RecoveryModuleLoadPei.c 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803
  1. /** @file
  2. Recovery module.
  3. Caution: This module requires additional review when modified.
  4. This module will have external input - capsule image.
  5. This external input must be validated carefully to avoid security issue like
  6. buffer overflow, integer overflow.
  7. ProcessRecoveryCapsule(), ProcessFmpCapsuleImage(), ProcessRecoveryImage(),
  8. ValidateFmpCapsule() will receive untrusted input and do basic validation.
  9. Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.<BR>
  10. SPDX-License-Identifier: BSD-2-Clause-Patent
  11. **/
  12. //
  13. // The package level header files this module uses
  14. //
  15. #include <Uefi.h>
  16. #include <PiPei.h>
  17. //
  18. // The protocols, PPI and GUID defintions for this module
  19. //
  20. #include <Ppi/MasterBootMode.h>
  21. #include <Ppi/BootInRecoveryMode.h>
  22. #include <Ppi/RecoveryModule.h>
  23. #include <Ppi/DeviceRecoveryModule.h>
  24. #include <Ppi/FirmwareVolumeInfo.h>
  25. #include <Guid/FirmwareFileSystem2.h>
  26. #include <Guid/FmpCapsule.h>
  27. #include <Guid/EdkiiSystemFmpCapsule.h>
  28. //
  29. // The Library classes this module consumes
  30. //
  31. #include <Library/DebugLib.h>
  32. #include <Library/PeimEntryPoint.h>
  33. #include <Library/PeiServicesLib.h>
  34. #include <Library/HobLib.h>
  35. #include <Library/BaseMemoryLib.h>
  36. #include <Library/MemoryAllocationLib.h>
  37. #include <Library/PcdLib.h>
  38. #include "RecoveryModuleLoadPei.h"
  39. /**
  40. Loads a DXE capsule from some media into memory and updates the HOB table
  41. with the DXE firmware volume information.
  42. @param[in] PeiServices General-purpose services that are available to every PEIM.
  43. @param[in] This Indicates the EFI_PEI_RECOVERY_MODULE_PPI instance.
  44. @retval EFI_SUCCESS The capsule was loaded correctly.
  45. @retval EFI_DEVICE_ERROR A device error occurred.
  46. @retval EFI_NOT_FOUND A recovery DXE capsule cannot be found.
  47. **/
  48. EFI_STATUS
  49. EFIAPI
  50. LoadRecoveryCapsule (
  51. IN EFI_PEI_SERVICES **PeiServices,
  52. IN EFI_PEI_RECOVERY_MODULE_PPI *This
  53. );
  54. EFI_PEI_RECOVERY_MODULE_PPI mRecoveryPpi = {
  55. LoadRecoveryCapsule
  56. };
  57. EFI_PEI_PPI_DESCRIPTOR mRecoveryPpiList = {
  58. (EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),
  59. &gEfiPeiRecoveryModulePpiGuid,
  60. &mRecoveryPpi
  61. };
  62. /**
  63. Parse Config data file to get the updated data array.
  64. @param[in] DataBuffer Config raw file buffer.
  65. @param[in] BufferSize Size of raw buffer.
  66. @param[in, out] ConfigHeader Pointer to the config header.
  67. @param[in, out] RecoveryArray Pointer to the config of recovery data.
  68. @retval EFI_NOT_FOUND No config data is found.
  69. @retval EFI_OUT_OF_RESOURCES No enough memory is allocated.
  70. @retval EFI_SUCCESS Parse the config file successfully.
  71. **/
  72. EFI_STATUS
  73. ParseRecoveryDataFile (
  74. IN UINT8 *DataBuffer,
  75. IN UINTN BufferSize,
  76. IN OUT CONFIG_HEADER *ConfigHeader,
  77. IN OUT RECOVERY_CONFIG_DATA **RecoveryArray
  78. );
  79. /**
  80. Return if this FMP is a system FMP or a device FMP, based upon FmpImageInfo.
  81. @param[in] FmpImageHeader A pointer to EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER
  82. @return TRUE It is a system FMP.
  83. @return FALSE It is a device FMP.
