SignedCapsulePkg/Library/EdkiiSystemCapsuleLib/EdkiiSystemCapsuleLib.c

   1 /** @file
   2   EDKII System Capsule library.
   3
   4   EDKII System Capsule library instance.
   5
   6   CapsuleAuthenticateSystemFirmware(), ExtractAuthenticatedImage() will receive
   7   untrusted input and do basic validation.
   8
   9   Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
  10   This program and the accompanying materials
  11   are licensed and made available under the terms and conditions of the BSD License
  12   which accompanies this distribution.  The full text of the license may be found at
  13   http://opensource.org/licenses/bsd-license.php
  14
  15   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  16   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  17
  18 **/
  19
  20 #include <PiDxe.h>
  21
  22 #include <Guid/SystemResourceTable.h>
  23 #include <Guid/FirmwareContentsSigned.h>
  24 #include <Guid/WinCertificate.h>
  25 #include <Guid/EdkiiSystemFmpCapsule.h>
  26 #include <Guid/WinCertificate.h>
  27 #include <Guid/ImageAuthentication.h>
  28
  29 #include <Library/BaseLib.h>
  30 #include <Library/BaseMemoryLib.h>
  31 #include <Library/DebugLib.h>
  32 #include <Library/MemoryAllocationLib.h>
  33 #include <Library/EdkiiSystemCapsuleLib.h>
  34 #include <Library/FmpAuthenticationLib.h>
  35
  36 #include <Protocol/FirmwareManagement.h>
  37
  38 EDKII_SYSTEM_FIRMWARE_IMAGE_DESCRIPTOR   *mImageFmpInfo;
  39 UINTN                                    mImageFmpInfoSize;
  40 EFI_GUID                                 mEdkiiSystemFirmwareFileGuid;
  41
  42 /**
  43   Check if a block of buffer is erased.
  44
  45   @param[in] ErasePolarity  Erase polarity attribute of the firmware volume
  46   @param[in] InBuffer       The buffer to be checked
  47   @param[in] BufferSize     Size of the buffer in bytes
  48
  49   @retval    TRUE           The block of buffer is erased
  50   @retval    FALSE          The block of buffer is not erased
  51 **/
  52 BOOLEAN
  53 IsBufferErased (
  54   IN UINT8    ErasePolarity,
  55   IN VOID     *InBuffer,
  56   IN UINTN    BufferSize
  57   )
  58 {
  59   UINTN   Count;
  60   UINT8   EraseByte;
  61   UINT8   *Buffer;
  62
  63   if(ErasePolarity == 1) {
  64     EraseByte = 0xFF;
  65   } else {
  66     EraseByte = 0;
  67   }
  68
  69   Buffer = InBuffer;
  70   for (Count = 0; Count < BufferSize; Count++) {
  71     if (Buffer[Count] != EraseByte) {
  72       return FALSE;
  73     }
  74   }
  75
  76   return TRUE;
  77 }
  78
  79 /**
  80   Get Section buffer pointer by SectionType and SectionInstance.
  81
  82   @param[in]   SectionBuffer     The buffer of section
  83   @param[in]   SectionBufferSize The size of SectionBuffer in bytes
  84   @param[in]   SectionType       The SectionType of Section to be found
  85   @param[in]   SectionInstance   The Instance of Section to be found
  86   @param[out]  OutSectionBuffer  The section found, including SECTION_HEADER
  87   @param[out]  OutSectionSize    The size of section found, including SECTION_HEADER
  88
  89   @retval TRUE  The FFS buffer is found.
  90   @retval FALSE The FFS buffer is not found.
