]>
Commit | Line | Data |
---|---|---|
1802d0be | 1 | // SPDX-License-Identifier: GPL-2.0-only |
72854fb0 SB |
2 | /* |
3 | * Remote Processor Framework Elf loader | |
4 | * | |
5 | * Copyright (C) 2011 Texas Instruments, Inc. | |
6 | * Copyright (C) 2011 Google, Inc. | |
7 | * | |
8 | * Ohad Ben-Cohen <ohad@wizery.com> | |
9 | * Brian Swetland <swetland@google.com> | |
10 | * Mark Grosen <mgrosen@ti.com> | |
11 | * Fernando Guzman Lugo <fernando.lugo@ti.com> | |
12 | * Suman Anna <s-anna@ti.com> | |
13 | * Robert Tivy <rtivy@ti.com> | |
14 | * Armando Uribe De Leon <x0095078@ti.com> | |
15 | * Sjur Brændeland <sjur.brandeland@stericsson.com> | |
72854fb0 SB |
16 | */ |
17 | ||
18 | #define pr_fmt(fmt) "%s: " fmt, __func__ | |
19 | ||
20 | #include <linux/module.h> | |
21 | #include <linux/firmware.h> | |
22 | #include <linux/remoteproc.h> | |
23 | #include <linux/elf.h> | |
24 | ||
25 | #include "remoteproc_internal.h" | |
f31e339f | 26 | #include "remoteproc_elf_helpers.h" |
72854fb0 SB |
27 | |
28 | /** | |
f31e339f | 29 | * rproc_elf_sanity_check() - Sanity Check for ELF32/ELF64 firmware image |
72854fb0 SB |
30 | * @rproc: the remote processor handle |
31 | * @fw: the ELF firmware image | |
32 | * | |
f31e339f | 33 | * Make sure this fw image is sane (ie a correct ELF32/ELF64 file). |
72854fb0 | 34 | */ |
f31e339f | 35 | int rproc_elf_sanity_check(struct rproc *rproc, const struct firmware *fw) |
72854fb0 SB |
36 | { |
37 | const char *name = rproc->firmware; | |
38 | struct device *dev = &rproc->dev; | |
f31e339f CL |
39 | /* |
40 | * Elf files are beginning with the same structure. Thus, to simplify | |
41 | * header parsing, we can use the elf32_hdr one for both elf64 and | |
42 | * elf32. | |
43 | */ | |
72854fb0 | 44 | struct elf32_hdr *ehdr; |
f31e339f CL |
45 | u32 elf_shdr_get_size; |
46 | u64 phoff, shoff; | |
72854fb0 | 47 | char class; |
f31e339f | 48 | u16 phnum; |
72854fb0 SB |
49 | |
50 | if (!fw) { | |
51 | dev_err(dev, "failed to load %s\n", name); | |
52 | return -EINVAL; | |
53 | } | |
54 | ||
55 | if (fw->size < sizeof(struct elf32_hdr)) { | |
56 | dev_err(dev, "Image is too small\n"); | |
57 | return -EINVAL; | |
58 | } | |
59 | ||
60 | ehdr = (struct elf32_hdr *)fw->data; | |
61 | ||
f31e339f CL |
62 | if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG)) { |
63 | dev_err(dev, "Image is corrupted (bad magic)\n"); | |
64 | return -EINVAL; | |
65 | } | |
66 | ||
72854fb0 | 67 | class = ehdr->e_ident[EI_CLASS]; |
f31e339f | 68 | if (class != ELFCLASS32 && class != ELFCLASS64) { |
72854fb0 SB |
69 | dev_err(dev, "Unsupported class: %d\n", class); |
70 | return -EINVAL; | |
71 | } | |
72 | ||
f31e339f CL |
73 | if (class == ELFCLASS64 && fw->size < sizeof(struct elf64_hdr)) { |
74 | dev_err(dev, "elf64 header is too small\n"); | |
75 | return -EINVAL; | |
76 | } | |
77 | ||
9c768207 | 78 | /* We assume the firmware has the same endianness as the host */ |
72854fb0 SB |
79 | # ifdef __LITTLE_ENDIAN |
80 | if (ehdr->e_ident[EI_DATA] != ELFDATA2LSB) { | |
81 | # else /* BIG ENDIAN */ | |
82 | if (ehdr->e_ident[EI_DATA] != ELFDATA2MSB) { | |
