RecoveryModuleLoadPei.c 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833
  1. /** @file
  2. Recovery module.
  3. Caution: This module requires additional review when modified.
  4. This module will have external input - capsule image.
  5. This external input must be validated carefully to avoid security issue like
  6. buffer overflow, integer overflow.
  7. ProcessRecoveryCapsule(), ProcessFmpCapsuleImage(), ProcessRecoveryImage(),
  8. ValidateFmpCapsule() will receive untrusted input and do basic validation.
  9. Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.<BR>
  10. SPDX-License-Identifier: BSD-2-Clause-Patent
  11. **/
  12. //
  13. // The package level header files this module uses
  14. //
  15. #include <Uefi.h>
  16. #include <PiPei.h>
  17. //
  18. // The protocols, PPI and GUID definitions for this module
  19. //
  20. #include <Ppi/MasterBootMode.h>
  21. #include <Ppi/BootInRecoveryMode.h>
  22. #include <Ppi/RecoveryModule.h>
  23. #include <Ppi/DeviceRecoveryModule.h>
  24. #include <Ppi/FirmwareVolumeInfo.h>
  25. #include <Guid/FirmwareFileSystem2.h>
  26. #include <Guid/FmpCapsule.h>
  27. #include <Guid/EdkiiSystemFmpCapsule.h>
  28. //
  29. // The Library classes this module consumes
  30. //
  31. #include <Library/DebugLib.h>
  32. #include <Library/PeimEntryPoint.h>
  33. #include <Library/PeiServicesLib.h>
  34. #include <Library/HobLib.h>
  35. #include <Library/BaseMemoryLib.h>
  36. #include <Library/MemoryAllocationLib.h>
  37. #include <Library/PcdLib.h>
  38. #include "RecoveryModuleLoadPei.h"
  39. /**
  40. Loads a DXE capsule from some media into memory and updates the HOB table
  41. with the DXE firmware volume information.
  42. @param[in] PeiServices General-purpose services that are available to every PEIM.
  43. @param[in] This Indicates the EFI_PEI_RECOVERY_MODULE_PPI instance.
  44. @retval EFI_SUCCESS The capsule was loaded correctly.
  45. @retval EFI_DEVICE_ERROR A device error occurred.
  46. @retval EFI_NOT_FOUND A recovery DXE capsule cannot be found.
  47. **/
  48. EFI_STATUS
  49. EFIAPI
  50. LoadRecoveryCapsule (
  51. IN EFI_PEI_SERVICES **PeiServices,
  52. IN EFI_PEI_RECOVERY_MODULE_PPI *This
  53. );
  54. EFI_PEI_RECOVERY_MODULE_PPI mRecoveryPpi = {
  55. LoadRecoveryCapsule
  56. };
  57. EFI_PEI_PPI_DESCRIPTOR mRecoveryPpiList = {
  58. (EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),
  59. &gEfiPeiRecoveryModulePpiGuid,
  60. &mRecoveryPpi
  61. };
  62. /**
  63. Parse Config data file to get the updated data array.
  64. @param[in] DataBuffer Config raw file buffer.
  65. @param[in] BufferSize Size of raw buffer.
  66. @param[in, out] ConfigHeader Pointer to the config header.
  67. @param[in, out] RecoveryArray Pointer to the config of recovery data.
  68. @retval EFI_NOT_FOUND No config data is found.
  69. @retval EFI_OUT_OF_RESOURCES No enough memory is allocated.
  70. @retval EFI_SUCCESS Parse the config file successfully.
  71. **/
  72. EFI_STATUS
  73. ParseRecoveryDataFile (
  74. IN UINT8 *DataBuffer,
  75. IN UINTN BufferSize,
  76. IN OUT CONFIG_HEADER *ConfigHeader,
  77. IN OUT RECOVERY_CONFIG_DATA **RecoveryArray
  78. );
  79. /**
  80. Return if this FMP is a system FMP or a device FMP, based upon FmpImageInfo.
  81. @param[in] FmpImageHeader A pointer to EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER
  82. @return TRUE It is a system FMP.
  83. @return FALSE It is a device FMP.
  84. **/
  85. BOOLEAN
  86. IsSystemFmpImage (
  87. IN EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *FmpImageHeader
  88. )
  89. {
  90. GUID *Guid;
  91. UINTN Count;
  92. UINTN Index;
  93. Guid = PcdGetPtr (PcdSystemFmpCapsuleImageTypeIdGuid);
  94. Count = PcdGetSize (PcdSystemFmpCapsuleImageTypeIdGuid) / sizeof (GUID);
  95. for (Index = 0; Index < Count; Index++, Guid++) {
  96. if (CompareGuid (&FmpImageHeader->UpdateImageTypeId, Guid)) {
  97. return TRUE;
  98. }
  99. }
  100. return FALSE;
  101. }
  102. /**
  103. Return if this CapsuleGuid is a FMP capsule GUID or not.
  104. @param[in] CapsuleGuid A pointer to EFI_GUID
  105. @return TRUE It is a FMP capsule GUID.
