IntelSiliconPkg/Feature/Capsule/MicrocodeUpdateDxe/MicrocodeUpdate.c

   1 /** @file
   2   SetImage instance to update Microcode.
   3
   4   Caution: This module requires additional review when modified.
   5   This module will have external input - capsule image.
   6   This external input must be validated carefully to avoid security issue like
   7   buffer overflow, integer overflow.
   8
   9   MicrocodeWrite() and VerifyMicrocode() will receive untrusted input and do basic validation.
  10
  11   Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
  12   This program and the accompanying materials
  13   are licensed and made available under the terms and conditions of the BSD License
  14   which accompanies this distribution.  The full text of the license may be found at
  15   http://opensource.org/licenses/bsd-license.php
  16
  17   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  18   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  19
  20 **/
  21
  22 #include "MicrocodeUpdate.h"
  23
  24 /**
  25   Get Microcode Region.
  26
  27   @param[out] MicrocodePatchAddress      The address of Microcode
  28   @param[out] MicrocodePatchRegionSize   The region size of Microcode
  29
  30   @retval TRUE   The Microcode region is returned.
  31   @retval FALSE  No Microcode region.
  32 **/
  33 BOOLEAN
  34 GetMicrocodeRegion (
  35   OUT VOID     **MicrocodePatchAddress,
  36   OUT UINTN    *MicrocodePatchRegionSize
  37   )
  38 {
  39   *MicrocodePatchAddress = (VOID *)(UINTN)PcdGet64(PcdCpuMicrocodePatchAddress);
  40   *MicrocodePatchRegionSize = (UINTN)PcdGet64(PcdCpuMicrocodePatchRegionSize);
  41
  42   if ((*MicrocodePatchAddress == NULL) || (*MicrocodePatchRegionSize == 0)) {
  43     return FALSE;
  44   }
  45
  46   return TRUE;
  47 }
  48
  49 /**
  50   Get Microcode update signature of currently loaded Microcode update.
  51
  52   @return  Microcode signature.
  53
  54 **/
  55 UINT32
  56 GetCurrentMicrocodeSignature (
  57   VOID
  58   )
  59 {
  60   UINT64 Signature;
  61
  62   AsmWriteMsr64(MSR_IA32_BIOS_SIGN_ID, 0);
  63   AsmCpuid(CPUID_VERSION_INFO, NULL, NULL, NULL, NULL);
  64   Signature = AsmReadMsr64(MSR_IA32_BIOS_SIGN_ID);
  65   return (UINT32)RShiftU64(Signature, 32);
  66 }
  67
  68 /**
  69   Get current processor signature.
  70
  71   @return current processor signature.
  72 **/
  73 UINT32
  74 GetCurrentProcessorSignature (
  75   VOID
  76   )
  77 {
  78   UINT32                                  RegEax;
  79   AsmCpuid(CPUID_VERSION_INFO, &RegEax, NULL, NULL, NULL);
  80   return RegEax;
  81 }
  82
  83 /**
  84   Get current platform ID.
  85
  86   @return current platform ID.
  87 **/
  88 UINT8
  89 GetCurrentPlatformId (
  90   VOID
  91   )
  92 {
  93   UINT8                                   PlatformId;
  94
  95   PlatformId = (UINT8)AsmMsrBitFieldRead64(MSR_IA32_PLATFORM_ID, 50, 52);
  96   return PlatformId;
  97 }
  98
  99 /**
 100   Load new Microcode.
 101
 102   @param[in] Address  The address of new Microcode.
 103
 104   @return  Loaded Microcode signature.
 105
 106 **/
 107 UINT32
 108 LoadMicrocode (
 109   IN UINT64  Address
 110   )
 111 {
 112   AsmWriteMsr64(MSR_IA32_BIOS_UPDT_TRIG, Address);
 113   return GetCurrentMicrocodeSignature();
 114 }
 115
 116 /**
 117   Load Microcode on an Application Processor.
 118   The function prototype for invoking a function on an Application Processor.
 119
 120   @param[in,out] Buffer  The pointer to private data buffer.
 121 **/
 122 VOID
 123 EFIAPI
 124 MicrocodeLoadAp (
 125   IN OUT VOID  *Buffer
 126   )
 127 {
 128   MICROCODE_LOAD_BUFFER                *MicrocodeLoadBuffer;
 129
 130   MicrocodeLoadBuffer = Buffer;
 131   MicrocodeLoadBuffer->Revision = LoadMicrocode (MicrocodeLoadBuffer->Address);
 132 }
 133
 134 /**
 135   Load new Microcode on this processor
 136
 137   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 138   @param[in]  CpuIndex                   The index of the processor.
 139   @param[in]  Address                    The address of new Microcode.
 140
 141   @return  Loaded Microcode signature.
 142
 143 **/
 144 UINT32
 145 LoadMicrocodeOnThis (
 146   IN  MICROCODE_FMP_PRIVATE_DATA  *MicrocodeFmpPrivate,
 147   IN  UINTN                       CpuIndex,
 148   IN  UINT64                      Address
 149   )
 150 {
 151   EFI_STATUS                           Status;
 152   EFI_MP_SERVICES_PROTOCOL             *MpService;
 153   MICROCODE_LOAD_BUFFER                MicrocodeLoadBuffer;
 154
 155   if (CpuIndex == MicrocodeFmpPrivate->BspIndex) {
 156     return LoadMicrocode (Address);
 157   } else {
 158     MpService = MicrocodeFmpPrivate->MpService;
 159     MicrocodeLoadBuffer.Address = Address;
 160     MicrocodeLoadBuffer.Revision = 0;
 161     Status = MpService->StartupThisAP (
 162                           MpService,
 163                           MicrocodeLoadAp,
 164                           CpuIndex,
 165                           NULL,
 166                           0,
 167                           &MicrocodeLoadBuffer,
 168                           NULL
 169                           );
 170     ASSERT_EFI_ERROR(Status);
 171     return MicrocodeLoadBuffer.Revision;
 172   }
 173 }
 174
 175 /**
 176   Collect processor information.
 177   The function prototype for invoking a function on an Application Processor.
 178
 179   @param[in,out] Buffer  The pointer to private data buffer.
 180 **/
 181 VOID
 182 EFIAPI
 183 CollectProcessorInfo (
 184   IN OUT VOID  *Buffer
 185   )
 186 {
 187   PROCESSOR_INFO  *ProcessorInfo;
 188
 189   ProcessorInfo = Buffer;
 190   ProcessorInfo->ProcessorSignature = GetCurrentProcessorSignature();
 191   ProcessorInfo->PlatformId = GetCurrentPlatformId();
 192   ProcessorInfo->MicrocodeRevision = GetCurrentMicrocodeSignature();
 193 }
 194
 195 /**
 196   Get current Microcode information.
 197
 198   The ProcessorInformation (BspIndex/ProcessorCount/ProcessorInfo)
 199   in MicrocodeFmpPrivate must be initialized.
 200
 201   The MicrocodeInformation (DescriptorCount/ImageDescriptor/MicrocodeInfo)
 202   in MicrocodeFmpPrivate may not be avaiable in this function.
 203
 204   @param[in]   MicrocodeFmpPrivate        The Microcode driver private data
 205   @param[in]   DescriptorCount            The count of Microcode ImageDescriptor allocated.