83 | # endif | |
9c768207 | 84 | dev_err(dev, "Unsupported firmware endianness\n"); |
72854fb0 SB |
85 | return -EINVAL; |
86 | } | |
87 | ||
f31e339f CL |
88 | phoff = elf_hdr_get_e_phoff(class, fw->data); |
89 | shoff = elf_hdr_get_e_shoff(class, fw->data); | |
90 | phnum = elf_hdr_get_e_phnum(class, fw->data); | |
91 | elf_shdr_get_size = elf_size_of_shdr(class); | |
72854fb0 | 92 | |
f31e339f CL |
93 | if (fw->size < shoff + elf_shdr_get_size) { |
94 | dev_err(dev, "Image is too small\n"); | |
72854fb0 SB |
95 | return -EINVAL; |
96 | } | |
97 | ||
f31e339f | 98 | if (phnum == 0) { |
72854fb0 SB |
99 | dev_err(dev, "No loadable segments\n"); |
100 | return -EINVAL; | |
101 | } | |
102 | ||
f31e339f | 103 | if (phoff > fw->size) { |
72854fb0 SB |
104 | dev_err(dev, "Firmware size is too small\n"); |
105 | return -EINVAL; | |
106 | } | |
107 | ||
f31e339f CL |
108 | dev_dbg(dev, "Firmware is an elf%d file\n", |
109 | class == ELFCLASS32 ? 32 : 64); | |
110 | ||
72854fb0 SB |
111 | return 0; |
112 | } | |
f31e339f CL |
113 | EXPORT_SYMBOL(rproc_elf_sanity_check); |
114 | ||
72854fb0 | 115 | /** |
4afc89d6 | 116 | * rproc_elf_get_boot_addr() - Get rproc's boot address. |
72854fb0 SB |
117 | * @rproc: the remote processor handle |
118 | * @fw: the ELF firmware image | |
119 | * | |
120 | * This function returns the entry point address of the ELF | |
121 | * image. | |
122 | * | |
123 | * Note that the boot address is not a configurable property of all remote | |
124 | * processors. Some will always boot at a specific hard-coded address. | |
125 | */ | |
e4ae4b7d | 126 | u64 rproc_elf_get_boot_addr(struct rproc *rproc, const struct firmware *fw) |
72854fb0 | 127 | { |
f31e339f | 128 | return elf_hdr_get_e_entry(fw_elf_get_class(fw), fw->data); |
72854fb0 | 129 | } |
0f21f9cc | 130 | EXPORT_SYMBOL(rproc_elf_get_boot_addr); |
72854fb0 SB |
131 | |
132 | /** | |
4afc89d6 | 133 | * rproc_elf_load_segments() - load firmware segments to memory |
72854fb0 SB |
134 | * @rproc: remote processor which will be booted using these fw segments |
135 | * @fw: the ELF firmware image | |
136 | * | |
137 | * This function loads the firmware segments to memory, where the remote | |
138 | * processor expects them. | |
139 | * | |
140 | * Some remote processors will expect their code and data to be placed | |
141 | * in specific device addresses, and can't have them dynamically assigned. | |
142 | * | |
143 | * We currently support only those kind of remote processors, and expect | |
144 | * the program header's paddr member to contain those addresses. We then go | |
145 | * through the physically contiguous "carveout" memory regions which we | |
146 | * allocated (and mapped) earlier on behalf of the remote processor, | |
147 | * and "translate" device address to kernel addresses, so we can copy the | |
148 | * segments where they are expected. | |
149 | * | |
150 | * Currently we only support remote processors that required carveout | |
151 | * allocations and got them mapped onto their iommus. Some processors | |
152 | * might be different: they might not have iommus, and would prefer to | |
