• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: GPL-2.0-only
2 #define pr_fmt(fmt) "efi: " fmt
3 
4 #include <linux/init.h>
5 #include <linux/kernel.h>
6 #include <linux/string.h>
7 #include <linux/time.h>
8 #include <linux/types.h>
9 #include <linux/efi.h>
10 #include <linux/slab.h>
11 #include <linux/memblock.h>
12 #include <linux/acpi.h>
13 #include <linux/dmi.h>
14 
15 #include <asm/e820/api.h>
16 #include <asm/efi.h>
17 #include <asm/uv/uv.h>
18 #include <asm/cpu_device_id.h>
19 #include <asm/reboot.h>
20 
21 #define EFI_MIN_RESERVE 5120
22 
23 #define EFI_DUMMY_GUID \
24 	EFI_GUID(0x4424ac57, 0xbe4b, 0x47dd, 0x9e, 0x97, 0xed, 0x50, 0xf0, 0x9f, 0x92, 0xa9)
25 
26 #define QUARK_CSH_SIGNATURE		0x5f435348	/* _CSH */
27 #define QUARK_SECURITY_HEADER_SIZE	0x400
28 
29 /*
30  * Header prepended to the standard EFI capsule on Quark systems the are based
31  * on Intel firmware BSP.
32  * @csh_signature:	Unique identifier to sanity check signed module
33  * 			presence ("_CSH").
34  * @version:		Current version of CSH used. Should be one for Quark A0.
35  * @modulesize:		Size of the entire module including the module header
36  * 			and payload.
37  * @security_version_number_index: Index of SVN to use for validation of signed
38  * 			module.
39  * @security_version_number: Used to prevent against roll back of modules.
40  * @rsvd_module_id:	Currently unused for Clanton (Quark).
41  * @rsvd_module_vendor:	Vendor Identifier. For Intel products value is
42  * 			0x00008086.
43  * @rsvd_date:		BCD representation of build date as yyyymmdd, where
44  * 			yyyy=4 digit year, mm=1-12, dd=1-31.
45  * @headersize:		Total length of the header including including any
46  * 			padding optionally added by the signing tool.
47  * @hash_algo:		What Hash is used in the module signing.
48  * @cryp_algo:		What Crypto is used in the module signing.
49  * @keysize:		Total length of the key data including including any
50  * 			padding optionally added by the signing tool.
51  * @signaturesize:	Total length of the signature including including any
52  * 			padding optionally added by the signing tool.
53  * @rsvd_next_header:	32-bit pointer to the next Secure Boot Module in the
54  * 			chain, if there is a next header.
55  * @rsvd:		Reserved, padding structure to required size.
56  *
57  * See also QuartSecurityHeader_t in
58  * Quark_EDKII_v1.2.1.1/QuarkPlatformPkg/Include/QuarkBootRom.h
59  * from https://downloadcenter.intel.com/download/23197/Intel-Quark-SoC-X1000-Board-Support-Package-BSP
60  */
61 struct quark_security_header {
62 	u32 csh_signature;
63 	u32 version;
64 	u32 modulesize;
65 	u32 security_version_number_index;
66 	u32 security_version_number;
67 	u32 rsvd_module_id;
68 	u32 rsvd_module_vendor;
69 	u32 rsvd_date;
70 	u32 headersize;
71 	u32 hash_algo;
72 	u32 cryp_algo;
73 	u32 keysize;
74 	u32 signaturesize;
75 	u32 rsvd_next_header;
76 	u32 rsvd[2];
77 };
78 
79 static const efi_char16_t efi_dummy_name[] = L"DUMMY";
80 
81 static bool efi_no_storage_paranoia;
82 
83 /*
84  * Some firmware implementations refuse to boot if there's insufficient
85  * space in the variable store. The implementation of garbage collection
86  * in some FW versions causes stale (deleted) variables to take up space
87  * longer than intended and space is only freed once the store becomes
88  * almost completely full.
89  *
90  * Enabling this option disables the space checks in
91  * efi_query_variable_store() and forces garbage collection.
92  *
93  * Only enable this option if deleting EFI variables does not free up
94  * space in your variable store, e.g. if despite deleting variables
95  * you're unable to create new ones.
