IntelSiliconPkg/Feature/Capsule/MicrocodeUpdateDxe/MicrocodeUpdate.c

   1 /** @file
   2   SetImage instance to update Microcode.
   3
   4   Caution: This module requires additional review when modified.
   5   This module will have external input - capsule image.
   6   This external input must be validated carefully to avoid security issue like
   7   buffer overflow, integer overflow.
   8
   9   MicrocodeWrite() and VerifyMicrocode() will receive untrusted input and do basic validation.
  10
  11   Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
  12   This program and the accompanying materials
  13   are licensed and made available under the terms and conditions of the BSD License
  14   which accompanies this distribution.  The full text of the license may be found at
  15   http://opensource.org/licenses/bsd-license.php
  16
  17   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  18   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  19
  20 **/
  21
  22 #include "MicrocodeUpdate.h"
  23
  24 /**
  25   Get Microcode Region.
  26
  27   @param[out] MicrocodePatchAddress      The address of Microcode
  28   @param[out] MicrocodePatchRegionSize   The region size of Microcode
  29
  30   @retval TRUE   The Microcode region is returned.
  31   @retval FALSE  No Microcode region.
  32 **/
  33 BOOLEAN
  34 GetMicrocodeRegion (
  35   OUT VOID     **MicrocodePatchAddress,
  36   OUT UINTN    *MicrocodePatchRegionSize
  37   )
  38 {
  39   *MicrocodePatchAddress = (VOID *)(UINTN)PcdGet64(PcdCpuMicrocodePatchAddress);
  40   *MicrocodePatchRegionSize = (UINTN)PcdGet64(PcdCpuMicrocodePatchRegionSize);
  41
  42   if ((*MicrocodePatchAddress == NULL) || (*MicrocodePatchRegionSize == 0)) {
  43     return FALSE;
  44   }
  45
  46   return TRUE;
  47 }
  48
  49 /**
  50   Get Microcode update signature of currently loaded Microcode update.
  51
  52   @return  Microcode signature.
  53
  54 **/
  55 UINT32
  56 GetCurrentMicrocodeSignature (
  57   VOID
  58   )
  59 {
  60   UINT64 Signature;
  61
  62   AsmWriteMsr64(MSR_IA32_BIOS_SIGN_ID, 0);
  63   AsmCpuid(CPUID_VERSION_INFO, NULL, NULL, NULL, NULL);
  64   Signature = AsmReadMsr64(MSR_IA32_BIOS_SIGN_ID);
  65   return (UINT32)RShiftU64(Signature, 32);
  66 }
  67
  68 /**
  69   Get current processor signature.
  70
  71   @return current processor signature.
  72 **/
  73 UINT32
  74 GetCurrentProcessorSignature (
  75   VOID
  76   )
  77 {
  78   UINT32                                  RegEax;
  79   AsmCpuid(CPUID_VERSION_INFO, &RegEax, NULL, NULL, NULL);
  80   return RegEax;
  81 }
  82
  83 /**
  84   Get current platform ID.
  85
  86   @return current platform ID.
  87 **/
  88 UINT8
  89 GetCurrentPlatformId (
  90   VOID
  91   )
  92 {
  93   UINT8                                   PlatformId;
  94
  95   PlatformId = (UINT8)AsmMsrBitFieldRead64(MSR_IA32_PLATFORM_ID, 50, 52);
  96   return PlatformId;
  97 }
  98
  99 /**
 100   Load new Microcode.
 101
 102   @param[in] Address  The address of new Microcode.
 103
 104   @return  Loaded Microcode signature.
 105
 106 **/
 107 UINT32
 108 LoadMicrocode (
 109   IN UINT64  Address
 110   )
 111 {
 112   AsmWriteMsr64(MSR_IA32_BIOS_UPDT_TRIG, Address);
 113   return GetCurrentMicrocodeSignature();
 114 }
 115
 116 /**
 117   Load Microcode on an Application Processor.
 118   The function prototype for invoking a function on an Application Processor.
 119
 120   @param[in,out] Buffer  The pointer to private data buffer.
 121 **/
 122 VOID
 123 EFIAPI
 124 MicrocodeLoadAp (
 125   IN OUT VOID  *Buffer
 126   )
 127 {
 128   MICROCODE_LOAD_BUFFER                *MicrocodeLoadBuffer;
 129
 130   MicrocodeLoadBuffer = Buffer;
 131   MicrocodeLoadBuffer->Revision = LoadMicrocode (MicrocodeLoadBuffer->Address);
 132 }
 133
 134 /**
 135   Load new Microcode on this processor
 136
 137   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 138   @param[in]  CpuIndex                   The index of the processor.
 139   @param[in]  Address                    The address of new Microcode.
 140
 141   @return  Loaded Microcode signature.
 142
 143 **/
 144 UINT32
 145 LoadMicrocodeOnThis (
 146   IN  MICROCODE_FMP_PRIVATE_DATA  *MicrocodeFmpPrivate,
 147   IN  UINTN                       CpuIndex,
 148   IN  UINT64                      Address
 149   )
 150 {
 151   EFI_STATUS                           Status;
 152   EFI_MP_SERVICES_PROTOCOL             *MpService;
 153   MICROCODE_LOAD_BUFFER                MicrocodeLoadBuffer;
 154
 155   if (CpuIndex == MicrocodeFmpPrivate->BspIndex) {
 156     return LoadMicrocode (Address);
 157   } else {
 158     MpService = MicrocodeFmpPrivate->MpService;
 159     MicrocodeLoadBuffer.Address = Address;
 160     MicrocodeLoadBuffer.Revision = 0;
 161     Status = MpService->StartupThisAP (
 162                           MpService,
 163                           MicrocodeLoadAp,
 164                           CpuIndex,
 165                           NULL,
 166                           0,
 167                           &MicrocodeLoadBuffer,
 168                           NULL
 169                           );
 170     ASSERT_EFI_ERROR(Status);
 171     return MicrocodeLoadBuffer.Revision;
 172   }
 173 }
 174
 175 /**
 176   Collect processor information.
 177   The function prototype for invoking a function on an Application Processor.
 178
 179   @param[in,out] Buffer  The pointer to private data buffer.
 180 **/
 181 VOID
 182 EFIAPI
 183 CollectProcessorInfo (
 184   IN OUT VOID  *Buffer
 185   )
 186 {
 187   PROCESSOR_INFO  *ProcessorInfo;
 188
 189   ProcessorInfo = Buffer;
 190   ProcessorInfo->ProcessorSignature = GetCurrentProcessorSignature();
 191   ProcessorInfo->PlatformId = GetCurrentPlatformId();
 192   ProcessorInfo->MicrocodeRevision = GetCurrentMicrocodeSignature();
 193 }
 194
 195 /**
 196   Get current Microcode information.
 197
 198   The ProcessorInformation (BspIndex/ProcessorCount/ProcessorInfo)
 199   in MicrocodeFmpPrivate must be initialized.
 200
 201   The MicrocodeInformation (DescriptorCount/ImageDescriptor/MicrocodeInfo)
 202   in MicrocodeFmpPrivate may not be avaiable in this function.
 203
 204   @param[in]   MicrocodeFmpPrivate        The Microcode driver private data
 205   @param[in]   DescriptorCount            The count of Microcode ImageDescriptor allocated.
