4 Caution: This module requires additional review when modified.
5 This module will have external input - capsule image.
6 This external input must be validated carefully to avoid security issue like
7 buffer overflow, integer overflow.
9 ProcessCapsules(), ProcessTheseCapsules() will receive untrusted
10 input and do basic validation.
12 Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
13 This program and the accompanying materials
14 are licensed and made available under the terms and conditions of the BSD License
15 which accompanies this distribution. The full text of the license may be found at
16 http://opensource.org/licenses/bsd-license.php
18 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
19 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
24 #include <Protocol/EsrtManagement.h>
26 #include <Library/BaseLib.h>
27 #include <Library/DebugLib.h>
28 #include <Library/BaseMemoryLib.h>
29 #include <Library/UefiBootServicesTableLib.h>
30 #include <Library/UefiRuntimeServicesTableLib.h>
31 #include <Library/MemoryAllocationLib.h>
32 #include <Library/UefiLib.h>
33 #include <Library/PcdLib.h>
34 #include <Library/HobLib.h>
35 #include <Library/ReportStatusCodeLib.h>
36 #include <Library/CapsuleLib.h>
38 #include <IndustryStandard/WindowsUxCapsule.h>
41 Return if this FMP is a system FMP or a device FMP, based upon CapsuleHeader.
43 @param[in] CapsuleHeader A pointer to EFI_CAPSULE_HEADER
45 @retval TRUE It is a system FMP.
46 @retval FALSE It is a device FMP.
50 IN EFI_CAPSULE_HEADER
*CapsuleHeader
54 Validate Fmp capsules layout.
56 Caution: This function may receive untrusted input.
58 This function assumes the caller validated the capsule by using
59 IsValidCapsuleHeader(), so that all fields in EFI_CAPSULE_HEADER are correct.
60 The capsule buffer size is CapsuleHeader->CapsuleImageSize.
62 This function validates the fields in EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER
63 and EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER.
65 This function need support nested FMP capsule.
67 @param[in] CapsuleHeader Points to a capsule header.
68 @param[out] EmbeddedDriverCount The EmbeddedDriverCount in the FMP capsule.
70 @retval EFI_SUCESS Input capsule is a correct FMP capsule.
71 @retval EFI_INVALID_PARAMETER Input capsule is not a correct FMP capsule.
75 IN EFI_CAPSULE_HEADER
*CapsuleHeader
,
76 OUT UINT16
*EmbeddedDriverCount OPTIONAL
80 Validate if it is valid capsule header
82 This function assumes the caller provided correct CapsuleHeader pointer
85 This function validates the fields in EFI_CAPSULE_HEADER.
87 @param[in] CapsuleHeader Points to a capsule header.
88 @param[in] CapsuleSize Size of the whole capsule image.
92 IsValidCapsuleHeader (
93 IN EFI_CAPSULE_HEADER
*CapsuleHeader
,
97 extern BOOLEAN mDxeCapsuleLibEndOfDxe
;
98 extern BOOLEAN mAreAllImagesProcessed
;
103 This routine is called to process capsules.
105 Caution: This function may receive untrusted input.
107 Each individual capsule result is recorded in capsule record variable.
109 @param[in] NeedBlockDriver TRUE: Need skip the FMP capsules with non zero EmbeddedDriverCount.
110 FALSE: No need to skip any FMP capsules.
112 @retval EFI_SUCCESS There is no error when processing capsules.
113 @retval EFI_OUT_OF_RESOURCES No enough resource to process capsules.
117 ProcessTheseCapsules (
118 IN BOOLEAN NeedBlockDriver
122 EFI_PEI_HOB_POINTERS HobPointer
;
123 EFI_CAPSULE_HEADER
*CapsuleHeader
;
125 UINT32 CapsuleNumber
;
126 UINT32 CapsuleTotalNumber
;
127 EFI_CAPSULE_TABLE
*CapsuleTable
;
132 VOID
**CapsulePtrCache
;
133 EFI_GUID
*CapsuleGuidCache
;
134 EFI_STATUS
*CapsuleStatusArray
;
135 BOOLEAN DisplayCapsuleExist
;
136 ESRT_MANAGEMENT_PROTOCOL
*EsrtManagement
;
137 UINT16 EmbeddedDriverCount
;
139 REPORT_STATUS_CODE(EFI_PROGRESS_CODE
, (EFI_SOFTWARE
| PcdGet32(PcdStatusCodeSubClassCapsule
) | PcdGet32(PcdCapsuleStatusCodeProcessCapsulesBegin
)));
142 CapsuleTotalNumber
= 0;
146 CapsulePtrCache
= NULL
;
147 CapsuleGuidCache
= NULL
;
148 DisplayCapsuleExist
= FALSE
;
149 EsrtManagement
= NULL
;
151 Status
= EFI_SUCCESS
;
153 // Find all capsule images from hob
155 HobPointer
.Raw
= GetHobList ();
156 while ((HobPointer
.Raw
= GetNextHob (EFI_HOB_TYPE_UEFI_CAPSULE
, HobPointer
.Raw
)) != NULL
) {
157 if (!IsValidCapsuleHeader((VOID
*)(UINTN
)HobPointer
.Capsule
->BaseAddress
, HobPointer
.Capsule
->Length
)) {
158 HobPointer
.Header
->HobType
= EFI_HOB_TYPE_UNUSED
; // Mark this hob as invalid
160 CapsuleTotalNumber
++;
162 HobPointer
.Raw
= GET_NEXT_HOB (HobPointer
);
165 if (CapsuleTotalNumber
== 0) {
167 // We didn't find a hob, so had no errors.
