Commit | Line | Data |
---|---|---|
1802d0be | 1 | // SPDX-License-Identifier: GPL-2.0-only |
72854fb0 | 2 | /* |
70e79866 | 3 | * Remote Processor Framework ELF loader |
72854fb0 SB |
4 | * |
5 | * Copyright (C) 2011 Texas Instruments, Inc. | |
6 | * Copyright (C) 2011 Google, Inc. | |
7 | * | |
8 | * Ohad Ben-Cohen <ohad@wizery.com> | |
9 | * Brian Swetland <swetland@google.com> | |
10 | * Mark Grosen <mgrosen@ti.com> | |
11 | * Fernando Guzman Lugo <fernando.lugo@ti.com> | |
12 | * Suman Anna <s-anna@ti.com> | |
13 | * Robert Tivy <rtivy@ti.com> | |
14 | * Armando Uribe De Leon <x0095078@ti.com> | |
15 | * Sjur Brændeland <sjur.brandeland@stericsson.com> | |
72854fb0 SB |
16 | */ |
17 | ||
18 | #define pr_fmt(fmt) "%s: " fmt, __func__ | |
19 | ||
20 | #include <linux/module.h> | |
21 | #include <linux/firmware.h> | |
22 | #include <linux/remoteproc.h> | |
23 | #include <linux/elf.h> | |
24 | ||
25 | #include "remoteproc_internal.h" | |
f31e339f | 26 | #include "remoteproc_elf_helpers.h" |
72854fb0 SB |
27 | |
28 | /** | |
f31e339f | 29 | * rproc_elf_sanity_check() - Sanity Check for ELF32/ELF64 firmware image |
72854fb0 SB |
30 | * @rproc: the remote processor handle |
31 | * @fw: the ELF firmware image | |
32 | * | |
f31e339f | 33 | * Make sure this fw image is sane (ie a correct ELF32/ELF64 file). |
f2867434 SA |
34 | * |
35 | * Return: 0 on success and -EINVAL upon any failure | |
72854fb0 | 36 | */ |
f31e339f | 37 | int rproc_elf_sanity_check(struct rproc *rproc, const struct firmware *fw) |
72854fb0 SB |
38 | { |
39 | const char *name = rproc->firmware; | |
40 | struct device *dev = &rproc->dev; | |
f31e339f | 41 | /* |
70e79866 | 42 | * ELF files are beginning with the same structure. Thus, to simplify |
f31e339f CL |
43 | * header parsing, we can use the elf32_hdr one for both elf64 and |
44 | * elf32. | |
45 | */ | |
72854fb0 | 46 | struct elf32_hdr *ehdr; |
f31e339f CL |
47 | u32 elf_shdr_get_size; |
48 | u64 phoff, shoff; | |
72854fb0 | 49 | char class; |
f31e339f | 50 | u16 phnum; |
72854fb0 SB |
51 | |
52 | if (!fw) { | |
53 | dev_err(dev, "failed to load %s\n", name); | |
54 | return -EINVAL; | |
55 | } | |
56 | ||
57 | if (fw->size < sizeof(struct elf32_hdr)) { | |
58 | dev_err(dev, "Image is too small\n"); | |
59 | return -EINVAL; | |
60 | } | |
61 | ||
62 | ehdr = (struct elf32_hdr *)fw->data; | |
63 | ||
f31e339f CL |
64 | if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG)) { |
65 | dev_err(dev, "Image is corrupted (bad magic)\n"); | |
66 | return -EINVAL; | |
67 | } | |
68 | ||
72854fb0 | 69 | class = ehdr->e_ident[EI_CLASS]; |
f31e339f | 70 | if (class != ELFCLASS32 && class != ELFCLASS64) { |
72854fb0 SB |
71 | dev_err(dev, "Unsupported class: %d\n", class); |
72 | return -EINVAL; | |
73 | } | |
74 | ||
f31e339f CL |
75 | if (class == ELFCLASS64 && fw->size < sizeof(struct elf64_hdr)) { |
76 | dev_err(dev, "elf64 header is too small\n"); | |
77 | return -EINVAL; | |
78 | } | |
79 | ||
9c768207 | 80 | /* We assume the firmware has the same endianness as the host */ |
72854fb0 SB |
81 | # ifdef __LITTLE_ENDIAN |
82 | if (ehdr->e_ident[EI_DATA] != ELFDATA2LSB) { | |
83 | # else /* BIG ENDIAN */ | |
84 | if (ehdr->e_ident[EI_DATA] != ELFDATA2MSB) { | |
