MdeModulePkg/Universal/CapsulePei/Common/CapsuleCoalesce.c

   1 /** @file
   2   The logic to process capsule.
   3
   4   Caution: This module requires additional review when modified.
   5   This driver will have external input - capsule image.
   6   This external input must be validated carefully to avoid security issue like
   7   buffer overflow, integer overflow.
   8
   9   CapsuleDataCoalesce() will do basic validation before coalesce capsule data
  10   into memory.
  11
  12 (C) Copyright 2014 Hewlett-Packard Development Company, L.P.<BR>
  13 Copyright (c) 2011 - 2018, Intel Corporation. All rights reserved.<BR>
  14 This program and the accompanying materials
  15 are licensed and made available under the terms and conditions of the BSD License
  16 which accompanies this distribution.  The full text of the license may be found at
  17 http://opensource.org/licenses/bsd-license.php
  18
  19 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  20 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  21
  22 **/
  23
  24 #include <Uefi.h>
  25 #include <PiPei.h>
  26
  27 #include <Guid/CapsuleVendor.h>
  28
  29 #include <Library/BaseMemoryLib.h>
  30 #include <Library/DebugLib.h>
  31 #include <Library/PrintLib.h>
  32 #include <Library/BaseLib.h>
  33
  34 #include "CommonHeader.h"
  35
  36 #define MIN_COALESCE_ADDR                     (1024 * 1024)
  37
  38 /**
  39   Given a pointer to the capsule block list, info on the available system
  40   memory, and the size of a buffer, find a free block of memory where a
  41   buffer of the given size can be copied to safely.
  42
  43   @param BlockList   Pointer to head of capsule block descriptors
  44   @param MemBase     Pointer to the base of memory in which we want to find free space
  45   @param MemSize     The size of the block of memory pointed to by MemBase
  46   @param DataSize    How big a free block we want to find
  47
  48   @return A pointer to a memory block of at least DataSize that lies somewhere
  49           between MemBase and (MemBase + MemSize). The memory pointed to does not
  50           contain any of the capsule block descriptors or capsule blocks pointed to
  51           by the BlockList.
  52
  53 **/
  54 UINT8 *
  55 FindFreeMem (
  56   EFI_CAPSULE_BLOCK_DESCRIPTOR     *BlockList,
  57   UINT8                            *MemBase,
  58   UINTN                             MemSize,
  59   UINTN                             DataSize
  60   );
  61
  62 /**
  63   The capsule block descriptors may be fragmented and spread all over memory.
  64   To simplify the coalescing of capsule blocks, first coalesce all the
  65   capsule block descriptors low in memory.
  66
  67   The descriptors passed in can be fragmented throughout memory. Here
  68   they are relocated into memory to turn them into a contiguous (null
  69   terminated) array.
  70
  71   @param PeiServices    pointer to PEI services table
  72   @param BlockList      pointer to the capsule block descriptors
  73   @param NumDescriptors number of capsule data block descriptors, whose Length is non-zero.
  74   @param MemBase        base of system memory in which we can work
  75   @param MemSize        size of the system memory pointed to by MemBase
  76
  77   @retval NULL    could not relocate the descriptors
  78   @retval Pointer to the base of the successfully-relocated block descriptors.
  79
  80 **/
  81 EFI_CAPSULE_BLOCK_DESCRIPTOR *
  82 RelocateBlockDescriptors (
  83   IN EFI_PEI_SERVICES                  **PeiServices,
  84   IN EFI_CAPSULE_BLOCK_DESCRIPTOR      *BlockList,
  85   IN UINTN                              NumDescriptors,
  86   IN UINT8                             *MemBase,
  87   IN UINTN                             MemSize
  88   );
  89
  90 /**
  91   Check every capsule header.
  92
  93   @param CapsuleHeader   The pointer to EFI_CAPSULE_HEADER
  94
  95   @retval FALSE  Capsule is OK
  96   @retval TRUE   Capsule is corrupted
  97
  98 **/
  99 BOOLEAN
 100 IsCapsuleCorrupted (
 101   IN EFI_CAPSULE_HEADER       *CapsuleHeader
 102   );
 103
 104 /**
 105   Determine if two buffers overlap in memory.
 106
 107   @param Buff1   pointer to first buffer
 108   @param Size1   size of Buff1
 109   @param Buff2   pointer to second buffer
 110   @param Size2   size of Buff2
 111
 112   @retval TRUE    Buffers overlap in memory.
