SignedCapsulePkg/Library/EdkiiSystemCapsuleLib/EdkiiSystemCapsuleLib.c

   1 /** @file
   2   EDKII System Capsule library.
   3
   4   EDKII System Capsule library instance.
   5
   6   CapsuleAuthenticateSystemFirmware(), ExtractAuthenticatedImage() will receive
   7   untrusted input and do basic validation.
   8
   9   Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
  10   This program and the accompanying materials
  11   are licensed and made available under the terms and conditions of the BSD License
  12   which accompanies this distribution.  The full text of the license may be found at
  13   http://opensource.org/licenses/bsd-license.php
  14
  15   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  16   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  17
  18 **/
  19
  20 #include <PiDxe.h>
  21
  22 #include <Guid/SystemResourceTable.h>
  23 #include <Guid/FirmwareContentsSigned.h>
  24 #include <Guid/WinCertificate.h>
  25 #include <Guid/EdkiiSystemFmpCapsule.h>
  26 #include <Guid/WinCertificate.h>
  27 #include <Guid/ImageAuthentication.h>
  28
  29 #include <Library/BaseLib.h>
  30 #include <Library/BaseMemoryLib.h>
  31 #include <Library/DebugLib.h>
  32 #include <Library/PcdLib.h>
  33 #include <Library/MemoryAllocationLib.h>
  34 #include <Library/EdkiiSystemCapsuleLib.h>
  35 #include <Library/FmpAuthenticationLib.h>
  36
  37 #include <Protocol/FirmwareManagement.h>
  38
  39 EDKII_SYSTEM_FIRMWARE_IMAGE_DESCRIPTOR   *mImageFmpInfo;
  40 UINTN                                    mImageFmpInfoSize;
  41 EFI_GUID                                 mEdkiiSystemFirmwareFileGuid;
  42
  43 /**
  44   Check if a block of buffer is erased.
  45
  46   @param[in] ErasePolarity  Erase polarity attribute of the firmware volume
  47   @param[in] InBuffer       The buffer to be checked
  48   @param[in] BufferSize     Size of the buffer in bytes
  49
  50   @retval    TRUE           The block of buffer is erased
  51   @retval    FALSE          The block of buffer is not erased
  52 **/
  53 BOOLEAN
  54 IsBufferErased (
  55   IN UINT8    ErasePolarity,
  56   IN VOID     *InBuffer,
  57   IN UINTN    BufferSize
  58   )
  59 {
  60   UINTN   Count;
  61   UINT8   EraseByte;
  62   UINT8   *Buffer;
  63
  64   if(ErasePolarity == 1) {
  65     EraseByte = 0xFF;
  66   } else {
  67     EraseByte = 0;
  68   }
  69
  70   Buffer = InBuffer;
  71   for (Count = 0; Count < BufferSize; Count++) {
  72     if (Buffer[Count] != EraseByte) {
  73       return FALSE;
  74     }
  75   }
  76
  77   return TRUE;
  78 }
  79
  80 /**
  81   Get Section buffer pointer by SectionType and SectionInstance.
  82
  83   @param[in]   SectionBuffer     The buffer of section
  84   @param[in]   SectionBufferSize The size of SectionBuffer in bytes
  85   @param[in]   SectionType       The SectionType of Section to be found
  86   @param[in]   SectionInstance   The Instance of Section to be found
  87   @param[out]  OutSectionBuffer  The section found, including SECTION_HEADER
  88   @param[out]  OutSectionSize    The size of section found, including SECTION_HEADER
  89
  90   @retval TRUE  The FFS buffer is found.
  91   @retval FALSE The FFS buffer is not found.
