[linux-2.6-block.git] / drivers / remoteproc / remoteproc_elf_loader.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Remote Processor Framework Elf loader
 *
 * Copyright (C) 2011 Texas Instruments, Inc.
 * Copyright (C) 2011 Google, Inc.
 *
 * Ohad Ben-Cohen <ohad@wizery.com>
 * Brian Swetland <swetland@google.com>
 * Mark Grosen <mgrosen@ti.com>
 * Fernando Guzman Lugo <fernando.lugo@ti.com>
 * Suman Anna <s-anna@ti.com>
 * Robert Tivy <rtivy@ti.com>
 * Armando Uribe De Leon <x0095078@ti.com>
 * Sjur Brændeland <sjur.brandeland@stericsson.com>
 */

#define pr_fmt(fmt)    "%s: " fmt, __func__

#include <linux/module.h>
#include <linux/firmware.h>
#include <linux/remoteproc.h>
#include <linux/elf.h>

#include "remoteproc_internal.h"

/**
 * rproc_elf_sanity_check() - Sanity Check ELF firmware image
 * @rproc: the remote processor handle
 * @fw: the ELF firmware image
 *
 * Make sure this fw image is sane.
 */
int rproc_elf_sanity_check(struct rproc *rproc, const struct firmware *fw)
{
	const char *name = rproc->firmware;
	struct device *dev = &rproc->dev;
	struct elf32_hdr *ehdr;
	char class;

	if (!fw) {
		dev_err(dev, "failed to load %s\n", name);
		return -EINVAL;
	}

	if (fw->size < sizeof(struct elf32_hdr)) {
		dev_err(dev, "Image is too small\n");
		return -EINVAL;
	}

	ehdr = (struct elf32_hdr *)fw->data;

	/* We only support ELF32 at this point */
	class = ehdr->e_ident[EI_CLASS];
	if (class != ELFCLASS32) {
		dev_err(dev, "Unsupported class: %d\n", class);
		return -EINVAL;
	}

	/* We assume the firmware has the same endianness as the host */
# ifdef __LITTLE_ENDIAN
	if (ehdr->e_ident[EI_DATA] != ELFDATA2LSB) {
# else /* BIG ENDIAN */
	if (ehdr->e_ident[EI_DATA] != ELFDATA2MSB) {
# endif
		dev_err(dev, "Unsupported firmware endianness\n");
		return -EINVAL;
	}

	if (fw->size < ehdr->e_shoff + sizeof(struct elf32_shdr)) {
		dev_err(dev, "Image is too small\n");
		return -EINVAL;
	}

	if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG)) {
		dev_err(dev, "Image is corrupted (bad magic)\n");
		return -EINVAL;
	}

	if (ehdr->e_phnum == 0) {
		dev_err(dev, "No loadable segments\n");
		return -EINVAL;
	}

	if (ehdr->e_phoff > fw->size) {
		dev_err(dev, "Firmware size is too small\n");
		return -EINVAL;
	}

	return 0;
}
EXPORT_SYMBOL(rproc_elf_sanity_check);

/**
 * rproc_elf_get_boot_addr() - Get rproc's boot address.
 * @rproc: the remote processor handle
 * @fw: the ELF firmware image
 *
 * This function returns the entry point address of the ELF
 * image.
 *
 * Note that the boot address is not a configurable property of all remote
 * processors. Some will always boot at a specific hard-coded address.
 */
u32 rproc_elf_get_boot_addr(struct rproc *rproc, const struct firmware *fw)
{
	struct elf32_hdr *ehdr  = (struct elf32_hdr *)fw->data;

	return ehdr->e_entry;
}
EXPORT_SYMBOL(rproc_elf_get_boot_addr);

