mdt_loader.c 8.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Qualcomm Peripheral Image Loader
  4. *
  5. * Copyright (C) 2016 Linaro Ltd
  6. * Copyright (C) 2015 Sony Mobile Communications Inc
  7. * Copyright (c) 2012-2013, The Linux Foundation. All rights reserved.
  8. */
  9. #include <linux/device.h>
  10. #include <linux/elf.h>
  11. #include <linux/firmware.h>
  12. #include <linux/kernel.h>
  13. #include <linux/module.h>
  14. #include <linux/qcom_scm.h>
  15. #include <linux/sizes.h>
  16. #include <linux/slab.h>
  17. #include <linux/soc/qcom/mdt_loader.h>
  18. static bool mdt_phdr_valid(const struct elf32_phdr *phdr)
  19. {
  20. if (phdr->p_type != PT_LOAD)
  21. return false;
  22. if ((phdr->p_flags & QCOM_MDT_TYPE_MASK) == QCOM_MDT_TYPE_HASH)
  23. return false;
  24. if (!phdr->p_memsz)
  25. return false;
  26. return true;
  27. }
  28. /**
  29. * qcom_mdt_get_size() - acquire size of the memory region needed to load mdt
  30. * @fw: firmware object for the mdt file
  31. *
  32. * Returns size of the loaded firmware blob, or -EINVAL on failure.
  33. */
  34. ssize_t qcom_mdt_get_size(const struct firmware *fw)
  35. {
  36. const struct elf32_phdr *phdrs;
  37. const struct elf32_phdr *phdr;
  38. const struct elf32_hdr *ehdr;
  39. phys_addr_t min_addr = PHYS_ADDR_MAX;
  40. phys_addr_t max_addr = 0;
  41. int i;
  42. ehdr = (struct elf32_hdr *)fw->data;
  43. phdrs = (struct elf32_phdr *)(ehdr + 1);
  44. for (i = 0; i < ehdr->e_phnum; i++) {
  45. phdr = &phdrs[i];
  46. if (!mdt_phdr_valid(phdr))
  47. continue;
  48. if (phdr->p_paddr < min_addr)
  49. min_addr = phdr->p_paddr;
  50. if (phdr->p_paddr + phdr->p_memsz > max_addr)
  51. max_addr = ALIGN(phdr->p_paddr + phdr->p_memsz, SZ_4K);
  52. }
  53. return min_addr < max_addr ? max_addr - min_addr : -EINVAL;
  54. }
  55. EXPORT_SYMBOL_GPL(qcom_mdt_get_size);
  56. /**
  57. * qcom_mdt_read_metadata() - read header and metadata from mdt or mbn
  58. * @fw: firmware of mdt header or mbn
  59. * @data_len: length of the read metadata blob
  60. *
  61. * The mechanism that performs the authentication of the loading firmware
  62. * expects an ELF header directly followed by the segment of hashes, with no
  63. * padding inbetween. This function allocates a chunk of memory for this pair
  64. * and copy the two pieces into the buffer.
  65. *
  66. * In the case of split firmware the hash is found directly following the ELF
  67. * header, rather than at p_offset described by the second program header.
  68. *
  69. * The caller is responsible to free (kfree()) the returned pointer.