  92 **/
  93 BOOLEAN
  94 GetSectionByType (
  95   IN VOID                  *SectionBuffer,
  96   IN UINT32                SectionBufferSize,
  97   IN EFI_SECTION_TYPE      SectionType,
  98   IN UINTN                 SectionInstance,
  99   OUT VOID                 **OutSectionBuffer,
 100   OUT UINTN                *OutSectionSize
 101   )
 102 {
 103   EFI_COMMON_SECTION_HEADER             *SectionHeader;
 104   UINTN                                 SectionSize;
 105   UINTN                                 Instance;
 106
 107   DEBUG ((DEBUG_INFO, "GetSectionByType - Buffer: 0x%08x - 0x%08x\n", SectionBuffer, SectionBufferSize));
 108
 109   //
 110   // Find Section
 111   //
 112   SectionHeader = SectionBuffer;
 113
 114   Instance = 0;
 115   while ((UINTN)SectionHeader < (UINTN)SectionBuffer + SectionBufferSize) {
 116     DEBUG ((DEBUG_INFO, "GetSectionByType - Section: 0x%08x\n", SectionHeader));
 117     if (IS_SECTION2(SectionHeader)) {
 118       SectionSize = SECTION2_SIZE(SectionHeader);
 119     } else {
 120       SectionSize = SECTION_SIZE(SectionHeader);
 121     }
 122
 123     if (SectionHeader->Type == SectionType) {
 124       if (Instance == SectionInstance) {
 125         *OutSectionBuffer = (UINT8 *)SectionHeader;
 126         *OutSectionSize = SectionSize;
 127         DEBUG((DEBUG_INFO, "GetSectionByType - 0x%x - 0x%x\n", *OutSectionBuffer, *OutSectionSize));
 128         return TRUE;
 129       } else {
 130         DEBUG((DEBUG_INFO, "GetSectionByType - find section instance %x\n", Instance));
 131         Instance++;
 132       }
 133     } else {
 134       //
 135       // Skip other section type
 136       //
 137       DEBUG ((DEBUG_INFO, "GetSectionByType - other section type 0x%x\n", SectionHeader->Type));
 138     }
 139
 140     //
 141     // Next Section
 142     //
 143     SectionHeader = (EFI_COMMON_SECTION_HEADER *)((UINTN)SectionHeader + ALIGN_VALUE(SectionSize, 4));
 144   }
 145
 146   return FALSE;
 147 }
 148
 149 /**
 150   Get FFS buffer pointer by FileName GUID and FileType.
 151
 152   @param[in]   FdStart          The System Firmware FD image
 153   @param[in]   FdSize           The size of System Firmware FD image
 154   @param[in]   FileName         The FileName GUID of FFS to be found
 155   @param[in]   Type             The FileType of FFS to be found
 156   @param[out]  OutFfsBuffer     The FFS buffer found, including FFS_FILE_HEADER
 157   @param[out]  OutFfsBufferSize The size of FFS buffer found, including FFS_FILE_HEADER
 158
 159   @retval TRUE  The FFS buffer is found.
 160   @retval FALSE The FFS buffer is not found.
 161 **/
 162 BOOLEAN
 163 GetFfsByName (
 164   IN VOID                  *FdStart,
 165   IN UINTN                 FdSize,
 166   IN EFI_GUID              *FileName,
 167   IN EFI_FV_FILETYPE       Type,
 168   OUT VOID                 **OutFfsBuffer,
 169   OUT UINTN                *OutFfsBufferSize
 170   )
 171 {
 172   UINTN                                     FvSize;
 173   EFI_FIRMWARE_VOLUME_HEADER                *FvHeader;
 174   EFI_FIRMWARE_VOLUME_EXT_HEADER            *FvExtHeader;
 175   EFI_FFS_FILE_HEADER                       *FfsHeader;
 176   UINT32                                    FfsSize;
 177   UINTN                                     TestLength;
 178   BOOLEAN                                   FvFound;
 179
 180   DEBUG ((DEBUG_INFO, "GetFfsByName - FV: 0x%08x - 0x%08x\n", (UINTN)FdStart, (UINTN)FdSize));
 181
 182   FvFound = FALSE;
 183   FvHeader = (EFI_FIRMWARE_VOLUME_HEADER *)FdStart;
 184   while ((UINTN)FvHeader < (UINTN)FdStart + FdSize - 1) {
 185     FvSize = (UINTN)FdStart + FdSize - (UINTN)FvHeader;
 186
 187     if (FvHeader->Signature != EFI_FVH_SIGNATURE) {
 188       FvHeader = (EFI_FIRMWARE_VOLUME_HEADER *)((UINTN)FvHeader + SIZE_4KB);
 189       continue;
 190     }
 191     DEBUG((DEBUG_INFO, "checking FV....0x%08x - 0x%x\n", FvHeader, FvHeader->FvLength));
 192     FvFound = TRUE;
 193     if (FvHeader->FvLength > FvSize) {
 194       DEBUG((DEBUG_ERROR, "GetFfsByName - FvSize: 0x%08x, MaxSize - 0x%08x\n", (UINTN)FvHeader->FvLength, (UINTN)FvSize));