 206   @param[out]  ImageDescriptor            Microcode ImageDescriptor
 207   @param[out]  MicrocodeInfo              Microcode information
 208
 209   @return Microcode count
 210 **/
 211 UINTN
 212 GetMicrocodeInfo (
 213   IN  MICROCODE_FMP_PRIVATE_DATA     *MicrocodeFmpPrivate,
 214   IN  UINTN                          DescriptorCount,  OPTIONAL
 215   OUT EFI_FIRMWARE_IMAGE_DESCRIPTOR  *ImageDescriptor, OPTIONAL
 216   OUT MICROCODE_INFO                 *MicrocodeInfo    OPTIONAL
 217   )
 218 {
 219   VOID                                    *MicrocodePatchAddress;
 220   UINTN                                   MicrocodePatchRegionSize;
 221   CPU_MICROCODE_HEADER                    *MicrocodeEntryPoint;
 222   UINTN                                   MicrocodeEnd;
 223   UINTN                                   TotalSize;
 224   UINTN                                   Count;
 225   UINT64                                  ImageAttributes;
 226   BOOLEAN                                 IsInUse;
 227   EFI_STATUS                              Status;
 228   UINT32                                  AttemptStatus;
 229   UINTN                                   TargetCpuIndex;
 230
 231   MicrocodePatchAddress = MicrocodeFmpPrivate->MicrocodePatchAddress;
 232   MicrocodePatchRegionSize = MicrocodeFmpPrivate->MicrocodePatchRegionSize;
 233
 234   DEBUG((DEBUG_INFO, "Microcode Region - 0x%x - 0x%x\n", MicrocodePatchAddress, MicrocodePatchRegionSize));
 235
 236   Count = 0;
 237
 238   MicrocodeEnd = (UINTN)MicrocodePatchAddress + MicrocodePatchRegionSize;
 239   MicrocodeEntryPoint = (CPU_MICROCODE_HEADER *) (UINTN) MicrocodePatchAddress;
 240   do {
 241     if (MicrocodeEntryPoint->HeaderVersion == 0x1 && MicrocodeEntryPoint->LoaderRevision == 0x1) {
 242       //
 243       // It is the microcode header. It is not the padding data between microcode patches
 244       // becasue the padding data should not include 0x00000001 and it should be the repeated
 245       // byte format (like 0xXYXYXYXY....).
 246       //
 247       if (MicrocodeEntryPoint->DataSize == 0) {
 248         TotalSize = 2048;
 249       } else {
 250         TotalSize = MicrocodeEntryPoint->TotalSize;
 251       }
 252
 253       TargetCpuIndex = (UINTN)-1;
 254       Status = VerifyMicrocode(MicrocodeFmpPrivate, MicrocodeEntryPoint, TotalSize, FALSE, &AttemptStatus, NULL, &TargetCpuIndex);
 255       if (!EFI_ERROR(Status)) {
 256         IsInUse = TRUE;
 257         ASSERT (TargetCpuIndex < MicrocodeFmpPrivate->ProcessorCount);
 258         MicrocodeFmpPrivate->ProcessorInfo[TargetCpuIndex].MicrocodeIndex = Count;
 259       } else {
 260         IsInUse = FALSE;
 261       }
 262
 263       if (ImageDescriptor != NULL && DescriptorCount > Count) {
 264         ImageDescriptor[Count].ImageIndex = (UINT8)(Count + 1);
 265         CopyGuid (&ImageDescriptor[Count].ImageTypeId, &gMicrocodeFmpImageTypeIdGuid);
 266         ImageDescriptor[Count].ImageId = LShiftU64(MicrocodeEntryPoint->ProcessorFlags, 32) + MicrocodeEntryPoint->ProcessorSignature.Uint32;
 267         ImageDescriptor[Count].ImageIdName = NULL;
 268         ImageDescriptor[Count].Version = MicrocodeEntryPoint->UpdateRevision;
 269         ImageDescriptor[Count].VersionName = NULL;
 270         ImageDescriptor[Count].Size = TotalSize;
 271         ImageAttributes = IMAGE_ATTRIBUTE_IMAGE_UPDATABLE | IMAGE_ATTRIBUTE_RESET_REQUIRED;
 272         if (IsInUse) {
 273           ImageAttributes |= IMAGE_ATTRIBUTE_IN_USE;
 274         }
 275         ImageDescriptor[Count].AttributesSupported = ImageAttributes | IMAGE_ATTRIBUTE_IN_USE;
 276         ImageDescriptor[Count].AttributesSetting = ImageAttributes;
 277         ImageDescriptor[Count].Compatibilities = 0;
 278         ImageDescriptor[Count].LowestSupportedImageVersion = MicrocodeEntryPoint->UpdateRevision; // do not support rollback
 279         ImageDescriptor[Count].LastAttemptVersion = 0;
 280         ImageDescriptor[Count].LastAttemptStatus = 0;
 281         ImageDescriptor[Count].HardwareInstance = 0;
 282       }
 283       if (MicrocodeInfo != NULL && DescriptorCount > Count) {
 284         MicrocodeInfo[Count].MicrocodeEntryPoint = MicrocodeEntryPoint;
 285         MicrocodeInfo[Count].TotalSize = TotalSize;
 286         MicrocodeInfo[Count].InUse = IsInUse;
 287       }
 288     } else {
 289       //
 290       // It is the padding data between the microcode patches for microcode patches alignment.
 291       // Because the microcode patch is the multiple of 1-KByte, the padding data should not
 292       // exist if the microcode patch alignment value is not larger than 1-KByte. So, the microcode
 293       // alignment value should be larger than 1-KByte. We could skip SIZE_1KB padding data to
 294       // find the next possible microcode patch header.
 295       //
 296       MicrocodeEntryPoint = (CPU_MICROCODE_HEADER *) (((UINTN) MicrocodeEntryPoint) + SIZE_1KB);
 297       continue;
 298     }
 299
 300     Count++;
 301     ASSERT(Count < 0xFF);
 302
 303     //
 304     // Get the next patch.
 305     //
 306     MicrocodeEntryPoint = (CPU_MICROCODE_HEADER *) (((UINTN) MicrocodeEntryPoint) + TotalSize);
 307   } while (((UINTN) MicrocodeEntryPoint < MicrocodeEnd));
 308
 309   return Count;
 310 }
 311
 312 /**
 313   Return matched processor information.
 314
 315   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 316   @param[in]  ProcessorSignature         The processor signature to be matched
 317   @param[in]  ProcessorFlags             The processor flags to be matched
 318   @param[in, out] TargetCpuIndex         On input, the index of target CPU which tries to match the Microcode. (UINTN)-1 means to try all.
 319                                          On output, the index of target CPU which matches the Microcode.
 320
 321   @return matched processor information.
 322 **/
 323 PROCESSOR_INFO *
 324 GetMatchedProcessor (
 325   IN MICROCODE_FMP_PRIVATE_DATA  *MicrocodeFmpPrivate,
 326   IN UINT32                      ProcessorSignature,
 327   IN UINT32                      ProcessorFlags,
 328   IN OUT UINTN                   *TargetCpuIndex
 329   )
 330 {
 331   UINTN  Index;
 332
 333   if (*TargetCpuIndex != (UINTN)-1) {
 334     Index = *TargetCpuIndex;
 335     if ((ProcessorSignature == MicrocodeFmpPrivate->ProcessorInfo[Index].ProcessorSignature) &&
 336         ((ProcessorFlags & (1 << MicrocodeFmpPrivate->ProcessorInfo[Index].PlatformId)) != 0)) {
 337       return &MicrocodeFmpPrivate->ProcessorInfo[Index];
 338     } else {
 339       return NULL;
 340     }
 341   }
 342
 343   for (Index = 0; Index < MicrocodeFmpPrivate->ProcessorCount; Index++) {
 344     if ((ProcessorSignature == MicrocodeFmpPrivate->ProcessorInfo[Index].ProcessorSignature) &&
 345         ((ProcessorFlags & (1 << MicrocodeFmpPrivate->ProcessorInfo[Index].PlatformId)) != 0)) {
 346       *TargetCpuIndex = Index;
 347       return &MicrocodeFmpPrivate->ProcessorInfo[Index];
 348     }
 349   }
 350   return NULL;
 351 }
 352
 353 /**
 354   Verify Microcode.
 355
 356   Caution: This function may receive untrusted input.
 357
 358   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 359   @param[in]  Image                      The Microcode image buffer.