85 | # endif | |
9c768207 | 86 | dev_err(dev, "Unsupported firmware endianness\n"); |
72854fb0 SB |
87 | return -EINVAL; |
88 | } | |
89 | ||
f31e339f CL |
90 | phoff = elf_hdr_get_e_phoff(class, fw->data); |
91 | shoff = elf_hdr_get_e_shoff(class, fw->data); | |
92 | phnum = elf_hdr_get_e_phnum(class, fw->data); | |
93 | elf_shdr_get_size = elf_size_of_shdr(class); | |
72854fb0 | 94 | |
f31e339f CL |
95 | if (fw->size < shoff + elf_shdr_get_size) { |
96 | dev_err(dev, "Image is too small\n"); | |
72854fb0 SB |
97 | return -EINVAL; |
98 | } | |
99 | ||
f31e339f | 100 | if (phnum == 0) { |
72854fb0 SB |
101 | dev_err(dev, "No loadable segments\n"); |
102 | return -EINVAL; | |
103 | } | |
104 | ||
f31e339f | 105 | if (phoff > fw->size) { |
72854fb0 SB |
106 | dev_err(dev, "Firmware size is too small\n"); |
107 | return -EINVAL; | |
108 | } | |
109 | ||
f31e339f CL |
110 | dev_dbg(dev, "Firmware is an elf%d file\n", |
111 | class == ELFCLASS32 ? 32 : 64); | |
112 | ||
72854fb0 SB |
113 | return 0; |
114 | } | |
f31e339f CL |
115 | EXPORT_SYMBOL(rproc_elf_sanity_check); |
116 | ||
72854fb0 | 117 | /** |
4afc89d6 | 118 | * rproc_elf_get_boot_addr() - Get rproc's boot address. |
72854fb0 SB |
119 | * @rproc: the remote processor handle |
120 | * @fw: the ELF firmware image | |
121 | * | |
72854fb0 SB |
122 | * Note that the boot address is not a configurable property of all remote |
123 | * processors. Some will always boot at a specific hard-coded address. | |
f2867434 SA |
124 | * |
125 | * Return: entry point address of the ELF image | |
126 | * | |
72854fb0 | 127 | */ |
e4ae4b7d | 128 | u64 rproc_elf_get_boot_addr(struct rproc *rproc, const struct firmware *fw) |
72854fb0 | 129 | { |
f31e339f | 130 | return elf_hdr_get_e_entry(fw_elf_get_class(fw), fw->data); |
72854fb0 | 131 | } |
0f21f9cc | 132 | EXPORT_SYMBOL(rproc_elf_get_boot_addr); |
72854fb0 SB |
133 | |
134 | /** | |
4afc89d6 | 135 | * rproc_elf_load_segments() - load firmware segments to memory |
72854fb0 SB |
136 | * @rproc: remote processor which will be booted using these fw segments |
137 | * @fw: the ELF firmware image | |
138 | * | |
139 | * This function loads the firmware segments to memory, where the remote | |
140 | * processor expects them. | |
141 | * | |
142 | * Some remote processors will expect their code and data to be placed | |
143 | * in specific device addresses, and can't have them dynamically assigned. | |
144 | * | |
145 | * We currently support only those kind of remote processors, and expect | |
146 | * the program header's paddr member to contain those addresses. We then go | |
147 | * through the physically contiguous "carveout" memory regions which we | |
148 | * allocated (and mapped) earlier on behalf of the remote processor, | |
149 | * and "translate" device address to kernel addresses, so we can copy the | |
150 | * segments where they are expected. | |
151 | * | |
152 | * Currently we only support remote processors that required carveout | |
153 | * allocations and got them mapped onto their iommus. Some processors | |
154 | * might be different: they might not have iommus, and would prefer to | |
155 | * directly allocate memory for every segment/resource. This is not yet | |
156 | * supported, though. | |
