[PATCH] firmware: efi: add a separate timeout for UpdateCapsule()

[Yeoreum Yun]

On platforms that allows to update firmware in runtime, UpdateCapsule()
may immediately write a firmware image to persistent storage.
This operation can take longer than EFI_RTS_TIMEOUT.

Use a separate timeout for the UpdateCapsule() runtime service. By
default, wait indefinitely to avoid interrupting an ongoing firmware
update. Administrators may configure an appropriate timeout, in seconds,
through /sys/firmware/efi/capsule_update_timeout.

Signed-off-by: Yeoreum Yun <yeoreum.yun@xxxxxxx>
---
 drivers/firmware/efi/efi.c              | 41 +++++++++++++++++++++++++
 drivers/firmware/efi/runtime-wrappers.c | 14 +++------
 include/linux/efi.h                     | 10 ++++++
 3 files changed, 55 insertions(+), 10 deletions(-)

diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 0327a39d31fa..aef0ba170e3c 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -63,6 +63,18 @@ static unsigned long __initdata mem_reserve = EFI_INVALID_TABLE_ADDR;
 static unsigned long __initdata rt_prop = EFI_INVALID_TABLE_ADDR;
 static unsigned long __initdata initrd = EFI_INVALID_TABLE_ADDR;
 
+/*
+ * Depending on the platform, UpdateCapsule() may update the firmware
+ * immediately if the platform allows to update the firmware while in runtime.
+ * In this case, writing the image to firmware storage may take longer than
+ * EFI_RTS_TIMEOUT (120 seconds).
+ *
+ * To handle this, use a separate timeout for the UpdateCapsule() runtime
+ * service. Wait indefinitely by default, and allow administrators to set
+ * an appropriate timeout in seconds through /sys/firmware/efi/capsule_update_timeout.
+ */
+unsigned long efi_capsule_update_timeout = MAX_SCHEDULE_TIMEOUT;
+
 extern unsigned long primary_display_table;
 
 struct mm_struct efi_mm = {
@@ -163,15 +175,44 @@ static ssize_t fw_platform_size_show(struct kobject *kobj,
 	return sprintf(buf, "%d\n", efi_enabled(EFI_64BIT) ? 64 : 32);
 }
 
+static ssize_t capsule_update_timeout_show(struct kobject *kobj,
+					   struct kobj_attribute *attr, char *buf)
+{
+	return sysfs_emit(buf, "%lu\n", efi_capsule_update_timeout / HZ);
+}
+
+static ssize_t capsule_update_timeout_store(struct kobject *kobj,
+					    struct kobj_attribute *attr,
+					    const char *buf, size_t count)
+{
+	int ret;
+	unsigned long secs, timeout;
+
+	ret = kstrtoul(buf, 0, &secs);
+	if (ret)
+		return ret;
+	if (check_mul_overflow(secs, HZ, &timeout))
+		timeout = MAX_SCHEDULE_TIMEOUT;
+	if (timeout < EFI_RTS_TIMEOUT)
+		timeout = EFI_RTS_TIMEOUT;
+
+	efi_capsule_update_timeout = timeout;
+
+	return count;
+}
+
 extern __weak struct kobj_attribute efi_attr_fw_vendor;
 extern __weak struct kobj_attribute efi_attr_runtime;
 extern __weak struct kobj_attribute efi_attr_config_table;
 static struct kobj_attribute efi_attr_fw_platform_size =
 	__ATTR_RO(fw_platform_size);
+static struct kobj_attribute efi_attr_capsule_update_timeout =
+	__ATTR_RW_MODE(capsule_update_timeout, 0600);
 
 static struct attribute *efi_subsys_attrs[] = {
 	&efi_attr_systab.attr,
 	&efi_attr_fw_platform_size.attr,
+	&efi_attr_capsule_update_timeout.attr,
 	&efi_attr_fw_vendor.attr,
 	&efi_attr_runtime.attr,
 	&efi_attr_config_table.attr,
diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
index 2344b9d1e81f..b0f867f828c1 100644
--- a/drivers/firmware/efi/runtime-wrappers.c
+++ b/drivers/firmware/efi/runtime-wrappers.c
@@ -118,14 +118,6 @@ union efi_rts_args {
 
 struct efi_runtime_work efi_rts_work;
 
-/*
- * Upper bound on how long we wait for a single EFI runtime service
- * call to finish before declaring firmware wedged. Chosen to be longer
- * than any plausible legitimate call (including UpdateCapsule on slow
- * SPI-NOR) while still bounding userspace wait time.
- */
-#define EFI_RTS_TIMEOUT		(120 * HZ)
-
 /*
  * efi_queue_work:	Queue EFI runtime service call and wait for completion
  * @_rts:		EFI runtime service function identifier
@@ -347,6 +339,8 @@ static void __nocfi efi_call_rts(struct work_struct *work)
 static efi_status_t __efi_queue_work(enum efi_rts_ids id,
 				     union efi_rts_args *args)
 {
+	unsigned long timeout;
+
 	if (!efi_enabled(EFI_RUNTIME_SERVICES)) {
 		pr_warn_once("EFI Runtime Services are disabled!\n");
 		return EFI_DEVICE_ERROR;
@@ -369,8 +363,8 @@ static efi_status_t __efi_queue_work(enum efi_rts_ids id,
 		goto exit;
 	}
 
-	if (!wait_for_completion_timeout(&efi_rts_work.efi_rts_comp,
-					 EFI_RTS_TIMEOUT)) {
+	timeout = (id == EFI_UPDATE_CAPSULE) ? efi_capsule_update_timeout : EFI_RTS_TIMEOUT;
+	if (!wait_for_completion_timeout(&efi_rts_work.efi_rts_comp, timeout)) {
 		pr_err("EFI runtime service %d wedged in firmware; disabling EFI runtime services\n",
 		       id);
 		clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
diff --git a/include/linux/efi.h b/include/linux/efi.h
index aa15ff88539b..8e14ca5e57de 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1345,4 +1345,14 @@ extern struct blocking_notifier_head efivar_ops_nh;
 void efivars_generic_ops_register(void);
 void efivars_generic_ops_unregister(void);
 
+/*
+ * Upper bound on how long we wait for a single EFI runtime service
+ * call to finish before declaring firmware wedged. Chosen to be longer
+ * than any plausible legitimate call (excluding UpdateCapsule() while
+ * still bounding userspace wait time.
+ */
+#define EFI_RTS_TIMEOUT		(120 * HZ)
+
+extern unsigned long efi_capsule_update_timeout;
+
 #endif /* _LINUX_EFI_H */
-- 
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}