 195       return FALSE;
 196     }
 197     FvSize = (UINTN)FvHeader->FvLength;
 198
 199     //
 200     // Find FFS
 201     //
 202     if (FvHeader->ExtHeaderOffset != 0) {
 203       FvExtHeader = (EFI_FIRMWARE_VOLUME_EXT_HEADER *)((UINT8 *)FvHeader + FvHeader->ExtHeaderOffset);
 204       FfsHeader = (EFI_FFS_FILE_HEADER *)((UINT8 *)FvExtHeader + FvExtHeader->ExtHeaderSize);
 205     } else {
 206       FfsHeader = (EFI_FFS_FILE_HEADER *)((UINT8 *)FvHeader + FvHeader->HeaderLength);
 207     }
 208     FfsHeader = (EFI_FFS_FILE_HEADER *)((UINTN)FvHeader + ALIGN_VALUE((UINTN)FfsHeader - (UINTN)FvHeader, 8));
 209
 210     while ((UINTN)FfsHeader < (UINTN)FvHeader + FvSize - 1) {
 211       DEBUG((DEBUG_INFO, "GetFfsByName - FFS: 0x%08x\n", FfsHeader));
 212       TestLength = (UINTN)((UINTN)FvHeader + FvSize - (UINTN)FfsHeader);
 213       if (TestLength > sizeof(EFI_FFS_FILE_HEADER)) {
 214         TestLength = sizeof(EFI_FFS_FILE_HEADER);
 215       }
 216       if (IsBufferErased(1, FfsHeader, TestLength)) {
 217         break;
 218       }
 219
 220       if (IS_FFS_FILE2(FfsHeader)) {
 221         FfsSize = FFS_FILE2_SIZE(FfsHeader);
 222       } else {
 223         FfsSize = FFS_FILE_SIZE(FfsHeader);
 224       }
 225
 226       if (CompareGuid(FileName, &FfsHeader->Name) &&
 227           ((Type == EFI_FV_FILETYPE_ALL) || (FfsHeader->Type == Type))) {
 228         *OutFfsBuffer = FfsHeader;
 229         *OutFfsBufferSize = FfsSize;
 230         return TRUE;
 231       } else {
 232         //
 233         // Any other type is not allowed
 234         //
 235         DEBUG((DEBUG_INFO, "GetFfsByName - other FFS type 0x%x, name %g\n", FfsHeader->Type, &FfsHeader->Name));
 236       }
 237
 238       //
 239       // Next File
 240       //
 241       FfsHeader = (EFI_FFS_FILE_HEADER *)((UINTN)FfsHeader + ALIGN_VALUE(FfsSize, 8));
 242     }
 243
 244     //
 245     // Next FV
 246     //
 247     FvHeader = (VOID *)(UINTN)((UINTN)FvHeader + FvHeader->FvLength);
 248   }
 249
 250   if (!FvFound) {
 251     DEBUG((DEBUG_ERROR, "GetFfsByName - NO FV Found\n"));
 252   }
 253   return FALSE;
 254 }
 255
 256 /**
 257   Extract the driver FV from an authenticated image.
 258
 259   @param[in]  AuthenticatedImage      The authenticated capsule image.
 260   @param[in]  AuthenticatedImageSize  The size of the authenticated capsule image in bytes.
 261   @param[out] DriverFvImage           The driver FV image.
 262   @param[out] DriverFvImageSize       The size of the driver FV image in bytes.
 263
 264   @retval TRUE  The driver Fv is extracted.
 265   @retval FALSE The driver Fv is not extracted.
 266 **/
 267 BOOLEAN
 268 EFIAPI
 269 ExtractDriverFvImage (
 270   IN VOID                         *AuthenticatedImage,
 271   IN UINTN                        AuthenticatedImageSize,
 272   OUT VOID                        **DriverFvImage,
 273   OUT UINTN                       *DriverFvImageSize
 274   )
 275 {
 276   BOOLEAN     Result;
 277   UINT32      FileHeaderSize;
 278
 279   *DriverFvImage = NULL;
 280   *DriverFvImageSize = 0;
 281
 282   Result = GetFfsByName(AuthenticatedImage, AuthenticatedImageSize, &gEdkiiSystemFmpCapsuleDriverFvFileGuid, EFI_FV_FILETYPE_RAW, DriverFvImage, DriverFvImageSize);
 283   if (!Result) {
 284     return FALSE;
 285   }
 286
 287   if (IS_FFS_FILE2(*DriverFvImage)) {
 288     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER2);
 289   } else {
 290     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER);
 291   }
 292   *DriverFvImage = (UINT8 *)*DriverFvImage + FileHeaderSize;
 293   *DriverFvImageSize = *DriverFvImageSize - FileHeaderSize;
 294
 295   return Result;
 296 }
 297
 298 /**
 299   Extract the config image from an authenticated image.
 300
 301   @param[in]  AuthenticatedImage      The authenticated capsule image.
 302   @param[in]  AuthenticatedImageSize  The size of the authenticated capsule image in bytes.
 303   @param[out] ConfigImage             The config image.
 304   @param[out] ConfigImageSize         The size of the config image in bytes.
 305
 306   @retval TRUE  The config image is extracted.
