ArmPkg: only attempt buildin MmCommunicationDxe for AArch64
[mirror_edk2.git] / SignedCapsulePkg / Universal / RecoveryModuleLoadPei / RecoveryModuleLoadPei.c
1 /** @file
2 Recovery module.
3
4 Caution: This module requires additional review when modified.
5 This module will have external input - capsule image.
6 This external input must be validated carefully to avoid security issue like
7 buffer overflow, integer overflow.
8
9 ProcessRecoveryCapsule(), ProcessFmpCapsuleImage(), ProcessRecoveryImage(),
10 ValidateFmpCapsule() will receive untrusted input and do basic validation.
11
12 Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.<BR>
13 SPDX-License-Identifier: BSD-2-Clause-Patent
14
15 **/
16
17 //
18 // The package level header files this module uses
19 //
20 #include <Uefi.h>
21 #include <PiPei.h>
22 //
23 // The protocols, PPI and GUID definitions for this module
24 //
25 #include <Ppi/MasterBootMode.h>
26 #include <Ppi/BootInRecoveryMode.h>
27 #include <Ppi/RecoveryModule.h>
28 #include <Ppi/DeviceRecoveryModule.h>
29 #include <Ppi/FirmwareVolumeInfo.h>
30 #include <Guid/FirmwareFileSystem2.h>
31 #include <Guid/FmpCapsule.h>
32 #include <Guid/EdkiiSystemFmpCapsule.h>
33
34 //
35 // The Library classes this module consumes
36 //
37 #include <Library/DebugLib.h>
38 #include <Library/PeimEntryPoint.h>
39 #include <Library/PeiServicesLib.h>
40 #include <Library/HobLib.h>
41 #include <Library/BaseMemoryLib.h>
42 #include <Library/MemoryAllocationLib.h>
43 #include <Library/PcdLib.h>
44
45 #include "RecoveryModuleLoadPei.h"
46
47 /**
48 Loads a DXE capsule from some media into memory and updates the HOB table
49 with the DXE firmware volume information.
50
51 @param[in] PeiServices General-purpose services that are available to every PEIM.
52 @param[in] This Indicates the EFI_PEI_RECOVERY_MODULE_PPI instance.
53
54 @retval EFI_SUCCESS The capsule was loaded correctly.
55 @retval EFI_DEVICE_ERROR A device error occurred.
56 @retval EFI_NOT_FOUND A recovery DXE capsule cannot be found.
57
58 **/
59 EFI_STATUS
60 EFIAPI
61 LoadRecoveryCapsule (
62 IN EFI_PEI_SERVICES **PeiServices,
63 IN EFI_PEI_RECOVERY_MODULE_PPI *This
64 );
65
66 EFI_PEI_RECOVERY_MODULE_PPI mRecoveryPpi = {
67 LoadRecoveryCapsule
68 };
69
70 EFI_PEI_PPI_DESCRIPTOR mRecoveryPpiList = {
71 (EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),
72 &gEfiPeiRecoveryModulePpiGuid,
73 &mRecoveryPpi
74 };
75
76 /**
77 Parse Config data file to get the updated data array.
78
79 @param[in] DataBuffer Config raw file buffer.
80 @param[in] BufferSize Size of raw buffer.
81 @param[in, out] ConfigHeader Pointer to the config header.
82 @param[in, out] RecoveryArray Pointer to the config of recovery data.
83
84 @retval EFI_NOT_FOUND No config data is found.
85 @retval EFI_OUT_OF_RESOURCES No enough memory is allocated.
86 @retval EFI_SUCCESS Parse the config file successfully.
87
88 **/
89 EFI_STATUS
90 ParseRecoveryDataFile (
91 IN UINT8 *DataBuffer,
92 IN UINTN BufferSize,
93 IN OUT CONFIG_HEADER *ConfigHeader,
94 IN OUT RECOVERY_CONFIG_DATA **RecoveryArray
95 );
96
97 /**
98 Return if this FMP is a system FMP or a device FMP, based upon FmpImageInfo.
99
100 @param[in] FmpImageHeader A pointer to EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER
101
102 @return TRUE It is a system FMP.
103 @return FALSE It is a device FMP.