  84. **/
  85. BOOLEAN
  86. IsSystemFmpImage (
  87. IN EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *FmpImageHeader
  88. )
  89. {
  90. GUID *Guid;
  91. UINTN Count;
  92. UINTN Index;
  93. Guid = PcdGetPtr(PcdSystemFmpCapsuleImageTypeIdGuid);
  94. Count = PcdGetSize(PcdSystemFmpCapsuleImageTypeIdGuid) / sizeof(GUID);
  95. for (Index = 0; Index < Count; Index++, Guid++) {
  96. if (CompareGuid(&FmpImageHeader->UpdateImageTypeId, Guid)) {
  97. return TRUE;
  98. }
  99. }
  100. return FALSE;
  101. }
  102. /**
  103. Return if this CapsuleGuid is a FMP capsule GUID or not.
  104. @param[in] CapsuleGuid A pointer to EFI_GUID
  105. @return TRUE It is a FMP capsule GUID.
  106. @return FALSE It is not a FMP capsule GUID.
  107. **/
  108. BOOLEAN
  109. IsFmpCapsuleGuid (
  110. IN EFI_GUID *CapsuleGuid
  111. )
  112. {
  113. if (CompareGuid(&gEfiFmpCapsuleGuid, CapsuleGuid)) {
  114. return TRUE;
  115. }
  116. return FALSE;
  117. }
  118. /**
  119. This function assumes the input Capusule image already passes basic check in
  120. ValidateFmpCapsule().
  121. Criteria of system FMP capsule is:
  122. 1) FmpCapsuleHeader->EmbeddedDriverCount is 0.
  123. 2) FmpCapsuleHeader->PayloadItemCount is not 0.
  124. 3) All ImageHeader->UpdateImageTypeId matches PcdSystemFmpCapsuleImageTypeIdGuid.
  125. @param[in] CapsuleHeader Points to a capsule header.
  126. @retval TRUE Input capsule is a correct system FMP capsule.
  127. @retval FALSE Input capsule is not a correct system FMP capsule.
  128. **/
  129. BOOLEAN
  130. IsSystemFmpCapsuleImage (
  131. IN EFI_CAPSULE_HEADER *CapsuleHeader
  132. )
  133. {
  134. EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *FmpCapsuleHeader;
  135. EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *ImageHeader;
  136. UINT64 *ItemOffsetList;
  137. UINT32 ItemNum;
  138. UINTN Index;
  139. FmpCapsuleHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *) ((UINT8 *) CapsuleHeader + CapsuleHeader->HeaderSize);
  140. if (FmpCapsuleHeader->EmbeddedDriverCount != 0) {
  141. return FALSE;
  142. }
  143. if (FmpCapsuleHeader->PayloadItemCount == 0) {
  144. return FALSE;
  145. }
  146. ItemNum = FmpCapsuleHeader->EmbeddedDriverCount + FmpCapsuleHeader->PayloadItemCount;
  147. ItemOffsetList = (UINT64 *)(FmpCapsuleHeader + 1);
  148. for (Index = 0; Index < ItemNum; Index++) {
  149. ImageHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *)((UINT8 *)FmpCapsuleHeader + ItemOffsetList[Index]);
  150. if (!IsSystemFmpImage(ImageHeader)) {
  151. return FALSE;
  152. }
  153. }
  154. return TRUE;
  155. }
  156. /**
  157. Validate if it is valid capsule header
  158. This function assumes the caller provided correct CapsuleHeader pointer
  159. and CapsuleSize.
  160. This function validates the fields in EFI_CAPSULE_HEADER.
  161. @param[in] CapsuleHeader Points to a capsule header.
  162. @param[in] CapsuleSize Size of the whole capsule image.
  163. **/
  164. BOOLEAN
  165. IsValidCapsuleHeader (
  166. IN EFI_CAPSULE_HEADER *CapsuleHeader,
  167. IN UINT64 CapsuleSize
  168. )
  169. {
  170. if (CapsuleHeader->CapsuleImageSize != CapsuleSize) {
  171. return FALSE;
  172. }
  173. if (CapsuleHeader->HeaderSize >= CapsuleHeader->CapsuleImageSize) {
  174. return FALSE;
  175. }
  176. return TRUE;
  177. }
  178. /**
  179. Validate Fmp capsules layout.
  180. Caution: This function may receive untrusted input.
  181. This function assumes the caller validated the capsule by using
  182. IsValidCapsuleHeader(), so that all fields in EFI_CAPSULE_HEADER are correct.
  183. The capsule buffer size is CapsuleHeader->CapsuleImageSize.
  184. This function validates the fields in EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER
  185. and EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER.
  186. @param[in] CapsuleHeader Points to a capsule header.
  187. @param[out] IsSystemFmp If it is a system FMP.
  188. @param[out] EmbeddedDriverCount The EmbeddedDriverCount in the FMP capsule.
  189. @retval EFI_SUCESS Input capsule is a correct FMP capsule.
