bfrec

#!/bin/bash

# Copyright (c) 2020, Mellanox Technologies
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice, this
#    list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright notice,
#    this list of conditions and the following disclaimer in the documentation
#    and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
# The views and conclusions contained in the software and documentation are those
# of the authors and should not be interpreted as representing official policies,
# either expressed or implied, of the FreeBSD Project.

set -e

# To debug set run=echo
run=

PROGNAME=$(basename "$0")

usage()
{
    cat <<EOF
Usage: $PROGNAME    [--help]
                    [--bootctl [FILE]]
                    [--capsule [FILE]]

Description:
  --help                : print help.
  --bootctl [FILE]      : update the boot partition via the
                          kernel path. If FILE isn't specified,
                          /lib/firmware/mellanox/boot/default.bfb
                          will be used by default.
  --capsule [FILE]      : update the boot partition via the
                          capsule path. If FILE isn't specified,
                          /lib/firmware/mellanox/boot/capsule/MmcBootCap
                          will be used by default.
  --policy POLICY       : determines the update policy. may be:
                            single - updates the secondary partition and
                                     swaps to it
                            dual   - updates both boot partitions, does not
                                     swap

                          if this flag is not specified, 'single' policy is
                          assumed.
EOF
    exit 0
}

bootctl_mode=
capsule_mode=

PARSED_OPTIONS=$(getopt -n "$PROGNAME" -o h -l help,bootctl,capsule,policy: -- "$@")
eval set -- "$PARSED_OPTIONS"

while true
do
  case $1 in
      -h | --help)
          usage
          ;;
      --bootctl)
          bootctl_mode=1
          shift
          ;;
      --capsule)
          capsule_mode=1
          shift
          ;;
      --policy)
          policy=$2
          shift 2
          ;;
      --)
          shift
          break
          ;;
  esac
done

# Mount efivars sysfs if not already
efivars=/sys/firmware/efi/efivars
test "$(ls -A $efivars)" || mount -t efivarfs efivarfs $efivars

# Check secure boot
secure_boot=
if [ -e "$efivars/PK-8be4df61-93ca-11d2-aa0d-00e098032b8c" ]; then
    secure_boot=1
fi

# Only allow capsule when secure boot is enabled.
if [ -n "$bootctl_mode" ]; then
    if [ -n "$secure_boot" ]; then
        echo "ERROR: need to use capsule in secure boot mode"
        exit 1
    fi

    if [ -n "$capsule_mode" ]; then
        echo "ERROR: Use either options '--bootctl' or '--capsule'"
        exit 1
    fi
elif [ -z "$capsule_mode" ]; then
    if [ -n "$secure_boot" ]; then
      capsule_mode=1
    else
      bootctl_mode=1
    fi
fi

#
# Fall back to bootctl mode if capsule is not supported, which is
# needed to be compatible with old boot-image versions.
#
os_cap_var=OsIndicationsSupported-8be4df61-93ca-11d2-aa0d-00e098032b8c
os_var=OsIndications-8be4df61-93ca-11d2-aa0d-00e098032b8c
if [ ! -e "${efivars}/${os_cap_var}" ]; then
    capsule_mode=
    bootctl_mode=1
else
    # Check the EFI_OS_INDICATIONS_FILE_CAPSULE_DELIVERY_SUPPORTED bit.
    cp -f ${efivars}/${os_cap_var} /tmp/
    os_cap=$(hexdump -s 4 -n 1  -e '/1 "%d" "\n"' /tmp/${os_cap_var})
    os_cap=$((os_cap & 4))
    if [ $os_cap -eq 0 ]; then
        capsule_mode=
        bootctl_mode=1
    fi
fi

bfb_location=/lib/firmware/mellanox/boot
capsule_location=/lib/firmware/mellanox/boot/capsule

uefi_capsule_update()
{
    # Set EFI System partition mountpoint
    mount_efi=/mnt/efi_system_partition

    # Set capsule update file variable name
    capsule_efi=MmcBootCap
    device_efi=/dev/mmcblk0p1

    # UEFI will read the capsule image from the EFI System Partition.
    # Check whether an EFI System partition is present. If not, then
    # the capsule update is not supported;
    if ! fdisk -l | grep -q "EFI System" >/dev/null; then
        echo "cannot find EFI System Partition"
        exit 2
    fi

    if [ ! -f "$capsule_file" ]; then
        capsule_file=$capsule_location/$capsule_efi
    fi

    if [ ! -f "$capsule_file" ]; then
        echo "Capsule file not found"
        exit 2
    fi