96  */
setup_storage_paranoia(char * arg)97 static int __init setup_storage_paranoia(char *arg)
98 {
99 	efi_no_storage_paranoia = true;
100 	return 0;
101 }
102 early_param("efi_no_storage_paranoia", setup_storage_paranoia);
103 
104 /*
105  * Deleting the dummy variable which kicks off garbage collection
106 */
efi_delete_dummy_variable(void)107 void efi_delete_dummy_variable(void)
108 {
109 	efi.set_variable_nonblocking((efi_char16_t *)efi_dummy_name,
110 				     &EFI_DUMMY_GUID,
111 				     EFI_VARIABLE_NON_VOLATILE |
112 				     EFI_VARIABLE_BOOTSERVICE_ACCESS |
113 				     EFI_VARIABLE_RUNTIME_ACCESS, 0, NULL);
114 }
115 
116 /*
117  * In the nonblocking case we do not attempt to perform garbage
118  * collection if we do not have enough free space. Rather, we do the
119  * bare minimum check and give up immediately if the available space
120  * is below EFI_MIN_RESERVE.
121  *
122  * This function is intended to be small and simple because it is
123  * invoked from crash handler paths.
124  */
125 static efi_status_t
query_variable_store_nonblocking(u32 attributes,unsigned long size)126 query_variable_store_nonblocking(u32 attributes, unsigned long size)
127 {
128 	efi_status_t status;
129 	u64 storage_size, remaining_size, max_size;
130 
131 	status = efi.query_variable_info_nonblocking(attributes, &storage_size,
132 						     &remaining_size,
133 						     &max_size);
134 	if (status != EFI_SUCCESS)
135 		return status;
136 
137 	if (remaining_size - size < EFI_MIN_RESERVE)
138 		return EFI_OUT_OF_RESOURCES;
139 
140 	return EFI_SUCCESS;
141 }
142 
143 /*
144  * Some firmware implementations refuse to boot if there's insufficient space
145  * in the variable store. Ensure that we never use more than a safe limit.
146  *
147  * Return EFI_SUCCESS if it is safe to write 'size' bytes to the variable
148  * store.
149  */
efi_query_variable_store(u32 attributes,unsigned long size,bool nonblocking)150 efi_status_t efi_query_variable_store(u32 attributes, unsigned long size,
151 				      bool nonblocking)
152 {
153 	efi_status_t status;
154 	u64 storage_size, remaining_size, max_size;
155 
156 	if (!(attributes & EFI_VARIABLE_NON_VOLATILE))
157 		return 0;
158 
159 	if (nonblocking)
160 		return query_variable_store_nonblocking(attributes, size);
161 
162 	status = efi.query_variable_info(attributes, &storage_size,
163 					 &remaining_size, &max_size);
164 	if (status != EFI_SUCCESS)
165 		return status;
166 
167 	/*
168 	 * We account for that by refusing the write if permitting it would
169 	 * reduce the available space to under 5KB. This figure was provided by
170 	 * Samsung, so should be safe.
171 	 */
172 	if ((remaining_size - size < EFI_MIN_RESERVE) &&
173 		!efi_no_storage_paranoia) {
174 
175 		/*
176 		 * Triggering garbage collection may require that the firmware
177 		 * generate a real EFI_OUT_OF_RESOURCES error. We can force
178 		 * that by attempting to use more space than is available.
179 		 */
180 		unsigned long dummy_size = remaining_size + 1024;
181 		void *dummy = kzalloc(dummy_size, GFP_KERNEL);
182 
183 		if (!dummy)
184 			return EFI_OUT_OF_RESOURCES;
185 
186 		status = efi.set_variable((efi_char16_t *)efi_dummy_name,
187 					  &EFI_DUMMY_GUID,
188 					  EFI_VARIABLE_NON_VOLATILE |
189 					  EFI_VARIABLE_BOOTSERVICE_ACCESS |
190 					  EFI_VARIABLE_RUNTIME_ACCESS,
191 					  dummy_size, dummy);
192 
193 		if (status == EFI_SUCCESS) {
194 			/*
195 			 * This should have failed, so if it didn't make sure
196 			 * that we delete it...