 307   @retval FALSE The config image is not extracted.
 308 **/
 309 BOOLEAN
 310 EFIAPI
 311 ExtractConfigImage (
 312   IN VOID                         *AuthenticatedImage,
 313   IN UINTN                        AuthenticatedImageSize,
 314   OUT VOID                        **ConfigImage,
 315   OUT UINTN                       *ConfigImageSize
 316   )
 317 {
 318   BOOLEAN     Result;
 319   UINT32      FileHeaderSize;
 320
 321   *ConfigImage = NULL;
 322   *ConfigImageSize = 0;
 323
 324   Result = GetFfsByName(AuthenticatedImage, AuthenticatedImageSize, &gEdkiiSystemFmpCapsuleConfigFileGuid, EFI_FV_FILETYPE_RAW, ConfigImage, ConfigImageSize);
 325   if (!Result) {
 326     return FALSE;
 327   }
 328
 329   if (IS_FFS_FILE2(*ConfigImage)) {
 330     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER2);
 331   } else {
 332     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER);
 333   }
 334   *ConfigImage = (UINT8 *)*ConfigImage + FileHeaderSize;
 335   *ConfigImageSize = *ConfigImageSize - FileHeaderSize;
 336
 337   return Result;
 338 }
 339
 340 /**
 341   Extract the authenticated image from an FMP capsule image.
 342
 343   Caution: This function may receive untrusted input.
 344
 345   @param[in]  Image                   The FMP capsule image, including EFI_FIRMWARE_IMAGE_AUTHENTICATION.
 346   @param[in]  ImageSize               The size of FMP capsule image in bytes.
 347   @param[out] LastAttemptStatus       The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 348   @param[out] AuthenticatedImage      The authenticated capsule image, excluding EFI_FIRMWARE_IMAGE_AUTHENTICATION.
 349   @param[out] AuthenticatedImageSize  The size of the authenticated capsule image in bytes.
 350
 351   @retval TRUE  The authenticated image is extracted.
 352   @retval FALSE The authenticated image is not extracted.
 353 **/
 354 BOOLEAN
 355 EFIAPI
 356 ExtractAuthenticatedImage (
 357   IN VOID                         *Image,
 358   IN UINTN                        ImageSize,
 359   OUT UINT32                      *LastAttemptStatus,
 360   OUT VOID                        **AuthenticatedImage,
 361   OUT UINTN                       *AuthenticatedImageSize
 362   )
 363 {
 364   EFI_FIRMWARE_IMAGE_AUTHENTICATION         *ImageAuth;
 365   EFI_STATUS                                Status;
 366   GUID                                      *CertType;
 367   VOID                                      *PublicKeyData;
 368   UINTN                                     PublicKeyDataLength;
 369
 370   DEBUG((DEBUG_INFO, "ExtractAuthenticatedImage - Image: 0x%08x - 0x%08x\n", (UINTN)Image, (UINTN)ImageSize));
 371
 372   *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 373   if ((Image == NULL) || (ImageSize == 0)) {
 374     return FALSE;
 375   }
 376
 377   ImageAuth = (EFI_FIRMWARE_IMAGE_AUTHENTICATION *)Image;
 378   if (ImageSize < sizeof(EFI_FIRMWARE_IMAGE_AUTHENTICATION)) {
 379     DEBUG((DEBUG_ERROR, "ExtractAuthenticatedImage - ImageSize too small\n"));
 380     return FALSE;
 381   }
 382   if (ImageAuth->AuthInfo.Hdr.dwLength <= OFFSET_OF(WIN_CERTIFICATE_UEFI_GUID, CertData)) {
 383     DEBUG((DEBUG_ERROR, "ExtractAuthenticatedImage - dwLength too small\n"));
 384     return FALSE;
 385   }
 386   if ((UINTN) ImageAuth->AuthInfo.Hdr.dwLength > MAX_UINTN - sizeof(UINT64)) {
 387     DEBUG((DEBUG_ERROR, "ExtractAuthenticatedImage - dwLength too big\n"));
 388     return FALSE;
 389   }
 390   if (ImageSize <= sizeof(ImageAuth->MonotonicCount) + ImageAuth->AuthInfo.Hdr.dwLength) {
 391     DEBUG((DEBUG_ERROR, "ExtractAuthenticatedImage - ImageSize too small\n"));
 392     return FALSE;
 393   }
 394   if (ImageAuth->AuthInfo.Hdr.wRevision != 0x0200) {
 395     DEBUG((DEBUG_ERROR, "ExtractAuthenticatedImage - wRevision: 0x%02x, expect - 0x%02x\n", (UINTN)ImageAuth->AuthInfo.Hdr.wRevision, (UINTN)0x0200));
 396     return FALSE;
 397   }
 398   if (ImageAuth->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) {
 399     DEBUG((DEBUG_ERROR, "ExtractAuthenticatedImage - wCertificateType: 0x%02x, expect - 0x%02x\n", (UINTN)ImageAuth->AuthInfo.Hdr.wCertificateType, (UINTN)WIN_CERT_TYPE_EFI_GUID));
