| Message ID | 20230306231202.12223-5-quic_molvera@quicinc.com |
|---|---|
| State | New |
| Headers | show |
| Series | remoteproc: qcom_q6v5_pas: Add support for QDU1000/QRU1000 mpss | expand |
Hi Melody,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on dc837c1a5137a8cf2e9432c1891392b6a66f4d8d]
url: https://github.com/intel-lab-lkp/linux/commits/Melody-Olvera/dt-bindings-firmware-qcom-scm-Update-QDU1000-QRU1000-compatible/20230307-071438
base: dc837c1a5137a8cf2e9432c1891392b6a66f4d8d
patch link: https://lore.kernel.org/r/20230306231202.12223-5-quic_molvera%40quicinc.com
patch subject: [PATCH v2 4/7] soc: qcom: mdt_loader: Enhance split binary detection
config: arm-allmodconfig (https://download.01.org/0day-ci/archive/20230308/202303081259.uohZV4ZE-lkp@intel.com/config)
compiler: arm-linux-gnueabi-gcc (GCC) 12.1.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/3964310160b68a6246f85828ecbcebf1fb9137a7
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Melody-Olvera/dt-bindings-firmware-qcom-scm-Update-QDU1000-QRU1000-compatible/20230307-071438
git checkout 3964310160b68a6246f85828ecbcebf1fb9137a7
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=arm olddefconfig
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=arm SHELL=/bin/bash drivers/soc/qcom/
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
| Link: https://lore.kernel.org/oe-kbuild-all/202303081259.uohZV4ZE-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/soc/qcom/mdt_loader.c: In function 'qcom_mdt_read_metadata':
>> drivers/soc/qcom/mdt_loader.c:156:17: warning: variable 'ret' set but not used [-Wunused-but-set-variable]
156 | ssize_t ret;
| ^~~
vim +/ret +156 drivers/soc/qcom/mdt_loader.c
051fb70fd4ea40f drivers/remoteproc/qcom_mdt_loader.c Bjorn Andersson 2016-06-20 126
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 127 /**
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 128 * qcom_mdt_read_metadata() - read header and metadata from mdt or mbn
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 129 * @fw: firmware of mdt header or mbn
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 130 * @data_len: length of the read metadata blob
d11a34a404ee556 drivers/soc/qcom/mdt_loader.c Krzysztof Kozlowski 2022-05-19 131 * @fw_name: name of the firmware, for construction of segment file names
d11a34a404ee556 drivers/soc/qcom/mdt_loader.c Krzysztof Kozlowski 2022-05-19 132 * @dev: device handle to associate resources with
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 133 *
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 134 * The mechanism that performs the authentication of the loading firmware
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 135 * expects an ELF header directly followed by the segment of hashes, with no
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 136 * padding inbetween. This function allocates a chunk of memory for this pair
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 137 * and copy the two pieces into the buffer.
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 138 *
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 139 * In the case of split firmware the hash is found directly following the ELF
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 140 * header, rather than at p_offset described by the second program header.
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 141 *
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 142 * The caller is responsible to free (kfree()) the returned pointer.
