1 /** @file 2 The logic to process capsule. 3 4 Caution: This module requires additional review when modified. 5 This driver will have external input - capsule image. 6 This external input must be validated carefully to avoid security issue like 7 buffer overflow, integer overflow. 8 9 CapsuleDataCoalesce() will do basic validation before coalesce capsule data 10 into memory. 11 12 (C) Copyright 2014 Hewlett-Packard Development Company, L.P.<BR> 13 Copyright (c) 2011 - 2016, Intel Corporation. All rights reserved.<BR> 14 This program and the accompanying materials 15 are licensed and made available under the terms and conditions of the BSD License 16 which accompanies this distribution. The full text of the license may be found at 17 http://opensource.org/licenses/bsd-license.php 18 19 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, 20 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. 21 22 **/ 23 24 #include <Uefi.h> 25 #include <PiPei.h> 26 27 #include <Guid/CapsuleVendor.h> 28 29 #include <Library/BaseMemoryLib.h> 30 #include <Library/DebugLib.h> 31 #include <Library/PrintLib.h> 32 #include <Library/BaseLib.h> 33 34 #include "CommonHeader.h" 35 36 #define MIN_COALESCE_ADDR (1024 * 1024) 37 38 /** 39 Given a pointer to the capsule block list, info on the available system 40 memory, and the size of a buffer, find a free block of memory where a 41 buffer of the given size can be copied to safely. 42 43 @param BlockList Pointer to head of capsule block descriptors 44 @param MemBase Pointer to the base of memory in which we want to find free space 45 @param MemSize The size of the block of memory pointed to by MemBase 46 @param DataSize How big a free block we want to find 47 48 @return A pointer to a memory block of at least DataSize that lies somewhere 49 between MemBase and (MemBase + MemSize). The memory pointed to does not 50 contain any of the capsule block descriptors or capsule blocks pointed to 51 by the BlockList. 52 53 **/ 54 UINT8 * 55 FindFreeMem ( 56 EFI_CAPSULE_BLOCK_DESCRIPTOR *BlockList, 57 UINT8 *MemBase, 58 UINTN MemSize, 59 UINTN DataSize 60 ); 61 62 /** 63 The capsule block descriptors may be fragmented and spread all over memory. 64 To simplify the coalescing of capsule blocks, first coalesce all the 65 capsule block descriptors low in memory. 66 67 The descriptors passed in can be fragmented throughout memory. Here 68 they are relocated into memory to turn them into a contiguous (null 69 terminated) array. 70 71 @param PeiServices pointer to PEI services table 72 @param BlockList pointer to the capsule block descriptors 73 @param NumDescriptors number of capsule data block descriptors, whose Length is non-zero. 74 @param MemBase base of system memory in which we can work 75 @param MemSize size of the system memory pointed to by MemBase 76 77 @retval NULL could not relocate the descriptors 78 @retval Pointer to the base of the successfully-relocated block descriptors. 79 80 **/ 81 EFI_CAPSULE_BLOCK_DESCRIPTOR * 82 RelocateBlockDescriptors ( 83 IN EFI_PEI_SERVICES **PeiServices, 84 IN EFI_CAPSULE_BLOCK_DESCRIPTOR *BlockList, 85 IN UINTN NumDescriptors, 86 IN UINT8 *MemBase, 87 IN UINTN MemSize 88 ); 89 90 /** 91 Check every capsule header. 92 93 @param CapsuleHeader The pointer to EFI_CAPSULE_HEADER 94 95 @retval FALSE Capsule is OK 96 @retval TRUE Capsule is corrupted 97 98 **/ 99 BOOLEAN 100 IsCapsuleCorrupted ( 101 IN EFI_CAPSULE_HEADER *CapsuleHeader 102 ); 103 104 /** 105 Determine if two buffers overlap in memory. 106 107 @param Buff1 pointer to first buffer 108 @param Size1 size of Buff1 109 @param Buff2 pointer to second buffer 110 @param Size2 size of Buff2 111 112 @retval TRUE Buffers overlap in memory. 113 @retval FALSE Buffer doesn't overlap. 114 115 **/ 116 BOOLEAN 117 IsOverlapped ( 118 UINT8 *Buff1, 119 UINTN Size1, 120 UINT8 *Buff2, 121 UINTN Size2 122 ); 123 124 /** 125 Given a pointer to a capsule block descriptor, traverse the list to figure 126 out how many legitimate descriptors there are, and how big the capsule it 127 refers to is. 128 129 @param Desc Pointer to the capsule block descriptors 130 @param NumDescriptors Optional pointer to where to return the number of capsule data descriptors, whose Length is non-zero. 131 @param CapsuleSize Optional pointer to where to return the capsule image size 132 @param CapsuleNumber Optional pointer to where to return the number of capsule 133 134 @retval EFI_NOT_FOUND No descriptors containing data in the list 135 @retval EFI_SUCCESS Return data is valid 136 137 **/ 138 EFI_STATUS 139 GetCapsuleInfo ( 140 IN EFI_CAPSULE_BLOCK_DESCRIPTOR *Desc, 141 IN OUT UINTN *NumDescriptors OPTIONAL, 142 IN OUT UINTN *CapsuleSize OPTIONAL, 143 IN OUT UINTN *CapsuleNumber OPTIONAL 144 ); 145 146 /** 147 Given a pointer to the capsule block list, info on the available system 148 memory, and the size of a buffer, find a free block of memory where a 149 buffer of the given size can be copied to safely. 150 151 @param BlockList Pointer to head of capsule block descriptors 152 @param MemBase Pointer to the base of memory in which we want to find free space 153 @param MemSize The size of the block of memory pointed to by MemBase 154 @param DataSize How big a free block we want to find 155 156 @return A pointer to a memory block of at least DataSize that lies somewhere 157 between MemBase and (MemBase + MemSize). The memory pointed to does not 158 contain any of the capsule block descriptors or capsule blocks pointed to 159 by the BlockList. 