  91 **/
  92 BOOLEAN
  93 GetSectionByType (
  94   IN VOID                  *SectionBuffer,
  95   IN UINT32                SectionBufferSize,
  96   IN EFI_SECTION_TYPE      SectionType,
  97   IN UINTN                 SectionInstance,
  98   OUT VOID                 **OutSectionBuffer,
  99   OUT UINTN                *OutSectionSize
 100   )
 101 {
 102   EFI_COMMON_SECTION_HEADER             *SectionHeader;
 103   UINTN                                 SectionSize;
 104   UINTN                                 Instance;
 105
 106   DEBUG ((DEBUG_INFO, "GetSectionByType - Buffer: 0x%08x - 0x%08x\n", SectionBuffer, SectionBufferSize));
 107
 108   //
 109   // Find Section
 110   //
 111   SectionHeader = SectionBuffer;
 112
 113   Instance = 0;
 114   while ((UINTN)SectionHeader < (UINTN)SectionBuffer + SectionBufferSize) {
 115     DEBUG ((DEBUG_INFO, "GetSectionByType - Section: 0x%08x\n", SectionHeader));
 116     if (IS_SECTION2(SectionHeader)) {
 117       SectionSize = SECTION2_SIZE(SectionHeader);
 118     } else {
 119       SectionSize = SECTION_SIZE(SectionHeader);
 120     }
 121
 122     if (SectionHeader->Type == SectionType) {
 123       if (Instance == SectionInstance) {
 124         *OutSectionBuffer = (UINT8 *)SectionHeader;
 125         *OutSectionSize = SectionSize;
 126         DEBUG((DEBUG_INFO, "GetSectionByType - 0x%x - 0x%x\n", *OutSectionBuffer, *OutSectionSize));
 127         return TRUE;
 128       } else {
 129         DEBUG((DEBUG_INFO, "GetSectionByType - find section instance %x\n", Instance));
 130         Instance++;
 131       }
 132     } else {
 133       //
 134       // Skip other section type
 135       //
 136       DEBUG ((DEBUG_INFO, "GetSectionByType - other section type 0x%x\n", SectionHeader->Type));
 137     }
 138
 139     //
 140     // Next Section
 141     //
 142     SectionHeader = (EFI_COMMON_SECTION_HEADER *)((UINTN)SectionHeader + ALIGN_VALUE(SectionSize, 4));
 143   }
 144
 145   return FALSE;
 146 }
 147
 148 /**
 149   Get FFS buffer pointer by FileName GUID and FileType.
 150
 151   @param[in]   FdStart          The System Firmware FD image
 152   @param[in]   FdSize           The size of System Firmware FD image
 153   @param[in]   FileName         The FileName GUID of FFS to be found
 154   @param[in]   Type             The FileType of FFS to be found
 155   @param[out]  OutFfsBuffer     The FFS buffer found, including FFS_FILE_HEADER
 156   @param[out]  OutFfsBufferSize The size of FFS buffer found, including FFS_FILE_HEADER
 157
 158   @retval TRUE  The FFS buffer is found.
 159   @retval FALSE The FFS buffer is not found.
 160 **/
 161 BOOLEAN
 162 GetFfsByName (
 163   IN VOID                  *FdStart,
 164   IN UINTN                 FdSize,
 165   IN EFI_GUID              *FileName,
 166   IN EFI_FV_FILETYPE       Type,
 167   OUT VOID                 **OutFfsBuffer,
 168   OUT UINTN                *OutFfsBufferSize
 169   )
 170 {
 171   UINTN                                     FvSize;
 172   EFI_FIRMWARE_VOLUME_HEADER                *FvHeader;
 173   EFI_FIRMWARE_VOLUME_EXT_HEADER            *FvExtHeader;
 174   EFI_FFS_FILE_HEADER                       *FfsHeader;
 175   UINT32                                    FfsSize;
 176   UINTN                                     TestLength;
 177   BOOLEAN                                   FvFound;
 178
 179   DEBUG ((DEBUG_INFO, "GetFfsByName - FV: 0x%08x - 0x%08x\n", (UINTN)FdStart, (UINTN)FdSize));
 180