104 **/
105 BOOLEAN
106 IsSystemFmpImage (
107 IN EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *FmpImageHeader
108 )
109 {
110 GUID *Guid;
111 UINTN Count;
112 UINTN Index;
113
114 Guid = PcdGetPtr(PcdSystemFmpCapsuleImageTypeIdGuid);
115 Count = PcdGetSize(PcdSystemFmpCapsuleImageTypeIdGuid) / sizeof(GUID);
116
117 for (Index = 0; Index < Count; Index++, Guid++) {
118 if (CompareGuid(&FmpImageHeader->UpdateImageTypeId, Guid)) {
119 return TRUE;
120 }
121 }
122
123 return FALSE;
124 }
125
126 /**
127 Return if this CapsuleGuid is a FMP capsule GUID or not.
128
129 @param[in] CapsuleGuid A pointer to EFI_GUID
130
131 @return TRUE It is a FMP capsule GUID.
132 @return FALSE It is not a FMP capsule GUID.
133 **/
134 BOOLEAN
135 IsFmpCapsuleGuid (
136 IN EFI_GUID *CapsuleGuid
137 )
138 {
139 if (CompareGuid(&gEfiFmpCapsuleGuid, CapsuleGuid)) {
140 return TRUE;
141 }
142
143 return FALSE;
144 }
145
146 /**
147 This function assumes the input Capsule image already passes basic check in
148 ValidateFmpCapsule().
149
150 Criteria of system FMP capsule is:
151 1) FmpCapsuleHeader->EmbeddedDriverCount is 0.
152 2) FmpCapsuleHeader->PayloadItemCount is not 0.
153 3) All ImageHeader->UpdateImageTypeId matches PcdSystemFmpCapsuleImageTypeIdGuid.
154
155 @param[in] CapsuleHeader Points to a capsule header.
156
157 @retval TRUE Input capsule is a correct system FMP capsule.
158 @retval FALSE Input capsule is not a correct system FMP capsule.
159 **/
160 BOOLEAN
161 IsSystemFmpCapsuleImage (
162 IN EFI_CAPSULE_HEADER *CapsuleHeader
163 )
164 {
165 EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *FmpCapsuleHeader;
166 EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *ImageHeader;
167 UINT64 *ItemOffsetList;
168 UINT32 ItemNum;
169 UINTN Index;
170
171 FmpCapsuleHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *) ((UINT8 *) CapsuleHeader + CapsuleHeader->HeaderSize);
172
173 if (FmpCapsuleHeader->EmbeddedDriverCount != 0) {
174 return FALSE;
175 }
176
177 if (FmpCapsuleHeader->PayloadItemCount == 0) {
178 return FALSE;
179 }
180
181 ItemNum = FmpCapsuleHeader->EmbeddedDriverCount + FmpCapsuleHeader->PayloadItemCount;
182
183 ItemOffsetList = (UINT64 *)(FmpCapsuleHeader + 1);
184
185 for (Index = 0; Index < ItemNum; Index++) {
186 ImageHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *)((UINT8 *)FmpCapsuleHeader + ItemOffsetList[Index]);
187 if (!IsSystemFmpImage(ImageHeader)) {
188 return FALSE;
189 }
190 }
191
192 return TRUE;
193 }
194
195 /**
196 Validate if it is valid capsule header
197
198 This function assumes the caller provided correct CapsuleHeader pointer
199 and CapsuleSize.
200
201 This function validates the fields in EFI_CAPSULE_HEADER.
202
203 @param[in] CapsuleHeader Points to a capsule header.
204 @param[in] CapsuleSize Size of the whole capsule image.
205
206 **/
207 BOOLEAN
208 IsValidCapsuleHeader (
209 IN EFI_CAPSULE_HEADER *CapsuleHeader,
210 IN UINT64 CapsuleSize
211 )
212 {
213 if (CapsuleHeader->CapsuleImageSize != CapsuleSize) {
214 return FALSE;
215 }
216 if (CapsuleHeader->HeaderSize >= CapsuleHeader->CapsuleImageSize) {
217 return FALSE;
218 }
219 return TRUE;
220 }
221
222 /**
223 Validate Fmp capsules layout.
224
225 Caution: This function may receive untrusted input.
226
227 This function assumes the caller validated the capsule by using
228 IsValidCapsuleHeader(), so that all fields in EFI_CAPSULE_HEADER are correct.
229 The capsule buffer size is CapsuleHeader->CapsuleImageSize.
230
231 This function validates the fields in EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER
232 and EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER.
233
234 @param[in] CapsuleHeader Points to a capsule header.
235 @param[out] IsSystemFmp If it is a system FMP.
236 @param[out] EmbeddedDriverCount The EmbeddedDriverCount in the FMP capsule.
237
238 @retval EFI_SUCCESS Input capsule is a correct FMP capsule.