160 161 **/ 162 UINT8 * 163 FindFreeMem ( 164 EFI_CAPSULE_BLOCK_DESCRIPTOR *BlockList, 165 UINT8 *MemBase, 166 UINTN MemSize, 167 UINTN DataSize 168 ) 169 { 170 UINTN Size; 171 EFI_CAPSULE_BLOCK_DESCRIPTOR *CurrDesc; 172 EFI_CAPSULE_BLOCK_DESCRIPTOR *TempDesc; 173 UINT8 *MemEnd; 174 BOOLEAN Failed; 175 176 // 177 // Need at least enough to copy the data to at the end of the buffer, so 178 // say the end is less the data size for easy comparisons here. 179 // 180 MemEnd = MemBase + MemSize - DataSize; 181 CurrDesc = BlockList; 182 // 183 // Go through all the descriptor blocks and see if any obstruct the range 184 // 185 while (CurrDesc != NULL) { 186 // 187 // Get the size of this block list and see if it's in the way 188 // 189 Failed = FALSE; 190 TempDesc = CurrDesc; 191 Size = sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR); 192 while (TempDesc->Length != 0) { 193 Size += sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR); 194 TempDesc++; 195 } 196 197 if (IsOverlapped (MemBase, DataSize, (UINT8 *) CurrDesc, Size)) { 198 // 199 // Set our new base to the end of this block list and start all over 200 // 201 MemBase = (UINT8 *) CurrDesc + Size; 202 CurrDesc = BlockList; 203 if (MemBase > MemEnd) { 204 return NULL; 205 } 206 207 Failed = TRUE; 208 } 209 // 210 // Now go through all the blocks and make sure none are in the way 211 // 212 while ((CurrDesc->Length != 0) && (!Failed)) { 213 if (IsOverlapped (MemBase, DataSize, (UINT8 *) (UINTN) CurrDesc->Union.DataBlock, (UINTN) CurrDesc->Length)) { 214 // 215 // Set our new base to the end of this block and start all over 216 // 217 Failed = TRUE; 218 MemBase = (UINT8 *) ((UINTN) CurrDesc->Union.DataBlock) + CurrDesc->Length; 219 CurrDesc = BlockList; 220 if (MemBase > MemEnd) { 221 return NULL; 222 } 223 } 224 CurrDesc++; 225 } 226 // 227 // Normal continuation -- jump to next block descriptor list 228 // 229 if (!Failed) { 230 CurrDesc = (EFI_CAPSULE_BLOCK_DESCRIPTOR *) (UINTN) CurrDesc->Union.ContinuationPointer; 231 } 232 } 233 return MemBase; 234 } 235 236 /** 237 Validate capsule by MemoryResource. 238 239 @param MemoryResource Pointer to the buffer of memory resource descriptor. 240 @param Address Address to be validated. 241 @param Size Size to be validated. 242 243 @retval TRUE No memory resource descriptor reported in HOB list before capsule Coalesce, 244 or it is valid in one MemoryResource. 245 FALSE It is not in any MemoryResource. 246 247 **/ 248 BOOLEAN 249 ValidateCapsuleByMemoryResource ( 250 IN MEMORY_RESOURCE_DESCRIPTOR *MemoryResource, 251 IN EFI_PHYSICAL_ADDRESS Address, 252 IN UINT64 Size 253 ) 254 { 255 UINTN Index; 256 257 // 258 // Sanity Check 259 // 260 if (Size > MAX_ADDRESS) { 261 DEBUG ((EFI_D_ERROR, "ERROR: Size(0x%lx) > MAX_ADDRESS\n", Size)); 262 return FALSE; 263 } 264 265 // 266 // Sanity Check 267 // 268 if (Address > (MAX_ADDRESS - Size)) { 269 DEBUG ((EFI_D_ERROR, "ERROR: Address(0x%lx) > (MAX_ADDRESS - Size(0x%lx))\n", Address, Size)); 270 return FALSE; 271 } 272 273 if (MemoryResource == NULL) { 274 // 275 // No memory resource descriptor reported in HOB list before capsule Coalesce. 276 // 277 return TRUE; 278 } 279 280 for (Index = 0; MemoryResource[Index].ResourceLength != 0; Index++) { 281 if ((Address >= MemoryResource[Index].PhysicalStart) && 282 ((Address + Size) <= (MemoryResource[Index].PhysicalStart + MemoryResource[Index].ResourceLength))) { 283 DEBUG ((EFI_D_INFO, "Address(0x%lx) Size(0x%lx) in MemoryResource[0x%x] - Start(0x%lx) Length(0x%lx)\n", 284 Address, Size, 285 Index, MemoryResource[Index].PhysicalStart, MemoryResource[Index].ResourceLength)); 286 return TRUE; 287 } 288 } 289 290 DEBUG ((EFI_D_ERROR, "ERROR: Address(0x%lx) Size(0x%lx) not in any MemoryResource\n", Address, Size)); 291 return FALSE; 292 } 293 294 /** 295 Check the integrity of the capsule descriptors. 296 297 @param BlockList Pointer to the capsule descriptors 298 @param MemoryResource Pointer to the buffer of memory resource descriptor. 299 300 @retval NULL BlockList is not valid. 301 @retval LastBlockDesc Last one Block in BlockList 302 303 **/ 304 EFI_CAPSULE_BLOCK_DESCRIPTOR * 305 ValidateCapsuleIntegrity ( 306 IN EFI_CAPSULE_BLOCK_DESCRIPTOR *BlockList, 307 IN MEMORY_RESOURCE_DESCRIPTOR *MemoryResource 308 ) 309 { 310 EFI_CAPSULE_HEADER *CapsuleHeader; 311 UINT64 CapsuleSize; 312 UINTN CapsuleCount; 313 EFI_CAPSULE_BLOCK_DESCRIPTOR *Ptr; 314 315 DEBUG ((EFI_D_INFO, "ValidateCapsuleIntegrity\n")); 316 317 // 318 // Go through the list to look for inconsistencies. Check for: 319 // * misaligned block descriptors. 320 // * The first capsule header guid 321 // * The first capsule header flag 322 // * The first capsule header HeaderSize 323 // * Below check will be done in ValidateCapsuleByMemoryResource() 324 // Length > MAX_ADDRESS 325 // Ptr + sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR) > MAX_ADDRESS 326 // DataBlock + Length > MAX_ADDRESS 327 // 328 CapsuleSize = 0; 329 CapsuleCount = 0; 330 Ptr = BlockList; 331 332 if (!ValidateCapsuleByMemoryResource (MemoryResource, (EFI_PHYSICAL_ADDRESS) (UINTN) Ptr, sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR))) { 333 return NULL; 334 } 335 336 DEBUG ((EFI_D_INFO, "Ptr - 0x%x\n", Ptr)); 337 DEBUG ((EFI_D_INFO, "Ptr->Length - 0x%x\n", Ptr->Length)); 338 DEBUG ((EFI_D_INFO, "Ptr->Union - 0x%x\n", Ptr->Union.ContinuationPointer)); 339 while ((Ptr->Length != 0) || (Ptr->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL)) { 340 // 341 // Make sure the descriptor is aligned at UINT64 in memory 342 // 343 if ((UINTN) Ptr & (sizeof(UINT64) - 1)) { 344 DEBUG ((EFI_D_ERROR, "ERROR: BlockList address failed alignment check\n")); 345 return NULL; 346 } 347 348 if (Ptr->Length == 0) { 349 // 350 // Descriptor points to another list of block descriptors somewhere 351 // else. 352 // 353 Ptr = (EFI_CAPSULE_BLOCK_DESCRIPTOR *) (UINTN) Ptr->Union.ContinuationPointer; 354 if (!ValidateCapsuleByMemoryResource (MemoryResource, (EFI_PHYSICAL_ADDRESS) (UINTN) Ptr, sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR))) { 355 return NULL; 356 } 357 DEBUG ((EFI_D_INFO, "Ptr(C) - 0x%x\n", Ptr)); 358 DEBUG ((EFI_D_INFO, "Ptr->Length - 0x%x\n", Ptr->Length)); 359 DEBUG ((EFI_D_INFO, "Ptr->Union - 0x%x\n", Ptr->Union.ContinuationPointer)); 360 } else { 361 if (!ValidateCapsuleByMemoryResource (MemoryResource, Ptr->Union.DataBlock, Ptr->Length)) { 362 return NULL; 363 } 364 365 // 366 //To enhance the reliability of check-up, the first capsule's header is checked here. 367 //More reliabilities check-up will do later. 368 // 369 if (CapsuleSize == 0) { 370 // 371 //Move to the first capsule to check its header. 372 // 373 CapsuleHeader = (EFI_CAPSULE_HEADER*)((UINTN)Ptr->Union.DataBlock); 374 // 375 // Sanity check 376 // 377 if (Ptr->Length < sizeof(EFI_CAPSULE_HEADER)) { 378 DEBUG ((EFI_D_ERROR, "ERROR: Ptr->Length(0x%lx) < sizeof(EFI_CAPSULE_HEADER)\n", Ptr->Length)); 379 return NULL; 380 } 381 // 382 // Make sure HeaderSize field is valid 383 // 384 if (CapsuleHeader->HeaderSize > CapsuleHeader->CapsuleImageSize) { 385 DEBUG ((EFI_D_ERROR, "ERROR: CapsuleHeader->HeaderSize(0x%x) > CapsuleHeader->CapsuleImageSize(0x%x)\n", CapsuleHeader->HeaderSize, CapsuleHeader->CapsuleImageSize)); 386 return NULL; 387 } 388 if (IsCapsuleCorrupted (CapsuleHeader)) { 389 return NULL; 390 } 391 CapsuleCount ++; 392 CapsuleSize = CapsuleHeader->CapsuleImageSize; 393 } 394 395 if (CapsuleSize >= Ptr->Length) { 396 CapsuleSize = CapsuleSize - Ptr->Length; 397 } else { 398 DEBUG ((EFI_D_ERROR, "ERROR: CapsuleSize(0x%lx) < Ptr->Length(0x%lx)\n", CapsuleSize, Ptr->Length)); 399 // 400 // Sanity check 401 // 402 return NULL; 403 } 404 405 // 406 // Move to next BLOCK descriptor 407 // 408 Ptr++; 409 if (!ValidateCapsuleByMemoryResource (MemoryResource, (EFI_PHYSICAL_ADDRESS) (UINTN) Ptr, sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR))) { 410 return NULL; 411 } 412 DEBUG ((EFI_D_INFO, "Ptr(B) - 0x%x\n", Ptr)); 413 DEBUG ((EFI_D_INFO, "Ptr->Length - 0x%x\n", Ptr->Length)); 414 DEBUG ((EFI_D_INFO, "Ptr->Union - 0x%x\n", Ptr->Union.ContinuationPointer)); 415 } 416 } 417 418 if (CapsuleCount == 0) { 419 // 420 // No any capsule is found in BlockList 421 // 422 DEBUG ((EFI_D_ERROR, "ERROR: CapsuleCount(0x%x) == 0\n", CapsuleCount)); 423 return NULL; 424 } 425 426 if (CapsuleSize != 0) { 427 // 428 // Capsule data is incomplete. 429 // 430 DEBUG ((EFI_D_ERROR, "ERROR: CapsuleSize(0x%lx) != 0\n", CapsuleSize)); 431 return NULL; 432 } 433 434 return Ptr; 435 } 436 437 /** 438 The capsule block descriptors may be fragmented and spread all over memory. 439 To simplify the coalescing of capsule blocks, first coalesce all the 440 capsule block descriptors low in memory. 441 442 The descriptors passed in can be fragmented throughout memory. Here 443 they are relocated into memory to turn them into a contiguous (null 444 terminated) array. 445 446 @param PeiServices pointer to PEI services table 447 @param BlockList pointer to the capsule block descriptors 448 @param NumDescriptors number of capsule data block descriptors, whose Length is non-zero. 449 @param MemBase base of system memory in which we can work 450 @param MemSize size of the system memory pointed to by MemBase 451 452 @retval NULL could not relocate the descriptors 453 @retval Pointer to the base of the successfully-relocated block descriptors. 454 455 **/ 456 EFI_CAPSULE_BLOCK_DESCRIPTOR * 457 RelocateBlockDescriptors ( 458 IN EFI_PEI_SERVICES **PeiServices, 459 IN EFI_CAPSULE_BLOCK_DESCRIPTOR *BlockList, 460 IN UINTN NumDescriptors, 461 IN UINT8 *MemBase, 462 IN UINTN MemSize 463 ) 464 { 465 EFI_CAPSULE_BLOCK_DESCRIPTOR *NewBlockList; 466 EFI_CAPSULE_BLOCK_DESCRIPTOR *CurrBlockDescHead; 467 EFI_CAPSULE_BLOCK_DESCRIPTOR *TempBlockDesc; 468 EFI_CAPSULE_BLOCK_DESCRIPTOR *PrevBlockDescTail; 469 UINTN BufferSize; 470 UINT8 *RelocBuffer; 471 UINTN BlockListSize; 472 473 // 474 // Get the info on the blocks and descriptors. Since we're going to move 475 // the descriptors low in memory, adjust the base/size values accordingly here. 476 // NumDescriptors is the number of legit data descriptors, so add one for 477 // a terminator. (Already done by caller, no check is needed.) 