SignedCapsulePkg/Universal/SystemFirmwareUpdate/SystemFirmwareUpdateDxe.c

   1 /** @file
   2   SetImage instance to update system firmware.
   3
   4   Caution: This module requires additional review when modified.
   5   This module will have external input - capsule image.
   6   This external input must be validated carefully to avoid security issue like
   7   buffer overflow, integer overflow.
   8
   9   FmpSetImage() will receive untrusted input and do basic validation.
  10
  11   Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
  12   This program and the accompanying materials
  13   are licensed and made available under the terms and conditions of the BSD License
  14   which accompanies this distribution.  The full text of the license may be found at
  15   http://opensource.org/licenses/bsd-license.php
  16
  17   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  18   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  19
  20 **/
  21
  22 #include "SystemFirmwareDxe.h"
  23
  24 //
  25 // SystemFmp driver private data
  26 //
  27 SYSTEM_FMP_PRIVATE_DATA *mSystemFmpPrivate = NULL;
  28
  29 EFI_GUID mCurrentImageTypeId;
  30
  31 BOOLEAN  mNvRamUpdated = FALSE;
  32
  33 /**
  34   Parse Config data file to get the updated data array.
  35
  36   @param[in]      DataBuffer      Config raw file buffer.
  37   @param[in]      BufferSize      Size of raw buffer.
  38   @param[in, out] ConfigHeader    Pointer to the config header.
  39   @param[in, out] UpdateArray     Pointer to the config of update data.
  40
  41   @retval EFI_NOT_FOUND         No config data is found.
  42   @retval EFI_OUT_OF_RESOURCES  No enough memory is allocated.
  43   @retval EFI_SUCCESS           Parse the config file successfully.
  44
  45 **/
  46 EFI_STATUS
  47 ParseUpdateDataFile (
  48   IN      UINT8                         *DataBuffer,
  49   IN      UINTN                         BufferSize,
  50   IN OUT  CONFIG_HEADER                 *ConfigHeader,
  51   IN OUT  UPDATE_CONFIG_DATA            **UpdateArray
  52   );
  53
  54 /**
  55   Update System Firmware image component.
  56
  57   @param[in]  SystemFirmwareImage     Points to the System Firmware image.
  58   @param[in]  SystemFirmwareImageSize The length of the System Firmware image in bytes.
  59   @param[in]  ConfigData              Points to the component configuration structure.
  60   @param[out] LastAttemptVersion      The last attempt version, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
  61   @param[out] LastAttemptStatus       The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
  62
  63   @retval EFI_SUCCESS             The System Firmware image is updated.
  64   @retval EFI_WRITE_PROTECTED     The flash device is read only.
  65 **/
  66 EFI_STATUS
  67 PerformUpdate (
  68   IN VOID                         *SystemFirmwareImage,
  69   IN UINTN                        SystemFirmwareImageSize,
  70   IN UPDATE_CONFIG_DATA           *ConfigData,
  71   OUT UINT32                      *LastAttemptVersion,
  72   OUT UINT32                      *LastAttemptStatus
  73   )
  74 {
  75   EFI_STATUS                   Status;
  76
  77   DEBUG((DEBUG_INFO, "PlatformUpdate:"));
  78   DEBUG((DEBUG_INFO, "  BaseAddress - 0x%lx,", ConfigData->BaseAddress));
  79   DEBUG((DEBUG_INFO, "  ImageOffset - 0x%x,", ConfigData->ImageOffset));
  80   DEBUG((DEBUG_INFO, "  Legnth - 0x%x\n", ConfigData->Length));
  81   Status = PerformFlashWrite (
  82              ConfigData->FirmwareType,
  83              ConfigData->BaseAddress,
  84              ConfigData->AddressType,
  85              (VOID *)((UINTN)SystemFirmwareImage + (UINTN)ConfigData->ImageOffset),
  86              ConfigData->Length
  87              );
  88   if (!EFI_ERROR(Status)) {
  89     *LastAttemptStatus = LAST_ATTEMPT_STATUS_SUCCESS;
  90     if (ConfigData->FirmwareType == PlatformFirmwareTypeNvRam) {
  91       mNvRamUpdated = TRUE;
  92     }
  93   } else {
  94     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_UNSUCCESSFUL;
  95   }
  96   return Status;
  97 }
  98
  99 /**
 100   Update System Firmware image.
 101
 102   @param[in]  SystemFirmwareImage     Points to the System Firmware image.
