[U-Boot] [PATCH 4/9] efi_loader: Add boot time services

[Alexander Graf <agraf@suse.de>]

On 26.12.15 19:09, Leif Lindholm wrote:
> On Tue, Dec 22, 2015 at 02:57:51PM +0100, Alexander Graf wrote:
>> When an EFI application runs, it has access to a few descriptor and callback
>> tables to instruct the EFI compliant firmware to do things for it. The bulk
>> of those interfaces are "boot time services". They handle all object management,
>> and memory allocation.
>>
>> This patch adds support for the boot time services and also exposes a system
>> table, which is the point of entry descriptor table for EFI payloads.
> 
> One overall observation, and I may help track these down - but not all
> for this review: this code uses EFI_UNSUPPORTED as a default
> "something went wrong" error code, but this is not actually supported
> by the specification. I'm pointing out a few of these, but it would be
> preferable if we could crowdsource this a bit since there are quire a
> few instances...
> 
>> Signed-off-by: Alexander Graf <agraf@suse.de>
>> ---
>>  include/efi_loader.h          |  41 +++
>>  lib/efi_loader/efi_boottime.c | 838 ++++++++++++++++++++++++++++++++++++++++++
>>  2 files changed, 879 insertions(+)
>>  create mode 100644 lib/efi_loader/efi_boottime.c
>>
>> diff --git a/include/efi_loader.h b/include/efi_loader.h
>> index da82354..ed7c389 100644
>> --- a/include/efi_loader.h
>> +++ b/include/efi_loader.h
>> @@ -24,14 +24,55 @@
>>  #include <efi_api.h>
>>  #include <linux/list.h>
>>  
>> +/* #define DEBUG_EFI */
>> +
>> +#ifdef DEBUG_EFI
>> +#define EFI_ENTRY(format, ...) do { \
>> +	efi_restore_gd(); \
>> +	printf("EFI: Entry %s(" format ")\n", __func__, ##__VA_ARGS__); \
>> +	} while(0)
>> +#else
>> +#define EFI_ENTRY(format, ...) do { \
>> +	efi_restore_gd(); \
>> +	} while(0)
>> +#endif
>> +
>> +#define EFI_EXIT(ret) efi_exit_func(ret);
>> +
>> +extern struct efi_system_table systab;
>> +
>>  extern const efi_guid_t efi_guid_device_path;
>>  extern const efi_guid_t efi_guid_loaded_image;
>>  
>> +struct efi_class_map {
>> +	const efi_guid_t *guid;
>> +	const void *interface;
>> +};
>> +
>> +struct efi_handler {
>> +	const efi_guid_t *guid;
>> +	efi_status_t (EFIAPI *open)(void *handle,
>> +			efi_guid_t *protocol, void **protocol_interface,
>> +			void *agent_handle, void *controller_handle,
>> +			uint32_t attributes);
>> +};
>> +
>> +struct efi_object {
>> +	struct list_head link;
>> +	struct efi_handler protocols[4];
>> +	void *handle;
>> +};
>> +extern struct list_head efi_obj_list;
>> +
>>  efi_status_t efi_return_handle(void *handle,
>>  		efi_guid_t *protocol, void **protocol_interface,
>>  		void *agent_handle, void *controller_handle,
>>  		uint32_t attributes);
>> +void efi_timer_check(void);
>>  void *efi_load_pe(void *efi, struct efi_loaded_image *loaded_image_info);
>> +void efi_save_gd(void);
>> +void efi_restore_gd(void);
>> +efi_status_t efi_exit_func(efi_status_t ret);
>>  
>>  #define EFI_LOADER_POOL_SIZE (128 * 1024 * 1024)
>>  void *efi_loader_alloc(uint64_t len);
>> diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
>> new file mode 100644
>> index 0000000..ed95962
>> --- /dev/null