478 // 479 480 BufferSize = NumDescriptors * sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR); 481 NewBlockList = (EFI_CAPSULE_BLOCK_DESCRIPTOR *) MemBase; 482 if (MemSize < BufferSize) { 483 return NULL; 484 } 485 486 MemSize -= BufferSize; 487 MemBase += BufferSize; 488 // 489 // Go through all the blocks and make sure none are in the way 490 // 491 TempBlockDesc = BlockList; 492 while (TempBlockDesc->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL) { 493 if (TempBlockDesc->Length == 0) { 494 // 495 // Next block of descriptors 496 // 497 TempBlockDesc = (EFI_CAPSULE_BLOCK_DESCRIPTOR *) (UINTN) TempBlockDesc->Union.ContinuationPointer; 498 } else { 499 // 500 // If the capsule data pointed to by this descriptor is in the way, 501 // move it. 502 // 503 if (IsOverlapped ( 504 (UINT8 *) NewBlockList, 505 BufferSize, 506 (UINT8 *) (UINTN) TempBlockDesc->Union.DataBlock, 507 (UINTN) TempBlockDesc->Length 508 )) { 509 // 510 // Relocate the block 511 // 512 RelocBuffer = FindFreeMem (BlockList, MemBase, MemSize, (UINTN) TempBlockDesc->Length); 513 if (RelocBuffer == NULL) { 514 return NULL; 515 } 516 517 CopyMem ((VOID *) RelocBuffer, (VOID *) (UINTN) TempBlockDesc->Union.DataBlock, (UINTN) TempBlockDesc->Length); 518 DEBUG ((EFI_D_INFO, "Capsule relocate descriptors from/to/size 0x%lX 0x%lX 0x%lX\n", TempBlockDesc->Union.DataBlock, (UINT64)(UINTN)RelocBuffer, TempBlockDesc->Length)); 519 TempBlockDesc->Union.DataBlock = (EFI_PHYSICAL_ADDRESS) (UINTN) RelocBuffer; 520 } 521 TempBlockDesc++; 522 } 523 } 524 // 525 // Now go through all the block descriptors to make sure that they're not 526 // in the memory region we want to copy them to. 527 // 528 CurrBlockDescHead = BlockList; 529 PrevBlockDescTail = NULL; 530 while ((CurrBlockDescHead != NULL) && (CurrBlockDescHead->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL)) { 531 // 532 // Get the size of this list then see if it overlaps our low region 533 // 534 TempBlockDesc = CurrBlockDescHead; 535 BlockListSize = sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR); 536 while (TempBlockDesc->Length != 0) { 537 BlockListSize += sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR); 538 TempBlockDesc++; 539 } 540 541 if (IsOverlapped ( 542 (UINT8 *) NewBlockList, 543 BufferSize, 544 (UINT8 *) CurrBlockDescHead, 545 BlockListSize 546 )) { 547 // 548 // Overlaps, so move it out of the way 549 // 550 RelocBuffer = FindFreeMem (BlockList, MemBase, MemSize, BlockListSize); 551 if (RelocBuffer == NULL) { 552 return NULL; 553 } 554 CopyMem ((VOID *) RelocBuffer, (VOID *) CurrBlockDescHead, BlockListSize); 555 DEBUG ((EFI_D_INFO, "Capsule reloc descriptor block #2\n")); 556 // 557 // Point the previous block's next point to this copied version. If 558 // the tail pointer is null, then this is the first descriptor block. 559 // 560 if (PrevBlockDescTail == NULL) { 561 BlockList = (EFI_CAPSULE_BLOCK_DESCRIPTOR *) RelocBuffer; 562 } else { 563 PrevBlockDescTail->Union.DataBlock = (EFI_PHYSICAL_ADDRESS) (UINTN) RelocBuffer; 564 } 565 } 566 // 567 // Save our new tail and jump to the next block list 568 // 569 PrevBlockDescTail = TempBlockDesc; 570 CurrBlockDescHead = (EFI_CAPSULE_BLOCK_DESCRIPTOR *) (UINTN) TempBlockDesc->Union.ContinuationPointer; 571 } 572 // 573 // Cleared out low memory. Now copy the descriptors down there. 574 // 575 TempBlockDesc = BlockList; 576 CurrBlockDescHead = NewBlockList; 577 while ((TempBlockDesc != NULL) && (TempBlockDesc->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL)) { 578 if (TempBlockDesc->Length != 0) { 579 CurrBlockDescHead->Union.DataBlock = TempBlockDesc->Union.DataBlock; 580 CurrBlockDescHead->Length = TempBlockDesc->Length; 581 CurrBlockDescHead++; 582 TempBlockDesc++; 583 } else { 584 TempBlockDesc = (EFI_CAPSULE_BLOCK_DESCRIPTOR *) (UINTN) TempBlockDesc->Union.ContinuationPointer; 585 } 586 } 587 // 588 // Null terminate 589 // 590 CurrBlockDescHead->Union.ContinuationPointer = (EFI_PHYSICAL_ADDRESS) (UINTN) NULL; 591 CurrBlockDescHead->Length = 0; 592 return NewBlockList; 593 } 594 595 /** 596 Determine if two buffers overlap in memory. 597 598 @param Buff1 pointer to first buffer 599 @param Size1 size of Buff1 600 @param Buff2 pointer to second buffer 601 @param Size2 size of Buff2 602 603 @retval TRUE Buffers overlap in memory. 604 @retval FALSE Buffer doesn't overlap. 605 606 **/ 607 BOOLEAN 608 IsOverlapped ( 609 UINT8 *Buff1, 610 UINTN Size1, 611 UINT8 *Buff2, 612 UINTN Size2 613 ) 614 { 615 // 616 // If buff1's end is less than the start of buff2, then it's ok. 617 // Also, if buff1's start is beyond buff2's end, then it's ok. 618 // 619 if (((Buff1 + Size1) <= Buff2) || (Buff1 >= (Buff2 + Size2))) { 620 return FALSE; 621 } 622 623 return TRUE; 624 } 625 626 /** 627 Given a pointer to a capsule block descriptor, traverse the list to figure 628 out how many legitimate descriptors there are, and how big the capsule it 629 refers to is. 630 631 @param Desc Pointer to the capsule block descriptors 632 @param NumDescriptors Optional pointer to where to return the number of capsule data descriptors, whose Length is non-zero. 633 @param CapsuleSize Optional pointer to where to return the capsule image size 634 @param CapsuleNumber Optional pointer to where to return the number of capsule 635 636 @retval EFI_NOT_FOUND No descriptors containing data in the list 637 @retval EFI_SUCCESS Return data is valid 638 639 **/ 640 EFI_STATUS 641 GetCapsuleInfo ( 642 IN EFI_CAPSULE_BLOCK_DESCRIPTOR *Desc, 643 IN OUT UINTN *NumDescriptors OPTIONAL, 644 IN OUT UINTN *CapsuleSize OPTIONAL, 645 IN OUT UINTN *CapsuleNumber OPTIONAL 646 ) 647 { 648 UINTN Count; 649 UINTN Size; 650 UINTN Number; 651 UINTN ThisCapsuleImageSize; 652 EFI_CAPSULE_HEADER *CapsuleHeader; 653 654 DEBUG ((EFI_D_INFO, "GetCapsuleInfo enter\n")); 655 656 ASSERT (Desc != NULL); 657 658 Count = 0; 659 Size = 0; 660 Number = 0; 661 ThisCapsuleImageSize = 0; 662 663 while (Desc->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL) { 664 if (Desc->Length == 0) { 665 // 666 // Descriptor points to another list of block descriptors somewhere 667 // 668 Desc = (EFI_CAPSULE_BLOCK_DESCRIPTOR *) (UINTN) Desc->Union.ContinuationPointer; 669 } else { 670 // 671 // Sanity Check 