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 143 *
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 144 * Return: pointer to data, or ERR_PTR()
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 145 */
8bd42e2341a7857 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 146 void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len,
8bd42e2341a7857 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 147 const char *fw_name, struct device *dev)
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 148 {
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 149 const struct elf32_phdr *phdrs;
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 150 const struct elf32_hdr *ehdr;
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 151 unsigned int hash_segment = 0;
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 152 size_t hash_offset;
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 153 size_t hash_size;
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 154 size_t ehdr_size;
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 155 unsigned int i;
8bd42e2341a7857 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 @156 ssize_t ret;
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 157 void *data;
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 158
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 159 ehdr = (struct elf32_hdr *)fw->data;
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 160 phdrs = (struct elf32_phdr *)(ehdr + 1);
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 161
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 162 if (ehdr->e_phnum < 2)
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 163 return ERR_PTR(-EINVAL);
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 164
833d51d7c66d670 drivers/soc/qcom/mdt_loader.c Shawn Guo 2021-08-28 165 if (phdrs[0].p_type == PT_LOAD)
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 166 return ERR_PTR(-EINVAL);
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 167
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 168 for (i = 1; i < ehdr->e_phnum; i++) {
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 169 if ((phdrs[i].p_flags & QCOM_MDT_TYPE_MASK) == QCOM_MDT_TYPE_HASH) {
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 170 hash_segment = i;
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 171 break;
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 172 }
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 173 }
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 174
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 175 if (!hash_segment) {
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 176 dev_err(dev, "no hash segment found in %s\n", fw_name);
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 177 return ERR_PTR(-EINVAL);
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 178 }
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 179
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 180 ehdr_size = phdrs[0].p_filesz;
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 181 hash_size = phdrs[hash_segment].p_filesz;
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 182
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 183 data = kmalloc(ehdr_size + hash_size, GFP_KERNEL);
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 184 if (!data)
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 185 return ERR_PTR(-ENOMEM);
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 186
8bd42e2341a7857 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 187 /* Copy ELF header */
8bd42e2341a7857 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 188 memcpy(data, fw->data, ehdr_size);
8bd42e2341a7857 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 189
3964310160b68a6 drivers/soc/qcom/mdt_loader.c Gokul Krishna Krishnakumar 2023-03-06 190
3964310160b68a6 drivers/soc/qcom/mdt_loader.c Gokul Krishna Krishnakumar 2023-03-06 191 if (qcom_mdt_bins_are_split(fw)) {
