1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * Copyright (c) 2022, Linaro Limited
8 #include <efi_loader.h>
9 #include <efi_variable.h>
12 #include <fwu_mdata.h>
15 #include <linux/errno.h>
16 #include <linux/types.h>
19 static u8 boottime_check;
21 #include <linux/errno.h>
22 #include <linux/types.h>
23 #include <u-boot/crc.h>
36 static int fwu_get_dev_mdata(struct udevice **dev, struct fwu_mdata *mdata)
40 ret = uclass_first_device_err(UCLASS_FWU_MDATA, dev);
42 log_debug("Cannot find fwu device\n");
49 ret = fwu_get_mdata(*dev, mdata);
51 log_debug("Unable to get valid FWU metadata\n");
56 static int trial_counter_update(u16 *trial_state_ctr)
63 delete = !trial_state_ctr ? true : false;
64 var_size = !trial_state_ctr ? 0 : (efi_uintn_t)sizeof(*trial_state_ctr);
65 var_attr = !trial_state_ctr ? 0 : EFI_VARIABLE_NON_VOLATILE |
66 EFI_VARIABLE_BOOTSERVICE_ACCESS;
67 status = efi_set_variable_int(u"TrialStateCtr",
68 &efi_global_variable_guid,
70 var_size, trial_state_ctr, false);
72 if ((delete && (status != EFI_NOT_FOUND &&
73 status != EFI_SUCCESS)) ||
74 (!delete && status != EFI_SUCCESS))
80 static int trial_counter_read(u16 *trial_state_ctr)
85 var_size = (efi_uintn_t)sizeof(trial_state_ctr);
86 status = efi_get_variable_int(u"TrialStateCtr",
87 &efi_global_variable_guid,
89 &var_size, trial_state_ctr,
91 if (status != EFI_SUCCESS) {
92 log_err("Unable to read TrialStateCtr variable\n");
99 static int fwu_trial_count_update(void)
104 ret = trial_counter_read(&trial_state_ctr);
106 log_debug("Unable to read trial_state_ctr\n");
111 if (trial_state_ctr > CONFIG_FWU_TRIAL_STATE_CNT) {
112 log_info("Trial State count exceeded. Revert back to previous_active_index\n");
113 ret = fwu_revert_boot_index();
115 log_err("Unable to revert active_index\n");
118 ret = trial_counter_update(&trial_state_ctr);
120 log_err("Unable to increment TrialStateCtr variable\n");
127 static int in_trial_state(struct fwu_mdata *mdata)
130 struct fwu_image_entry *img_entry;
131 struct fwu_image_bank_info *img_bank_info;
133 active_bank = mdata->active_index;
134 img_entry = &mdata->img_entry[0];
135 for (i = 0; i < CONFIG_FWU_NUM_IMAGES_PER_BANK; i++) {
136 img_bank_info = &img_entry[i].img_bank_info[active_bank];
137 if (!img_bank_info->accepted) {
138 log_info("System booting in Trial State\n");
146 static int fwu_get_image_type_id(u8 *image_index, efi_guid_t *image_type_id)
150 struct efi_fw_image *image;
152 index = *image_index;
153 image = update_info.images;
154 for (i = 0; i < num_image_type_guids; i++) {
155 if (index == image[i].image_index) {
156 guidcpy(image_type_id, &image[i].image_type_id);
165 * fwu_verify_mdata() - Verify the FWU metadata
166 * @mdata: FWU metadata structure
167 * @pri_part: FWU metadata partition is primary or secondary
169 * Verify the FWU metadata by computing the CRC32 for the metadata
170 * structure and comparing it against the CRC32 value stored as part
173 * Return: 0 if OK, -ve on error
176 int fwu_verify_mdata(struct fwu_mdata *mdata, bool pri_part)
181 buf = &mdata->version;
182 calc_crc32 = crc32(0, buf, sizeof(*mdata) - sizeof(u32));
184 if (calc_crc32 != mdata->crc32) {
185 log_debug("crc32 check failed for %s FWU metadata partition\n",
186 pri_part ? "primary" : "secondary");
194 * fwu_check_mdata_validity() - Check for validity of the FWU metadata copies
196 * Read both the metadata copies from the storage media, verify their checksum,
197 * and ascertain that both copies match. If one of the copies has gone bad,
198 * restore it from the good copy.