672 // It is needed, because ValidateCapsuleIntegrity() only validate one individual capsule Size. 673 // While here we need check all capsules size. 674 // 675 if (Desc->Length >= (MAX_ADDRESS - Size)) { 676 DEBUG ((EFI_D_ERROR, "ERROR: Desc->Length(0x%lx) >= (MAX_ADDRESS - Size(0x%x))\n", Desc->Length, Size)); 677 return EFI_OUT_OF_RESOURCES; 678 } 679 Size += (UINTN) Desc->Length; 680 Count++; 681 682 // 683 // See if this is first capsule's header 684 // 685 if (ThisCapsuleImageSize == 0) { 686 CapsuleHeader = (EFI_CAPSULE_HEADER*)((UINTN)Desc->Union.DataBlock); 687 // 688 // This has been checked in ValidateCapsuleIntegrity() 689 // 690 Number ++; 691 ThisCapsuleImageSize = CapsuleHeader->CapsuleImageSize; 692 } 693 694 // 695 // This has been checked in ValidateCapsuleIntegrity() 696 // 697 ASSERT (ThisCapsuleImageSize >= Desc->Length); 698 ThisCapsuleImageSize = (UINTN)(ThisCapsuleImageSize - Desc->Length); 699 700 // 701 // Move to next 702 // 703 Desc++; 704 } 705 } 706 // 707 // If no descriptors, then fail 708 // 709 if (Count == 0) { 710 DEBUG ((EFI_D_ERROR, "ERROR: Count == 0\n")); 711 return EFI_NOT_FOUND; 712 } 713 714 // 715 // checked in ValidateCapsuleIntegrity() 716 // 717 ASSERT (ThisCapsuleImageSize == 0); 718 719 if (NumDescriptors != NULL) { 720 *NumDescriptors = Count; 721 } 722 723 if (CapsuleSize != NULL) { 724 *CapsuleSize = Size; 725 } 726 727 if (CapsuleNumber != NULL) { 728 *CapsuleNumber = Number; 729 } 730 731 return EFI_SUCCESS; 732 } 733 734 /** 735 Check every capsule header. 736 737 @param CapsuleHeader The pointer to EFI_CAPSULE_HEADER 738 739 @retval FALSE Capsule is OK 740 @retval TRUE Capsule is corrupted 741 742 **/ 743 BOOLEAN 744 IsCapsuleCorrupted ( 745 IN EFI_CAPSULE_HEADER *CapsuleHeader 746 ) 747 { 748 // 749 //A capsule to be updated across a system reset should contain CAPSULE_FLAGS_PERSIST_ACROSS_RESET. 750 // 751 if ((CapsuleHeader->Flags & CAPSULE_FLAGS_PERSIST_ACROSS_RESET) == 0) { 752 return TRUE; 753 } 754 // 755 //Make sure the flags combination is supported by the platform. 756 // 757 if ((CapsuleHeader->Flags & (CAPSULE_FLAGS_PERSIST_ACROSS_RESET | CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE)) == CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE) { 758 return TRUE; 759 } 760 if ((CapsuleHeader->Flags & (CAPSULE_FLAGS_PERSIST_ACROSS_RESET | CAPSULE_FLAGS_INITIATE_RESET)) == CAPSULE_FLAGS_INITIATE_RESET) { 761 return TRUE; 762 } 763 764 return FALSE; 765 } 766 767 /** 768 Try to verify the integrity of a capsule test pattern before the 769 capsule gets coalesced. This can be useful in narrowing down 770 where capsule data corruption occurs. 771 772 The test pattern mode fills in memory with a counting UINT32 value. 773 If the capsule is not divided up in a multiple of 4-byte blocks, then 774 things get messy doing the check. Therefore there are some cases 775 here where we just give up and skip the pre-coalesce check. 776 777 @param PeiServices PEI services table 778 @param Desc Pointer to capsule descriptors 779 **/ 780 VOID 781 CapsuleTestPatternPreCoalesce ( 782 IN EFI_PEI_SERVICES **PeiServices, 783 IN EFI_CAPSULE_BLOCK_DESCRIPTOR *Desc 784 ) 785 { 786 UINT32 *TestPtr; 787 UINT32 TestCounter; 788 UINT32 TestSize; 789 790 DEBUG ((EFI_D_INFO, "CapsuleTestPatternPreCoalesce\n")); 791 792 // 793 // Find first data descriptor 794 // 795 while ((Desc->Length == 0) && (Desc->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL)) { 796 Desc = (EFI_CAPSULE_BLOCK_DESCRIPTOR *) (UINTN) Desc->Union.ContinuationPointer; 797 } 798 799 if (Desc->Union.ContinuationPointer == 0) { 800 return ; 801 } 802 // 803 // First one better be long enough to at least hold the test signature 804 // 805 if (Desc->Length < sizeof (UINT32)) { 806 DEBUG ((EFI_D_INFO, "Capsule test pattern pre-coalesce punted #1\n")); 807 return ; 808 } 809 810 TestPtr = (UINT32 *) (UINTN) Desc->Union.DataBlock; 811 // 812 // 0x54534554 "TEST" 813 // 814 if (*TestPtr != 0x54534554) { 815 return ; 816 } 817 818 TestCounter = 0; 819 TestSize = (UINT32) Desc->Length - 2 * sizeof (UINT32); 820 // 821 // Skip over the signature and the size fields in the pattern data header 822 // 823 TestPtr += 2; 824 while (1) { 825 if ((TestSize & 0x03) != 0) { 826 DEBUG ((EFI_D_INFO, "Capsule test pattern pre-coalesce punted #2\n")); 827 return ; 828 } 829 830 while (TestSize > 0) { 831 if (*TestPtr != TestCounter) { 832 DEBUG ((EFI_D_INFO, "Capsule test pattern pre-coalesce failed data corruption check\n")); 833 return ; 834 } 835 836 TestSize -= sizeof (UINT32); 837 TestCounter++; 838 TestPtr++; 839 } 840 Desc++; 841 while ((Desc->Length == 0) && (Desc->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL)) { 842 Desc = (EFI_CAPSULE_BLOCK_DESCRIPTOR *) (UINTN) Desc->Union.ContinuationPointer; 843 } 844 845 if (Desc->Union.ContinuationPointer == (EFI_PHYSICAL_ADDRESS) (UINTN) NULL) { 846 return ; 847 } 848 TestSize = (UINT32) Desc->Length; 849 TestPtr = (UINT32 *) (UINTN) Desc->Union.DataBlock; 850 } 851 } 852 853 /** 854 Checks for the presence of capsule descriptors. 855 Get capsule descriptors from variable CapsuleUpdateData, CapsuleUpdateData1, CapsuleUpdateData2... 856 857 @param BlockListBuffer Pointer to the buffer of capsule descriptors variables 858 @param MemoryResource Pointer to the buffer of memory resource descriptor. 