  106. @return FALSE It is not a FMP capsule GUID.
  107. **/
  108. BOOLEAN
  109. IsFmpCapsuleGuid (
  110. IN EFI_GUID *CapsuleGuid
  111. )
  112. {
  113. if (CompareGuid (&gEfiFmpCapsuleGuid, CapsuleGuid)) {
  114. return TRUE;
  115. }
  116. return FALSE;
  117. }
  118. /**
  119. This function assumes the input Capsule image already passes basic check in
  120. ValidateFmpCapsule().
  121. Criteria of system FMP capsule is:
  122. 1) FmpCapsuleHeader->EmbeddedDriverCount is 0.
  123. 2) FmpCapsuleHeader->PayloadItemCount is not 0.
  124. 3) All ImageHeader->UpdateImageTypeId matches PcdSystemFmpCapsuleImageTypeIdGuid.
  125. @param[in] CapsuleHeader Points to a capsule header.
  126. @retval TRUE Input capsule is a correct system FMP capsule.
  127. @retval FALSE Input capsule is not a correct system FMP capsule.
  128. **/
  129. BOOLEAN
  130. IsSystemFmpCapsuleImage (
  131. IN EFI_CAPSULE_HEADER *CapsuleHeader
  132. )
  133. {
  134. EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *FmpCapsuleHeader;
  135. EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *ImageHeader;
  136. UINT64 *ItemOffsetList;
  137. UINT32 ItemNum;
  138. UINTN Index;
  139. FmpCapsuleHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *)((UINT8 *)CapsuleHeader + CapsuleHeader->HeaderSize);
  140. if (FmpCapsuleHeader->EmbeddedDriverCount != 0) {
  141. return FALSE;
  142. }
  143. if (FmpCapsuleHeader->PayloadItemCount == 0) {
  144. return FALSE;
  145. }
  146. ItemNum = FmpCapsuleHeader->EmbeddedDriverCount + FmpCapsuleHeader->PayloadItemCount;
  147. ItemOffsetList = (UINT64 *)(FmpCapsuleHeader + 1);
  148. for (Index = 0; Index < ItemNum; Index++) {
  149. ImageHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *)((UINT8 *)FmpCapsuleHeader + ItemOffsetList[Index]);
  150. if (!IsSystemFmpImage (ImageHeader)) {
  151. return FALSE;
  152. }
  153. }
  154. return TRUE;
  155. }
  156. /**
  157. Validate if it is valid capsule header
  158. This function assumes the caller provided correct CapsuleHeader pointer
  159. and CapsuleSize.
  160. This function validates the fields in EFI_CAPSULE_HEADER.
  161. @param[in] CapsuleHeader Points to a capsule header.
  162. @param[in] CapsuleSize Size of the whole capsule image.
  163. **/
  164. BOOLEAN
  165. IsValidCapsuleHeader (
  166. IN EFI_CAPSULE_HEADER *CapsuleHeader,
  167. IN UINT64 CapsuleSize
  168. )
  169. {
  170. if (CapsuleHeader->CapsuleImageSize != CapsuleSize) {
  171. return FALSE;
  172. }
  173. if (CapsuleHeader->HeaderSize >= CapsuleHeader->CapsuleImageSize) {
  174. return FALSE;
  175. }
  176. return TRUE;
  177. }
  178. /**
  179. Validate Fmp capsules layout.
  180. Caution: This function may receive untrusted input.
  181. This function assumes the caller validated the capsule by using
  182. IsValidCapsuleHeader(), so that all fields in EFI_CAPSULE_HEADER are correct.
  183. The capsule buffer size is CapsuleHeader->CapsuleImageSize.
  184. This function validates the fields in EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER
  185. and EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER.
  186. @param[in] CapsuleHeader Points to a capsule header.
  187. @param[out] IsSystemFmp If it is a system FMP.
  188. @param[out] EmbeddedDriverCount The EmbeddedDriverCount in the FMP capsule.
  189. @retval EFI_SUCCESS Input capsule is a correct FMP capsule.
  190. @retval EFI_INVALID_PARAMETER Input capsule is not a correct FMP capsule.