239 @retval EFI_INVALID_PARAMETER Input capsule is not a correct FMP capsule.
240 **/
241 EFI_STATUS
242 ValidateFmpCapsule (
243 IN EFI_CAPSULE_HEADER *CapsuleHeader,
244 OUT BOOLEAN *IsSystemFmp, OPTIONAL
245 OUT UINT16 *EmbeddedDriverCount OPTIONAL
246 )
247 {
248 EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *FmpCapsuleHeader;
249 UINT8 *EndOfCapsule;
250 EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *ImageHeader;
251 UINT8 *EndOfPayload;
252 UINT64 *ItemOffsetList;
253 UINT32 ItemNum;
254 UINTN Index;
255 UINTN FmpCapsuleSize;
256 UINTN FmpCapsuleHeaderSize;
257 UINT64 FmpImageSize;
258 UINTN FmpImageHeaderSize;
259
260 if (CapsuleHeader->HeaderSize >= CapsuleHeader->CapsuleImageSize) {
261 DEBUG((DEBUG_ERROR, "HeaderSize(0x%x) >= CapsuleImageSize(0x%x)\n", CapsuleHeader->HeaderSize, CapsuleHeader->CapsuleImageSize));
262 return EFI_INVALID_PARAMETER;
263 }
264
265 FmpCapsuleHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *) ((UINT8 *) CapsuleHeader + CapsuleHeader->HeaderSize);
266 EndOfCapsule = (UINT8 *) CapsuleHeader + CapsuleHeader->CapsuleImageSize;
267 FmpCapsuleSize = (UINTN)EndOfCapsule - (UINTN)FmpCapsuleHeader;
268
269 if (FmpCapsuleSize < sizeof(EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER)) {
270 DEBUG((DEBUG_ERROR, "FmpCapsuleSize(0x%x) < EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER\n", FmpCapsuleSize));
271 return EFI_INVALID_PARAMETER;
272 }
273
274 // Check EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER
275 if (FmpCapsuleHeader->Version != EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER_INIT_VERSION) {
276 DEBUG((DEBUG_ERROR, "FmpCapsuleHeader->Version(0x%x) != EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER_INIT_VERSION\n", FmpCapsuleHeader->Version));
277 return EFI_INVALID_PARAMETER;
278 }
279 ItemOffsetList = (UINT64 *)(FmpCapsuleHeader + 1);
280
281 // No overflow
282 ItemNum = FmpCapsuleHeader->EmbeddedDriverCount + FmpCapsuleHeader->PayloadItemCount;
283
284 if ((FmpCapsuleSize - sizeof(EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER))/sizeof(UINT64) < ItemNum) {
285 DEBUG((DEBUG_ERROR, "ItemNum(0x%x) too big\n", ItemNum));
286 return EFI_INVALID_PARAMETER;
287 }
288 FmpCapsuleHeaderSize = sizeof(EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER) + sizeof(UINT64)*ItemNum;
289
290 // Check ItemOffsetList
291 for (Index = 0; Index < ItemNum; Index++) {
292 if (ItemOffsetList[Index] >= FmpCapsuleSize) {
293 DEBUG((DEBUG_ERROR, "ItemOffsetList[%d](0x%lx) >= FmpCapsuleSize(0x%x)\n", Index, ItemOffsetList[Index], FmpCapsuleSize));
294 return EFI_INVALID_PARAMETER;
295 }
296 if (ItemOffsetList[Index] < FmpCapsuleHeaderSize) {
297 DEBUG((DEBUG_ERROR, "ItemOffsetList[%d](0x%lx) < FmpCapsuleHeaderSize(0x%x)\n", Index, ItemOffsetList[Index], FmpCapsuleHeaderSize));
298 return EFI_INVALID_PARAMETER;
299 }
300 //
301 // All the address in ItemOffsetList must be stored in ascending order
302 //
303 if (Index > 0) {
304 if (ItemOffsetList[Index] <= ItemOffsetList[Index - 1]) {
305 DEBUG((DEBUG_ERROR, "ItemOffsetList[%d](0x%lx) < ItemOffsetList[%d](0x%x)\n", Index, ItemOffsetList[Index], Index, ItemOffsetList[Index - 1]));
306 return EFI_INVALID_PARAMETER;
307 }
308 }
309 }
310
311 // Check EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER
312 for (Index = FmpCapsuleHeader->EmbeddedDriverCount; Index < ItemNum; Index++) {
313 ImageHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *)((UINT8 *)FmpCapsuleHeader + ItemOffsetList[Index]);
