remoteproc_elf_loader.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Remote Processor Framework Elf loader
  4. *
  5. * Copyright (C) 2011 Texas Instruments, Inc.
  6. * Copyright (C) 2011 Google, Inc.
  7. *
  8. * Ohad Ben-Cohen <ohad@wizery.com>
  9. * Brian Swetland <swetland@google.com>
  10. * Mark Grosen <mgrosen@ti.com>
  11. * Fernando Guzman Lugo <fernando.lugo@ti.com>
  12. * Suman Anna <s-anna@ti.com>
  13. * Robert Tivy <rtivy@ti.com>
  14. * Armando Uribe De Leon <x0095078@ti.com>
  15. * Sjur Brændeland <sjur.brandeland@stericsson.com>
  16. */
  17. #define pr_fmt(fmt) "%s: " fmt, __func__
  18. #include <linux/module.h>
  19. #include <linux/firmware.h>
  20. #include <linux/remoteproc.h>
  21. #include <linux/elf.h>
  22. #include "remoteproc_internal.h"
  23. #include "remoteproc_elf_helpers.h"
  24. /**
  25. * rproc_elf_sanity_check() - Sanity Check for ELF32/ELF64 firmware image
  26. * @rproc: the remote processor handle
  27. * @fw: the ELF firmware image
  28. *
  29. * Make sure this fw image is sane (ie a correct ELF32/ELF64 file).
  30. */
  31. int rproc_elf_sanity_check(struct rproc *rproc, const struct firmware *fw)
  32. {
  33. const char *name = rproc->firmware;
  34. struct device *dev = &rproc->dev;
  35. /*
  36. * Elf files are beginning with the same structure. Thus, to simplify
  37. * header parsing, we can use the elf32_hdr one for both elf64 and
  38. * elf32.
  39. */
  40. struct elf32_hdr *ehdr;
  41. u32 elf_shdr_get_size;
  42. u64 phoff, shoff;
  43. char class;
  44. u16 phnum;
  45. if (!fw) {
  46. dev_err(dev, "failed to load %s\n", name);
  47. return -EINVAL;
  48. }
  49. if (fw->size < sizeof(struct elf32_hdr)) {
  50. dev_err(dev, "Image is too small\n");
  51. return -EINVAL;
  52. }
  53. ehdr = (struct elf32_hdr *)fw->data;
  54. if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG)) {
  55. dev_err(dev, "Image is corrupted (bad magic)\n");
  56. return -EINVAL;
  57. }
  58. class = ehdr->e_ident[EI_CLASS];
  59. if (class != ELFCLASS32 && class != ELFCLASS64) {
  60. dev_err(dev, "Unsupported class: %d\n", class);
  61. return -EINVAL;
  62. }
  63. if (class == ELFCLASS64 && fw->size < sizeof(struct elf64_hdr)) {
  64. dev_err(dev, "elf64 header is too small\n");
  65. return -EINVAL;
  66. }
  67. /* We assume the firmware has the same endianness as the host */
  68. # ifdef __LITTLE_ENDIAN
  69. if (ehdr->e_ident[EI_DATA] != ELFDATA2LSB) {
  70. # else /* BIG ENDIAN */
  71. if (ehdr->e_ident[EI_DATA] != ELFDATA2MSB) {
  72. # endif
  73. dev_err(dev, "Unsupported firmware endianness\n");
  74. return -EINVAL;
  75. }
  76. phoff = elf_hdr_get_e_phoff(class, fw->data);
  77. shoff = elf_hdr_get_e_shoff(class, fw->data);
  78. phnum = elf_hdr_get_e_phnum(class, fw->data);
  79. elf_shdr_get_size = elf_size_of_shdr(class);
  80. if (fw->size < shoff + elf_shdr_get_size) {
  81. dev_err(dev, "Image is too small\n");
  82. return -EINVAL;
  83. }
  84. if (phnum == 0) {
  85. dev_err(dev, "No loadable segments\n");
  86. return -EINVAL;
  87. }
  88. if (phoff > fw->size) {
  89. dev_err(dev, "Firmware size is too small\n");
  90. return -EINVAL;
  91. }
  92. dev_dbg(dev, "Firmware is an elf%d file\n",
  93. class == ELFCLASS32 ? 32 : 64);
  94. return 0;
  95. }
  96. EXPORT_SYMBOL(rproc_elf_sanity_check);
  97. /**
  98. * rproc_elf_get_boot_addr() - Get rproc's boot address.
  99. * @rproc: the remote processor handle
  100. * @fw: the ELF firmware image
  101. *
  102. * This function returns the entry point address of the ELF
  103. * image.
  104. *
  105. * Note that the boot address is not a configurable property of all remote
  106. * processors. Some will always boot at a specific hard-coded address.
  107. */
  108. u64 rproc_elf_get_boot_addr(struct rproc *rproc, const struct firmware *fw)
  109. {
  110. return elf_hdr_get_e_entry(fw_elf_get_class(fw), fw->data);
  111. }
  112. EXPORT_SYMBOL(rproc_elf_get_boot_addr);
  113. /**
  114. * rproc_elf_load_segments() - load firmware segments to memory
  115. * @rproc: remote processor which will be booted using these fw segments
  116. * @fw: the ELF firmware image
  117. *
  118. * This function loads the firmware segments to memory, where the remote
  119. * processor expects them.