 206   @param[out]  ImageDescriptor            Microcode ImageDescriptor
 207   @param[out]  MicrocodeInfo              Microcode information
 208
 209   @return Microcode count
 210 **/
 211 UINTN
 212 GetMicrocodeInfo (
 213   IN  MICROCODE_FMP_PRIVATE_DATA     *MicrocodeFmpPrivate,
 214   IN  UINTN                          DescriptorCount,  OPTIONAL
 215   OUT EFI_FIRMWARE_IMAGE_DESCRIPTOR  *ImageDescriptor, OPTIONAL
 216   OUT MICROCODE_INFO                 *MicrocodeInfo    OPTIONAL
 217   )
 218 {
 219   VOID                                    *MicrocodePatchAddress;
 220   UINTN                                   MicrocodePatchRegionSize;
 221   CPU_MICROCODE_HEADER                    *MicrocodeEntryPoint;
 222   UINTN                                   MicrocodeEnd;
 223   UINTN                                   TotalSize;
 224   UINTN                                   Count;
 225   UINT64                                  ImageAttributes;
 226   BOOLEAN                                 IsInUse;
 227   EFI_STATUS                              Status;
 228   UINT32                                  AttemptStatus;
 229   UINTN                                   TargetCpuIndex;
 230
 231   MicrocodePatchAddress = MicrocodeFmpPrivate->MicrocodePatchAddress;
 232   MicrocodePatchRegionSize = MicrocodeFmpPrivate->MicrocodePatchRegionSize;
 233
 234   DEBUG((DEBUG_INFO, "Microcode Region - 0x%x - 0x%x\n", MicrocodePatchAddress, MicrocodePatchRegionSize));
 235
 236   Count = 0;
 237
 238   MicrocodeEnd = (UINTN)MicrocodePatchAddress + MicrocodePatchRegionSize;
 239   MicrocodeEntryPoint = (CPU_MICROCODE_HEADER *) (UINTN) MicrocodePatchAddress;
 240   do {
 241     if (MicrocodeEntryPoint->HeaderVersion == 0x1 && MicrocodeEntryPoint->LoaderRevision == 0x1) {
 242       //
 243       // It is the microcode header. It is not the padding data between microcode patches
 244       // becasue the padding data should not include 0x00000001 and it should be the repeated
 245       // byte format (like 0xXYXYXYXY....).
 246       //
 247       if (MicrocodeEntryPoint->DataSize == 0) {
 248         TotalSize = 2048;
 249       } else {
 250         TotalSize = MicrocodeEntryPoint->TotalSize;
 251       }
 252
 253       TargetCpuIndex = (UINTN)-1;
 254       Status = VerifyMicrocode(MicrocodeFmpPrivate, MicrocodeEntryPoint, TotalSize, FALSE, &AttemptStatus, NULL, &TargetCpuIndex);
 255       if (!EFI_ERROR(Status)) {
 256         IsInUse = TRUE;
 257         ASSERT (TargetCpuIndex < MicrocodeFmpPrivate->ProcessorCount);
 258         MicrocodeFmpPrivate->ProcessorInfo[TargetCpuIndex].MicrocodeIndex = Count;
 259       } else {
 260         IsInUse = FALSE;
 261       }
 262
 263       if (ImageDescriptor != NULL && DescriptorCount > Count) {
 264         ImageDescriptor[Count].ImageIndex = (UINT8)(Count + 1);
 265         CopyGuid (&ImageDescriptor[Count].ImageTypeId, &gMicrocodeFmpImageTypeIdGuid);
 266         ImageDescriptor[Count].ImageId = LShiftU64(MicrocodeEntryPoint->ProcessorFlags, 32) + MicrocodeEntryPoint->ProcessorSignature.Uint32;
 267         ImageDescriptor[Count].ImageIdName = NULL;
 268         ImageDescriptor[Count].Version = MicrocodeEntryPoint->UpdateRevision;
 269         ImageDescriptor[Count].VersionName = NULL;
 270         ImageDescriptor[Count].Size = TotalSize;
 271         ImageAttributes = IMAGE_ATTRIBUTE_IMAGE_UPDATABLE | IMAGE_ATTRIBUTE_RESET_REQUIRED;
 272         if (IsInUse) {
 273           ImageAttributes |= IMAGE_ATTRIBUTE_IN_USE;
 274         }
 275         ImageDescriptor[Count].AttributesSupported = ImageAttributes | IMAGE_ATTRIBUTE_IN_USE;
 276         ImageDescriptor[Count].AttributesSetting = ImageAttributes;
 277         ImageDescriptor[Count].Compatibilities = 0;
 278         ImageDescriptor[Count].LowestSupportedImageVersion = MicrocodeEntryPoint->UpdateRevision; // do not support rollback
 279         ImageDescriptor[Count].LastAttemptVersion = 0;
 280         ImageDescriptor[Count].LastAttemptStatus = 0;
 281         ImageDescriptor[Count].HardwareInstance = 0;
 282       }
 283       if (MicrocodeInfo != NULL && DescriptorCount > Count) {
 284         MicrocodeInfo[Count].MicrocodeEntryPoint = MicrocodeEntryPoint;
 285         MicrocodeInfo[Count].TotalSize = TotalSize;
 286         MicrocodeInfo[Count].InUse = IsInUse;
 287       }
 288     } else {
 289       //
 290       // It is the padding data between the microcode patches for microcode patches alignment.
 291       // Because the microcode patch is the multiple of 1-KByte, the padding data should not
 292       // exist if the microcode patch alignment value is not larger than 1-KByte. So, the microcode
 293       // alignment value should be larger than 1-KByte. We could skip SIZE_1KB padding data to
 294       // find the next possible microcode patch header.
 295       //
 296       MicrocodeEntryPoint = (CPU_MICROCODE_HEADER *) (((UINTN) MicrocodeEntryPoint) + SIZE_1KB);
 297       continue;
 298     }
 299
 300     Count++;
 301     ASSERT(Count < 0xFF);
 302
 303     //
 304     // Get the next patch.
 305     //
 306     MicrocodeEntryPoint = (CPU_MICROCODE_HEADER *) (((UINTN) MicrocodeEntryPoint) + TotalSize);
 307   } while (((UINTN) MicrocodeEntryPoint < MicrocodeEnd));
 308
 309   return Count;
 310 }
 311
 312 /**
 313   Return matched processor information.
 314
 315   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 316   @param[in]  ProcessorSignature         The processor signature to be matched
 317   @param[in]  ProcessorFlags             The processor flags to be matched
 318   @param[in, out] TargetCpuIndex         On input, the index of target CPU which tries to match the Microcode. (UINTN)-1 means to try all.
 319                                          On output, the index of target CPU which matches the Microcode.
 320
 321   @return matched processor information.
 322 **/
 323 PROCESSOR_INFO *
 324 GetMatchedProcessor (
 325   IN MICROCODE_FMP_PRIVATE_DATA  *MicrocodeFmpPrivate,
 326   IN UINT32                      ProcessorSignature,
 327   IN UINT32                      ProcessorFlags,
 328   IN OUT UINTN                   *TargetCpuIndex
 329   )
 330 {
 331   UINTN  Index;
 332
 333   if (*TargetCpuIndex != (UINTN)-1) {
 334     Index = *TargetCpuIndex;
 335     if ((ProcessorSignature == MicrocodeFmpPrivate->ProcessorInfo[Index].ProcessorSignature) &&
 336         ((ProcessorFlags & (1 << MicrocodeFmpPrivate->ProcessorInfo[Index].PlatformId)) != 0)) {
 337       return &MicrocodeFmpPrivate->ProcessorInfo[Index];
 338     } else {
 339       return NULL;
 340     }
 341   }
 342
 343   for (Index = 0; Index < MicrocodeFmpPrivate->ProcessorCount; Index++) {
 344     if ((ProcessorSignature == MicrocodeFmpPrivate->ProcessorInfo[Index].ProcessorSignature) &&
 345         ((ProcessorFlags & (1 << MicrocodeFmpPrivate->ProcessorInfo[Index].PlatformId)) != 0)) {
 346       *TargetCpuIndex = Index;
 347       return &MicrocodeFmpPrivate->ProcessorInfo[Index];
 348     }
 349   }
 350   return NULL;
 351 }
 352
 353 /**
 354   Verify Microcode.
 355
 356   Caution: This function may receive untrusted input.
 357
 358   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 359   @param[in]  Image                      The Microcode image buffer.
 360   @param[in]  ImageSize                  The size of Microcode image buffer in bytes.
 361   @param[in]  TryLoad                    Try to load Microcode or not.