314 if (Index == ItemNum - 1) {
315 EndOfPayload = (UINT8 *)((UINTN)EndOfCapsule - (UINTN)FmpCapsuleHeader);
316 } else {
317 EndOfPayload = (UINT8 *)(UINTN)ItemOffsetList[Index+1];
318 }
319 FmpImageSize = (UINTN)EndOfPayload - ItemOffsetList[Index];
320
321 if (FmpImageSize < OFFSET_OF(EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, UpdateHardwareInstance)) {
322 DEBUG((DEBUG_ERROR, "FmpImageSize(0x%lx) < EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER\n", FmpImageSize));
323 return EFI_INVALID_PARAMETER;
324 }
325 FmpImageHeaderSize = sizeof(EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER);
326 if ((ImageHeader->Version > EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER_INIT_VERSION) ||
327 (ImageHeader->Version < 1)) {
328 DEBUG((DEBUG_ERROR, "ImageHeader->Version(0x%x) Unknown\n", ImageHeader->Version));
329 return EFI_INVALID_PARAMETER;
330 }
331 ///
332 /// Current Init ImageHeader version is 3. UpdateHardwareInstance field was added in version 2
333 /// and ImageCapsuleSupport field was added in version 3
334 ///
335 if (ImageHeader->Version == 1) {
336 FmpImageHeaderSize = OFFSET_OF(EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, UpdateHardwareInstance);
337 } else if (ImageHeader->Version == 2){
338 FmpImageHeaderSize = OFFSET_OF(EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, ImageCapsuleSupport);
339 }
340
341 // No overflow
342 if (FmpImageSize != (UINT64)FmpImageHeaderSize + (UINT64)ImageHeader->UpdateImageSize + (UINT64)ImageHeader->UpdateVendorCodeSize) {
343 DEBUG((DEBUG_ERROR, "FmpImageSize(0x%lx) mismatch, UpdateImageSize(0x%x) UpdateVendorCodeSize(0x%x)\n", FmpImageSize, ImageHeader->UpdateImageSize, ImageHeader->UpdateVendorCodeSize));
344 return EFI_INVALID_PARAMETER;
345 }
346 }
347
348 if (ItemNum == 0) {
349 //
350 // No driver & payload element in FMP
351 //
352 EndOfPayload = (UINT8 *)(FmpCapsuleHeader + 1);
353 if (EndOfPayload != EndOfCapsule) {
354 DEBUG((DEBUG_ERROR, "EndOfPayload(0x%x) mismatch, EndOfCapsule(0x%x)\n", EndOfPayload, EndOfCapsule));
355 return EFI_INVALID_PARAMETER;
356 }
357 return EFI_UNSUPPORTED;
358 }
359
360 //
361 // Check in system FMP capsule
362 //
363 if (IsSystemFmp != NULL) {
364 *IsSystemFmp = IsSystemFmpCapsuleImage(CapsuleHeader);
365 }
366
367 if (EmbeddedDriverCount != NULL) {
368 *EmbeddedDriverCount = FmpCapsuleHeader->EmbeddedDriverCount;
369 }
370
371 return EFI_SUCCESS;
372 }
373
374 /**
375 Recovery module entrypoint
376
377 @param[in] FileHandle Handle of the file being invoked.
378 @param[in] PeiServices Describes the list of possible PEI Services.
379
380 @return EFI_SUCCESS Recovery module is initialized.
381 **/
382 EFI_STATUS
383 EFIAPI
384 InitializeRecoveryModule (
385 IN EFI_PEI_FILE_HANDLE FileHandle,
386 IN CONST EFI_PEI_SERVICES **PeiServices
387 )
388 {
389 EFI_STATUS Status;
390 UINTN BootMode;
391
392 BootMode = GetBootModeHob();
393 ASSERT(BootMode == BOOT_IN_RECOVERY_MODE);
394
395 Status = (**PeiServices).InstallPpi (PeiServices, &mRecoveryPpiList);
396 ASSERT_EFI_ERROR (Status);
397
398 return Status;
399 }
400
401 /**
402 Create hob and install FvInfo PPI for recovery capsule.
403
404 @param[in] FvImage Points to the DXE FV image.
405 @param[in] FvImageSize The length of the DXE FV image in bytes.
406
407 @retval EFI_SUCCESS Create hob and install FvInfo PPI successfully.
408 @retval EFI_VOLUME_CORRUPTED The input data is not an FV.