169 DEBUG ((DEBUG_ERROR
, "We can not find capsule data in capsule update boot mode.\n"));
170 Status
= EFI_SUCCESS
;
175 // Init temp Capsule Data table.
177 CapsulePtr
= (VOID
**) AllocateZeroPool (sizeof (VOID
*) * CapsuleTotalNumber
);
178 ASSERT (CapsulePtr
!= NULL
);
179 if (CapsulePtr
== NULL
) {
180 Status
= EFI_OUT_OF_RESOURCES
;
183 CapsulePtrCache
= (VOID
**) AllocateZeroPool (sizeof (VOID
*) * CapsuleTotalNumber
);
184 ASSERT (CapsulePtrCache
!= NULL
);
185 if (CapsulePtrCache
== NULL
) {
186 Status
= EFI_OUT_OF_RESOURCES
;
189 CapsuleGuidCache
= (EFI_GUID
*) AllocateZeroPool (sizeof (EFI_GUID
) * CapsuleTotalNumber
);
190 ASSERT (CapsuleGuidCache
!= NULL
);
191 if (CapsuleGuidCache
== NULL
) {
192 Status
= EFI_OUT_OF_RESOURCES
;
195 CapsuleStatusArray
= (EFI_STATUS
*) AllocateZeroPool (sizeof (EFI_STATUS
) * CapsuleTotalNumber
);
196 ASSERT (CapsuleStatusArray
!= NULL
);
197 if (CapsuleStatusArray
== NULL
) {
198 Status
= EFI_OUT_OF_RESOURCES
;
203 // Find all capsule images from hob
205 HobPointer
.Raw
= GetHobList ();
206 while ((HobPointer
.Raw
= GetNextHob (EFI_HOB_TYPE_UEFI_CAPSULE
, HobPointer
.Raw
)) != NULL
) {
207 CapsulePtr
[CapsuleNumber
++] = (VOID
*) (UINTN
) HobPointer
.Capsule
->BaseAddress
;
208 HobPointer
.Raw
= GET_NEXT_HOB (HobPointer
);
212 // Check the capsule flags,if contains CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE, install
213 // capsuleTable to configure table with EFI_CAPSULE_GUID
217 // Capsules who have CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE always are used for operating
218 // System to have information persist across a system reset. EFI System Table must
219 // point to an array of capsules that contains the same CapsuleGuid value. And agents
220 // searching for this type capsule will look in EFI System Table and search for the
221 // capsule's Guid and associated pointer to retrieve the data. Two steps below describes
222 // how to sorting the capsules by the unique guid and install the array to EFI System Table.
223 // Firstly, Loop for all coalesced capsules, record unique CapsuleGuids and cache them in an
224 // array for later sorting capsules by CapsuleGuid.
226 for (Index
= 0; Index
< CapsuleTotalNumber
; Index
++) {
227 CapsuleStatusArray
[Index
] = EFI_UNSUPPORTED
;
228 CapsuleHeader
= (EFI_CAPSULE_HEADER
*) CapsulePtr
[Index
];
229 if ((CapsuleHeader
->Flags
& CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE
) != 0) {
231 // For each capsule, we compare it with known CapsuleGuid in the CacheArray.
232 // If already has the Guid, skip it. Whereas, record it in the CacheArray as
233 // an additional one.
236 while (CacheIndex
< CacheNumber
) {
237 if (CompareGuid(&CapsuleGuidCache
[CacheIndex
],&CapsuleHeader
->CapsuleGuid
)) {
242 if (CacheIndex
== CacheNumber
) {
243 CopyMem(&CapsuleGuidCache
[CacheNumber
++],&CapsuleHeader
->CapsuleGuid
,sizeof(EFI_GUID
));
249 // Secondly, for each unique CapsuleGuid in CacheArray, gather all coalesced capsules
250 // whose guid is the same as it, and malloc memory for an array which preceding
251 // with UINT32. The array fills with entry point of capsules that have the same
252 // CapsuleGuid, and UINT32 represents the size of the array of capsules. Then install
253 // this array into EFI System Table, so that agents searching for this type capsule
254 // will look in EFI System Table and search for the capsule's Guid and associated
255 // pointer to retrieve the data.