 362   @param[out] LastAttemptStatus          The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 363   @param[out] AbortReason                A pointer to a pointer to a null-terminated string providing more
 364                                          details for the aborted operation. The buffer is allocated by this function
 365                                          with AllocatePool(), and it is the caller's responsibility to free it with a
 366                                          call to FreePool().
 367   @param[in, out] TargetCpuIndex         On input, the index of target CPU which tries to match the Microcode. (UINTN)-1 means to try all.
 368                                          On output, the index of target CPU which matches the Microcode.
 369
 370   @retval EFI_SUCCESS               The Microcode image passes verification.
 371   @retval EFI_VOLUME_CORRUPTED      The Microcode image is corrupted.
 372   @retval EFI_INCOMPATIBLE_VERSION  The Microcode image version is incorrect.
 373   @retval EFI_UNSUPPORTED           The Microcode ProcessorSignature or ProcessorFlags is incorrect.
 374   @retval EFI_SECURITY_VIOLATION    The Microcode image fails to load.
 375 **/
 376 EFI_STATUS
 377 VerifyMicrocode (
 378   IN  MICROCODE_FMP_PRIVATE_DATA  *MicrocodeFmpPrivate,
 379   IN  VOID                        *Image,
 380   IN  UINTN                       ImageSize,
 381   IN  BOOLEAN                     TryLoad,
 382   OUT UINT32                      *LastAttemptStatus,
 383   OUT CHAR16                      **AbortReason,   OPTIONAL
 384   IN OUT UINTN                    *TargetCpuIndex
 385   )
 386 {
 387   UINTN                                   Index;
 388   CPU_MICROCODE_HEADER                    *MicrocodeEntryPoint;
 389   UINTN                                   TotalSize;
 390   UINTN                                   DataSize;
 391   UINT32                                  CurrentRevision;
 392   PROCESSOR_INFO                          *ProcessorInfo;
 393   UINT32                                  InCompleteCheckSum32;
 394   UINT32                                  CheckSum32;
 395   UINTN                                   ExtendedTableLength;
 396   UINT32                                  ExtendedTableCount;
 397   CPU_MICROCODE_EXTENDED_TABLE            *ExtendedTable;
 398   CPU_MICROCODE_EXTENDED_TABLE_HEADER     *ExtendedTableHeader;
 399   BOOLEAN                                 CorrectMicrocode;
 400
 401   //
 402   // Check HeaderVersion
 403   //
 404   MicrocodeEntryPoint = Image;
 405   if (MicrocodeEntryPoint->HeaderVersion != 0x1) {
 406     DEBUG((DEBUG_ERROR, "VerifyMicrocode - fail on HeaderVersion\n"));
 407     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 408     if (AbortReason != NULL) {
 409       *AbortReason = AllocateCopyPool(sizeof(L"InvalidHeaderVersion"), L"InvalidHeaderVersion");
 410     }
 411     return EFI_INCOMPATIBLE_VERSION;
 412   }
 413   //
 414   // Check LoaderRevision
 415   //
 416   if (MicrocodeEntryPoint->LoaderRevision != 0x1) {
 417     DEBUG((DEBUG_ERROR, "VerifyMicrocode - fail on LoaderRevision\n"));
 418     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 419     if (AbortReason != NULL) {
 420       *AbortReason = AllocateCopyPool(sizeof(L"InvalidLoaderVersion"), L"InvalidLoaderVersion");
 421     }
 422     return EFI_INCOMPATIBLE_VERSION;
 423   }
 424   //
 425   // Check TotalSize
 426   //
 427   if (MicrocodeEntryPoint->DataSize == 0) {
 428     TotalSize = 2048;
 429   } else {
 430     TotalSize = MicrocodeEntryPoint->TotalSize;
 431   }
 432   if (TotalSize <= sizeof(CPU_MICROCODE_HEADER)) {
 433     DEBUG((DEBUG_ERROR, "VerifyMicrocode - TotalSize too small\n"));
 434     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 435     if (AbortReason != NULL) {
 436       *AbortReason = AllocateCopyPool(sizeof(L"InvalidTotalSize"), L"InvalidTotalSize");
 437     }
 438     return EFI_VOLUME_CORRUPTED;
 439   }
 440   if ((TotalSize & (SIZE_1KB - 1)) != 0) {
 441     DEBUG((DEBUG_ERROR, "VerifyMicrocode - TotalSize is not multiples of 1024 bytes (1 KBytes)\n"));
 442     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 443     if (AbortReason != NULL) {
 444       *AbortReason = AllocateCopyPool(sizeof(L"InvalidTotalSize"), L"InvalidTotalSize");
 445     }
 446     return EFI_VOLUME_CORRUPTED;
 447   }
 448   if (TotalSize != ImageSize) {
 449     DEBUG((DEBUG_ERROR, "VerifyMicrocode - TotalSize not equal to ImageSize\n"));
 450     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 451     if (AbortReason != NULL) {
 452       *AbortReason = AllocateCopyPool(sizeof(L"InvalidTotalSize"), L"InvalidTotalSize");
 453     }
 454     return EFI_VOLUME_CORRUPTED;
 455   }
 456   //
 457   // Check DataSize
 458   //
 459   if (MicrocodeEntryPoint->DataSize == 0) {
 460     DataSize = 2048 - sizeof(CPU_MICROCODE_HEADER);
 461   } else {
 462     DataSize = MicrocodeEntryPoint->DataSize;
 463   }
 464   if (DataSize > TotalSize - sizeof(CPU_MICROCODE_HEADER)) {
 465     DEBUG((DEBUG_ERROR, "VerifyMicrocode - DataSize too big\n"));
 466     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 467     if (AbortReason != NULL) {
 468       *AbortReason = AllocateCopyPool(sizeof(L"InvalidDataSize"), L"InvalidDataSize");
 469     }
 470     return EFI_VOLUME_CORRUPTED;
 471   }
 472   if ((DataSize & 0x3) != 0) {
 473     DEBUG((DEBUG_ERROR, "VerifyMicrocode - DataSize is not multiples of DWORDs\n"));
 474     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 475     if (AbortReason != NULL) {
 476       *AbortReason = AllocateCopyPool(sizeof(L"InvalidDataSize"), L"InvalidDataSize");
 477     }
 478     return EFI_VOLUME_CORRUPTED;
 479   }
 480   //
 481   // Check CheckSum32
 482   //
 483   CheckSum32 = CalculateSum32((UINT32 *)MicrocodeEntryPoint, DataSize + sizeof(CPU_MICROCODE_HEADER));
 484   if (CheckSum32 != 0) {
 485     DEBUG((DEBUG_ERROR, "VerifyMicrocode - fail on CheckSum32\n"));
 486     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INVALID_FORMAT;
 487     if (AbortReason != NULL) {
 488       *AbortReason = AllocateCopyPool(sizeof(L"InvalidChecksum"), L"InvalidChecksum");
 489     }
 490     return EFI_VOLUME_CORRUPTED;
 491   }
 492   InCompleteCheckSum32 = CheckSum32;
 493   InCompleteCheckSum32 -= MicrocodeEntryPoint->ProcessorSignature.Uint32;
 494   InCompleteCheckSum32 -= MicrocodeEntryPoint->ProcessorFlags;
 495   InCompleteCheckSum32 -= MicrocodeEntryPoint->Checksum;
 496
 497   //
 498   // Check ProcessorSignature/ProcessorFlags
 499   //
 500
 501   ProcessorInfo = GetMatchedProcessor (MicrocodeFmpPrivate, MicrocodeEntryPoint->ProcessorSignature.Uint32, MicrocodeEntryPoint->ProcessorFlags, TargetCpuIndex);
 502   if (ProcessorInfo == NULL) {
 503     CorrectMicrocode = FALSE;
 504     ExtendedTableLength = TotalSize - (DataSize + sizeof(CPU_MICROCODE_HEADER));