409 @retval EFI_OUT_OF_RESOURCES No enough resource to process the input data.
410 **/
411 EFI_STATUS
412 EFIAPI
413 CreateHobForRecoveryCapsule (
414 IN VOID *FvImage,
415 IN UINTN FvImageSize
416 )
417 {
418 EFI_FIRMWARE_VOLUME_HEADER *FvHeader;
419 UINT32 FvAlignment;
420 UINT64 FvLength;
421 VOID *NewFvBuffer;
422
423 //
424 // FvImage should be at its required alignment.
425 //
426 FvHeader = (EFI_FIRMWARE_VOLUME_HEADER *) FvImage;
427 //
428 // Validate FV Header, if not as expected, return
429 //
430 if (ReadUnaligned32 (&FvHeader->Signature) != EFI_FVH_SIGNATURE) {
431 DEBUG((DEBUG_ERROR, "CreateHobForRecoveryCapsule (Fv Signature Error)\n"));
432 return EFI_VOLUME_CORRUPTED;
433 }
434 //
435 // If EFI_FVB2_WEAK_ALIGNMENT is set in the volume header then the first byte of the volume
436 // can be aligned on any power-of-two boundary. A weakly aligned volume can not be moved from
437 // its initial linked location and maintain its alignment.
438 //
439 if ((ReadUnaligned32 (&FvHeader->Attributes) & EFI_FVB2_WEAK_ALIGNMENT) != EFI_FVB2_WEAK_ALIGNMENT) {
440 //
441 // Get FvHeader alignment
442 //
443 FvAlignment = 1 << ((ReadUnaligned32 (&FvHeader->Attributes) & EFI_FVB2_ALIGNMENT) >> 16);
444 //
445 // FvAlignment must be greater than or equal to 8 bytes of the minimum FFS alignment value.
446 //
447 if (FvAlignment < 8) {
448 FvAlignment = 8;
449 }
450 //
451 // Allocate the aligned buffer for the FvImage.
452 //
453 if ((UINTN) FvHeader % FvAlignment != 0) {
454 DEBUG((DEBUG_INFO, "CreateHobForRecoveryCapsule (FvHeader 0x%lx is not aligned)\n", (UINT64)(UINTN)FvHeader));
455 FvLength = ReadUnaligned64 (&FvHeader->FvLength);
456 NewFvBuffer = AllocateAlignedPages (EFI_SIZE_TO_PAGES ((UINTN) FvLength), FvAlignment);
457 if (NewFvBuffer == NULL) {
458 DEBUG((DEBUG_ERROR, "CreateHobForRecoveryCapsule (Not enough resource to allocate 0x%lx bytes)\n", FvLength));
459 return EFI_OUT_OF_RESOURCES;
460 }
461 CopyMem (NewFvBuffer, FvHeader, (UINTN) FvLength);
462 FvHeader = (EFI_FIRMWARE_VOLUME_HEADER*) NewFvBuffer;
463 }
464 }
465
466 BuildFvHob((UINT64)(UINTN)FvHeader, FvHeader->FvLength);
467 DEBUG((DEBUG_INFO, "BuildFvHob (FV in recovery) - 0x%lx - 0x%lx\n", (UINT64)(UINTN)FvHeader, FvHeader->FvLength));
468
469 PeiServicesInstallFvInfoPpi(
470 &FvHeader->FileSystemGuid,
471 (VOID *)FvHeader,
472 (UINT32)FvHeader->FvLength,
473 NULL,
474 NULL
475 );
476
477 return EFI_SUCCESS;
478 }
479
480 /**
481 Create recovery context based upon System Firmware image and config file.
482
483 @param[in] SystemFirmwareImage Points to the System Firmware image.
484 @param[in] SystemFirmwareImageSize The length of the System Firmware image in bytes.
485 @param[in] ConfigImage Points to the config file image.
486 @param[in] ConfigImageSize The length of the config file image in bytes.
487
488 @retval EFI_SUCCESS Process Recovery Image successfully.