197 			 */
198 			efi_delete_dummy_variable();
199 		}
200 
201 		kfree(dummy);
202 
203 		/*
204 		 * The runtime code may now have triggered a garbage collection
205 		 * run, so check the variable info again
206 		 */
207 		status = efi.query_variable_info(attributes, &storage_size,
208 						 &remaining_size, &max_size);
209 
210 		if (status != EFI_SUCCESS)
211 			return status;
212 
213 		/*
214 		 * There still isn't enough room, so return an error
215 		 */
216 		if (remaining_size - size < EFI_MIN_RESERVE)
217 			return EFI_OUT_OF_RESOURCES;
218 	}
219 
220 	return EFI_SUCCESS;
221 }
222 EXPORT_SYMBOL_GPL(efi_query_variable_store);
223 
224 /*
225  * The UEFI specification makes it clear that the operating system is
226  * free to do whatever it wants with boot services code after
227  * ExitBootServices() has been called. Ignoring this recommendation a
228  * significant bunch of EFI implementations continue calling into boot
229  * services code (SetVirtualAddressMap). In order to work around such
230  * buggy implementations we reserve boot services region during EFI
231  * init and make sure it stays executable. Then, after
232  * SetVirtualAddressMap(), it is discarded.
233  *
234  * However, some boot services regions contain data that is required
235  * by drivers, so we need to track which memory ranges can never be
236  * freed. This is done by tagging those regions with the
237  * EFI_MEMORY_RUNTIME attribute.
238  *
239  * Any driver that wants to mark a region as reserved must use
240  * efi_mem_reserve() which will insert a new EFI memory descriptor
241  * into efi.memmap (splitting existing regions if necessary) and tag
242  * it with EFI_MEMORY_RUNTIME.
243  */
efi_arch_mem_reserve(phys_addr_t addr,u64 size)244 void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size)
245 {
246 	phys_addr_t new_phys, new_size;
247 	struct efi_mem_range mr;
248 	efi_memory_desc_t md;
249 	int num_entries;
250 	void *new;
251 
252 	if (efi_mem_desc_lookup(addr, &md) ||
253 	    md.type != EFI_BOOT_SERVICES_DATA) {
254 		pr_err("Failed to lookup EFI memory descriptor for %pa\n", &addr);
255 		return;
256 	}
257 
258 	if (addr + size > md.phys_addr + (md.num_pages << EFI_PAGE_SHIFT)) {
259 		pr_err("Region spans EFI memory descriptors, %pa\n", &addr);
260 		return;
261 	}
262 
263 	size += addr % EFI_PAGE_SIZE;
264 	size = round_up(size, EFI_PAGE_SIZE);
265 	addr = round_down(addr, EFI_PAGE_SIZE);
266 
267 	mr.range.start = addr;
268 	mr.range.end = addr + size - 1;
269 	mr.attribute = md.attribute | EFI_MEMORY_RUNTIME;
270 
271 	num_entries = efi_memmap_split_count(&md, &mr.range);
272 	num_entries += efi.memmap.nr_map;
273 
274 	new_size = efi.memmap.desc_size * num_entries;
275 
276 	new_phys = efi_memmap_alloc(num_entries);
277 	if (!new_phys) {
278 		pr_err("Could not allocate boot services memmap\n");
279 		return;
280 	}
281 
282 	new = early_memremap_prot(new_phys, new_size,
283 				  pgprot_val(pgprot_encrypted(FIXMAP_PAGE_NORMAL)));
284 	if (!new) {
285 		pr_err("Failed to map new boot services memmap\n");
286 		return;
287 	}
288 
289 	efi_memmap_insert(&efi.memmap, new, &mr);
290 	early_memunmap(new, new_size);
291 
292 	efi_memmap_install(new_phys, num_entries);
293 	e820__range_update(addr, size, E820_TYPE_RAM, E820_TYPE_RESERVED);
294 	e820__update_table(e820_table);
295 }
296 
297 /*
298  * Helper function for efi_reserve_boot_services() to figure out if we
299  * can free regions in efi_free_boot_services().
