MdeModulePkg/Library/DxeCapsuleLibFmp/DxeCapsuleProcessLib.c

   1 /** @file
   2   DXE capsule process.
   3
   4   Caution: This module requires additional review when modified.
   5   This module will have external input - capsule image.
   6   This external input must be validated carefully to avoid security issue like
   7   buffer overflow, integer overflow.
   8
   9   ProcessCapsules(), ProcessTheseCapsules() will receive untrusted
  10   input and do basic validation.
  11
  12   Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
  13   This program and the accompanying materials
  14   are licensed and made available under the terms and conditions of the BSD License
  15   which accompanies this distribution.  The full text of the license may be found at
  16   http://opensource.org/licenses/bsd-license.php
  17
  18   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  19   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  20
  21 **/
  22
  23 #include <PiDxe.h>
  24 #include <Protocol/EsrtManagement.h>
  25
  26 #include <Library/BaseLib.h>
  27 #include <Library/DebugLib.h>
  28 #include <Library/BaseMemoryLib.h>
  29 #include <Library/UefiBootServicesTableLib.h>
  30 #include <Library/UefiRuntimeServicesTableLib.h>
  31 #include <Library/MemoryAllocationLib.h>
  32 #include <Library/UefiLib.h>
  33 #include <Library/PcdLib.h>
  34 #include <Library/HobLib.h>
  35 #include <Library/ReportStatusCodeLib.h>
  36 #include <Library/CapsuleLib.h>
  37
  38 #include <IndustryStandard/WindowsUxCapsule.h>
  39
  40 /**
  41   Return if this FMP is a system FMP or a device FMP, based upon CapsuleHeader.
  42
  43   @param[in] CapsuleHeader A pointer to EFI_CAPSULE_HEADER
  44
  45   @retval TRUE  It is a system FMP.
  46   @retval FALSE It is a device FMP.
  47 **/
  48 BOOLEAN
  49 IsFmpCapsule (
  50   IN EFI_CAPSULE_HEADER  *CapsuleHeader
  51   );
  52
  53 /**
  54   Validate Fmp capsules layout.
  55
  56   Caution: This function may receive untrusted input.
  57
  58   This function assumes the caller validated the capsule by using
  59   IsValidCapsuleHeader(), so that all fields in EFI_CAPSULE_HEADER are correct.
  60   The capsule buffer size is CapsuleHeader->CapsuleImageSize.
  61
  62   This function validates the fields in EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER
  63   and EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER.
  64
  65   This function need support nested FMP capsule.
  66
  67   @param[in]   CapsuleHeader        Points to a capsule header.
  68   @param[out]  EmbeddedDriverCount  The EmbeddedDriverCount in the FMP capsule.
  69
  70   @retval EFI_SUCESS             Input capsule is a correct FMP capsule.
  71   @retval EFI_INVALID_PARAMETER  Input capsule is not a correct FMP capsule.
  72 **/
  73 EFI_STATUS
  74 ValidateFmpCapsule (
  75   IN EFI_CAPSULE_HEADER  *CapsuleHeader,
  76   OUT UINT16             *EmbeddedDriverCount OPTIONAL
  77   );
  78
  79 /**
  80   Validate if it is valid capsule header
  81
  82   This function assumes the caller provided correct CapsuleHeader pointer
  83   and CapsuleSize.
  84
  85   This function validates the fields in EFI_CAPSULE_HEADER.
  86
  87   @param[in]  CapsuleHeader    Points to a capsule header.
  88   @param[in]  CapsuleSize      Size of the whole capsule image.