  191. **/
  192. EFI_STATUS
  193. ValidateFmpCapsule (
  194. IN EFI_CAPSULE_HEADER *CapsuleHeader,
  195. OUT BOOLEAN *IsSystemFmp OPTIONAL,
  196. OUT UINT16 *EmbeddedDriverCount OPTIONAL
  197. )
  198. {
  199. EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *FmpCapsuleHeader;
  200. UINT8 *EndOfCapsule;
  201. EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *ImageHeader;
  202. UINT8 *EndOfPayload;
  203. UINT64 *ItemOffsetList;
  204. UINT32 ItemNum;
  205. UINTN Index;
  206. UINTN FmpCapsuleSize;
  207. UINTN FmpCapsuleHeaderSize;
  208. UINT64 FmpImageSize;
  209. UINTN FmpImageHeaderSize;
  210. if (CapsuleHeader->HeaderSize >= CapsuleHeader->CapsuleImageSize) {
  211. DEBUG ((DEBUG_ERROR, "HeaderSize(0x%x) >= CapsuleImageSize(0x%x)\n", CapsuleHeader->HeaderSize, CapsuleHeader->CapsuleImageSize));
  212. return EFI_INVALID_PARAMETER;
  213. }
  214. FmpCapsuleHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *)((UINT8 *)CapsuleHeader + CapsuleHeader->HeaderSize);
  215. EndOfCapsule = (UINT8 *)CapsuleHeader + CapsuleHeader->CapsuleImageSize;
  216. FmpCapsuleSize = (UINTN)EndOfCapsule - (UINTN)FmpCapsuleHeader;
  217. if (FmpCapsuleSize < sizeof (EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER)) {
  218. DEBUG ((DEBUG_ERROR, "FmpCapsuleSize(0x%x) < EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER\n", FmpCapsuleSize));
  219. return EFI_INVALID_PARAMETER;
  220. }
  221. // Check EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER
  222. if (FmpCapsuleHeader->Version != EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER_INIT_VERSION) {
  223. DEBUG ((DEBUG_ERROR, "FmpCapsuleHeader->Version(0x%x) != EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER_INIT_VERSION\n", FmpCapsuleHeader->Version));
  224. return EFI_INVALID_PARAMETER;
  225. }
  226. ItemOffsetList = (UINT64 *)(FmpCapsuleHeader + 1);
  227. // No overflow
  228. ItemNum = FmpCapsuleHeader->EmbeddedDriverCount + FmpCapsuleHeader->PayloadItemCount;
  229. if ((FmpCapsuleSize - sizeof (EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER))/sizeof (UINT64) < ItemNum) {
  230. DEBUG ((DEBUG_ERROR, "ItemNum(0x%x) too big\n", ItemNum));
  231. return EFI_INVALID_PARAMETER;
  232. }
  233. FmpCapsuleHeaderSize = sizeof (EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER) + sizeof (UINT64)*ItemNum;
  234. // Check ItemOffsetList
  235. for (Index = 0; Index < ItemNum; Index++) {
  236. if (ItemOffsetList[Index] >= FmpCapsuleSize) {
  237. DEBUG ((DEBUG_ERROR, "ItemOffsetList[%d](0x%lx) >= FmpCapsuleSize(0x%x)\n", Index, ItemOffsetList[Index], FmpCapsuleSize));
  238. return EFI_INVALID_PARAMETER;
  239. }
  240. if (ItemOffsetList[Index] < FmpCapsuleHeaderSize) {
  241. DEBUG ((DEBUG_ERROR, "ItemOffsetList[%d](0x%lx) < FmpCapsuleHeaderSize(0x%x)\n", Index, ItemOffsetList[Index], FmpCapsuleHeaderSize));
  242. return EFI_INVALID_PARAMETER;
  243. }
  244. //
  245. // All the address in ItemOffsetList must be stored in ascending order
  246. //
  247. if (Index > 0) {
  248. if (ItemOffsetList[Index] <= ItemOffsetList[Index - 1]) {
  249. DEBUG ((DEBUG_ERROR, "ItemOffsetList[%d](0x%lx) < ItemOffsetList[%d](0x%x)\n", Index, ItemOffsetList[Index], Index, ItemOffsetList[Index - 1]));
  250. return EFI_INVALID_PARAMETER;
  251. }
  252. }
  253. }
  254. // Check EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER
  255. for (Index = FmpCapsuleHeader->EmbeddedDriverCount; Index < ItemNum; Index++) {
  256. ImageHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *)((UINT8 *)FmpCapsuleHeader + ItemOffsetList[Index]);
  257. if (Index == ItemNum - 1) {