f2867434 SA |
157 | * |
158 | * Return: 0 on success and an appropriate error code otherwise | |
72854fb0 | 159 | */ |
0f21f9cc | 160 | int rproc_elf_load_segments(struct rproc *rproc, const struct firmware *fw) |
72854fb0 SB |
161 | { |
162 | struct device *dev = &rproc->dev; | |
f31e339f | 163 | const void *ehdr, *phdr; |
72854fb0 | 164 | int i, ret = 0; |
f31e339f | 165 | u16 phnum; |
72854fb0 | 166 | const u8 *elf_data = fw->data; |
f31e339f CL |
167 | u8 class = fw_elf_get_class(fw); |
168 | u32 elf_phdr_get_size = elf_size_of_phdr(class); | |
72854fb0 | 169 | |
f31e339f CL |
170 | ehdr = elf_data; |
171 | phnum = elf_hdr_get_e_phnum(class, ehdr); | |
172 | phdr = elf_data + elf_hdr_get_e_phoff(class, ehdr); | |
72854fb0 SB |
173 | |
174 | /* go through the available ELF segments */ | |
f31e339f CL |
175 | for (i = 0; i < phnum; i++, phdr += elf_phdr_get_size) { |
176 | u64 da = elf_phdr_get_p_paddr(class, phdr); | |
177 | u64 memsz = elf_phdr_get_p_memsz(class, phdr); | |
178 | u64 filesz = elf_phdr_get_p_filesz(class, phdr); | |
179 | u64 offset = elf_phdr_get_p_offset(class, phdr); | |
180 | u32 type = elf_phdr_get_p_type(class, phdr); | |
970675f6 | 181 | bool is_iomem = false; |
72854fb0 SB |
182 | void *ptr; |
183 | ||
f340d5a1 | 184 | if (type != PT_LOAD || !memsz) |
72854fb0 SB |
185 | continue; |
186 | ||
f31e339f CL |
187 | dev_dbg(dev, "phdr: type %d da 0x%llx memsz 0x%llx filesz 0x%llx\n", |
188 | type, da, memsz, filesz); | |
72854fb0 SB |
189 | |
190 | if (filesz > memsz) { | |
f31e339f | 191 | dev_err(dev, "bad phdr filesz 0x%llx memsz 0x%llx\n", |
730f84ce | 192 | filesz, memsz); |
72854fb0 SB |
193 | ret = -EINVAL; |
194 | break; | |
195 | } | |
196 | ||
197 | if (offset + filesz > fw->size) { | |
f31e339f | 198 | dev_err(dev, "truncated fw: need 0x%llx avail 0x%zx\n", |
730f84ce | 199 | offset + filesz, fw->size); |
72854fb0 SB |
200 | ret = -EINVAL; |
201 | break; | |
202 | } | |
203 | ||
f31e339f CL |
204 | if (!rproc_u64_fit_in_size_t(memsz)) { |
205 | dev_err(dev, "size (%llx) does not fit in size_t type\n", | |
206 | memsz); | |
207 | ret = -EOVERFLOW; | |
208 | break; | |
209 | } | |
210 | ||
72854fb0 | 211 | /* grab the kernel address for this device address */ |
40df0a91 | 212 | ptr = rproc_da_to_va(rproc, da, memsz, &is_iomem); |
72854fb0 | 213 | if (!ptr) { |
f31e339f CL |
214 | dev_err(dev, "bad phdr da 0x%llx mem 0x%llx\n", da, |
215 | memsz); | |
72854fb0 SB |
216 | ret = -EINVAL; |
217 | break; | |
218 | } | |
219 | ||
220 | /* put the segment where the remote processor expects it */ | |
40df0a91 PF |
221 | if (filesz) { |
222 | if (is_iomem) | |
24acbd9d | 223 | memcpy_toio((void __iomem *)ptr, elf_data + offset, filesz); |
40df0a91 PF |
224 | else |
225 | memcpy(ptr, elf_data + offset, filesz); | |
226 | } | |
72854fb0 SB |
227 | |
228 | /* | |
229 | * Zero out remaining memory for this segment. | |
230 | * | |
231 | * This isn't strictly required since dma_alloc_coherent already | |
232 | * did this for us. albeit harmless, we may consider removing | |
233 | * this. | |
234 | */ | |
40df0a91 PF |
235 | if (memsz > filesz) { |
236 | if (is_iomem) | |
237 | memset_io((void __iomem *)(ptr + filesz), 0, memsz - filesz); | |
238 | else | |