300  *
301  * Use this function to ensure we do not free regions owned by somebody
302  * else. We must only reserve (and then free) regions:
303  *
304  * - Not within any part of the kernel
305  * - Not the BIOS reserved area (E820_TYPE_RESERVED, E820_TYPE_NVS, etc)
306  */
can_free_region(u64 start,u64 size)307 static __init bool can_free_region(u64 start, u64 size)
308 {
309 	if (start + size > __pa_symbol(_text) && start <= __pa_symbol(_end))
310 		return false;
311 
312 	if (!e820__mapped_all(start, start+size, E820_TYPE_RAM))
313 		return false;
314 
315 	return true;
316 }
317 
efi_reserve_boot_services(void)318 void __init efi_reserve_boot_services(void)
319 {
320 	efi_memory_desc_t *md;
321 
322 	for_each_efi_memory_desc(md) {
323 		u64 start = md->phys_addr;
324 		u64 size = md->num_pages << EFI_PAGE_SHIFT;
325 		bool already_reserved;
326 
327 		if (md->type != EFI_BOOT_SERVICES_CODE &&
328 		    md->type != EFI_BOOT_SERVICES_DATA)
329 			continue;
330 
331 		already_reserved = memblock_is_region_reserved(start, size);
332 
333 		/*
334 		 * Because the following memblock_reserve() is paired
335 		 * with memblock_free_late() for this region in
336 		 * efi_free_boot_services(), we must be extremely
337 		 * careful not to reserve, and subsequently free,
338 		 * critical regions of memory (like the kernel image) or
339 		 * those regions that somebody else has already
340 		 * reserved.
341 		 *
342 		 * A good example of a critical region that must not be
343 		 * freed is page zero (first 4Kb of memory), which may
344 		 * contain boot services code/data but is marked
345 		 * E820_TYPE_RESERVED by trim_bios_range().
346 		 */
347 		if (!already_reserved) {
348 			memblock_reserve(start, size);
349 
350 			/*
351 			 * If we are the first to reserve the region, no
352 			 * one else cares about it. We own it and can
353 			 * free it later.
354 			 */
355 			if (can_free_region(start, size))
356 				continue;
357 		}
358 
359 		/*
360 		 * We don't own the region. We must not free it.
361 		 *
362 		 * Setting this bit for a boot services region really
363 		 * doesn't make sense as far as the firmware is
364 		 * concerned, but it does provide us with a way to tag
365 		 * those regions that must not be paired with
366 		 * memblock_free_late().
367 		 */
368 		md->attribute |= EFI_MEMORY_RUNTIME;
369 	}
370 }
371 
372 /*
373  * Apart from having VA mappings for EFI boot services code/data regions,
374  * (duplicate) 1:1 mappings were also created as a quirk for buggy firmware. So,
375  * unmap both 1:1 and VA mappings.
376  */
efi_unmap_pages(efi_memory_desc_t * md)377 static void __init efi_unmap_pages(efi_memory_desc_t *md)
378 {
379 	pgd_t *pgd = efi_mm.pgd;
380 	u64 pa = md->phys_addr;
381 	u64 va = md->virt_addr;
382 
383 	/*
384 	 * To Do: Remove this check after adding functionality to unmap EFI boot
385 	 * services code/data regions from direct mapping area because
386 	 * "efi=old_map" maps EFI regions in swapper_pg_dir.
387 	 */
388 	if (efi_enabled(EFI_OLD_MEMMAP))
389 		return;
390 
391 	/*
392 	 * EFI mixed mode has all RAM mapped to access arguments while making
393 	 * EFI runtime calls, hence don't unmap EFI boot services code/data
394 	 * regions.
395 	 */
396 	if (!efi_is_native())
397 		return;
398 
399 	if (kernel_unmap_pages_in_pgd(pgd, pa, md->num_pages))
400 		pr_err("Failed to unmap 1:1 mapping for 0x%llx\n", pa);
401 
402 	if (kernel_unmap_pages_in_pgd(pgd, va, md->num_pages))
403 		pr_err("Failed to unmap VA mapping for 0x%llx\n", va);
404 }
405 
efi_free_boot_services(void)406 void __init efi_free_boot_services(void)
407 {
408 	phys_addr_t new_phys, new_size;
409 	efi_memory_desc_t *md;
410 	int num_entries = 0;
411 	void *new, *new_md;
412 
413 	for_each_efi_memory_desc(md) {
414 		unsigned long long start = md->phys_addr;
415 		unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
416 		size_t rm_size;
417 
418 		if (md->type != EFI_BOOT_SERVICES_CODE &&
419 		    md->type != EFI_BOOT_SERVICES_DATA) {
420 			num_entries++;
421 			continue;
422 		}
423 
424 		/* Do not free, someone else owns it: */
425 		if (md->attribute & EFI_MEMORY_RUNTIME) {
426 			num_entries++;
427 			continue;
428 		}
429 
430 		/*
431 		 * Before calling set_virtual_address_map(), EFI boot services
432 		 * code/data regions were mapped as a quirk for buggy firmware.
433 		 * Unmap them from efi_pgd before freeing them up.