 113   @retval FALSE   Buffer doesn't overlap.
 114
 115 **/
 116 BOOLEAN
 117 IsOverlapped (
 118   UINT8     *Buff1,
 119   UINTN     Size1,
 120   UINT8     *Buff2,
 121   UINTN     Size2
 122   );
 123
 124 /**
 125   Given a pointer to a capsule block descriptor, traverse the list to figure
 126   out how many legitimate descriptors there are, and how big the capsule it
 127   refers to is.
 128
 129   @param Desc            Pointer to the capsule block descriptors
 130   @param NumDescriptors  Optional pointer to where to return the number of capsule data descriptors, whose Length is non-zero.
 131   @param CapsuleSize     Optional pointer to where to return the capsule image size
 132   @param CapsuleNumber   Optional pointer to where to return the number of capsule
 133
 134   @retval EFI_NOT_FOUND   No descriptors containing data in the list
 135   @retval EFI_SUCCESS     Return data is valid
 136
 137 **/
 138 EFI_STATUS
 139 GetCapsuleInfo (
 140   IN EFI_CAPSULE_BLOCK_DESCRIPTOR   *Desc,
 141   IN OUT UINTN                      *NumDescriptors OPTIONAL,
 142   IN OUT UINTN                      *CapsuleSize OPTIONAL,
 143   IN OUT UINTN                      *CapsuleNumber OPTIONAL
 144   );
 145
 146 /**
 147   Given a pointer to the capsule block list, info on the available system
 148   memory, and the size of a buffer, find a free block of memory where a
 149   buffer of the given size can be copied to safely.
 150
 151   @param BlockList   Pointer to head of capsule block descriptors
 152   @param MemBase     Pointer to the base of memory in which we want to find free space
 153   @param MemSize     The size of the block of memory pointed to by MemBase
 154   @param DataSize    How big a free block we want to find
 155
 156   @return A pointer to a memory block of at least DataSize that lies somewhere
 157           between MemBase and (MemBase + MemSize). The memory pointed to does not
 158           contain any of the capsule block descriptors or capsule blocks pointed to
 159           by the BlockList.
 160
 161 **/
 162 UINT8 *
 163 FindFreeMem (
 164   EFI_CAPSULE_BLOCK_DESCRIPTOR      *BlockList,
 165   UINT8                             *MemBase,
 166   UINTN                             MemSize,
 167   UINTN                             DataSize
 168   )
 169 {
 170   UINTN                           Size;
 171   EFI_CAPSULE_BLOCK_DESCRIPTOR    *CurrDesc;
 172   EFI_CAPSULE_BLOCK_DESCRIPTOR    *TempDesc;
 173   UINT8                           *MemEnd;
 174   BOOLEAN                         Failed;
 175
 176   //
 177   // Need at least enough to copy the data to at the end of the buffer, so
 178   // say the end is less the data size for easy comparisons here.