 360   @param[in]  ImageSize                  The size of Microcode image buffer in bytes.
 361   @param[in]  TryLoad                    Try to load Microcode or not.
 362   @param[out] LastAttemptStatus          The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 363   @param[out] AbortReason                A pointer to a pointer to a null-terminated string providing more
 364                                          details for the aborted operation. The buffer is allocated by this function
 365                                          with AllocatePool(), and it is the caller's responsibility to free it with a
 366                                          call to FreePool().
 367   @param[in, out] TargetCpuIndex         On input, the index of target CPU which tries to match the Microcode. (UINTN)-1 means to try all.
 368                                          On output, the index of target CPU which matches the Microcode.
 369
 370   @retval EFI_SUCCESS               The Microcode image passes verification.
 371   @retval EFI_VOLUME_CORRUPTED      The Microcode image is corrupted.
 372   @retval EFI_INCOMPATIBLE_VERSION  The Microcode image version is incorrect.
 373   @retval EFI_UNSUPPORTED           The Microcode ProcessorSignature or ProcessorFlags is incorrect.
 374   @retval EFI_SECURITY_VIOLATION    The Microcode image fails to load.
 375 **/
 376 EFI_STATUS
 377 VerifyMicrocode (
 378   IN  MICROCODE_FMP_PRIVATE_DATA  *MicrocodeFmpPrivate,
 379   IN  VOID                        *Image,
 380   IN  UINTN                       ImageSize,
 381   IN  BOOLEAN                     TryLoad,
 382   OUT UINT32                      *LastAttemptStatus,
 383   OUT CHAR16                      **AbortReason,   OPTIONAL
 384   IN OUT UINTN                    *TargetCpuIndex
 385   )
 386 {
 387   UINTN                                   Index;
 388   CPU_MICROCODE_HEADER                    *MicrocodeEntryPoint;
 389   UINTN                                   TotalSize;
 390   UINTN                                   DataSize;
 391   UINT32                                  CurrentRevision;
 392   PROCESSOR_INFO                          *ProcessorInfo;
 393   UINT32                                  CheckSum32;
 394   UINTN                                   ExtendedTableLength;
 395   UINT32                                  ExtendedTableCount;
 396   CPU_MICROCODE_EXTENDED_TABLE            *ExtendedTable;
 397   CPU_MICROCODE_EXTENDED_TABLE_HEADER     *ExtendedTableHeader;
 398   BOOLEAN                                 CorrectMicrocode;
 399
 400   //
 401   // Check HeaderVersion
 402   //
 403   MicrocodeEntryPoint = Image;
 404   if (MicrocodeEntryPoint->HeaderVersion != 0x1) {
 405     DEBUG((DEBUG_ERROR, "VerifyMicrocode - fail on HeaderVersion\n"));
 406     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 407     if (AbortReason != NULL) {
 408       *AbortReason = AllocateCopyPool(sizeof(L"InvalidHeaderVersion"), L"InvalidHeaderVersion");
 409     }
 410     return EFI_INCOMPATIBLE_VERSION;
 411   }
 412   //
 413   // Check LoaderRevision
 414   //
 415   if (MicrocodeEntryPoint->LoaderRevision != 0x1) {
 416     DEBUG((DEBUG_ERROR, "VerifyMicrocode - fail on LoaderRevision\n"));
 417     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 418     if (AbortReason != NULL) {
 419       *AbortReason = AllocateCopyPool(sizeof(L"InvalidLoaderVersion"), L"InvalidLoaderVersion");
 420     }
 421     return EFI_INCOMPATIBLE_VERSION;
 422   }
 423   //
 424   // Check TotalSize
 425   //
 426   if (MicrocodeEntryPoint->DataSize == 0) {
 427     TotalSize = 2048;
 428   } else {
 429     TotalSize = MicrocodeEntryPoint->TotalSize;
 430   }
 431   if (TotalSize <= sizeof(CPU_MICROCODE_HEADER)) {
 432     DEBUG((DEBUG_ERROR, "VerifyMicrocode - TotalSize too small\n"));
 433     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 434     if (AbortReason != NULL) {
 435       *AbortReason = AllocateCopyPool(sizeof(L"InvalidTotalSize"), L"InvalidTotalSize");
 436     }
 437     return EFI_VOLUME_CORRUPTED;
 438   }
 439   if ((TotalSize & (SIZE_1KB - 1)) != 0) {
 440     DEBUG((DEBUG_ERROR, "VerifyMicrocode - TotalSize is not multiples of 1024 bytes (1 KBytes)\n"));
 441     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 442     if (AbortReason != NULL) {
 443       *AbortReason = AllocateCopyPool(sizeof(L"InvalidTotalSize"), L"InvalidTotalSize");
 444     }
 445     return EFI_VOLUME_CORRUPTED;
 446   }
 447   if (TotalSize != ImageSize) {
 448     DEBUG((DEBUG_ERROR, "VerifyMicrocode - TotalSize not equal to ImageSize\n"));
 449     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 450     if (AbortReason != NULL) {
 451       *AbortReason = AllocateCopyPool(sizeof(L"InvalidTotalSize"), L"InvalidTotalSize");
 452     }
 453     return EFI_VOLUME_CORRUPTED;
 454   }
 455   //
 456   // Check DataSize
 457   //
 458   if (MicrocodeEntryPoint->DataSize == 0) {
 459     DataSize = 2048 - sizeof(CPU_MICROCODE_HEADER);
 460   } else {
 461     DataSize = MicrocodeEntryPoint->DataSize;
 462   }
 463   if (DataSize > TotalSize - sizeof(CPU_MICROCODE_HEADER)) {
 464     DEBUG((DEBUG_ERROR, "VerifyMicrocode - DataSize too big\n"));
 465     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 466     if (AbortReason != NULL) {
 467       *AbortReason = AllocateCopyPool(sizeof(L"InvalidDataSize"), L"InvalidDataSize");
 468     }
 469     return EFI_VOLUME_CORRUPTED;
 470   }
 471   if ((DataSize & 0x3) != 0) {
 472     DEBUG((DEBUG_ERROR, "VerifyMicrocode - DataSize is not multiples of DWORDs\n"));
 473     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 474     if (AbortReason != NULL) {
 475       *AbortReason = AllocateCopyPool(sizeof(L"InvalidDataSize"), L"InvalidDataSize");
 476     }
 477     return EFI_VOLUME_CORRUPTED;
 478   }
 479   //
 480   // Check CheckSum32
 481   //
 482   CheckSum32 = CalculateSum32((UINT32 *)MicrocodeEntryPoint, DataSize + sizeof(CPU_MICROCODE_HEADER));
 483   if (CheckSum32 != 0) {
 484     DEBUG((DEBUG_ERROR, "VerifyMicrocode - fail on CheckSum32\n"));
 485     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 486     if (AbortReason != NULL) {
 487       *AbortReason = AllocateCopyPool(sizeof(L"InvalidChecksum"), L"InvalidChecksum");
 488     }
 489     return EFI_VOLUME_CORRUPTED;
 490   }
 491
 492   //
 493   // Check ProcessorSignature/ProcessorFlags
 494   //
 495
 496   ProcessorInfo = GetMatchedProcessor (MicrocodeFmpPrivate, MicrocodeEntryPoint->ProcessorSignature.Uint32, MicrocodeEntryPoint->ProcessorFlags, TargetCpuIndex);
 497   if (ProcessorInfo == NULL) {
 498     CorrectMicrocode = FALSE;
 499     ExtendedTableLength = TotalSize - (DataSize + sizeof(CPU_MICROCODE_HEADER));