258 while (CacheIndex
< CacheNumber
) {
260 for (Index
= 0; Index
< CapsuleTotalNumber
; Index
++) {
261 CapsuleHeader
= (EFI_CAPSULE_HEADER
*) CapsulePtr
[Index
];
262 if ((CapsuleHeader
->Flags
& CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE
) != 0) {
263 if (CompareGuid (&CapsuleGuidCache
[CacheIndex
], &CapsuleHeader
->CapsuleGuid
)) {
265 // Cache Caspuleheader to the array, this array is uniqued with certain CapsuleGuid.
267 CapsulePtrCache
[CapsuleNumber
++] = (VOID
*)CapsuleHeader
;
269 // When a Capsule is listed in CapsulePtrCache, it will be reported in ConfigurationTable
270 // So, report the CapsuleStatus as "processed successfully".
272 CapsuleStatusArray
[Index
] = EFI_SUCCESS
;
276 if (CapsuleNumber
!= 0) {
277 Size
= sizeof(EFI_CAPSULE_TABLE
) + (CapsuleNumber
- 1) * sizeof(VOID
*);
278 CapsuleTable
= AllocateRuntimePool (Size
);
279 ASSERT (CapsuleTable
!= NULL
);
280 if (CapsuleTable
== NULL
) {
281 return EFI_OUT_OF_RESOURCES
;
283 CapsuleTable
->CapsuleArrayNumber
= CapsuleNumber
;
284 CopyMem(&CapsuleTable
->CapsulePtr
[0], CapsulePtrCache
, CapsuleNumber
* sizeof(VOID
*));
285 Status
= gBS
->InstallConfigurationTable (&CapsuleGuidCache
[CacheIndex
], (VOID
*)CapsuleTable
);
286 ASSERT_EFI_ERROR (Status
);
291 REPORT_STATUS_CODE(EFI_PROGRESS_CODE
, (EFI_SOFTWARE
| PcdGet32(PcdStatusCodeSubClassCapsule
) | PcdGet32(PcdCapsuleStatusCodeUpdatingFirmware
)));
294 // If Windows UX capsule exist, process it first
296 for (Index
= 0; Index
< CapsuleTotalNumber
; Index
++) {
297 CapsuleHeader
= (EFI_CAPSULE_HEADER
*) CapsulePtr
[Index
];
298 if (CompareGuid(&CapsuleHeader
->CapsuleGuid
,&gWindowsUxCapsuleGuid
)) {
299 DEBUG ((DEBUG_INFO
, "ProcessCapsuleImage (Ux) - 0x%x\n", CapsuleHeader
));
300 DisplayCapsuleExist
= TRUE
;
301 DEBUG ((DEBUG_INFO
, "Display logo capsule is found.\n"));
302 Status
= ProcessCapsuleImage (CapsuleHeader
);
303 DEBUG((DEBUG_INFO
, "ProcessCapsuleImage (Ux) - %r\n", Status
));
304 CapsuleStatusArray
[Index
] = Status
;
309 if (!DisplayCapsuleExist
) {
311 // Display Capsule not found. Display the default string.
313 Print (L
"Updating the firmware ......\r\n");
317 // All capsules left are recognized by platform.
319 for (Index
= 0; Index
< CapsuleTotalNumber
; Index
++) {
320 CapsuleHeader
= (EFI_CAPSULE_HEADER
*) CapsulePtr
[Index
];
321 if (!CompareGuid(&CapsuleHeader
->CapsuleGuid
,&gWindowsUxCapsuleGuid
)) {
323 // Call capsule library to process capsule image.
