1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * PCI ROM access routines 4 * 5 * (C) Copyright 2004 Jon Smirl <jonsmirl@yahoo.com> 6 * (C) Copyright 2004 Silicon Graphics, Inc. Jesse Barnes <jbarnes@sgi.com> 7 */ 8 9 #include <linux/align.h> 10 #include <linux/bits.h> 11 #include <linux/kernel.h> 12 #include <linux/export.h> 13 #include <linux/io.h> 14 #include <linux/overflow.h> 15 #include <linux/pci.h> 16 #include <linux/sizes.h> 17 #include <linux/slab.h> 18 19 #include "pci.h" 20 21 #define PCI_ROM_HEADER_SIZE 0x1A 22 #define PCI_ROM_POINTER_TO_DATA_STRUCT 0x18 23 #define PCI_ROM_LAST_IMAGE_INDICATOR 0x15 24 #define PCI_ROM_LAST_IMAGE_INDICATOR_BIT BIT(7) 25 #define PCI_ROM_IMAGE_LEN 0x10 26 #define PCI_ROM_IMAGE_SECTOR_SIZE SZ_512 27 #define PCI_ROM_IMAGE_SIGNATURE 0xAA55 28 29 /* Data structure signature is "PCIR" in ASCII representation */ 30 #define PCI_ROM_DATA_STRUCT_SIGNATURE 0x52494350 31 #define PCI_ROM_DATA_STRUCT_LEN 0x0A 32 33 /* 34 * Per PCI Firmware r3.3, sec 5.1.3, a conformant PCI Data Structure is at 35 * least 24 bytes (0x18), large enough to cover every fixed field this 36 * driver reads (up to the Indicator byte at offset 0x15). Reject smaller 37 * device-claimed lengths so the follow-up readers in pci_get_rom_size() 38 * cannot escape the mapped ROM window. 39 */ 40 #define PCI_ROM_DATA_STRUCT_MIN_LEN 0x18 41 42 /** 43 * pci_enable_rom - enable ROM decoding for a PCI device 44 * @pdev: PCI device to enable 45 * 46 * Enable ROM decoding on @dev. This involves simply turning on the last 47 * bit of the PCI ROM BAR. Note that some cards may share address decoders 48 * between the ROM and other resources, so enabling it may disable access 49 * to MMIO registers or other card memory. 50 */ 51 int pci_enable_rom(struct pci_dev *pdev) 52 { 53 struct resource *res = &pdev->resource[PCI_ROM_RESOURCE]; 54 struct pci_bus_region region; 55 u32 rom_addr; 56 57 if (!res->flags) 58 return -1; 59 60 /* Nothing to enable if we're using a shadow copy in RAM */ 61 if (res->flags & IORESOURCE_ROM_SHADOW) 62 return 0; 63 64 /* 65 * Ideally pci_update_resource() would update the ROM BAR address, 66 * and we would only set the enable bit here. But apparently some 67 * devices have buggy ROM BARs that read as zero when disabled. 68 */ 69 pcibios_resource_to_bus(pdev->bus, ®ion, res); 70 pci_read_config_dword(pdev, pdev->rom_base_reg, &rom_addr); 71 rom_addr &= ~PCI_ROM_ADDRESS_MASK; 72 rom_addr |= region.start | PCI_ROM_ADDRESS_ENABLE; 73 pci_write_config_dword(pdev, pdev->rom_base_reg, rom_addr); 74 return 0; 75 } 76 EXPORT_SYMBOL_GPL(pci_enable_rom); 77 78 /** 79 * pci_disable_rom - disable ROM decoding for a PCI device 80 * @pdev: PCI device to disable 81 * 82 * Disable ROM decoding on a PCI device by turning off the last bit in the 83 * ROM BAR. 84 */ 85 void pci_disable_rom(struct pci_dev *pdev) 86 { 87 struct resource *res = &pdev->resource[PCI_ROM_RESOURCE]; 88 u32 rom_addr; 89 90 if (res->flags & IORESOURCE_ROM_SHADOW) 91 return; 92 93 pci_read_config_dword(pdev, pdev->rom_base_reg, &rom_addr); 94 rom_addr &= ~PCI_ROM_ADDRESS_ENABLE; 95 