 181   FvFound = FALSE;
 182   FvHeader = (EFI_FIRMWARE_VOLUME_HEADER *)FdStart;
 183   while ((UINTN)FvHeader < (UINTN)FdStart + FdSize - 1) {
 184     FvSize = (UINTN)FdStart + FdSize - (UINTN)FvHeader;
 185
 186     if (FvHeader->Signature != EFI_FVH_SIGNATURE) {
 187       FvHeader = (EFI_FIRMWARE_VOLUME_HEADER *)((UINTN)FvHeader + SIZE_4KB);
 188       continue;
 189     }
 190     DEBUG((DEBUG_ERROR, "checking FV....0x%08x - 0x%x\n", FvHeader, FvHeader->FvLength));
 191     FvFound = TRUE;
 192     if (FvHeader->FvLength > FvSize) {
 193       DEBUG((DEBUG_ERROR, "GetFfsByName - FvSize: 0x%08x, MaxSize - 0x%08x\n", (UINTN)FvHeader->FvLength, (UINTN)FvSize));
 194       return FALSE;
 195     }
 196     FvSize = (UINTN)FvHeader->FvLength;
 197
 198     //
 199     // Find FFS
 200     //
 201     if (FvHeader->ExtHeaderOffset != 0) {
 202       FvExtHeader = (EFI_FIRMWARE_VOLUME_EXT_HEADER *)((UINT8 *)FvHeader + FvHeader->ExtHeaderOffset);
 203       FfsHeader = (EFI_FFS_FILE_HEADER *)((UINT8 *)FvExtHeader + FvExtHeader->ExtHeaderSize);
 204     } else {
 205       FfsHeader = (EFI_FFS_FILE_HEADER *)((UINT8 *)FvHeader + FvHeader->HeaderLength);
 206     }
 207     FfsHeader = (EFI_FFS_FILE_HEADER *)((UINTN)FvHeader + ALIGN_VALUE((UINTN)FfsHeader - (UINTN)FvHeader, 8));
 208
 209     while ((UINTN)FfsHeader < (UINTN)FvHeader + FvSize - 1) {
 210       DEBUG((DEBUG_INFO, "GetFfsByName - FFS: 0x%08x\n", FfsHeader));
 211       TestLength = (UINTN)((UINTN)FvHeader + FvSize - (UINTN)FfsHeader);
 212       if (TestLength > sizeof(EFI_FFS_FILE_HEADER)) {
 213         TestLength = sizeof(EFI_FFS_FILE_HEADER);
 214       }
 215       if (IsBufferErased(1, FfsHeader, TestLength)) {
 216         break;
 217       }
 218
 219       if (IS_FFS_FILE2(FfsHeader)) {
 220         FfsSize = FFS_FILE2_SIZE(FfsHeader);
 221       } else {
 222         FfsSize = FFS_FILE_SIZE(FfsHeader);
 223       }
 224
 225       if (CompareGuid(FileName, &FfsHeader->Name) &&
 226           ((Type == EFI_FV_FILETYPE_ALL) || (FfsHeader->Type == Type))) {
 227         //
 228         // Check section
 229         //
 230         *OutFfsBuffer = FfsHeader;
 231         *OutFfsBufferSize = FfsSize;
 232         return TRUE;
 233       } else {
 234         //
 235         // Any other type is not allowed
 236         //
 237         DEBUG((DEBUG_INFO, "GetFfsByName - other FFS type 0x%x, name %g\n", FfsHeader->Type, &FfsHeader->Name));
 238       }
 239
 240       //
 241       // Next File
 242       //
 243       FfsHeader = (EFI_FFS_FILE_HEADER *)((UINTN)FfsHeader + ALIGN_VALUE(FfsSize, 8));
 244     }
 245
 246     //
 247     // Next FV
 248     //
 249     FvHeader = (VOID *)(UINTN)((UINTN)FvHeader + FvHeader->FvLength);
 250     DEBUG((DEBUG_ERROR, "Next FV....0x%08x - 0x%x\n", FvHeader, FvHeader->FvLength));
 251   }
 252
 253   if (!FvFound) {
 254     DEBUG((DEBUG_ERROR, "GetFfsByName - NO FV Found\n"));
 255   }
 256   return FALSE;
 257 }
 258
 259 /**
 260   Extract the driver FV from an authenticated image.
 261
 262   @param[in]  AuthenticatedImage      The authenticated capsule image.
 263   @param[in]  AuthenticatedImageSize  The size of the authenticated capsule image in bytes.
 264   @param[out] DriverFvImage           The driver FV image.
 265   @param[out] DriverFvImageSize       The size of the driver FV image in bytes.
 266
 267   @retval TRUE  The driver Fv is extracted.
 268   @retval FALSE The driver Fv is not extracted.
