blob: b18cbf799425bca8c815999ac3f21b17431ed2de [file] [log] [blame]
Arthur Heymansc82900b2018-01-10 12:48:16 +01001/*
Nikolai Artemievdd81c9a2020-10-15 13:47:56 +11002 * Copyright 2010, Google LLC.
Arthur Heymansc82900b2018-01-10 12:48:16 +01003 * Copyright 2018-present, Facebook Inc.
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions are
8 * met:
9 *
10 * * Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * * Redistributions in binary form must reproduce the above
13 * copyright notice, this list of conditions and the following disclaimer
14 * in the documentation and/or other materials provided with the
15 * distribution.
16 * * Neither the name of Google Inc. nor the names of its
17 * contributors may be used to endorse or promote products derived from
18 * this software without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
23 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
24 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
26 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 *
32 * Alternatively, this software may be distributed under the terms of the
33 * GNU General Public License ("GPL") version 2 as published by the Free
34 * Software Foundation.
35 */
36
37#include <ctype.h>
38#include <stdlib.h>
39#include <string.h>
40#include <sys/types.h>
41#include "flash.h"
42#include "fmap.h"
43
44static size_t fmap_size(const struct fmap *fmap)
45{
46 return sizeof(*fmap) + (fmap->nareas * sizeof(struct fmap_area));
47}
48
49static int is_valid_fmap(const struct fmap *fmap)
50{
51 if (memcmp(fmap, FMAP_SIGNATURE, strlen(FMAP_SIGNATURE)) != 0)
52 return 0;
53 /* strings containing the magic tend to fail here */
54 if (fmap->ver_major > FMAP_VER_MAJOR)
55 return 0;
56 if (fmap->ver_minor > FMAP_VER_MINOR)
57 return 0;
58 /* a basic consistency check: flash address space size should be larger
59 * than the size of the fmap data structure */
60 if (fmap->size < fmap_size(fmap))
61 return 0;
62
63 /* fmap-alikes along binary data tend to fail on having a valid,
64 * null-terminated string in the name field.*/
65 int i;
66 for (i = 0; i < FMAP_STRLEN; i++) {
67 if (fmap->name[i] == 0)
68 break;
69 if (!isgraph(fmap->name[i]))
70 return 0;
71 if (i == FMAP_STRLEN - 1) {
72 /* name is specified to be null terminated single-word string
73 * without spaces. We did not break in the 0 test, we know it
74 * is a printable spaceless string but we're seeing FMAP_STRLEN
75 * symbols, which is one too many.
76 */
77 return 0;
78 }
79 }
80 return 1;
81
82}
83
84/**
85 * @brief Do a brute-force linear search for fmap in provided buffer
86 *
87 * @param[in] buffer The buffer to search
88 * @param[in] len Length (in bytes) to search
89 *
90 * @return offset in buffer where fmap is found if successful
91 * -1 to indicate that fmap was not found
92 * -2 to indicate fmap is truncated or exceeds buffer + len
93 */
94static off_t fmap_lsearch(const uint8_t *buf, size_t len)
95{
96 off_t offset;
97 bool fmap_found = 0;
98
Nico Huber519be662018-12-23 20:03:35 +010099 for (offset = 0; offset <= (off_t)(len - sizeof(struct fmap)); offset++) {
Arthur Heymansc82900b2018-01-10 12:48:16 +0100100 if (is_valid_fmap((struct fmap *)&buf[offset])) {
101 fmap_found = 1;
102 break;
103 }
104 }
105
106 if (!fmap_found)
107 return -1;
108
109 if (offset + fmap_size((struct fmap *)&buf[offset]) > len) {
110 msg_gerr("fmap size exceeds buffer boundary.\n");
111 return -2;
112 }
113
114 return offset;
115}
116
117/**
118 * @brief Read fmap from provided buffer and copy it to fmap_out
119 *
120 * @param[out] fmap_out Double-pointer to location to store fmap contents.
121 * Caller must free allocated fmap contents.