>> +++ b/lib/efi_loader/efi_boottime.c
>> @@ -0,0 +1,838 @@
>> +/*
>> + *  EFI application boot time services
>> + *
>> + *  Copyright (c) 2015 Alexander Graf
>> + *
>> + *  This library is free software; you can redistribute it and/or
>> + *  modify it under the terms of the GNU Lesser General Public
>> + *  License as published by the Free Software Foundation; either
>> + *  version 2.1 of the License, or (at your option) any later version.
>> + *
>> + *  This library is distributed in the hope that it will be useful,
>> + *  but WITHOUT ANY WARRANTY; without even the implied warranty of
>> + *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
>> + *  Lesser General Public License for more details.
>> + *
>> + *  You should have received a copy of the GNU Lesser General Public
>> + *  License along with this library; if not, write to the Free Software
>> + *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
>> + *
>> + *  SPDX-License-Identifier:     LGPL-2.1+
>> + */
>> +
>> +#define DEBUG_EFI
>> +
>> +#include <common.h>
>> +#include <efi_loader.h>
>> +#include <malloc.h>
>> +#include <asm/global_data.h>
>> +#include <libfdt_env.h>
>> +#include <u-boot/crc.h>
>> +#include <bootm.h>
>> +#include <inttypes.h>
>> +#include <watchdog.h>
>> +
>> +DECLARE_GLOBAL_DATA_PTR;
>> +
>> +/*
>> + * EFI can pass arbitrary additional "tables" containing vendor specific
>> + * information to the payload. One such table is the FDT table which contains
>> + * a pointer to a flattened device tree blob.
>> + *
>> + * In most cases we want to pass an FDT to the payload, so reserve one slot of
>> + * config table space for it. The pointer gets populated by do_bootefi_exec().
>> + */
>> +static struct efi_configuration_table efi_conf_table[] = {
>> +	{
>> +		.guid = EFI_FDT_GUID,
>> +	},
>> +};
>> +
>> +/*
>> + * The "gd" pointer lives in a register on ARM and AArch64 that we declare
>> + * fixed when compiling U-Boot. However, the payload does now know about that
>> + * restriction so we need to manually swap its and our view of that register on
>> + * EFI callback entry/exit.
>> + */
>> +static volatile void *efi_gd, *app_gd;
>> +
>> +/* Called from do_bootefi_exec() */
>> +void efi_save_gd(void)
>> +{
>> +	efi_gd = gd;
>> +}
>> +
>> +/* Called on every callback entry */
>> +void efi_restore_gd(void)
>> +{
>> +	if (gd != efi_gd)
>> +		app_gd = gd;
>> +	gd = efi_gd;
>> +}
>> +
>> +/* Called on every callback exit */
>> +efi_status_t efi_exit_func(efi_status_t ret)
>> +{
>> +	gd = app_gd;
>> +	return ret;
>> +}
>> +
>> +static efi_status_t efi_unsupported(const char *funcname)
>> +{
>> +#ifdef DEBUG_EFI
>> +	printf("EFI: App called into unimplemented function %s\n", funcname);
>> +#endif
>> +	return EFI_EXIT(EFI_UNSUPPORTED);
> 
> Not always a legal return status.
> 
>> +}
>> +
>> +static unsigned long efi_raise_tpl(unsigned long new_tpl)
>> +{
>> +	EFI_ENTRY("0x%lx", new_tpl);
>> +	return EFI_EXIT(efi_unsupported(__func__));
> 
> "Unlike other UEFI interface functions, EFI_BOOT_SERVICES.RaiseTPL()
> does not return a status code. Instead, it returns the previous task
> priority level, which is to be restored later with a matching call to
> RestoreTPL()."