  89
  90 **/
  91 BOOLEAN
  92 IsValidCapsuleHeader (
  93   IN EFI_CAPSULE_HEADER  *CapsuleHeader,
  94   IN UINT64              CapsuleSize
  95   );
  96
  97 extern BOOLEAN                   mDxeCapsuleLibEndOfDxe;
  98 BOOLEAN                          mNeedReset;
  99
 100 VOID                        **mCapsulePtr;
 101 EFI_STATUS                  *mCapsuleStatusArray;
 102 UINT32                      mCapsuleTotalNumber;
 103
 104 /**
 105   This function initializes the mCapsulePtr, mCapsuleStatusArray and mCapsuleTotalNumber.
 106 **/
 107 VOID
 108 InitCapsulePtr (
 109   VOID
 110   )
 111 {
 112   EFI_PEI_HOB_POINTERS        HobPointer;
 113   UINTN                       Index;
 114
 115   //
 116   // Find all capsule images from hob
 117   //
 118   HobPointer.Raw = GetHobList ();
 119   while ((HobPointer.Raw = GetNextHob (EFI_HOB_TYPE_UEFI_CAPSULE, HobPointer.Raw)) != NULL) {
 120     if (!IsValidCapsuleHeader((VOID *)(UINTN)HobPointer.Capsule->BaseAddress, HobPointer.Capsule->Length)) {
 121       HobPointer.Header->HobType = EFI_HOB_TYPE_UNUSED; // Mark this hob as invalid
 122     } else {
 123       mCapsuleTotalNumber++;
 124     }
 125     HobPointer.Raw = GET_NEXT_HOB (HobPointer);
 126   }
 127
 128   DEBUG ((DEBUG_INFO, "mCapsuleTotalNumber - 0x%x\n", mCapsuleTotalNumber));
 129
 130   if (mCapsuleTotalNumber == 0) {
 131     return ;
 132   }
 133
 134   //
 135   // Init temp Capsule Data table.
 136   //
 137   mCapsulePtr       = (VOID **) AllocateZeroPool (sizeof (VOID *) * mCapsuleTotalNumber);
 138   if (mCapsulePtr == NULL) {
 139     DEBUG ((DEBUG_ERROR, "Allocate mCapsulePtr fail!\n"));
 140     mCapsuleTotalNumber = 0;
 141     return ;
 142   }
 143   mCapsuleStatusArray = (EFI_STATUS *) AllocateZeroPool (sizeof (EFI_STATUS) * mCapsuleTotalNumber);
 144   if (mCapsuleStatusArray == NULL) {
 145     DEBUG ((DEBUG_ERROR, "Allocate mCapsuleStatusArray fail!\n"));
 146     FreePool (mCapsulePtr);
 147     mCapsulePtr = NULL;
 148     mCapsuleTotalNumber = 0;
 149     return ;
 150   }
 151   SetMemN (mCapsuleStatusArray, sizeof (EFI_STATUS) * mCapsuleTotalNumber, EFI_NOT_READY);
 152
 153   //
 154   // Find all capsule images from hob
 155   //
 156   HobPointer.Raw = GetHobList ();
 157   Index = 0;
 158   while ((HobPointer.Raw = GetNextHob (EFI_HOB_TYPE_UEFI_CAPSULE, HobPointer.Raw)) != NULL) {
 159     mCapsulePtr [Index++] = (VOID *) (UINTN) HobPointer.Capsule->BaseAddress;
 160     HobPointer.Raw = GET_NEXT_HOB (HobPointer);
 161   }
 162 }
 163
 164 /**
 165   This function returns if all capsule images are processed.
 166
 167   @retval TRUE   All capsule images are processed.
 168   @retval FALSE  Not all capsule images are processed.
 169 **/
 170 BOOLEAN
 171 AreAllImagesProcessed (
 172   VOID
 173   )
 174 {
 175   UINTN  Index;
 176
 177   for (Index = 0; Index < mCapsuleTotalNumber; Index++) {
 178     if (mCapsuleStatusArray[Index] == EFI_NOT_READY) {
 179       return FALSE;
 180     }
 181   }
 182
 183   return TRUE;