 179   //
 180   MemEnd    = MemBase + MemSize - DataSize;
 181   CurrDesc  = BlockList;
 182   //
 183   // Go through all the descriptor blocks and see if any obstruct the range
 184   //
 185   while (CurrDesc != NULL) {
 186     //
 187     // Get the size of this block list and see if it's in the way
 188     //
 189     Failed    = FALSE;
 190     TempDesc  = CurrDesc;
 191     Size      = sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR);
 192     while (TempDesc->Length != 0) {
 193       Size += sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR);
 194       TempDesc++;
 195     }
 196
 197     if (IsOverlapped (MemBase, DataSize, (UINT8 *) CurrDesc, Size)) {
 198       //
 199       // Set our new base to the end of this block list and start all over
 200       //
 201       MemBase   = (UINT8 *) CurrDesc + Size;
 202       CurrDesc  = BlockList;
 203       if (MemBase > MemEnd) {
 204         return NULL;
 205       }
 206
 207       Failed = TRUE;
 208     }
 209     //
 210     // Now go through all the blocks and make sure none are in the way
 211     //
 212     while ((CurrDesc->Length != 0) && (!Failed)) {
 213       if (IsOverlapped (MemBase, DataSize, (UINT8 *) (UINTN) CurrDesc->Union.DataBlock, (UINTN) CurrDesc->Length)) {
 214         //
 215         // Set our new base to the end of this block and start all over
 216         //
 217         Failed    = TRUE;
 218         MemBase   = (UINT8 *) ((UINTN) CurrDesc->Union.DataBlock) + CurrDesc->Length;
 219         CurrDesc  = BlockList;
 220         if (MemBase > MemEnd) {
 221           return NULL;
 222         }
 223       }
 224       CurrDesc++;
 225     }
 226     //
 227     // Normal continuation -- jump to next block descriptor list
 228     //
 229     if (!Failed) {
 230       CurrDesc = (EFI_CAPSULE_BLOCK_DESCRIPTOR  *) (UINTN) CurrDesc->Union.ContinuationPointer;
 231     }
 232   }
 233   return MemBase;
 234 }
 235
 236 /**
 237   Validate capsule by MemoryResource.
 238
 239   @param MemoryResource  Pointer to the buffer of memory resource descriptor.
 240   @param Address         Address to be validated.
 241   @param Size            Size to be validated.
 242
 243   @retval TRUE  No memory resource descriptor reported in HOB list before capsule Coalesce,
 244                 or it is valid in one MemoryResource.
 245           FALSE It is not in any MemoryResource.
 246
 247 **/
 248 BOOLEAN
 249 ValidateCapsuleByMemoryResource (
 250   IN MEMORY_RESOURCE_DESCRIPTOR     *MemoryResource,
 251   IN EFI_PHYSICAL_ADDRESS           Address,
 252   IN UINT64                         Size
 253   )
 254 {
 255   UINTN             Index;
 256
 257   //
 258   // Sanity Check
 259   //
 260   if (Size > MAX_ADDRESS) {
 261     DEBUG ((EFI_D_ERROR, "ERROR: Size(0x%lx) > MAX_ADDRESS\n", Size));
 262     return FALSE;
 263   }
 264
 265   //
 266   // Sanity Check
 267   //
 268   if (Address > (MAX_ADDRESS - Size)) {
 269     DEBUG ((EFI_D_ERROR, "ERROR: Address(0x%lx) > (MAX_ADDRESS - Size(0x%lx))\n", Address, Size));
 270     return FALSE;
 271   }
 272
 273   if (MemoryResource == NULL) {
 274     //
 275     // No memory resource descriptor reported in HOB list before capsule Coalesce.
 276     //
 277     return TRUE;
 278   }
 279
 280   for (Index = 0; MemoryResource[Index].ResourceLength != 0; Index++) {
 281     if ((Address >= MemoryResource[Index].PhysicalStart) &&
 282         ((Address + Size) <= (MemoryResource[Index].PhysicalStart + MemoryResource[Index].ResourceLength))) {
 283       DEBUG ((EFI_D_INFO, "Address(0x%lx) Size(0x%lx) in MemoryResource[0x%x] - Start(0x%lx) Length(0x%lx)\n",
 284                           Address, Size,
 285                           Index, MemoryResource[Index].PhysicalStart, MemoryResource[Index].ResourceLength));
 286       return TRUE;
 287     }
 288   }
 289
 290   DEBUG ((EFI_D_ERROR, "ERROR: Address(0x%lx) Size(0x%lx) not in any MemoryResource\n", Address, Size));
 291   return FALSE;
 292 }
 293
 294 /**
 295   Check the integrity of the capsule descriptors.
 296
 297   @param BlockList       Pointer to the capsule descriptors
 298   @param MemoryResource  Pointer to the buffer of memory resource descriptor.