  258. EndOfPayload = (UINT8 *)((UINTN)EndOfCapsule - (UINTN)FmpCapsuleHeader);
  259. } else {
  260. EndOfPayload = (UINT8 *)(UINTN)ItemOffsetList[Index+1];
  261. }
  262. FmpImageSize = (UINTN)EndOfPayload - ItemOffsetList[Index];
  263. if (FmpImageSize < OFFSET_OF (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, UpdateHardwareInstance)) {
  264. DEBUG ((DEBUG_ERROR, "FmpImageSize(0x%lx) < EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER\n", FmpImageSize));
  265. return EFI_INVALID_PARAMETER;
  266. }
  267. FmpImageHeaderSize = sizeof (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER);
  268. if ((ImageHeader->Version > EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER_INIT_VERSION) ||
  269. (ImageHeader->Version < 1))
  270. {
  271. DEBUG ((DEBUG_ERROR, "ImageHeader->Version(0x%x) Unknown\n", ImageHeader->Version));
  272. return EFI_INVALID_PARAMETER;
  273. }
  274. ///
  275. /// Current Init ImageHeader version is 3. UpdateHardwareInstance field was added in version 2
  276. /// and ImageCapsuleSupport field was added in version 3
  277. ///
  278. if (ImageHeader->Version == 1) {
  279. FmpImageHeaderSize = OFFSET_OF (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, UpdateHardwareInstance);
  280. } else if (ImageHeader->Version == 2) {
  281. FmpImageHeaderSize = OFFSET_OF (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, ImageCapsuleSupport);
  282. }
  283. // No overflow
  284. if (FmpImageSize != (UINT64)FmpImageHeaderSize + (UINT64)ImageHeader->UpdateImageSize + (UINT64)ImageHeader->UpdateVendorCodeSize) {
  285. DEBUG ((DEBUG_ERROR, "FmpImageSize(0x%lx) mismatch, UpdateImageSize(0x%x) UpdateVendorCodeSize(0x%x)\n", FmpImageSize, ImageHeader->UpdateImageSize, ImageHeader->UpdateVendorCodeSize));
  286. return EFI_INVALID_PARAMETER;
  287. }
  288. }
  289. if (ItemNum == 0) {
  290. //
  291. // No driver & payload element in FMP
  292. //
  293. EndOfPayload = (UINT8 *)(FmpCapsuleHeader + 1);
  294. if (EndOfPayload != EndOfCapsule) {
  295. DEBUG ((DEBUG_ERROR, "EndOfPayload(0x%x) mismatch, EndOfCapsule(0x%x)\n", EndOfPayload, EndOfCapsule));
  296. return EFI_INVALID_PARAMETER;
  297. }
  298. return EFI_UNSUPPORTED;
  299. }
  300. //
  301. // Check in system FMP capsule
  302. //
  303. if (IsSystemFmp != NULL) {
  304. *IsSystemFmp = IsSystemFmpCapsuleImage (CapsuleHeader);
  305. }
  306. if (EmbeddedDriverCount != NULL) {
  307. *EmbeddedDriverCount = FmpCapsuleHeader->EmbeddedDriverCount;
  308. }
  309. return EFI_SUCCESS;
  310. }
  311. /**
  312. Recovery module entrypoint
  313. @param[in] FileHandle Handle of the file being invoked.
  314. @param[in] PeiServices Describes the list of possible PEI Services.
  315. @return EFI_SUCCESS Recovery module is initialized.
  316. **/
  317. EFI_STATUS
  318. EFIAPI
  319. InitializeRecoveryModule (
  320. IN EFI_PEI_FILE_HANDLE FileHandle,
  321. IN CONST EFI_PEI_SERVICES **PeiServices
  322. )
  323. {
  324. EFI_STATUS Status;
  325. UINTN BootMode;
  326. BootMode = GetBootModeHob ();
  327. ASSERT (BootMode == BOOT_IN_RECOVERY_MODE);
  328. Status = (**PeiServices).InstallPpi (PeiServices, &mRecoveryPpiList);
  329. ASSERT_EFI_ERROR (Status);
  330. return Status;
  331. }
  332. /**
  333. Create hob and install FvInfo PPI for recovery capsule.
  334. @param[in] FvImage Points to the DXE FV image.
  335. @param[in] FvImageSize The length of the DXE FV image in bytes.
  336. @retval EFI_SUCCESS Create hob and install FvInfo PPI successfully.
  337. @retval EFI_VOLUME_CORRUPTED The input data is not an FV.
  338. @retval EFI_OUT_OF_RESOURCES No enough resource to process the input data.