200 * Return: 0 if OK, -ve on error
203 int fwu_check_mdata_validity(void)
207 struct fwu_mdata pri_mdata;
208 struct fwu_mdata secondary_mdata;
210 uint valid_partitions, invalid_partitions;
212 ret = fwu_get_dev_mdata(&dev, NULL);
217 * Check if the platform has defined its own
218 * function to check the metadata partitions'
219 * validity. If so, that takes precedence.
221 ret = fwu_mdata_check(dev);
222 if (!ret || ret != -ENOSYS)
226 * Two FWU metadata partitions are expected.
227 * If we don't have two, user needs to create
230 valid_partitions = 0;
231 ret = fwu_get_mdata_part_num(dev, mdata_parts);
233 log_debug("Error getting the FWU metadata partitions\n");
237 ret = fwu_read_mdata_partition(dev, &pri_mdata, mdata_parts[0]);
239 ret = fwu_verify_mdata(&pri_mdata, 1);
241 valid_partitions |= PRIMARY_PART;
244 ret = fwu_read_mdata_partition(dev, &secondary_mdata, mdata_parts[1]);
246 ret = fwu_verify_mdata(&secondary_mdata, 0);
248 valid_partitions |= SECONDARY_PART;
251 if (valid_partitions == (PRIMARY_PART | SECONDARY_PART)) {
253 * Before returning, check that both the
254 * FWU metadata copies are the same. If not,
255 * populate the secondary partition from the
256 * primary partition copy.
258 if (!memcmp(&pri_mdata, &secondary_mdata,
259 sizeof(struct fwu_mdata))) {
262 log_info("Both FWU metadata copies are valid but do not match.");
263 log_info(" Restoring the secondary partition from the primary\n");
264 ret = fwu_write_mdata_partition(dev, &pri_mdata,
267 log_debug("Restoring secondary FWU metadata partition failed\n");
272 if (!(valid_partitions & BOTH_PARTS)) {
273 log_info("Both FWU metadata partitions invalid\n");
278 invalid_partitions = valid_partitions ^ BOTH_PARTS;
279 ret = fwu_write_mdata_partition(dev,
280 (invalid_partitions == PRIMARY_PART) ?
281 &secondary_mdata : &pri_mdata,
282 (invalid_partitions == PRIMARY_PART) ?
283 mdata_parts[0] : mdata_parts[1]);
286 log_debug("Restoring %s FWU metadata partition failed\n",
287 (invalid_partitions == PRIMARY_PART) ?
288 "primary" : "secondary");
295 * fwu_get_active_index() - Get active_index from the FWU metadata
296 * @active_idx: active_index value to be read
298 * Read the active_index field from the FWU metadata and place it in
299 * the variable pointed to be the function argument.
301 * Return: 0 if OK, -ve on error
304 int fwu_get_active_index(uint *active_idx)
308 struct fwu_mdata mdata = { 0 };
310 ret = fwu_get_dev_mdata(&dev, &mdata);
315 * Found the FWU metadata partition, now read the active_index
318 *active_idx = mdata.active_index;
319 if (*active_idx >= CONFIG_FWU_NUM_BANKS) {
320 log_debug("Active index value read is incorrect\n");
328 * fwu_set_active_index() - Set active_index in the FWU metadata
329 * @active_idx: active_index value to be set
331 * Update the active_index field in the FWU metadata
333 * Return: 0 if OK, -ve on error
336 int fwu_set_active_index(uint active_idx)
340 struct fwu_mdata mdata = { 0 };
342 if (active_idx >= CONFIG_FWU_NUM_BANKS) {
343 log_debug("Invalid active index value\n");
347 ret = fwu_get_dev_mdata(&dev, &mdata);
352 * Update the active index and previous_active_index fields
353 * in the FWU metadata
355 mdata.previous_active_index = mdata.active_index;
356 mdata.active_index = active_idx;
359 * Now write this updated FWU metadata to both the
360 * FWU metadata partitions
362 ret = fwu_update_mdata(dev, &mdata);
364 log_debug("Failed to update FWU metadata partitions\n");
372 * fwu_get_image_index() - Get the Image Index to be used for capsule update
373 * @image_index: The Image Index for the image
375 * The FWU multi bank update feature computes the value of image_index at
376 * runtime, based on the bank to which the image needs to be written to.