 184 }
 185
 186 /**
 187   This function populates capsule in the configuration table.
 188 **/
 189 VOID
 190 PopulateCapsuleInConfigurationTable (
 191   VOID
 192   )
 193 {
 194   VOID                        **CapsulePtrCache;
 195   EFI_GUID                    *CapsuleGuidCache;
 196   EFI_CAPSULE_HEADER          *CapsuleHeader;
 197   EFI_CAPSULE_TABLE           *CapsuleTable;
 198   UINT32                      CacheIndex;
 199   UINT32                      CacheNumber;
 200   UINT32                      CapsuleNumber;
 201   UINTN                       Index;
 202   UINTN                       Size;
 203   EFI_STATUS                  Status;
 204
 205   if (mCapsuleTotalNumber == 0) {
 206     return ;
 207   }
 208
 209   CapsulePtrCache     = NULL;
 210   CapsuleGuidCache    = NULL;
 211   CacheIndex          = 0;
 212   CacheNumber         = 0;
 213
 214   CapsulePtrCache  = (VOID **) AllocateZeroPool (sizeof (VOID *) * mCapsuleTotalNumber);
 215   if (CapsulePtrCache == NULL) {
 216     DEBUG ((DEBUG_ERROR, "Allocate CapsulePtrCache fail!\n"));
 217     return ;
 218   }
 219   CapsuleGuidCache = (EFI_GUID *) AllocateZeroPool (sizeof (EFI_GUID) * mCapsuleTotalNumber);
 220   if (CapsuleGuidCache == NULL) {
 221     DEBUG ((DEBUG_ERROR, "Allocate CapsuleGuidCache fail!\n"));
 222     FreePool (CapsulePtrCache);
 223     return ;
 224   }
 225
 226   //
 227   // Capsules who have CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE always are used for operating
 228   // System to have information persist across a system reset. EFI System Table must
 229   // point to an array of capsules that contains the same CapsuleGuid value. And agents
 230   // searching for this type capsule will look in EFI System Table and search for the
 231   // capsule's Guid and associated pointer to retrieve the data. Two steps below describes
 232   // how to sorting the capsules by the unique guid and install the array to EFI System Table.
 233   // Firstly, Loop for all coalesced capsules, record unique CapsuleGuids and cache them in an
 234   // array for later sorting capsules by CapsuleGuid.
 235   //
 236   for (Index = 0; Index < mCapsuleTotalNumber; Index++) {
 237     CapsuleHeader = (EFI_CAPSULE_HEADER*) mCapsulePtr [Index];
 238     if ((CapsuleHeader->Flags & CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE) != 0) {
 239       //
 240       // For each capsule, we compare it with known CapsuleGuid in the CacheArray.
 241       // If already has the Guid, skip it. Whereas, record it in the CacheArray as
 242       // an additional one.
 243       //
 244       CacheIndex = 0;
 245       while (CacheIndex < CacheNumber) {
 246         if (CompareGuid(&CapsuleGuidCache[CacheIndex],&CapsuleHeader->CapsuleGuid)) {
 247           break;
 248         }
 249         CacheIndex++;
 250       }
 251       if (CacheIndex == CacheNumber) {
 252         CopyMem(&CapsuleGuidCache[CacheNumber++],&CapsuleHeader->CapsuleGuid,sizeof(EFI_GUID));
 253       }
 254     }
 255   }
 256
 257   //
 258   // Secondly, for each unique CapsuleGuid in CacheArray, gather all coalesced capsules
 259   // whose guid is the same as it, and malloc memory for an array which preceding
 260   // with UINT32. The array fills with entry point of capsules that have the same
 261   // CapsuleGuid, and UINT32 represents the size of the array of capsules. Then install
 262   // this array into EFI System Table, so that agents searching for this type capsule
 263   // will look in EFI System Table and search for the capsule's Guid and associated
 264   // pointer to retrieve the data.
 265   //
 266   for (CacheIndex = 0; CacheIndex < CacheNumber; CacheIndex++) {
 267     CapsuleNumber = 0;
 268     for (Index = 0; Index < mCapsuleTotalNumber; Index++) {
 269       CapsuleHeader = (EFI_CAPSULE_HEADER*) mCapsulePtr [Index];
 270       if ((CapsuleHeader->Flags & CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE) != 0) {
 271         if (CompareGuid (&CapsuleGuidCache[CacheIndex], &CapsuleHeader->CapsuleGuid)) {
 272           //
 273           // Cache Caspuleheader to the array, this array is uniqued with certain CapsuleGuid.