 505     if (ExtendedTableLength != 0) {
 506       //
 507       // Extended Table exist, check if the CPU in support list
 508       //
 509       ExtendedTableHeader = (CPU_MICROCODE_EXTENDED_TABLE_HEADER *)((UINT8 *)(MicrocodeEntryPoint) + DataSize + sizeof(CPU_MICROCODE_HEADER));
 510       //
 511       // Calculate Extended Checksum
 512       //
 513       if ((ExtendedTableLength > sizeof(CPU_MICROCODE_EXTENDED_TABLE_HEADER)) && ((ExtendedTableLength & 0x3) == 0)) {
 514         CheckSum32 = CalculateSum32((UINT32 *)ExtendedTableHeader, ExtendedTableLength);
 515         if (CheckSum32 != 0) {
 516           //
 517           // Checksum incorrect
 518           //
 519           DEBUG((DEBUG_ERROR, "VerifyMicrocode - The checksum for extended table is incorrect\n"));
 520         } else {
 521           //
 522           // Checksum correct
 523           //
 524           ExtendedTableCount = ExtendedTableHeader->ExtendedSignatureCount;
 525           if (ExtendedTableCount > (ExtendedTableLength - sizeof(CPU_MICROCODE_EXTENDED_TABLE_HEADER)) / sizeof(CPU_MICROCODE_EXTENDED_TABLE)) {
 526             DEBUG((DEBUG_ERROR, "VerifyMicrocode - ExtendedTableCount %d is too big\n", ExtendedTableCount));
 527           } else {
 528             ExtendedTable = (CPU_MICROCODE_EXTENDED_TABLE *)(ExtendedTableHeader + 1);
 529             for (Index = 0; Index < ExtendedTableCount; Index++) {
 530               CheckSum32 = InCompleteCheckSum32;
 531               CheckSum32 += ExtendedTable->ProcessorSignature.Uint32;
 532               CheckSum32 += ExtendedTable->ProcessorFlag;
 533               CheckSum32 += ExtendedTable->Checksum;
 534               if (CheckSum32 != 0) {
 535                 DEBUG((DEBUG_ERROR, "VerifyMicrocode - The checksum for ExtendedTable entry with index 0x%x is incorrect\n", Index));
 536               } else {
 537                 //
 538                 // Verify Header
 539                 //
 540                 ProcessorInfo = GetMatchedProcessor (MicrocodeFmpPrivate, ExtendedTable->ProcessorSignature.Uint32, ExtendedTable->ProcessorFlag, TargetCpuIndex);
 541                 if (ProcessorInfo != NULL) {
 542                   //
 543                   // Find one
 544                   //
 545                   CorrectMicrocode = TRUE;
 546                   break;
 547                 }
 548               }
 549               ExtendedTable++;
 550             }
 551           }
 552         }
 553       }
 554     }
 555     if (!CorrectMicrocode) {
 556       if (TryLoad) {
 557         DEBUG((DEBUG_ERROR, "VerifyMicrocode - fail on Current ProcessorSignature/ProcessorFlags\n"));
 558       }
 559       *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INCORRECT_VERSION;
 560       if (AbortReason != NULL) {
 561         *AbortReason = AllocateCopyPool(sizeof(L"UnsupportedProcessorSignature/ProcessorFlags"), L"UnsupportedProcessorSignature/ProcessorFlags");
 562       }
 563       return EFI_UNSUPPORTED;
 564     }
 565   }
 566
 567   //
 568   // Check UpdateRevision
 569   //
 570   CurrentRevision = ProcessorInfo->MicrocodeRevision;
 571   if ((MicrocodeEntryPoint->UpdateRevision < CurrentRevision) ||
 572       (TryLoad && (MicrocodeEntryPoint->UpdateRevision == CurrentRevision))) {
 573     if (TryLoad) {
 574       DEBUG((DEBUG_ERROR, "VerifyMicrocode - fail on UpdateRevision\n"));
 575     }
 576     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INCORRECT_VERSION;
 577     if (AbortReason != NULL) {
 578       *AbortReason = AllocateCopyPool(sizeof(L"IncorrectRevision"), L"IncorrectRevision");
 579     }
 580     return EFI_INCOMPATIBLE_VERSION;
 581   }
 582
 583   //
 584   // try load MCU
 585   //
 586   if (TryLoad) {
 587     CurrentRevision = LoadMicrocodeOnThis(MicrocodeFmpPrivate, ProcessorInfo->CpuIndex, (UINTN)MicrocodeEntryPoint + sizeof(CPU_MICROCODE_HEADER));
 588     if (MicrocodeEntryPoint->UpdateRevision != CurrentRevision) {
 589       DEBUG((DEBUG_ERROR, "VerifyMicrocode - fail on LoadMicrocode\n"));
 590       *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_AUTH_ERROR;
 591       if (AbortReason != NULL) {
 592         *AbortReason = AllocateCopyPool(sizeof(L"InvalidData"), L"InvalidData");
 593       }
 594       return EFI_SECURITY_VIOLATION;
 595     }
 596   }
 597
 598   return EFI_SUCCESS;
 599 }
 600
 601 /**
 602   Get next Microcode entrypoint.
 603
 604   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 605   @param[in]  MicrocodeEntryPoint        Current Microcode entrypoint
 606
 607   @return next Microcode entrypoint.
 608 **/
 609 CPU_MICROCODE_HEADER *
 610 GetNextMicrocode (
 611   IN MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate,
 612   IN CPU_MICROCODE_HEADER                    *MicrocodeEntryPoint
 613   )
 614 {
 615   UINTN                                   Index;
 616
 617   for (Index = 0; Index < MicrocodeFmpPrivate->DescriptorCount; Index++) {
 618     if (MicrocodeEntryPoint == MicrocodeFmpPrivate->MicrocodeInfo[Index].MicrocodeEntryPoint) {
 619       if (Index == (UINTN)MicrocodeFmpPrivate->DescriptorCount - 1) {
 620         // it is last one
 621         return NULL;
 622       } else {
 623         // return next one
 624         return MicrocodeFmpPrivate->MicrocodeInfo[Index + 1].MicrocodeEntryPoint;
 625       }
 626     }
 627   }
 628
 629   ASSERT(FALSE);
 630   return NULL;
 631 }
 632
 633 /**
 634   Get next FIT Microcode entrypoint.
 635
 636   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 637   @param[in]  MicrocodeEntryPoint        Current Microcode entrypoint
 638
 639   @return next FIT Microcode entrypoint.
 640 **/
 641 CPU_MICROCODE_HEADER *
 642 GetNextFitMicrocode (
 643   IN MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate,
 644   IN CPU_MICROCODE_HEADER                    *MicrocodeEntryPoint
 645   )
 646 {
 647   UINTN                                   Index;
 648
 649   for (Index = 0; Index < MicrocodeFmpPrivate->FitMicrocodeEntryCount; Index++) {
 650     if (MicrocodeEntryPoint == MicrocodeFmpPrivate->FitMicrocodeInfo[Index].MicrocodeEntryPoint) {
 651       if (Index == (UINTN) MicrocodeFmpPrivate->FitMicrocodeEntryCount - 1) {
 652         // it is last one
 653         return NULL;
 654       } else {
 655         // return next one
 656         return MicrocodeFmpPrivate->FitMicrocodeInfo[Index + 1].MicrocodeEntryPoint;
 657       }
 658     }
 659   }
 660
 661   ASSERT(FALSE);
 662   return NULL;
 663 }
 664
 665 /**
 666   Find empty FIT Microcode entrypoint.
 667
 668   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 669   @param[in]  ImageSize                  The size of Microcode image buffer in bytes.
 670   @param[out] AvailableSize              Available size of the empty FIT Microcode entrypoint.
 671
 672   @return Empty FIT Microcode entrypoint.