/**
 * rproc_elf_load_segments() - load firmware segments to memory
 * @rproc: remote processor which will be booted using these fw segments
 * @fw: the ELF firmware image
 *
 * This function loads the firmware segments to memory, where the remote
 * processor expects them.
 *
 * Some remote processors will expect their code and data to be placed
 * in specific device addresses, and can't have them dynamically assigned.
 *
 * We currently support only those kind of remote processors, and expect
 * the program header's paddr member to contain those addresses. We then go
 * through the physically contiguous "carveout" memory regions which we
 * allocated (and mapped) earlier on behalf of the remote processor,
 * and "translate" device address to kernel addresses, so we can copy the
 * segments where they are expected.
 *
 * Currently we only support remote processors that required carveout
 * allocations and got them mapped onto their iommus. Some processors
 * might be different: they might not have iommus, and would prefer to
 * directly allocate memory for every segment/resource. This is not yet
 * supported, though.
 */
int rproc_elf_load_segments(struct rproc *rproc, const struct firmware *fw)
{
	struct device *dev = &rproc->dev;
	struct elf32_hdr *ehdr;
	struct elf32_phdr *phdr;
	int i, ret = 0;
	const u8 *elf_data = fw->data;

	ehdr = (struct elf32_hdr *)elf_data;
	phdr = (struct elf32_phdr *)(elf_data + ehdr->e_phoff);

	/* go through the available ELF segments */
	for (i = 0; i < ehdr->e_phnum; i++, phdr++) {
		u32 da = phdr->p_paddr;
		u32 memsz = phdr->p_memsz;
		u32 filesz = phdr->p_filesz;
		u32 offset = phdr->p_offset;
		void *ptr;

		if (phdr->p_type != PT_LOAD)
			continue;

		dev_dbg(dev, "phdr: type %d da 0x%x memsz 0x%x filesz 0x%x\n",
			phdr->p_type, da, memsz, filesz);

		if (filesz > memsz) {
			dev_err(dev, "bad phdr filesz 0x%x memsz 0x%x\n",
				filesz, memsz);
			ret = -EINVAL;
			break;
		}

		if (offset + filesz > fw->size) {
			dev_err(dev, "truncated fw: need 0x%x avail 0x%zx\n",
				offset + filesz, fw->size);
			ret = -EINVAL;
			break;
		}

		/* grab the kernel address for this device address */
		ptr = rproc_da_to_va(rproc, da, memsz);
		if (!ptr) {
			dev_err(dev, "bad phdr da 0x%x mem 0x%x\n", da, memsz);
			ret = -EINVAL;
			break;
		}

		/* put the segment where the remote processor expects it */
		if (phdr->p_filesz)
			memcpy(ptr, elf_data + phdr->p_offset, filesz);

		/*
		 * Zero out remaining memory for this segment.
		 *
		 * This isn't strictly required since dma_alloc_coherent already
		 * did this for us. albeit harmless, we may consider removing
		 * this.
		 */
		if (memsz > filesz)
			memset(ptr + filesz, 0, memsz - filesz);
	}

	return ret;
}
EXPORT_SYMBOL(rproc_elf_load_segments);

static struct elf32_shdr *
find_table(struct device *dev, struct elf32_hdr *ehdr, size_t fw_size)
{
	struct elf32_shdr *shdr;
	int i;
	const char *name_table;
	struct resource_table *table = NULL;
	const u8 *elf_data = (void *)ehdr;

	/* look for the resource table and handle it */
	shdr = (struct elf32_shdr *)(elf_data + ehdr->e_shoff);
	name_table = elf_data + shdr[ehdr->e_shstrndx].sh_offset;

	for (i = 0; i < ehdr->e_shnum; i++, shdr++) {
		u32 size = shdr->sh_size;
		u32 offset = shdr->sh_offset;

		if (strcmp(name_table + shdr->sh_name, ".resource_table"))
			continue;

		table = (struct resource_table *)(elf_data + offset);

		/* make sure we have the entire table */
		if (offset + size > fw_size || offset + size < size) {
			dev_err(dev, "resource table truncated\n");
			return NULL;
		}

		/* make sure table has at least the header */
		if (sizeof(struct resource_table) > size) {
			dev_err(dev, "header-less resource table\n");
			return NULL;
		}

		/* we don't support any version beyond the first */
		if (table->ver != 1) {
			dev_err(dev, "unsupported fw ver: %d\n", table->ver);
			return NULL;
		}

		/* make sure reserved bytes are zeroes */
		if (table->reserved[0] || table->reserved[1]) {
			dev_err(dev, "non zero reserved bytes\n");
			return NULL;
		}