 400     return FALSE;
 401   }
 402
 403   CertType = &ImageAuth->AuthInfo.CertType;
 404   DEBUG((DEBUG_INFO, "ExtractAuthenticatedImage - CertType: %g\n", CertType));
 405
 406   if (CompareGuid(&gEfiCertPkcs7Guid, CertType)) {
 407     PublicKeyData   = PcdGetPtr(PcdPkcs7CertBuffer);
 408     PublicKeyDataLength = PcdGetSize(PcdPkcs7CertBuffer);
 409   } else if (CompareGuid(&gEfiCertTypeRsa2048Sha256Guid, CertType)) {
 410     PublicKeyData = PcdGetPtr(PcdRsa2048Sha256PublicKeyBuffer);
 411     PublicKeyDataLength = PcdGetSize(PcdRsa2048Sha256PublicKeyBuffer);
 412   } else {
 413     return FALSE;
 414   }
 415   ASSERT (PublicKeyData != NULL);
 416   ASSERT (PublicKeyDataLength != 0);
 417
 418   Status = AuthenticateFmpImage(
 419              ImageAuth,
 420              ImageSize,
 421              PublicKeyData,
 422              PublicKeyDataLength
 423              );
 424   switch (Status) {
 425   case RETURN_SUCCESS:
 426     *LastAttemptStatus = LAST_ATTEMPT_STATUS_SUCCESS;
 427     break;
 428   case RETURN_SECURITY_VIOLATION:
 429     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_AUTH_ERROR;
 430     break;
 431   case RETURN_INVALID_PARAMETER:
 432     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 433     break;
 434   case RETURN_UNSUPPORTED:
 435     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 436     break;
 437   case RETURN_OUT_OF_RESOURCES:
 438     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
 439     break;
 440   default:
 441     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_UNSUCCESSFUL;
 442     break;
 443   }
 444   if (EFI_ERROR(Status)) {
 445     return FALSE;
 446   }
 447
 448   if (AuthenticatedImage != NULL) {
 449     *AuthenticatedImage = (UINT8 *)ImageAuth + ImageAuth->AuthInfo.Hdr.dwLength + sizeof(ImageAuth->MonotonicCount);
 450   }
 451   if (AuthenticatedImageSize != NULL) {
 452     *AuthenticatedImageSize = ImageSize - ImageAuth->AuthInfo.Hdr.dwLength - sizeof(ImageAuth->MonotonicCount);
 453   }
 454   return TRUE;
 455 }
 456
 457 /**
 458   Extract ImageFmpInfo from system firmware.
 459
 460   @param[in]  SystemFirmwareImage     The System Firmware image.
 461   @param[in]  SystemFirmwareImageSize The size of the System Firmware image in bytes.
 462   @param[out] ImageFmpInfo            The ImageFmpInfo.
 463   @param[out] ImageFmpInfoSize        The size of the ImageFmpInfo in bytes.
 464
 465   @retval TRUE  The ImageFmpInfo is extracted.
 466   @retval FALSE The ImageFmpInfo is not extracted.
 467 **/
 468 BOOLEAN
 469 EFIAPI
 470 ExtractSystemFirmwareImageFmpInfo (
 471   IN VOID                                      *SystemFirmwareImage,
 472   IN UINTN                                     SystemFirmwareImageSize,
 473   OUT EDKII_SYSTEM_FIRMWARE_IMAGE_DESCRIPTOR   **ImageFmpInfo,
 474   OUT UINTN                                    *ImageFmpInfoSize
 475   )
 476 {
 477   BOOLEAN     Result;
 478   UINT32      SectionHeaderSize;
 479   UINT32      FileHeaderSize;
 480
 481   *ImageFmpInfo = NULL;
 482   *ImageFmpInfoSize = 0;
 483
 484   Result = GetFfsByName(SystemFirmwareImage, SystemFirmwareImageSize, &gEdkiiSystemFirmwareImageDescriptorFileGuid, EFI_FV_FILETYPE_ALL, (VOID **)ImageFmpInfo, ImageFmpInfoSize);
 485   if (!Result) {
 486     return FALSE;
 487   }
 488   if (IS_FFS_FILE2 (*ImageFmpInfo)) {
 489     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER2);
 490   } else {
 491     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER);
 492   }
 493   *ImageFmpInfo = (VOID *)((UINT8 *)*ImageFmpInfo + FileHeaderSize);
 494   *ImageFmpInfoSize = *ImageFmpInfoSize - FileHeaderSize;
 495
 496   Result = GetSectionByType(*ImageFmpInfo, (UINT32)*ImageFmpInfoSize, EFI_SECTION_RAW, 0, (VOID **)ImageFmpInfo, ImageFmpInfoSize);
 497   if (!Result) {
 498     return FALSE;
 499   }
 500   if (IS_SECTION2(*ImageFmpInfo)) {
 501     SectionHeaderSize = sizeof(EFI_RAW_SECTION2);
 502   } else {
 503     SectionHeaderSize = sizeof(EFI_RAW_SECTION);
 504   }
 505   *ImageFmpInfo = (VOID *)((UINT8 *)*ImageFmpInfo + SectionHeaderSize);
 506   *ImageFmpInfoSize = *ImageFmpInfoSize - SectionHeaderSize;
 507
 508   return TRUE;