3964310160b68a6 drivers/soc/qcom/mdt_loader.c Gokul Krishna Krishnakumar 2023-03-06 192 ret = mdt_load_split_segment(data + ehdr_size, phdrs, hash_segment, fw_name, dev);
3964310160b68a6 drivers/soc/qcom/mdt_loader.c Gokul Krishna Krishnakumar 2023-03-06 193 } else {
64fb5eb87d5815f drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 194 hash_offset = phdrs[hash_segment].p_offset;
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 195 memcpy(data + ehdr_size, fw->data + hash_offset, hash_size);
8bd42e2341a7857 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2022-01-27 196 }
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 197 *data_len = ehdr_size + hash_size;
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 198
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 199 return data;
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 200 }
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 201 EXPORT_SYMBOL_GPL(qcom_mdt_read_metadata);
498b98e939007f8 drivers/soc/qcom/mdt_loader.c Bjorn Andersson 2019-06-21 202
On Mon, Mar 06, 2023 at 03:11:59PM -0800, Melody Olvera wrote: > From: Gokul Krishna Krishnakumar <quic_gokukris@quicinc.com> > > When booting with split binaries, it may be that the offset of the first > program header lies inside the mdt's filesize, in this case the loader > would incorrectly assume that the bins were not split. The loading would > then continue on and fail for split bins. Can you please be more explicit about the scenario you're having problems with? Is the problem that the first segment is represented in both the .mdt and .b01, but different? Or is it that you find the hash in both .mdt abd .b01, but only one of them is valid? > This change updates the logic used > by the mdt loader to understand whether the firmware images are split or not > by checking if each programs header's segment lies within the file or not. > > Signed-off-by: Gokul Krishna Krishnakumar <quic_gokukris@quicinc.com> > Signed-off-by: Melody Olvera <quic_molvera@quicinc.com> > --- > drivers/soc/qcom/mdt_loader.c | 64 +++++++++++++++++++---------------- > 1 file changed, 35 insertions(+), 29 deletions(-) > > diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c > index 33dd8c315eb7..3aadce299c02 100644 > --- a/drivers/soc/qcom/mdt_loader.c > +++ b/drivers/soc/qcom/mdt_loader.c > @@ -31,6 +31,26 @@ static bool mdt_phdr_valid(const struct elf32_phdr *phdr) > return true; > } > > +static bool qcom_mdt_bins_are_split(const struct firmware *fw) > +{ > + const struct elf32_phdr *phdrs; > + const struct elf32_hdr *ehdr; > + uint64_t seg_start, seg_end; > + int i; > + > + ehdr = (struct elf32_hdr *)fw->data; > + phdrs = (struct elf32_phdr *)(ehdr + 1); > + > + for (i = 0; i < ehdr->e_phnum; i++) { > + seg_start = phdrs[i].p_offset; > + seg_end = phdrs[i].p_offset + phdrs[i].p_filesz; > + if (seg_start > fw->size || seg_end > fw->size) > + return true; > + } > + > + return false; > +} > + > static ssize_t mdt_load_split_segment(void *ptr, const struct elf32_phdr *phdrs, > unsigned int segment, const char *fw_name, > struct device *dev) > @@ -167,23 +187,13 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len, > /* Copy ELF header */ > memcpy(data, fw->data, ehdr_size); > The existing code handles 3 cases: > - if (ehdr_size + hash_size == fw->size) { 1) File is split, but hash resides with the ELF header in the .mdt > - /* Firmware is split and hash is packed following the ELF header */ > - hash_offset = phdrs[0].p_filesz; > - memcpy(data + ehdr_size, fw->data + hash_offset, hash_size); > - } else if (phdrs[hash_segment].p_offset + hash_size <= fw->size) { 2) The hash segment exists in a segment of its own, but in the loaded image. > - /* Hash is in its own segment, but within the loaded file */ > + > + if (qcom_mdt_bins_are_split(fw)) { > + ret = mdt_load_split_segment(data + ehdr_size, phdrs, hash_segment, fw_name, dev); > + } else { > hash_offset = phdrs[hash_segment].p_offset; > memcpy(data + ehdr_size, fw->data + hash_offset, hash_size); > - } else { 3) The image is split, and the hash segment resides in it's own file. Afaict the updated logic maintains #2 and #3, but