 269 **/
 270 BOOLEAN
 271 EFIAPI
 272 ExtractDriverFvImage (
 273   IN VOID                         *AuthenticatedImage,
 274   IN UINTN                        AuthenticatedImageSize,
 275   OUT VOID                        **DriverFvImage,
 276   OUT UINTN                       *DriverFvImageSize
 277   )
 278 {
 279   BOOLEAN     Result;
 280   UINT32      FileHeaderSize;
 281
 282   *DriverFvImage = NULL;
 283   *DriverFvImageSize = 0;
 284
 285   Result = GetFfsByName(AuthenticatedImage, AuthenticatedImageSize, &gEdkiiSystemFmpCapsuleDriverFvFileGuid, EFI_FV_FILETYPE_RAW, DriverFvImage, DriverFvImageSize);
 286   if (!Result) {
 287     return FALSE;
 288   }
 289
 290   if (IS_FFS_FILE2(*DriverFvImage)) {
 291     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER2);
 292   } else {
 293     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER);
 294   }
 295   *DriverFvImage = (UINT8 *)*DriverFvImage + FileHeaderSize;
 296   *DriverFvImageSize = *DriverFvImageSize - FileHeaderSize;
 297
 298   return Result;
 299 }
 300
 301 /**
 302   Extract the config image from an authenticated image.
 303
 304   @param[in]  AuthenticatedImage      The authenticated capsule image.
 305   @param[in]  AuthenticatedImageSize  The size of the authenticated capsule image in bytes.
 306   @param[out] ConfigImage             The config image.
 307   @param[out] ConfigImageSize         The size of the config image in bytes.
 308
 309   @retval TRUE  The config image is extracted.
 310   @retval FALSE The config image is not extracted.
 311 **/
 312 BOOLEAN
 313 EFIAPI
 314 ExtractConfigImage (
 315   IN VOID                         *AuthenticatedImage,
 316   IN UINTN                        AuthenticatedImageSize,
 317   OUT VOID                        **ConfigImage,
 318   OUT UINTN                       *ConfigImageSize
 319   )
 320 {
 321   BOOLEAN     Result;
 322   UINT32      FileHeaderSize;
 323
 324   *ConfigImage = NULL;
 325   *ConfigImageSize = 0;
 326
 327   Result = GetFfsByName(AuthenticatedImage, AuthenticatedImageSize, &gEdkiiSystemFmpCapsuleConfigFileGuid, EFI_FV_FILETYPE_RAW, ConfigImage, ConfigImageSize);
 328   if (!Result) {
 329     return FALSE;
 330   }
 331
 332   if (IS_FFS_FILE2(*ConfigImage)) {
 333     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER2);
 334   } else {
 335     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER);
 336   }
 337   *ConfigImage = (UINT8 *)*ConfigImage + FileHeaderSize;
 338   *ConfigImageSize = *ConfigImageSize - FileHeaderSize;
 339
 340   return Result;
 341 }
 342
 343 /**
 344   Extract the authenticated image from an FMP capsule image.
 345
 346   Caution: This function may receive untrusted input.
 347
 348   @param[in]  Image                   The FMP capsule image, including EFI_FIRMWARE_IMAGE_AUTHENTICATION.
 349   @param[in]  ImageSize               The size of FMP capsule image in bytes.
 350   @param[out] LastAttemptStatus       The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 351   @param[out] AuthenticatedImage      The authenticated capsule image, excluding EFI_FIRMWARE_IMAGE_AUTHENTICATION.
 352   @param[out] AuthenticatedImageSize  The size of the authenticated capsule image in bytes.
 353
 354   @retval TRUE  The authenticated image is extracted.
 355   @retval FALSE The authenticated image is not extracted.
