capsule.c 8.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * EFI capsule support.
  4. *
  5. * Copyright 2013 Intel Corporation; author Matt Fleming
  6. */
  7. #define pr_fmt(fmt) "efi: " fmt
  8. #include <linux/slab.h>
  9. #include <linux/mutex.h>
  10. #include <linux/highmem.h>
  11. #include <linux/efi.h>
  12. #include <linux/vmalloc.h>
  13. #include <asm/io.h>
  14. typedef struct {
  15. u64 length;
  16. u64 data;
  17. } efi_capsule_block_desc_t;
  18. static bool capsule_pending;
  19. static bool stop_capsules;
  20. static int efi_reset_type = -1;
  21. /*
  22. * capsule_mutex serialises access to both capsule_pending and
  23. * efi_reset_type and stop_capsules.
  24. */
  25. static DEFINE_MUTEX(capsule_mutex);
  26. /**
  27. * efi_capsule_pending - has a capsule been passed to the firmware?
  28. * @reset_type: store the type of EFI reset if capsule is pending
  29. *
  30. * To ensure that the registered capsule is processed correctly by the
  31. * firmware we need to perform a specific type of reset. If a capsule is
  32. * pending return the reset type in @reset_type.
  33. *
  34. * This function will race with callers of efi_capsule_update(), for
  35. * example, calling this function while somebody else is in
  36. * efi_capsule_update() but hasn't reached efi_capsue_update_locked()
  37. * will miss the updates to capsule_pending and efi_reset_type after
  38. * efi_capsule_update_locked() completes.
  39. *
  40. * A non-racy use is from platform reboot code because we use
  41. * system_state to ensure no capsules can be sent to the firmware once
  42. * we're at SYSTEM_RESTART. See efi_capsule_update_locked().
  43. */
  44. bool efi_capsule_pending(int *reset_type)
  45. {
  46. if (!capsule_pending)
  47. return false;
  48. if (reset_type)
  49. *reset_type = efi_reset_type;
  50. return true;
  51. }
  52. /*
  53. * Whitelist of EFI capsule flags that we support.
  54. *
  55. * We do not handle EFI_CAPSULE_INITIATE_RESET because that would
  56. * require us to prepare the kernel for reboot. Refuse to load any
  57. * capsules with that flag and any other flags that we do not know how
  58. * to handle.
  59. */
  60. #define EFI_CAPSULE_SUPPORTED_FLAG_MASK \
  61. (EFI_CAPSULE_PERSIST_ACROSS_RESET | EFI_CAPSULE_POPULATE_SYSTEM_TABLE)
  62. /**
  63. * efi_capsule_supported - does the firmware support the capsule?
  64. * @guid: vendor guid of capsule
  65. * @flags: capsule flags
  66. * @size: size of capsule data
  67. * @reset: the reset type required for this capsule
  68. *
  69. * Check whether a capsule with @flags is supported by the firmware
  70. * and that @size doesn't exceed the maximum size for a capsule.
  71. *
  72. * No attempt is made to check @reset against the reset type required
  73. * by any pending capsules because of the races involved.
  74. */
  75. int efi_capsule_supported(efi_guid_t guid, u32 flags, size_t size, int *reset)
  76. {
  77. efi_capsule_header_t capsule;
  78. efi_capsule_header_t *cap_list[] = { &capsule };
  79. efi_status_t status;
  80. u64 max_size;
  81. if (flags & ~EFI_CAPSULE_SUPPORTED_FLAG_MASK)
  82. return -EINVAL;
  83. capsule.headersize = capsule.imagesize = sizeof(capsule);
  84. memcpy(&capsule.guid, &guid, sizeof(efi_guid_t));
  85. capsule.flags = flags;
  86. status = efi.query_capsule_caps(cap_list, 1, &max_size, reset);
  87. if (status != EFI_SUCCESS)
  88. return efi_status_to_err(status);
  89. if (size > max_size)
  90. return -ENOSPC;
  91. return 0;
  92. }
  93. EXPORT_SYMBOL_GPL(efi_capsule_supported);
  94. /*
  95. * Every scatter gather list (block descriptor) page must end with a
  96. * continuation pointer. The last continuation pointer of the last
  97. * page must be zero to mark the end of the chain.
  98. */
  99. #define SGLIST_PER_PAGE ((PAGE_SIZE / sizeof(efi_capsule_block_desc_t)) - 1)
  100. /*
  101. * How many scatter gather list (block descriptor) pages do we need
  102. * to map @count pages?
  103. */
  104. static inline unsigned int sg_pages_num(unsigned int count)
  105. {
  106. return DIV_ROUND_UP(count, SGLIST_PER_PAGE);
  107. }
  108. /**
  109. * efi_capsule_update_locked - pass a single capsule to the firmware
  110. * @capsule: capsule to send to the firmware
  111. * @sg_pages: array of scatter gather (block descriptor) pages
  112. * @reset: the reset type required for @capsule
  113. *
  114. * Since this function must be called under capsule_mutex check
  115. * whether efi_reset_type will conflict with @reset, and atomically
  116. * set it and capsule_pending if a capsule was successfully sent to
  117. * the firmware.
  118. *
  119. * We also check to see if the system is about to restart, and if so,
  120. * abort. This avoids races between efi_capsule_update() and
  121. * efi_capsule_pending().
  122. */
  123. static int
  124. efi_capsule_update_locked(efi_capsule_header_t *capsule,
  125. struct page **sg_pages, int reset)
  126. {
  127. efi_physical_addr_t sglist_phys;
  128. efi_status_t status;
  129. lockdep_assert_held(&capsule_mutex);
  130. /*
  131. * If someone has already registered a capsule that requires a
  132. * different reset type, we're out of luck and must abort.
