEST=y and memtest=1 kernel arg?

@jaihindy Jaihind Yadav (jaihindy) Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We performed additional debugging and identified that the failure is occurring during TrustZone SHM Bridge enablement. Specifically, the following API returns a non-zero status from TrustZone:
ret = qcom_scm_shm_bridge_enable(qcom_tzmem_dev);
Show more lines

Debug logs show:

[ 0.070390] qcom_scm firmware:scm: SHM bridge enable raw result: ret=0 res0=97 res1=0 res2=0
[ 0.070391] qcom_scm firmware:scm: SHM bridge enable returned non-zero status: 97

From the collected logs:

The SHM Bridge feature availability check succeeds (avail=1).

The SCM call itself completes successfully (ret=0).

However, TrustZone returns status 97 in res0.

The kernel interprets this status as a failure and reports:

Failed to enable the TrustZone memory allocator

Additionally, I tested:
CONFIG_QCOM_TZMEM_MODE_GENERIC=y
instead of:
CONFIG_QCOM_TZMEM_MODE_SHMBRIDGE=y
With GENERIC mode, the device boots successfully, including when the kernel hardening configurations (CONFIG_INIT_ON_ALLOC_DEFAULT_ON and CONFIG_INIT_ON_FREE_DEFAULT_ON) are enabled.

We have engaged the TrustZone (SSG) team and shared the debug findings. They are currently investigating why TrustZone returns status 97 for the SHM Bridge enable request on this platform.

Even if a TrustZone-side fix is identified, it is expected to take considerable time before it becomes available in the Non-HLOS images used by the nightly builds. Since this issue was only recently uncovered, waiting for the firmware fix would significantly delay the rollout of the hardening configuration changes.

Therefore, I would kindly request approval of this change while we continue to work with the SSG team on the root-cause analysis and firmware-side resolution of the SHM Bridge enablement failure. Once the fix will be available we'll enable CONFIG_INIT_ON_ALLOC_DEFAULT_ON and CONFIG_INIT_ON_FREE_DEFAULT_ON back.

@ricardosalveti Ricardo Salveti (ricardosalveti) Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would prefer to wait until we are able to identify a fix from the TrustZone-side, as we do want to find these type of issues.

@lumag Dmitry Baryshkov (lumag) Aug 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any progress on this issue?

# observed during early boot on RB4.
# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
6 changes: 6 additions & 0 deletions recipes-kernel/linux/linux-qcom-next/configs/bsp-additions.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -314,3 +314,9 @@ CONFIG_NFT_TPROXY=m
CONFIG_NFT_TUNNEL=m
CONFIG_PACKET_DIAG=y
CONFIG_VETH=m
# Disable stack erase plugin to avoid buildpath leakage in out-of-tree modules
CONFIG_KSTACK_ERASE=n
# Disabled due to TrustZone memory allocator initialization failure
# observed during early boot on RB4.
# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
2 changes: 1 addition & 1 deletion recipes-kernel/linux/linux-qcom-next_git.bb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ S = "${UNPACKDIR}/${BP}"
KBUILD_DEFCONFIG ?= "defconfig"
KBUILD_DEFCONFIG:qcom-armv7a = "qcom_defconfig"

KBUILD_CONFIG_EXTRA = "${@bb.utils.contains('DISTRO_FEATURES', 'hardened', '${S}/kernel/configs/hardening.config', '', d)}"
KBUILD_CONFIG_EXTRA = "${S}/kernel/configs/hardening.config"
KBUILD_CONFIG_EXTRA:append:aarch64 = " ${S}/arch/arm64/configs/prune.config"
KBUILD_CONFIG_EXTRA:append:aarch64 = " ${S}/arch/arm64/configs/qcom.config"
KBUILD_CONFIG_EXTRA:append = " ${@oe.utils.vartrue('DEBUG_BUILD', '${S}/kernel/configs/debug.config', '', d)}"
Expand Down
2 changes: 1 addition & 1 deletion recipes-kernel/linux/linux-qcom_6.18.bb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ S = "${UNPACKDIR}/${BP}"
KBUILD_DEFCONFIG ?= "defconfig"
KBUILD_DEFCONFIG:qcom-armv7a = "qcom_defconfig"

KBUILD_CONFIG_EXTRA = "${@bb.utils.contains('DISTRO_FEATURES', 'hardened', '${S}/kernel/configs/hardening.config', '', d)}"
KBUILD_CONFIG_EXTRA = "${S}/kernel/configs/hardening.config"
KBUILD_CONFIG_EXTRA:append:aarch64 = " ${S}/arch/arm64/configs/prune.config"
KBUILD_CONFIG_EXTRA:append:aarch64 = " ${S}/arch/arm64/configs/qcom.config"
KBUILD_CONFIG_EXTRA:append = " ${@oe.utils.vartrue('DEBUG_BUILD', '${S}/kernel/configs/debug.config', '', d)}"
Expand Down
Loading