		/* make sure the offsets array isn't truncated */
		if (struct_size(table, offset, table->num) > size) {
			dev_err(dev, "resource table incomplete\n");
			return NULL;
		}

		return shdr;
	}

	return NULL;
}

/**
 * rproc_elf_load_rsc_table() - load the resource table
 * @rproc: the rproc handle
 * @fw: the ELF firmware image
 *
 * This function finds the resource table inside the remote processor's
 * firmware, load it into the @cached_table and update @table_ptr.
 *
 * Return: 0 on success, negative errno on failure.
 */
int rproc_elf_load_rsc_table(struct rproc *rproc, const struct firmware *fw)
{
	struct elf32_hdr *ehdr;
	struct elf32_shdr *shdr;
	struct device *dev = &rproc->dev;
	struct resource_table *table = NULL;
	const u8 *elf_data = fw->data;
	size_t tablesz;

	ehdr = (struct elf32_hdr *)elf_data;

	shdr = find_table(dev, ehdr, fw->size);
	if (!shdr)
		return -EINVAL;

	table = (struct resource_table *)(elf_data + shdr->sh_offset);
	tablesz = shdr->sh_size;

	/*
	 * Create a copy of the resource table. When a virtio device starts
	 * and calls vring_new_virtqueue() the address of the allocated vring
	 * will be stored in the cached_table. Before the device is started,
	 * cached_table will be copied into device memory.
	 */
	rproc->cached_table = kmemdup(table, tablesz, GFP_KERNEL);
	if (!rproc->cached_table)
		return -ENOMEM;

	rproc->table_ptr = rproc->cached_table;
	rproc->table_sz = tablesz;

	return 0;
}
EXPORT_SYMBOL(rproc_elf_load_rsc_table);

/**
 * rproc_elf_find_loaded_rsc_table() - find the loaded resource table
 * @rproc: the rproc handle
 * @fw: the ELF firmware image
 *
 * This function finds the location of the loaded resource table. Don't
 * call this function if the table wasn't loaded yet - it's a bug if you do.
 *
 * Returns the pointer to the resource table if it is found or NULL otherwise.
 * If the table wasn't loaded yet the result is unspecified.
 */
struct resource_table *rproc_elf_find_loaded_rsc_table(struct rproc *rproc,
						       const struct firmware *fw)
{
	struct elf32_hdr *ehdr = (struct elf32_hdr *)fw->data;
	struct elf32_shdr *shdr;

	shdr = find_table(&rproc->dev, ehdr, fw->size);
	if (!shdr)
		return NULL;