Since we don't do TPLs (or IRQs for that matter), I'll just return 0 here.

> 
>> +}
>> +
>> +static void efi_restore_tpl(unsigned long old_tpl)
>> +{
>> +	EFI_ENTRY("0x%lx", old_tpl);
>> +	EFI_EXIT(efi_unsupported(__func__));
> 
> (void function, nothing to return)

Yes, hence no return. EFI_EXIT deals with the gd swapping and
efi_unsupported() gives me a nice debug message :).

> 
>> +}
>> +
>> +static void *efi_alloc(uint64_t len, int memory_type)
>> +{
>> +	switch (memory_type) {
>> +	case EFI_LOADER_DATA:
>> +		return efi_loader_alloc(len);
>> +	default:
>> +		return malloc(len);
>> +	}
>> +}
>> +
>> +static efi_status_t efi_allocate_pages(int type, int memory_type,
>> +				       unsigned long pages, uint64_t *memory)
>> +{
>> +	u64 len = pages << 12;
>> +	efi_status_t r = EFI_SUCCESS;
>> +
>> +	EFI_ENTRY("%d, %d, 0x%lx, %p", type, memory_type, pages, memory);
>> +
>> +	switch (type) {
>> +	case 0:
>> +		/* Any page means we can go to efi_alloc */
>> +		*memory = (unsigned long)efi_alloc(len, memory_type);
>> +		break;
>> +	case 1:
>> +		/* Max address */
>> +		if (gd->relocaddr < *memory) {
>> +			*memory = (unsigned long)efi_alloc(len, memory_type);
>> +			break;
>> +		}
>> +		r = EFI_UNSUPPORTED;
> 
> EFI_OUT_OF_RESOURCES/EFI_NOT_FOUND?
> 
>> +		break;
>> +	case 2:
>> +		/* Exact address, grant it. The addr is already in *memory. */
> 
> As far as I can tell, this is why GRUB works. Because it filters
> through the memory map manually, requesting to allocate its heap at an
> exact address in a region of free memory in the UEFI memory map.

Yes.

> The key is that EFI_LOADER_MEMORY will be used by applications loaded
> as well as by U-Boot to load applications into. A simple example where
> this could be problematic would be a large(ish) initrd loaded via initrd=
> on kernel (stub loader) command line rather than via GRUB.

Ah, so here the 128MB limit on the LOADER_DATA section might bite us?

> 
>> +		break;
>> +	default:
> 
> It would actually be fair here to state that the above are the only
> types supported by the UEFI specification, as opposed to not being
> implemented.
> 
>> +		r = EFI_UNSUPPORTED;
> 
> Actually, not a valid return value.
> EFI_INVALID_PARAMETER
> 
>> +		break;
>> +	}
>> +
>> +	return EFI_EXIT(r);
>> +}
>> +
>> +static efi_status_t efi_free_pages(uint64_t memory, unsigned long pages)
>> +{
>> +	/* We don't free, let's cross our fingers we have plenty RAM */
>> +	EFI_ENTRY("%"PRIx64", 0x%lx", memory, pages);
>> +	return EFI_EXIT(EFI_SUCCESS);
>> +}
>> +
>> +/*
>> + * Returns the EFI memory map. In our case, this looks pretty simple:
>> + *
>> + *  ____________________________    TOM
>> + * |                            |
>> + * |    Second half of U-Boot   |
>> + * |____________________________|   &__efi_runtime_stop
>> + * |                            |
>> + * |    EFI Runtime Services    |
>> + * |____________________________|   &__efi_runtime_start
>> + * |                            |
>> + * |    First half of U-Boot    |
>> + * |____________________________|   start of EFI loader allocation space
>> + * |                            |
>> + * |          Free RAM          |
>> + * |____________________________|   CONFIG_SYS_SDRAM_BASE
>> + *
>> + * All pointers are extended to live on a 4k boundary. After exiting the boot
>> + * services, only the EFI Runtime Services chunk of memory stays alive.
>> + */
>> +static efi_status_t efi_get_memory_map(unsigned long *memory_map_size,
>> +			       struct efi_mem_desc *memory_map,
>> +			       unsigned long *map_key,
>> +			       unsigned long *descriptor_size,
>> +			       uint32_t *descriptor_version)
>> +{
>> +	struct efi_mem_desc efi_memory_map[] = {
>> +		{
>> +			/* RAM before U-Boot */
>> +			.type = EFI_CONVENTIONAL_MEMORY,
>> +			.attribute = 1 << EFI_MEMORY_WB_SHIFT,
>> +		},
>> +		{
>> +			/* First half of U-Boot */
>> +			.type = EFI_LOADER_DATA,
>> +			.attribute = 1 << EFI_MEMORY_WB_SHIFT,
>> +		},
>> +		{
>> +			/* EFI Runtime Services */
>> +			.type = EFI_RUNTIME_SERVICES_CODE,
>> +			.attribute = 1 << EFI_MEMORY_WB_SHIFT,
>> +		},
>> +		{
>> +			/* Second half of U-Boot */
>> +			.type = EFI_LOADER_DATA,
>> +			.attribute = 1 << EFI_MEMORY_WB_SHIFT,
>> +		},
>> +	};
>> +	ulong runtime_start, runtime_end, runtime_len_pages, runtime_len;
>> +
>> +	EFI_ENTRY("%p, %p, %p, %p, %p", memory_map_size, memory_map, map_key,
>> +		  descriptor_size, descriptor_version);
>> +
>> +	runtime_start = (ulong)&__efi_runtime_start & ~0xfffULL;
>> +	runtime_end = ((ulong)&__efi_runtime_stop + 0xfff) & ~0xfffULL;
>> +	runtime_len_pages = (runtime_end - runtime_start) >> 12;
>> +	runtime_len = runtime_len_pages << 12;
>> +
>> +	/* Fill in where normal RAM is (up to U-Boot) */
>> +	efi_memory_map[0].num_pages = gd->relocaddr >> 12;
> 
> U-Boot question: is gd->relocaddr always the offset from start of RAM?
> How does this work with gaps in memory map?