  339. **/
  340. EFI_STATUS
  341. EFIAPI
  342. CreateHobForRecoveryCapsule (
  343. IN VOID *FvImage,
  344. IN UINTN FvImageSize
  345. )
  346. {
  347. EFI_FIRMWARE_VOLUME_HEADER *FvHeader;
  348. UINT32 FvAlignment;
  349. UINT64 FvLength;
  350. VOID *NewFvBuffer;
  351. //
  352. // FvImage should be at its required alignment.
  353. //
  354. FvHeader = (EFI_FIRMWARE_VOLUME_HEADER *)FvImage;
  355. //
  356. // Validate FV Header, if not as expected, return
  357. //
  358. if (ReadUnaligned32 (&FvHeader->Signature) != EFI_FVH_SIGNATURE) {
  359. DEBUG ((DEBUG_ERROR, "CreateHobForRecoveryCapsule (Fv Signature Error)\n"));
  360. return EFI_VOLUME_CORRUPTED;
  361. }
  362. //
  363. // If EFI_FVB2_WEAK_ALIGNMENT is set in the volume header then the first byte of the volume
  364. // can be aligned on any power-of-two boundary. A weakly aligned volume can not be moved from
  365. // its initial linked location and maintain its alignment.
  366. //
  367. if ((ReadUnaligned32 (&FvHeader->Attributes) & EFI_FVB2_WEAK_ALIGNMENT) != EFI_FVB2_WEAK_ALIGNMENT) {
  368. //
  369. // Get FvHeader alignment
  370. //
  371. FvAlignment = 1 << ((ReadUnaligned32 (&FvHeader->Attributes) & EFI_FVB2_ALIGNMENT) >> 16);
  372. //
  373. // FvAlignment must be greater than or equal to 8 bytes of the minimum FFS alignment value.
  374. //
  375. if (FvAlignment < 8) {
  376. FvAlignment = 8;
  377. }
  378. //
  379. // Allocate the aligned buffer for the FvImage.
  380. //
  381. if ((UINTN)FvHeader % FvAlignment != 0) {
  382. DEBUG ((DEBUG_INFO, "CreateHobForRecoveryCapsule (FvHeader 0x%lx is not aligned)\n", (UINT64)(UINTN)FvHeader));
  383. FvLength = ReadUnaligned64 (&FvHeader->FvLength);
  384. NewFvBuffer = AllocateAlignedPages (EFI_SIZE_TO_PAGES ((UINTN)FvLength), FvAlignment);
  385. if (NewFvBuffer == NULL) {
  386. DEBUG ((DEBUG_ERROR, "CreateHobForRecoveryCapsule (Not enough resource to allocate 0x%lx bytes)\n", FvLength));
  387. return EFI_OUT_OF_RESOURCES;
  388. }
  389. CopyMem (NewFvBuffer, FvHeader, (UINTN)FvLength);
  390. FvHeader = (EFI_FIRMWARE_VOLUME_HEADER *)NewFvBuffer;
  391. }
  392. }
  393. BuildFvHob ((UINT64)(UINTN)FvHeader, FvHeader->FvLength);
  394. DEBUG ((DEBUG_INFO, "BuildFvHob (FV in recovery) - 0x%lx - 0x%lx\n", (UINT64)(UINTN)FvHeader, FvHeader->FvLength));
  395. PeiServicesInstallFvInfoPpi (
  396. &FvHeader->FileSystemGuid,
  397. (VOID *)FvHeader,
  398. (UINT32)FvHeader->FvLength,
  399. NULL,
  400. NULL
  401. );
  402. return EFI_SUCCESS;
  403. }
  404. /**
  405. Create recovery context based upon System Firmware image and config file.
  406. @param[in] SystemFirmwareImage Points to the System Firmware image.
  407. @param[in] SystemFirmwareImageSize The length of the System Firmware image in bytes.
  408. @param[in] ConfigImage Points to the config file image.
  409. @param[in] ConfigImageSize The length of the config file image in bytes.
  410. @retval EFI_SUCCESS Process Recovery Image successfully.