 500     if (ExtendedTableLength != 0) {
 501       //
 502       // Extended Table exist, check if the CPU in support list
 503       //
 504       ExtendedTableHeader = (CPU_MICROCODE_EXTENDED_TABLE_HEADER *)((UINT8 *)(MicrocodeEntryPoint) + DataSize + sizeof(CPU_MICROCODE_HEADER));
 505       //
 506       // Calculate Extended Checksum
 507       //
 508       if ((ExtendedTableLength > sizeof(CPU_MICROCODE_EXTENDED_TABLE_HEADER)) && ((ExtendedTableLength & 0x3) == 0)) {
 509         CheckSum32 = CalculateSum32((UINT32 *)ExtendedTableHeader, ExtendedTableLength);
 510         if (CheckSum32 != 0) {
 511           //
 512           // Checksum incorrect
 513           //
 514           DEBUG((DEBUG_ERROR, "VerifyMicrocode - The checksum for extended table is incorrect\n"));
 515         } else {
 516           //
 517           // Checksum correct
 518           //
 519           ExtendedTableCount = ExtendedTableHeader->ExtendedSignatureCount;
 520           if (ExtendedTableCount > (ExtendedTableLength - sizeof(CPU_MICROCODE_EXTENDED_TABLE_HEADER)) / sizeof(CPU_MICROCODE_EXTENDED_TABLE)) {
 521             DEBUG((DEBUG_ERROR, "VerifyMicrocode - ExtendedTableCount too big\n"));
 522           } else {
 523             ExtendedTable = (CPU_MICROCODE_EXTENDED_TABLE *)(ExtendedTableHeader + 1);
 524             for (Index = 0; Index < ExtendedTableCount; Index++) {
 525               CheckSum32 = CalculateSum32((UINT32 *)ExtendedTable, sizeof(CPU_MICROCODE_EXTENDED_TABLE));
 526               if (CheckSum32 != 0) {
 527                 DEBUG((DEBUG_ERROR, "VerifyMicrocode - The checksum for ExtendedTable entry with index 0x%x is incorrect\n", Index));
 528               } else {
 529                 //
 530                 // Verify Header
 531                 //
 532                 ProcessorInfo = GetMatchedProcessor (MicrocodeFmpPrivate, ExtendedTable->ProcessorSignature.Uint32, ExtendedTable->ProcessorFlag, TargetCpuIndex);
 533                 if (ProcessorInfo != NULL) {
 534                   //
 535                   // Find one
 536                   //
 537                   CorrectMicrocode = TRUE;
 538                   break;
 539                 }
 540               }
 541               ExtendedTable++;
 542             }
 543           }
 544         }
 545       }
 546     }
 547     if (!CorrectMicrocode) {
 548       if (TryLoad) {
 549         DEBUG((DEBUG_ERROR, "VerifyMicrocode - fail on Current ProcessorSignature/ProcessorFlags\n"));
 550       }
 551       *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INCORRECT_VERSION;
 552       if (AbortReason != NULL) {
 553         *AbortReason = AllocateCopyPool(sizeof(L"UnsupportedProcessorSignature/ProcessorFlags"), L"UnsupportedProcessorSignature/ProcessorFlags");
 554       }
 555       return EFI_UNSUPPORTED;
 556     }
 557   }
 558
 559   //
 560   // Check UpdateRevision
 561   //
 562   CurrentRevision = ProcessorInfo->MicrocodeRevision;
 563   if ((MicrocodeEntryPoint->UpdateRevision < CurrentRevision) ||
 564       (TryLoad && (MicrocodeEntryPoint->UpdateRevision == CurrentRevision))) {
 565     if (TryLoad) {
 566       DEBUG((DEBUG_ERROR, "VerifyMicrocode - fail on UpdateRevision\n"));
 567     }
 568     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INCORRECT_VERSION;
 569     if (AbortReason != NULL) {
 570       *AbortReason = AllocateCopyPool(sizeof(L"IncorrectRevision"), L"IncorrectRevision");
 571     }
 572     return EFI_INCOMPATIBLE_VERSION;
 573   }
 574
 575   //
 576   // try load MCU
 577   //
 578   if (TryLoad) {
 579     CurrentRevision = LoadMicrocodeOnThis(MicrocodeFmpPrivate, ProcessorInfo->CpuIndex, (UINTN)MicrocodeEntryPoint + sizeof(CPU_MICROCODE_HEADER));
 580     if (MicrocodeEntryPoint->UpdateRevision != CurrentRevision) {
 581       DEBUG((DEBUG_ERROR, "VerifyMicrocode - fail on LoadMicrocode\n"));
 582       *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_AUTH_ERROR;
 583       if (AbortReason != NULL) {
 584         *AbortReason = AllocateCopyPool(sizeof(L"InvalidData"), L"InvalidData");
 585       }
 586       return EFI_SECURITY_VIOLATION;
 587     }
 588   }
 589
 590   return EFI_SUCCESS;
 591 }
 592
 593 /**
 594   Get next Microcode entrypoint.
 595
 596   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 597   @param[in]  MicrocodeEntryPoint        Current Microcode entrypoint
 598
 599   @return next Microcode entrypoint.
 600 **/
 601 CPU_MICROCODE_HEADER *
 602 GetNextMicrocode (
 603   IN MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate,
 604   IN CPU_MICROCODE_HEADER                    *MicrocodeEntryPoint
 605   )
 606 {
 607   UINTN                                   Index;
 608
 609   for (Index = 0; Index < MicrocodeFmpPrivate->DescriptorCount; Index++) {
 610     if (MicrocodeEntryPoint == MicrocodeFmpPrivate->MicrocodeInfo[Index].MicrocodeEntryPoint) {
 611       if (Index == (UINTN)MicrocodeFmpPrivate->DescriptorCount - 1) {
 612         // it is last one
 613         return NULL;
 614       } else {
 615         // return next one
 616         return MicrocodeFmpPrivate->MicrocodeInfo[Index + 1].MicrocodeEntryPoint;
 617       }
 618     }
 619   }
 620
 621   ASSERT(FALSE);
 622   return NULL;
 623 }
 624
 625 /**
 626   Get next FIT Microcode entrypoint.
 627
 628   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 629   @param[in]  MicrocodeEntryPoint        Current Microcode entrypoint
 630
 631   @return next FIT Microcode entrypoint.
 632 **/
 633 CPU_MICROCODE_HEADER *
 634 GetNextFitMicrocode (
 635   IN MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate,
 636   IN CPU_MICROCODE_HEADER                    *MicrocodeEntryPoint
 637   )
 638 {
 639   UINTN                                   Index;
 640
 641   for (Index = 0; Index < MicrocodeFmpPrivate->FitMicrocodeEntryCount; Index++) {
 642     if (MicrocodeEntryPoint == MicrocodeFmpPrivate->FitMicrocodeInfo[Index].MicrocodeEntryPoint) {
 643       if (Index == (UINTN) MicrocodeFmpPrivate->FitMicrocodeEntryCount - 1) {
 644         // it is last one
 645         return NULL;
 646       } else {
 647         // return next one
 648         return MicrocodeFmpPrivate->FitMicrocodeInfo[Index + 1].MicrocodeEntryPoint;
 649       }
 650     }
 651   }
 652
 653   ASSERT(FALSE);
 654   return NULL;
 655 }
 656
 657 /**
 658   Find empty FIT Microcode entrypoint.
 659
 660   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 661   @param[in]  ImageSize                  The size of Microcode image buffer in bytes.
 662   @param[out] AvailableSize              Available size of the empty FIT Microcode entrypoint.
 663
 664   @return Empty FIT Microcode entrypoint.