  190. @retval EFI_INVALID_PARAMETER Input capsule is not a correct FMP capsule.
  191. **/
  192. EFI_STATUS
  193. ValidateFmpCapsule (
  194. IN EFI_CAPSULE_HEADER *CapsuleHeader,
  195. OUT BOOLEAN *IsSystemFmp, OPTIONAL
  196. OUT UINT16 *EmbeddedDriverCount OPTIONAL
  197. )
  198. {
  199. EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *FmpCapsuleHeader;
  200. UINT8 *EndOfCapsule;
  201. EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *ImageHeader;
  202. UINT8 *EndOfPayload;
  203. UINT64 *ItemOffsetList;
  204. UINT32 ItemNum;
  205. UINTN Index;
  206. UINTN FmpCapsuleSize;
  207. UINTN FmpCapsuleHeaderSize;
  208. UINT64 FmpImageSize;
  209. UINTN FmpImageHeaderSize;
  210. if (CapsuleHeader->HeaderSize >= CapsuleHeader->CapsuleImageSize) {
  211. DEBUG((DEBUG_ERROR, "HeaderSize(0x%x) >= CapsuleImageSize(0x%x)\n", CapsuleHeader->HeaderSize, CapsuleHeader->CapsuleImageSize));
  212. return EFI_INVALID_PARAMETER;
  213. }
  214. FmpCapsuleHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *) ((UINT8 *) CapsuleHeader + CapsuleHeader->HeaderSize);
  215. EndOfCapsule = (UINT8 *) CapsuleHeader + CapsuleHeader->CapsuleImageSize;
  216. FmpCapsuleSize = (UINTN)EndOfCapsule - (UINTN)FmpCapsuleHeader;
  217. if (FmpCapsuleSize < sizeof(EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER)) {
  218. DEBUG((DEBUG_ERROR, "FmpCapsuleSize(0x%x) < EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER\n", FmpCapsuleSize));
  219. return EFI_INVALID_PARAMETER;
  220. }
  221. // Check EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER
  222. if (FmpCapsuleHeader->Version != EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER_INIT_VERSION) {
  223. DEBUG((DEBUG_ERROR, "FmpCapsuleHeader->Version(0x%x) != EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER_INIT_VERSION\n", FmpCapsuleHeader->Version));
  224. return EFI_INVALID_PARAMETER;
  225. }
  226. ItemOffsetList = (UINT64 *)(FmpCapsuleHeader + 1);
  227. // No overflow
  228. ItemNum = FmpCapsuleHeader->EmbeddedDriverCount + FmpCapsuleHeader->PayloadItemCount;
  229. if ((FmpCapsuleSize - sizeof(EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER))/sizeof(UINT64) < ItemNum) {
  230. DEBUG((DEBUG_ERROR, "ItemNum(0x%x) too big\n", ItemNum));
  231. return EFI_INVALID_PARAMETER;
  232. }
  233. FmpCapsuleHeaderSize = sizeof(EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER) + sizeof(UINT64)*ItemNum;
  234. // Check ItemOffsetList
  235. for (Index = 0; Index < ItemNum; Index++) {
  236. if (ItemOffsetList[Index] >= FmpCapsuleSize) {
  237. DEBUG((DEBUG_ERROR, "ItemOffsetList[%d](0x%lx) >= FmpCapsuleSize(0x%x)\n", Index, ItemOffsetList[Index], FmpCapsuleSize));
  238. return EFI_INVALID_PARAMETER;
  239. }
  240. if (ItemOffsetList[Index] < FmpCapsuleHeaderSize) {
  241. DEBUG((DEBUG_ERROR, "ItemOffsetList[%d](0x%lx) < FmpCapsuleHeaderSize(0x%x)\n", Index, ItemOffsetList[Index], FmpCapsuleHeaderSize));
  242. return EFI_INVALID_PARAMETER;
  243. }
  244. //
  245. // All the address in ItemOffsetList must be stored in ascending order
  246. //
  247. if (Index > 0) {
  248. if (ItemOffsetList[Index] <= ItemOffsetList[Index - 1]) {
  249. DEBUG((DEBUG_ERROR, "ItemOffsetList[%d](0x%lx) < ItemOffsetList[%d](0x%x)\n", Index, ItemOffsetList[Index], Index, ItemOffsetList[Index - 1]));
  250. return EFI_INVALID_PARAMETER;
  251. }
  252. }
  253. }
  254. // Check EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER
  255. for (Index = FmpCapsuleHeader->EmbeddedDriverCount; Index < ItemNum; Index++) {