377 * Derive the image_index value for the image.
379 * Currently, the capsule update driver uses the DFU framework for
380 * the updates. This function gets the DFU alt number which is to
381 * be used as the Image Index
383 * Return: 0 if OK, -ve on error
386 int fwu_get_image_index(u8 *image_index)
391 efi_guid_t *image_guid, image_type_id;
393 struct fwu_mdata mdata = { 0 };
394 struct fwu_image_entry *img_entry;
395 struct fwu_image_bank_info *img_bank_info;
397 ret = fwu_get_dev_mdata(&dev, &mdata);
401 ret = fwu_plat_get_update_index(&update_bank);
403 log_debug("Failed to get the FWU update bank\n");
407 ret = fwu_get_image_type_id(image_index, &image_type_id);
409 log_debug("Unable to get image_type_id for image_index %u\n",
416 * The FWU metadata has been read. Now get the image_uuid for the
417 * image with the update_bank.
419 for (i = 0; i < CONFIG_FWU_NUM_IMAGES_PER_BANK; i++) {
420 if (!guidcmp(&image_type_id,
421 &mdata.img_entry[i].image_type_uuid)) {
422 img_entry = &mdata.img_entry[i];
423 img_bank_info = &img_entry->img_bank_info[update_bank];
424 image_guid = &img_bank_info->image_uuid;
425 ret = fwu_plat_get_alt_num(dev, image_guid, &alt_num);
427 log_debug("alt_num not found for partition with GUID %pUs\n",
430 log_debug("alt_num %d for partition %pUs\n",
431 alt_num, image_guid);
432 *image_index = alt_num + 1;
439 log_debug("Partition with the image type %pUs not found\n",
447 * fwu_revert_boot_index() - Revert the active index in the FWU metadata
449 * Revert the active_index value in the FWU metadata, by swapping the values
450 * of active_index and previous_active_index in both copies of the
453 * Return: 0 if OK, -ve on error
456 int fwu_revert_boot_index(void)
459 u32 cur_active_index;
461 struct fwu_mdata mdata = { 0 };
463 ret = fwu_get_dev_mdata(&dev, &mdata);
468 * Swap the active index and previous_active_index fields
469 * in the FWU metadata
471 cur_active_index = mdata.active_index;
472 mdata.active_index = mdata.previous_active_index;
473 mdata.previous_active_index = cur_active_index;
476 * Now write this updated FWU metadata to both the
477 * FWU metadata partitions
479 ret = fwu_update_mdata(dev, &mdata);
481 log_debug("Failed to update FWU metadata partitions\n");
489 * fwu_clrset_image_accept() - Set or Clear the Acceptance bit for the image
490 * @img_type_id: GUID of the image type for which the accepted bit is to be
492 * @bank: Bank of which the image's Accept bit is to be set or cleared
493 * @action: Action which specifies whether image's Accept bit is to be set or
496 * Set/Clear the accepted bit for the image specified by the img_guid parameter.
497 * This indicates acceptance or rejection of image for subsequent boots by some
498 * governing component like OS(or firmware).
500 * Return: 0 if OK, -ve on error
503 static int fwu_clrset_image_accept(efi_guid_t *img_type_id, u32 bank, u8 action)
507 struct fwu_mdata mdata = { 0 };
508 struct fwu_image_entry *img_entry;
509 struct fwu_image_bank_info *img_bank_info;
511 ret = fwu_get_dev_mdata(&dev, &mdata);
515 img_entry = &mdata.img_entry[0];
516 for (i = 0; i < CONFIG_FWU_NUM_IMAGES_PER_BANK; i++) {
517 if (!guidcmp(&img_entry[i].image_type_uuid, img_type_id)) {
518 img_bank_info = &img_entry[i].img_bank_info[bank];
519 if (action == IMAGE_ACCEPT_SET)
520 img_bank_info->accepted |= FWU_IMAGE_ACCEPTED;
522 img_bank_info->accepted = 0;
524 ret = fwu_update_mdata(dev, &mdata);
529 /* Image not found */
537 * fwu_accept_image() - Set the Acceptance bit for the image
538 * @img_type_id: GUID of the image type for which the accepted bit is to be
540 * @bank: Bank of which the image's Accept bit is to be set
542 * Set the accepted bit for the image specified by the img_guid parameter. This
543 * indicates acceptance of image for subsequent boots by some governing component
544 * like OS(or firmware).