239 | memset(ptr + filesz, 0, memsz - filesz); | |
240 | } | |
72854fb0 SB |
241 | } |
242 | ||
243 | return ret; | |
244 | } | |
0f21f9cc | 245 | EXPORT_SYMBOL(rproc_elf_load_segments); |
72854fb0 | 246 | |
f31e339f CL |
247 | static const void * |
248 | find_table(struct device *dev, const struct firmware *fw) | |
72854fb0 | 249 | { |
f31e339f | 250 | const void *shdr, *name_table_shdr; |
f665b2cd | 251 | int i; |
72854fb0 | 252 | const char *name_table; |
72854fb0 | 253 | struct resource_table *table = NULL; |
f31e339f CL |
254 | const u8 *elf_data = (void *)fw->data; |
255 | u8 class = fw_elf_get_class(fw); | |
256 | size_t fw_size = fw->size; | |
257 | const void *ehdr = elf_data; | |
258 | u16 shnum = elf_hdr_get_e_shnum(class, ehdr); | |
259 | u32 elf_shdr_get_size = elf_size_of_shdr(class); | |
260 | u16 shstrndx = elf_hdr_get_e_shstrndx(class, ehdr); | |
72854fb0 | 261 | |
f665b2cd | 262 | /* look for the resource table and handle it */ |
f31e339f CL |
263 | /* First, get the section header according to the elf class */ |
264 | shdr = elf_data + elf_hdr_get_e_shoff(class, ehdr); | |
265 | /* Compute name table section header entry in shdr array */ | |
266 | name_table_shdr = shdr + (shstrndx * elf_shdr_get_size); | |
267 | /* Finally, compute the name table section address in elf */ | |
268 | name_table = elf_data + elf_shdr_get_sh_offset(class, name_table_shdr); | |
269 | ||
270 | for (i = 0; i < shnum; i++, shdr += elf_shdr_get_size) { | |
271 | u64 size = elf_shdr_get_sh_size(class, shdr); | |
272 | u64 offset = elf_shdr_get_sh_offset(class, shdr); | |
273 | u32 name = elf_shdr_get_sh_name(class, shdr); | |
274 | ||
275 | if (strcmp(name_table + name, ".resource_table")) | |
72854fb0 SB |
276 | continue; |
277 | ||
278 | table = (struct resource_table *)(elf_data + offset); | |
279 | ||
280 | /* make sure we have the entire table */ | |
f665b2cd | 281 | if (offset + size > fw_size || offset + size < size) { |
72854fb0 SB |
282 | dev_err(dev, "resource table truncated\n"); |
283 | return NULL; | |
284 | } | |
285 | ||
286 | /* make sure table has at least the header */ | |
287 | if (sizeof(struct resource_table) > size) { | |
288 | dev_err(dev, "header-less resource table\n"); | |
289 | return NULL; | |
290 | } | |
291 | ||
292 | /* we don't support any version beyond the first */ | |
293 | if (table->ver != 1) { | |
294 | dev_err(dev, "unsupported fw ver: %d\n", table->ver); | |
295 | return NULL; | |
296 | } | |
297 | ||
298 | /* make sure reserved bytes are zeroes */ | |
299 | if (table->reserved[0] || table->reserved[1]) { | |
300 | dev_err(dev, "non zero reserved bytes\n"); | |
301 | return NULL; | |
302 | } | |
303 | ||
304 | /* make sure the offsets array isn't truncated */ | |
77e5a448 | 305 | if (struct_size(table, offset, table->num) > size) { |
72854fb0 SB |
306 | dev_err(dev, "resource table incomplete\n"); |
307 | return NULL; | |
308 | } | |
309 | ||
f665b2cd | 310 | return shdr; |
72854fb0 SB |
311 | } |
312 | ||
f665b2cd SB |
313 | return NULL; |
314 | } | |
315 | ||
316 | /** | |
58b64090 | 317 | * rproc_elf_load_rsc_table() - load the resource table |
f665b2cd SB |
318 | * @rproc: the rproc handle |
319 | * @fw: the ELF firmware image | |
f665b2cd SB |
320 | * |