 673 **/
 674 CPU_MICROCODE_HEADER *
 675 FindEmptyFitMicrocode (
 676   IN MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate,
 677   IN UINTN                                   ImageSize,
 678   OUT UINTN                                  *AvailableSize
 679   )
 680 {
 681   UINTN                                   Index;
 682   CPU_MICROCODE_HEADER                    *MicrocodeEntryPoint;
 683   CPU_MICROCODE_HEADER                    *NextMicrocodeEntryPoint;
 684   VOID                                    *MicrocodePatchAddress;
 685   UINTN                                   MicrocodePatchRegionSize;
 686
 687   MicrocodePatchAddress = MicrocodeFmpPrivate->MicrocodePatchAddress;
 688   MicrocodePatchRegionSize = MicrocodeFmpPrivate->MicrocodePatchRegionSize;
 689
 690   for (Index = 0; Index < MicrocodeFmpPrivate->FitMicrocodeEntryCount; Index++) {
 691     if (MicrocodeFmpPrivate->FitMicrocodeInfo[Index].Empty) {
 692       MicrocodeEntryPoint = MicrocodeFmpPrivate->FitMicrocodeInfo[Index].MicrocodeEntryPoint;
 693       NextMicrocodeEntryPoint = GetNextFitMicrocode (MicrocodeFmpPrivate, MicrocodeEntryPoint);
 694       if (NextMicrocodeEntryPoint != NULL) {
 695         *AvailableSize = (UINTN) NextMicrocodeEntryPoint - (UINTN) MicrocodeEntryPoint;
 696       } else {
 697         *AvailableSize = (UINTN) MicrocodePatchAddress + MicrocodePatchRegionSize - (UINTN) MicrocodeEntryPoint;
 698       }
 699       if (*AvailableSize >= ImageSize) {
 700         return MicrocodeEntryPoint;
 701       }
 702     }
 703   }
 704
 705   return NULL;
 706 }
 707
 708 /**
 709   Find unused FIT Microcode entrypoint.
 710
 711   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 712   @param[in]  ImageSize                  The size of Microcode image buffer in bytes.
 713   @param[out] AvailableSize              Available size of the unused FIT Microcode entrypoint.
 714
 715   @return Unused FIT Microcode entrypoint.
 716 **/
 717 CPU_MICROCODE_HEADER *
 718 FindUnusedFitMicrocode (
 719   IN MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate,
 720   IN UINTN                                   ImageSize,
 721   OUT UINTN                                  *AvailableSize
 722   )
 723 {
 724   UINTN                                   Index;
 725   CPU_MICROCODE_HEADER                    *MicrocodeEntryPoint;
 726   CPU_MICROCODE_HEADER                    *NextMicrocodeEntryPoint;
 727   VOID                                    *MicrocodePatchAddress;
 728   UINTN                                   MicrocodePatchRegionSize;
 729
 730   MicrocodePatchAddress = MicrocodeFmpPrivate->MicrocodePatchAddress;
 731   MicrocodePatchRegionSize = MicrocodeFmpPrivate->MicrocodePatchRegionSize;
 732
 733   for (Index = 0; Index < MicrocodeFmpPrivate->FitMicrocodeEntryCount; Index++) {
 734     if (!MicrocodeFmpPrivate->FitMicrocodeInfo[Index].InUse) {
 735       MicrocodeEntryPoint = MicrocodeFmpPrivate->FitMicrocodeInfo[Index].MicrocodeEntryPoint;
 736       NextMicrocodeEntryPoint = GetNextFitMicrocode (MicrocodeFmpPrivate, MicrocodeEntryPoint);
 737       if (NextMicrocodeEntryPoint != NULL) {
 738         *AvailableSize = (UINTN) NextMicrocodeEntryPoint - (UINTN) MicrocodeEntryPoint;
 739       } else {
 740         *AvailableSize = (UINTN) MicrocodePatchAddress + MicrocodePatchRegionSize - (UINTN) MicrocodeEntryPoint;
 741       }
 742       if (*AvailableSize >= ImageSize) {
 743         return MicrocodeEntryPoint;
 744       }
 745     }
 746   }
 747
 748   return NULL;
 749 }
 750
 751 /**
 752   Get current Microcode used region size.
 753
 754   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 755
 756   @return current Microcode used region size.
 757 **/
 758 UINTN
 759 GetCurrentMicrocodeUsedRegionSize (
 760   IN MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate
 761   )
 762 {
 763   if (MicrocodeFmpPrivate->DescriptorCount == 0) {
 764     return 0;
 765   }
 766
 767   return (UINTN)MicrocodeFmpPrivate->MicrocodeInfo[MicrocodeFmpPrivate->DescriptorCount - 1].MicrocodeEntryPoint
 768          + (UINTN)MicrocodeFmpPrivate->MicrocodeInfo[MicrocodeFmpPrivate->DescriptorCount - 1].TotalSize
 769          - (UINTN)MicrocodeFmpPrivate->MicrocodePatchAddress;
 770 }
 771
 772 /**
 773   Update Microcode.
 774
 775   @param[in]   Address            The flash address of Microcode.
 776   @param[in]   Image              The Microcode image buffer.
 777   @param[in]   ImageSize          The size of Microcode image buffer in bytes.
 778   @param[out]  LastAttemptStatus  The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 779
 780   @retval EFI_SUCCESS           The Microcode image is updated.
 781   @retval EFI_WRITE_PROTECTED   The flash device is read only.
 782 **/
 783 EFI_STATUS
 784 UpdateMicrocode (
 785   IN UINT64   Address,
 786   IN VOID     *Image,
 787   IN UINTN    ImageSize,
 788   OUT UINT32  *LastAttemptStatus
 789   )
 790 {
 791   EFI_STATUS  Status;
 792
 793   DEBUG((DEBUG_INFO, "PlatformUpdate:"));
 794   DEBUG((DEBUG_INFO, "  Address - 0x%lx,", Address));
 795   DEBUG((DEBUG_INFO, "  Length - 0x%x\n", ImageSize));
 796
 797   Status = MicrocodeFlashWrite (
 798              Address,
 799              Image,
 800              ImageSize
 801              );
 802   if (!EFI_ERROR(Status)) {
 803     *LastAttemptStatus = LAST_ATTEMPT_STATUS_SUCCESS;
 804   } else {
 805     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_UNSUCCESSFUL;
 806   }
 807   return Status;
 808 }
 809
 810 /**
 811   Update Microcode flash region with FIT.
 812
 813   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
 814   @param[in]  TargetMicrocodeEntryPoint  Target Microcode entrypoint to be updated
 815   @param[in]  Image                      The Microcode image buffer.
 816   @param[in]  ImageSize                  The size of Microcode image buffer in bytes.
 817   @param[out] LastAttemptStatus          The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
 818
 819   @retval EFI_SUCCESS             The Microcode image is written.
 820   @retval EFI_WRITE_PROTECTED     The flash device is read only.