153 | * directly allocate memory for every segment/resource. This is not yet | |
154 | * supported, though. | |
155 | */ | |
0f21f9cc | 156 | int rproc_elf_load_segments(struct rproc *rproc, const struct firmware *fw) |
72854fb0 SB |
157 | { |
158 | struct device *dev = &rproc->dev; | |
f31e339f | 159 | const void *ehdr, *phdr; |
72854fb0 | 160 | int i, ret = 0; |
f31e339f | 161 | u16 phnum; |
72854fb0 | 162 | const u8 *elf_data = fw->data; |
f31e339f CL |
163 | u8 class = fw_elf_get_class(fw); |
164 | u32 elf_phdr_get_size = elf_size_of_phdr(class); | |
72854fb0 | 165 | |
f31e339f CL |
166 | ehdr = elf_data; |
167 | phnum = elf_hdr_get_e_phnum(class, ehdr); | |
168 | phdr = elf_data + elf_hdr_get_e_phoff(class, ehdr); | |
72854fb0 SB |
169 | |
170 | /* go through the available ELF segments */ | |
f31e339f CL |
171 | for (i = 0; i < phnum; i++, phdr += elf_phdr_get_size) { |
172 | u64 da = elf_phdr_get_p_paddr(class, phdr); | |
173 | u64 memsz = elf_phdr_get_p_memsz(class, phdr); | |
174 | u64 filesz = elf_phdr_get_p_filesz(class, phdr); | |
175 | u64 offset = elf_phdr_get_p_offset(class, phdr); | |
176 | u32 type = elf_phdr_get_p_type(class, phdr); | |
72854fb0 SB |
177 | void *ptr; |
178 | ||
f31e339f | 179 | if (type != PT_LOAD) |
72854fb0 SB |
180 | continue; |
181 | ||
f31e339f CL |
182 | dev_dbg(dev, "phdr: type %d da 0x%llx memsz 0x%llx filesz 0x%llx\n", |
183 | type, da, memsz, filesz); | |
72854fb0 SB |
184 | |
185 | if (filesz > memsz) { | |
f31e339f | 186 | dev_err(dev, "bad phdr filesz 0x%llx memsz 0x%llx\n", |
730f84ce | 187 | filesz, memsz); |
72854fb0 SB |
188 | ret = -EINVAL; |
189 | break; | |
190 | } | |
191 | ||
192 | if (offset + filesz > fw->size) { | |
f31e339f | 193 | dev_err(dev, "truncated fw: need 0x%llx avail 0x%zx\n", |
730f84ce | 194 | offset + filesz, fw->size); |
72854fb0 SB |
195 | ret = -EINVAL; |
196 | break; | |
197 | } | |
198 | ||
f31e339f CL |
199 | if (!rproc_u64_fit_in_size_t(memsz)) { |
200 | dev_err(dev, "size (%llx) does not fit in size_t type\n", | |
201 | memsz); | |
202 | ret = -EOVERFLOW; | |
203 | break; | |
204 | } | |
205 | ||
72854fb0 SB |
206 | /* grab the kernel address for this device address */ |
207 | ptr = rproc_da_to_va(rproc, da, memsz); | |
208 | if (!ptr) { | |
f31e339f CL |
209 | dev_err(dev, "bad phdr da 0x%llx mem 0x%llx\n", da, |
210 | memsz); | |
72854fb0 SB |
211 | ret = -EINVAL; |
212 | break; | |
213 | } | |
214 | ||
215 | /* put the segment where the remote processor expects it */ | |
f31e339f CL |
216 | if (filesz) |
217 | memcpy(ptr, elf_data + offset, filesz); | |
72854fb0 SB |
218 | |
219 | /* | |
220 | * Zero out remaining memory for this segment. | |
221 | * | |
222 | * This isn't strictly required since dma_alloc_coherent already | |
223 | * did this for us. albeit harmless, we may consider removing | |
224 | * this. | |
225 | */ | |
226 | if (memsz > filesz) | |
227 | memset(ptr + filesz, 0, memsz - filesz); | |
228 | } | |
229 | ||
230 | return ret; | |
231 | } | |
0f21f9cc | 232 | EXPORT_SYMBOL(rproc_elf_load_segments); |
72854fb0 | 233 | |
f31e339f CL |