 356 **/
 357 BOOLEAN
 358 EFIAPI
 359 ExtractAuthenticatedImage (
 360   IN VOID                         *Image,
 361   IN UINTN                        ImageSize,
 362   OUT UINT32                      *LastAttemptStatus,
 363   OUT VOID                        **AuthenticatedImage,
 364   OUT UINTN                       *AuthenticatedImageSize
 365   )
 366 {
 367   EFI_FIRMWARE_IMAGE_AUTHENTICATION         *ImageAuth;
 368   EFI_STATUS                                Status;
 369   GUID                                      *CertType;
 370   VOID                                      *PublicKeyData;
 371   UINTN                                     PublicKeyDataLength;
 372
 373   DEBUG((DEBUG_INFO, "ExtractAuthenticatedImage - Image: 0x%08x - 0x%08x\n", (UINTN)Image, (UINTN)ImageSize));
 374
 375   *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 376   if ((Image == NULL) || (ImageSize == 0)) {
 377     return FALSE;
 378   }
 379
 380   ImageAuth = (EFI_FIRMWARE_IMAGE_AUTHENTICATION *)Image;
 381   if (ImageSize < sizeof(EFI_FIRMWARE_IMAGE_AUTHENTICATION)) {
 382     DEBUG((DEBUG_ERROR, "ExtractAuthenticatedImage - ImageSize too small\n"));
 383     return FALSE;
 384   }
 385   if (ImageAuth->AuthInfo.Hdr.dwLength <= OFFSET_OF(WIN_CERTIFICATE_UEFI_GUID, CertData)) {
 386     DEBUG((DEBUG_ERROR, "ExtractAuthenticatedImage - dwLength too small\n"));
 387     return FALSE;
 388   }
 389   if (ImageAuth->AuthInfo.Hdr.dwLength > MAX_UINTN - sizeof(UINT64)) {
 390     DEBUG((DEBUG_ERROR, "ExtractAuthenticatedImage - dwLength too big\n"));
 391     return FALSE;
 392   }
 393   if (ImageSize <= sizeof(ImageAuth->MonotonicCount) + ImageAuth->AuthInfo.Hdr.dwLength) {
 394     DEBUG((DEBUG_ERROR, "ExtractAuthenticatedImage - ImageSize too small\n"));
 395     return FALSE;
 396   }
 397   if (ImageAuth->AuthInfo.Hdr.wRevision != 0x0200) {
 398     DEBUG((DEBUG_ERROR, "ExtractAuthenticatedImage - wRevision: 0x%02x, expect - 0x%02x\n", (UINTN)ImageAuth->AuthInfo.Hdr.wRevision, (UINTN)0x0200));
 399     return FALSE;
 400   }
 401   if (ImageAuth->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) {
 402     DEBUG((DEBUG_ERROR, "ExtractAuthenticatedImage - wCertificateType: 0x%02x, expect - 0x%02x\n", (UINTN)ImageAuth->AuthInfo.Hdr.wCertificateType, (UINTN)WIN_CERT_TYPE_EFI_GUID));
 403     return FALSE;
 404   }
 405
 406   CertType = &ImageAuth->AuthInfo.CertType;
 407   DEBUG((DEBUG_INFO, "ExtractAuthenticatedImage - CertType: %g\n", CertType));
 408
 409   if (CompareGuid(&gEfiCertPkcs7Guid, CertType)) {
 410     PublicKeyData   = PcdGetPtr(PcdPkcs7CertBuffer);
 411     PublicKeyDataLength = PcdGetSize(PcdPkcs7CertBuffer);
 412   } else if (CompareGuid(&gEfiCertTypeRsa2048Sha256Guid, CertType)) {
 413     PublicKeyData = PcdGetPtr(PcdRsa2048Sha256PublicKeyBuffer);
 414     PublicKeyDataLength = PcdGetSize(PcdRsa2048Sha256PublicKeyBuffer);
 415   } else {
 416     return FALSE;
 417   }
 418
 419   Status = AuthenticateFmpImage(
 420              ImageAuth,
 421              ImageSize,
 422              PublicKeyData,
 423              PublicKeyDataLength
 424              );
 425   switch (Status) {
 426   case RETURN_SUCCESS:
 427     *LastAttemptStatus = LAST_ATTEMPT_STATUS_SUCCESS;
 428     break;
 429   case RETURN_SECURITY_VIOLATION:
 430     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_AUTH_ERROR;
 431     break;
 432   case RETURN_INVALID_PARAMETER:
 433     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 434     break;
 435   case RETURN_UNSUPPORTED:
 436     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 437     break;
 438   case RETURN_OUT_OF_RESOURCES:
 439     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
 440     break;
 441   default:
 442     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_UNSUCCESSFUL;
 443     break;
 444   }
 445   if (EFI_ERROR(Status)) {
 446     return FALSE;
 447   }
 448
 449   if (AuthenticatedImage != NULL) {
 450     *AuthenticatedImage = (UINT8 *)ImageAuth + ImageAuth->AuthInfo.Hdr.dwLength + sizeof(ImageAuth->MonotonicCount);
 451   }
 452   if (AuthenticatedImageSize != NULL) {
 453     *AuthenticatedImageSize = ImageSize - ImageAuth->AuthInfo.Hdr.dwLength - sizeof(ImageAuth->MonotonicCount);
 454   }
 455   return TRUE;