 821 **/
 822 EFI_STATUS
 823 UpdateMicrocodeFlashRegionWithFit (
 824   IN  MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate,
 825   IN  CPU_MICROCODE_HEADER                    *TargetMicrocodeEntryPoint,
 826   IN  VOID                                    *Image,
 827   IN  UINTN                                   ImageSize,
 828   OUT UINT32                                  *LastAttemptStatus
 829   )
 830 {
 831   VOID                                    *MicrocodePatchAddress;
 832   UINTN                                   MicrocodePatchRegionSize;
 833   UINTN                                   TargetTotalSize;
 834   EFI_STATUS                              Status;
 835   VOID                                    *MicrocodePatchScratchBuffer;
 836   UINT8                                   *ScratchBufferPtr;
 837   UINTN                                   ScratchBufferSize;
 838   UINTN                                   RestSize;
 839   UINTN                                   AvailableSize;
 840   VOID                                    *NextMicrocodeEntryPoint;
 841   VOID                                    *EmptyFitMicrocodeEntry;
 842   VOID                                    *UnusedFitMicrocodeEntry;
 843
 844   DEBUG((DEBUG_INFO, "UpdateMicrocodeFlashRegionWithFit: Image - 0x%x, size - 0x%x\n", Image, ImageSize));
 845
 846   MicrocodePatchAddress = MicrocodeFmpPrivate->MicrocodePatchAddress;
 847   MicrocodePatchRegionSize = MicrocodeFmpPrivate->MicrocodePatchRegionSize;
 848
 849   MicrocodePatchScratchBuffer = AllocateZeroPool (MicrocodePatchRegionSize);
 850   if (MicrocodePatchScratchBuffer == NULL) {
 851     DEBUG((DEBUG_ERROR, "Fail to allocate Microcode Scratch buffer\n"));
 852     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
 853     return EFI_OUT_OF_RESOURCES;
 854   }
 855   ScratchBufferPtr = MicrocodePatchScratchBuffer;
 856   ScratchBufferSize = 0;
 857
 858   //
 859   // Target data collection
 860   //
 861   TargetTotalSize = 0;
 862   AvailableSize = 0;
 863   if (TargetMicrocodeEntryPoint != NULL) {
 864     if (TargetMicrocodeEntryPoint->DataSize == 0) {
 865       TargetTotalSize = 2048;
 866     } else {
 867       TargetTotalSize = TargetMicrocodeEntryPoint->TotalSize;
 868     }
 869     DEBUG((DEBUG_INFO, "  TargetTotalSize - 0x%x\n", TargetTotalSize));
 870     NextMicrocodeEntryPoint = GetNextFitMicrocode (MicrocodeFmpPrivate, TargetMicrocodeEntryPoint);
 871     DEBUG((DEBUG_INFO, "  NextMicrocodeEntryPoint - 0x%x\n", NextMicrocodeEntryPoint));
 872     if (NextMicrocodeEntryPoint != NULL) {
 873       ASSERT ((UINTN) NextMicrocodeEntryPoint >= ((UINTN) TargetMicrocodeEntryPoint + TargetTotalSize));
 874       AvailableSize = (UINTN) NextMicrocodeEntryPoint - (UINTN) TargetMicrocodeEntryPoint;
 875     } else {
 876       AvailableSize = (UINTN) MicrocodePatchAddress + MicrocodePatchRegionSize - (UINTN) TargetMicrocodeEntryPoint;
 877     }
 878     DEBUG((DEBUG_INFO, "  AvailableSize - 0x%x\n", AvailableSize));
 879     ASSERT (AvailableSize >= TargetTotalSize);
 880   }
 881   //
 882   // Total Size means the Microcode size.
 883   // Available Size means the Microcode size plus the pad till (1) next Microcode or (2) the end.
 884   //
 885   // (1)
 886   // +------+-----------+-----+------+===================+
 887   // | MCU1 | Microcode | PAD | MCU2 |      Empty        |
 888   // +------+-----------+-----+------+===================+
 889   //        | TotalSize |
 890   //        |<-AvailableSize->|
 891   //
 892   // (2)
 893   // +------+-----------+===================+
 894   // | MCU  | Microcode |      Empty        |
 895   // +------+-----------+===================+
 896   //        | TotalSize |
 897   //        |<-      AvailableSize        ->|
 898   //
 899
 900   //
 901   // Update based on policy
 902   //
 903
 904   //
 905   // 1. If there is enough space to update old one in situ, replace old microcode in situ.
 906   //
 907   if (AvailableSize >= ImageSize) {
 908     DEBUG((DEBUG_INFO, "Replace old microcode in situ\n"));
 909     //
 910     // +------+------------+------+===================+
 911     // |Other | Old Image  | ...  |      Empty        |
 912     // +------+------------+------+===================+
 913     //
 914     // +------+---------+--+------+===================+
 915     // |Other |New Image|FF| ...  |      Empty        |
 916     // +------+---------+--+------+===================+
 917     //
 918     // 1.1. Copy new image
 919     CopyMem (ScratchBufferPtr, Image, ImageSize);
 920     ScratchBufferSize += ImageSize;
 921     ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
 922     // 1.2. Pad 0xFF
 923     RestSize = AvailableSize - ImageSize;
 924     if (RestSize > 0) {
 925       SetMem (ScratchBufferPtr, RestSize, 0xFF);
 926       ScratchBufferSize += RestSize;
 927       ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
 928     }
 929     Status = UpdateMicrocode((UINTN)TargetMicrocodeEntryPoint, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
 930     return Status;
 931   }
 932
 933   //
 934   // 2. If there is empty FIT microcode entry with enough space, use it.
 935   //
 936   EmptyFitMicrocodeEntry = FindEmptyFitMicrocode (MicrocodeFmpPrivate, ImageSize, &AvailableSize);
 937   if (EmptyFitMicrocodeEntry != NULL) {
 938     DEBUG((DEBUG_INFO, "Use empty FIT microcode entry\n"));
 939     // 2.1. Copy new image
 940     CopyMem (ScratchBufferPtr, Image, ImageSize);
 941     ScratchBufferSize += ImageSize;
 942     ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
 943     // 2.2. Pad 0xFF
 944     RestSize = AvailableSize - ImageSize;
 945     if (RestSize > 0) {
 946       SetMem (ScratchBufferPtr, RestSize, 0xFF);
 947       ScratchBufferSize += RestSize;
 948       ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
 949     }
 950     Status = UpdateMicrocode ((UINTN) EmptyFitMicrocodeEntry, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
 951     if (!EFI_ERROR (Status) && (TargetMicrocodeEntryPoint != NULL)) {
 952       //
 953       // Empty old microcode.
 954       //
 955       ScratchBufferPtr = MicrocodePatchScratchBuffer;
 956       SetMem (ScratchBufferPtr, TargetTotalSize, 0xFF);
 957       ScratchBufferSize = TargetTotalSize;
 958       ScratchBufferPtr = (UINT8 *) MicrocodePatchScratchBuffer + ScratchBufferSize;
 959       UpdateMicrocode ((UINTN) TargetMicrocodeEntryPoint, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
 960     }
 961     return Status;
 962   }
 963
 964   //
 965   // 3. If there is unused microcode entry with enough space, use it.
 966   //
 967   UnusedFitMicrocodeEntry = FindUnusedFitMicrocode (MicrocodeFmpPrivate, ImageSize, &AvailableSize);
 968   if (UnusedFitMicrocodeEntry != NULL) {
 969     DEBUG((DEBUG_INFO, "Use unused FIT microcode entry\n"));
 970     // 3.1. Copy new image
 971     CopyMem (ScratchBufferPtr, Image, ImageSize);
 972     ScratchBufferSize += ImageSize;
 973     ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
 974     // 3.2. Pad 0xFF
 975     RestSize = AvailableSize - ImageSize;
 976     if (RestSize > 0) {
 977       SetMem (ScratchBufferPtr, RestSize, 0xFF);
 978       ScratchBufferSize += RestSize;
 979       ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
 980     }
 981     Status = UpdateMicrocode ((UINTN) UnusedFitMicrocodeEntry, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
 982     if (!EFI_ERROR (Status) && (TargetMicrocodeEntryPoint != NULL)) {
 983       //
 984       // Empty old microcode.
 985       //
 986       ScratchBufferPtr = MicrocodePatchScratchBuffer;
 987       SetMem (ScratchBufferPtr, TargetTotalSize, 0xFF);
 988       ScratchBufferSize = TargetTotalSize;
 989       ScratchBufferPtr = (UINT8 *) MicrocodePatchScratchBuffer + ScratchBufferSize;
 990       UpdateMicrocode ((UINTN) TargetMicrocodeEntryPoint, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
 991     }
 992     return Status;
 993   }
 994
 995   //
 996   // 4. No usable FIT microcode entry.
 997   //
 998   DEBUG((DEBUG_ERROR, "No usable FIT microcode entry\n"));
 999   *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
1000   Status = EFI_OUT_OF_RESOURCES;
1001
1002   return Status;
1003 }
1004
1005 /**
1006   Update Microcode flash region.
1007
1008   @param[in]  MicrocodeFmpPrivate        The Microcode driver private data
1009   @param[in]  TargetMicrocodeEntryPoint  Target Microcode entrypoint to be updated
1010   @param[in]  Image                      The Microcode image buffer.
1011   @param[in]  ImageSize                  The size of Microcode image buffer in bytes.
1012   @param[out] LastAttemptStatus          The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
1013
1014   @retval EFI_SUCCESS             The Microcode image is written.
1015   @retval EFI_WRITE_PROTECTED     The flash device is read only.