234 | static const void * |
235 | find_table(struct device *dev, const struct firmware *fw) | |
72854fb0 | 236 | { |
f31e339f | 237 | const void *shdr, *name_table_shdr; |
f665b2cd | 238 | int i; |
72854fb0 | 239 | const char *name_table; |
72854fb0 | 240 | struct resource_table *table = NULL; |
f31e339f CL |
241 | const u8 *elf_data = (void *)fw->data; |
242 | u8 class = fw_elf_get_class(fw); | |
243 | size_t fw_size = fw->size; | |
244 | const void *ehdr = elf_data; | |
245 | u16 shnum = elf_hdr_get_e_shnum(class, ehdr); | |
246 | u32 elf_shdr_get_size = elf_size_of_shdr(class); | |
247 | u16 shstrndx = elf_hdr_get_e_shstrndx(class, ehdr); | |
72854fb0 | 248 | |
f665b2cd | 249 | /* look for the resource table and handle it */ |
f31e339f CL |
250 | /* First, get the section header according to the elf class */ |
251 | shdr = elf_data + elf_hdr_get_e_shoff(class, ehdr); | |
252 | /* Compute name table section header entry in shdr array */ | |
253 | name_table_shdr = shdr + (shstrndx * elf_shdr_get_size); | |
254 | /* Finally, compute the name table section address in elf */ | |
255 | name_table = elf_data + elf_shdr_get_sh_offset(class, name_table_shdr); | |
256 | ||
257 | for (i = 0; i < shnum; i++, shdr += elf_shdr_get_size) { | |
258 | u64 size = elf_shdr_get_sh_size(class, shdr); | |
259 | u64 offset = elf_shdr_get_sh_offset(class, shdr); | |
260 | u32 name = elf_shdr_get_sh_name(class, shdr); | |
261 | ||
262 | if (strcmp(name_table + name, ".resource_table")) | |
72854fb0 SB |
263 | continue; |
264 | ||
265 | table = (struct resource_table *)(elf_data + offset); | |
266 | ||
267 | /* make sure we have the entire table */ | |
f665b2cd | 268 | if (offset + size > fw_size || offset + size < size) { |
72854fb0 SB |
269 | dev_err(dev, "resource table truncated\n"); |
270 | return NULL; | |
271 | } | |
272 | ||
273 | /* make sure table has at least the header */ | |
274 | if (sizeof(struct resource_table) > size) { | |
275 | dev_err(dev, "header-less resource table\n"); | |
276 | return NULL; | |
277 | } | |
278 | ||
279 | /* we don't support any version beyond the first */ | |
280 | if (table->ver != 1) { | |
281 | dev_err(dev, "unsupported fw ver: %d\n", table->ver); | |
282 | return NULL; | |
283 | } | |
284 | ||
285 | /* make sure reserved bytes are zeroes */ | |
286 | if (table->reserved[0] || table->reserved[1]) { | |
287 | dev_err(dev, "non zero reserved bytes\n"); | |
288 | return NULL; | |
289 | } | |
290 | ||
291 | /* make sure the offsets array isn't truncated */ | |
77e5a448 | 292 | if (struct_size(table, offset, table->num) > size) { |
72854fb0 SB |
293 | dev_err(dev, "resource table incomplete\n"); |
294 | return NULL; | |
295 | } | |
296 | ||
f665b2cd | 297 | return shdr; |
72854fb0 SB |
298 | } |
299 | ||
f665b2cd SB |
300 | return NULL; |
301 | } | |
302 | ||
303 | /** | |
58b64090 | 304 | * rproc_elf_load_rsc_table() - load the resource table |
f665b2cd SB |
305 | * @rproc: the rproc handle |
306 | * @fw: the ELF firmware image | |
f665b2cd SB |
307 | * |
308 | * This function finds the resource table inside the remote processor's | |