434 		 */
435 		efi_unmap_pages(md);
436 
437 		/*
438 		 * Nasty quirk: if all sub-1MB memory is used for boot
439 		 * services, we can get here without having allocated the
440 		 * real mode trampoline.  It's too late to hand boot services
441 		 * memory back to the memblock allocator, so instead
442 		 * try to manually allocate the trampoline if needed.
443 		 *
444 		 * I've seen this on a Dell XPS 13 9350 with firmware
445 		 * 1.4.4 with SGX enabled booting Linux via Fedora 24's
446 		 * grub2-efi on a hard disk.  (And no, I don't know why
447 		 * this happened, but Linux should still try to boot rather
448 		 * panicing early.)
449 		 */
450 		rm_size = real_mode_size_needed();
451 		if (rm_size && (start + rm_size) < (1<<20) && size >= rm_size) {
452 			set_real_mode_mem(start);
453 			start += rm_size;
454 			size -= rm_size;
455 		}
456 
457 		memblock_free_late(start, size);
458 	}
459 
460 	if (!num_entries)
461 		return;
462 
463 	new_size = efi.memmap.desc_size * num_entries;
464 	new_phys = efi_memmap_alloc(num_entries);
465 	if (!new_phys) {
466 		pr_err("Failed to allocate new EFI memmap\n");
467 		return;
468 	}
469 
470 	new = memremap(new_phys, new_size, MEMREMAP_WB);
471 	if (!new) {
472 		pr_err("Failed to map new EFI memmap\n");
473 		return;
474 	}
475 
476 	/*
477 	 * Build a new EFI memmap that excludes any boot services
478 	 * regions that are not tagged EFI_MEMORY_RUNTIME, since those
479 	 * regions have now been freed.
480 	 */
481 	new_md = new;
482 	for_each_efi_memory_desc(md) {
483 		if (!(md->attribute & EFI_MEMORY_RUNTIME) &&
484 		    (md->type == EFI_BOOT_SERVICES_CODE ||
485 		     md->type == EFI_BOOT_SERVICES_DATA))
486 			continue;
487 
488 		memcpy(new_md, md, efi.memmap.desc_size);
489 		new_md += efi.memmap.desc_size;
490 	}
491 
492 	memunmap(new);
493 
494 	if (efi_memmap_install(new_phys, num_entries)) {
495 		pr_err("Could not install new EFI memmap\n");
496 		return;
497 	}
498 }
499 
500 /*
501  * A number of config table entries get remapped to virtual addresses
502  * after entering EFI virtual mode. However, the kexec kernel requires
503  * their physical addresses therefore we pass them via setup_data and
504  * correct those entries to their respective physical addresses here.
505  *
506  * Currently only handles smbios which is necessary for some firmware
507  * implementation.
508  */
efi_reuse_config(u64 tables,int nr_tables)509 int __init efi_reuse_config(u64 tables, int nr_tables)
510 {
511 	int i, sz, ret = 0;
512 	void *p, *tablep;
513 	struct efi_setup_data *data;
514 
515 	if (nr_tables == 0)
516 		return 0;
517 
518 	if (!efi_setup)
519 		return 0;
520 
521 	if (!efi_enabled(EFI_64BIT))
522 		return 0;
523 
524 	data = early_memremap(efi_setup, sizeof(*data));
525 	if (!data) {
526 		ret = -ENOMEM;
527 		goto out;
528 	}
529 
530 	if (!data->smbios)
531 		goto out_memremap;
532 
533 	sz = sizeof(efi_config_table_64_t);
534 
535 	p = tablep = early_memremap(tables, nr_tables * sz);
536 	if (!p) {
537 		pr_err("Could not map Configuration table!\n");
538 		ret = -ENOMEM;
539 		goto out_memremap;
540 	}
541 
542 	for (i = 0; i < efi.systab->nr_tables; i++) {
543 		efi_guid_t guid;
544 
545 		guid = ((efi_config_table_64_t *)p)->guid;
546 
547 		if (!efi_guidcmp(guid, SMBIOS_TABLE_GUID))
548 			((efi_config_table_64_t *)p)->table = data->smbios;
549 		p += sz;
550 	}
551 	early_memunmap(tablep, nr_tables * sz);
552 
553 out_memremap:
554 	early_memunmap(data, sizeof(*data));
555 out:
556 	return ret;
557 }
558 
559 static const struct dmi_system_id sgi_uv1_dmi[] = {
560 	{ NULL, "SGI UV1",
561 		{	DMI_MATCH(DMI_PRODUCT_NAME,	"Stoutland Platform"),
562 			DMI_MATCH(DMI_PRODUCT_VERSION,	"1.0"),
563 			DMI_MATCH(DMI_BIOS_VENDOR,	"SGI.COM"),
564 		}
565 	},
566 	{ } /* NULL entry stops DMI scanning */
567 };
568 
efi_apply_memmap_quirks(void)569 void __init efi_apply_memmap_quirks(void)
570 {
571 	/*
572 	 * Once setup is done earlier, unmap the EFI memory map on mismatched
573 	 * firmware/kernel architectures since there is no support for runtime
574 	 * services.