325 EmbeddedDriverCount
= 0;
326 if (IsFmpCapsule(CapsuleHeader
)) {
327 Status
= ValidateFmpCapsule(CapsuleHeader
, &EmbeddedDriverCount
);
328 if (EFI_ERROR(Status
)) {
329 DEBUG((DEBUG_ERROR
, "ValidateFmpCapsule failed. Ignore!\n"));
334 if ((!NeedBlockDriver
) || (EmbeddedDriverCount
== 0)) {
335 DEBUG((DEBUG_INFO
, "ProcessCapsuleImage - 0x%x\n", CapsuleHeader
));
336 Status
= ProcessCapsuleImage (CapsuleHeader
);
337 CapsuleStatusArray
[Index
] = Status
;
338 DEBUG((DEBUG_INFO
, "ProcessCapsuleImage - %r\n", Status
));
340 if (EFI_ERROR(Status
)) {
341 REPORT_STATUS_CODE(EFI_ERROR_CODE
, (EFI_SOFTWARE
| PcdGet32(PcdStatusCodeSubClassCapsule
) | PcdGet32(PcdCapsuleStatusCodeUpdateFirmwareFailed
)));
342 DEBUG ((DEBUG_ERROR
, "Capsule process failed. reset the system!\n"));
343 Print (L
"Firmware update failed...\r\n");
345 REPORT_STATUS_CODE(EFI_PROGRESS_CODE
, (EFI_SOFTWARE
| PcdGet32(PcdStatusCodeSubClassCapsule
) | PcdGet32(PcdCapsuleStatusCodeUpdateFirmwareSuccess
)));
348 if ((CapsuleHeader
->Flags
& PcdGet16(PcdSystemRebootAfterCapsuleProcessFlag
)) != 0 ||
349 IsFmpCapsule(CapsuleHeader
)) {
356 Status
= gBS
->LocateProtocol(&gEsrtManagementProtocolGuid
, NULL
, (VOID
**)&EsrtManagement
);
358 // Always sync ESRT Cache from FMP Instance
360 if (!EFI_ERROR(Status
)) {
361 EsrtManagement
->SyncEsrtFmp();
363 Status
= EFI_SUCCESS
;
367 // Free the allocated temp memory space.
369 if (CapsuleGuidCache
!= NULL
) {
370 FreePool(CapsuleGuidCache
);
372 if (CapsulePtrCache
!= NULL
) {
373 FreePool(CapsulePtrCache
);
375 if (CapsulePtr
!= NULL
) {
376 FreePool(CapsulePtr
);
379 REPORT_STATUS_CODE(EFI_PROGRESS_CODE
, (EFI_SOFTWARE
| PcdGet32(PcdStatusCodeSubClassCapsule
) | PcdGet32(PcdCapsuleStatusCodeProcessCapsulesEnd
)));
394 REPORT_STATUS_CODE(EFI_PROGRESS_CODE
, (EFI_SOFTWARE
| PcdGet32(PcdStatusCodeSubClassCapsule
) | PcdGet32(PcdCapsuleStatusCodeResettingSystem
)));
396 Print(L
"Capsule Request Cold Reboot.\n");
397 DEBUG((DEBUG_INFO
, "Capsule Request Cold Reboot."));
399 for (Index
= 5; Index
> 0; Index
--) {
400 Print(L
"\rResetting system in %d seconds ...", Index
);
401 DEBUG((DEBUG_INFO
, "\rResetting system in %d seconds ...", Index
));
405 gRT
->ResetSystem(EfiResetCold
, EFI_SUCCESS
, 0, NULL
);
412 This routine is called to process capsules.
414 Caution: This function may receive untrusted input.
416 The capsules reported in EFI_HOB_UEFI_CAPSULE are processed.
417 If there is no EFI_HOB_UEFI_CAPSULE, this routine does nothing.
419 This routine should be called twice in BDS.
420 1) The first call must be before EndOfDxe. The system capsules is processed.
421 If device capsule FMP protocols are exposted at this time and device FMP
422 capsule has zero EmbeddedDriverCount, the device capsules are processed.
423 Each individual capsule result is recorded in capsule record variable.
424 System may reset in this function, if reset is required by capsule and
425 all capsules are processed.
426 If not all capsules are processed, reset will be defered to second call.
428 2) The second call must be after EndOfDxe and after ConnectAll, so that all
429 device capsule FMP protocols are exposed.
430 The system capsules are skipped. If the device capsules are NOT processed
431 in first call, they are processed here.
432 Each individual capsule result is recorded in capsule record variable.
433 System may reset in this function, if reset is required by capsule
434 processed in first call and second call.
436 @retval EFI_SUCCESS There is no error when processing capsules.
437 @retval EFI_OUT_OF_RESOURCES No enough resource to process capsules.
448 if (!mDxeCapsuleLibEndOfDxe
) {
450 // Initialize mAreAllImagesProcessed to be TRUE.
452 // It will be updated to FALSE in ProcessTheseCapsules()->ProcessCapsuleImage(),
453 // if there is any FMP image in any FMP capsule not processed.
455 mAreAllImagesProcessed
= TRUE
;
457 Status
= ProcessTheseCapsules(TRUE
);
459 // Reboot System if and only if all capsule processed.
460 // If not, defer reset to 2nd process.
462 if (mNeedReset
&& mAreAllImagesProcessed
) {
466 Status
= ProcessTheseCapsules(FALSE
);
468 // Reboot System if required after all capsule processed