drops #1. Please review the git history to see if you can determine which target this case exists with - and ask for someone to specifically verify your change there. Perhaps all your change is doing is removing case #1, in which case this should be clear in the commit message; and we need to validate that your new assumptions holds. > - /* Hash is in its own segment, beyond the loaded file */ > - ret = mdt_load_split_segment(data + ehdr_size, phdrs, hash_segment, fw_name, dev); For some reason you reversed the condition and got this out of the else (seems like an unnecessary change)...but in the process you lost the error handling below. > - if (ret) { > - kfree(data); > - return ERR_PTR(ret); > - } > } > - > *data_len = ehdr_size + hash_size; > > return data; > @@ -270,6 +280,7 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, > phys_addr_t min_addr = PHYS_ADDR_MAX; > ssize_t offset; > bool relocate = false; > + bool is_split; > void *ptr; > int ret = 0; > int i; > @@ -277,6 +288,7 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, > if (!fw || !mem_region || !mem_phys || !mem_size) > return -EINVAL; > > + is_split = qcom_mdt_bins_are_split(fw); > ehdr = (struct elf32_hdr *)fw->data; > phdrs = (struct elf32_phdr *)(ehdr + 1); > > @@ -330,22 +342,16 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, > > ptr = mem_region + offset; > > - if (phdr->p_filesz && phdr->p_offset < fw->size && > - phdr->p_offset + phdr->p_filesz <= fw->size) { > - /* Firmware is large enough to be non-split */ > - if (phdr->p_offset + phdr->p_filesz > fw->size) { > - dev_err(dev, "file %s segment %d would be truncated\n", > - fw_name, i); > - ret = -EINVAL; > - break; > + if (phdr->p_filesz) { If you just change the condition (phr->p_filesz && !issplit), then your patch becomes easier to read. Regards, Bjorn > + if (!is_split) { > + /* Firmware is large enough to be non-split */ > + memcpy(ptr, fw->data + phdr->p_offset, phdr->p_filesz); > + } else { > + /* Firmware not large enough, load split-out segments */ > + ret = mdt_load_split_segment(ptr, phdrs, i, fw_name, dev); > + if (ret) > + break; > } > - > - memcpy(ptr, fw->data + phdr->p_offset, phdr->p_filesz); > - } else if (phdr->p_filesz) { > - /* Firmware not large enough, load split-out segments */ > - ret = mdt_load_split_segment(ptr, phdrs, i, fw_name, dev); > - if (ret) > - break; > } > > if (phdr->p_memsz > phdr->p_filesz) > -- > 2.25.1 >
Thanks Bjorn for the review comments. On 3/15/2023 7:12 PM, Bjorn Andersson wrote: > On Mon, Mar 06, 2023 at 03:11:59PM -0800, Melody Olvera wrote: >> From: Gokul Krishna Krishnakumar <quic_gokukris@quicinc.com> >> >> When booting with split binaries, it may be that the offset of the first >> program header lies inside the mdt's filesize, in this case the loader >> would incorrectly assume that the bins were not split. The loading would >> then continue on and fail for split bins. > > Can you please be more explicit about the scenario you're having > problems with? > In this scenario below, the first pheader end address is < mdt file size but the next pheader lies outside the mdt file size. The _qcom_mdt_load() would continue on to load the firmware as a single image which leads to load error. By checking if all the pheaders lie inside the file size, we will be able to fix this issue. fw = cdsp_dtb.mdt phdr->p_filesz = 148 phdr->p_offset 0 fw->size 4044 fw = cdsp_dtb.mdt phdr->p_filesz = 512 phdr->p_offset 148 fw->size 4044 fw = cdsp_dtb.mdt phdr->p_filesz = 3896 phdr->p_offset 4096 fw->size 4044 > Is the problem that the first segment is represented in both the .mdt > and .b01, but different? Or is it that you find the hash in both .mdt > abd .b01, but only one of them is valid? > >> This change updates the logic used >> by the mdt loader to understand whether the firmware images are split or not >> by checking if each programs header's segment lies within the file or not. >> >> Signed-off-by: Gokul Krishna Krishnakumar <quic_gokukris@quicinc.com> >> Signed-off-by: Melody Olvera <quic_molvera@quicinc.com> >> --- >> drivers/soc/qcom/mdt_loader.c | 64 +++++++++++++++++++---------------- >> 1 file changed, 35 insertions(+), 29 deletions(-) >> >> diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c >> index 33dd8c315eb7..3aadce299c02 100644 >> --- a/drivers/soc/qcom/mdt_loader.c >> +++ b/drivers/soc/qcom/mdt_loader.c >> @@ -31,6 +31,26 @@ static bool mdt_phdr_valid(const struct elf32_phdr *phdr) >> return true; >> } >> >> +static bool qcom_mdt_bins_are_split(const struct firmware *fw) >> +{ >> + const struct elf32_phdr *phdrs; >> + const struct elf32_hdr *ehdr; >> + uint64_t seg_start, seg_end; >> + int i; >> + >> + ehdr = (struct elf32_hdr *)fw->data; >> + phdrs = (struct elf32_phdr *)(ehdr + 1); >> + >> + for (i = 0; i < ehdr->e_phnum; i++) { >> + seg_start = phdrs[i].p_offset; >> + seg_end = phdrs[i].p_offset + phdrs[i].p_filesz; >> + if (seg_start > fw->size || seg_end > fw->size) >> + return true; >> + } >> + >> + return false; >> +} >> + >> static ssize_t mdt_load_split_segment(void *ptr, const struct elf32_phdr *phdrs, >> unsigned int segment, const char *fw_name, >> struct device *dev) >> @@ -167,23 +187,13 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len, >> /* Copy ELF header */ >> memcpy(data, fw->data, ehdr_size); >> > > The existing code handles 3 cases: > >> - if (ehdr_size + hash_size == fw->size) { > > 1) File is split, but hash resides with the ELF header in the .mdt > >> - /* Firmware is split and hash is packed following the ELF header */ >> - hash_offset = phdrs[0].p_filesz; >> - memcpy(data + ehdr_size, fw->data + hash_offset, hash_size); >> - } else if (phdrs[hash_segment].p_offset + hash_size <= fw->size) { > > 2) The hash segment exists in a segment of its own, but in the loaded > image. > >> - /* Hash is in its own segment, but within the loaded file */ >> + >> + if (qcom_mdt_bins_are_split(fw)) { >> + ret = mdt_load_split_segment(data + ehdr_size, phdrs, hash_segment, fw_name, dev); >> + } else { >> hash_offset = phdrs[hash_segment].p_offset; >> memcpy(data + ehdr_size, fw->data + hash_offset, hash_size); >> - } else { > > 3) The image is split, and the hash segment resides in it's own file. > > > Afaict the updated logic maintains #2 and #3, but drops #1. Please > review the git history to see if you can determine which target this > case exists with - and ask for someone to specifically verify your > change there. > > Perhaps all your change is doing is removing case #1, in which case this > should be clear in the commit message; and we need to validate that your > new assumptions holds. > >> - /* Hash is in its own segment, beyond the loaded file */ >> - ret = mdt_load_split_segment(data + ehdr_size, phdrs, hash_segment, fw_name, dev); > > For some reason you reversed the condition and got this out of the else > (seems like an unnecessary change)...but in the process you lost the > error handling below. > Yes, Updating the patch to remove this unnecessary change in the qcom_mdt_read_metadat(). >> - if (ret) { >> - kfree(data); >> - return ERR_PTR(ret); >> - } >> } >> - >> *data_len = ehdr_size + hash_size; >> >> return data; >> @@ -270,6 +280,7 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, >> phys_addr_t min_addr = PHYS_ADDR_MAX; >> ssize_t offset; >> bool relocate = false; >> + bool is_split; >> void *ptr; >> int ret = 0; >> int i; >> @@ -277,6 +288,7 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, >> if (!fw || !mem_region || !mem_phys || !mem_size) >> return -EINVAL; >> >> + is_split = qcom_mdt_bins_are_split(fw); >> ehdr = (struct elf32_hdr *)fw->data; >> phdrs = (struct elf32_phdr *)(ehdr + 1); >> >> @@ -330,22 +342,16 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, >> >> ptr = mem_region + offset; >> >> - if (phdr->p_filesz && phdr->p_offset < fw->size && >> - phdr->p_offset + phdr->p_filesz <= fw->size) { >> - /* Firmware is large enough to be non-split */ >> - if (phdr->p_offset + phdr->p_filesz > fw->size) { >> - dev_err(dev, "file %s segment %d would be truncated\n", >> - fw_name, i); >> - ret = -EINVAL; >> - break; >> + if (phdr->p_filesz) { > > If you just change the condition (phr->p_filesz && !issplit), then your > patch becomes easier to read. > Done. V3: only make change in the __qcom_mdt_load() and not in the qcom_mdt_read_metadata(). > Regards, > Bjorn > >> + if (!is_split) { >> + /* Firmware is large enough to be non-split */ >> + memcpy(ptr, fw->data + phdr->p_offset, phdr->p_filesz); >> + } else { >> + /* Firmware not large enough, load split-out segments */ >> + ret = mdt_load_split_segment(ptr, phdrs, i, fw_name, dev); >> + if (ret) >> + break; >> } >> - >> - memcpy(ptr, fw->data + phdr->p_offset, phdr->p_filesz); >> - } else if (phdr->p_filesz) { >> - /* Firmware not large enough, load split-out segments */ >> - ret = mdt_load_split_segment(ptr, phdrs, i, fw_name, dev); >> - if (ret) >> - break; >> } >> >> if (phdr->p_memsz > phdr->p_filesz) >> -- >> 2.25.1 >> Thanks, Gokul
diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c index 33dd8c315eb7..3aadce299c02 100644 --- a/drivers/soc/qcom/mdt_loader.c +++ b/drivers/soc/qcom/mdt_loader.c @@ -31,6 +31,26 @@ static bool mdt_phdr_valid(const struct elf32_phdr *phdr) return true; } +static bool qcom_mdt_bins_are_split(const struct firmware *fw) +{ + const struct elf32_phdr *phdrs; + const struct elf32_hdr *ehdr; + uint64_t seg_start, seg_end; + int i; + + ehdr = (struct elf32_hdr *)fw->data; + phdrs = (struct elf32_phdr *)(ehdr + 1); + + for (i = 0; i < ehdr->e_phnum; i++) { + seg_start = phdrs[i].p_offset; + seg_end = phdrs[i].p_offset + phdrs[i].p_filesz; + if (seg_start > fw->size || seg_end > fw->size) + return true; + } + + return false; +} + static ssize_t mdt_load_split_segment(void *ptr, const struct elf32_phdr *phdrs, unsigned int segment, const char *fw_name, struct device *dev) @@ -167,23 +187,13 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len, /* Copy ELF header */ memcpy(data, fw->data, ehdr_size); - if (ehdr_size + hash_size == fw->size) { - /* Firmware is split and hash is packed following the ELF header */ - hash_offset = phdrs[0].p_filesz; - memcpy(data + ehdr_size, fw->data + hash_offset, hash_size); - } else if (phdrs[hash_segment].p_offset + hash_size <= fw->size) { - /* Hash is in its own segment, but within the loaded file */ + + if (qcom_mdt_bins_are_split(fw)) { + ret = mdt_load_split_segment(data + ehdr_size, phdrs, hash_segment, fw_name, dev); + } else { hash_offset = phdrs[hash_segment].p_offset; memcpy(data + ehdr_size, fw->data + hash_offset, hash_size); - } else { - /* Hash is in its own segment, beyond the loaded file */ - ret = mdt_load_split_segment(data + ehdr_size, phdrs, hash_segment, fw_name, dev); - if (ret) { - kfree(data); - return ERR_PTR(ret); - } } - *data_len = ehdr_size + hash_size; return data; @@ -270,6 +280,7 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, phys_addr_t min_addr = PHYS_ADDR_MAX; ssize_t offset; bool relocate = false; + bool is_split; void *ptr; int ret = 0; int i; @@ -277,6 +288,7 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, if (!fw || !mem_region || !mem_phys || !mem_size) return -EINVAL; + is_split = qcom_mdt_bins_are_split(fw); ehdr = (struct elf32_hdr *)fw->data; phdrs = (struct elf32_phdr *)(ehdr + 1); @@ -330,22 +342,16 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, ptr = mem_region + offset; - if (phdr->p_filesz && phdr->p_offset < fw->size && - phdr->p_offset + phdr->p_filesz <= fw->size) { - /* Firmware is large enough to be non-split */ - if (phdr->p_offset + phdr->p_filesz > fw->size) { - dev_err(dev, "file %s segment %d would be truncated\n", - fw_name, i); - ret = -EINVAL; - break; + if (phdr->p_filesz) { + if (!is_split) { + /* Firmware is large enough to be non-split */ + memcpy(ptr, fw->data + phdr->p_offset, phdr->p_filesz); + } else { + /* Firmware not large enough, load split-out segments */ + ret = mdt_load_split_segment(ptr, phdrs, i, fw_name, dev); + if (ret) + break; } - - memcpy(ptr, fw->data + phdr->p_offset, phdr->p_filesz); - } else if (phdr->p_filesz) { - /* Firmware not large enough, load split-out segments */ - ret = mdt_load_split_segment(ptr, phdrs, i, fw_name, dev); - if (ret) - break; } if (phdr->p_memsz > phdr->p_filesz)