 299
 300   @retval NULL           BlockList is not valid.
 301   @retval LastBlockDesc  Last one Block in BlockList
 302
 303 **/
 304 EFI_CAPSULE_BLOCK_DESCRIPTOR *
 305 ValidateCapsuleIntegrity (
 306   IN EFI_CAPSULE_BLOCK_DESCRIPTOR    *BlockList,
 307   IN MEMORY_RESOURCE_DESCRIPTOR      *MemoryResource
 308   )
 309 {
 310   EFI_CAPSULE_HEADER             *CapsuleHeader;
 311   UINT64                         CapsuleSize;
 312   UINTN                          CapsuleCount;
 313   EFI_CAPSULE_BLOCK_DESCRIPTOR   *Ptr;
 314
 315   DEBUG ((EFI_D_INFO, "ValidateCapsuleIntegrity\n"));
 316
 317   //
 318   // Go through the list to look for inconsistencies. Check for:
 319   //   * misaligned block descriptors.
 320   //   * The first capsule header guid
 321   //   * The first capsule header flag
 322   //   * The first capsule header HeaderSize
 323   //   * Below check will be done in ValidateCapsuleByMemoryResource()
 324   //     Length > MAX_ADDRESS
 325   //     Ptr + sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR) > MAX_ADDRESS
 326   //     DataBlock + Length > MAX_ADDRESS
 327   //
 328   CapsuleSize  = 0;
 329   CapsuleCount = 0;
 330   Ptr = BlockList;
 331
 332   if (!ValidateCapsuleByMemoryResource (MemoryResource, (EFI_PHYSICAL_ADDRESS) (UINTN) Ptr, sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR))) {
 333     return NULL;
 334   }
 335
 336   DEBUG ((EFI_D_INFO, "Ptr - 0x%x\n", Ptr));
 337   DEBUG ((EFI_D_INFO, "Ptr->Length - 0x%x\n", Ptr->Length));
 338   DEBUG ((EFI_D_INFO, "Ptr->Union - 0x%x\n", Ptr->Union.ContinuationPointer));
 339   while ((Ptr->Length != 0) || (Ptr->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL)) {
 340     //
 341     // Make sure the descriptor is aligned at UINT64 in memory
 342     //
 343     if ((UINTN) Ptr & (sizeof(UINT64) - 1)) {
 344       DEBUG ((EFI_D_ERROR, "ERROR: BlockList address failed alignment check\n"));
 345       return NULL;
 346     }
 347
 348     if (Ptr->Length == 0) {
 349       //
 350       // Descriptor points to another list of block descriptors somewhere
 351       // else.
 352       //
 353       Ptr = (EFI_CAPSULE_BLOCK_DESCRIPTOR  *) (UINTN) Ptr->Union.ContinuationPointer;
 354       if (!ValidateCapsuleByMemoryResource (MemoryResource, (EFI_PHYSICAL_ADDRESS) (UINTN) Ptr, sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR))) {
 355         return NULL;
 356       }
 357       DEBUG ((EFI_D_INFO, "Ptr(C) - 0x%x\n", Ptr));
 358       DEBUG ((EFI_D_INFO, "Ptr->Length - 0x%x\n", Ptr->Length));
 359       DEBUG ((EFI_D_INFO, "Ptr->Union - 0x%x\n", Ptr->Union.ContinuationPointer));
 360     } else {
 361       if (!ValidateCapsuleByMemoryResource (MemoryResource, Ptr->Union.DataBlock, Ptr->Length)) {
 362         return NULL;
 363       }
 364
 365       //
 366       //To enhance the reliability of check-up, the first capsule's header is checked here.