  411. **/
  412. EFI_STATUS
  413. RecoverImage (
  414. IN VOID *SystemFirmwareImage,
  415. IN UINTN SystemFirmwareImageSize,
  416. IN VOID *ConfigImage,
  417. IN UINTN ConfigImageSize
  418. )
  419. {
  420. EFI_STATUS Status;
  421. RECOVERY_CONFIG_DATA *ConfigData;
  422. RECOVERY_CONFIG_DATA *RecoveryConfigData;
  423. CONFIG_HEADER ConfigHeader;
  424. UINTN Index;
  425. if (ConfigImage == NULL) {
  426. DEBUG ((DEBUG_INFO, "RecoverImage (NoConfig)\n"));
  427. Status = CreateHobForRecoveryCapsule (
  428. SystemFirmwareImage,
  429. SystemFirmwareImageSize
  430. );
  431. return Status;
  432. }
  433. ConfigData = NULL;
  434. ZeroMem (&ConfigHeader, sizeof (ConfigHeader));
  435. Status = ParseRecoveryDataFile (
  436. ConfigImage,
  437. ConfigImageSize,
  438. &ConfigHeader,
  439. &ConfigData
  440. );
  441. DEBUG ((DEBUG_INFO, "ParseRecoveryDataFile - %r\n", Status));
  442. if (EFI_ERROR (Status)) {
  443. return Status;
  444. }
  445. DEBUG ((DEBUG_INFO, "ConfigHeader.NumOfRecovery - 0x%x\n", ConfigHeader.NumOfRecovery));
  446. DEBUG ((DEBUG_INFO, "PcdEdkiiSystemFirmwareFileGuid - %g\n", PcdGetPtr (PcdEdkiiSystemFirmwareFileGuid)));
  447. Index = 0;
  448. RecoveryConfigData = ConfigData;
  449. while (Index < ConfigHeader.NumOfRecovery) {
  450. if (CompareGuid (&RecoveryConfigData->FileGuid, PcdGetPtr (PcdEdkiiSystemFirmwareFileGuid))) {
  451. DEBUG ((DEBUG_INFO, "FileGuid - %g (processing)\n", &RecoveryConfigData->FileGuid));
  452. Status = CreateHobForRecoveryCapsule (
  453. (UINT8 *)SystemFirmwareImage + RecoveryConfigData->ImageOffset,
  454. RecoveryConfigData->Length
  455. );
  456. //
  457. // Shall updates be serialized so that if a recovery FV is not successfully completed,
  458. // the remaining updates won't be performed.
  459. //
  460. if (EFI_ERROR (Status)) {
  461. break;
  462. }
  463. } else {
  464. DEBUG ((DEBUG_INFO, "FileGuid - %g (ignored)\n", &RecoveryConfigData->FileGuid));
  465. }
  466. Index++;
  467. RecoveryConfigData++;
  468. }
  469. return Status;
  470. }
  471. /**
  472. Process recovery image.
  473. Caution: This function may receive untrusted input.
  474. @param[in] Image Points to the recovery image.
  475. @param[in] Length The length of the recovery image in bytes.
  476. @retval EFI_SUCCESS Process Recovery Image successfully.
  477. @retval EFI_SECURITY_VIOLATION Recovery image is not processed due to security violation.
  478. **/
  479. EFI_STATUS
  480. ProcessRecoveryImage (
  481. IN VOID *Image,
  482. IN UINTN Length
  483. )
  484. {
  485. UINT32 LastAttemptVersion;
  486. UINT32 LastAttemptStatus;
  487. EFI_STATUS Status;
  488. VOID *SystemFirmwareImage;
  489. UINTN SystemFirmwareImageSize;
  490. VOID *ConfigImage;
  491. UINTN ConfigImageSize;
  492. VOID *AuthenticatedImage;
  493. UINTN AuthenticatedImageSize;
  494. AuthenticatedImage = NULL;
  495. AuthenticatedImageSize = 0;
  496. Status = CapsuleAuthenticateSystemFirmware (Image, Length, TRUE, &LastAttemptVersion, &LastAttemptStatus, &AuthenticatedImage, &AuthenticatedImageSize);
  497. if (EFI_ERROR (Status)) {
  498. DEBUG ((DEBUG_INFO, "CapsuleAuthenticateSystemFirmware - %r\n", Status));
  499. return Status;
  500. }
  501. ExtractSystemFirmwareImage (AuthenticatedImage, AuthenticatedImageSize, &SystemFirmwareImage, &SystemFirmwareImageSize);
  502. ExtractConfigImage (AuthenticatedImage, AuthenticatedImageSize, &ConfigImage, &ConfigImageSize);
  503. Status = RecoverImage (SystemFirmwareImage, SystemFirmwareImageSize, ConfigImage, ConfigImageSize);
  504. if (EFI_ERROR (Status)) {
  505. DEBUG ((DEBUG_INFO, "RecoverImage - %r\n", Status));
  506. return Status;
  507. }
  508. return EFI_SUCCESS;
  509. }
  510. /**
  511. Process Firmware management protocol data capsule.
  512. Caution: This function may receive untrusted input.
  513. This function assumes the caller validated the capsule by using
  514. ValidateFmpCapsule(), so that all fields in EFI_CAPSULE_HEADER,
  515. EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER and
  516. EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER are correct.
  517. @param[in] CapsuleHeader Points to a capsule header.