	return rproc_da_to_va(rproc, shdr->sh_addr, shdr->sh_size);
}
EXPORT_SYMBOL(rproc_elf_find_loaded_rsc_table);
Commit	Line	Data
1802d0be	1	// SPDX-License-Identifier: GPL-2.0-only
72854fb0 SB	2	/*
	3	* Remote Processor Framework Elf loader
	4	*
	5	* Copyright (C) 2011 Texas Instruments, Inc.
	6	* Copyright (C) 2011 Google, Inc.
	7	*
	8	* Ohad Ben-Cohen <ohad@wizery.com>
	9	* Brian Swetland <swetland@google.com>
	10	* Mark Grosen <mgrosen@ti.com>
	11	* Fernando Guzman Lugo <fernando.lugo@ti.com>
	12	* Suman Anna <s-anna@ti.com>
	13	* Robert Tivy <rtivy@ti.com>
	14	* Armando Uribe De Leon <x0095078@ti.com>
	15	* Sjur Brændeland <sjur.brandeland@stericsson.com>
72854fb0 SB	16	*/
	17
	18	#define pr_fmt(fmt) "%s: " fmt, __func__
	19
	20	#include <linux/module.h>
	21	#include <linux/firmware.h>
	22	#include <linux/remoteproc.h>
	23	#include <linux/elf.h>
	24
	25	#include "remoteproc_internal.h"
	26
	27	/**
4afc89d6	28	* rproc_elf_sanity_check() - Sanity Check ELF firmware image
72854fb0 SB	29	* @rproc: the remote processor handle
	30	* @fw: the ELF firmware image
	31	*
	32	* Make sure this fw image is sane.
	33	*/
0f21f9cc	34	int rproc_elf_sanity_check(struct rproc rproc, const struct firmware fw)
72854fb0 SB	35	{
	36	const char *name = rproc->firmware;
	37	struct device *dev = &rproc->dev;
	38	struct elf32_hdr *ehdr;
	39	char class;
	40
	41	if (!fw) {
	42	dev_err(dev, "failed to load %s\n", name);
	43	return -EINVAL;
	44	}
	45
	46	if (fw->size < sizeof(struct elf32_hdr)) {
	47	dev_err(dev, "Image is too small\n");
	48	return -EINVAL;
	49	}
	50
	51	ehdr = (struct elf32_hdr *)fw->data;
	52
	53	/* We only support ELF32 at this point */
	54	class = ehdr->e_ident[EI_CLASS];
	55	if (class != ELFCLASS32) {
	56	dev_err(dev, "Unsupported class: %d\n", class);
	57	return -EINVAL;
	58	}
	59
9c768207	60	/* We assume the firmware has the same endianness as the host */
72854fb0 SB	61	# ifdef __LITTLE_ENDIAN
	62	if (ehdr->e_ident[EI_DATA] != ELFDATA2LSB) {
	63	# else /* BIG ENDIAN */
	64	if (ehdr->e_ident[EI_DATA] != ELFDATA2MSB) {
	65	# endif
9c768207	66	dev_err(dev, "Unsupported firmware endianness\n");
72854fb0 SB	67	return -EINVAL;
	68	}
	69
	70	if (fw->size < ehdr->e_shoff + sizeof(struct elf32_shdr)) {
	71	dev_err(dev, "Image is too small\n");
	72	return -EINVAL;
	73	}
	74
	75	if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG)) {
	76	dev_err(dev, "Image is corrupted (bad magic)\n");
	77	return -EINVAL;
	78	}
	79
	80	if (ehdr->e_phnum == 0) {
	81	dev_err(dev, "No loadable segments\n");
	82	return -EINVAL;
	83	}
	84
	85	if (ehdr->e_phoff > fw->size) {
	86	dev_err(dev, "Firmware size is too small\n");
	87	return -EINVAL;
	88	}
	89
	90	return 0;
	91	}
0f21f9cc	92	EXPORT_SYMBOL(rproc_elf_sanity_check);
72854fb0 SB	93
72854fb0 SB	94	/**
4afc89d6	95	* rproc_elf_get_boot_addr() - Get rproc's boot address.
72854fb0 SB	96	* @rproc: the remote processor handle
	97	* @fw: the ELF firmware image
	98	*
	99	* This function returns the entry point address of the ELF
	100	* image.
	101	*
	102	* Note that the boot address is not a configurable property of all remote
	103	* processors. Some will always boot at a specific hard-coded address.
	104	*/
4afc89d6	105	u32 rproc_elf_get_boot_addr(struct rproc rproc, const struct firmware fw)
72854fb0 SB	106	{
	107	struct elf32_hdr ehdr = (struct elf32_hdr )fw->data;
	108
	109	return ehdr->e_entry;
	110	}
0f21f9cc	111	EXPORT_SYMBOL(rproc_elf_get_boot_addr);
72854fb0 SB	112
72854fb0 SB	113	/**
4afc89d6	114	* rproc_elf_load_segments() - load firmware segments to memory
72854fb0 SB	115	* @rproc: remote processor which will be booted using these fw segments
	116	* @fw: the ELF firmware image
	117	*
	118	* This function loads the firmware segments to memory, where the remote
