From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D6DC357A4A for ; Thu, 20 Aug 2026 14:31:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787236303; cv=none; b=AGyUCBIkZQOp+y5X+NWX3LAnT22IPSb2IusIKRVidi3p2i/odHax8YdTQxmh+LhM3qkK4phfT74T5iMEARJRhi9GKL8WH0XdMHgXfIInP+Qf4071bUBVbV0bWizpj3Ip6GCEYQaC/5qyE3TAgPnObjOFvrlo21VqBeY9s1nVHlQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787236303; c=relaxed/simple; bh=cfnpr8w4exTVb7D4hekpomYCJ2mAqjyh/p6qZiUEzJk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=pvBMWK9CoYS9F3RJ1Xt+fVtUEZCPXwjVsMr7AaoW7XXMbqTHBH1S962NYxXUixs9EixFlulAY1G8uuL3+g6hWeepDzKMEADmyObNGMHpYgE9Ld4TiAImiKOaBk9ULRS3/AzW3dOhe/ZO4CmfVrFw8D1MRdxEmIVTQp0D8nMBA3o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=gZjXr0lu; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=K1zRdT39; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="gZjXr0lu"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="K1zRdT39" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67KE7d6C3987799 for ; Thu, 20 Aug 2026 14:31:37 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= MRJrBAJIIuvN/ZSCg19dnsWny7L4+vdYdyZCNWvV5qU=; b=gZjXr0lunuQ3G0Un V34M68L6shV/oh76Vo4becosqxZMKqBsDbNsle1cgVMtn/TvwF3djcY2BhTsU9+h 5KsedT2LHIvaZIs1qoKaNBfw2ET2usGHY5Y6JLHj0itUgF0W++QznRBK7e8kbU/j ezf89oWm2fj40AvxJoIUWfsFvziJ3Wm7FRRb5ZShbPsuAICND+l0rhFNRjZ4G1dc TsS/RgjJsJ8QxU04oF3APR6nsFijbHFsZBogtpKT1bEPiwMyms213KbiLsBEP2kr GJtaus0AzFv8MWKc+bzm+5dwg2s/5qaOOqfniQkiRzKW7xQEW4mO1aSiJTM4wo/Q xXOH3A== Received: from mail-qk1-f198.google.com (mail-qk1-f198.google.com [209.85.222.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4g5yg8927s-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 20 Aug 2026 14:31:37 +0000 (GMT) Received: by mail-qk1-f198.google.com with SMTP id af79cd13be357-934963b2bc0so243882685a.3 for ; Thu, 20 Aug 2026 07:31:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1787236296; x=1787841096; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MRJrBAJIIuvN/ZSCg19dnsWny7L4+vdYdyZCNWvV5qU=; b=K1zRdT39nAGSJLbsCxjyKefv937a6/3K1hNaLMmdOqjcG6zLQXbDmR4ayzFDPMxhay 0emsQ+d6qQdQlRTPKunloDEtjU/A4ASZQO0DBavE8g1z5KAEEpxoD6MxjxCqseWMkDu+ xht56Oi4pzqIKJkNL3vzg+i8x3pe+6HpvUU5gD67mT4P4nE0LXY6bvdOr/YYQOJjHdGj 2pdOHlKr8i+v89EFnRf6dyKl04cmp6NvJgRsy9hllRq7t/BeEWLH/cXQChnP8NvY4KTn 1JRBPsu7k6Z5G2Dk0QKqVa8nMdpMh+n9af7C2SBTkPfrfbc1k6yBUtQ7T+FrJWqa6nqk C9FA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787236296; x=1787841096; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=MRJrBAJIIuvN/ZSCg19dnsWny7L4+vdYdyZCNWvV5qU=; b=c7NApTrVSqSG0Z5vI7iY+X4CFjKNwraMqJwe4KSyb9P60Y4JB4zz7WXDOkhJT4D+83 bwKpObqDTgas+UeJ0B45aRfLIVowkrCrhWrGUVDyJJzbKoGLdqk27oyYXqTL8JWBgUzM H/ENUXI8nY6sUIMIJtP6rZ7kfUoaN8I7cr+2Kxz2pzSj+9aiksFbgKYPf2YXb82nn8Hw Dw6XrRj5tj3EXxXfxO1Ud+M3hKHRRuaeUzLrjdlALEkvf8F8yC6EWxWKgbXlJSoD4SNJ yVSex4vJoBV3tT2E5Jd7MjgjfZ7Dt5rbDBolnjgK3284yP0MVAn/O81oROd60RRoRtJl c9AQ== X-Forwarded-Encrypted: i=1; AHgh+Rq4buAx79oim2SDsAx2SPZNrq2Gpww46JfcIYKf/m1PP1eCRwPQDp2Amw4UH3EX4u4ZAhgCBiZiT/ExCgo=@vger.kernel.org X-Gm-Message-State: AOJu0YwQYWn8voKwkF3jgrU0NY/i6WtU5srDwIndLUzXaaL5LuNXkzs9 uKkJqxNIQmcygphYaDzEn1PA9i7wah79jBqpR37MBJfU56U8/jsGPUwfBtafJ88a275Su3A5NVs CmMFSOo+cs/rjEJb9uO/ydWrPdgcaRbqz3Yjf5vnp/snWRlBTWVdCBhaHEAf2xQ8OIrck7SmaEk