 367       //More reliabilities check-up will do later.
 368       //
 369       if (CapsuleSize == 0) {
 370         //
 371         //Move to the first capsule to check its header.
 372         //
 373         CapsuleHeader = (EFI_CAPSULE_HEADER*)((UINTN)Ptr->Union.DataBlock);
 374         //
 375         // Sanity check
 376         //
 377         if (Ptr->Length < sizeof(EFI_CAPSULE_HEADER)) {
 378           DEBUG ((EFI_D_ERROR, "ERROR: Ptr->Length(0x%lx) < sizeof(EFI_CAPSULE_HEADER)\n", Ptr->Length));
 379           return NULL;
 380         }
 381         //
 382         // Make sure HeaderSize field is valid
 383         //
 384         if (CapsuleHeader->HeaderSize > CapsuleHeader->CapsuleImageSize) {
 385           DEBUG ((EFI_D_ERROR, "ERROR: CapsuleHeader->HeaderSize(0x%x) > CapsuleHeader->CapsuleImageSize(0x%x)\n", CapsuleHeader->HeaderSize, CapsuleHeader->CapsuleImageSize));
 386           return NULL;
 387         }
 388         if (IsCapsuleCorrupted (CapsuleHeader)) {
 389           return NULL;
 390         }
 391         CapsuleCount ++;
 392         CapsuleSize = CapsuleHeader->CapsuleImageSize;
 393       }
 394
 395       if (CapsuleSize >= Ptr->Length) {
 396         CapsuleSize = CapsuleSize - Ptr->Length;
 397       } else {
 398         DEBUG ((EFI_D_ERROR, "ERROR: CapsuleSize(0x%lx) < Ptr->Length(0x%lx)\n", CapsuleSize, Ptr->Length));
 399         //
 400         // Sanity check
 401         //
 402         return NULL;
 403       }
 404
 405       //
 406       // Move to next BLOCK descriptor
 407       //
 408       Ptr++;
 409       if (!ValidateCapsuleByMemoryResource (MemoryResource, (EFI_PHYSICAL_ADDRESS) (UINTN) Ptr, sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR))) {
 410         return NULL;
 411       }
 412       DEBUG ((EFI_D_INFO, "Ptr(B) - 0x%x\n", Ptr));
 413       DEBUG ((EFI_D_INFO, "Ptr->Length - 0x%x\n", Ptr->Length));
 414       DEBUG ((EFI_D_INFO, "Ptr->Union - 0x%x\n", Ptr->Union.ContinuationPointer));
 415     }
 416   }
 417
 418   if (CapsuleCount == 0) {
 419     //
 420     // No any capsule is found in BlockList
 421     //
 422     DEBUG ((EFI_D_ERROR, "ERROR: CapsuleCount(0x%x) == 0\n", CapsuleCount));
 423     return NULL;
 424   }
 425
 426   if (CapsuleSize != 0) {
 427     //
 428     // Capsule data is incomplete.
 429     //
 430     DEBUG ((EFI_D_ERROR, "ERROR: CapsuleSize(0x%lx) != 0\n", CapsuleSize));
 431     return NULL;
 432   }
 433
 434   return Ptr;
 435 }
 436
 437 /**
 438   The capsule block descriptors may be fragmented and spread all over memory.
 439   To simplify the coalescing of capsule blocks, first coalesce all the
 440   capsule block descriptors low in memory.
 441
 442   The descriptors passed in can be fragmented throughout memory. Here
 443   they are relocated into memory to turn them into a contiguous (null
 444   terminated) array.
 445
 446   @param PeiServices    pointer to PEI services table
 447   @param BlockList      pointer to the capsule block descriptors
 448   @param NumDescriptors number of capsule data block descriptors, whose Length is non-zero.
 449   @param MemBase        base of system memory in which we can work
 450   @param MemSize        size of the system memory pointed to by MemBase
 451
 452   @retval NULL    could not relocate the descriptors
 453   @retval Pointer to the base of the successfully-relocated block descriptors.