122 * @param[in] buf Buffer to search
123 * @param[in] len Length (in bytes) to search
124 *
125 * @return 0 if successful
126 * 1 to indicate error
127 * 2 to indicate fmap is not found
128 */
129int fmap_read_from_buffer(struct fmap **fmap_out, const uint8_t *const buf, size_t len)
130{
131 off_t offset = fmap_lsearch(buf, len);
132 if (offset < 0) {
133 msg_gdbg("Unable to find fmap in provided buffer.\n");
134 return 2;
Arthur Heymansc82900b2018-01-10 12:48:16 +0100135 }
Elyes HAOUASe2764112019-06-09 17:09:25 +0200136 msg_gdbg("Found fmap at offset 0x%06zx\n", (size_t)offset);
Arthur Heymansc82900b2018-01-10 12:48:16 +0100137
138 const struct fmap *fmap = (const struct fmap *)(buf + offset);
139 *fmap_out = malloc(fmap_size(fmap));
140 if (*fmap_out == NULL) {
141 msg_gerr("Out of memory.\n");
142 return 1;
143 }
144
145 memcpy(*fmap_out, fmap, fmap_size(fmap));
146 return 0;
147}
148
149static int fmap_lsearch_rom(struct fmap **fmap_out,
150 struct flashctx *const flashctx, size_t rom_offset, size_t len)
151{
152 int ret = -1;
153 uint8_t *buf;
154
155 if (prepare_flash_access(flashctx, true, false, false, false))
156 goto _finalize_ret;
157
158 /* likely more memory than we need, but it simplifies handling and
159 * printing offsets to keep them uniform with what's on the ROM */
160 buf = malloc(rom_offset + len);
161 if (!buf) {
162 msg_gerr("Out of memory.\n");
163 goto _finalize_ret;
164 }
165
166 ret = flashctx->chip->read(flashctx, buf + rom_offset, rom_offset, len);
167 if (ret) {
168 msg_pdbg("Cannot read ROM contents.\n");
169 goto _free_ret;
170 }
171
172 ret = fmap_read_from_buffer(fmap_out, buf + rom_offset, len);
173_free_ret:
174 free(buf);
175_finalize_ret:
176 finalize_flash_access(flashctx);
177 return ret;
178}
179
180static int fmap_bsearch_rom(struct fmap **fmap_out, struct flashctx *const flashctx,
Nico Huber519be662018-12-23 20:03:35 +0100181 size_t rom_offset, size_t len, size_t min_stride)
Arthur Heymansc82900b2018-01-10 12:48:16 +0100182{
183 size_t stride, fmap_len = 0;
184 int ret = 1, fmap_found = 0, check_offset_0 = 1;
185 struct fmap *fmap;
186 const unsigned int chip_size = flashctx->chip->total_size * 1024;
187 const int sig_len = strlen(FMAP_SIGNATURE);
188
189 if (rom_offset + len > flashctx->chip->total_size * 1024)
190 return 1;
191
192 if (len < sizeof(*fmap))
193 return 1;
194
195 if (prepare_flash_access(flashctx, true, false, false, false))
196 return 1;
197
Angel Pons3bd47522021-06-07 12:33:53 +0200198 fmap = malloc(sizeof(*fmap));
Arthur Heymansc82900b2018-01-10 12:48:16 +0100199 if (!fmap) {
200 msg_gerr("Out of memory.\n");
201 goto _free_ret;
202 }
203
204 /*
205 * For efficient operation, we start with the largest stride possible
206 * and then decrease the stride on each iteration. Also, check for a
207 * remainder when modding the offset with the previous stride. This
208 * makes it so that each offset is only checked once.
209 *
210 * Zero (rom_offset == 0) is a special case and is handled using a
211 * variable to track whether or not we've checked it.
212 */
213 size_t offset;
214 for (stride = chip_size / 2; stride >= min_stride; stride /= 2) {
215 if (stride > len)
216 continue;
217
218 for (offset = rom_offset;
219 offset <= rom_offset + len - sizeof(struct fmap);
220 offset += stride) {
221 if ((offset % (stride * 2) == 0) && (offset != 0))
222 continue;
223 if (offset == 0 && !check_offset_0)
224 continue;
225 check_offset_0 = 0;
226
227 /* Read errors are considered non-fatal since we may
228 * encounter locked regions and want to continue. */
229 if (flashctx->chip->read(flashctx, (uint8_t *)fmap, offset, sig_len)) {
230 /*
231 * Print in verbose mode only to avoid excessive
232 * messages for benign errors. Subsequent error
233 * prints should be done as usual.
234 */
235 msg_cdbg("Cannot read %d bytes at offset %zu\n", sig_len, offset);
236 continue;
237 }
238
239 if (memcmp(fmap, FMAP_SIGNATURE, sig_len) != 0)
240 continue;
241
242 if (flashctx->chip->read(flashctx, (uint8_t *)fmap + sig_len,
243 offset + sig_len, sizeof(*fmap) - sig_len)) {
244 msg_cerr("Cannot read %zu bytes at offset %06zx\n",
Nico Huberba72e912018-12-11 12:10:04 +0100245 sizeof(*fmap) - sig_len, offset + sig_len);
Arthur Heymansc82900b2018-01-10 12:48:16 +0100246 continue;
247 }
248
249 if (is_valid_fmap(fmap)) {
250 msg_gdbg("fmap found at offset 0x%06zx\n", offset);
251 fmap_found = 1;
252 break;
Arthur Heymansc82900b2018-01-10 12:48:16 +0100253 }
Elyes HAOUASe2764112019-06-09 17:09:25 +0200254 msg_gerr("fmap signature found at %zu but header is invalid.\n", offset);
255 ret = 2;
Arthur Heymansc82900b2018-01-10 12:48:16 +0100256 }
257
258 if (fmap_found)
259 break;
260 }
261
262 if (!fmap_found)
263 goto _free_ret;
264
265 fmap_len = fmap_size(fmap);
266 struct fmap *tmp = fmap;
267 fmap = realloc(fmap, fmap_len);
268 if (!fmap) {
269 msg_gerr("Failed to realloc.\n");
270 free(tmp);
271 goto _free_ret;
272 }
273
274 if (flashctx->chip->read(flashctx, (uint8_t *)fmap + sizeof(*fmap),
275 offset + sizeof(*fmap), fmap_len - sizeof(*fmap))) {
276 msg_cerr("Cannot read %zu bytes at offset %06zx\n",
277 fmap_len - sizeof(*fmap), offset + sizeof(*fmap));
278 /* Treat read failure to be fatal since this
279 * should be a valid, usable fmap. */
280 ret = 2;
281 goto _free_ret;
282 }
283
284 *fmap_out = fmap;
285 ret = 0;
286_free_ret:
287 if (ret)
288 free(fmap);
289 finalize_flash_access(flashctx);
290 return ret;
291}
292
293/**
294 * @brief Read fmap from ROM
295 *
296 * @param[out] fmap_out Double-pointer to location to store fmap contents.
297 * Caller must free allocated fmap contents.
298 * @param[in] flashctx Flash context
299 * @param[in] rom_offset Offset in ROM to begin search
300 * @param[in] len Length to search relative to rom_offset
301 *
302 * @return 0 on success,
303 * 2 if the fmap couldn't be read,
304 * 1 on any other error.
305 */
306int fmap_read_from_rom(struct fmap **fmap_out,
307 struct flashctx *const flashctx, size_t rom_offset, size_t len)
308{
309 int ret;
310
311 if (!flashctx || !flashctx->chip)
312 return 1;
313
314 /*
315 * Binary search is used at first to see if we can find an fmap quickly
316 * in a usual location (often at a power-of-2 offset). However, once we
317 * reach a small enough stride the transaction overhead will reverse the
318 * speed benefit of using bsearch at which point we need to use brute-
319 * force instead.
320 *
321 * TODO: Since flashrom is often used with high-latency external
322 * programmers we should not be overly aggressive with bsearch.
323 */
324 ret = fmap_bsearch_rom(fmap_out, flashctx, rom_offset, len, 256);
325 if (ret) {
326 msg_gdbg("Binary search failed, trying linear search...\n");
327 ret = fmap_lsearch_rom(fmap_out, flashctx, rom_offset, len);
328 }
329
330 return ret;
331}