  256. ImageHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *)((UINT8 *)FmpCapsuleHeader + ItemOffsetList[Index]);
  257. if (Index == ItemNum - 1) {
  258. EndOfPayload = (UINT8 *)((UINTN)EndOfCapsule - (UINTN)FmpCapsuleHeader);
  259. } else {
  260. EndOfPayload = (UINT8 *)(UINTN)ItemOffsetList[Index+1];
  261. }
  262. FmpImageSize = (UINTN)EndOfPayload - ItemOffsetList[Index];
  263. if (FmpImageSize < OFFSET_OF(EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, UpdateHardwareInstance)) {
  264. DEBUG((DEBUG_ERROR, "FmpImageSize(0x%lx) < EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER\n", FmpImageSize));
  265. return EFI_INVALID_PARAMETER;
  266. }
  267. FmpImageHeaderSize = sizeof(EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER);
  268. if ((ImageHeader->Version > EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER_INIT_VERSION) ||
  269. (ImageHeader->Version < 1)) {
  270. DEBUG((DEBUG_ERROR, "ImageHeader->Version(0x%x) Unknown\n", ImageHeader->Version));
  271. return EFI_INVALID_PARAMETER;
  272. }
  273. if (ImageHeader->Version < EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER_INIT_VERSION) {
  274. FmpImageHeaderSize = OFFSET_OF(EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, UpdateHardwareInstance);
  275. }
  276. // No overflow
  277. if (FmpImageSize != (UINT64)FmpImageHeaderSize + (UINT64)ImageHeader->UpdateImageSize + (UINT64)ImageHeader->UpdateVendorCodeSize) {
  278. DEBUG((DEBUG_ERROR, "FmpImageSize(0x%lx) mismatch, UpdateImageSize(0x%x) UpdateVendorCodeSize(0x%x)\n", FmpImageSize, ImageHeader->UpdateImageSize, ImageHeader->UpdateVendorCodeSize));
  279. return EFI_INVALID_PARAMETER;
  280. }
  281. }
  282. if (ItemNum == 0) {
  283. //
  284. // No driver & payload element in FMP
  285. //
  286. EndOfPayload = (UINT8 *)(FmpCapsuleHeader + 1);
  287. if (EndOfPayload != EndOfCapsule) {
  288. DEBUG((DEBUG_ERROR, "EndOfPayload(0x%x) mismatch, EndOfCapsule(0x%x)\n", EndOfPayload, EndOfCapsule));
  289. return EFI_INVALID_PARAMETER;
  290. }
  291. return EFI_UNSUPPORTED;
  292. }
  293. //
  294. // Check in system FMP capsule
  295. //
  296. if (IsSystemFmp != NULL) {
  297. *IsSystemFmp = IsSystemFmpCapsuleImage(CapsuleHeader);
  298. }
  299. if (EmbeddedDriverCount != NULL) {
  300. *EmbeddedDriverCount = FmpCapsuleHeader->EmbeddedDriverCount;
  301. }
  302. return EFI_SUCCESS;
  303. }
  304. /**
  305. Recovery module entrypoint
  306. @param[in] FileHandle Handle of the file being invoked.
  307. @param[in] PeiServices Describes the list of possible PEI Services.
  308. @return EFI_SUCCESS Recovery module is initialized.
  309. **/
  310. EFI_STATUS
  311. EFIAPI
  312. InitializeRecoveryModule (
  313. IN EFI_PEI_FILE_HANDLE FileHandle,
  314. IN CONST EFI_PEI_SERVICES **PeiServices
  315. )
  316. {
  317. EFI_STATUS Status;
  318. UINTN BootMode;
  319. BootMode = GetBootModeHob();
  320. ASSERT(BootMode == BOOT_IN_RECOVERY_MODE);
  321. Status = (**PeiServices).InstallPpi (PeiServices, &mRecoveryPpiList);
  322. ASSERT_EFI_ERROR (Status);
  323. return Status;
  324. }
  325. /**
  326. Create hob and install FvInfo PPI for recovery capsule.
  327. @param[in] FvImage Points to the DXE FV image.
  328. @param[in] FvImageSize The length of the DXE FV image in bytes.
  329. @retval EFI_SUCESS Create hob and install FvInfo PPI successfully.
  330. @retval EFI_VOLUME_CORRUPTED The input data is not an FV.
  331. @retval EFI_OUT_OF_RESOURCES No enough resource to process the input data.