1016 **/
1017 EFI_STATUS
1018 UpdateMicrocodeFlashRegion (
1019   IN  MICROCODE_FMP_PRIVATE_DATA              *MicrocodeFmpPrivate,
1020   IN  CPU_MICROCODE_HEADER                    *TargetMicrocodeEntryPoint,
1021   IN  VOID                                    *Image,
1022   IN  UINTN                                   ImageSize,
1023   OUT UINT32                                  *LastAttemptStatus
1024   )
1025 {
1026   VOID                                    *MicrocodePatchAddress;
1027   UINTN                                   MicrocodePatchRegionSize;
1028   UINTN                                   TargetTotalSize;
1029   UINTN                                   UsedRegionSize;
1030   EFI_STATUS                              Status;
1031   VOID                                    *MicrocodePatchScratchBuffer;
1032   UINT8                                   *ScratchBufferPtr;
1033   UINTN                                   ScratchBufferSize;
1034   UINTN                                   RestSize;
1035   UINTN                                   AvailableSize;
1036   VOID                                    *NextMicrocodeEntryPoint;
1037   MICROCODE_INFO                          *MicrocodeInfo;
1038   UINTN                                   MicrocodeCount;
1039   UINTN                                   Index;
1040
1041   DEBUG((DEBUG_INFO, "UpdateMicrocodeFlashRegion: Image - 0x%x, size - 0x%x\n", Image, ImageSize));
1042
1043   MicrocodePatchAddress = MicrocodeFmpPrivate->MicrocodePatchAddress;
1044   MicrocodePatchRegionSize = MicrocodeFmpPrivate->MicrocodePatchRegionSize;
1045
1046   MicrocodePatchScratchBuffer = AllocateZeroPool (MicrocodePatchRegionSize);
1047   if (MicrocodePatchScratchBuffer == NULL) {
1048     DEBUG((DEBUG_ERROR, "Fail to allocate Microcode Scratch buffer\n"));
1049     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
1050     return EFI_OUT_OF_RESOURCES;
1051   }
1052   ScratchBufferPtr = MicrocodePatchScratchBuffer;
1053   ScratchBufferSize = 0;
1054
1055   //
1056   // Target data collection
1057   //
1058   TargetTotalSize = 0;
1059   AvailableSize = 0;
1060   NextMicrocodeEntryPoint = NULL;
1061   if (TargetMicrocodeEntryPoint != NULL) {
1062     if (TargetMicrocodeEntryPoint->DataSize == 0) {
1063       TargetTotalSize = 2048;
1064     } else {
1065       TargetTotalSize = TargetMicrocodeEntryPoint->TotalSize;
1066     }
1067     DEBUG((DEBUG_INFO, "  TargetTotalSize - 0x%x\n", TargetTotalSize));
1068     NextMicrocodeEntryPoint = GetNextMicrocode(MicrocodeFmpPrivate, TargetMicrocodeEntryPoint);
1069     DEBUG((DEBUG_INFO, "  NextMicrocodeEntryPoint - 0x%x\n", NextMicrocodeEntryPoint));
1070     if (NextMicrocodeEntryPoint != NULL) {
1071       ASSERT ((UINTN)NextMicrocodeEntryPoint >= ((UINTN)TargetMicrocodeEntryPoint + TargetTotalSize));
1072       AvailableSize = (UINTN)NextMicrocodeEntryPoint - (UINTN)TargetMicrocodeEntryPoint;
1073     } else {
1074       AvailableSize = (UINTN)MicrocodePatchAddress + MicrocodePatchRegionSize - (UINTN)TargetMicrocodeEntryPoint;
1075     }
1076     DEBUG((DEBUG_INFO, "  AvailableSize - 0x%x\n", AvailableSize));
1077     ASSERT (AvailableSize >= TargetTotalSize);
1078   }
1079   UsedRegionSize = GetCurrentMicrocodeUsedRegionSize(MicrocodeFmpPrivate);
1080   DEBUG((DEBUG_INFO, "  UsedRegionSize - 0x%x\n", UsedRegionSize));
1081   ASSERT (UsedRegionSize >= TargetTotalSize);
1082   if (TargetMicrocodeEntryPoint != NULL) {
1083     ASSERT ((UINTN)MicrocodePatchAddress + UsedRegionSize >= ((UINTN)TargetMicrocodeEntryPoint + TargetTotalSize));
1084   }
1085   //
1086   // Total Size means the Microcode size.
1087   // Available Size means the Microcode size plus the pad till (1) next Microcode or (2) the end.
1088   //
1089   // (1)
1090   // +------+-----------+-----+------+===================+
1091   // | MCU1 | Microcode | PAD | MCU2 |      Empty        |
1092   // +------+-----------+-----+------+===================+
1093   //        | TotalSize |
1094   //        |<-AvailableSize->|
1095   // |<-        UsedRegionSize     ->|
1096   //
1097   // (2)
1098   // +------+-----------+===================+
1099   // | MCU  | Microcode |      Empty        |
1100   // +------+-----------+===================+
1101   //        | TotalSize |
1102   //        |<-      AvailableSize        ->|
1103   // |<-UsedRegionSize->|
1104   //
1105
1106   //
1107   // Update based on policy
1108   //
1109
1110   //
1111   // 1. If there is enough space to update old one in situ, replace old microcode in situ.
1112   //
1113   if (AvailableSize >= ImageSize) {
1114     DEBUG((DEBUG_INFO, "Replace old microcode in situ\n"));
1115     //
1116     // +------+------------+------+===================+
1117     // |Other | Old Image  | ...  |      Empty        |
1118     // +------+------------+------+===================+
1119     //
1120     // +------+---------+--+------+===================+
1121     // |Other |New Image|FF| ...  |      Empty        |
1122     // +------+---------+--+------+===================+
1123     //
1124     // 1.1. Copy new image
1125     CopyMem (ScratchBufferPtr, Image, ImageSize);
1126     ScratchBufferSize += ImageSize;
1127     ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1128     // 1.2. Pad 0xFF
1129     RestSize = AvailableSize - ImageSize;
1130     if (RestSize > 0) {
1131       SetMem (ScratchBufferPtr, RestSize, 0xFF);
1132       ScratchBufferSize += RestSize;
1133       ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1134     }
1135     Status = UpdateMicrocode((UINTN)TargetMicrocodeEntryPoint, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
1136     return Status;
1137   }
1138
1139   //
1140   // 2. If there is enough space to remove old one and add new one, reorg and replace old microcode.
1141   //
1142   if (MicrocodePatchRegionSize - (UsedRegionSize - TargetTotalSize) >= ImageSize) {
1143     if (TargetMicrocodeEntryPoint == NULL) {
1144       DEBUG((DEBUG_INFO, "Append new microcode\n"));
1145       //
1146       // +------+------------+------+===================+
1147       // |Other1|   Other    |Other2|      Empty        |
1148       // +------+------------+------+===================+
1149       //
1150       // +------+------------+------+-----------+=======+
1151       // |Other1|   Other    |Other2| New Image | Empty |
1152       // +------+------------+------+-----------+=======+
1153       //
1154       Status = UpdateMicrocode((UINTN)MicrocodePatchAddress + UsedRegionSize, Image, ImageSize, LastAttemptStatus);
1155     } else {
1156       DEBUG((DEBUG_INFO, "Reorg and replace old microcode\n"));
1157       //
1158       // +------+------------+------+===================+
1159       // |Other | Old Image  | ...  |      Empty        |
1160       // +------+------------+------+===================+
1161       //
1162       // +------+---------------+------+================+
1163       // |Other |   New Image   | ...  |      Empty     |
1164       // +------+---------------+------+================+
1165       //
1166       // 2.1. Copy new image
1167       CopyMem (ScratchBufferPtr, Image, ImageSize);
1168       ScratchBufferSize += ImageSize;
1169       ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1170       // 2.2. Copy rest images after the old image.