 274           //
 275           CapsulePtrCache[CapsuleNumber++] = (VOID*)CapsuleHeader;
 276         }
 277       }
 278     }
 279     if (CapsuleNumber != 0) {
 280       Size = sizeof(EFI_CAPSULE_TABLE) + (CapsuleNumber - 1) * sizeof(VOID*);
 281       CapsuleTable = AllocateRuntimePool (Size);
 282       if (CapsuleTable == NULL) {
 283         DEBUG ((DEBUG_ERROR, "Allocate CapsuleTable (%g) fail!\n", &CapsuleGuidCache[CacheIndex]));
 284         continue;
 285       }
 286       CapsuleTable->CapsuleArrayNumber =  CapsuleNumber;
 287       CopyMem(&CapsuleTable->CapsulePtr[0], CapsulePtrCache, CapsuleNumber * sizeof(VOID*));
 288       Status = gBS->InstallConfigurationTable (&CapsuleGuidCache[CacheIndex], (VOID*)CapsuleTable);
 289       if (EFI_ERROR (Status)) {
 290         DEBUG ((DEBUG_ERROR, "InstallConfigurationTable (%g) fail!\n", &CapsuleGuidCache[CacheIndex]));
 291       }
 292     }
 293   }
 294
 295   FreePool(CapsuleGuidCache);
 296   FreePool(CapsulePtrCache);
 297 }
 298
 299 /**
 300
 301   This routine is called to process capsules.
 302
 303   Caution: This function may receive untrusted input.
 304
 305   Each individual capsule result is recorded in capsule record variable.
 306
 307   @param[in]  FirstRound         TRUE:  First round. Need skip the FMP capsules with non zero EmbeddedDriverCount.
 308                                  FALSE: Process rest FMP capsules.
 309
 310   @retval EFI_SUCCESS             There is no error when processing capsules.
 311   @retval EFI_OUT_OF_RESOURCES    No enough resource to process capsules.
 312
 313 **/
 314 EFI_STATUS
 315 ProcessTheseCapsules (
 316   IN BOOLEAN  FirstRound
 317   )
 318 {
 319   EFI_STATUS                  Status;
 320   EFI_CAPSULE_HEADER          *CapsuleHeader;
 321   UINT32                      Index;
 322   BOOLEAN                     DisplayCapsuleExist;
 323   ESRT_MANAGEMENT_PROTOCOL    *EsrtManagement;
 324   UINT16                      EmbeddedDriverCount;
 325
 326   REPORT_STATUS_CODE(EFI_PROGRESS_CODE, (EFI_SOFTWARE | PcdGet32(PcdStatusCodeSubClassCapsule) | PcdGet32(PcdCapsuleStatusCodeProcessCapsulesBegin)));
 327
 328   if (FirstRound) {
 329     InitCapsulePtr ();
 330   }
 331
 332   if (mCapsuleTotalNumber == 0) {
 333     //
 334     // We didn't find a hob, so had no errors.