859 @param BlockDescriptorList Pointer to the capsule descriptors list 860 861 @retval EFI_SUCCESS a valid capsule is present 862 @retval EFI_NOT_FOUND if a valid capsule is not present 863 **/ 864 EFI_STATUS 865 BuildCapsuleDescriptors ( 866 IN EFI_PHYSICAL_ADDRESS *BlockListBuffer, 867 IN MEMORY_RESOURCE_DESCRIPTOR *MemoryResource, 868 OUT EFI_CAPSULE_BLOCK_DESCRIPTOR **BlockDescriptorList 869 ) 870 { 871 UINTN Index; 872 EFI_CAPSULE_BLOCK_DESCRIPTOR *LastBlock; 873 EFI_CAPSULE_BLOCK_DESCRIPTOR *TempBlock; 874 EFI_CAPSULE_BLOCK_DESCRIPTOR *HeadBlock; 875 876 DEBUG ((EFI_D_INFO, "BuildCapsuleDescriptors enter\n")); 877 878 LastBlock = NULL; 879 HeadBlock = NULL; 880 TempBlock = NULL; 881 Index = 0; 882 883 while (BlockListBuffer[Index] != 0) { 884 // 885 // Test integrity of descriptors. 886 // 887 if (BlockListBuffer[Index] < MAX_ADDRESS) { 888 TempBlock = ValidateCapsuleIntegrity ((EFI_CAPSULE_BLOCK_DESCRIPTOR *)(UINTN)BlockListBuffer[Index], MemoryResource); 889 if (TempBlock != NULL) { 890 if (LastBlock == NULL) { 891 LastBlock = TempBlock; 892 893 // 894 // Return the base of the block descriptors 895 // 896 HeadBlock = (EFI_CAPSULE_BLOCK_DESCRIPTOR *)(UINTN)BlockListBuffer[Index]; 897 } else { 898 // 899 // Combine the different BlockList into single BlockList. 900 // 901 LastBlock->Union.DataBlock = (EFI_PHYSICAL_ADDRESS)(UINTN)BlockListBuffer[Index]; 902 LastBlock->Length = 0; 903 LastBlock = TempBlock; 904 } 905 } 906 } else { 907 DEBUG ((EFI_D_ERROR, "ERROR: BlockListBuffer[Index](0x%lx) < MAX_ADDRESS\n", BlockListBuffer[Index])); 908 } 909 Index ++; 910 } 911 912 if (HeadBlock != NULL) { 913 *BlockDescriptorList = HeadBlock; 914 return EFI_SUCCESS; 915 } 916 return EFI_NOT_FOUND; 917 } 918 919 /** 920 The function to coalesce a fragmented capsule in memory. 921 922 Memory Map for coalesced capsule: 923 MemBase + ---->+---------------------------+<-----------+ 924 MemSize | ------------------------- | | 925 | | Capsule [Num-1] | | | 926 | ------------------------- | | 927 | | ................ | | | 928 | ------------------------- | | 929 | | Capsule [1] | | | 930 | ------------------------- | | 931 | | Capsule [0] | | | 932 | ------------------------- | | 933 | Capsule Image | | 934 CapsuleImageBase-->+---------------------------+ 935 | ------------------------- | | 936 | | CapsuleOffset[Num-1] | | | 937 | ------------------------- | | 938 | | ................ | | CapsuleSize 939 | ------------------------- | | 940 | | CapsuleOffset[1] | | | 941 | ------------------------- | | 942 | | CapsuleOffset[0] | | | 943 |---------------------------| | 944 | | CapsuleNumber | | | 945 | ------------------------- | | 946 | | CapsuleAllImageSize | | | 947 | ------------------------- | | 948 | PrivateData | | 949 DestPtr ---->+---------------------------+<-----------+ 950 | | | 951 | FreeMem | FreeMemSize 952 | | | 953 FreeMemBase --->+---------------------------+<-----------+ 954 | Terminator | 955 +---------------------------+ 956 | BlockDescriptor n | 957 +---------------------------+ 958 | ................. | 959 +---------------------------+ 960 | BlockDescriptor 1 | 961 +---------------------------+ 962 | BlockDescriptor 0 | 963 +---------------------------+ 964 | PrivateDataDesc 0 | 965 MemBase ---->+---------------------------+<----- BlockList 966 967 Caution: This function may receive untrusted input. 968 The capsule data is external input, so this routine will do basic validation before 969 coalesce capsule data into memory. 970 971 @param PeiServices General purpose services available to every PEIM. 972 @param BlockListBuffer Pointer to the buffer of Capsule Descriptor Variables. 973 @param MemoryResource Pointer to the buffer of memory resource descriptor. 974 @param MemoryBase Pointer to the base of a block of memory that we can walk 975 all over while trying to coalesce our buffers. 976 On output, this variable will hold the base address of 977 a coalesced capsule. 978 @param MemorySize Size of the memory region pointed to by MemoryBase. 979 On output, this variable will contain the size of the 980 coalesced capsule. 981 982 @retval EFI_NOT_FOUND If we could not find the capsule descriptors. 983 984 @retval EFI_BUFFER_TOO_SMALL 985 If we could not coalesce the capsule in the memory 986 region provided to us. 987 988 @retval EFI_SUCCESS Processed the capsule successfully. 989 **/ 990 EFI_STATUS 991 EFIAPI 992 CapsuleDataCoalesce ( 993 IN EFI_PEI_SERVICES **PeiServices, 994 IN EFI_PHYSICAL_ADDRESS *BlockListBuffer, 995 IN MEMORY_RESOURCE_DESCRIPTOR *MemoryResource, 996 IN OUT VOID **MemoryBase, 997 IN OUT UINTN *MemorySize 998 ) 999 { 1000 VOID *NewCapsuleBase; 1001 VOID *CapsuleImageBase; 1002 UINTN CapsuleIndex; 1003 UINT8 *FreeMemBase; 1004 UINT8 *DestPtr; 1005 UINTN DestLength; 1006 UINT8 *RelocPtr; 1007 UINTN CapsuleTimes; 1008 UINT64 SizeLeft; 1009 UINT64 CapsuleImageSize; 1010 UINTN CapsuleSize; 1011 UINTN CapsuleNumber; 1012 UINTN DescriptorsSize; 1013 UINTN FreeMemSize; 1014 UINTN NumDescriptors; 1015 BOOLEAN CapsuleBeginFlag; 1016 EFI_STATUS Status; 1017 EFI_CAPSULE_HEADER *CapsuleHeader; 1018 EFI_CAPSULE_PEIM_PRIVATE_DATA PrivateData; 1019 EFI_CAPSULE_PEIM_PRIVATE_DATA *PrivateDataPtr; 1020 EFI_CAPSULE_BLOCK_DESCRIPTOR *BlockList; 1021 EFI_CAPSULE_BLOCK_DESCRIPTOR *CurrentBlockDesc; 1022 EFI_CAPSULE_BLOCK_DESCRIPTOR *TempBlockDesc; 1023 EFI_CAPSULE_BLOCK_DESCRIPTOR PrivateDataDesc[2]; 1024 1025 DEBUG ((EFI_D_INFO, "CapsuleDataCoalesce enter\n")); 1026 1027 CapsuleIndex = 0; 1028 SizeLeft = 0; 1029 CapsuleTimes = 0; 1030 CapsuleImageSize = 0; 1031 PrivateDataPtr = NULL; 1032 CapsuleHeader = NULL; 1033 CapsuleBeginFlag = TRUE; 1034 CapsuleSize = 0; 1035 NumDescriptors = 0; 1036 1037 // 1038 // Build capsule descriptors list 1039 // 1040 Status = BuildCapsuleDescriptors (BlockListBuffer, MemoryResource, &BlockList); 1041 if (EFI_ERROR (Status)) { 1042 return Status; 1043 } 1044 1045 DEBUG_CODE ( 1046 CapsuleTestPatternPreCoalesce (PeiServices, BlockList); 1047 ); 1048 1049 // 1050 // Get the size of our descriptors and the capsule size. GetCapsuleInfo() 1051 // returns the number of descriptors that actually point to data, so add 1052 // one for a terminator. Do that below. 