kernel.git/drivers/soc/qcom/mdt_loader.c, branch linux-5.10.y

soc: qcom: mdt_loader: Deal with zero e_shentsize

2025-10-02T11:35:40Z

commit 25daf9af0ac1bf12490b723b5efaf8dcc85980bc upstream. Firmware that doesn't provide section headers leave both e_shentsize and e_shnum 0, which obvious isn't compatible with the newly introduced stricter checks. Make the section-related checks conditional on either of these values being non-zero. Fixes: 9f9967fed9d0 ("soc: qcom: mdt_loader: Ensure we don't read past the ELF header") Reported-by: Val Packett Closes: https://lore.kernel.org/all/ece307c3-7d65-440f-babd-88cf9705b908@packett.cool/ Reported-by: Neil Armstrong Closes: https://lore.kernel.org/all/aec9cd03-6fc2-4dc8-b937-8b7cf7bf4128@linaro.org/ Signed-off-by: Bjorn Andersson Fixes: 9f35ab0e53cc ("soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()") Tested-by: Neil Armstrong # on SM8650-QRD Reviewed-by: Dmitry Baryshkov Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250730-mdt-loader-shentsize-zero-v1-1-04f43186229c@oss.qualcomm.com Signed-off-by: Bjorn Andersson Cc: Yongqin Liu Signed-off-by: Greg Kroah-Hartman

soc: qcom: mdt_loader: Ensure we don't read past the ELF header

2025-08-28T14:22:56Z

[ Upstream commit 9f9967fed9d066ed3dae9372b45ffa4f6fccfeef ] When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid. Fixes: 2aad40d911ee ("remoteproc: Move qcom_mdt_loader into drivers/soc/qcom") Cc: stable@vger.kernel.org Reported-by: Doug Anderson Signed-off-by: Bjorn Andersson Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250610-mdt-loader-validation-and-fixes-v2-1-f7073e9ab899@oss.qualcomm.com Signed-off-by: Bjorn Andersson Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment

2021-10-13T08:04:25Z

[ Upstream commit 833d51d7c66d6708abbc02398892b96b950167b9 ] PT_LOAD type denotes that the segment should be loaded into the final firmware memory region. Hash segment is not one such, because it's only needed for PAS init and shouldn't be in the final firmware memory region. That's why mdt_phdr_valid() explicitly reject non PT_LOAD segment and hash segment. This actually makes the hash segment type check in qcom_mdt_read_metadata() unnecessary and redundant. For a hash segment, it won't be loaded into firmware memory region anyway, due to the QCOM_MDT_TYPE_HASH check in mdt_phdr_valid(), even if it has a PT_LOAD type for some reason (misusing or abusing?). Some firmware files on Sony phones are such examples, e.g WCNSS firmware of Sony Xperia M4 Aqua phone. The type of hash segment is just PT_LOAD. Drop the unnecessary hash segment type check in qcom_mdt_read_metadata() to fix firmware loading failure on these phones, while hash segment is still kept away from the final firmware memory region. Fixes: 498b98e93900 ("soc: qcom: mdt_loader: Support loading non-split images") Signed-off-by: Shawn Guo Reviewed-by: Marijn Suijten Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20210828070202.7033-1-shawn.guo@linaro.org Signed-off-by: Sasha Levin

soc: qcom: mdt_loader: Detect truncated read of segments

2021-05-14T07:50:16Z

[ Upstream commit 0648c55e3a21ccd816e99b6600d6199fbf39d23a ] Given that no validation of how much data the firmware loader read in for a given segment truncated segment files would best case result in a hash verification failure, without any indication of what went wrong. Improve this by validating that the firmware loader did return the amount of data requested. Fixes: 445c2410a449 ("soc: qcom: mdt_loader: Use request_firmware_into_buf()") Reviewed-by: Sibi Sankar Link: https://lore.kernel.org/r/20210107232526.716989-1-bjorn.andersson@linaro.org Signed-off-by: Bjorn Andersson Signed-off-by: Sasha Levin