U-Boot always relocates itself at TOM (or at least what we consider TOM
here). gd->relocaddr is the physical address of the start of U-Boot
which is right below TOM.

> 
>> +#ifdef CONFIG_SYS_SDRAM_BASE
>> +	efi_memory_map[0].physical_start = CONFIG_SYS_SDRAM_BASE;
>> +	efi_memory_map[0].virtual_start = CONFIG_SYS_SDRAM_BASE;
>> +	efi_memory_map[0].num_pages -= CONFIG_SYS_SDRAM_BASE >> 12;
> #else
> #error "..."
> ?

If it's not defined, it's 0 :).

>> +#endif
>> +
>> +	/* Remove U-Boot from the available RAM view */
>> +	efi_memory_map[0].num_pages -= gd->mon_len >> 12;
>> +
>> +	/* Remove the malloc area from the available RAM view */
>> +	efi_memory_map[0].num_pages -= TOTAL_MALLOC_LEN >> 12;
>> +
>> +	/* Give us some space for the stack */
>> +	efi_memory_map[0].num_pages -= (16 * 1024 * 1024) >> 12;
>> +
>> +	/* Reserve the EFI loader pool */
>> +	efi_memory_map[0].num_pages -= EFI_LOADER_POOL_SIZE >> 12;
>> +
>> +	/* Cut out the runtime services */
>> +	efi_memory_map[2].physical_start = runtime_start;
>> +	efi_memory_map[2].virtual_start = efi_memory_map[2].physical_start;
>> +	efi_memory_map[2].num_pages = runtime_len_pages;
>> +
>> +	/* Allocate the rest to U-Boot */
>> +	efi_memory_map[1].physical_start = efi_memory_map[0].physical_start +
>> +					   (efi_memory_map[0].num_pages << 12);
>> +	efi_memory_map[1].virtual_start = efi_memory_map[1].physical_start;
>> +	efi_memory_map[1].num_pages = (runtime_start -
>> +				       efi_memory_map[1].physical_start) >> 12;
>> +
>> +	efi_memory_map[3].physical_start = runtime_start + runtime_len;
>> +	efi_memory_map[3].virtual_start = efi_memory_map[3].physical_start;
>> +	efi_memory_map[3].num_pages = (gd->ram_top -
>> +				       efi_memory_map[3].physical_start) >> 12;
>> +
>> +	*memory_map_size = sizeof(efi_memory_map);
>> +
>> +	if (descriptor_size)
>> +		*descriptor_size = sizeof(struct efi_mem_desc);
>> +
>> +	if (*memory_map_size < sizeof(efi_memory_map)) {
>> +		return EFI_EXIT(EFI_BUFFER_TOO_SMALL);
>> +	}
>> +
>> +	if (memory_map)
>> +		memcpy(memory_map, efi_memory_map, sizeof(efi_memory_map));
>> +
>> +	return EFI_EXIT(EFI_SUCCESS);
>> +}
>> +
>> +static efi_status_t efi_allocate_pool(int pool_type, unsigned long size, void **buffer)
>> +{
>> +	return efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer);
>> +}
>> +
>> +static efi_status_t efi_free_pool(void *buffer)
>> +{
>> +	return efi_free_pages((ulong)buffer, 0);
>> +}
>> +
>> +/*