1053 // 1054 Status = GetCapsuleInfo (BlockList, &NumDescriptors, &CapsuleSize, &CapsuleNumber); 1055 if (EFI_ERROR (Status)) { 1056 return Status; 1057 } 1058 DEBUG ((EFI_D_INFO, "CapsuleSize - 0x%x\n", CapsuleSize)); 1059 DEBUG ((EFI_D_INFO, "CapsuleNumber - 0x%x\n", CapsuleNumber)); 1060 DEBUG ((EFI_D_INFO, "NumDescriptors - 0x%x\n", NumDescriptors)); 1061 if ((CapsuleSize == 0) || (NumDescriptors == 0) || (CapsuleNumber == 0)) { 1062 return EFI_NOT_FOUND; 1063 } 1064 1065 if (CapsuleNumber - 1 >= (MAX_ADDRESS - (sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA) + sizeof(UINT64))) / sizeof(UINT64)) { 1066 DEBUG ((EFI_D_ERROR, "ERROR: CapsuleNumber - 0x%x\n", CapsuleNumber)); 1067 return EFI_BUFFER_TOO_SMALL; 1068 } 1069 1070 // 1071 // Initialize our local copy of private data. When we're done, we'll create a 1072 // descriptor for it as well so that it can be put into free memory without 1073 // trashing anything. 1074 // 1075 PrivateData.Signature = EFI_CAPSULE_PEIM_PRIVATE_DATA_SIGNATURE; 1076 PrivateData.CapsuleAllImageSize = (UINT64) CapsuleSize; 1077 PrivateData.CapsuleNumber = (UINT64) CapsuleNumber; 1078 PrivateData.CapsuleOffset[0] = 0; 1079 // 1080 // NOTE: Only data in sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA) is valid, CapsuleOffset field is uninitialized at this moment. 1081 // The code sets partial length here for Descriptor.Length check, but later it will use full length to reserve those PrivateData region. 1082 // 1083 PrivateDataDesc[0].Union.DataBlock = (EFI_PHYSICAL_ADDRESS) (UINTN) &PrivateData; 1084 PrivateDataDesc[0].Length = sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA); 1085 PrivateDataDesc[1].Union.DataBlock = (EFI_PHYSICAL_ADDRESS) (UINTN) BlockList; 1086 PrivateDataDesc[1].Length = 0; 1087 // 1088 // Add PrivateDataDesc[0] in beginning, as it is new descriptor. PrivateDataDesc[1] is NOT needed. 1089 // In addition, one NULL terminator is added in the end. See RelocateBlockDescriptors(). 1090 // 1091 NumDescriptors += 2; 1092 // 1093 // Sanity check 1094 // 1095 if (CapsuleSize >= (MAX_ADDRESS - (sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA) + (CapsuleNumber - 1) * sizeof(UINT64) + sizeof(UINT64)))) { 1096 DEBUG ((EFI_D_ERROR, "ERROR: CapsuleSize - 0x%x\n", CapsuleSize)); 1097 return EFI_BUFFER_TOO_SMALL; 1098 } 1099 // 1100 // Need add sizeof(UINT64) for PrivateData alignment 1101 // 1102 CapsuleSize += sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA) + (CapsuleNumber - 1) * sizeof(UINT64) + sizeof(UINT64); 1103 BlockList = PrivateDataDesc; 1104 // 1105 // Sanity check 1106 // 1107 if (NumDescriptors >= (MAX_ADDRESS / sizeof(EFI_CAPSULE_BLOCK_DESCRIPTOR))) { 1108 DEBUG ((EFI_D_ERROR, "ERROR: NumDescriptors - 0x%x\n", NumDescriptors)); 1109 return EFI_BUFFER_TOO_SMALL; 1110 } 1111 DescriptorsSize = NumDescriptors * sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR); 1112 // 1113 // Sanity check 1114 // 1115 if (DescriptorsSize >= (MAX_ADDRESS - CapsuleSize)) { 1116 DEBUG ((EFI_D_ERROR, "ERROR: DescriptorsSize - 0x%lx, CapsuleSize - 0x%lx\n", (UINT64)DescriptorsSize, (UINT64)CapsuleSize)); 1117 return EFI_BUFFER_TOO_SMALL; 1118 } 1119 1120 // 1121 // Don't go below some min address. If the base is below it, 1122 // then move it up and adjust the size accordingly. 1123 // 1124 DEBUG ((EFI_D_INFO, "Capsule Memory range from 0x%8X to 0x%8X\n", (UINTN) *MemoryBase, (UINTN)*MemoryBase + *MemorySize)); 1125 if ((UINTN)*MemoryBase < (UINTN) MIN_COALESCE_ADDR) { 1126 if (((UINTN)*MemoryBase + *MemorySize) < (UINTN) MIN_COALESCE_ADDR) { 1127 DEBUG ((EFI_D_ERROR, "ERROR: *MemoryBase + *MemorySize - 0x%x\n", (UINTN)*MemoryBase + *MemorySize)); 1128 return EFI_BUFFER_TOO_SMALL; 1129 } else { 1130 *MemorySize = *MemorySize - ((UINTN) MIN_COALESCE_ADDR - (UINTN) *MemoryBase); 1131 *MemoryBase = (VOID *) (UINTN) MIN_COALESCE_ADDR; 1132 } 1133 } 1134 1135 if (*MemorySize <= (CapsuleSize + DescriptorsSize)) { 1136 DEBUG ((EFI_D_ERROR, "ERROR: CapsuleSize + DescriptorsSize - 0x%x\n", CapsuleSize + DescriptorsSize)); 1137 return EFI_BUFFER_TOO_SMALL; 1138 } 1139 1140 FreeMemBase = *MemoryBase; 1141 FreeMemSize = *MemorySize; 1142 DEBUG ((EFI_D_INFO, "Capsule Free Memory from 0x%8X to 0x%8X\n", (UINTN) FreeMemBase, (UINTN) FreeMemBase + FreeMemSize)); 1143 1144 // 1145 // Relocate all the block descriptors to low memory to make further 1146 // processing easier. 1147 // 1148 BlockList = RelocateBlockDescriptors (PeiServices, BlockList, NumDescriptors, FreeMemBase, FreeMemSize); 1149 if (BlockList == NULL) { 1150 // 1151 // Not enough room to relocate the descriptors 1152 // 1153 return EFI_BUFFER_TOO_SMALL; 1154 } 1155 1156 // 1157 // Take the top of memory for the capsule. UINT64 align up. 1158 // 1159 DestPtr = FreeMemBase + FreeMemSize - CapsuleSize; 1160 DestPtr = (UINT8 *) (((UINTN)DestPtr + sizeof (UINT64) - 1) & ~(sizeof (UINT64) - 1)); 1161 FreeMemBase = (UINT8 *) BlockList + DescriptorsSize; 1162 FreeMemSize = (UINTN) DestPtr - (UINTN) FreeMemBase; 1163 NewCapsuleBase = (VOID *) DestPtr; 1164 CapsuleImageBase = (UINT8 *)NewCapsuleBase + sizeof(EFI_CAPSULE_PEIM_PRIVATE_DATA) + (CapsuleNumber - 1) * sizeof(UINT64); 1165 1166 PrivateDataPtr = (EFI_CAPSULE_PEIM_PRIVATE_DATA *) NewCapsuleBase; 1167 1168 // 1169 // Move all the blocks to the top (high) of memory. 