 335     //
 336     DEBUG ((DEBUG_ERROR, "We can not find capsule data in capsule update boot mode.\n"));
 337     return EFI_SUCCESS;
 338   }
 339
 340   if (AreAllImagesProcessed ()) {
 341     return EFI_SUCCESS;
 342   }
 343
 344   //
 345   // Check the capsule flags,if contains CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE, install
 346   // capsuleTable to configure table with EFI_CAPSULE_GUID
 347   //
 348   if (FirstRound) {
 349     PopulateCapsuleInConfigurationTable ();
 350   }
 351
 352   REPORT_STATUS_CODE(EFI_PROGRESS_CODE, (EFI_SOFTWARE | PcdGet32(PcdStatusCodeSubClassCapsule) | PcdGet32(PcdCapsuleStatusCodeUpdatingFirmware)));
 353
 354   //
 355   // If Windows UX capsule exist, process it first
 356   //
 357   DisplayCapsuleExist = FALSE;
 358   for (Index = 0; Index < mCapsuleTotalNumber; Index++) {
 359     CapsuleHeader = (EFI_CAPSULE_HEADER*) mCapsulePtr [Index];
 360     if (CompareGuid (&CapsuleHeader->CapsuleGuid, &gWindowsUxCapsuleGuid)) {
 361       DEBUG ((DEBUG_INFO, "ProcessCapsuleImage (Ux) - 0x%x\n", CapsuleHeader));
 362       DisplayCapsuleExist = TRUE;
 363       DEBUG ((DEBUG_INFO, "Display logo capsule is found.\n"));
 364       Status = ProcessCapsuleImage (CapsuleHeader);
 365       mCapsuleStatusArray [Index] = EFI_SUCCESS;
 366       DEBUG((DEBUG_INFO, "ProcessCapsuleImage (Ux) - %r\n", Status));
 367       break;
 368     }
 369   }
 370
 371   if (!DisplayCapsuleExist) {
 372     //
 373     // Display Capsule not found. Display the default string.
 374     //
 375     Print (L"Updating the firmware ......\r\n");
 376   }
 377
 378   //
 379   // All capsules left are recognized by platform.
 380   //
 381   for (Index = 0; Index < mCapsuleTotalNumber; Index++) {
 382     if (mCapsuleStatusArray [Index] != EFI_NOT_READY) {
 383       // already processed
 384       continue;
 385     }
 386     CapsuleHeader = (EFI_CAPSULE_HEADER*) mCapsulePtr [Index];
 387     if (!CompareGuid (&CapsuleHeader->CapsuleGuid, &gWindowsUxCapsuleGuid)) {
 388       //
 389       // Call capsule library to process capsule image.
 390       //
 391       EmbeddedDriverCount = 0;
 392       if (IsFmpCapsule(CapsuleHeader)) {
 393         Status = ValidateFmpCapsule (CapsuleHeader, &EmbeddedDriverCount);
 394         if (EFI_ERROR(Status)) {
 395           DEBUG((DEBUG_ERROR, "ValidateFmpCapsule failed. Ignore!\n"));
 396           mCapsuleStatusArray [Index] = EFI_ABORTED;
 397           continue;
 398         }
 399       } else {
 400         mCapsuleStatusArray [Index] = EFI_ABORTED;
 401         continue;
 402       }
 403
 404       if ((!FirstRound) || (EmbeddedDriverCount == 0)) {
 405         DEBUG((DEBUG_INFO, "ProcessCapsuleImage - 0x%x\n", CapsuleHeader));
 406         Status = ProcessCapsuleImage (CapsuleHeader);
 407         mCapsuleStatusArray [Index] = Status;
 408         DEBUG((DEBUG_INFO, "ProcessCapsuleImage - %r\n", Status));
 409
 410         if (Status != EFI_NOT_READY) {
 411           if (EFI_ERROR(Status)) {
 412             REPORT_STATUS_CODE(EFI_ERROR_CODE, (EFI_SOFTWARE | PcdGet32(PcdStatusCodeSubClassCapsule) | PcdGet32(PcdCapsuleStatusCodeUpdateFirmwareFailed)));
 413             DEBUG ((DEBUG_ERROR, "Capsule process failed!\n"));
 414             Print (L"Firmware update failed...\r\n");
 415           } else {
 416             REPORT_STATUS_CODE(EFI_PROGRESS_CODE, (EFI_SOFTWARE | PcdGet32(PcdStatusCodeSubClassCapsule) | PcdGet32(PcdCapsuleStatusCodeUpdateFirmwareSuccess)));
 417           }
 418
 419           if ((CapsuleHeader->Flags & PcdGet16(PcdSystemRebootAfterCapsuleProcessFlag)) != 0 ||
 420               IsFmpCapsule(CapsuleHeader)) {
 421             mNeedReset = TRUE;
 422           }
 423         }
 424       }
 425     }
 426   }
 427
 428   Status = gBS->LocateProtocol(&gEsrtManagementProtocolGuid, NULL, (VOID **)&EsrtManagement);
 429   //
 430   // Always sync ESRT Cache from FMP Instance
 431   //
 432   if (!EFI_ERROR(Status)) {
 433     EsrtManagement->SyncEsrtFmp();
 434   }
 435   Status = EFI_SUCCESS;
 436
 437   REPORT_STATUS_CODE(EFI_PROGRESS_CODE, (EFI_SOFTWARE | PcdGet32(PcdStatusCodeSubClassCapsule) | PcdGet32(PcdCapsuleStatusCodeProcessCapsulesEnd)));
 438
 439   return Status;