 456 }
 457
 458 /**
 459   Extract ImageFmpInfo from system firmware.
 460
 461   @param[in]  SystemFirmwareImage     The System Firmware image.
 462   @param[in]  SystemFirmwareImageSize The size of the System Firmware image in bytes.
 463   @param[out] ImageFmpInfo            The ImageFmpInfo.
 464   @param[out] ImageFmpInfoSize        The size of the ImageFmpInfo in bytes.
 465
 466   @retval TRUE  The ImageFmpInfo is extracted.
 467   @retval FALSE The ImageFmpInfo is not extracted.
 468 **/
 469 BOOLEAN
 470 EFIAPI
 471 ExtractSystemFirmwareImageFmpInfo (
 472   IN VOID                                      *SystemFirmwareImage,
 473   IN UINTN                                     SystemFirmwareImageSize,
 474   OUT EDKII_SYSTEM_FIRMWARE_IMAGE_DESCRIPTOR   **ImageFmpInfo,
 475   OUT UINTN                                    *ImageFmpInfoSize
 476   )
 477 {
 478   BOOLEAN     Result;
 479   UINT32      SectionHeaderSize;
 480   UINT32      FileHeaderSize;
 481
 482   *ImageFmpInfo = NULL;
 483   *ImageFmpInfoSize = 0;
 484
 485   Result = GetFfsByName(SystemFirmwareImage, SystemFirmwareImageSize, &gEdkiiSystemFirmwareImageDescriptorFileGuid, EFI_FV_FILETYPE_ALL, (VOID **)ImageFmpInfo, ImageFmpInfoSize);
 486   if (!Result) {
 487     return FALSE;
 488   }
 489   if (IS_FFS_FILE2 (*ImageFmpInfo)) {
 490     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER2);
 491   } else {
 492     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER);
 493   }
 494   *ImageFmpInfo = (VOID *)((UINT8 *)*ImageFmpInfo + FileHeaderSize);
 495   *ImageFmpInfoSize = *ImageFmpInfoSize - FileHeaderSize;
 496
 497   Result = GetSectionByType(*ImageFmpInfo, (UINT32)*ImageFmpInfoSize, EFI_SECTION_RAW, 0, (VOID **)ImageFmpInfo, ImageFmpInfoSize);
 498   if (!Result) {
 499     return FALSE;
 500   }
 501   if (IS_SECTION2(*ImageFmpInfo)) {
 502     SectionHeaderSize = sizeof(EFI_RAW_SECTION2);
 503   } else {
 504     SectionHeaderSize = sizeof(EFI_RAW_SECTION);
 505   }
 506   *ImageFmpInfo = (VOID *)((UINT8 *)*ImageFmpInfo + SectionHeaderSize);
 507   *ImageFmpInfoSize = *ImageFmpInfoSize - SectionHeaderSize;
 508
 509   return TRUE;
 510 }
 511
 512 /**
 513   Extract the System Firmware image from an authenticated image.
 514
 515   @param[in]  AuthenticatedImage      The authenticated capsule image.
 516   @param[in]  AuthenticatedImageSize  The size of the authenticated capsule image in bytes.
 517   @param[out] SystemFirmwareImage     The System Firmware image.
 518   @param[out] SystemFirmwareImageSize The size of the System Firmware image in bytes.
 519
 520   @retval TRUE  The System Firmware image is extracted.
 521   @retval FALSE The System Firmware image is not extracted.