>> + * Our event capabilities are very limited. Only support a single
>> + * event to exist, so we don't need to maintain lists.
>> + */
>> +static struct {
>> +	enum efi_event_type type;
>> +	u32 trigger_type;
>> +	u32 trigger_time;
>> +	u64 trigger_next;
>> +	unsigned long notify_tpl;
>> +	void (*notify_function) (void *event, void *context);
>> +	void *notify_context;
>> +} efi_event;
>> +
>> +static efi_status_t efi_create_event(enum efi_event_type type, ulong notify_tpl,
>> +			     void (*notify_function) (void *event,
>> +						      void *context),
>> +			     void *notify_context, void **event)
>> +{
>> +	EFI_ENTRY("%d, 0x%lx, %p, %p", type, notify_tpl, notify_function,
>> +		  notify_context);
>> +	if (efi_event.notify_function) {
>> +		/* We only support one event at a time */
>> +		return EFI_EXIT(EFI_UNSUPPORTED);
> 
> EFI_OUT_OF_RESOURCES would be a better return value here.

Yup.

> 
>> +	}
>> +
>> +	efi_event.type = type;
>> +	efi_event.notify_tpl = notify_tpl;
>> +	efi_event.notify_function = notify_function;
>> +	efi_event.notify_context = notify_context;
>> +	*event = &efi_event;
>> +
>> +	return EFI_EXIT(EFI_SUCCESS);
>> +}
>> +
>> +/*
>> + * Our timers have to work without interrupts, so we check whenever keyboard
>> + * input or disk accesses happen if enough time elapsed for it to fire.
>> + */
>> +void efi_timer_check(void)
>> +{
>> +	u64 now = timer_get_us();
>> +
>> +	if (now >= efi_event.trigger_next) {
>> +		/* Triggering! */
>> +		if (efi_event.trigger_type == EFI_TIMER_PERIODIC)
>> +			efi_event.trigger_next += efi_event.trigger_time / 10;
>> +		efi_event.notify_function(&efi_event, efi_event.notify_context);
>> +	}
>> +
>> +	WATCHDOG_RESET();
>> +}
>> +
>> +static efi_status_t efi_set_timer(void *event, int type, uint64_t trigger_time)
>> +{
>> +	/* We don't have 64bit division available everywhere, so limit timer
>> +	 * distances to 32bit bits. */
>> +	u32 trigger32 = trigger_time;
> 
> Add a warning message if this limit is exceeded?

ok

> 
>> +
>> +	EFI_ENTRY("%p, %d, %"PRIx64, event, type, trigger_time);
>> +	if (event != &efi_event) {
>> +		/* We only support one event at a time */
>> +		return EFI_EXIT(EFI_UNSUPPORTED);
> 
> This function should only ever be called with an event successfully
> created via create_event (and stored into efi_event). If we're called
> with another event handle, EFI_INVALID_PARAMETER is the appropriate
> error code.

Sounds reasonable.