58b64090 | 309 | * firmware, load it into the @cached_table and update @table_ptr. |
f665b2cd | 310 | * |
58b64090 | 311 | * Return: 0 on success, negative errno on failure. |
f665b2cd | 312 | */ |
58b64090 | 313 | int rproc_elf_load_rsc_table(struct rproc *rproc, const struct firmware *fw) |
f665b2cd | 314 | { |
f31e339f | 315 | const void *shdr; |
f665b2cd SB |
316 | struct device *dev = &rproc->dev; |
317 | struct resource_table *table = NULL; | |
318 | const u8 *elf_data = fw->data; | |
58b64090 | 319 | size_t tablesz; |
f31e339f CL |
320 | u8 class = fw_elf_get_class(fw); |
321 | u64 sh_offset; | |
f665b2cd | 322 | |
f31e339f | 323 | shdr = find_table(dev, fw); |
f665b2cd | 324 | if (!shdr) |
58b64090 | 325 | return -EINVAL; |
f665b2cd | 326 | |
f31e339f CL |
327 | sh_offset = elf_shdr_get_sh_offset(class, shdr); |
328 | table = (struct resource_table *)(elf_data + sh_offset); | |
329 | tablesz = elf_shdr_get_sh_size(class, shdr); | |
58b64090 BA |
330 | |
331 | /* | |
332 | * Create a copy of the resource table. When a virtio device starts | |
333 | * and calls vring_new_virtqueue() the address of the allocated vring | |
334 | * will be stored in the cached_table. Before the device is started, | |
335 | * cached_table will be copied into device memory. | |
336 | */ | |
337 | rproc->cached_table = kmemdup(table, tablesz, GFP_KERNEL); | |
338 | if (!rproc->cached_table) | |
339 | return -ENOMEM; | |
f665b2cd | 340 | |
58b64090 BA |
341 | rproc->table_ptr = rproc->cached_table; |
342 | rproc->table_sz = tablesz; | |
343 | ||
344 | return 0; | |
72854fb0 | 345 | } |
58b64090 | 346 | EXPORT_SYMBOL(rproc_elf_load_rsc_table); |
4afc89d6 | 347 | |
95f95781 SB |
348 | /** |
349 | * rproc_elf_find_loaded_rsc_table() - find the loaded resource table | |
350 | * @rproc: the rproc handle | |
351 | * @fw: the ELF firmware image | |
352 | * | |
353 | * This function finds the location of the loaded resource table. Don't | |
354 | * call this function if the table wasn't loaded yet - it's a bug if you do. | |
355 | * | |
356 | * Returns the pointer to the resource table if it is found or NULL otherwise. | |
357 | * If the table wasn't loaded yet the result is unspecified. | |
358 | */ | |
0f21f9cc BA |
359 | struct resource_table *rproc_elf_find_loaded_rsc_table(struct rproc *rproc, |
360 | const struct firmware *fw) | |
95f95781 | 361 | { |
f31e339f CL |
362 | const void *shdr; |
363 | u64 sh_addr, sh_size; | |
364 | u8 class = fw_elf_get_class(fw); | |
365 | struct device *dev = &rproc->dev; | |
95f95781 | 366 | |
f31e339f | 367 | shdr = find_table(&rproc->dev, fw); |
95f95781 SB |
368 | if (!shdr) |
369 | return NULL; | |
370 | ||
f31e339f CL |
371 | sh_addr = elf_shdr_get_sh_addr(class, shdr); |
372 | sh_size = elf_shdr_get_sh_size(class, shdr); | |
373 | ||
374 | if (!rproc_u64_fit_in_size_t(sh_size)) { | |
375 | dev_err(dev, "size (%llx) does not fit in size_t type\n", | |
376 | sh_size); | |
377 | return NULL; | |
378 | } | |
379 | ||
380 | return rproc_da_to_va(rproc, sh_addr, sh_size); | |
95f95781 | 381 | } |
0f21f9cc | 382 | EXPORT_SYMBOL(rproc_elf_find_loaded_rsc_table); |