575 	 */
576 	if (!efi_runtime_supported()) {
577 		pr_info("Setup done, disabling due to 32/64-bit mismatch\n");
578 		efi_memmap_unmap();
579 	}
580 
581 	/* UV2+ BIOS has a fix for this issue.  UV1 still needs the quirk. */
582 	if (dmi_check_system(sgi_uv1_dmi))
583 		set_bit(EFI_OLD_MEMMAP, &efi.flags);
584 }
585 
586 /*
587  * For most modern platforms the preferred method of powering off is via
588  * ACPI. However, there are some that are known to require the use of
589  * EFI runtime services and for which ACPI does not work at all.
590  *
591  * Using EFI is a last resort, to be used only if no other option
592  * exists.
593  */
efi_reboot_required(void)594 bool efi_reboot_required(void)
595 {
596 	if (!acpi_gbl_reduced_hardware)
597 		return false;
598 
599 	efi_reboot_quirk_mode = EFI_RESET_WARM;
600 	return true;
601 }
602 
efi_poweroff_required(void)603 bool efi_poweroff_required(void)
604 {
605 	return acpi_gbl_reduced_hardware || acpi_no_s5;
606 }
607 
608 #ifdef CONFIG_EFI_CAPSULE_QUIRK_QUARK_CSH
609 
qrk_capsule_setup_info(struct capsule_info * cap_info,void ** pkbuff,size_t hdr_bytes)610 static int qrk_capsule_setup_info(struct capsule_info *cap_info, void **pkbuff,
611 				  size_t hdr_bytes)
612 {
613 	struct quark_security_header *csh = *pkbuff;
614 
615 	/* Only process data block that is larger than the security header */
616 	if (hdr_bytes < sizeof(struct quark_security_header))
617 		return 0;
618 
619 	if (csh->csh_signature != QUARK_CSH_SIGNATURE ||
620 	    csh->headersize != QUARK_SECURITY_HEADER_SIZE)
621 		return 1;
622 
623 	/* Only process data block if EFI header is included */
624 	if (hdr_bytes < QUARK_SECURITY_HEADER_SIZE +
625 			sizeof(efi_capsule_header_t))
626 		return 0;
627 
628 	pr_debug("Quark security header detected\n");
629 
630 	if (csh->rsvd_next_header != 0) {
631 		pr_err("multiple Quark security headers not supported\n");
632 		return -EINVAL;
633 	}
634 
635 	*pkbuff += csh->headersize;
636 	cap_info->total_size = csh->headersize;
637 
638 	/*
639 	 * Update the first page pointer to skip over the CSH header.
640 	 */
641 	cap_info->phys[0] += csh->headersize;
642 
643 	/*
644 	 * cap_info->capsule should point at a virtual mapping of the entire
645 	 * capsule, starting at the capsule header. Our image has the Quark
646 	 * security header prepended, so we cannot rely on the default vmap()
647 	 * mapping created by the generic capsule code.
648 	 * Given that the Quark firmware does not appear to care about the
649 	 * virtual mapping, let's just point cap_info->capsule at our copy
650 	 * of the capsule header.