1170 // Relocate all the obstructing blocks. Note that the block descriptors 1171 // were coalesced when they were relocated, so we can just ++ the pointer. 1172 // 1173 CurrentBlockDesc = BlockList; 1174 while ((CurrentBlockDesc->Length != 0) || (CurrentBlockDesc->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL)) { 1175 if (CapsuleTimes == 0) { 1176 // 1177 // The first entry is the block descriptor for EFI_CAPSULE_PEIM_PRIVATE_DATA. 1178 // CapsuleOffset field is uninitialized at this time. No need copy it, but need to reserve for future use. 1179 // 1180 ASSERT (CurrentBlockDesc->Union.DataBlock == (UINT64)(UINTN)&PrivateData); 1181 DestLength = sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA) + (CapsuleNumber - 1) * sizeof(UINT64); 1182 } else { 1183 DestLength = (UINTN)CurrentBlockDesc->Length; 1184 } 1185 // 1186 // See if any of the remaining capsule blocks are in the way 1187 // 1188 TempBlockDesc = CurrentBlockDesc; 1189 while (TempBlockDesc->Length != 0) { 1190 // 1191 // Is this block in the way of where we want to copy the current descriptor to? 1192 // 1193 if (IsOverlapped ( 1194 (UINT8 *) DestPtr, 1195 (UINTN) DestLength, 1196 (UINT8 *) (UINTN) TempBlockDesc->Union.DataBlock, 1197 (UINTN) TempBlockDesc->Length 1198 )) { 1199 // 1200 // Relocate the block 1201 // 1202 RelocPtr = FindFreeMem (BlockList, FreeMemBase, FreeMemSize, (UINTN) TempBlockDesc->Length); 1203 if (RelocPtr == NULL) { 1204 return EFI_BUFFER_TOO_SMALL; 1205 } 1206 1207 CopyMem ((VOID *) RelocPtr, (VOID *) (UINTN) TempBlockDesc->Union.DataBlock, (UINTN) TempBlockDesc->Length); 1208 DEBUG ((EFI_D_INFO, "Capsule reloc data block from 0x%8X to 0x%8X with size 0x%8X\n", 1209 (UINTN) TempBlockDesc->Union.DataBlock, (UINTN) RelocPtr, (UINTN) TempBlockDesc->Length)); 1210 1211 TempBlockDesc->Union.DataBlock = (EFI_PHYSICAL_ADDRESS) (UINTN) RelocPtr; 1212 } 1213 // 1214 // Next descriptor 1215 // 1216 TempBlockDesc++; 1217 } 1218 // 1219 // Ok, we made it through. Copy the block. 1220 // we just support greping one capsule from the lists of block descs list. 1221 // 1222 CapsuleTimes ++; 1223 // 1224 //Skip the first block descriptor that filled with EFI_CAPSULE_PEIM_PRIVATE_DATA 1225 // 1226 if (CapsuleTimes > 1) { 1227 // 1228 //For every capsule entry point, check its header to determine whether to relocate it. 1229 //If it is invalid, skip it and move on to the next capsule. If it is valid, relocate it. 1230 // 1231 if (CapsuleBeginFlag) { 1232 CapsuleBeginFlag = FALSE; 1233 CapsuleHeader = (EFI_CAPSULE_HEADER*)(UINTN)CurrentBlockDesc->Union.DataBlock; 1234 SizeLeft = CapsuleHeader->CapsuleImageSize; 1235 1236 // 1237 // No more check here is needed, because IsCapsuleCorrupted() already in ValidateCapsuleIntegrity() 1238 // 1239 ASSERT (CapsuleIndex < CapsuleNumber); 1240 1241 // 1242 // Relocate this capsule 1243 // 1244 CapsuleImageSize += SizeLeft; 1245 // 1246 // Cache the begin offset of this capsule 1247 // 1248 ASSERT (PrivateDataPtr->Signature == EFI_CAPSULE_PEIM_PRIVATE_DATA_SIGNATURE); 1249 ASSERT ((UINTN)DestPtr >= (UINTN)CapsuleImageBase); 1250 PrivateDataPtr->CapsuleOffset[CapsuleIndex++] = (UINT64)((UINTN)DestPtr - (UINTN)CapsuleImageBase); 1251 } 1252 1253 // 1254 // Below ASSERT is checked in ValidateCapsuleIntegrity() 1255 // 1256 ASSERT (CurrentBlockDesc->Length <= SizeLeft); 1257 1258 CopyMem ((VOID *) DestPtr, (VOID *) (UINTN) (CurrentBlockDesc->Union.DataBlock), (UINTN)CurrentBlockDesc->Length); 1259 DEBUG ((EFI_D_INFO, "Capsule coalesce block no.0x%lX from 0x%lX to 0x%lX with size 0x%lX\n",(UINT64)CapsuleTimes, 1260 CurrentBlockDesc->Union.DataBlock, (UINT64)(UINTN)DestPtr, CurrentBlockDesc->Length)); 1261 DestPtr += CurrentBlockDesc->Length; 1262 SizeLeft -= CurrentBlockDesc->Length; 1263 1264 if (SizeLeft == 0) { 1265 // 1266 //Here is the end of the current capsule image. 1267 // 1268 CapsuleBeginFlag = TRUE; 1269 } 1270 } else { 1271 // 1272 // The first entry is the block descriptor for EFI_CAPSULE_PEIM_PRIVATE_DATA. 1273 // CapsuleOffset field is uninitialized at this time. No need copy it, but need to reserve for future use. 1274 // 1275 ASSERT (CurrentBlockDesc->Length == sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA)); 1276 ASSERT ((UINTN)DestPtr == (UINTN)NewCapsuleBase); 1277 CopyMem ((VOID *) DestPtr, (VOID *) (UINTN) CurrentBlockDesc->Union.DataBlock, (UINTN) CurrentBlockDesc->Length); 1278 DestPtr += sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA) + (CapsuleNumber - 1) * sizeof(UINT64); 1279 } 1280 // 1281 //Walk through the block descriptor list. 1282 // 1283 CurrentBlockDesc++; 1284 } 1285 // 1286 // We return the base of memory we want reserved, and the size. 1287 // The memory peim should handle it appropriately from there. 1288 // 1289 *MemorySize = (UINTN) CapsuleSize; 1290 *MemoryBase = (VOID *) NewCapsuleBase; 1291 1292 ASSERT (PrivateDataPtr->Signature == EFI_CAPSULE_PEIM_PRIVATE_DATA_SIGNATURE); 1293 ASSERT (PrivateDataPtr->CapsuleAllImageSize == CapsuleImageSize); 1294 ASSERT (PrivateDataPtr->CapsuleNumber == CapsuleIndex); 1295 1296 return EFI_SUCCESS; 1297 } 1298