 522 **/
 523 BOOLEAN
 524 EFIAPI
 525 ExtractSystemFirmwareImage (
 526   IN VOID                         *AuthenticatedImage,
 527   IN UINTN                        AuthenticatedImageSize,
 528   OUT VOID                        **SystemFirmwareImage,
 529   OUT UINTN                       *SystemFirmwareImageSize
 530   )
 531 {
 532   BOOLEAN     Result;
 533   UINT32      FileHeaderSize;
 534
 535   *SystemFirmwareImage = NULL;
 536   *SystemFirmwareImageSize = 0;
 537
 538   Result = GetFfsByName(AuthenticatedImage, AuthenticatedImageSize, &mEdkiiSystemFirmwareFileGuid, EFI_FV_FILETYPE_RAW, SystemFirmwareImage, SystemFirmwareImageSize);
 539   if (!Result) {
 540     // no nested FV, just return all data.
 541     *SystemFirmwareImage = AuthenticatedImage;
 542     *SystemFirmwareImageSize = AuthenticatedImageSize;
 543
 544     return TRUE;
 545   }
 546   if (IS_FFS_FILE2 (*SystemFirmwareImage)) {
 547     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER2);
 548   } else {
 549     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER);
 550   }
 551   *SystemFirmwareImage = (UINT8 *)*SystemFirmwareImage + FileHeaderSize;
 552   *SystemFirmwareImageSize = *SystemFirmwareImageSize - FileHeaderSize;
 553
 554   return Result;
 555 }
 556
 557 /**
 558   Authenticated system firmware FMP capsule image.
 559
 560   Caution: This function may receive untrusted input.
 561
 562   @param[in]  Image                   The FMP capsule image, including EFI_FIRMWARE_IMAGE_AUTHENTICATION.
 563   @param[in]  ImageSize               The size of FMP capsule image in bytes.
 564   @param[in]  ForceVersionMatch       TRUE: The version of capsule must be as same as the version of current image.
 565                                       FALSE: The version of capsule must be as same as greater than the lowest
 566                                              supported version of current image.
 567   @param[out] LastAttemptVersion      The last attempt version, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 568   @param[out] LastAttemptStatus       The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 569   @param[out] AuthenticatedImage      The authenticated capsule image, excluding EFI_FIRMWARE_IMAGE_AUTHENTICATION.
 570   @param[out] AuthenticatedImageSize  The size of the authenticated capsule image in bytes.
 571
 572   @retval TRUE  Authentication passes and the authenticated image is extracted.
 573   @retval FALSE Authentication fails and the authenticated image is not extracted.
 574 **/
 575 EFI_STATUS
 576 EFIAPI
 577 CapsuleAuthenticateSystemFirmware (
 578   IN VOID                         *Image,
 579   IN UINTN                        ImageSize,
 580   IN BOOLEAN                      ForceVersionMatch,
 581   OUT UINT32                      *LastAttemptVersion,
 582   OUT UINT32                      *LastAttemptStatus,
 583   OUT VOID                        **AuthenticatedImage,
 584   OUT UINTN                       *AuthenticatedImageSize
 585   )
 586 {
 587   BOOLEAN                                  Result;
 588   EDKII_SYSTEM_FIRMWARE_IMAGE_DESCRIPTOR   *ImageFmpInfo;
 589   UINTN                                    ImageFmpInfoSize;
 590   EDKII_SYSTEM_FIRMWARE_IMAGE_DESCRIPTOR   *CurrentImageFmpInfo;
 591   UINTN                                    CurrentImageFmpInfoSize;
 592   VOID                                     *SystemFirmwareImage;
 593   UINTN                                    SystemFirmwareImageSize;
 594
 595   *LastAttemptVersion = 0;
 596
 597   //
 598   // NOTE: This function need run in an isolated environment.
 599   // Do not touch FMP protocol and its private structure.