  133. */
  134. if (efi_reset_type >= 0 && efi_reset_type != reset) {
  135. pr_err("Conflicting capsule reset type %d (%d).\n",
  136. reset, efi_reset_type);
  137. return -EINVAL;
  138. }
  139. /*
  140. * If the system is getting ready to restart it may have
  141. * called efi_capsule_pending() to make decisions (such as
  142. * whether to force an EFI reboot), and we're racing against
  143. * that call. Abort in that case.
  144. */
  145. if (unlikely(stop_capsules)) {
  146. pr_warn("Capsule update raced with reboot, aborting.\n");
  147. return -EINVAL;
  148. }
  149. sglist_phys = page_to_phys(sg_pages[0]);
  150. status = efi.update_capsule(&capsule, 1, sglist_phys);
  151. if (status == EFI_SUCCESS) {
  152. capsule_pending = true;
  153. efi_reset_type = reset;
  154. }
  155. return efi_status_to_err(status);
  156. }
  157. /**
  158. * efi_capsule_update - send a capsule to the firmware
  159. * @capsule: capsule to send to firmware
  160. * @pages: an array of capsule data pages
  161. *
  162. * Build a scatter gather list with EFI capsule block descriptors to
  163. * map the capsule described by @capsule with its data in @pages and
  164. * send it to the firmware via the UpdateCapsule() runtime service.
  165. *
  166. * @capsule must be a virtual mapping of the complete capsule update in the
  167. * kernel address space, as the capsule can be consumed immediately.
  168. * A capsule_header_t that describes the entire contents of the capsule
  169. * must be at the start of the first data page.
  170. *
  171. * Even though this function will validate that the firmware supports
  172. * the capsule guid, users will likely want to check that
  173. * efi_capsule_supported() returns true before calling this function
  174. * because it makes it easier to print helpful error messages.
  175. *
  176. * If the capsule is successfully submitted to the firmware, any
  177. * subsequent calls to efi_capsule_pending() will return true. @pages
  178. * must not be released or modified if this function returns
  179. * successfully.
  180. *
  181. * Callers must be prepared for this function to fail, which can
  182. * happen if we raced with system reboot or if there is already a
  183. * pending capsule that has a reset type that conflicts with the one
  184. * required by @capsule. Do NOT use efi_capsule_pending() to detect
  185. * this conflict since that would be racy. Instead, submit the capsule
  186. * to efi_capsule_update() and check the return value.
  187. *
  188. * Return 0 on success, a converted EFI status code on failure.
  189. */
  190. int efi_capsule_update(efi_capsule_header_t *capsule, phys_addr_t *pages)
  191. {
  192. u32 imagesize = capsule->imagesize;
  193. efi_guid_t guid = capsule->guid;
  194. unsigned int count, sg_count;
  195. u32 flags = capsule->flags;
  196. struct page **sg_pages;
  197. int rv, reset_type;
  198. int i, j;
  199. rv = efi_capsule_supported(guid, flags, imagesize, &reset_type);
  200. if (rv)
  201. return rv;
  202. count = DIV_ROUND_UP(imagesize, PAGE_SIZE);
  203. sg_count = sg_pages_num(count);
  204. sg_pages = kcalloc(sg_count, sizeof(*sg_pages), GFP_KERNEL);
  205. if (!sg_pages)
  206. return -ENOMEM;
  207. for (i = 0; i < sg_count; i++) {
  208. sg_pages[i] = alloc_page(GFP_KERNEL);
  209. if (!sg_pages[i]) {
  210. rv = -ENOMEM;
  211. goto out;
  212. }
  213. }
  214. for (i = 0; i < sg_count; i++) {
  215. efi_capsule_block_desc_t *sglist;
  216. sglist = kmap(sg_pages[i]);
  217. for (j = 0; j < SGLIST_PER_PAGE && count > 0; j++) {
  218. u64 sz = min_t(u64, imagesize,
  219. PAGE_SIZE - (u64)*pages % PAGE_SIZE);
  220. sglist[j].length = sz;
  221. sglist[j].data = *pages++;
  222. imagesize -= sz;
  223. count--;
  224. }
  225. /* Continuation pointer */
  226. sglist[j].length = 0;
  227. if (i + 1 == sg_count)
  228. sglist[j].data = 0;
  229. else
  230. sglist[j].data = page_to_phys(sg_pages[i + 1]);
  231. kunmap(sg_pages[i]);
  232. }
  233. mutex_lock(&capsule_mutex);
  234. rv = efi_capsule_update_locked(capsule, sg_pages, reset_type);
  235. mutex_unlock(&capsule_mutex);
  236. out:
  237. for (i = 0; rv && i < sg_count; i++) {
  238. if (sg_pages[i])
  239. __free_page(sg_pages[i]);
  240. }
  241. kfree(sg_pages);
  242. return rv;
  243. }
  244. EXPORT_SYMBOL_GPL(efi_capsule_update);
  245. static int capsule_reboot_notify(struct notifier_block *nb, unsigned long event, void *cmd)
  246. {
  247. mutex_lock(&capsule_mutex);
  248. stop_capsules = true;
  249. mutex_unlock(&capsule_mutex);
  250. return NOTIFY_DONE;
  251. }
  252. static struct notifier_block capsule_reboot_nb = {
  253. .notifier_call = capsule_reboot_notify,
  254. };
  255. static int __init capsule_reboot_register(void)
  256. {
  257. return register_reboot_notifier(&capsule_reboot_nb);
  258. }
  259. core_initcall(capsule_reboot_register);