  70. *
  71. * Return: pointer to data, or ERR_PTR()
  72. */
  73. void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len)
  74. {
  75. const struct elf32_phdr *phdrs;
  76. const struct elf32_hdr *ehdr;
  77. size_t hash_offset;
  78. size_t hash_size;
  79. size_t ehdr_size;
  80. void *data;
  81. ehdr = (struct elf32_hdr *)fw->data;
  82. phdrs = (struct elf32_phdr *)(ehdr + 1);
  83. if (ehdr->e_phnum < 2)
  84. return ERR_PTR(-EINVAL);
  85. if (phdrs[0].p_type == PT_LOAD)
  86. return ERR_PTR(-EINVAL);
  87. if ((phdrs[1].p_flags & QCOM_MDT_TYPE_MASK) != QCOM_MDT_TYPE_HASH)
  88. return ERR_PTR(-EINVAL);
  89. ehdr_size = phdrs[0].p_filesz;
  90. hash_size = phdrs[1].p_filesz;
  91. data = kmalloc(ehdr_size + hash_size, GFP_KERNEL);
  92. if (!data)
  93. return ERR_PTR(-ENOMEM);
  94. /* Is the header and hash already packed */
  95. if (ehdr_size + hash_size == fw->size)
  96. hash_offset = phdrs[0].p_filesz;
  97. else
  98. hash_offset = phdrs[1].p_offset;
  99. memcpy(data, fw->data, ehdr_size);
  100. memcpy(data + ehdr_size, fw->data + hash_offset, hash_size);
  101. *data_len = ehdr_size + hash_size;
  102. return data;
  103. }
  104. EXPORT_SYMBOL_GPL(qcom_mdt_read_metadata);
  105. static int __qcom_mdt_load(struct device *dev, const struct firmware *fw,
  106. const char *firmware, int pas_id, void *mem_region,
  107. phys_addr_t mem_phys, size_t mem_size,
  108. phys_addr_t *reloc_base, bool pas_init)
  109. {
  110. const struct elf32_phdr *phdrs;
  111. const struct elf32_phdr *phdr;
  112. const struct elf32_hdr *ehdr;
  113. const struct firmware *seg_fw;
  114. phys_addr_t mem_reloc;
  115. phys_addr_t min_addr = PHYS_ADDR_MAX;
  116. phys_addr_t max_addr = 0;
  117. size_t metadata_len;
  118. size_t fw_name_len;
  119. ssize_t offset;
  120. void *metadata;
  121. char *fw_name;
  122. bool relocate = false;
  123. void *ptr;
  124. int ret = 0;
  125. int i;
  126. if (!fw || !mem_region || !mem_phys || !mem_size)
  127. return -EINVAL;
  128. ehdr = (struct elf32_hdr *)fw->data;
  129. phdrs = (struct elf32_phdr *)(ehdr + 1);
  130. fw_name_len = strlen(firmware);
  131. if (fw_name_len <= 4)
  132. return -EINVAL;
  133. fw_name = kstrdup(firmware, GFP_KERNEL);
  134. if (!fw_name)
  135. return -ENOMEM;
  136. if (pas_init) {
  137. metadata = qcom_mdt_read_metadata(fw, &metadata_len);
  138. if (IS_ERR(metadata)) {
  139. ret = PTR_ERR(metadata);
  140. goto out;
  141. }
  142. ret = qcom_scm_pas_init_image(pas_id, metadata, metadata_len);
  143. kfree(metadata);
  144. if (ret) {
  145. dev_err(dev, "invalid firmware metadata\n");
  146. goto out;
  147. }
  148. }
  149. for (i = 0; i < ehdr->e_phnum; i++) {
  150. phdr = &phdrs[i];
  151. if (!mdt_phdr_valid(phdr))
  152. continue;
  153. if (phdr->p_flags & QCOM_MDT_RELOCATABLE)
  154. relocate = true;
  155. if (phdr->p_paddr < min_addr)
  156. min_addr = phdr->p_paddr;
  157. if (phdr->p_paddr + phdr->p_memsz > max_addr)
  158. max_addr = ALIGN(phdr->p_paddr + phdr->p_memsz, SZ_4K);
  159. }
  160. if (relocate) {
  161. if (pas_init) {
  162. ret = qcom_scm_pas_mem_setup(pas_id, mem_phys,
  163. max_addr - min_addr);
  164. if (ret) {
  165. dev_err(dev, "unable to setup relocation\n");
  166. goto out;
  167. }
  168. }
  169. /*
  170. * The image is relocatable, so offset each segment based on
  171. * the lowest segment address.
  172. */
  173. mem_reloc = min_addr;
  174. } else {
  175. /*
  176. * Image is not relocatable, so offset each segment based on
  177. * the allocated physical chunk of memory.