 509 }
 510
 511 /**
 512   Extract the System Firmware image from an authenticated image.
 513
 514   @param[in]  AuthenticatedImage      The authenticated capsule image.
 515   @param[in]  AuthenticatedImageSize  The size of the authenticated capsule image in bytes.
 516   @param[out] SystemFirmwareImage     The System Firmware image.
 517   @param[out] SystemFirmwareImageSize The size of the System Firmware image in bytes.
 518
 519   @retval TRUE  The System Firmware image is extracted.
 520   @retval FALSE The System Firmware image is not extracted.
 521 **/
 522 BOOLEAN
 523 EFIAPI
 524 ExtractSystemFirmwareImage (
 525   IN VOID                         *AuthenticatedImage,
 526   IN UINTN                        AuthenticatedImageSize,
 527   OUT VOID                        **SystemFirmwareImage,
 528   OUT UINTN                       *SystemFirmwareImageSize
 529   )
 530 {
 531   BOOLEAN     Result;
 532   UINT32      FileHeaderSize;
 533
 534   *SystemFirmwareImage = NULL;
 535   *SystemFirmwareImageSize = 0;
 536
 537   Result = GetFfsByName(AuthenticatedImage, AuthenticatedImageSize, &mEdkiiSystemFirmwareFileGuid, EFI_FV_FILETYPE_RAW, SystemFirmwareImage, SystemFirmwareImageSize);
 538   if (!Result) {
 539     // no nested FV, just return all data.
 540     *SystemFirmwareImage = AuthenticatedImage;
 541     *SystemFirmwareImageSize = AuthenticatedImageSize;
 542
 543     return TRUE;
 544   }
 545   if (IS_FFS_FILE2 (*SystemFirmwareImage)) {
 546     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER2);
 547   } else {
 548     FileHeaderSize = sizeof(EFI_FFS_FILE_HEADER);
 549   }
 550   *SystemFirmwareImage = (UINT8 *)*SystemFirmwareImage + FileHeaderSize;
 551   *SystemFirmwareImageSize = *SystemFirmwareImageSize - FileHeaderSize;
 552
 553   return Result;
 554 }
 555
 556 /**
 557   Authenticated system firmware FMP capsule image.
 558
 559   Caution: This function may receive untrusted input.
 560
 561   @param[in]  Image                   The FMP capsule image, including EFI_FIRMWARE_IMAGE_AUTHENTICATION.
 562   @param[in]  ImageSize               The size of FMP capsule image in bytes.
 563   @param[in]  ForceVersionMatch       TRUE: The version of capsule must be as same as the version of current image.
 564                                       FALSE: The version of capsule must be as same as greater than the lowest
 565                                              supported version of current image.
 566   @param[out] LastAttemptVersion      The last attempt version, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 567   @param[out] LastAttemptStatus       The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 568   @param[out] AuthenticatedImage      The authenticated capsule image, excluding EFI_FIRMWARE_IMAGE_AUTHENTICATION.
 569   @param[out] AuthenticatedImageSize  The size of the authenticated capsule image in bytes.
 570
 571   @retval TRUE  Authentication passes and the authenticated image is extracted.
 572   @retval FALSE Authentication fails and the authenticated image is not extracted.