  518. @param[in] IsSystemFmp If this capsule is a system FMP capsule.
  519. @retval EFI_SUCCESS Process Capsule Image successfully.
  520. @retval EFI_UNSUPPORTED Capsule image is not supported by the firmware.
  521. @retval EFI_VOLUME_CORRUPTED FV volume in the capsule is corrupted.
  522. @retval EFI_OUT_OF_RESOURCES Not enough memory.
  523. **/
  524. EFI_STATUS
  525. ProcessFmpCapsuleImage (
  526. IN EFI_CAPSULE_HEADER *CapsuleHeader,
  527. IN BOOLEAN IsSystemFmp
  528. )
  529. {
  530. EFI_STATUS Status;
  531. EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *FmpCapsuleHeader;
  532. EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *ImageHeader;
  533. UINT8 *Image;
  534. UINT64 *ItemOffsetList;
  535. UINTN ItemIndex;
  536. if (!IsSystemFmp) {
  537. return EFI_UNSUPPORTED;
  538. }
  539. FmpCapsuleHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_HEADER *)((UINT8 *)CapsuleHeader + CapsuleHeader->HeaderSize);
  540. ItemOffsetList = (UINT64 *)(FmpCapsuleHeader + 1);
  541. for (ItemIndex = 0; ItemIndex < FmpCapsuleHeader->PayloadItemCount; ItemIndex++) {
  542. ImageHeader = (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER *)((UINT8 *)FmpCapsuleHeader + ItemOffsetList[ItemIndex]);
  543. if (ImageHeader->Version >= EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER_INIT_VERSION) {
  544. Image = (UINT8 *)(ImageHeader + 1);
  545. } else {
  546. //
  547. // If the EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER is version 1, only match ImageTypeId.
  548. // Header should exclude UpdateHardwareInstance field.
  549. // If version is 2 Header should exclude ImageCapsuleSupport field.
  550. //
  551. if (ImageHeader->Version == 1) {
  552. Image = (UINT8 *)ImageHeader + OFFSET_OF (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, UpdateHardwareInstance);
  553. } else {
  554. Image = (UINT8 *)ImageHeader + OFFSET_OF (EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER, ImageCapsuleSupport);
  555. }
  556. }
  557. Status = ProcessRecoveryImage (Image, ImageHeader->UpdateImageSize);
  558. if (EFI_ERROR (Status)) {
  559. return Status;
  560. }
  561. }
  562. return EFI_SUCCESS;
  563. }
  564. /**
  565. Process recovery capsule image.
  566. Caution: This function may receive untrusted input.
  567. @param[in] CapsuleBuffer The capsule image buffer.
  568. @param[in] CapsuleSize The size of the capsule image in bytes.
  569. @retval EFI_SUCCESS The recovery capsule is processed.
  570. @retval EFI_SECURITY_VIOLATION The recovery capsule is not process because of security violation.
  571. @retval EFI_NOT_FOUND The recovery capsule is not process because of unrecognization.
  572. **/
  573. EFI_STATUS
  574. EFIAPI
  575. ProcessRecoveryCapsule (
  576. IN VOID *CapsuleBuffer,
  577. IN UINTN CapsuleSize
  578. )
  579. {
  580. EFI_STATUS Status;
  581. BOOLEAN IsSystemFmp;
  582. EFI_CAPSULE_HEADER *CapsuleHeader;
  583. CapsuleHeader = CapsuleBuffer;
  584. if (!IsValidCapsuleHeader (CapsuleHeader, CapsuleSize)) {
  585. DEBUG ((DEBUG_ERROR, "CapsuleImageSize incorrect\n"));
  586. return EFI_SECURITY_VIOLATION;
  587. }
  588. //
  589. // Check FMP capsule layout
  590. //
  591. if (IsFmpCapsuleGuid (&CapsuleHeader->CapsuleGuid)) {
  592. DEBUG ((DEBUG_INFO, "CreateHobForRecoveryCapsule\n"));
  593. DEBUG ((DEBUG_INFO, "ProcessCapsuleImage for FmpCapsule ...\n"));
  594. DEBUG ((DEBUG_INFO, "ValidateFmpCapsule ...\n"));
  595. Status = ValidateFmpCapsule (CapsuleHeader, &IsSystemFmp, NULL);
  596. DEBUG ((DEBUG_INFO, "ValidateFmpCapsule - %r\n", Status));
  597. if (EFI_ERROR (Status)) {
  598. return Status;
  599. }
  600. //
  601. // Process EFI FMP Capsule
  602. //
  603. DEBUG ((DEBUG_INFO, "ProcessFmpCapsuleImage ...\n"));
  604. Status = ProcessFmpCapsuleImage (CapsuleHeader, IsSystemFmp);
  605. DEBUG ((DEBUG_INFO, "ProcessFmpCapsuleImage - %r\n", Status));
  606. DEBUG ((DEBUG_INFO, "CreateHobForRecoveryCapsule Done\n"));
  607. return Status;
  608. }
  609. return EFI_UNSUPPORTED;
  610. }
  611. /**
  612. Loads a DXE capsule from some media into memory and updates the HOB table
  613. with the DXE firmware volume information.