  332. **/
  333. EFI_STATUS
  334. EFIAPI
  335. CreateHobForRecoveryCapsule (
  336. IN VOID *FvImage,
  337. IN UINTN FvImageSize
  338. )
  339. {
  340. EFI_FIRMWARE_VOLUME_HEADER *FvHeader;
  341. UINT32 FvAlignment;
  342. UINT64 FvLength;
  343. VOID *NewFvBuffer;
  344. //
  345. // FvImage should be at its required alignment.
  346. //
  347. FvHeader = (EFI_FIRMWARE_VOLUME_HEADER *) FvImage;
  348. //
  349. // Validate FV Header, if not as expected, return
  350. //
  351. if (ReadUnaligned32 (&FvHeader->Signature) != EFI_FVH_SIGNATURE) {
  352. DEBUG((DEBUG_ERROR, "CreateHobForRecoveryCapsule (Fv Signature Error)\n"));
  353. return EFI_VOLUME_CORRUPTED;
  354. }
  355. //
  356. // If EFI_FVB2_WEAK_ALIGNMENT is set in the volume header then the first byte of the volume
  357. // can be aligned on any power-of-two boundary. A weakly aligned volume can not be moved from
  358. // its initial linked location and maintain its alignment.
  359. //
  360. if ((ReadUnaligned32 (&FvHeader->Attributes) & EFI_FVB2_WEAK_ALIGNMENT) != EFI_FVB2_WEAK_ALIGNMENT) {
  361. //
  362. // Get FvHeader alignment
  363. //
  364. FvAlignment = 1 << ((ReadUnaligned32 (&FvHeader->Attributes) & EFI_FVB2_ALIGNMENT) >> 16);
  365. //
  366. // FvAlignment must be greater than or equal to 8 bytes of the minimum FFS alignment value.
  367. //
  368. if (FvAlignment < 8) {
  369. FvAlignment = 8;
  370. }
  371. //
  372. // Allocate the aligned buffer for the FvImage.
  373. //
  374. if ((UINTN) FvHeader % FvAlignment != 0) {
  375. DEBUG((DEBUG_INFO, "CreateHobForRecoveryCapsule (FvHeader 0x%lx is not aligned)\n", (UINT64)(UINTN)FvHeader));
  376. FvLength = ReadUnaligned64 (&FvHeader->FvLength);
  377. NewFvBuffer = AllocateAlignedPages (EFI_SIZE_TO_PAGES ((UINTN) FvLength), FvAlignment);
  378. if (NewFvBuffer == NULL) {
  379. DEBUG((DEBUG_ERROR, "CreateHobForRecoveryCapsule (Not enough resource to allocate 0x%lx bytes)\n", FvLength));
  380. return EFI_OUT_OF_RESOURCES;
  381. }
  382. CopyMem (NewFvBuffer, FvHeader, (UINTN) FvLength);
  383. FvHeader = (EFI_FIRMWARE_VOLUME_HEADER*) NewFvBuffer;
  384. }
  385. }
  386. BuildFvHob((UINT64)(UINTN)FvHeader, FvHeader->FvLength);
  387. DEBUG((DEBUG_INFO, "BuildFvHob (FV in recovery) - 0x%lx - 0x%lx\n", (UINT64)(UINTN)FvHeader, FvHeader->FvLength));
  388. PeiServicesInstallFvInfoPpi(
  389. &FvHeader->FileSystemGuid,
  390. (VOID *)FvHeader,
  391. (UINT32)FvHeader->FvLength,
  392. NULL,
  393. NULL
  394. );
  395. return EFI_SUCCESS;
  396. }
  397. /**
  398. Create recovery context based upon System Firmware image and config file.
  399. @param[in] SystemFirmwareImage Points to the System Firmware image.
  400. @param[in] SystemFirmwareImageSize The length of the System Firmware image in bytes.
  401. @param[in] ConfigImage Points to the config file image.
  402. @param[in] ConfigImageSize The length of the config file image in bytes.
  403. @retval EFI_SUCESS Process Recovery Image successfully.