 665 **/
 666 CPU_MICROCODE_HEADER *
 667 FindEmptyFitMicrocode (
 668   IN MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate,
 669   IN UINTN                                   ImageSize,
 670   OUT UINTN                                  *AvailableSize
 671   )
 672 {
 673   UINTN                                   Index;
 674   CPU_MICROCODE_HEADER                    *MicrocodeEntryPoint;
 675   CPU_MICROCODE_HEADER                    *NextMicrocodeEntryPoint;
 676   VOID                                    *MicrocodePatchAddress;
 677   UINTN                                   MicrocodePatchRegionSize;
 678
 679   MicrocodePatchAddress = MicrocodeFmpPrivate->MicrocodePatchAddress;
 680   MicrocodePatchRegionSize = MicrocodeFmpPrivate->MicrocodePatchRegionSize;
 681
 682   for (Index = 0; Index < MicrocodeFmpPrivate->FitMicrocodeEntryCount; Index++) {
 683     if (MicrocodeFmpPrivate->FitMicrocodeInfo[Index].Empty) {
 684       MicrocodeEntryPoint = MicrocodeFmpPrivate->FitMicrocodeInfo[Index].MicrocodeEntryPoint;
 685       NextMicrocodeEntryPoint = GetNextFitMicrocode (MicrocodeFmpPrivate, MicrocodeEntryPoint);
 686       if (NextMicrocodeEntryPoint != NULL) {
 687         *AvailableSize = (UINTN) NextMicrocodeEntryPoint - (UINTN) MicrocodeEntryPoint;
 688       } else {
 689         *AvailableSize = (UINTN) MicrocodePatchAddress + MicrocodePatchRegionSize - (UINTN) MicrocodeEntryPoint;
 690       }
 691       if (*AvailableSize >= ImageSize) {
 692         return MicrocodeEntryPoint;
 693       }
 694     }
 695   }
 696
 697   return NULL;
 698 }
 699
 700 /**
 701   Find unused FIT Microcode entrypoint.
 702
 703   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 704   @param[in]  ImageSize                  The size of Microcode image buffer in bytes.
 705   @param[out] AvailableSize              Available size of the unused FIT Microcode entrypoint.
 706
 707   @return Unused FIT Microcode entrypoint.
 708 **/
 709 CPU_MICROCODE_HEADER *
 710 FindUnusedFitMicrocode (
 711   IN MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate,
 712   IN UINTN                                   ImageSize,
 713   OUT UINTN                                  *AvailableSize
 714   )
 715 {
 716   UINTN                                   Index;
 717   CPU_MICROCODE_HEADER                    *MicrocodeEntryPoint;
 718   CPU_MICROCODE_HEADER                    *NextMicrocodeEntryPoint;
 719   VOID                                    *MicrocodePatchAddress;
 720   UINTN                                   MicrocodePatchRegionSize;
 721
 722   MicrocodePatchAddress = MicrocodeFmpPrivate->MicrocodePatchAddress;
 723   MicrocodePatchRegionSize = MicrocodeFmpPrivate->MicrocodePatchRegionSize;
 724
 725   for (Index = 0; Index < MicrocodeFmpPrivate->FitMicrocodeEntryCount; Index++) {
 726     if (!MicrocodeFmpPrivate->FitMicrocodeInfo[Index].InUse) {
 727       MicrocodeEntryPoint = MicrocodeFmpPrivate->FitMicrocodeInfo[Index].MicrocodeEntryPoint;
 728       NextMicrocodeEntryPoint = GetNextFitMicrocode (MicrocodeFmpPrivate, MicrocodeEntryPoint);
 729       if (NextMicrocodeEntryPoint != NULL) {
 730         *AvailableSize = (UINTN) NextMicrocodeEntryPoint - (UINTN) MicrocodeEntryPoint;
 731       } else {
 732         *AvailableSize = (UINTN) MicrocodePatchAddress + MicrocodePatchRegionSize - (UINTN) MicrocodeEntryPoint;
 733       }
 734       if (*AvailableSize >= ImageSize) {
 735         return MicrocodeEntryPoint;
 736       }
 737     }
 738   }
 739
 740   return NULL;
 741 }
 742
 743 /**
 744   Get current Microcode used region size.
 745
 746   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 747
 748   @return current Microcode used region size.
 749 **/
 750 UINTN
 751 GetCurrentMicrocodeUsedRegionSize (
 752   IN MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate
 753   )
 754 {
 755   if (MicrocodeFmpPrivate->DescriptorCount == 0) {
 756     return 0;
 757   }
 758
 759   return (UINTN)MicrocodeFmpPrivate->MicrocodeInfo[MicrocodeFmpPrivate->DescriptorCount - 1].MicrocodeEntryPoint
 760          + (UINTN)MicrocodeFmpPrivate->MicrocodeInfo[MicrocodeFmpPrivate->DescriptorCount - 1].TotalSize
 761          - (UINTN)MicrocodeFmpPrivate->MicrocodePatchAddress;
 762 }
 763
 764 /**
 765   Update Microcode.
 766
 767   @param[in]   Address            The flash address of Microcode.
 768   @param[in]   Image              The Microcode image buffer.
 769   @param[in]   ImageSize          The size of Microcode image buffer in bytes.
 770   @param[out]  LastAttemptStatus  The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 771
 772   @retval EFI_SUCCESS           The Microcode image is updated.
 773   @retval EFI_WRITE_PROTECTED   The flash device is read only.
 774 **/
 775 EFI_STATUS
 776 UpdateMicrocode (
 777   IN UINT64   Address,
 778   IN VOID     *Image,
 779   IN UINTN    ImageSize,
 780   OUT UINT32  *LastAttemptStatus
 781   )
 782 {
 783   EFI_STATUS  Status;
 784
 785   DEBUG((DEBUG_INFO, "PlatformUpdate:"));
 786   DEBUG((DEBUG_INFO, "  Address - 0x%lx,", Address));
 787   DEBUG((DEBUG_INFO, "  Length - 0x%x\n", ImageSize));
 788
 789   Status = MicrocodeFlashWrite (
 790              Address,
 791              Image,
 792              ImageSize
 793              );
 794   if (!EFI_ERROR(Status)) {
 795     *LastAttemptStatus = LAST_ATTEMPT_STATUS_SUCCESS;
 796   } else {
 797     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_UNSUCCESSFUL;
 798   }
 799   return Status;
 800 }
 801
 802 /**
 803   Update Microcode flash region with FIT.
 804
 805   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 806   @param[in]  TargetMicrocodeEntryPoint  Target Microcode entrypoint to be updated
 807   @param[in]  Image                      The Microcode image buffer.
 808   @param[in]  ImageSize                  The size of Microcode image buffer in bytes.
 809   @param[out] LastAttemptStatus          The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 810
 811   @retval EFI_SUCCESS             The Microcode image is written.
 812   @retval EFI_WRITE_PROTECTED     The flash device is read only.