489 **/
490 EFI_STATUS
491 RecoverImage (
492 IN VOID *SystemFirmwareImage,
493 IN UINTN SystemFirmwareImageSize,
494 IN VOID *ConfigImage,
495 IN UINTN ConfigImageSize
496 )
497 {
498 EFI_STATUS Status;
499 RECOVERY_CONFIG_DATA *ConfigData;
500 RECOVERY_CONFIG_DATA *RecoveryConfigData;
501 CONFIG_HEADER ConfigHeader;
502 UINTN Index;
503
504 if (ConfigImage == NULL) {
505 DEBUG((DEBUG_INFO, "RecoverImage (NoConfig)\n"));
506 Status = CreateHobForRecoveryCapsule(
507 SystemFirmwareImage,
508 SystemFirmwareImageSize
509 );
510 return Status;
511 }
512
513 ConfigData = NULL;
514 ZeroMem (&ConfigHeader, sizeof(ConfigHeader));
515 Status = ParseRecoveryDataFile (
516 ConfigImage,
517 ConfigImageSize,
518 &ConfigHeader,
519 &ConfigData
520 );
521 DEBUG((DEBUG_INFO, "ParseRecoveryDataFile - %r\n", Status));
522 if (EFI_ERROR(Status)) {
523 return Status;
524 }
525 DEBUG((DEBUG_INFO, "ConfigHeader.NumOfRecovery - 0x%x\n", ConfigHeader.NumOfRecovery));
526 DEBUG((DEBUG_INFO, "PcdEdkiiSystemFirmwareFileGuid - %g\n", PcdGetPtr(PcdEdkiiSystemFirmwareFileGuid)));
527
528 Index = 0;
529 RecoveryConfigData = ConfigData;
530 while (Index < ConfigHeader.NumOfRecovery) {
531 if (CompareGuid(&RecoveryConfigData->FileGuid, PcdGetPtr(PcdEdkiiSystemFirmwareFileGuid))) {
532 DEBUG((DEBUG_INFO, "FileGuid - %g (processing)\n", &RecoveryConfigData->FileGuid));
533 Status = CreateHobForRecoveryCapsule (
534 (UINT8 *)SystemFirmwareImage + RecoveryConfigData->ImageOffset,
535 RecoveryConfigData->Length
536 );
537 //
538 // Shall updates be serialized so that if a recovery FV is not successfully completed,
539 // the remaining updates won't be performed.
540 //
541 if (EFI_ERROR (Status)) {
542 break;
543 }
544 } else {
545 DEBUG((DEBUG_INFO, "FileGuid - %g (ignored)\n", &RecoveryConfigData->FileGuid));
546 }
547
548 Index++;
549 RecoveryConfigData++;
550 }
551
552 return Status;
553 }
554
555 /**
556 Process recovery image.
557
558 Caution: This function may receive untrusted input.
559
560 @param[in] Image Points to the recovery image.
561 @param[in] Length The length of the recovery image in bytes.
562
563 @retval EFI_SUCCESS Process Recovery Image successfully.
564 @retval EFI_SECURITY_VIOLATION Recovery image is not processed due to security violation.
565 **/
566 EFI_STATUS
567 ProcessRecoveryImage (
568 IN VOID *Image,
569 IN UINTN Length
570 )
571 {
572 UINT32 LastAttemptVersion;
573 UINT32 LastAttemptStatus;
574 EFI_STATUS Status;
575 VOID *SystemFirmwareImage;
576 UINTN SystemFirmwareImageSize;
577 VOID *ConfigImage;
578 UINTN ConfigImageSize;
579 VOID *AuthenticatedImage;
580 UINTN AuthenticatedImageSize;
581
582 AuthenticatedImage = NULL;
583 AuthenticatedImageSize = 0;
584
585 Status = CapsuleAuthenticateSystemFirmware(Image, Length, TRUE, &LastAttemptVersion, &LastAttemptStatus, &AuthenticatedImage, &AuthenticatedImageSize);
586 if (EFI_ERROR(Status)) {
587 DEBUG((DEBUG_INFO, "CapsuleAuthenticateSystemFirmware - %r\n", Status));
588 return Status;
589 }
590
591 ExtractSystemFirmwareImage(AuthenticatedImage, AuthenticatedImageSize, &SystemFirmwareImage, &SystemFirmwareImageSize);
592 ExtractConfigImage(AuthenticatedImage, AuthenticatedImageSize, &ConfigImage, &ConfigImageSize);
593
594 Status = RecoverImage(SystemFirmwareImage, SystemFirmwareImageSize, ConfigImage, ConfigImageSize);
595 if (EFI_ERROR(Status)) {
596 DEBUG((DEBUG_INFO, "RecoverImage - %r\n", Status));
597 return Status;
598 }
599
600 return EFI_SUCCESS;
601 }
602
603 /**
604 Process Firmware management protocol data capsule.
605
606 Caution: This function may receive untrusted input.
607
608 This function assumes the caller validated the capsule by using
609 ValidateFmpCapsule(), so that all fields in EFI_CAPSULE_HEADER,
610 EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER and
611 EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER are correct.
612
613 @param[in] CapsuleHeader Points to a capsule header.