  404. **/
  405. EFI_STATUS
  406. RecoverImage (
  407. IN VOID *SystemFirmwareImage,
  408. IN UINTN SystemFirmwareImageSize,
  409. IN VOID *ConfigImage,
  410. IN UINTN ConfigImageSize
  411. )
  412. {
  413. EFI_STATUS Status;
  414. RECOVERY_CONFIG_DATA *ConfigData;
  415. RECOVERY_CONFIG_DATA *RecoveryConfigData;
  416. CONFIG_HEADER ConfigHeader;
  417. UINTN Index;
  418. if (ConfigImage == NULL) {
  419. DEBUG((DEBUG_INFO, "RecoverImage (NoConfig)\n"));
  420. Status = CreateHobForRecoveryCapsule(
  421. SystemFirmwareImage,
  422. SystemFirmwareImageSize
  423. );
  424. return Status;
  425. }
  426. ConfigData = NULL;
  427. ZeroMem (&ConfigHeader, sizeof(ConfigHeader));
  428. Status = ParseRecoveryDataFile (
  429. ConfigImage,
  430. ConfigImageSize,
  431. &ConfigHeader,
  432. &ConfigData
  433. );
  434. DEBUG((DEBUG_INFO, "ParseRecoveryDataFile - %r\n", Status));
  435. if (EFI_ERROR(Status)) {
  436. return Status;
  437. }
  438. DEBUG((DEBUG_INFO, "ConfigHeader.NumOfRecovery - 0x%x\n", ConfigHeader.NumOfRecovery));
  439. DEBUG((DEBUG_INFO, "PcdEdkiiSystemFirmwareFileGuid - %g\n", PcdGetPtr(PcdEdkiiSystemFirmwareFileGuid)));
  440. Index = 0;
  441. RecoveryConfigData = ConfigData;
  442. while (Index < ConfigHeader.NumOfRecovery) {
  443. if (CompareGuid(&RecoveryConfigData->FileGuid, PcdGetPtr(PcdEdkiiSystemFirmwareFileGuid))) {
  444. DEBUG((DEBUG_INFO, "FileGuid - %g (processing)\n", &RecoveryConfigData->FileGuid));
  445. Status = CreateHobForRecoveryCapsule (
  446. (UINT8 *)SystemFirmwareImage + RecoveryConfigData->ImageOffset,
  447. RecoveryConfigData->Length
  448. );
  449. //
  450. // Shall updates be serialized so that if a recovery FV is not successfully completed,
  451. // the remaining updates won't be performed.
  452. //
  453. if (EFI_ERROR (Status)) {
  454. break;
  455. }
  456. } else {
  457. DEBUG((DEBUG_INFO, "FileGuid - %g (ignored)\n", &RecoveryConfigData->FileGuid));
  458. }
  459. Index++;
  460. RecoveryConfigData++;
  461. }
  462. return Status;
  463. }
  464. /**
  465. Process recovery image.
  466. Caution: This function may receive untrusted input.
  467. @param[in] Image Points to the recovery image.
  468. @param[in] Length The length of the recovery image in bytes.
  469. @retval EFI_SUCESS Process Recovery Image successfully.
  470. @retval EFI_SECURITY_VIOLATION Recovery image is not processed due to security violation.
  471. **/
  472. EFI_STATUS
  473. ProcessRecoveryImage (
  474. IN VOID *Image,
  475. IN UINTN Length
  476. )
  477. {
  478. UINT32 LastAttemptVersion;
  479. UINT32 LastAttemptStatus;
  480. EFI_STATUS Status;
  481. VOID *SystemFirmwareImage;
  482. UINTN SystemFirmwareImageSize;
  483. VOID *ConfigImage;
  484. UINTN ConfigImageSize;
  485. VOID *AuthenticatedImage;
  486. UINTN AuthenticatedImageSize;
  487. AuthenticatedImage = NULL;
  488. AuthenticatedImageSize = 0;
  489. Status = CapsuleAuthenticateSystemFirmware(Image, Length, TRUE, &LastAttemptVersion, &LastAttemptStatus, &AuthenticatedImage, &AuthenticatedImageSize);
  490. if (EFI_ERROR(Status)) {
  491. DEBUG((DEBUG_INFO, "CapsuleAuthenticateSystemFirmware - %r\n", Status));
  492. return Status;
  493. }
  494. ExtractSystemFirmwareImage(AuthenticatedImage, AuthenticatedImageSize, &SystemFirmwareImage, &SystemFirmwareImageSize);
  495. ExtractConfigImage(AuthenticatedImage, AuthenticatedImageSize, &ConfigImage, &ConfigImageSize);
  496. Status = RecoverImage(SystemFirmwareImage, SystemFirmwareImageSize, ConfigImage, ConfigImageSize);
  497. if (EFI_ERROR(Status)) {
  498. DEBUG((DEBUG_INFO, "RecoverImage - %r\n", Status));
  499. return Status;
  500. }
  501. return EFI_SUCCESS;
  502. }
  503. /**
  504. Process Firmware management protocol data capsule.
  505. Caution: This function may receive untrusted input.
  506. This function assumes the caller validated the capsule by using
  507. ValidateFmpCapsule(), so that all fields in EFI_CAPSULE_HEADER,
  508. EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER and
  509. EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER are correct.
  510. @param[in] CapsuleHeader Points to a capsule header.