 813 **/
 814 EFI_STATUS
 815 UpdateMicrocodeFlashRegionWithFit (
 816   IN  MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate,
 817   IN  CPU_MICROCODE_HEADER                    *TargetMicrocodeEntryPoint,
 818   IN  VOID                                    *Image,
 819   IN  UINTN                                   ImageSize,
 820   OUT UINT32                                  *LastAttemptStatus
 821   )
 822 {
 823   VOID                                    *MicrocodePatchAddress;
 824   UINTN                                   MicrocodePatchRegionSize;
 825   UINTN                                   TargetTotalSize;
 826   EFI_STATUS                              Status;
 827   VOID                                    *MicrocodePatchScratchBuffer;
 828   UINT8                                   *ScratchBufferPtr;
 829   UINTN                                   ScratchBufferSize;
 830   UINTN                                   RestSize;
 831   UINTN                                   AvailableSize;
 832   VOID                                    *NextMicrocodeEntryPoint;
 833   VOID                                    *EmptyFitMicrocodeEntry;
 834   VOID                                    *UnusedFitMicrocodeEntry;
 835
 836   DEBUG((DEBUG_INFO, "UpdateMicrocodeFlashRegionWithFit: Image - 0x%x, size - 0x%x\n", Image, ImageSize));
 837
 838   MicrocodePatchAddress = MicrocodeFmpPrivate->MicrocodePatchAddress;
 839   MicrocodePatchRegionSize = MicrocodeFmpPrivate->MicrocodePatchRegionSize;
 840
 841   MicrocodePatchScratchBuffer = AllocateZeroPool (MicrocodePatchRegionSize);
 842   if (MicrocodePatchScratchBuffer == NULL) {
 843     DEBUG((DEBUG_ERROR, "Fail to allocate Microcode Scratch buffer\n"));
 844     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
 845     return EFI_OUT_OF_RESOURCES;
 846   }
 847   ScratchBufferPtr = MicrocodePatchScratchBuffer;
 848   ScratchBufferSize = 0;
 849
 850   //
 851   // Target data collection
 852   //
 853   TargetTotalSize = 0;
 854   AvailableSize = 0;
 855   if (TargetMicrocodeEntryPoint != NULL) {
 856     if (TargetMicrocodeEntryPoint->DataSize == 0) {
 857       TargetTotalSize = 2048;
 858     } else {
 859       TargetTotalSize = TargetMicrocodeEntryPoint->TotalSize;
 860     }
 861     DEBUG((DEBUG_INFO, "  TargetTotalSize - 0x%x\n", TargetTotalSize));
 862     NextMicrocodeEntryPoint = GetNextFitMicrocode (MicrocodeFmpPrivate, TargetMicrocodeEntryPoint);
 863     DEBUG((DEBUG_INFO, "  NextMicrocodeEntryPoint - 0x%x\n", NextMicrocodeEntryPoint));
 864     if (NextMicrocodeEntryPoint != NULL) {
 865       ASSERT ((UINTN) NextMicrocodeEntryPoint >= ((UINTN) TargetMicrocodeEntryPoint + TargetTotalSize));
 866       AvailableSize = (UINTN) NextMicrocodeEntryPoint - (UINTN) TargetMicrocodeEntryPoint;
 867     } else {
 868       AvailableSize = (UINTN) MicrocodePatchAddress + MicrocodePatchRegionSize - (UINTN) TargetMicrocodeEntryPoint;
 869     }
 870     DEBUG((DEBUG_INFO, "  AvailableSize - 0x%x\n", AvailableSize));
 871     ASSERT (AvailableSize >= TargetTotalSize);
 872   }
 873   //
 874   // Total Size means the Microcode size.
 875   // Available Size means the Microcode size plus the pad till (1) next Microcode or (2) the end.
 876   //
 877   // (1)
 878   // +------+-----------+-----+------+===================+
 879   // | MCU1 | Microcode | PAD | MCU2 |      Empty        |
 880   // +------+-----------+-----+------+===================+
 881   //        | TotalSize |
 882   //        |<-AvailableSize->|
 883   //
 884   // (2)
 885   // +------+-----------+===================+
 886   // | MCU  | Microcode |      Empty        |
 887   // +------+-----------+===================+
 888   //        | TotalSize |
 889   //        |<-      AvailableSize        ->|
 890   //
 891
 892   //
 893   // Update based on policy
 894   //
 895
 896   //
 897   // 1. If there is enough space to update old one in situ, replace old microcode in situ.
 898   //
 899   if (AvailableSize >= ImageSize) {
 900     DEBUG((DEBUG_INFO, "Replace old microcode in situ\n"));
 901     //
 902     // +------+------------+------+===================+
 903     // |Other | Old Image  | ...  |      Empty        |
 904     // +------+------------+------+===================+
 905     //
 906     // +------+---------+--+------+===================+
 907     // |Other |New Image|FF| ...  |      Empty        |
 908     // +------+---------+--+------+===================+
 909     //
 910     // 1.1. Copy new image
 911     CopyMem (ScratchBufferPtr, Image, ImageSize);
 912     ScratchBufferSize += ImageSize;
 913     ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
 914     // 1.2. Pad 0xFF
 915     RestSize = AvailableSize - ImageSize;
 916     if (RestSize > 0) {
 917       SetMem (ScratchBufferPtr, RestSize, 0xFF);
 918       ScratchBufferSize += RestSize;
 919       ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
 920     }
 921     Status = UpdateMicrocode((UINTN)TargetMicrocodeEntryPoint, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
 922     return Status;
 923   }
 924
 925   //
 926   // 2. If there is empty FIT microcode entry with enough space, use it.
 927   //
 928   EmptyFitMicrocodeEntry = FindEmptyFitMicrocode (MicrocodeFmpPrivate, ImageSize, &AvailableSize);
 929   if (EmptyFitMicrocodeEntry != NULL) {
 930     DEBUG((DEBUG_INFO, "Use empty FIT microcode entry\n"));
 931     // 2.1. Copy new image
 932     CopyMem (ScratchBufferPtr, Image, ImageSize);
 933     ScratchBufferSize += ImageSize;
 934     ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
 935     // 2.2. Pad 0xFF
 936     RestSize = AvailableSize - ImageSize;
 937     if (RestSize > 0) {
 938       SetMem (ScratchBufferPtr, RestSize, 0xFF);
 939       ScratchBufferSize += RestSize;
 940       ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
 941     }
 942     Status = UpdateMicrocode ((UINTN) EmptyFitMicrocodeEntry, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
 943     if (!EFI_ERROR (Status) && (TargetMicrocodeEntryPoint != NULL)) {
 944       //
 945       // Empty old microcode.
 946       //
 947       ScratchBufferPtr = MicrocodePatchScratchBuffer;
 948       SetMem (ScratchBufferPtr, TargetTotalSize, 0xFF);
 949       ScratchBufferSize = TargetTotalSize;
 950       ScratchBufferPtr = (UINT8 *) MicrocodePatchScratchBuffer + ScratchBufferSize;
 951       UpdateMicrocode ((UINTN) TargetMicrocodeEntryPoint, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
 952     }
 953     return Status;
 954   }
 955
 956   //
 957   // 3. If there is unused microcode entry with enough space, use it.
 958   //
 959   UnusedFitMicrocodeEntry = FindUnusedFitMicrocode (MicrocodeFmpPrivate, ImageSize, &AvailableSize);
 960   if (UnusedFitMicrocodeEntry != NULL) {
 961     DEBUG((DEBUG_INFO, "Use unused FIT microcode entry\n"));
 962     // 3.1. Copy new image
 963     CopyMem (ScratchBufferPtr, Image, ImageSize);
 964     ScratchBufferSize += ImageSize;
 965     ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
 966     // 3.2. Pad 0xFF
 967     RestSize = AvailableSize - ImageSize;
 968     if (RestSize > 0) {
 969       SetMem (ScratchBufferPtr, RestSize, 0xFF);
 970       ScratchBufferSize += RestSize;
 971       ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
 972     }
 973     Status = UpdateMicrocode ((UINTN) UnusedFitMicrocodeEntry, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
 974     if (!EFI_ERROR (Status) && (TargetMicrocodeEntryPoint != NULL)) {
 975       //
 976       // Empty old microcode.
 977       //
 978       ScratchBufferPtr = MicrocodePatchScratchBuffer;
 979       SetMem (ScratchBufferPtr, TargetTotalSize, 0xFF);
 980       ScratchBufferSize = TargetTotalSize;
 981       ScratchBufferPtr = (UINT8 *) MicrocodePatchScratchBuffer + ScratchBufferSize;
 982       UpdateMicrocode ((UINTN) TargetMicrocodeEntryPoint, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
 983     }
 984     return Status;
 985   }
 986
 987   //
 988   // 4. No usable FIT microcode entry.
 989   //
 990   DEBUG((DEBUG_ERROR, "No usable FIT microcode entry\n"));
 991   *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
 992   Status = EFI_OUT_OF_RESOURCES;
 993
 994   return Status;
 995 }
 996
 997 /**
 998   Update Microcode flash region.
 999
1000   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
1001   @param[in]  TargetMicrocodeEntryPoint  Target Microcode entrypoint to be updated
1002   @param[in]  Image                      The Microcode image buffer.
1003   @param[in]  ImageSize                  The size of Microcode image buffer in bytes.