  120. *
  121. * Some remote processors will expect their code and data to be placed
  122. * in specific device addresses, and can't have them dynamically assigned.
  123. *
  124. * We currently support only those kind of remote processors, and expect
  125. * the program header's paddr member to contain those addresses. We then go
  126. * through the physically contiguous "carveout" memory regions which we
  127. * allocated (and mapped) earlier on behalf of the remote processor,
  128. * and "translate" device address to kernel addresses, so we can copy the
  129. * segments where they are expected.
  130. *
  131. * Currently we only support remote processors that required carveout
  132. * allocations and got them mapped onto their iommus. Some processors
  133. * might be different: they might not have iommus, and would prefer to
  134. * directly allocate memory for every segment/resource. This is not yet
  135. * supported, though.
  136. */
  137. int rproc_elf_load_segments(struct rproc *rproc, const struct firmware *fw)
  138. {
  139. struct device *dev = &rproc->dev;
  140. const void *ehdr, *phdr;
  141. int i, ret = 0;
  142. u16 phnum;
  143. const u8 *elf_data = fw->data;
  144. u8 class = fw_elf_get_class(fw);
  145. u32 elf_phdr_get_size = elf_size_of_phdr(class);
  146. ehdr = elf_data;
  147. phnum = elf_hdr_get_e_phnum(class, ehdr);
  148. phdr = elf_data + elf_hdr_get_e_phoff(class, ehdr);
  149. /* go through the available ELF segments */
  150. for (i = 0; i < phnum; i++, phdr += elf_phdr_get_size) {
  151. u64 da = elf_phdr_get_p_paddr(class, phdr);
  152. u64 memsz = elf_phdr_get_p_memsz(class, phdr);
  153. u64 filesz = elf_phdr_get_p_filesz(class, phdr);
  154. u64 offset = elf_phdr_get_p_offset(class, phdr);
  155. u32 type = elf_phdr_get_p_type(class, phdr);
  156. bool is_iomem = false;
  157. void *ptr;
  158. if (type != PT_LOAD)
  159. continue;
  160. dev_dbg(dev, "phdr: type %d da 0x%llx memsz 0x%llx filesz 0x%llx\n",
  161. type, da, memsz, filesz);
  162. if (filesz > memsz) {
  163. dev_err(dev, "bad phdr filesz 0x%llx memsz 0x%llx\n",
  164. filesz, memsz);
  165. ret = -EINVAL;
  166. break;
  167. }
  168. if (offset + filesz > fw->size) {
  169. dev_err(dev, "truncated fw: need 0x%llx avail 0x%zx\n",
  170. offset + filesz, fw->size);
  171. ret = -EINVAL;
  172. break;
  173. }
  174. if (!rproc_u64_fit_in_size_t(memsz)) {
  175. dev_err(dev, "size (%llx) does not fit in size_t type\n",
  176. memsz);
  177. ret = -EOVERFLOW;
  178. break;
  179. }
  180. /* grab the kernel address for this device address */
  181. ptr = rproc_da_to_va(rproc, da, memsz, &is_iomem);
  182. if (!ptr) {
  183. dev_err(dev, "bad phdr da 0x%llx mem 0x%llx\n", da,
  184. memsz);
  185. ret = -EINVAL;
  186. break;
  187. }
  188. /* put the segment where the remote processor expects it */
  189. if (filesz) {
  190. if (is_iomem)
  191. memcpy_toio((void __iomem *)ptr, elf_data + offset, filesz);
  192. else
  193. memcpy(ptr, elf_data + offset, filesz);
  194. }
  195. /*
  196. * Zero out remaining memory for this segment.
  197. *
  198. * This isn't strictly required since dma_alloc_coherent already
  199. * did this for us. albeit harmless, we may consider removing
  200. * this.