pci_write_config_dword(pdev, pdev->rom_base_reg, rom_addr); 96 } 97 EXPORT_SYMBOL_GPL(pci_disable_rom); 98 99 static bool pci_rom_header_valid(struct pci_dev *pdev, void __iomem *image, 100 void __iomem *rom, size_t size, 101 bool expect_valid) 102 { 103 unsigned long rom_end = (unsigned long)rom + size - 1; 104 unsigned long header_end; 105 u16 signature; 106 107 /* 108 * Per PCI Firmware r3.3, sec 5.1, each image must start on a 109 * 512-byte boundary and must contain the PCI Expansion ROM header. 110 * Because @rom is page-aligned (returned by ioremap()), checking 111 * 512-byte alignment of @image is equivalent to enforcing the 112 * spec's sector-aligned layout within the ROM. This also 113 * satisfies the natural-alignment requirement of readw() on archs 114 * such as arm64 that disallow unaligned IOMEM access. 115 */ 116 if (!IS_ALIGNED((unsigned long)image, PCI_ROM_IMAGE_SECTOR_SIZE)) 117 return false; 118 119 if (check_add_overflow((unsigned long)image, PCI_ROM_HEADER_SIZE - 1, 120 &header_end)) 121 return false; 122 123 if (image < rom || header_end > rom_end) 124 return false; 125 126 /* Standard PCI ROMs start out with these bytes 55 AA */ 127 signature = readw(image); 128 if (signature != PCI_ROM_IMAGE_SIGNATURE) { 129 if (expect_valid) { 130 pci_info(pdev, "Invalid PCI ROM header signature: expecting %#06x, got %#06x\n", 131 PCI_ROM_IMAGE_SIGNATURE, signature); 132 } else { 133 pci_info(pdev, "No more images in PCI ROM\n"); 134 } 135 return false; 136 } 137 138 return true; 139 } 140 141 static bool pci_rom_data_struct_valid(struct pci_dev *pdev, void __iomem *pds, 142 void __iomem *rom, size_t size) 143 { 144 unsigned long rom_end = (unsigned long)rom + size - 1; 145 unsigned long end; 146 u32 signature; 147 u16 data_len; 148 149 /* 150 * Some CPU architectures require IOMEM access addresses to be 151 * aligned, for example arm64, so since we're about to call 152 * readl(), check here for 4-byte alignment. 153 */ 154 if (!IS_ALIGNED((unsigned long)pds, 4)) 155 return false; 156 157 if (check_add_overflow((unsigned long)pds, PCI_ROM_DATA_STRUCT_LEN + 1, 158 &end)) 159 return false; 160 161 if (pds < rom || end > rom_end) 162 return false; 163 164 signature = readl(pds); 165 if (signature != PCI_ROM_DATA_STRUCT_SIGNATURE) { 166 pci_info(pdev, "Invalid PCI ROM data signature: expecting %#010x, got %#010x\n", 167 PCI_ROM_DATA_STRUCT_SIGNATURE, signature); 168 return false; 169 } 170 171 data_len = readw(pds + PCI_ROM_DATA_STRUCT_LEN); 172 if (data_len < PCI_ROM_DATA_STRUCT_MIN_LEN || data_len == U16_MAX) 173 return false; 174 175 if (check_add_overflow((unsigned long)pds, data_len - 1, &end)) 176 return false; 177 178 if (end > rom_end) 179 return false; 180 181 return true; 182 } 183 184 /** 185 * pci_get_rom_size - obtain the actual size of the ROM image 186 * @pdev: target PCI device 187 * @rom: kernel virtual pointer to image of ROM 188 * @size: size of PCI window 189 * return: size of actual ROM image 190 * 191 * Determine the actual length of the ROM image. 192 * The PCI window size could be much larger than the 193 * actual image size. 194 */ 195 static size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, 196 size_t size) 197 { 198 void __iomem *image; 199 unsigned int length; 200 bool last_image; 201 202 image = rom; 203 do { 204 void __iomem *pds; 205 if (!pci_rom_header_valid(pdev, image, rom, size, true)) 206 break; 207 208 /* Get the PCI data structure and check its "PCIR" signature */ 209 pds = image + readw(image + PCI_ROM_POINTER_TO_DATA_STRUCT); 210 if (!pci_rom_data_struct_valid(pdev, pds, rom, size)) 211 break; 212 213 last_image = readb(pds + PCI_ROM_LAST_IMAGE_INDICATOR) & 214 PCI_ROM_LAST_IMAGE_INDICATOR_BIT; 215 length = readw(pds + PCI_ROM_IMAGE_LEN); 216 image += length * PCI_ROM_IMAGE_SECTOR_SIZE; 217 218 if (!last_image && 219 !pci_rom_header_valid(pdev, image, rom, size, false)) 220 break; 221 } while (length && !last_image); 222 223 /* never return a size larger than the PCI resource window */ 224 /* there are known ROMs that get the size wrong */ 225 return min((size_t)(image - rom), size); 226 } 227 228 /** 229 * pci_map_rom - map a PCI ROM to kernel space 230 * @pdev: pointer to pci device struct 231 * @size: pointer to receive size of pci window over ROM 232 * 233 * Return: kernel virtual pointer to image of ROM 234 * 235 * Map a PCI ROM into kernel space. If ROM is boot video ROM, 236 * the shadow BIOS copy will be returned instead of the 237 * actual ROM. 238 */ 239 void __iomem *pci_map_rom(struct pci_dev *pdev, size_t *size) 240 { 241 struct resource *res = &pdev->resource[PCI_ROM_RESOURCE]; 242 loff_t start; 243 void __iomem *rom; 244 245 /* assign the ROM an address if it doesn't have one */ 246 if (res->parent == NULL && pci_assign_resource(pdev, PCI_ROM_RESOURCE)) 247 return NULL; 248 249 start = pci_resource_start(pdev, PCI_ROM_RESOURCE); 250 *size = pci_resource_len(pdev, PCI_ROM_RESOURCE); 251 if (*size == 0) 252 return NULL; 253 254 /* Enable ROM space decodes */ 255 if (pci_enable_rom(pdev)) 256 return NULL; 257 258 rom = ioremap(start, *size); 259 if (!rom) 260 goto err_ioremap; 261 262 /* 263 * Try to find the true size of the ROM since sometimes the PCI window 264 * size is much larger than the actual size of the ROM. 265 * True size is important if the ROM is going to be copied. 266 */ 267 *size = pci_get_rom_size(pdev, rom, *size); 268 if (!*size) 269 goto invalid_rom; 270 271 return rom; 272 273 invalid_rom: 274 iounmap(rom); 275 err_ioremap: 276 /* restore enable if ioremap fails */ 277 if (!(res->flags & IORESOURCE_ROM_ENABLE)) 278 pci_disable_rom(pdev); 279 return NULL; 280 } 281 EXPORT_SYMBOL(pci_map_rom); 282 283 /** 284 * pci_unmap_rom - unmap the ROM from kernel space 285 * @pdev: pointer to pci device struct 286 * @rom: virtual address of the previous mapping 287 * 288 * Remove a mapping of a previously mapped ROM 289 */ 290 void pci_unmap_rom(struct pci_dev *pdev, void __iomem *rom) 291 { 292 struct resource *res = &pdev->resource[PCI_ROM_RESOURCE]; 293 294 iounmap(rom); 295 296 /* Disable again before continuing */ 297 if (!(res->flags & IORESOURCE_ROM_ENABLE)) 298 pci_disable_rom(pdev); 299 } 300 EXPORT_SYMBOL(pci_unmap_rom); 301