651 	 */
652 	cap_info->capsule = &cap_info->header;
653 
654 	return 1;
655 }
656 
657 #define ICPU(family, model, quirk_handler) \
658 	{ X86_VENDOR_INTEL, family, model, X86_FEATURE_ANY, \
659 	  (unsigned long)&quirk_handler }
660 
661 static const struct x86_cpu_id efi_capsule_quirk_ids[] = {
662 	ICPU(5, 9, qrk_capsule_setup_info),	/* Intel Quark X1000 */
663 	{ }
664 };
665 
efi_capsule_setup_info(struct capsule_info * cap_info,void * kbuff,size_t hdr_bytes)666 int efi_capsule_setup_info(struct capsule_info *cap_info, void *kbuff,
667 			   size_t hdr_bytes)
668 {
669 	int (*quirk_handler)(struct capsule_info *, void **, size_t);
670 	const struct x86_cpu_id *id;
671 	int ret;
672 
673 	if (hdr_bytes < sizeof(efi_capsule_header_t))
674 		return 0;
675 
676 	cap_info->total_size = 0;
677 
678 	id = x86_match_cpu(efi_capsule_quirk_ids);
679 	if (id) {
680 		/*
681 		 * The quirk handler is supposed to return
682 		 *  - a value > 0 if the setup should continue, after advancing
683 		 *    kbuff as needed
684 		 *  - 0 if not enough hdr_bytes are available yet
685 		 *  - a negative error code otherwise
686 		 */
687 		quirk_handler = (typeof(quirk_handler))id->driver_data;
688 		ret = quirk_handler(cap_info, &kbuff, hdr_bytes);
689 		if (ret <= 0)
690 			return ret;
691 	}
692 
693 	memcpy(&cap_info->header, kbuff, sizeof(cap_info->header));
694 
695 	cap_info->total_size += cap_info->header.imagesize;
696 
697 	return __efi_capsule_setup_info(cap_info);
698 }
699 
700 #endif
701 
702 /*
703  * If any access by any efi runtime service causes a page fault, then,
704  * 1. If it's efi_reset_system(), reboot through BIOS.
705  * 2. If any other efi runtime service, then
706  *    a. Return error status to the efi caller process.
707  *    b. Disable EFI Runtime Services forever and
708  *    c. Freeze efi_rts_wq and schedule new process.
709  *
710  * @return: Returns, if the page fault is not handled. This function
711  * will never return if the page fault is handled successfully.
712  */
efi_recover_from_page_fault(unsigned long phys_addr)713 void efi_recover_from_page_fault(unsigned long phys_addr)
714 {
715 	if (!IS_ENABLED(CONFIG_X86_64))
716 		return;
717 
718 	/*
719 	 * Make sure that an efi runtime service caused the page fault.
720 	 * "efi_mm" cannot be used to check if the page fault had occurred
721 	 * in the firmware context because efi=old_map doesn't use efi_pgd.
722 	 */
723 	if (efi_rts_work.efi_rts_id == EFI_NONE)
724 		return;
725 
726 	/*
727 	 * Address range 0x0000 - 0x0fff is always mapped in the efi_pgd, so
728 	 * page faulting on these addresses isn't expected.
729 	 */
730 	if (phys_addr <= 0x0fff)
731 		return;
732 
733 	/*
734 	 * Print stack trace as it might be useful to know which EFI Runtime
735 	 * Service is buggy.
736 	 */
737 	WARN(1, FW_BUG "Page fault caused by firmware at PA: 0x%lx\n",
738 	     phys_addr);
739 
740 	/*
741 	 * Buggy efi_reset_system() is handled differently from other EFI
742 	 * Runtime Services as it doesn't use efi_rts_wq. Although,
743 	 * native_machine_emergency_restart() says that machine_real_restart()
744 	 * could fail, it's better not to compilcate this fault handler
745 	 * because this case occurs *very* rarely and hence could be improved
746 	 * on a need by basis.
747 	 */
748 	if (efi_rts_work.efi_rts_id == EFI_RESET_SYSTEM) {
749 		pr_info("efi_reset_system() buggy! Reboot through BIOS\n");
750 		machine_real_restart(MRR_BIOS);
751 		return;
752 	}
753 
754 	/*
755 	 * Before calling EFI Runtime Service, the kernel has switched the
756 	 * calling process to efi_mm. Hence, switch back to task_mm.
757 	 */
758 	arch_efi_call_virt_teardown();
759 
760 	/* Signal error status to the efi caller process */
761 	efi_rts_work.status = EFI_ABORTED;
762 	complete(&efi_rts_work.efi_rts_comp);
763 
764 	clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
765 	pr_info("Froze efi_rts_wq and disabled EFI Runtime Services\n");
766 
767 	/*
768 	 * Call schedule() in an infinite loop, so that any spurious wake ups
769 	 * will never run efi_rts_wq again.
770 	 */
771 	for (;;) {
772 		set_current_state(TASK_IDLE);
773 		schedule();
774 	}
775 
776 	return;
777 }
778