 573 **/
 574 EFI_STATUS
 575 EFIAPI
 576 CapsuleAuthenticateSystemFirmware (
 577   IN VOID                         *Image,
 578   IN UINTN                        ImageSize,
 579   IN BOOLEAN                      ForceVersionMatch,
 580   OUT UINT32                      *LastAttemptVersion,
 581   OUT UINT32                      *LastAttemptStatus,
 582   OUT VOID                        **AuthenticatedImage,
 583   OUT UINTN                       *AuthenticatedImageSize
 584   )
 585 {
 586   BOOLEAN                                  Result;
 587   EDKII_SYSTEM_FIRMWARE_IMAGE_DESCRIPTOR   *ImageFmpInfo;
 588   UINTN                                    ImageFmpInfoSize;
 589   EDKII_SYSTEM_FIRMWARE_IMAGE_DESCRIPTOR   *CurrentImageFmpInfo;
 590   UINTN                                    CurrentImageFmpInfoSize;
 591   VOID                                     *SystemFirmwareImage;
 592   UINTN                                    SystemFirmwareImageSize;
 593
 594   *LastAttemptVersion = 0;
 595
 596   //
 597   // NOTE: This function need run in an isolated environment.
 598   // Do not touch FMP protocol and its private structure.
 599   //
 600   if (mImageFmpInfo == NULL) {
 601     DEBUG((DEBUG_INFO, "ImageFmpInfo is not set\n"));
 602     return EFI_SECURITY_VIOLATION;
 603   }
 604
 605   Result = ExtractAuthenticatedImage((VOID *)Image, ImageSize, LastAttemptStatus, AuthenticatedImage, AuthenticatedImageSize);
 606   if (!Result) {
 607     DEBUG((DEBUG_INFO, "ExtractAuthenticatedImage - fail\n"));
 608     return EFI_SECURITY_VIOLATION;
 609   }
 610
 611   DEBUG((DEBUG_INFO, "AuthenticatedImage - 0x%x - 0x%x\n", *AuthenticatedImage, *AuthenticatedImageSize));
 612
 613   Result = ExtractSystemFirmwareImage(*AuthenticatedImage, *AuthenticatedImageSize, &SystemFirmwareImage, &SystemFirmwareImageSize);
 614   if (!Result) {
 615     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 616     DEBUG((DEBUG_INFO, "ExtractSystemFirmwareImage - fail\n"));
 617     return EFI_SECURITY_VIOLATION;
 618   }
 619   DEBUG((DEBUG_INFO, "SystemFirmwareImage - 0x%x - 0x%x\n", SystemFirmwareImage, SystemFirmwareImageSize));
 620
 621   Result = ExtractSystemFirmwareImageFmpInfo(SystemFirmwareImage, SystemFirmwareImageSize, &ImageFmpInfo, &ImageFmpInfoSize);
 622   if (!Result) {
 623     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 624     DEBUG((DEBUG_INFO, "ExtractSystemFirmwareImageFmpInfo - fail\n"));
 625     return EFI_SECURITY_VIOLATION;
 626   }
 627
 628   *LastAttemptVersion = ImageFmpInfo->Version;
 629   DEBUG((DEBUG_INFO, "ImageFmpInfo - 0x%x - 0x%x\n", ImageFmpInfo, ImageFmpInfoSize));
 630   DEBUG((DEBUG_INFO, "NewImage Version - 0x%x\n", ImageFmpInfo->Version));
 631   DEBUG((DEBUG_INFO, "NewImage LowestSupportedImageVersion - 0x%x\n", ImageFmpInfo->LowestSupportedImageVersion));
 632
 633   CurrentImageFmpInfo = mImageFmpInfo;
 634   CurrentImageFmpInfoSize = mImageFmpInfoSize;
 635
 636   DEBUG((DEBUG_INFO, "ImageFmpInfo - 0x%x - 0x%x\n", CurrentImageFmpInfo, CurrentImageFmpInfoSize));
 637   DEBUG((DEBUG_INFO, "Current Version - 0x%x\n", CurrentImageFmpInfo->Version));
 638   DEBUG((DEBUG_INFO, "Current LowestSupportedImageVersion - 0x%x\n", CurrentImageFmpInfo->LowestSupportedImageVersion));
 639
 640   if (ForceVersionMatch) {
 641     if (CurrentImageFmpInfo->Version != ImageFmpInfo->Version) {
 642       *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INCORRECT_VERSION;
 643       DEBUG((DEBUG_INFO, "ForceVersionMatch check - fail\n"));
 644       return EFI_SECURITY_VIOLATION;
 645     }
 646   } else {
 647     if (ImageFmpInfo->Version < CurrentImageFmpInfo->LowestSupportedImageVersion) {
 648       *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INCORRECT_VERSION;
 649       DEBUG((DEBUG_INFO, "LowestSupportedImageVersion check - fail\n"));
 650       return EFI_SECURITY_VIOLATION;
 651     }
 652   }
 653
 654   *LastAttemptStatus = LAST_ATTEMPT_STATUS_SUCCESS;
 655   return EFI_SUCCESS;
 656 }
 657
 658 /**
 659   PcdCallBack gets the real set PCD value
 660
 661   @param[in]      CallBackGuid    The PCD token GUID being set.