  511. @param[in] IsSystemFmp If this capsule is a system FMP capsule.
  512. @retval EFI_SUCESS Process Capsule Image successfully.
  513. @retval EFI_UNSUPPORTED Capsule image is not supported by the firmware.
  514. @retval EFI_VOLUME_CORRUPTED FV volume in the capsule is corrupted.
  515. @retval EFI_OUT_OF_RESOURCES Not enough memory.
  516. **/
  517. EFI_STATUS
  518. ProcessFmpCapsuleImage (
  519. IN EFI_CAPSULE_HEADER *CapsuleHeader,
  520. IN BOOLEAN IsSystemFmp
  521. )
  522. {
  523. EFI_STATUS Status;
  524. EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *FmpCapsuleHeader;
  525. EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *ImageHeader;
  526. UINT8 *Image;
  527. UINT64 *ItemOffsetList;
  528. UINTN ItemIndex;
  529. if (!IsSystemFmp) {
  530. return EFI_UNSUPPORTED;
  531. }
  532. FmpCapsuleHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *)((UINT8 *)CapsuleHeader + CapsuleHeader->HeaderSize);
  533. ItemOffsetList = (UINT64 *)(FmpCapsuleHeader + 1);
  534. for (ItemIndex = 0; ItemIndex < FmpCapsuleHeader->PayloadItemCount; ItemIndex++) {
  535. ImageHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *)((UINT8 *)FmpCapsuleHeader + ItemOffsetList[ItemIndex]);
  536. if (ImageHeader->Version >= EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER_INIT_VERSION) {
  537. Image = (UINT8 *)(ImageHeader + 1);
  538. } else {
  539. //
  540. // If the EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER is version 1, only match ImageTypeId.
  541. // Header should exclude UpdateHardwareInstance field
  542. //
  543. Image = (UINT8 *)ImageHeader + OFFSET_OF(EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, UpdateHardwareInstance);
  544. }
  545. Status = ProcessRecoveryImage (Image, ImageHeader->UpdateImageSize);
  546. if (EFI_ERROR(Status)) {
  547. return Status;
  548. }
  549. }
  550. return EFI_SUCCESS;
  551. }
  552. /**
  553. Process recovery capsule image.
  554. Caution: This function may receive untrusted input.
  555. @param[in] CapsuleBuffer The capsule image buffer.
  556. @param[in] CapsuleSize The size of the capsule image in bytes.
  557. @retval EFI_SUCCESS The recovery capsule is processed.
  558. @retval EFI_SECURITY_VIOLATION The recovery capsule is not process because of security violation.
  559. @retval EFI_NOT_FOUND The recovery capsule is not process because of unrecognization.
  560. **/
  561. EFI_STATUS
  562. EFIAPI
  563. ProcessRecoveryCapsule (
  564. IN VOID *CapsuleBuffer,
  565. IN UINTN CapsuleSize
  566. )
  567. {
  568. EFI_STATUS Status;
  569. BOOLEAN IsSystemFmp;
  570. EFI_CAPSULE_HEADER *CapsuleHeader;
  571. CapsuleHeader = CapsuleBuffer;
  572. if (!IsValidCapsuleHeader (CapsuleHeader, CapsuleSize)) {
  573. DEBUG((DEBUG_ERROR, "CapsuleImageSize incorrect\n"));
  574. return EFI_SECURITY_VIOLATION;
  575. }
  576. //
  577. // Check FMP capsule layout
  578. //
  579. if (IsFmpCapsuleGuid(&CapsuleHeader->CapsuleGuid)) {
  580. DEBUG((DEBUG_INFO, "CreateHobForRecoveryCapsule\n"));
  581. DEBUG((DEBUG_INFO, "ProcessCapsuleImage for FmpCapsule ...\n"));
  582. DEBUG((DEBUG_INFO, "ValidateFmpCapsule ...\n"));
  583. Status = ValidateFmpCapsule(CapsuleHeader, &IsSystemFmp, NULL);
  584. DEBUG((DEBUG_INFO, "ValidateFmpCapsule - %r\n", Status));
  585. if (EFI_ERROR(Status)) {
  586. return Status;
  587. }
  588. //
  589. // Process EFI FMP Capsule
  590. //
  591. DEBUG((DEBUG_INFO, "ProcessFmpCapsuleImage ...\n"));
  592. Status = ProcessFmpCapsuleImage(CapsuleHeader, IsSystemFmp);
  593. DEBUG((DEBUG_INFO, "ProcessFmpCapsuleImage - %r\n", Status));
  594. DEBUG((DEBUG_INFO, "CreateHobForRecoveryCapsule Done\n"));
  595. return Status;
  596. }
  597. return EFI_UNSUPPORTED;
  598. }
  599. /**
  600. Loads a DXE capsule from some media into memory and updates the HOB table
  601. with the DXE firmware volume information.