	119	* processor expects them.
	120	*
	121	* Some remote processors will expect their code and data to be placed
	122	* in specific device addresses, and can't have them dynamically assigned.
	123	*
	124	* We currently support only those kind of remote processors, and expect
	125	* the program header's paddr member to contain those addresses. We then go
	126	* through the physically contiguous "carveout" memory regions which we
	127	* allocated (and mapped) earlier on behalf of the remote processor,
	128	* and "translate" device address to kernel addresses, so we can copy the
	129	* segments where they are expected.
	130	*
	131	* Currently we only support remote processors that required carveout
	132	* allocations and got them mapped onto their iommus. Some processors
	133	* might be different: they might not have iommus, and would prefer to
	134	* directly allocate memory for every segment/resource. This is not yet
	135	* supported, though.
	136	*/
0f21f9cc	137	int rproc_elf_load_segments(struct rproc rproc, const struct firmware fw)
72854fb0 SB	138	{
	139	struct device *dev = &rproc->dev;
	140	struct elf32_hdr *ehdr;
	141	struct elf32_phdr *phdr;
	142	int i, ret = 0;
	143	const u8 *elf_data = fw->data;
	144
	145	ehdr = (struct elf32_hdr *)elf_data;
	146	phdr = (struct elf32_phdr *)(elf_data + ehdr->e_phoff);
	147
	148	/* go through the available ELF segments */
	149	for (i = 0; i < ehdr->e_phnum; i++, phdr++) {
	150	u32 da = phdr->p_paddr;
	151	u32 memsz = phdr->p_memsz;
	152	u32 filesz = phdr->p_filesz;
	153	u32 offset = phdr->p_offset;
	154	void *ptr;
	155
	156	if (phdr->p_type != PT_LOAD)
	157	continue;
	158
	159	dev_dbg(dev, "phdr: type %d da 0x%x memsz 0x%x filesz 0x%x\n",
730f84ce	160	phdr->p_type, da, memsz, filesz);
72854fb0 SB	161
	162	if (filesz > memsz) {
	163	dev_err(dev, "bad phdr filesz 0x%x memsz 0x%x\n",
730f84ce	164	filesz, memsz);
72854fb0 SB	165	ret = -EINVAL;
	166	break;
	167	}
	168
	169	if (offset + filesz > fw->size) {
a9197f90	170	dev_err(dev, "truncated fw: need 0x%x avail 0x%zx\n",
730f84ce	171	offset + filesz, fw->size);
72854fb0 SB	172	ret = -EINVAL;
	173	break;
	174	}
	175
	176	/* grab the kernel address for this device address */
	177	ptr = rproc_da_to_va(rproc, da, memsz);
	178	if (!ptr) {
	179	dev_err(dev, "bad phdr da 0x%x mem 0x%x\n", da, memsz);
	180	ret = -EINVAL;
	181	break;
	182	}
	183
	184	/* put the segment where the remote processor expects it */
	185	if (phdr->p_filesz)
	186	memcpy(ptr, elf_data + phdr->p_offset, filesz);
	187
	188	/*
	189	* Zero out remaining memory for this segment.
	190	*
	191	* This isn't strictly required since dma_alloc_coherent already
	192	* did this for us. albeit harmless, we may consider removing
	193	* this.
	194	*/
	195	if (memsz > filesz)
	196	memset(ptr + filesz, 0, memsz - filesz);
	197	}
	198
	199	return ret;
	200	}
0f21f9cc	201	EXPORT_SYMBOL(rproc_elf_load_segments);
72854fb0	202
f665b2cd SB	203	static struct elf32_shdr *
f665b2cd SB	204	find_table(struct device dev, struct elf32_hdr ehdr, size_t fw_size)
72854fb0	205	{
72854fb0	206	struct elf32_shdr *shdr;
f665b2cd	207	int i;
72854fb0	208	const char *name_table;
72854fb0	209	struct resource_table *table = NULL;
f665b2cd	210	const u8 elf_data = (void )ehdr;
72854fb0	211
f665b2cd	212	/* look for the resource table and handle it */
72854fb0 SB	213	shdr = (struct elf32_shdr *)(elf_data + ehdr->e_shoff);
	214	name_table = elf_data + shdr[ehdr->e_shstrndx].sh_offset;
	215
72854fb0	216	for (i = 0; i < ehdr->e_shnum; i++, shdr++) {
f665b2cd SB	217	u32 size = shdr->sh_size;
f665b2cd SB	218	u32 offset = shdr->sh_offset;
72854fb0 SB	219
	220	if (strcmp(name_table + shdr->sh_name, ".resource_table"))
	221	continue;
	222