1171       if (NextMicrocodeEntryPoint != 0) {
1172         RestSize = (UINTN)MicrocodePatchAddress + UsedRegionSize - ((UINTN)NextMicrocodeEntryPoint);
1173         CopyMem (ScratchBufferPtr, NextMicrocodeEntryPoint, RestSize);
1174         ScratchBufferSize += RestSize;
1175         ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1176       }
1177       Status = UpdateMicrocode((UINTN)TargetMicrocodeEntryPoint, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
1178     }
1179     return Status;
1180   }
1181
1182   //
1183   // 3. The new image can be put in MCU region, but not all others can be put.
1184   //    So all the unused MCU is removed.
1185   //
1186   if (MicrocodePatchRegionSize >= ImageSize) {
1187     //
1188     // +------+------------+------+===================+
1189     // |Other1| Old Image  |Other2|      Empty        |
1190     // +------+------------+------+===================+
1191     //
1192     // +-------------------------------------+--------+
1193     // |        New Image                    | Other  |
1194     // +-------------------------------------+--------+
1195     //
1196     DEBUG((DEBUG_INFO, "Add new microcode from beginning\n"));
1197
1198     MicrocodeCount = MicrocodeFmpPrivate->DescriptorCount;
1199     MicrocodeInfo = MicrocodeFmpPrivate->MicrocodeInfo;
1200
1201     // 3.1. Copy new image
1202     CopyMem (ScratchBufferPtr, Image, ImageSize);
1203     ScratchBufferSize += ImageSize;
1204     ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1205     // 3.2. Copy some others to rest buffer
1206     for (Index = 0; Index < MicrocodeCount; Index++) {
1207       if (!MicrocodeInfo[Index].InUse) {
1208         continue;
1209       }
1210       if (MicrocodeInfo[Index].MicrocodeEntryPoint == TargetMicrocodeEntryPoint) {
1211         continue;
1212       }
1213       if (MicrocodeInfo[Index].TotalSize <= MicrocodePatchRegionSize - ScratchBufferSize) {
1214         CopyMem (ScratchBufferPtr, MicrocodeInfo[Index].MicrocodeEntryPoint, MicrocodeInfo[Index].TotalSize);
1215         ScratchBufferSize += MicrocodeInfo[Index].TotalSize;
1216         ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1217       }
1218     }
1219     // 3.3. Pad 0xFF
1220     RestSize = MicrocodePatchRegionSize - ScratchBufferSize;
1221     if (RestSize > 0) {
1222       SetMem (ScratchBufferPtr, RestSize, 0xFF);
1223       ScratchBufferSize += RestSize;
1224       ScratchBufferPtr = (UINT8 *)MicrocodePatchScratchBuffer + ScratchBufferSize;
1225     }
1226     Status = UpdateMicrocode((UINTN)MicrocodePatchAddress, MicrocodePatchScratchBuffer, ScratchBufferSize, LastAttemptStatus);
1227     return Status;
1228   }
1229
1230   //
1231   // 4. The new image size is bigger than the whole MCU region.
1232   //
1233   DEBUG((DEBUG_ERROR, "Microcode too big\n"));
1234   *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
1235   Status = EFI_OUT_OF_RESOURCES;
1236
1237   return Status;
1238 }
1239
1240 /**
1241   Write Microcode.
1242
1243   Caution: This function may receive untrusted input.
1244
1245   @param[in]   MicrocodeFmpPrivate The Microcode driver private data
1246   @param[in]   Image               The Microcode image buffer.
1247   @param[in]   ImageSize           The size of Microcode image buffer in bytes.
1248   @param[out]  LastAttemptVersion  The last attempt version, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
1249   @param[out]  LastAttemptStatus   The last attempt status, which will be recorded in ESRT and FMP EFI_FIRMWARE_IMAGE_DESCRIPTOR.
1250   @param[out]  AbortReason         A pointer to a pointer to a null-terminated string providing more
1251                                    details for the aborted operation. The buffer is allocated by this function
1252                                    with AllocatePool(), and it is the caller's responsibility to free it with a
1253                                    call to FreePool().
1254
1255   @retval EFI_SUCCESS               The Microcode image is written.
1256   @retval EFI_VOLUME_CORRUPTED      The Microcode image is corrupted.
1257   @retval EFI_INCOMPATIBLE_VERSION  The Microcode image version is incorrect.
1258   @retval EFI_SECURITY_VIOLATION    The Microcode image fails to load.
1259   @retval EFI_WRITE_PROTECTED       The flash device is read only.
1260 **/
1261 EFI_STATUS
1262 MicrocodeWrite (
1263   IN  MICROCODE_FMP_PRIVATE_DATA   *MicrocodeFmpPrivate,
1264   IN  VOID                         *Image,
1265   IN  UINTN                        ImageSize,
1266   OUT UINT32                       *LastAttemptVersion,
1267   OUT UINT32                       *LastAttemptStatus,
1268   OUT CHAR16                       **AbortReason
1269   )
1270 {
1271   EFI_STATUS                              Status;
1272   VOID                                    *AlignedImage;
1273   CPU_MICROCODE_HEADER                    *TargetMicrocodeEntryPoint;
1274   UINTN                                   TargetCpuIndex;
1275   UINTN                                   TargetMicrcodeIndex;
1276
1277   //
1278   // MCU must be 16 bytes aligned
1279   //
1280   AlignedImage = AllocateCopyPool(ImageSize, Image);
1281   if (AlignedImage == NULL) {
1282     DEBUG((DEBUG_ERROR, "Fail to allocate aligned image\n"));
1283     *LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INSUFFICIENT_RESOURCES;
1284     return EFI_OUT_OF_RESOURCES;
1285   }
1286
1287   TargetCpuIndex = (UINTN)-1;
1288   Status = VerifyMicrocode(MicrocodeFmpPrivate, AlignedImage, ImageSize, TRUE, LastAttemptStatus, AbortReason, &TargetCpuIndex);
1289   if (EFI_ERROR(Status)) {
1290     DEBUG((DEBUG_ERROR, "Fail to verify Microcode Region\n"));
1291     FreePool(AlignedImage);
1292     return Status;
1293   }
1294   DEBUG((DEBUG_INFO, "Pass VerifyMicrocode\n"));
1295   *LastAttemptVersion = ((CPU_MICROCODE_HEADER *)Image)->UpdateRevision;
1296
1297   DEBUG((DEBUG_INFO, "  TargetCpuIndex - 0x%x\n", TargetCpuIndex));
1298   ASSERT (TargetCpuIndex < MicrocodeFmpPrivate->ProcessorCount);
1299   TargetMicrcodeIndex = MicrocodeFmpPrivate->ProcessorInfo[TargetCpuIndex].MicrocodeIndex;
1300   DEBUG((DEBUG_INFO, "  TargetMicrcodeIndex - 0x%x\n", TargetMicrcodeIndex));
1301   if (TargetMicrcodeIndex != (UINTN)-1) {
1302     ASSERT (TargetMicrcodeIndex < MicrocodeFmpPrivate->DescriptorCount);
1303     TargetMicrocodeEntryPoint = MicrocodeFmpPrivate->MicrocodeInfo[TargetMicrcodeIndex].MicrocodeEntryPoint;
1304   } else {
1305     TargetMicrocodeEntryPoint = NULL;
1306   }
1307   DEBUG((DEBUG_INFO, "  TargetMicrocodeEntryPoint - 0x%x\n", TargetMicrocodeEntryPoint));
1308
1309   if (MicrocodeFmpPrivate->FitMicrocodeInfo != NULL) {
1310     Status = UpdateMicrocodeFlashRegionWithFit (
1311                MicrocodeFmpPrivate,
1312                TargetMicrocodeEntryPoint,
1313                AlignedImage,
1314                ImageSize,
1315                LastAttemptStatus
1316                );
1317   } else {
1318     Status = UpdateMicrocodeFlashRegion (
1319                MicrocodeFmpPrivate,
1320                TargetMicrocodeEntryPoint,
1321                AlignedImage,
1322                ImageSize,
1323                LastAttemptStatus
1324                );
1325   }
1326
1327   FreePool(AlignedImage);
1328
1329   return Status;
1330 }
1331
1332