> 
>> +	}
>> +
>> +	switch (type) {
>> +	case EFI_TIMER_STOP:
>> +		efi_event.trigger_next = -1ULL;
>> +		break;
>> +	case EFI_TIMER_PERIODIC:
>> +	case EFI_TIMER_RELATIVE:
>> +		efi_event.trigger_next = timer_get_us() + (trigger32 / 10);
>> +		break;
>> +	default:
>> +		return EFI_EXIT(EFI_UNSUPPORTED);
>> +	}
>> +	efi_event.trigger_type = type;
>> +	efi_event.trigger_time = trigger_time;
>> +
>> +	return EFI_EXIT(EFI_SUCCESS);
>> +}

[...]

>> +static const struct efi_boot_services efi_boot_services = {
>> +	.hdr = {
>> +		.headersize = sizeof(struct efi_table_hdr),
>> +	},
>> +	.raise_tpl = efi_raise_tpl,
>> +	.restore_tpl = efi_restore_tpl,
>> +	.allocate_pages = efi_allocate_pages,
>> +	.free_pages = efi_free_pages,
>> +	.get_memory_map = efi_get_memory_map,
>> +	.allocate_pool = efi_allocate_pool,
>> +	.free_pool = efi_free_pool,
>> +	.create_event = efi_create_event,
>> +	.set_timer = efi_set_timer,
>> +	.wait_for_event = efi_wait_for_event,
>> +	.signal_event = efi_signal_event,
>> +	.close_event = efi_close_event,
>> +	.check_event = efi_check_event,
>> +	.install_protocol_interface = efi_install_protocol_interface,
>> +	.reinstall_protocol_interface = efi_reinstall_protocol_interface,
>> +	.uninstall_protocol_interface = efi_uninstall_protocol_interface,
>> +	.handle_protocol = efi_handle_protocol,
>> +	.reserved = NULL,
>> +	.register_protocol_notify = efi_register_protocol_notify,
>> +	.locate_handle = efi_locate_handle,
>> +	.locate_device_path = efi_locate_device_path,
>> +	.install_configuration_table = efi_install_configuration_table,
>> +	.load_image = efi_load_image,
>> +	.start_image = efi_start_image,
>> +	.exit = (void*)efi_exit,
>> +	.unload_image = efi_unload_image,
>> +	.exit_boot_services = efi_exit_boot_services,
>> +	.get_next_monotonic_count = efi_get_next_monotonic_count,
>> +	.stall = efi_stall,
>> +	.set_watchdog_timer = efi_set_watchdog_timer,
>> +	.connect_controller = efi_connect_controller,
>> +	.disconnect_controller = efi_disconnect_controller,
>> +	.open_protocol = efi_open_protocol,
>> +	.close_protocol = efi_close_protocol,
>> +	.open_protocol_information = efi_open_protocol_information,
>> +	.protocols_per_handle = efi_protocols_per_handle,
>> +	.locate_handle_buffer = efi_locate_handle_buffer,
>> +	.locate_protocol = efi_locate_protocol,
>> +	.install_multiple_protocol_interfaces = efi_install_multiple_protocol_interfaces,
>> +	.uninstall_multiple_protocol_interfaces = efi_uninstall_multiple_protocol_interfaces,
>> +	.calculate_crc32 = efi_calculate_crc32,
>> +	.copy_mem = efi_copy_mem,
>> +	.set_mem = efi_set_mem,
>> +};
>> +
>> +
>> +static uint16_t firmware_vendor[] = { 'U','-','b','o','o','t',0 };
> 
> Surely, if we're being formal, that should be 'D', 'a', 's', ' ',
> ... :)

Heh :) Sure!

> 
>> +struct efi_system_table systab = {
>> +	.hdr = {
>> +		.signature = EFI_SYSTEM_TABLE_SIGNATURE,
>> +		.revision = 0x20000, /* 2.0 */
> 
> Really, this should claim to support revision 2.5, if not 2.6 (soon
> to be released). AArch64 support was only introduced in 2.4.

Works for me :).


Alex