1004   @param[out] LastAttemptStatus          The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
1005
1006   @retval EFI_SUCCESS             The Microcode image is written.
1007   @retval EFI_WRITE_PROTECTED     The flash device is read only.
1008 **/
1009 EFI_STATUS
1010 UpdateMicrocodeFlashRegion (
1011   IN  MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate,
1012   IN  CPU_MICROCODE_HEADER                    *TargetMicrocodeEntryPoint,
1013   IN  VOID                                    *Image,
1014   IN  UINTN                                   ImageSize,
1015   OUT UINT32                                  *LastAttemptStatus
1016   )
1017 {
1018   VOID                                    *MicrocodePatchAddress;
1019   UINTN                                   MicrocodePatchRegionSize;
1020   UINTN                                   TargetTotalSize;
1021   UINTN                                   UsedRegionSize;
1022   EFI_STATUS                              Status;
1023   VOID                                    *MicrocodePatchScratchBuffer;
1024   UINT8                                   *ScratchBufferPtr;
1025   UINTN                                   ScratchBufferSize;
1026   UINTN                                   RestSize;
1027   UINTN                                   AvailableSize;
1028   VOID                                    *NextMicrocodeEntryPoint;
1029   MICROCODE_INFO                          *MicrocodeInfo;
1030   UINTN                                   MicrocodeCount;
1031   UINTN                                   Index;
1032
1033   DEBUG((DEBUG_INFO, "UpdateMicrocodeFlashRegion: Image - 0x%x, size - 0x%x\n", Image, ImageSize));
1034
1035   MicrocodePatchAddress = MicrocodeFmpPrivate->MicrocodePatchAddress;
1036   MicrocodePatchRegionSize = MicrocodeFmpPrivate->MicrocodePatchRegionSize;
1037
1038   MicrocodePatchScratchBuffer = AllocateZeroPool (MicrocodePatchRegionSize);
1039   if (MicrocodePatchScratchBuffer == NULL) {
1040     DEBUG((DEBUG_ERROR, "Fail to allocate Microcode Scratch buffer\n"));
1041     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
1042     return EFI_OUT_OF_RESOURCES;
1043   }
1044   ScratchBufferPtr = MicrocodePatchScratchBuffer;
1045   ScratchBufferSize = 0;
1046
1047   //
1048   // Target data collection
1049   //
1050   TargetTotalSize = 0;
1051   AvailableSize = 0;
1052   NextMicrocodeEntryPoint = NULL;
1053   if (TargetMicrocodeEntryPoint != NULL) {
1054     if (TargetMicrocodeEntryPoint->DataSize == 0) {
1055       TargetTotalSize = 2048;
1056     } else {
1057       TargetTotalSize = TargetMicrocodeEntryPoint->TotalSize;
1058     }
1059     DEBUG((DEBUG_INFO, "  TargetTotalSize - 0x%x\n", TargetTotalSize));
1060     NextMicrocodeEntryPoint = GetNextMicrocode(MicrocodeFmpPrivate, TargetMicrocodeEntryPoint);
1061     DEBUG((DEBUG_INFO, "  NextMicrocodeEntryPoint - 0x%x\n", NextMicrocodeEntryPoint));
1062     if (NextMicrocodeEntryPoint != NULL) {
1063       ASSERT ((UINTN)NextMicrocodeEntryPoint >= ((UINTN)TargetMicrocodeEntryPoint + TargetTotalSize));
1064       AvailableSize = (UINTN)NextMicrocodeEntryPoint - (UINTN)TargetMicrocodeEntryPoint;
1065     } else {
1066       AvailableSize = (UINTN)MicrocodePatchAddress + MicrocodePatchRegionSize - (UINTN)TargetMicrocodeEntryPoint;
1067     }
1068     DEBUG((DEBUG_INFO, "  AvailableSize - 0x%x\n", AvailableSize));
1069     ASSERT (AvailableSize >= TargetTotalSize);
1070   }
1071   UsedRegionSize = GetCurrentMicrocodeUsedRegionSize(MicrocodeFmpPrivate);
1072   DEBUG((DEBUG_INFO, "  UsedRegionSize - 0x%x\n", UsedRegionSize));
1073   ASSERT (UsedRegionSize >= TargetTotalSize);
1074   if (TargetMicrocodeEntryPoint != NULL) {
1075     ASSERT ((UINTN)MicrocodePatchAddress + UsedRegionSize >= ((UINTN)TargetMicrocodeEntryPoint + TargetTotalSize));
1076   }
1077   //
1078   // Total Size means the Microcode size.
1079   // Available Size means the Microcode size plus the pad till (1) next Microcode or (2) the end.
1080   //
1081   // (1)
1082   // +------+-----------+-----+------+===================+
1083   // | MCU1 | Microcode | PAD | MCU2 |      Empty        |
1084   // +------+-----------+-----+------+===================+
1085   //        | TotalSize |
1086   //        |<-AvailableSize->|
1087   // |<-        UsedRegionSize     ->|
1088   //
1089   // (2)
1090   // +------+-----------+===================+
1091   // | MCU  | Microcode |      Empty        |
1092   // +------+-----------+===================+
1093   //        | TotalSize |
1094   //        |<-      AvailableSize        ->|
1095   // |<-UsedRegionSize->|
1096   //
1097
1098   //
1099   // Update based on policy
1100   //
1101
1102   //
1103   // 1. If there is enough space to update old one in situ, replace old microcode in situ.
1104   //
1105   if (AvailableSize >= ImageSize) {
1106     DEBUG((DEBUG_INFO, "Replace old microcode in situ\n"));
1107     //
1108     // +------+------------+------+===================+
1109     // |Other | Old Image  | ...  |      Empty        |
1110     // +------+------------+------+===================+
1111     //
1112     // +------+---------+--+------+===================+
1113     // |Other |New Image|FF| ...  |      Empty        |
1114     // +------+---------+--+------+===================+
1115     //
1116     // 1.1. Copy new image
1117     CopyMem (ScratchBufferPtr, Image, ImageSize);
1118     ScratchBufferSize += ImageSize;
1119     ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1120     // 1.2. Pad 0xFF
1121     RestSize = AvailableSize - ImageSize;
1122     if (RestSize > 0) {
1123       SetMem (ScratchBufferPtr, RestSize, 0xFF);
1124       ScratchBufferSize += RestSize;
1125       ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1126     }
1127     Status = UpdateMicrocode((UINTN)TargetMicrocodeEntryPoint, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
1128     return Status;
1129   }
1130
1131   //
1132   // 2. If there is enough space to remove old one and add new one, reorg and replace old microcode.
1133   //
1134   if (MicrocodePatchRegionSize - (UsedRegionSize - TargetTotalSize) >= ImageSize) {
1135     if (TargetMicrocodeEntryPoint == NULL) {
1136       DEBUG((DEBUG_INFO, "Append new microcode\n"));
1137       //
1138       // +------+------------+------+===================+
1139       // |Other1|   Other    |Other2|      Empty        |
1140       // +------+------------+------+===================+
1141       //
1142       // +------+------------+------+-----------+=======+
1143       // |Other1|   Other    |Other2| New Image | Empty |
1144       // +------+------------+------+-----------+=======+
1145       //
1146       Status = UpdateMicrocode((UINTN)MicrocodePatchAddress + UsedRegionSize, Image, ImageSize, LastAttemptStatus);
1147     } else {
1148       DEBUG((DEBUG_INFO, "Reorg and replace old microcode\n"));
1149       //
1150       // +------+------------+------+===================+
1151       // |Other | Old Image  | ...  |      Empty        |
1152       // +------+------------+------+===================+
1153       //
1154       // +------+---------------+------+================+
1155       // |Other |   New Image   | ...  |      Empty     |
1156       // +------+---------------+------+================+
1157       //
1158       // 2.1. Copy new image
1159       CopyMem (ScratchBufferPtr, Image, ImageSize);
1160       ScratchBufferSize += ImageSize;
1161       ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1162       // 2.2. Copy rest images after the old image.