614 @param[in] IsSystemFmp If this capsule is a system FMP capsule.
615
616 @retval EFI_SUCCESS Process Capsule Image successfully.
617 @retval EFI_UNSUPPORTED Capsule image is not supported by the firmware.
618 @retval EFI_VOLUME_CORRUPTED FV volume in the capsule is corrupted.
619 @retval EFI_OUT_OF_RESOURCES Not enough memory.
620 **/
621 EFI_STATUS
622 ProcessFmpCapsuleImage (
623 IN EFI_CAPSULE_HEADER *CapsuleHeader,
624 IN BOOLEAN IsSystemFmp
625 )
626 {
627 EFI_STATUS Status;
628 EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *FmpCapsuleHeader;
629 EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *ImageHeader;
630 UINT8 *Image;
631 UINT64 *ItemOffsetList;
632 UINTN ItemIndex;
633
634 if (!IsSystemFmp) {
635 return EFI_UNSUPPORTED;
636 }
637
638 FmpCapsuleHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *)((UINT8 *)CapsuleHeader + CapsuleHeader->HeaderSize);
639 ItemOffsetList = (UINT64 *)(FmpCapsuleHeader + 1);
640
641 for (ItemIndex = 0; ItemIndex < FmpCapsuleHeader->PayloadItemCount; ItemIndex++) {
642 ImageHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *)((UINT8 *)FmpCapsuleHeader + ItemOffsetList[ItemIndex]);
643 if (ImageHeader->Version >= EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER_INIT_VERSION) {
644 Image = (UINT8 *)(ImageHeader + 1);
645 } else {
646 //
647 // If the EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER is version 1, only match ImageTypeId.
648 // Header should exclude UpdateHardwareInstance field.
649 // If version is 2 Header should exclude ImageCapsuleSupport field.
650 //
651 if (ImageHeader->Version == 1) {
652 Image = (UINT8 *)ImageHeader + OFFSET_OF(EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, UpdateHardwareInstance);
653 } else {
654 Image = (UINT8 *)ImageHeader + OFFSET_OF(EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, ImageCapsuleSupport);
655 }
656 }
657
658 Status = ProcessRecoveryImage (Image, ImageHeader->UpdateImageSize);
659 if (EFI_ERROR(Status)) {
660 return Status;
661 }
662 }
663
664 return EFI_SUCCESS;
665 }
666
667 /**
668 Process recovery capsule image.
669
670 Caution: This function may receive untrusted input.
671
672 @param[in] CapsuleBuffer The capsule image buffer.
673 @param[in] CapsuleSize The size of the capsule image in bytes.
674
675 @retval EFI_SUCCESS The recovery capsule is processed.
676 @retval EFI_SECURITY_VIOLATION The recovery capsule is not process because of security violation.
677 @retval EFI_NOT_FOUND The recovery capsule is not process because of unrecognization.
678 **/
679 EFI_STATUS
680 EFIAPI
681 ProcessRecoveryCapsule (
682 IN VOID *CapsuleBuffer,
683 IN UINTN CapsuleSize
684 )
685 {
686 EFI_STATUS Status;
687 BOOLEAN IsSystemFmp;
688 EFI_CAPSULE_HEADER *CapsuleHeader;
689
690 CapsuleHeader = CapsuleBuffer;
691 if (!IsValidCapsuleHeader (CapsuleHeader, CapsuleSize)) {
692 DEBUG((DEBUG_ERROR, "CapsuleImageSize incorrect\n"));
693 return EFI_SECURITY_VIOLATION;
694 }
695
696 //
697 // Check FMP capsule layout
698 //
699 if (IsFmpCapsuleGuid(&CapsuleHeader->CapsuleGuid)) {
700 DEBUG((DEBUG_INFO, "CreateHobForRecoveryCapsule\n"));
701
702 DEBUG((DEBUG_INFO, "ProcessCapsuleImage for FmpCapsule ...\n"));
703 DEBUG((DEBUG_INFO, "ValidateFmpCapsule ...\n"));
704 Status = ValidateFmpCapsule(CapsuleHeader, &IsSystemFmp, NULL);
705 DEBUG((DEBUG_INFO, "ValidateFmpCapsule - %r\n", Status));
706 if (EFI_ERROR(Status)) {
707 return Status;
708 }
709
710 //
711 // Process EFI FMP Capsule
712 //
713 DEBUG((DEBUG_INFO, "ProcessFmpCapsuleImage ...\n"));
714 Status = ProcessFmpCapsuleImage(CapsuleHeader, IsSystemFmp);
715 DEBUG((DEBUG_INFO, "ProcessFmpCapsuleImage - %r\n", Status));
716
717 DEBUG((DEBUG_INFO, "CreateHobForRecoveryCapsule Done\n"));
718 return Status;
719 }
720
721 return EFI_UNSUPPORTED;
722 }
723
724 /**
725 Loads a DXE capsule from some media into memory and updates the HOB table
726 with the DXE firmware volume information.