  201. */
  202. if (memsz > filesz) {
  203. if (is_iomem)
  204. memset_io((void __iomem *)(ptr + filesz), 0, memsz - filesz);
  205. else
  206. memset(ptr + filesz, 0, memsz - filesz);
  207. }
  208. }
  209. return ret;
  210. }
  211. EXPORT_SYMBOL(rproc_elf_load_segments);
  212. static const void *
  213. find_table(struct device *dev, const struct firmware *fw)
  214. {
  215. const void *shdr, *name_table_shdr;
  216. int i;
  217. const char *name_table;
  218. struct resource_table *table = NULL;
  219. const u8 *elf_data = (void *)fw->data;
  220. u8 class = fw_elf_get_class(fw);
  221. size_t fw_size = fw->size;
  222. const void *ehdr = elf_data;
  223. u16 shnum = elf_hdr_get_e_shnum(class, ehdr);
  224. u32 elf_shdr_get_size = elf_size_of_shdr(class);
  225. u16 shstrndx = elf_hdr_get_e_shstrndx(class, ehdr);
  226. /* look for the resource table and handle it */
  227. /* First, get the section header according to the elf class */
  228. shdr = elf_data + elf_hdr_get_e_shoff(class, ehdr);
  229. /* Compute name table section header entry in shdr array */
  230. name_table_shdr = shdr + (shstrndx * elf_shdr_get_size);
  231. /* Finally, compute the name table section address in elf */
  232. name_table = elf_data + elf_shdr_get_sh_offset(class, name_table_shdr);
  233. for (i = 0; i < shnum; i++, shdr += elf_shdr_get_size) {
  234. u64 size = elf_shdr_get_sh_size(class, shdr);
  235. u64 offset = elf_shdr_get_sh_offset(class, shdr);
  236. u32 name = elf_shdr_get_sh_name(class, shdr);
  237. if (strcmp(name_table + name, ".resource_table"))
  238. continue;
  239. table = (struct resource_table *)(elf_data + offset);
  240. /* make sure we have the entire table */
  241. if (offset + size > fw_size || offset + size < size) {
  242. dev_err(dev, "resource table truncated\n");
  243. return NULL;
  244. }
  245. /* make sure table has at least the header */
  246. if (sizeof(struct resource_table) > size) {
  247. dev_err(dev, "header-less resource table\n");
  248. return NULL;
  249. }
  250. /* we don't support any version beyond the first */
  251. if (table->ver != 1) {
  252. dev_err(dev, "unsupported fw ver: %d\n", table->ver);
  253. return NULL;
  254. }
  255. /* make sure reserved bytes are zeroes */
  256. if (table->reserved[0] || table->reserved[1]) {
  257. dev_err(dev, "non zero reserved bytes\n");
  258. return NULL;
  259. }
  260. /* make sure the offsets array isn't truncated */
  261. if (struct_size(table, offset, table->num) > size) {
  262. dev_err(dev, "resource table incomplete\n");
  263. return NULL;
  264. }
  265. return shdr;
  266. }
  267. return NULL;
  268. }
  269. /**
  270. * rproc_elf_load_rsc_table() - load the resource table
  271. * @rproc: the rproc handle
  272. * @fw: the ELF firmware image
  273. *
  274. * This function finds the resource table inside the remote processor's
  275. * firmware, load it into the @cached_table and update @table_ptr.
  276. *
  277. * Return: 0 on success, negative errno on failure.
  278. */
  279. int rproc_elf_load_rsc_table(struct rproc *rproc, const struct firmware *fw)
  280. {
  281. const void *shdr;
  282. struct device *dev = &rproc->dev;
  283. struct resource_table *table = NULL;
  284. const u8 *elf_data = fw->data;
  285. size_t tablesz;
  286. u8 class = fw_elf_get_class(fw);
  287. u64 sh_offset;
  288. shdr = find_table(dev, fw);
  289. if (!shdr)
  290. return -EINVAL;
  291. sh_offset = elf_shdr_get_sh_offset(class, shdr);
  292. table = (struct resource_table *)(elf_data + sh_offset);
  293. tablesz = elf_shdr_get_sh_size(class, shdr);
  294. /*
  295. * Create a copy of the resource table. When a virtio device starts
  296. * and calls vring_new_virtqueue() the address of the allocated vring
  297. * will be stored in the cached_table. Before the device is started,
  298. * cached_table will be copied into device memory.
  299. */
  300. rproc->cached_table = kmemdup(table, tablesz, GFP_KERNEL);
  301. if (!rproc->cached_table)
  302. return -ENOMEM;
  303. rproc->table_ptr = rproc->cached_table;
  304. rproc->table_sz = tablesz;
  305. return 0;
  306. }
  307. EXPORT_SYMBOL(rproc_elf_load_rsc_table);
  308. /**
  309. * rproc_elf_find_loaded_rsc_table() - find the loaded resource table
  310. * @rproc: the rproc handle
  311. * @fw: the ELF firmware image
  312. *
  313. * This function finds the location of the loaded resource table. Don't
  314. * call this function if the table wasn't loaded yet - it's a bug if you do.
  315. *
  316. * Returns the pointer to the resource table if it is found or NULL otherwise.
  317. * If the table wasn't loaded yet the result is unspecified.
  318. */
  319. struct resource_table *rproc_elf_find_loaded_rsc_table(struct rproc *rproc,
  320. const struct firmware *fw)
  321. {
  322. const void *shdr;
  323. u64 sh_addr, sh_size;
  324. u8 class = fw_elf_get_class(fw);
  325. struct device *dev = &rproc->dev;
  326. shdr = find_table(&rproc->dev, fw);
  327. if (!shdr)
  328. return NULL;
  329. sh_addr = elf_shdr_get_sh_addr(class, shdr);
  330. sh_size = elf_shdr_get_sh_size(class, shdr);
  331. if (!rproc_u64_fit_in_size_t(sh_size)) {
  332. dev_err(dev, "size (%llx) does not fit in size_t type\n",
  333. sh_size);
  334. return NULL;
  335. }
  336. return rproc_da_to_va(rproc, sh_addr, sh_size, NULL);
  337. }
  338. EXPORT_SYMBOL(rproc_elf_find_loaded_rsc_table);