 103   @param[in]  SystemFirmwareImageSize The length of the System Firmware image in bytes.
 104   @param[in]  ConfigImage             Points to the config file image.
 105   @param[in]  ConfigImageSize         The length of the config file image in bytes.
 106   @param[out] LastAttemptVersion      The last attempt version, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 107   @param[out] LastAttemptStatus       The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 108
 109   @retval EFI_SUCCESS             The System Firmware image is updated.
 110   @retval EFI_WRITE_PROTECTED     The flash device is read only.
 111 **/
 112 EFI_STATUS
 113 UpdateImage (
 114   IN VOID                         *SystemFirmwareImage,
 115   IN UINTN                        SystemFirmwareImageSize,
 116   IN VOID                         *ConfigImage,
 117   IN UINTN                        ConfigImageSize,
 118   OUT UINT32                      *LastAttemptVersion,
 119   OUT UINT32                      *LastAttemptStatus
 120   )
 121 {
 122   EFI_STATUS                            Status;
 123   UPDATE_CONFIG_DATA                    *ConfigData;
 124   UPDATE_CONFIG_DATA                    *UpdateConfigData;
 125   CONFIG_HEADER                         ConfigHeader;
 126   UINTN                                 Index;
 127
 128   if (ConfigImage == NULL) {
 129     DEBUG((DEBUG_INFO, "PlatformUpdate (NoConfig):"));
 130     DEBUG((DEBUG_INFO, "  BaseAddress - 0x%x,", 0));
 131     DEBUG((DEBUG_INFO, "  Length - 0x%x\n", SystemFirmwareImageSize));
 132     // ASSUME the whole System Firmware include NVRAM region.
 133     Status = PerformFlashWrite (
 134                PlatformFirmwareTypeNvRam,
 135                0,
 136                FlashAddressTypeRelativeAddress,
 137                SystemFirmwareImage,
 138                SystemFirmwareImageSize
 139                );
 140     if (!EFI_ERROR(Status)) {
 141       *LastAttemptStatus = LAST_ATTEMPT_STATUS_SUCCESS;
 142       mNvRamUpdated = TRUE;
 143     } else {
 144       *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_UNSUCCESSFUL;
 145     }
 146     return Status;
 147   }
 148
 149   DEBUG((DEBUG_INFO, "PlatformUpdate (With Config):\n"));
 150   ConfigData        = NULL;
 151   ZeroMem (&ConfigHeader, sizeof(ConfigHeader));
 152   Status            = ParseUpdateDataFile (
 153                         ConfigImage,
 154                         ConfigImageSize,
 155                         &ConfigHeader,
 156                         &ConfigData
 157                         );
 158   DEBUG((DEBUG_INFO, "ParseUpdateDataFile - %r\n", Status));
 159   if (EFI_ERROR(Status)) {
 160     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_UNSUCCESSFUL;
 161     return EFI_INVALID_PARAMETER;
 162   }
 163   DEBUG((DEBUG_INFO, "ConfigHeader.NumOfUpdates - 0x%x\n", ConfigHeader.NumOfUpdates));
 164   DEBUG((DEBUG_INFO, "PcdEdkiiSystemFirmwareFileGuid - %g\n", PcdGetPtr(PcdEdkiiSystemFirmwareFileGuid)));
 165
 166   Index = 0;
 167   UpdateConfigData = ConfigData;
 168   while (Index < ConfigHeader.NumOfUpdates) {
 169     if (CompareGuid(&UpdateConfigData->FileGuid, PcdGetPtr(PcdEdkiiSystemFirmwareFileGuid))) {
 170       DEBUG((DEBUG_INFO, "FileGuid - %g (processing)\n", &UpdateConfigData->FileGuid));
 171       Status = PerformUpdate (
 172                  SystemFirmwareImage,
 173                  SystemFirmwareImageSize,
 174                  UpdateConfigData,
 175                  LastAttemptVersion,
 176                  LastAttemptStatus
 177                  );
 178       //
 179       // Shall updates be serialized so that if an update is not successfully completed,
 180       // the remaining updates won't be performed.