727
728 @param[in] PeiServices General-purpose services that are available to every PEIM.
729 @param[in] This Indicates the EFI_PEI_RECOVERY_MODULE_PPI instance.
730
731 @retval EFI_SUCCESS The capsule was loaded correctly.
732 @retval EFI_DEVICE_ERROR A device error occurred.
733 @retval EFI_NOT_FOUND A recovery DXE capsule cannot be found.
734
735 **/
736 EFI_STATUS
737 EFIAPI
738 LoadRecoveryCapsule (
739 IN EFI_PEI_SERVICES **PeiServices,
740 IN EFI_PEI_RECOVERY_MODULE_PPI *This
741 )
742 {
743 EFI_STATUS Status;
744 EFI_PEI_DEVICE_RECOVERY_MODULE_PPI *DeviceRecoveryPpi;
745 UINTN NumberRecoveryCapsules;
746 UINTN Instance;
747 UINTN CapsuleInstance;
748 UINTN CapsuleSize;
749 EFI_GUID CapsuleType;
750 VOID *CapsuleBuffer;
751
752 DEBUG((DEBUG_INFO | DEBUG_LOAD, "Recovery Entry\n"));
753
754 for (Instance = 0; ; Instance++) {
755 Status = PeiServicesLocatePpi (
756 &gEfiPeiDeviceRecoveryModulePpiGuid,
757 Instance,
758 NULL,
759 (VOID **)&DeviceRecoveryPpi
760 );
761 DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - LocateRecoveryPpi (%d) - %r\n", Instance, Status));
762 if (EFI_ERROR (Status)) {
763 break;
764 }
765 NumberRecoveryCapsules = 0;
766 Status = DeviceRecoveryPpi->GetNumberRecoveryCapsules (
767 (EFI_PEI_SERVICES **)PeiServices,
768 DeviceRecoveryPpi,
769 &NumberRecoveryCapsules
770 );
771 DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - GetNumberRecoveryCapsules (%d) - %r\n", NumberRecoveryCapsules, Status));
772 if (EFI_ERROR (Status)) {
773 continue;
774 }
775 for (CapsuleInstance = 1; CapsuleInstance <= NumberRecoveryCapsules; CapsuleInstance++) {
776 CapsuleSize = 0;
777 Status = DeviceRecoveryPpi->GetRecoveryCapsuleInfo (
778 (EFI_PEI_SERVICES **)PeiServices,
779 DeviceRecoveryPpi,
780 CapsuleInstance,
781 &CapsuleSize,
782 &CapsuleType
783 );
784 DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - GetRecoveryCapsuleInfo (%d - %x) - %r\n", CapsuleInstance, CapsuleSize, Status));
785 if (EFI_ERROR (Status)) {
786 break;
787 }
788
789 CapsuleBuffer = AllocatePages (EFI_SIZE_TO_PAGES(CapsuleSize));
790 if (CapsuleBuffer == NULL) {
791 DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - AllocatePool fail\n"));
792 continue;
793 }
794 Status = DeviceRecoveryPpi->LoadRecoveryCapsule (
795 (EFI_PEI_SERVICES **)PeiServices,
796 DeviceRecoveryPpi,
797 CapsuleInstance,
798 CapsuleBuffer
799 );
800 DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - LoadRecoveryCapsule (%d) - %r\n", CapsuleInstance, Status));
801 if (EFI_ERROR (Status)) {
802 FreePages (CapsuleBuffer, EFI_SIZE_TO_PAGES(CapsuleSize));
803 break;
804 }
805 //
806 // good, load capsule buffer
807 //
808 Status = ProcessRecoveryCapsule (CapsuleBuffer, CapsuleSize);
809 return Status;
810 }
811 }
812
813 return EFI_NOT_FOUND;
814 }