  602. @param[in] PeiServices General-purpose services that are available to every PEIM.
  603. @param[in] This Indicates the EFI_PEI_RECOVERY_MODULE_PPI instance.
  604. @retval EFI_SUCCESS The capsule was loaded correctly.
  605. @retval EFI_DEVICE_ERROR A device error occurred.
  606. @retval EFI_NOT_FOUND A recovery DXE capsule cannot be found.
  607. **/
  608. EFI_STATUS
  609. EFIAPI
  610. LoadRecoveryCapsule (
  611. IN EFI_PEI_SERVICES **PeiServices,
  612. IN EFI_PEI_RECOVERY_MODULE_PPI *This
  613. )
  614. {
  615. EFI_STATUS Status;
  616. EFI_PEI_DEVICE_RECOVERY_MODULE_PPI *DeviceRecoveryPpi;
  617. UINTN NumberRecoveryCapsules;
  618. UINTN Instance;
  619. UINTN CapsuleInstance;
  620. UINTN CapsuleSize;
  621. EFI_GUID CapsuleType;
  622. VOID *CapsuleBuffer;
  623. DEBUG((DEBUG_INFO | DEBUG_LOAD, "Recovery Entry\n"));
  624. for (Instance = 0; ; Instance++) {
  625. Status = PeiServicesLocatePpi (
  626. &gEfiPeiDeviceRecoveryModulePpiGuid,
  627. Instance,
  628. NULL,
  629. (VOID **)&DeviceRecoveryPpi
  630. );
  631. DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - LocateRecoveryPpi (%d) - %r\n", Instance, Status));
  632. if (EFI_ERROR (Status)) {
  633. break;
  634. }
  635. NumberRecoveryCapsules = 0;
  636. Status = DeviceRecoveryPpi->GetNumberRecoveryCapsules (
  637. (EFI_PEI_SERVICES **)PeiServices,
  638. DeviceRecoveryPpi,
  639. &NumberRecoveryCapsules
  640. );
  641. DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - GetNumberRecoveryCapsules (%d) - %r\n", NumberRecoveryCapsules, Status));
  642. if (EFI_ERROR (Status)) {
  643. continue;
  644. }
  645. for (CapsuleInstance = 1; CapsuleInstance <= NumberRecoveryCapsules; CapsuleInstance++) {
  646. CapsuleSize = 0;
  647. Status = DeviceRecoveryPpi->GetRecoveryCapsuleInfo (
  648. (EFI_PEI_SERVICES **)PeiServices,
  649. DeviceRecoveryPpi,
  650. CapsuleInstance,
  651. &CapsuleSize,
  652. &CapsuleType
  653. );
  654. DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - GetRecoveryCapsuleInfo (%d - %x) - %r\n", CapsuleInstance, CapsuleSize, Status));
  655. if (EFI_ERROR (Status)) {
  656. break;
  657. }
  658. CapsuleBuffer = AllocatePages (EFI_SIZE_TO_PAGES(CapsuleSize));
  659. if (CapsuleBuffer == NULL) {
  660. DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - AllocatePool fail\n"));
  661. continue;
  662. }
  663. Status = DeviceRecoveryPpi->LoadRecoveryCapsule (
  664. (EFI_PEI_SERVICES **)PeiServices,
  665. DeviceRecoveryPpi,
  666. CapsuleInstance,
  667. CapsuleBuffer
  668. );
  669. DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - LoadRecoveryCapsule (%d) - %r\n", CapsuleInstance, Status));
  670. if (EFI_ERROR (Status)) {
  671. FreePages (CapsuleBuffer, EFI_SIZE_TO_PAGES(CapsuleSize));
  672. break;
  673. }
  674. //
  675. // good, load capsule buffer
  676. //
  677. Status = ProcessRecoveryCapsule (CapsuleBuffer, CapsuleSize);
  678. return Status;
  679. }
  680. }
  681. return EFI_NOT_FOUND;
  682. }