 181       //
 182       if (EFI_ERROR (Status)) {
 183         break;
 184       }
 185     } else {
 186       DEBUG((DEBUG_INFO, "FileGuid - %g (ignored)\n", &UpdateConfigData->FileGuid));
 187     }
 188
 189     Index++;
 190     UpdateConfigData++;
 191   }
 192
 193   return Status;
 194 }
 195
 196 /**
 197   Authenticate and update System Firmware image.
 198
 199   Caution: This function may receive untrusted input.
 200
 201   @param[in]  Image              The EDKII system FMP capsule image.
 202   @param[in]  ImageSize          The size of the EDKII system FMP capsule image in bytes.
 203   @param[out] LastAttemptVersion The last attempt version, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 204   @param[out] LastAttemptStatus  The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 205
 206   @retval EFI_SUCCESS             EDKII system FMP capsule passes authentication and the System Firmware image is updated.
 207   @retval EFI_SECURITY_VIOLATION  EDKII system FMP capsule fails authentication and the System Firmware image is not updated.
 208   @retval EFI_WRITE_PROTECTED     The flash device is read only.
 209 **/
 210 EFI_STATUS
 211 SystemFirmwareAuthenticatedUpdate (
 212   IN VOID                         *Image,
 213   IN UINTN                        ImageSize,
 214   OUT UINT32                      *LastAttemptVersion,
 215   OUT UINT32                      *LastAttemptStatus
 216   )
 217 {
 218   EFI_STATUS                  Status;
 219   VOID                        *SystemFirmwareImage;
 220   UINTN                       SystemFirmwareImageSize;
 221   VOID                        *ConfigImage;
 222   UINTN                       ConfigImageSize;
 223   VOID                        *AuthenticatedImage;
 224   UINTN                       AuthenticatedImageSize;
 225
 226   DEBUG((DEBUG_INFO, "SystemFirmwareAuthenticatedUpdate...\n"));
 227
 228   Status = CapsuleAuthenticateSystemFirmware(Image, ImageSize, FALSE, LastAttemptVersion, LastAttemptStatus, &AuthenticatedImage, &AuthenticatedImageSize);
 229   if (EFI_ERROR(Status)) {
 230     DEBUG((DEBUG_INFO, "SystemFirmwareAuthenticateImage - %r\n", Status));
 231     return Status;
 232   }
 233
 234   DEBUG((DEBUG_INFO, "ExtractSystemFirmwareImage ...\n"));
 235   ExtractSystemFirmwareImage(AuthenticatedImage, AuthenticatedImageSize, &SystemFirmwareImage, &SystemFirmwareImageSize);
 236   DEBUG((DEBUG_INFO, "ExtractConfigImage ...\n"));
 237   ExtractConfigImage(AuthenticatedImage, AuthenticatedImageSize, &ConfigImage, &ConfigImageSize);
 238
 239   DEBUG((DEBUG_INFO, "UpdateImage ...\n"));
 240   Status = UpdateImage(SystemFirmwareImage, SystemFirmwareImageSize, ConfigImage, ConfigImageSize, LastAttemptVersion, LastAttemptStatus);
 241   if (EFI_ERROR(Status)) {
 242     DEBUG((DEBUG_INFO, "UpdateImage - %r\n", Status));
 243     return Status;
 244   }
 245
 246   DEBUG((DEBUG_INFO, "SystemFirmwareAuthenticatedUpdate Done\n"));
 247
 248   return EFI_SUCCESS;
 249 }
 250
 251 /**
 252
 253   This code finds variable in storage blocks (Volatile or Non-Volatile).
 254
 255   @param[in]      VariableName               Name of Variable to be found.
 256   @param[in]      VendorGuid                 Variable vendor GUID.
 257   @param[out]     Attributes                 Attribute value of the variable found.
 258   @param[in, out] DataSize                   Size of Data found. If size is less than the
 259                                              data, this value contains the required size.
 260   @param[out]     Data                       Data pointer.
 261
 262   @return EFI_INVALID_PARAMETER     Invalid parameter.
