[PATCH 3/5] nvmem: qfprom: Add the SM8350 keepout regions

From: Demeter Barna via B4 Relay

Date: Thu Nov 05 2026 - 09:17:49 EST


From: Demeter Barna <me@xxxxxxxxxxxxxxxxxxx>

Some SM8350 fuse ranges are protected by the XPU, so the AP cannot read
them: a read in 0x0-0x11f, 0x128-0x147, 0x640-0x8df or 0x2110-0x216f
resets the SoC. The nvmem file in sysfs is readable by every user, so
once the QFPROM is described, anyone who reads the whole file resets the
device.

Keep those regions out, as for SC7180 and SC7280, which share the
0x128-0x147 one; they read as zeros.

The regions were measured on a Razer Edge 5G one 32-bit word at a time,
and each boundary was checked from both sides.

Signed-off-by: Demeter Barna <me@xxxxxxxxxxxxxxxxxxx>
---
drivers/nvmem/qfprom.c | 13 +++++++++++++
1 file changed, 13 insertions(+)

diff --git a/drivers/nvmem/qfprom.c b/drivers/nvmem/qfprom.c
index 1de3435df..24958ed79 100644
--- a/drivers/nvmem/qfprom.c
+++ b/drivers/nvmem/qfprom.c
@@ -124,6 +124,18 @@ static const struct qfprom_soc_compatible_data sc7280_qfprom = {
.nkeepout = ARRAY_SIZE(sc7280_qfprom_keepout)
};

+static const struct nvmem_keepout sm8350_qfprom_keepout[] = {
+ {.start = 0x0, .end = 0x120},
+ {.start = 0x128, .end = 0x148},
+ {.start = 0x640, .end = 0x8e0},
+ {.start = 0x2110, .end = 0x2170}
+};
+
+static const struct qfprom_soc_compatible_data sm8350_qfprom = {
+ .keepout = sm8350_qfprom_keepout,
+ .nkeepout = ARRAY_SIZE(sm8350_qfprom_keepout)
+};
+
/**
* qfprom_disable_fuse_blowing() - Undo enabling of fuse blowing.
* @priv: Our driver data.
@@ -460,6 +472,7 @@ static const struct of_device_id qfprom_of_match[] = {
{ .compatible = "qcom,qfprom",},
{ .compatible = "qcom,sc7180-qfprom", .data = &sc7180_qfprom},
{ .compatible = "qcom,sc7280-qfprom", .data = &sc7280_qfprom},
+ { .compatible = "qcom,sm8350-qfprom", .data = &sm8350_qfprom},
{/* sentinel */},
};
MODULE_DEVICE_TABLE(of, qfprom_of_match);

--
2.53.0