1163       if (NextMicrocodeEntryPoint != 0) {
1164         RestSize = (UINTN)MicrocodePatchAddress + UsedRegionSize - ((UINTN)NextMicrocodeEntryPoint);
1165         CopyMem (ScratchBufferPtr, NextMicrocodeEntryPoint, RestSize);
1166         ScratchBufferSize += RestSize;
1167         ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1168       }
1169       Status = UpdateMicrocode((UINTN)TargetMicrocodeEntryPoint, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
1170     }
1171     return Status;
1172   }
1173
1174   //
1175   // 3. The new image can be put in MCU region, but not all others can be put.
1176   //    So all the unused MCU is removed.
1177   //
1178   if (MicrocodePatchRegionSize >= ImageSize) {
1179     //
1180     // +------+------------+------+===================+
1181     // |Other1| Old Image  |Other2|      Empty        |
1182     // +------+------------+------+===================+
1183     //
1184     // +-------------------------------------+--------+
1185     // |        New Image                    | Other  |
1186     // +-------------------------------------+--------+
1187     //
1188     DEBUG((DEBUG_INFO, "Add new microcode from beginning\n"));
1189
1190     MicrocodeCount = MicrocodeFmpPrivate->DescriptorCount;
1191     MicrocodeInfo = MicrocodeFmpPrivate->MicrocodeInfo;
1192
1193     // 3.1. Copy new image
1194     CopyMem (ScratchBufferPtr, Image, ImageSize);
1195     ScratchBufferSize += ImageSize;
1196     ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1197     // 3.2. Copy some others to rest buffer
1198     for (Index = 0; Index < MicrocodeCount; Index++) {
1199       if (!MicrocodeInfo[Index].InUse) {
1200         continue;
1201       }
1202       if (MicrocodeInfo[Index].MicrocodeEntryPoint == TargetMicrocodeEntryPoint) {
1203         continue;
1204       }
1205       if (MicrocodeInfo[Index].TotalSize <= MicrocodePatchRegionSize - ScratchBufferSize) {
1206         CopyMem (ScratchBufferPtr, MicrocodeInfo[Index].MicrocodeEntryPoint, MicrocodeInfo[Index].TotalSize);
1207         ScratchBufferSize += MicrocodeInfo[Index].TotalSize;
1208         ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1209       }
1210     }
1211     // 3.3. Pad 0xFF
1212     RestSize = MicrocodePatchRegionSize - ScratchBufferSize;
1213     if (RestSize > 0) {
1214       SetMem (ScratchBufferPtr, RestSize, 0xFF);
1215       ScratchBufferSize += RestSize;
1216       ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1217     }
1218     Status = UpdateMicrocode((UINTN)MicrocodePatchAddress, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
1219     return Status;
1220   }
1221
1222   //
1223   // 4. The new image size is bigger than the whole MCU region.
1224   //
1225   DEBUG((DEBUG_ERROR, "Microcode too big\n"));
1226   *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
1227   Status = EFI_OUT_OF_RESOURCES;
1228
1229   return Status;
1230 }
1231
1232 /**
1233   Write Microcode.
1234
1235   Caution: This function may receive untrusted input.
1236
1237   @param[in]   MicrocodeFmpPrivate The Microcode driver private data
1238   @param[in]   Image               The Microcode image buffer.
1239   @param[in]   ImageSize           The size of Microcode image buffer in bytes.
1240   @param[out]  LastAttemptVersion  The last attempt version, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
1241   @param[out]  LastAttemptStatus   The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
1242   @param[out]  AbortReason         A pointer to a pointer to a null-terminated string providing more
1243                                    details for the aborted operation. The buffer is allocated by this function
1244                                    with AllocatePool(), and it is the caller's responsibility to free it with a
1245                                    call to FreePool().
1246
1247   @retval EFI_SUCCESS               The Microcode image is written.
1248   @retval EFI_VOLUME_CORRUPTED      The Microcode image is corrupted.
1249   @retval EFI_INCOMPATIBLE_VERSION  The Microcode image version is incorrect.
1250   @retval EFI_SECURITY_VIOLATION    The Microcode image fails to load.
1251   @retval EFI_WRITE_PROTECTED       The flash device is read only.
1252 **/
1253 EFI_STATUS
1254 MicrocodeWrite (
1255   IN  MICROCODE_FMP_PRIVATE_DATA   *MicrocodeFmpPrivate,
1256   IN  VOID                         *Image,
1257   IN  UINTN                        ImageSize,
1258   OUT UINT32                       *LastAttemptVersion,
1259   OUT UINT32                       *LastAttemptStatus,
1260   OUT CHAR16                       **AbortReason
1261   )
1262 {
1263   EFI_STATUS                              Status;
1264   VOID                                    *AlignedImage;
1265   CPU_MICROCODE_HEADER                    *TargetMicrocodeEntryPoint;
1266   UINTN                                   TargetCpuIndex;
1267   UINTN                                   TargetMicrcodeIndex;
1268
1269   //
1270   // MCU must be 16 bytes aligned
1271   //
1272   AlignedImage = AllocateCopyPool(ImageSize, Image);
1273   if (AlignedImage == NULL) {
1274     DEBUG((DEBUG_ERROR, "Fail to allocate aligned image\n"));
1275     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
1276     return EFI_OUT_OF_RESOURCES;
1277   }
1278
1279   TargetCpuIndex = (UINTN)-1;
1280   Status = VerifyMicrocode(MicrocodeFmpPrivate, AlignedImage, ImageSize, TRUE, LastAttemptStatus, AbortReason, &TargetCpuIndex);
1281   if (EFI_ERROR(Status)) {
1282     DEBUG((DEBUG_ERROR, "Fail to verify Microcode Region\n"));
1283     FreePool(AlignedImage);
1284     return Status;
1285   }
1286   DEBUG((DEBUG_INFO, "Pass VerifyMicrocode\n"));
1287   *LastAttemptVersion = ((CPU_MICROCODE_HEADER *)Image)->UpdateRevision;
1288
1289   DEBUG((DEBUG_INFO, "  TargetCpuIndex - 0x%x\n", TargetCpuIndex));
1290   ASSERT (TargetCpuIndex < MicrocodeFmpPrivate->ProcessorCount);
1291   TargetMicrcodeIndex = MicrocodeFmpPrivate->ProcessorInfo[TargetCpuIndex].MicrocodeIndex;
1292   DEBUG((DEBUG_INFO, "  TargetMicrcodeIndex - 0x%x\n", TargetMicrcodeIndex));
1293   if (TargetMicrcodeIndex != (UINTN)-1) {
1294     ASSERT (TargetMicrcodeIndex < MicrocodeFmpPrivate->DescriptorCount);
1295     TargetMicrocodeEntryPoint = MicrocodeFmpPrivate->MicrocodeInfo[TargetMicrcodeIndex].MicrocodeEntryPoint;
1296   } else {
1297     TargetMicrocodeEntryPoint = NULL;
1298   }
1299   DEBUG((DEBUG_INFO, "  TargetMicrocodeEntryPoint - 0x%x\n", TargetMicrocodeEntryPoint));
1300
1301   if (MicrocodeFmpPrivate->FitMicrocodeInfo != NULL) {
1302     Status = UpdateMicrocodeFlashRegionWithFit (
1303                MicrocodeFmpPrivate,
1304                TargetMicrocodeEntryPoint,
1305                AlignedImage,
1306                ImageSize,
1307                LastAttemptStatus
1308                );
1309   } else {
1310     Status = UpdateMicrocodeFlashRegion (
1311                MicrocodeFmpPrivate,
1312                TargetMicrocodeEntryPoint,
1313                AlignedImage,
1314                ImageSize,
1315                LastAttemptStatus
1316                );
1317   }
1318
1319   FreePool(AlignedImage);
1320
1321   return Status;
1322 }
1323
1324