 454
 455 **/
 456 EFI_CAPSULE_BLOCK_DESCRIPTOR  *
 457 RelocateBlockDescriptors (
 458   IN EFI_PEI_SERVICES                   **PeiServices,
 459   IN EFI_CAPSULE_BLOCK_DESCRIPTOR       *BlockList,
 460   IN UINTN                              NumDescriptors,
 461   IN UINT8                              *MemBase,
 462   IN UINTN                              MemSize
 463   )
 464 {
 465   EFI_CAPSULE_BLOCK_DESCRIPTOR   *NewBlockList;
 466   EFI_CAPSULE_BLOCK_DESCRIPTOR   *CurrBlockDescHead;
 467   EFI_CAPSULE_BLOCK_DESCRIPTOR   *TempBlockDesc;
 468   EFI_CAPSULE_BLOCK_DESCRIPTOR   *PrevBlockDescTail;
 469   UINTN                          BufferSize;
 470   UINT8                          *RelocBuffer;
 471   UINTN                          BlockListSize;
 472
 473   //
 474   // Get the info on the blocks and descriptors. Since we're going to move
 475   // the descriptors low in memory, adjust the base/size values accordingly here.
 476   // NumDescriptors is the number of legit data descriptors, so add one for
 477   // a terminator. (Already done by caller, no check is needed.)
 478   //
 479
 480   BufferSize    = NumDescriptors * sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR);
 481   NewBlockList  = (EFI_CAPSULE_BLOCK_DESCRIPTOR *) MemBase;
 482   if (MemSize < BufferSize) {
 483     return NULL;
 484   }
 485
 486   MemSize -= BufferSize;
 487   MemBase += BufferSize;
 488   //
 489   // Go through all the blocks and make sure none are in the way
 490   //
 491   TempBlockDesc = BlockList;
 492   while (TempBlockDesc->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL) {
 493     if (TempBlockDesc->Length == 0) {
 494       //
 495       // Next block of descriptors
 496       //
 497       TempBlockDesc = (EFI_CAPSULE_BLOCK_DESCRIPTOR  *) (UINTN) TempBlockDesc->Union.ContinuationPointer;
 498     } else {
 499       //
 500       // If the capsule data pointed to by this descriptor is in the way,
 501       // move it.
 502       //
 503       if (IsOverlapped (
 504             (UINT8 *) NewBlockList,
 505             BufferSize,
 506             (UINT8 *) (UINTN) TempBlockDesc->Union.DataBlock,
 507             (UINTN) TempBlockDesc->Length
 508             )) {
 509         //
 510         // Relocate the block
 511         //
 512         RelocBuffer = FindFreeMem (BlockList, MemBase, MemSize, (UINTN) TempBlockDesc->Length);
 513         if (RelocBuffer == NULL) {
 514           return NULL;
 515         }
 516
 517         CopyMem ((VOID *) RelocBuffer, (VOID *) (UINTN) TempBlockDesc->Union.DataBlock, (UINTN) TempBlockDesc->Length);
 518         DEBUG ((EFI_D_INFO, "Capsule relocate descriptors from/to/size  0x%lX 0x%lX 0x%lX\n", TempBlockDesc->Union.DataBlock, (UINT64)(UINTN)RelocBuffer, TempBlockDesc->Length));
 519         TempBlockDesc->Union.DataBlock = (EFI_PHYSICAL_ADDRESS) (UINTN) RelocBuffer;
 520       }
 521       TempBlockDesc++;
 522     }
 523   }
 524   //
 525   // Now go through all the block descriptors to make sure that they're not
 526   // in the memory region we want to copy them to.