I= X-Gm-Gg: AR+sD11vjIKytra8n0OpKQlAy2dVPeojMEGacLz0aK7Gg2NO/BxZHkyygmCxhnFnAJ0 UpdsQIPNECV7kuhDg34+IUkgxIbu/sFsSNFq8SSHz0Q1lX9BjYNkQmi3U/T0enA923vA3rKsZCB ioRXBtCtmi3EiSv3TdItZ193ZUawHQDtSrfaF0oBPpKAYUKKn2+VZ4Y64VGIXYoisUgyR1TF5uw qVcaO1yWjaddkCXWRcfWhK7+Dnvjtrf4bv5A65Uoa5On526B2L35C+xuqYyc/08vY6ASB7dxRdS gebtaaGRB6BBqJOj/XplGP0bTKONj7rBb7ENvBQGyGF6gvq37f88F5tv2WHRHYSfPmkiDqkV+pf 4natZ6LH3ayR08jTz0TCuu+7e2aBE7B2/tdc+ X-Received: by 2002:a05:620a:44d3:b0:932:df51:5172 with SMTP id af79cd13be357-9371e677565mr1114593585a.42.1787236296374; Thu, 20 Aug 2026 07:31:36 -0700 (PDT) X-Received: by 2002:a05:620a:44d3:b0:932:df51:5172 with SMTP id af79cd13be357-9371e677565mr1114587685a.42.1787236295917; Thu, 20 Aug 2026 07:31:35 -0700 (PDT) Received: from hu-vdadhani-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b145c9d7sm15226618f8f.15.2026.08.20.07.31.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Aug 2026 07:31:34 -0700 (PDT) From: Viken Dadhaniya Date: Thu, 20 Aug 2026 20:01:01 +0530 Subject: [PATCH v2 4/4] soc: qcom: geni-se: Fix write to read-only firmware buffer Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260820-fix-write-to-read-only-firmware-buffer-v2-4-7badcdc455fe@oss.qualcomm.com> References: <20260820-fix-write-to-read-only-firmware-buffer-v2-0-7badcdc455fe@oss.qualcomm.com> In-Reply-To: <20260820-fix-write-to-read-only-firmware-buffer-v2-0-7badcdc455fe@oss.qualcomm.com> To: Bjorn Andersson , Konrad Dybcio , Viken Dadhaniya , Mukesh Kumar Savaliya Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1787236268; l=3738; i=viken.dadhaniya@oss.qualcomm.com; s=20260324; h=from:subject:message-id; bh=cfnpr8w4exTVb7D4hekpomYCJ2mAqjyh/p6qZiUEzJk=; b=KyncpvB/PyPrsZZTl1Cr+9096Z5a+RG7GUCCaD7GOs/CpdDTqqm/8/xeLfGtM95LL4CYCFGWU +XtcYWN3GSBDeSU3Nvuzj23sIFdhIxbDthGUJAqudI+DFaQrgRQsBho X-Developer-Key: i=viken.dadhaniya@oss.qualcomm.com; a=ed25519; pk=C39f+LOIGhh/02LQpT46TsUSXRvBn9qXC8Xb26KJ44Y= X-Proofpoint-Spam-Info: AW1haW4tMjYwODIwMDEwOSBTYWx0ZWRfX6LNIRuJIbeWr KiulnC0qvR19jgv6qGpEiCaXhxXHnHtSGRt8F0LD9+Ofjwj95lH3+pF0zihSQuPogrKOYQRC6BU tM+OrioofTGg9l1UQirxWdPoDiVFd8o= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODIwMDEwOSBTYWx0ZWRfXyMaDZbUEB9fj uV33VdaBfV7os3KBuFB2zaWTlKz+wHjkFIU3Rpf6Ghm/Wb8pzCHZ3m91Lnoaj68zZJAaKYzNcOx VpHzKhuMn08T3ZKHs3ycvCg1Otg7eRG4TPkQt7XsZBjk5mIXUbNLWgpuk8EywoTVqxFSPg9K8G3 jLHj2CnOlVDZ5LAjUAYkhyQcDDsSbRr9BO9k3EFD55KLCXvw7Hn6oaUI6HZNalAV/Bk0ACA8kBj uMHuetJBkZrFddxHkz69791uwyhDAGvdbIMInY755Xyjr/pvu2abOgjYpR3zc9qkloTeRw2aX8P NSPJLT2fXNH4kweWxx14WVM11vPgXKioAd4JCbfsI8kyc8QrBDGrGBIWMgzmOLjrlSuIdRorY11 6H3guenGRRFscvS2/yjWyGgU8Dv6rmUEdcvSoMokUH+TZPvhmHqeXXzz9iBFc6O1dCZC1nMs7aC AULwxV51i9CC310R5iQ== X-Authority-Analysis: v=2.4 cv=Y7/IdBeN c=1 sm=1 tr=0 ts=6a870fc9 cx=c_pps a=qKBjSQ1v91RyAK45QCPf5w==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=IkcTkHD0fZMA:10 a=Sv0fKeRqtYgA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=jfHSOdyuYKquJek64F8A:9 a=QEXdDO2ut3YA:10 a=NFOGd7dJGGMPyQGDc5-O:22 X-Proofpoint-GUID: X1JVFyc2rg3CElz42rEIcXcDAiAmkwUY X-Proofpoint-ORIG-GUID: X1JVFyc2rg3CElz42rEIcXcDAiAmkwUY X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-19_06,2026-08-20_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 bulkscore=0 priorityscore=1501 malwarescore=0 adultscore=0 