    # Check whether the EFI System Partition is mounted. If not mounted,
    # then create the mountpoint and mount the disk partition to the
    # default location in order to copy the update files.
    esp_dir=$(mount | grep $device_efi | cut -f 3 -d' ')
    if [ -z "$esp_dir" ]; then
        if [ ! -d $mount_efi ]; then
            $run mkdir $mount_efi
        fi
        $run mount $device_efi $mount_efi
    else
        mount_efi=$esp_dir
    fi

    # Copy the capsule file into the EFI System Partition.
    # "EFI/UpdateCapsule" is the standard directory defined by UEFI spec.
    # Files in this directory will processed as capsules in alphabetical
    # order once the capsule flag is set in the 'OsIndications' variable
    # which is done by the printf command below.
    $run mkdir -p "$mount_efi/EFI/UpdateCapsule" 2>/dev/null
    $run cp $capsule_file "$mount_efi/EFI/UpdateCapsule/${capsule_efi}1"
    if [ "$policy" = "dual" ]; then
        $run cp $capsule_file "$mount_efi/EFI/UpdateCapsule/${capsule_efi}2"
    fi

    $run printf "\x07\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00" > \
        "${efivars}/${os_var}"
    $run sync

    # Doing some cleanup, if needed
    if [ -z "$esp_dir"  ]; then
        $run umount "$mount_efi"
        $run rmdir "$mount_efi"
        $run sync
        # Wait until eMMC internal cache is fully flushed
        $run sleep 3
    fi

    cat <<EOF

    ***********************************************************************
    ***                                                                 ***
    ***    Reboot the system to process the platform firmware updates   ***
    ***                                                                 ***
    ***********************************************************************

EOF

    # Enable card-reset
    $run /sbin/mlxbf-bootctl -e

    return 0
}

kernel_bootctl_update()
{
    bfb_device=/dev/mmcblk0

    if ! command -v mlxbf-bootctl >/dev/null; then
        echo "mlxbf-bootctl program is not supported"
        exit 2
    fi

    if [ ! -b "$bfb_device" ]; then
        echo "bad block device $bfb_device"
        exit 2
    fi

    if [ -z "$bfb_file" ]; then
        bfb_file=$bfb_location/default.bfb
    fi

    if [ ! -f "$bfb_file" ]; then
        echo "cannot find file $bfb_file"
        exit 2
    fi

    $run /sbin/mlxbf-bootctl -s -d $bfb_device -b $bfb_file
    if [ "$policy" = "dual" ]; then
        # in dual case, run command again to update both partitions
        $run /sbin/mlxbf-bootctl -s -d $bfb_device -b $bfb_file
    fi
    $run sync

    cat <<EOF

    ***********************************************************************
    ***                                                                 ***
    ***                 Platform firmware updates complete.             ***
    ***                                                                 ***
    ***********************************************************************

EOF

    return 0
}

#
# Parse command arguments
#

if [ -n "$bootctl_mode" ] || [ -n "$capsule_mode" ]; then
    bfb_file=
    capsule_file=
    if [ $# -eq 1 ]; then
        if [ ! -f "$1" ]; then
	    echo "cannot find file $1"
	    exit 1
	fi
        bfb_file=$1
	capsule_file=$1
    fi
fi

if [ -n "$policy" ]; then
    if [ "$policy" != "single" ] && [ "$policy" != "dual" ]; then
        echo "ERROR: policy must be either 'single' or 'dual'"
        exit 1
    fi
else # default policy
    policy="single"
fi

if [ -n "$bootctl_mode" ]; then
    if [ $# -ge 2 ]; then
        echo "too many arguments"
        exit 1
    fi

    # Update the boot partitions.
    kernel_bootctl_update; exit $?

elif [ -n "$capsule_mode" ]; then
    if [ $# -ge 2 ]; then
        echo "too many arguments with option '--capsule'"
        exit 1
    fi

    # Initiate UEFI capsule update.
    uefi_capsule_update; exit $?
fi