 263   @return EFI_SUCCESS               Find the specified variable.
 264   @return EFI_NOT_FOUND             Not found.
 265   @return EFI_BUFFER_TO_SMALL       DataSize is too small for the result.
 266
 267 **/
 268 EFI_STATUS
 269 EFIAPI
 270 GetVariableHook (
 271   IN      CHAR16            *VariableName,
 272   IN      EFI_GUID          *VendorGuid,
 273   OUT     UINT32            *Attributes OPTIONAL,
 274   IN OUT  UINTN             *DataSize,
 275   OUT     VOID              *Data
 276   )
 277 {
 278   DEBUG((DEBUG_INFO, "GetVariableHook - %S, %g\n", VariableName, VendorGuid));
 279   return EFI_NOT_AVAILABLE_YET;
 280 }
 281
 282 /**
 283
 284   This code Finds the Next available variable.
 285
 286   @param[in, out] VariableNameSize           Size of the variable name.
 287   @param[in, out] VariableName               Pointer to variable name.
 288   @param[in, out] VendorGuid                 Variable Vendor Guid.
 289
 290   @return EFI_INVALID_PARAMETER     Invalid parameter.
 291   @return EFI_SUCCESS               Find the specified variable.
 292   @return EFI_NOT_FOUND             Not found.
 293   @return EFI_BUFFER_TO_SMALL       DataSize is too small for the result.
 294
 295 **/
 296 EFI_STATUS
 297 EFIAPI
 298 GetNextVariableNameHook (
 299   IN OUT  UINTN             *VariableNameSize,
 300   IN OUT  CHAR16            *VariableName,
 301   IN OUT  EFI_GUID          *VendorGuid
 302   )
 303 {
 304   DEBUG((DEBUG_INFO, "GetNextVariableNameHook - %S, %g\n", VariableName, VendorGuid));
 305   return EFI_NOT_AVAILABLE_YET;
 306 }
 307
 308 /**
 309
 310   This code sets variable in storage blocks (Volatile or Non-Volatile).
 311
 312   @param[in] VariableName                     Name of Variable to be found.
 313   @param[in] VendorGuid                       Variable vendor GUID.
 314   @param[in] Attributes                       Attribute value of the variable found
 315   @param[in] DataSize                         Size of Data found. If size is less than the
 316                                               data, this value contains the required size.
 317   @param[in] Data                             Data pointer.
 318
 319   @return EFI_INVALID_PARAMETER           Invalid parameter.
 320   @return EFI_SUCCESS                     Set successfully.
 321   @return EFI_OUT_OF_RESOURCES            Resource not enough to set variable.
 322   @return EFI_NOT_FOUND                   Not found.
 323   @return EFI_WRITE_PROTECTED             Variable is read-only.
 324
 325 **/
 326 EFI_STATUS
 327 EFIAPI
 328 SetVariableHook (
 329   IN CHAR16                  *VariableName,
 330   IN EFI_GUID                *VendorGuid,
 331   IN UINT32                  Attributes,
 332   IN UINTN                   DataSize,
 333   IN VOID                    *Data
 334   )
 335 {
 336   DEBUG((DEBUG_INFO, "SetVariableHook - %S, %g, 0x%x (0x%x)\n", VariableName, VendorGuid, Attributes, DataSize));
 337   return EFI_NOT_AVAILABLE_YET;
 338 }
 339
 340 /**
 341
 342   This code returns information about the EFI variables.
 343
 344   @param[in]  Attributes                     Attributes bitmask to specify the type of variables
 345                                              on which to return information.
 346   @param[out] MaximumVariableStorageSize     Pointer to the maximum size of the storage space available
 347                                              for the EFI variables associated with the attributes specified.
 348   @param[out] RemainingVariableStorageSize   Pointer to the remaining size of the storage space available
 349                                              for EFI variables associated with the attributes specified.
 350   @param[out] MaximumVariableSize            Pointer to the maximum size of an individual EFI variables
 351                                              associated with the attributes specified.
 352
 353   @return EFI_SUCCESS                   Query successfully.