 662   @param[in]      CallBackToken   The PCD token number being set.
 663   @param[in, out] TokenData       A pointer to the token data being set.
 664   @param[in]      TokenDataSize   The size, in bytes, of the data being set.
 665
 666 **/
 667 VOID
 668 EFIAPI
 669 EdkiiSystemCapsuleLibPcdCallBack (
 670   IN        CONST GUID        *CallBackGuid, OPTIONAL
 671   IN        UINTN             CallBackToken,
 672   IN  OUT   VOID              *TokenData,
 673   IN        UINTN             TokenDataSize
 674   )
 675 {
 676   if (CompareGuid (CallBackGuid, &gEfiSignedCapsulePkgTokenSpaceGuid) &&
 677       CallBackToken == PcdToken (PcdEdkiiSystemFirmwareImageDescriptor)) {
 678     mImageFmpInfoSize = TokenDataSize;
 679     mImageFmpInfo = AllocateCopyPool (mImageFmpInfoSize, TokenData);
 680     ASSERT(mImageFmpInfo != NULL);
 681     //
 682     // Cancel Callback after get the real set value
 683     //
 684     LibPcdCancelCallback (
 685       &gEfiSignedCapsulePkgTokenSpaceGuid,
 686       PcdToken (PcdEdkiiSystemFirmwareImageDescriptor),
 687       EdkiiSystemCapsuleLibPcdCallBack
 688       );
 689   }
 690
 691   if (CompareGuid (CallBackGuid, &gEfiSignedCapsulePkgTokenSpaceGuid) &&
 692       CallBackToken == PcdToken (PcdEdkiiSystemFirmwareFileGuid)) {
 693     CopyGuid(&mEdkiiSystemFirmwareFileGuid, TokenData);
 694     //
 695     // Cancel Callback after get the real set value
 696     //
 697     LibPcdCancelCallback (
 698       &gEfiSignedCapsulePkgTokenSpaceGuid,
 699       PcdToken (PcdEdkiiSystemFirmwareFileGuid),
 700       EdkiiSystemCapsuleLibPcdCallBack
 701       );
 702   }
 703 }
 704
 705 /**
 706   The constructor function.
 707
 708   @retval EFI_SUCCESS   The constructor successfully .
 709 **/
 710 EFI_STATUS
 711 EFIAPI
 712 EdkiiSystemCapsuleLibConstructor (
 713   VOID
 714   )
 715 {
 716   mImageFmpInfoSize = PcdGetSize(PcdEdkiiSystemFirmwareImageDescriptor);
 717   mImageFmpInfo     = PcdGetPtr(PcdEdkiiSystemFirmwareImageDescriptor);
 718   //
 719   // Verify Firmware Image Descriptor first
 720   //
 721   if (mImageFmpInfoSize < sizeof (EDKII_SYSTEM_FIRMWARE_IMAGE_DESCRIPTOR) ||
 722       mImageFmpInfo->Signature != EDKII_SYSTEM_FIRMWARE_IMAGE_DESCRIPTOR_SIGNATURE) {
 723     //
 724     // SystemFirmwareImageDescriptor is not set.
 725     // Register PCD set callback to hook PCD value set.
 726     //
 727     mImageFmpInfo     = NULL;
 728     mImageFmpInfoSize = 0;
 729     LibPcdCallbackOnSet (
 730       &gEfiSignedCapsulePkgTokenSpaceGuid,
 731       PcdToken (PcdEdkiiSystemFirmwareImageDescriptor),
 732       EdkiiSystemCapsuleLibPcdCallBack
 733       );
 734   } else {
 735     mImageFmpInfo = AllocateCopyPool (mImageFmpInfoSize, mImageFmpInfo);
 736     ASSERT(mImageFmpInfo != NULL);
 737   }
 738
 739   CopyGuid(&mEdkiiSystemFirmwareFileGuid, PcdGetPtr(PcdEdkiiSystemFirmwareFileGuid));
 740   //
 741   // Verify GUID value first
 742   //
 743   if (CompareGuid (&mEdkiiSystemFirmwareFileGuid, &gZeroGuid)) {
 744     LibPcdCallbackOnSet (
 745       &gEfiSignedCapsulePkgTokenSpaceGuid,
 746       PcdToken (PcdEdkiiSystemFirmwareFileGuid),
 747       EdkiiSystemCapsuleLibPcdCallBack
 748       );
 749   }
 750   return EFI_SUCCESS;
 751 }