clxscore=1015 phishscore=0 impostorscore=0 lowpriorityscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608200109 geni_find_protocol_fw() casts fw->data to a non-const struct se_fw_hdr pointer and writes back the rounded-up fw_size value: sefw->fw_size_in_items = cpu_to_le16(fw_size); The firmware subsystem maps the firmware blob read-only. Writing through the cast pointer causes a level-3 permission fault on AArch64 and crashes the kernel during driver probe. The write-back is no longer necessary: the previous commit propagates the rounded size to the caller via fw_size_out. Remove the write-back and make sefw (and the hdr pointer in the caller) const-correct. Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem") Cc: stable@vger.kernel.org Signed-off-by: Viken Dadhaniya --- drivers/soc/qcom/qcom-geni-se.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c index 11ca8223fbcd..6ac2bdc16984 100644 --- a/drivers/soc/qcom/qcom-geni-se.c +++ b/drivers/soc/qcom/qcom-geni-se.c @@ -1238,17 +1238,17 @@ EXPORT_SYMBOL_GPL(geni_se_resources_init); * controller. Validates the firmware size against the hardware PROG_RAM_DEPTH * read from SE_HW_PARAM_2. * - * Return: pointer to a valid 'struct se_fw_hdr' if found, or NULL otherwise. + * Return: pointer to a valid 'const struct se_fw_hdr' if found, or NULL otherwise. */ -static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw, - enum geni_se_protocol_type protocol, - u32 *fw_size_out) +static const struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw, + enum geni_se_protocol_type protocol, + u32 *fw_size_out) { struct device *dev = se->dev; const struct elf32_hdr *ehdr; const struct elf32_phdr *phdrs; const struct elf32_phdr *phdr; - struct se_fw_hdr *sefw; + const struct se_fw_hdr *sefw; u32 fw_end, cfg_idx_end, cfg_val_end; u32 prog_ram_depth; u32 fw_size; @@ -1290,7 +1290,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct if (phdr->p_filesz < sizeof(struct se_fw_hdr)) continue; - sefw = (struct se_fw_hdr *)(fw->data + phdr->p_offset); + sefw = (const struct se_fw_hdr *)(fw->data + phdr->p_offset); fw_size = le16_to_cpu(sefw->fw_size_in_items); if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1) @@ -1299,10 +1299,8 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct if (le16_to_cpu(sefw->serial_protocol) != protocol) continue; - if (fw_size % 2 != 0) { + if (fw_size % 2 != 0) fw_size++; - sefw->fw_size_in_items = cpu_to_le16(fw_size); - } fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32); cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) + @@ -1437,15 +1435,15 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw, const u8 *cfg_idx_arr; u32 i, reg_value, fw_size_in_items; int ret; - struct se_fw_hdr *hdr; + const struct se_fw_hdr *hdr; hdr = geni_find_protocol_fw(se, fw, protocol, &fw_size_in_items); if (!hdr) return -EINVAL; - fw_data = (const u32 *)((u8 *)hdr + le16_to_cpu(hdr->fw_offset)); + fw_data = (const u32 *)((const u8 *)hdr + le16_to_cpu(hdr->fw_offset)); cfg_idx_arr = (const u8 *)hdr + le16_to_cpu(hdr->cfg_idx_offset); - cfg_val_arr = (const u32 *)((u8 *)hdr + le16_to_cpu(hdr->cfg_val_offset)); + cfg_val_arr = (const u32 *)((const u8 *)hdr + le16_to_cpu(hdr->cfg_val_offset)); ret = geni_icc_set_bw(se); if (ret) -- 2.34.1