 354
 355 **/
 356 EFI_STATUS
 357 EFIAPI
 358 QueryVariableInfoHook (
 359   IN  UINT32                 Attributes,
 360   OUT UINT64                 *MaximumVariableStorageSize,
 361   OUT UINT64                 *RemainingVariableStorageSize,
 362   OUT UINT64                 *MaximumVariableSize
 363   )
 364 {
 365   DEBUG((DEBUG_INFO, "QueryVariableInfoHook - 0x%x\n", Attributes));
 366   return EFI_NOT_AVAILABLE_YET;
 367 }
 368
 369 /**
 370   Updates the firmware image of the device.
 371
 372   This function updates the hardware with the new firmware image.
 373   This function returns EFI_UNSUPPORTED if the firmware image is not updatable.
 374   If the firmware image is updatable, the function should perform the following minimal validations
 375   before proceeding to do the firmware image update.
 376   - Validate the image authentication if image has attribute
 377     IMAGE_ATTRIBUTE_AUTHENTICATION_REQUIRED. The function returns
 378     EFI_SECURITY_VIOLATION if the validation fails.
 379   - Validate the image is a supported image for this device. The function returns EFI_ABORTED if
 380     the image is unsupported. The function can optionally provide more detailed information on
 381     why the image is not a supported image.
 382   - Validate the data from VendorCode if not null. Image validation must be performed before
 383     VendorCode data validation. VendorCode data is ignored or considered invalid if image
 384     validation failed. The function returns EFI_ABORTED if the data is invalid.
 385
 386   VendorCode enables vendor to implement vendor-specific firmware image update policy. Null if
 387   the caller did not specify the policy or use the default policy. As an example, vendor can implement
 388   a policy to allow an option to force a firmware image update when the abort reason is due to the new
 389   firmware image version is older than the current firmware image version or bad image checksum.
 390   Sensitive operations such as those wiping the entire firmware image and render the device to be
 391   non-functional should be encoded in the image itself rather than passed with the VendorCode.
 392   AbortReason enables vendor to have the option to provide a more detailed description of the abort
 393   reason to the caller.
 394
 395   @param[in]  This               A pointer to the EFI_FIRMWARE_MANAGEMENT_PROTOCOL instance.
 396   @param[in]  ImageIndex         A unique number identifying the firmware image(s) within the device.
 397                                  The number is between 1 and DescriptorCount.
 398   @param[in]  Image              Points to the new image.
 399   @param[in]  ImageSize          Size of the new image in bytes.
 400   @param[in]  VendorCode         This enables vendor to implement vendor-specific firmware image update policy.
 401                                  Null indicates the caller did not specify the policy or use the default policy.
 402   @param[in]  Progress           A function used by the driver to report the progress of the firmware update.
 403   @param[out] AbortReason        A pointer to a pointer to a null-terminated string providing more
 404                                  details for the aborted operation. The buffer is allocated by this function
 405                                  with AllocatePool(), and it is the caller's responsibility to free it with a
 406                                  call to FreePool().
 407
 408   @retval EFI_SUCCESS            The device was successfully updated with the new image.
 409   @retval EFI_ABORTED            The operation is aborted.
 410   @retval EFI_INVALID_PARAMETER  The Image was NULL.
 411   @retval EFI_UNSUPPORTED        The operation is not supported.
 412   @retval EFI_SECURITY_VIOLATIO  The operation could not be performed due to an authentication failure.