  614. @param[in] PeiServices General-purpose services that are available to every PEIM.
  615. @param[in] This Indicates the EFI_PEI_RECOVERY_MODULE_PPI instance.
  616. @retval EFI_SUCCESS The capsule was loaded correctly.
  617. @retval EFI_DEVICE_ERROR A device error occurred.
  618. @retval EFI_NOT_FOUND A recovery DXE capsule cannot be found.
  619. **/
  620. EFI_STATUS
  621. EFIAPI
  622. LoadRecoveryCapsule (
  623. IN EFI_PEI_SERVICES **PeiServices,
  624. IN EFI_PEI_RECOVERY_MODULE_PPI *This
  625. )
  626. {
  627. EFI_STATUS Status;
  628. EFI_PEI_DEVICE_RECOVERY_MODULE_PPI *DeviceRecoveryPpi;
  629. UINTN NumberRecoveryCapsules;
  630. UINTN Instance;
  631. UINTN CapsuleInstance;
  632. UINTN CapsuleSize;
  633. EFI_GUID CapsuleType;
  634. VOID *CapsuleBuffer;
  635. DEBUG ((DEBUG_INFO | DEBUG_LOAD, "Recovery Entry\n"));
  636. for (Instance = 0; ; Instance++) {
  637. Status = PeiServicesLocatePpi (
  638. &gEfiPeiDeviceRecoveryModulePpiGuid,
  639. Instance,
  640. NULL,
  641. (VOID **)&DeviceRecoveryPpi
  642. );
  643. DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - LocateRecoveryPpi (%d) - %r\n", Instance, Status));
  644. if (EFI_ERROR (Status)) {
  645. break;
  646. }
  647. NumberRecoveryCapsules = 0;
  648. Status = DeviceRecoveryPpi->GetNumberRecoveryCapsules (
  649. (EFI_PEI_SERVICES **)PeiServices,
  650. DeviceRecoveryPpi,
  651. &NumberRecoveryCapsules
  652. );
  653. DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - GetNumberRecoveryCapsules (%d) - %r\n", NumberRecoveryCapsules, Status));
  654. if (EFI_ERROR (Status)) {
  655. continue;
  656. }
  657. for (CapsuleInstance = 1; CapsuleInstance <= NumberRecoveryCapsules; CapsuleInstance++) {
  658. CapsuleSize = 0;
  659. Status = DeviceRecoveryPpi->GetRecoveryCapsuleInfo (
  660. (EFI_PEI_SERVICES **)PeiServices,
  661. DeviceRecoveryPpi,
  662. CapsuleInstance,
  663. &CapsuleSize,
  664. &CapsuleType
  665. );
  666. DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - GetRecoveryCapsuleInfo (%d - %x) - %r\n", CapsuleInstance, CapsuleSize, Status));
  667. if (EFI_ERROR (Status)) {
  668. break;
  669. }
  670. CapsuleBuffer = AllocatePages (EFI_SIZE_TO_PAGES (CapsuleSize));
  671. if (CapsuleBuffer == NULL) {
  672. DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - AllocatePool fail\n"));
  673. continue;
  674. }
  675. Status = DeviceRecoveryPpi->LoadRecoveryCapsule (
  676. (EFI_PEI_SERVICES **)PeiServices,
  677. DeviceRecoveryPpi,
  678. CapsuleInstance,
  679. CapsuleBuffer
  680. );
  681. DEBUG ((DEBUG_ERROR, "LoadRecoveryCapsule - LoadRecoveryCapsule (%d) - %r\n", CapsuleInstance, Status));
  682. if (EFI_ERROR (Status)) {
  683. FreePages (CapsuleBuffer, EFI_SIZE_TO_PAGES (CapsuleSize));
  684. break;
  685. }
  686. //
  687. // good, load capsule buffer
  688. //
  689. Status = ProcessRecoveryCapsule (CapsuleBuffer, CapsuleSize);
  690. return Status;
  691. }
  692. }
  693. return EFI_NOT_FOUND;
  694. }