321 | * This function finds the resource table inside the remote processor's | |
58b64090 | 322 | * firmware, load it into the @cached_table and update @table_ptr. |
f665b2cd | 323 | * |
58b64090 | 324 | * Return: 0 on success, negative errno on failure. |
f665b2cd | 325 | */ |
58b64090 | 326 | int rproc_elf_load_rsc_table(struct rproc *rproc, const struct firmware *fw) |
f665b2cd | 327 | { |
f31e339f | 328 | const void *shdr; |
f665b2cd SB |
329 | struct device *dev = &rproc->dev; |
330 | struct resource_table *table = NULL; | |
331 | const u8 *elf_data = fw->data; | |
58b64090 | 332 | size_t tablesz; |
f31e339f CL |
333 | u8 class = fw_elf_get_class(fw); |
334 | u64 sh_offset; | |
f665b2cd | 335 | |
f31e339f | 336 | shdr = find_table(dev, fw); |
f665b2cd | 337 | if (!shdr) |
58b64090 | 338 | return -EINVAL; |
f665b2cd | 339 | |
f31e339f CL |
340 | sh_offset = elf_shdr_get_sh_offset(class, shdr); |
341 | table = (struct resource_table *)(elf_data + sh_offset); | |
342 | tablesz = elf_shdr_get_sh_size(class, shdr); | |
58b64090 BA |
343 | |
344 | /* | |
345 | * Create a copy of the resource table. When a virtio device starts | |
346 | * and calls vring_new_virtqueue() the address of the allocated vring | |
347 | * will be stored in the cached_table. Before the device is started, | |
348 | * cached_table will be copied into device memory. | |
349 | */ | |
350 | rproc->cached_table = kmemdup(table, tablesz, GFP_KERNEL); | |
351 | if (!rproc->cached_table) | |
352 | return -ENOMEM; | |
f665b2cd | 353 | |
58b64090 BA |
354 | rproc->table_ptr = rproc->cached_table; |
355 | rproc->table_sz = tablesz; | |
356 | ||
357 | return 0; | |
72854fb0 | 358 | } |
58b64090 | 359 | EXPORT_SYMBOL(rproc_elf_load_rsc_table); |
4afc89d6 | 360 | |
95f95781 SB |
361 | /** |
362 | * rproc_elf_find_loaded_rsc_table() - find the loaded resource table | |
363 | * @rproc: the rproc handle | |
364 | * @fw: the ELF firmware image | |
365 | * | |
366 | * This function finds the location of the loaded resource table. Don't | |
367 | * call this function if the table wasn't loaded yet - it's a bug if you do. | |
368 | * | |
f2867434 | 369 | * Return: pointer to the resource table if it is found or NULL otherwise. |
95f95781 SB |
370 | * If the table wasn't loaded yet the result is unspecified. |
371 | */ | |
0f21f9cc BA |
372 | struct resource_table *rproc_elf_find_loaded_rsc_table(struct rproc *rproc, |
373 | const struct firmware *fw) | |
95f95781 | 374 | { |
f31e339f CL |
375 | const void *shdr; |
376 | u64 sh_addr, sh_size; | |
377 | u8 class = fw_elf_get_class(fw); | |
378 | struct device *dev = &rproc->dev; | |
95f95781 | 379 | |
f31e339f | 380 | shdr = find_table(&rproc->dev, fw); |
95f95781 SB |
381 | if (!shdr) |
382 | return NULL; | |
383 | ||
f31e339f CL |
384 | sh_addr = elf_shdr_get_sh_addr(class, shdr); |
385 | sh_size = elf_shdr_get_sh_size(class, shdr); | |
386 | ||
387 | if (!rproc_u64_fit_in_size_t(sh_size)) { | |
388 | dev_err(dev, "size (%llx) does not fit in size_t type\n", | |
389 | sh_size); | |
390 | return NULL; | |
391 | } | |
392 | ||
40df0a91 | 393 | return rproc_da_to_va(rproc, sh_addr, sh_size, NULL); |
95f95781 | 394 | } |
0f21f9cc | 395 | EXPORT_SYMBOL(rproc_elf_find_loaded_rsc_table); |