 413
 414 **/
 415 EFI_STATUS
 416 EFIAPI
 417 FmpSetImage (
 418   IN  EFI_FIRMWARE_MANAGEMENT_PROTOCOL                 *This,
 419   IN  UINT8                                            ImageIndex,
 420   IN  CONST VOID                                       *Image,
 421   IN  UINTN                                            ImageSize,
 422   IN  CONST VOID                                       *VendorCode,
 423   IN  EFI_FIRMWARE_MANAGEMENT_UPDATE_IMAGE_PROGRESS    Progress,
 424   OUT CHAR16                                           **AbortReason
 425   )
 426 {
 427   EFI_STATUS              Status;
 428   EFI_STATUS              VarStatus;
 429   SYSTEM_FMP_PRIVATE_DATA *SystemFmpPrivate;
 430
 431   if (Image == NULL || ImageSize == 0 || AbortReason == NULL) {
 432     return EFI_INVALID_PARAMETER;
 433   }
 434
 435   SystemFmpPrivate = SYSTEM_FMP_PRIVATE_DATA_FROM_FMP(This);
 436   *AbortReason     = NULL;
 437
 438   if (ImageIndex == 0 || ImageIndex > SystemFmpPrivate->DescriptorCount) {
 439     return EFI_INVALID_PARAMETER;
 440   }
 441
 442   Status = SystemFirmwareAuthenticatedUpdate((VOID *)Image, ImageSize, &SystemFmpPrivate->LastAttempt.LastAttemptVersion, &SystemFmpPrivate->LastAttempt.LastAttemptStatus);
 443   DEBUG((DEBUG_INFO, "SetImage - LastAttemp Version - 0x%x, State - 0x%x\n", SystemFmpPrivate->LastAttempt.LastAttemptVersion, SystemFmpPrivate->LastAttempt.LastAttemptStatus));
 444
 445   //
 446   // If NVRAM is updated, we should no longer touch variable services, because
 447   // the current variable driver may not manage the new NVRAM region.
 448   //
 449   if (mNvRamUpdated) {
 450     DEBUG ((DEBUG_INFO, "NvRamUpdated, Update Variable Serivces\n"));
 451     gRT->GetVariable         = GetVariableHook;
 452     gRT->GetNextVariableName = GetNextVariableNameHook;
 453     gRT->SetVariable         = SetVariableHook;
 454     gRT->QueryVariableInfo   = QueryVariableInfoHook;
 455
 456     gRT->Hdr.CRC32 = 0;
 457     gBS->CalculateCrc32 (
 458           (UINT8 *) &gRT->Hdr,
 459           gRT->Hdr.HeaderSize,
 460           &gRT->Hdr.CRC32
 461           );
 462   }
 463
 464   VarStatus = gRT->SetVariable(
 465                      SYSTEM_FMP_LAST_ATTEMPT_VARIABLE_NAME,
 466                      &gSystemFmpLastAttemptVariableGuid,
 467                      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 468                      sizeof(SystemFmpPrivate->LastAttempt),
 469                      &SystemFmpPrivate->LastAttempt
 470                      );
 471   DEBUG((DEBUG_INFO, "SetLastAttemp - %r\n", VarStatus));
 472
 473   return Status;
 474 }
 475
 476 /**
 477   System FMP module entrypoint
 478
 479   @param  ImageHandle       The firmware allocated handle for the EFI image.
 480   @param  SystemTable       A pointer to the EFI System Table.
 481
 482   @return EFI_SUCCESS System FMP module is initialized.
 483 **/
 484 EFI_STATUS
 485 EFIAPI
 486 SystemFirmwareUpdateMainDxe (
 487   IN EFI_HANDLE                         ImageHandle,
 488   IN EFI_SYSTEM_TABLE                   *SystemTable
 489   )
 490 {
 491   EFI_STATUS                                      Status;
 492
 493   //
 494   // Initialize SystemFmpPrivateData
 495   //
 496   mSystemFmpPrivate = AllocateZeroPool (sizeof(SYSTEM_FMP_PRIVATE_DATA));
 497   if (mSystemFmpPrivate == NULL) {
 498     return EFI_OUT_OF_RESOURCES;
 499   }
 500
 501   Status = InitializePrivateData(mSystemFmpPrivate);
 502   if (EFI_ERROR(Status)) {
 503     FreePool(mSystemFmpPrivate);
 504     mSystemFmpPrivate = NULL;
 505     return Status;
 506   }
 507
 508   //
 509   // Install FMP protocol.
 510   //
 511   Status = gBS->InstallMultipleProtocolInterfaces (
 512                   &mSystemFmpPrivate->Handle,
 513                   &gEfiFirmwareManagementProtocolGuid,
 514                   &mSystemFmpPrivate->Fmp,
 515                   &gSystemFmpProtocolGuid,
 516                   &mSystemFmpPrivate->Fmp,
 517                   NULL
 518                   );
 519   if (EFI_ERROR (Status)) {
 520     FreePool(mSystemFmpPrivate);
 521     mSystemFmpPrivate = NULL;
 522     return Status;
 523   }
 524
 525   return Status;
 526 }