546 * Return: 0 if OK, -ve on error
549 int fwu_accept_image(efi_guid_t *img_type_id, u32 bank)
551 return fwu_clrset_image_accept(img_type_id, bank,
556 * fwu_clear_accept_image() - Clear the Acceptance bit for the image
557 * @img_type_id: GUID of the image type for which the accepted bit is to be
559 * @bank: Bank of which the image's Accept bit is to be cleared
561 * Clear the accepted bit for the image type specified by the img_type_id parameter.
562 * This function is called after the image has been updated. The accepted bit is
563 * cleared to be set subsequently after passing the image acceptance criteria, by
564 * either the OS(or firmware)
566 * Return: 0 if OK, -ve on error
569 int fwu_clear_accept_image(efi_guid_t *img_type_id, u32 bank)
571 return fwu_clrset_image_accept(img_type_id, bank,
576 * fwu_plat_get_update_index() - Get the value of the update bank
577 * @update_idx: Bank number to which images are to be updated
579 * Get the value of the bank(partition) to which the update needs to be
582 * Note: This is a weak function and platforms can override this with
583 * their own implementation for selection of the update bank.
585 * Return: 0 if OK, -ve on error
588 __weak int fwu_plat_get_update_index(uint *update_idx)
593 ret = fwu_get_active_index(&active_idx);
597 *update_idx = (active_idx + 1) % CONFIG_FWU_NUM_BANKS;
603 * fwu_update_checks_pass() - Check if FWU update can be done
605 * Check if the FWU update can be executed. The updates are
606 * allowed only when the platform is not in Trial State and
607 * the boot time checks have passed
609 * Return: 1 if OK, 0 if checks do not pass
612 u8 fwu_update_checks_pass(void)
614 return !in_trial && boottime_check;
618 * fwu_empty_capsule_checks_pass() - Check if empty capsule can be processed
620 * Check if the empty capsule can be processed to either accept or revert
621 * an earlier executed update. The empty capsules need to be processed
622 * only when the platform is in Trial State and the boot time checks have
625 * Return: 1 if OK, 0 if not to be allowed
628 u8 fwu_empty_capsule_checks_pass(void)
630 return in_trial && boottime_check;
633 static int fwu_boottime_checks(void *ctx, struct event *event)
636 u32 boot_idx, active_idx;
638 struct fwu_mdata mdata = { 0 };
640 ret = fwu_check_mdata_validity();
645 * Get the Boot Index, i.e. the bank from
646 * which the platform has booted. This value
647 * gets passed from the ealier stage bootloader
648 * which booted u-boot, e.g. tf-a. If the
649 * boot index is not the same as the
650 * active_index read from the FWU metadata,
651 * update the active_index.
653 fwu_plat_get_bootidx(&boot_idx);
654 if (boot_idx >= CONFIG_FWU_NUM_BANKS) {
655 log_err("Received incorrect value of boot_index\n");
659 ret = fwu_get_active_index(&active_idx);
661 log_err("Unable to read active_index\n");
665 if (boot_idx != active_idx) {
666 log_info("Boot idx %u is not matching active idx %u, changing active_idx\n",
667 boot_idx, active_idx);
668 ret = fwu_set_active_index(boot_idx);
675 if (efi_init_obj_list() != EFI_SUCCESS)
678 ret = fwu_get_dev_mdata(&dev, &mdata);
682 in_trial = in_trial_state(&mdata);
683 if (!in_trial || (ret = fwu_trial_count_update()) > 0)
684 ret = trial_counter_update(NULL);
691 EVENT_SPY(EVT_MAIN_LOOP, fwu_boottime_checks);