soc: qcom: mdt_loader: Validate that p_filesz < p_memsz

2021-05-14T07:50:16Z

[ Upstream commit 84168d1b54e76a1bcb5192991adde5176abe02e3 ] The code validates that segments of p_memsz bytes of a segment will fit in the provided memory region, but does not validate that p_filesz bytes will, which means that an incorrectly crafted ELF header might write beyond the provided memory region. Fixes: 051fb70fd4ea ("remoteproc: qcom: Driver for the self-authenticating Hexagon v5") Reviewed-by: Sibi Sankar Link: https://lore.kernel.org/r/20210107233119.717173-1-bjorn.andersson@linaro.org Signed-off-by: Bjorn Andersson Signed-off-by: Sasha Levin

Merge tag 'rproc-v5.3' of git://github.com/andersson/remoteproc

2019-07-17T18:44:41Z

Pull remoteproc updates from Bjorn Andersson: "This adds support for the STM32 remoteproc, additional i.MX platforms with Cortex M4 remoteprocs and Qualcomm's QCS404 Compute DSP. Also initial support for vendor specific resource table entries and support for unprocessed Qualcomm firmware files" * tag 'rproc-v5.3' of git://github.com/andersson/remoteproc: remoteproc: stm32: fix building without ARM SMCC remoteproc: qcom: q6v5-mss: Fix build error without QCOM_MDT_LOADER remoteproc: copy parent dma_pfn_offset for vdev remoteproc: qcom: q6v5-mss: Support loading non-split images soc: qcom: mdt_loader: Support loading non-split images remoteproc: stm32: add an ST stm32_rproc driver dt-bindings: remoteproc: add bindings for stm32 remote processor driver dt-bindings: stm32: add bindings for ML-AHB interconnect remoteproc: Use struct_size() helper remoteproc: add vendor resources handling remoteproc: imx: Fix typo in "failed" remoteproc: imx: Broaden the Kconfig selection logic remoteproc,rpmsg: add missing MAINTAINERS file entries remoteproc: qcom: qdsp6-adsp: Add support for QCS404 CDSP dt-bindings: remoteproc: Rename and amend Hexagon v56 binding

soc: qcom: mdt_loader: Support loading non-split images

2019-07-02T02:02:28Z

In some software releases the firmware images are not split up with each loadable segment in it's own file. Check the size of the loaded firmware to see if it still contains each segment to be loaded, before falling back to the split-out segments. Acked-by: Andy Gross Reviewed-by: Jeffrey Hugo Signed-off-by: Bjorn Andersson

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174

2019-05-30T18:26:41Z

Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license version 2 as published by the free software foundation this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details extracted by the scancode license scanner the SPDX license identifier GPL-2.0-only has been chosen to replace the boilerplate/reference in 655 file(s). Signed-off-by: Thomas Gleixner Reviewed-by: Allison Randal Reviewed-by: Kate Stewart Reviewed-by: Richard Fontana Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190527070034.575739538@linutronix.de Signed-off-by: Greg Kroah-Hartman

remoteproc: qcom: mdt_loader: Make the firmware authentication optional

2018-06-18T22:55:31Z

qcom_mdt_load function loads the mdt type firmware and initialises the secure memory as well. Make the initialisation only when requested by the caller, so that the function can be used by self-authenticating remoteproc as well. Acked-by: Andy Gross Signed-off-by: Sricharan R Signed-off-by: Bjorn Andersson

treewide: use PHYS_ADDR_MAX to avoid type casting ULLONG_MAX

2018-06-14T22:55:25Z

With PHYS_ADDR_MAX there is now a type safe variant for all bits set. Make use of it. Patch created using a semantic patch as follows: // @@ typedef phys_addr_t; @@ -(phys_addr_t)ULLONG_MAX +PHYS_ADDR_MAX // Link: http://lkml.kernel.org/r/20180419214204.19322-1-stefan@agner.ch Signed-off-by: Stefan Agner Reviewed-by: Andrew Morton Acked-by: Ard Biesheuvel Acked-by: Catalin Marinas [arm64] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds