1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * EFI capsule support. |
4 | * |
5 | * Copyright 2013 Intel Corporation; author Matt Fleming |
6 | */ |
7 | |
8 | #define pr_fmt(fmt) "efi: " fmt |
9 | |
10 | #include <linux/slab.h> |
11 | #include <linux/mutex.h> |
12 | #include <linux/highmem.h> |
13 | #include <linux/efi.h> |
14 | #include <linux/vmalloc.h> |
15 | #include <asm/efi.h> |
16 | #include <asm/io.h> |
17 | |
18 | typedef struct { |
19 | u64 length; |
20 | u64 data; |
21 | } efi_capsule_block_desc_t; |
22 | |
23 | static bool capsule_pending; |
24 | static bool stop_capsules; |
25 | static int efi_reset_type = -1; |
26 | |
27 | /* |
28 | * capsule_mutex serialises access to both capsule_pending and |
29 | * efi_reset_type and stop_capsules. |
30 | */ |
31 | static DEFINE_MUTEX(capsule_mutex); |
32 | |
33 | /** |
34 | * efi_capsule_pending - has a capsule been passed to the firmware? |
35 | * @reset_type: store the type of EFI reset if capsule is pending |
36 | * |
37 | * To ensure that the registered capsule is processed correctly by the |
38 | * firmware we need to perform a specific type of reset. If a capsule is |
39 | * pending return the reset type in @reset_type. |
40 | * |
41 | * This function will race with callers of efi_capsule_update(), for |
42 | * example, calling this function while somebody else is in |
43 | * efi_capsule_update() but hasn't reached efi_capsue_update_locked() |
44 | * will miss the updates to capsule_pending and efi_reset_type after |
45 | * efi_capsule_update_locked() completes. |
46 | * |
47 | * A non-racy use is from platform reboot code because we use |
48 | * system_state to ensure no capsules can be sent to the firmware once |
49 | * we're at SYSTEM_RESTART. See efi_capsule_update_locked(). |
50 | */ |
51 | bool efi_capsule_pending(int *reset_type) |
52 | { |
53 | if (!capsule_pending) |
54 | return false; |
55 | |
56 | if (reset_type) |
57 | *reset_type = efi_reset_type; |
58 | |
59 | return true; |
60 | } |
61 | |
62 | /* |
63 | * Whitelist of EFI capsule flags that we support. |
64 | * |
65 | * We do not handle EFI_CAPSULE_INITIATE_RESET because that would |
66 | * require us to prepare the kernel for reboot. Refuse to load any |
67 | * capsules with that flag and any other flags that we do not know how |
68 | * to handle. |
69 | */ |
70 | #define EFI_CAPSULE_SUPPORTED_FLAG_MASK \ |
71 | (EFI_CAPSULE_PERSIST_ACROSS_RESET | EFI_CAPSULE_POPULATE_SYSTEM_TABLE) |
72 | |
73 | /** |
74 | * efi_capsule_supported - does the firmware support the capsule? |
75 | * @guid: vendor guid of capsule |
76 | * @flags: capsule flags |
77 | * @size: size of capsule data |
78 | * @reset: the reset type required for this capsule |
79 | * |
80 | * Check whether a capsule with @flags is supported by the firmware |
81 | * and that @size doesn't exceed the maximum size for a capsule. |
82 | * |
83 | * No attempt is made to check @reset against the reset type required |
84 | * by any pending capsules because of the races involved. |
85 | */ |
86 | int efi_capsule_supported(efi_guid_t guid, u32 flags, size_t size, int *reset) |
87 | { |
88 | efi_capsule_header_t capsule; |
89 | efi_capsule_header_t *cap_list[] = { &capsule }; |
90 | efi_status_t status; |
91 | u64 max_size; |
92 | |
93 | if (flags & ~EFI_CAPSULE_SUPPORTED_FLAG_MASK) |
94 | return -EINVAL; |
95 | |
96 | capsule.headersize = capsule.imagesize = sizeof(capsule); |
97 | memcpy(&capsule.guid, &guid, sizeof(efi_guid_t)); |
98 | capsule.flags = flags; |
99 | |
100 | status = efi.query_capsule_caps(cap_list, 1, &max_size, reset); |
101 | if (status != EFI_SUCCESS) |
102 | return efi_status_to_err(status); |
103 | |
104 | if (size > max_size) |
105 | return -ENOSPC; |
106 | |
107 | return 0; |
108 | } |
109 | EXPORT_SYMBOL_GPL(efi_capsule_supported); |
110 | |
111 | /* |
112 | * Every scatter gather list (block descriptor) page must end with a |
113 | * continuation pointer. The last continuation pointer of the last |
114 | * page must be zero to mark the end of the chain. |
115 | */ |
116 | #define SGLIST_PER_PAGE ((PAGE_SIZE / sizeof(efi_capsule_block_desc_t)) - 1) |
117 | |
118 | /* |
119 | * How many scatter gather list (block descriptor) pages do we need |
120 | * to map @count pages? |
121 | */ |
122 | static inline unsigned int sg_pages_num(unsigned int count) |
123 | { |
124 | return DIV_ROUND_UP(count, SGLIST_PER_PAGE); |
125 | } |
126 | |
127 | /** |
128 | * efi_capsule_update_locked - pass a single capsule to the firmware |
129 | * @capsule: capsule to send to the firmware |
130 | * @sg_pages: array of scatter gather (block descriptor) pages |
131 | * @reset: the reset type required for @capsule |
132 | * |
133 | * Since this function must be called under capsule_mutex check |
134 | * whether efi_reset_type will conflict with @reset, and atomically |
135 | * set it and capsule_pending if a capsule was successfully sent to |
136 | * the firmware. |
137 | * |
138 | * We also check to see if the system is about to restart, and if so, |
139 | * abort. This avoids races between efi_capsule_update() and |
140 | * efi_capsule_pending(). |
141 | */ |
142 | static int |
143 | efi_capsule_update_locked(efi_capsule_header_t *capsule, |
144 | struct page **sg_pages, int reset) |
145 | { |
146 | efi_physical_addr_t sglist_phys; |
147 | efi_status_t status; |
148 | |
149 | lockdep_assert_held(&capsule_mutex); |
150 | |
151 | /* |
152 | * If someone has already registered a capsule that requires a |
153 | * different reset type, we're out of luck and must abort. |
154 | */ |
155 | if (efi_reset_type >= 0 && efi_reset_type != reset) { |
156 | pr_err("Conflicting capsule reset type %d (%d).\n" , |
157 | reset, efi_reset_type); |
158 | return -EINVAL; |
159 | } |
160 | |
161 | /* |
162 | * If the system is getting ready to restart it may have |
163 | * called efi_capsule_pending() to make decisions (such as |
164 | * whether to force an EFI reboot), and we're racing against |
165 | * that call. Abort in that case. |
166 | */ |
167 | if (unlikely(stop_capsules)) { |
168 | pr_warn("Capsule update raced with reboot, aborting.\n" ); |
169 | return -EINVAL; |
170 | } |
171 | |
172 | sglist_phys = page_to_phys(sg_pages[0]); |
173 | |
174 | status = efi.update_capsule(&capsule, 1, sglist_phys); |
175 | if (status == EFI_SUCCESS) { |
176 | capsule_pending = true; |
177 | efi_reset_type = reset; |
178 | } |
179 | |
180 | return efi_status_to_err(status); |
181 | } |
182 | |
183 | /** |
184 | * efi_capsule_update - send a capsule to the firmware |
185 | * @capsule: capsule to send to firmware |
186 | * @pages: an array of capsule data pages |
187 | * |
188 | * Build a scatter gather list with EFI capsule block descriptors to |
189 | * map the capsule described by @capsule with its data in @pages and |
190 | * send it to the firmware via the UpdateCapsule() runtime service. |
191 | * |
192 | * @capsule must be a virtual mapping of the complete capsule update in the |
193 | * kernel address space, as the capsule can be consumed immediately. |
194 | * A capsule_header_t that describes the entire contents of the capsule |
195 | * must be at the start of the first data page. |
196 | * |
197 | * Even though this function will validate that the firmware supports |
198 | * the capsule guid, users will likely want to check that |
199 | * efi_capsule_supported() returns true before calling this function |
200 | * because it makes it easier to print helpful error messages. |
201 | * |
202 | * If the capsule is successfully submitted to the firmware, any |
203 | * subsequent calls to efi_capsule_pending() will return true. @pages |
204 | * must not be released or modified if this function returns |
205 | * successfully. |
206 | * |
207 | * Callers must be prepared for this function to fail, which can |
208 | * happen if we raced with system reboot or if there is already a |
209 | * pending capsule that has a reset type that conflicts with the one |
210 | * required by @capsule. Do NOT use efi_capsule_pending() to detect |
211 | * this conflict since that would be racy. Instead, submit the capsule |
212 | * to efi_capsule_update() and check the return value. |
213 | * |
214 | * Return 0 on success, a converted EFI status code on failure. |
215 | */ |
216 | int efi_capsule_update(efi_capsule_header_t *capsule, phys_addr_t *pages) |
217 | { |
218 | u32 imagesize = capsule->imagesize; |
219 | efi_guid_t guid = capsule->guid; |
220 | unsigned int count, sg_count; |
221 | u32 flags = capsule->flags; |
222 | struct page **sg_pages; |
223 | int rv, reset_type; |
224 | int i, j; |
225 | |
226 | rv = efi_capsule_supported(guid, flags, imagesize, &reset_type); |
227 | if (rv) |
228 | return rv; |
229 | |
230 | count = DIV_ROUND_UP(imagesize, PAGE_SIZE); |
231 | sg_count = sg_pages_num(count); |
232 | |
233 | sg_pages = kcalloc(n: sg_count, size: sizeof(*sg_pages), GFP_KERNEL); |
234 | if (!sg_pages) |
235 | return -ENOMEM; |
236 | |
237 | for (i = 0; i < sg_count; i++) { |
238 | sg_pages[i] = alloc_page(GFP_KERNEL); |
239 | if (!sg_pages[i]) { |
240 | rv = -ENOMEM; |
241 | goto out; |
242 | } |
243 | } |
244 | |
245 | for (i = 0; i < sg_count; i++) { |
246 | efi_capsule_block_desc_t *sglist; |
247 | |
248 | sglist = kmap_atomic(page: sg_pages[i]); |
249 | |
250 | for (j = 0; j < SGLIST_PER_PAGE && count > 0; j++) { |
251 | u64 sz = min_t(u64, imagesize, |
252 | PAGE_SIZE - (u64)*pages % PAGE_SIZE); |
253 | |
254 | sglist[j].length = sz; |
255 | sglist[j].data = *pages++; |
256 | |
257 | imagesize -= sz; |
258 | count--; |
259 | } |
260 | |
261 | /* Continuation pointer */ |
262 | sglist[j].length = 0; |
263 | |
264 | if (i + 1 == sg_count) |
265 | sglist[j].data = 0; |
266 | else |
267 | sglist[j].data = page_to_phys(sg_pages[i + 1]); |
268 | |
269 | #if defined(CONFIG_ARM) || defined(CONFIG_ARM64) |
270 | /* |
271 | * At runtime, the firmware has no way to find out where the |
272 | * sglist elements are mapped, if they are mapped in the first |
273 | * place. Therefore, on architectures that can only perform |
274 | * cache maintenance by virtual address, the firmware is unable |
275 | * to perform this maintenance, and so it is up to the OS to do |
276 | * it instead. |
277 | */ |
278 | efi_capsule_flush_cache_range(sglist, PAGE_SIZE); |
279 | #endif |
280 | kunmap_atomic(sglist); |
281 | } |
282 | |
283 | mutex_lock(&capsule_mutex); |
284 | rv = efi_capsule_update_locked(capsule, sg_pages, reset: reset_type); |
285 | mutex_unlock(lock: &capsule_mutex); |
286 | |
287 | out: |
288 | for (i = 0; rv && i < sg_count; i++) { |
289 | if (sg_pages[i]) |
290 | __free_page(sg_pages[i]); |
291 | } |
292 | |
293 | kfree(objp: sg_pages); |
294 | return rv; |
295 | } |
296 | EXPORT_SYMBOL_GPL(efi_capsule_update); |
297 | |
298 | static int capsule_reboot_notify(struct notifier_block *nb, unsigned long event, void *cmd) |
299 | { |
300 | mutex_lock(&capsule_mutex); |
301 | stop_capsules = true; |
302 | mutex_unlock(lock: &capsule_mutex); |
303 | |
304 | return NOTIFY_DONE; |
305 | } |
306 | |
307 | static struct notifier_block capsule_reboot_nb = { |
308 | .notifier_call = capsule_reboot_notify, |
309 | }; |
310 | |
311 | static int __init capsule_reboot_register(void) |
312 | { |
313 | return register_reboot_notifier(&capsule_reboot_nb); |
314 | } |
315 | core_initcall(capsule_reboot_register); |
316 | |