  178. */
  179. mem_reloc = mem_phys;
  180. }
  181. for (i = 0; i < ehdr->e_phnum; i++) {
  182. phdr = &phdrs[i];
  183. if (!mdt_phdr_valid(phdr))
  184. continue;
  185. offset = phdr->p_paddr - mem_reloc;
  186. if (offset < 0 || offset + phdr->p_memsz > mem_size) {
  187. dev_err(dev, "segment outside memory range\n");
  188. ret = -EINVAL;
  189. break;
  190. }
  191. if (phdr->p_filesz > phdr->p_memsz) {
  192. dev_err(dev,
  193. "refusing to load segment %d with p_filesz > p_memsz\n",
  194. i);
  195. ret = -EINVAL;
  196. break;
  197. }
  198. ptr = mem_region + offset;
  199. if (phdr->p_filesz && phdr->p_offset < fw->size) {
  200. /* Firmware is large enough to be non-split */
  201. if (phdr->p_offset + phdr->p_filesz > fw->size) {
  202. dev_err(dev,
  203. "failed to load segment %d from truncated file %s\n",
  204. i, firmware);
  205. ret = -EINVAL;
  206. break;
  207. }
  208. memcpy(ptr, fw->data + phdr->p_offset, phdr->p_filesz);
  209. } else if (phdr->p_filesz) {
  210. /* Firmware not large enough, load split-out segments */
  211. sprintf(fw_name + fw_name_len - 3, "b%02d", i);
  212. ret = request_firmware_into_buf(&seg_fw, fw_name, dev,
  213. ptr, phdr->p_filesz);
  214. if (ret) {
  215. dev_err(dev, "failed to load %s\n", fw_name);
  216. break;
  217. }
  218. if (seg_fw->size != phdr->p_filesz) {
  219. dev_err(dev,
  220. "failed to load segment %d from truncated file %s\n",
  221. i, fw_name);
  222. release_firmware(seg_fw);
  223. ret = -EINVAL;
  224. break;
  225. }
  226. release_firmware(seg_fw);
  227. }
  228. if (phdr->p_memsz > phdr->p_filesz)
  229. memset(ptr + phdr->p_filesz, 0, phdr->p_memsz - phdr->p_filesz);
  230. }
  231. if (reloc_base)
  232. *reloc_base = mem_reloc;
  233. out:
  234. kfree(fw_name);
  235. return ret;
  236. }
  237. /**
  238. * qcom_mdt_load() - load the firmware which header is loaded as fw
  239. * @dev: device handle to associate resources with
  240. * @fw: firmware object for the mdt file
  241. * @firmware: name of the firmware, for construction of segment file names
  242. * @pas_id: PAS identifier
  243. * @mem_region: allocated memory region to load firmware into
  244. * @mem_phys: physical address of allocated memory region
  245. * @mem_size: size of the allocated memory region
  246. * @reloc_base: adjusted physical address after relocation
  247. *
  248. * Returns 0 on success, negative errno otherwise.
  249. */
  250. int qcom_mdt_load(struct device *dev, const struct firmware *fw,
  251. const char *firmware, int pas_id, void *mem_region,
  252. phys_addr_t mem_phys, size_t mem_size,
  253. phys_addr_t *reloc_base)
  254. {
  255. return __qcom_mdt_load(dev, fw, firmware, pas_id, mem_region, mem_phys,
  256. mem_size, reloc_base, true);
  257. }
  258. EXPORT_SYMBOL_GPL(qcom_mdt_load);
  259. /**
  260. * qcom_mdt_load_no_init() - load the firmware which header is loaded as fw
  261. * @dev: device handle to associate resources with
  262. * @fw: firmware object for the mdt file
  263. * @firmware: name of the firmware, for construction of segment file names
  264. * @pas_id: PAS identifier
  265. * @mem_region: allocated memory region to load firmware into
  266. * @mem_phys: physical address of allocated memory region
  267. * @mem_size: size of the allocated memory region
  268. * @reloc_base: adjusted physical address after relocation
  269. *
  270. * Returns 0 on success, negative errno otherwise.
  271. */
  272. int qcom_mdt_load_no_init(struct device *dev, const struct firmware *fw,
  273. const char *firmware, int pas_id,
  274. void *mem_region, phys_addr_t mem_phys,
  275. size_t mem_size, phys_addr_t *reloc_base)
  276. {
  277. return __qcom_mdt_load(dev, fw, firmware, pas_id, mem_region, mem_phys,
  278. mem_size, reloc_base, false);
  279. }
  280. EXPORT_SYMBOL_GPL(qcom_mdt_load_no_init);
  281. MODULE_DESCRIPTION("Firmware parser for Qualcomm MDT format");
  282. MODULE_LICENSE("GPL v2");