 600   //
 601
 602   Result = ExtractAuthenticatedImage((VOID *)Image, ImageSize, LastAttemptStatus, AuthenticatedImage, AuthenticatedImageSize);
 603   if (!Result) {
 604     DEBUG((DEBUG_INFO, "ExtractAuthenticatedImage - fail\n"));
 605     return EFI_SECURITY_VIOLATION;
 606   }
 607
 608   DEBUG((DEBUG_INFO, "AuthenticatedImage - 0x%x - 0x%x\n", *AuthenticatedImage, *AuthenticatedImageSize));
 609
 610   Result = ExtractSystemFirmwareImage(*AuthenticatedImage, *AuthenticatedImageSize, &SystemFirmwareImage, &SystemFirmwareImageSize);
 611   if (!Result) {
 612     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 613     DEBUG((DEBUG_INFO, "ExtractSystemFirmwareImage - fail\n"));
 614     return EFI_SECURITY_VIOLATION;
 615   }
 616   DEBUG((DEBUG_INFO, "SystemFirmwareImage - 0x%x - 0x%x\n", SystemFirmwareImage, SystemFirmwareImageSize));
 617
 618   Result = ExtractSystemFirmwareImageFmpInfo(SystemFirmwareImage, SystemFirmwareImageSize, &ImageFmpInfo, &ImageFmpInfoSize);
 619   if (!Result) {
 620     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 621     DEBUG((DEBUG_INFO, "ExtractSystemFirmwareImageFmpInfo - fail\n"));
 622     return EFI_SECURITY_VIOLATION;
 623   }
 624
 625   *LastAttemptVersion = ImageFmpInfo->Version;
 626   DEBUG((DEBUG_INFO, "ImageFmpInfo - 0x%x - 0x%x\n", ImageFmpInfo, ImageFmpInfoSize));
 627   DEBUG((DEBUG_INFO, "NewImage Version - 0x%x\n", ImageFmpInfo->Version));
 628   DEBUG((DEBUG_INFO, "NewImage LowestSupportedImageVersion - 0x%x\n", ImageFmpInfo->LowestSupportedImageVersion));
 629
 630   CurrentImageFmpInfo = mImageFmpInfo;
 631   CurrentImageFmpInfoSize = mImageFmpInfoSize;
 632
 633   DEBUG((DEBUG_INFO, "ImageFmpInfo - 0x%x - 0x%x\n", CurrentImageFmpInfo, CurrentImageFmpInfoSize));
 634   DEBUG((DEBUG_INFO, "Current Version - 0x%x\n", CurrentImageFmpInfo->Version));
 635   DEBUG((DEBUG_INFO, "Current LowestSupportedImageVersion - 0x%x\n", CurrentImageFmpInfo->LowestSupportedImageVersion));
 636
 637   if (ForceVersionMatch) {
 638     if (CurrentImageFmpInfo->Version != ImageFmpInfo->Version) {
 639       *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INCORRECT_VERSION;
 640       DEBUG((DEBUG_INFO, "ForceVersionMatch check - fail\n"));
 641       return EFI_SECURITY_VIOLATION;
 642     }
 643   } else {
 644     if (CurrentImageFmpInfo->Version < ImageFmpInfo->LowestSupportedImageVersion) {
 645       *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INCORRECT_VERSION;
 646       DEBUG((DEBUG_INFO, "LowestSupportedImageVersion check - fail\n"));
 647       return EFI_SECURITY_VIOLATION;
 648     }
 649   }
 650
 651   *LastAttemptStatus = LAST_ATTEMPT_STATUS_SUCCESS;
 652   return EFI_SUCCESS;
 653 }
 654
 655 /**
 656   The constructor function.
 657
 658   @retval EFI_SUCCESS   The constructor successfully .
 659 **/
 660 EFI_STATUS
 661 EFIAPI
 662 EdkiiSystemCapsuleLibConstructor (
 663   VOID
 664   )
 665 {
 666   mImageFmpInfoSize = PcdGetSize(PcdEdkiiSystemFirmwareImageDescriptor);
 667   mImageFmpInfo = AllocateCopyPool (mImageFmpInfoSize, PcdGetPtr(PcdEdkiiSystemFirmwareImageDescriptor));
 668   ASSERT(mImageFmpInfo != NULL);
 669   CopyGuid(&mEdkiiSystemFirmwareFileGuid, PcdGetPtr(PcdEdkiiSystemFirmwareFileGuid));
 670   return EFI_SUCCESS;
 671 }