	223	table = (struct resource_table *)(elf_data + offset);
	224
	225	/* make sure we have the entire table */
f665b2cd	226	if (offset + size > fw_size \|\| offset + size < size) {
72854fb0 SB	227	dev_err(dev, "resource table truncated\n");
	228	return NULL;
	229	}
	230
	231	/* make sure table has at least the header */
	232	if (sizeof(struct resource_table) > size) {
	233	dev_err(dev, "header-less resource table\n");
	234	return NULL;
	235	}
	236
	237	/* we don't support any version beyond the first */
	238	if (table->ver != 1) {
	239	dev_err(dev, "unsupported fw ver: %d\n", table->ver);
	240	return NULL;
	241	}
	242
	243	/* make sure reserved bytes are zeroes */
	244	if (table->reserved[0] \|\| table->reserved[1]) {
	245	dev_err(dev, "non zero reserved bytes\n");
	246	return NULL;
	247	}
	248
	249	/* make sure the offsets array isn't truncated */
77e5a448	250	if (struct_size(table, offset, table->num) > size) {
72854fb0 SB	251	dev_err(dev, "resource table incomplete\n");
	252	return NULL;
	253	}
	254
f665b2cd	255	return shdr;
72854fb0 SB	256	}
72854fb0 SB	257
f665b2cd SB	258	return NULL;
	259	}
	260
	261	/**
58b64090	262	* rproc_elf_load_rsc_table() - load the resource table
f665b2cd SB	263	* @rproc: the rproc handle
f665b2cd SB	264	* @fw: the ELF firmware image
f665b2cd SB	265	*
f665b2cd SB	266	* This function finds the resource table inside the remote processor's
58b64090	267	* firmware, load it into the @cached_table and update @table_ptr.
f665b2cd	268	*
58b64090	269	* Return: 0 on success, negative errno on failure.
f665b2cd	270	*/
58b64090	271	int rproc_elf_load_rsc_table(struct rproc rproc, const struct firmware fw)
f665b2cd SB	272	{
	273	struct elf32_hdr *ehdr;
	274	struct elf32_shdr *shdr;
	275	struct device *dev = &rproc->dev;
	276	struct resource_table *table = NULL;
	277	const u8 *elf_data = fw->data;
58b64090	278	size_t tablesz;
f665b2cd SB	279
	280	ehdr = (struct elf32_hdr *)elf_data;
	281
	282	shdr = find_table(dev, ehdr, fw->size);
	283	if (!shdr)
58b64090	284	return -EINVAL;
f665b2cd SB	285
f665b2cd SB	286	table = (struct resource_table *)(elf_data + shdr->sh_offset);
58b64090 BA	287	tablesz = shdr->sh_size;
	288
	289	/*
	290	* Create a copy of the resource table. When a virtio device starts
	291	* and calls vring_new_virtqueue() the address of the allocated vring
	292	* will be stored in the cached_table. Before the device is started,
	293	* cached_table will be copied into device memory.
	294	*/
	295	rproc->cached_table = kmemdup(table, tablesz, GFP_KERNEL);
	296	if (!rproc->cached_table)
	297	return -ENOMEM;
f665b2cd	298
58b64090 BA	299	rproc->table_ptr = rproc->cached_table;
	300	rproc->table_sz = tablesz;
	301
	302	return 0;
72854fb0	303	}
58b64090	304	EXPORT_SYMBOL(rproc_elf_load_rsc_table);
4afc89d6	305
95f95781 SB	306	/**
	307	* rproc_elf_find_loaded_rsc_table() - find the loaded resource table
	308	* @rproc: the rproc handle
	309	* @fw: the ELF firmware image
	310	*
	311	* This function finds the location of the loaded resource table. Don't
	312	* call this function if the table wasn't loaded yet - it's a bug if you do.
	313	*
	314	* Returns the pointer to the resource table if it is found or NULL otherwise.
	315	* If the table wasn't loaded yet the result is unspecified.
	316	*/
0f21f9cc BA	317	struct resource_table rproc_elf_find_loaded_rsc_table(struct rproc rproc,
0f21f9cc BA	318	const struct firmware *fw)
95f95781 SB	319	{
	320	struct elf32_hdr ehdr = (struct elf32_hdr )fw->data;
	321	struct elf32_shdr *shdr;
	322
	323	shdr = find_table(&rproc->dev, ehdr, fw->size);
	324	if (!shdr)
	325	return NULL;
	326
	327	return rproc_da_to_va(rproc, shdr->sh_addr, shdr->sh_size);
	328	}
0f21f9cc	329	EXPORT_SYMBOL(rproc_elf_find_loaded_rsc_table);