 440 }
 441
 442 /**
 443   Do reset system.
 444 **/
 445 VOID
 446 DoResetSystem (
 447   VOID
 448   )
 449 {
 450   UINTN                         Index;
 451
 452   REPORT_STATUS_CODE(EFI_PROGRESS_CODE, (EFI_SOFTWARE | PcdGet32(PcdStatusCodeSubClassCapsule) | PcdGet32(PcdCapsuleStatusCodeResettingSystem)));
 453
 454   Print(L"Capsule Request Cold Reboot.\n");
 455   DEBUG((DEBUG_INFO, "Capsule Request Cold Reboot."));
 456
 457   for (Index = 5; Index > 0; Index--) {
 458     Print(L"\rResetting system in %d seconds ...", Index);
 459     DEBUG((DEBUG_INFO, "\rResetting system in %d seconds ...", Index));
 460     gBS->Stall(1000000);
 461   }
 462
 463   gRT->ResetSystem(EfiResetCold, EFI_SUCCESS, 0, NULL);
 464
 465   CpuDeadLoop();
 466 }
 467
 468 /**
 469
 470   This routine is called to process capsules.
 471
 472   Caution: This function may receive untrusted input.
 473
 474   The capsules reported in EFI_HOB_UEFI_CAPSULE are processed.
 475   If there is no EFI_HOB_UEFI_CAPSULE, this routine does nothing.
 476
 477   This routine should be called twice in BDS.
 478   1) The first call must be before EndOfDxe. The system capsules is processed.
 479      If device capsule FMP protocols are exposted at this time and device FMP
 480      capsule has zero EmbeddedDriverCount, the device capsules are processed.
 481      Each individual capsule result is recorded in capsule record variable.
 482      System may reset in this function, if reset is required by capsule and
 483      all capsules are processed.
 484      If not all capsules are processed, reset will be defered to second call.
 485
 486   2) The second call must be after EndOfDxe and after ConnectAll, so that all
 487      device capsule FMP protocols are exposed.
 488      The system capsules are skipped. If the device capsules are NOT processed
 489      in first call, they are processed here.
 490      Each individual capsule result is recorded in capsule record variable.
 491      System may reset in this function, if reset is required by capsule
 492      processed in first call and second call.
 493
 494   @retval EFI_SUCCESS             There is no error when processing capsules.
 495   @retval EFI_OUT_OF_RESOURCES    No enough resource to process capsules.
 496
 497 **/
 498 EFI_STATUS
 499 EFIAPI
 500 ProcessCapsules (
 501   VOID
 502   )
 503 {
 504   EFI_STATUS                    Status;
 505
 506   if (!mDxeCapsuleLibEndOfDxe) {
 507     Status = ProcessTheseCapsules(TRUE);
 508
 509     //
 510     // Reboot System if and only if all capsule processed.
 511     // If not, defer reset to 2nd process.
 512     //
 513     if (mNeedReset && AreAllImagesProcessed()) {
 514       DoResetSystem();
 515     }
 516   } else {
 517     Status = ProcessTheseCapsules(FALSE);
 518     //
 519     // Reboot System if required after all capsule processed
 520     //
 521     if (mNeedReset) {
 522       DoResetSystem();
 523     }
 524   }
 525   return Status;
 526 }