 527   //
 528   CurrBlockDescHead = BlockList;
 529   PrevBlockDescTail = NULL;
 530   while ((CurrBlockDescHead != NULL) && (CurrBlockDescHead->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL)) {
 531     //
 532     // Get the size of this list then see if it overlaps our low region
 533     //
 534     TempBlockDesc = CurrBlockDescHead;
 535     BlockListSize = sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR);
 536     while (TempBlockDesc->Length != 0) {
 537       BlockListSize += sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR);
 538       TempBlockDesc++;
 539     }
 540
 541     if (IsOverlapped (
 542           (UINT8 *) NewBlockList,
 543           BufferSize,
 544           (UINT8 *) CurrBlockDescHead,
 545           BlockListSize
 546           )) {
 547       //
 548       // Overlaps, so move it out of the way
 549       //
 550       RelocBuffer = FindFreeMem (BlockList, MemBase, MemSize, BlockListSize);
 551       if (RelocBuffer == NULL) {
 552         return NULL;
 553       }
 554       CopyMem ((VOID *) RelocBuffer, (VOID *) CurrBlockDescHead, BlockListSize);
 555       DEBUG ((EFI_D_INFO, "Capsule reloc descriptor block #2\n"));
 556       //
 557       // Point the previous block's next point to this copied version. If
 558       // the tail pointer is null, then this is the first descriptor block.
 559       //
 560       if (PrevBlockDescTail == NULL) {
 561         BlockList = (EFI_CAPSULE_BLOCK_DESCRIPTOR  *) RelocBuffer;
 562       } else {
 563         PrevBlockDescTail->Union.DataBlock = (EFI_PHYSICAL_ADDRESS) (UINTN) RelocBuffer;
 564       }
 565     }
 566     //
 567     // Save our new tail and jump to the next block list
 568     //
 569     PrevBlockDescTail = TempBlockDesc;
 570     CurrBlockDescHead = (EFI_CAPSULE_BLOCK_DESCRIPTOR  *) (UINTN) TempBlockDesc->Union.ContinuationPointer;
 571   }
 572   //
 573   // Cleared out low memory. Now copy the descriptors down there.
 574   //
 575   TempBlockDesc     = BlockList;
 576   CurrBlockDescHead = NewBlockList;
 577   while ((TempBlockDesc != NULL) && (TempBlockDesc->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL)) {
 578     if (TempBlockDesc->Length != 0) {
 579       CurrBlockDescHead->Union.DataBlock = TempBlockDesc->Union.DataBlock;
 580       CurrBlockDescHead->Length = TempBlockDesc->Length;
 581       CurrBlockDescHead++;
 582       TempBlockDesc++;
 583     } else {
 584       TempBlockDesc = (EFI_CAPSULE_BLOCK_DESCRIPTOR  *) (UINTN) TempBlockDesc->Union.ContinuationPointer;
 585     }
 586   }
 587   //
 588   // Null terminate
 589   //
 590   CurrBlockDescHead->Union.ContinuationPointer   = (EFI_PHYSICAL_ADDRESS) (UINTN) NULL;
 591   CurrBlockDescHead->Length = 0;
 592   return NewBlockList;
 593 }
 594
 595 /**
 596   Determine if two buffers overlap in memory.
 597
 598   @param Buff1   pointer to first buffer
 599   @param Size1   size of Buff1
 600   @param Buff2   pointer to second buffer
 601   @param Size2   size of Buff2
 602
 603   @retval TRUE    Buffers overlap in memory.
 604   @retval FALSE   Buffer doesn't overlap.
 605
 606 **/
 607 BOOLEAN
 608 IsOverlapped (
 609   UINT8     *Buff1,
 610   UINTN     Size1,
 611   UINT8     *Buff2,
 612   UINTN     Size2
 613   )
 614 {
 615   //
 616   // If buff1's end is less than the start of buff2, then it's ok.
 617   // Also, if buff1's start is beyond buff2's end, then it's ok.
 618   //
 619   if (((Buff1 + Size1) <= Buff2) || (Buff1 >= (Buff2 + Size2))) {
 620     return FALSE;
 621   }
 622
 623   return TRUE;
 624 }
 625
 626 /**
 627   Given a pointer to a capsule block descriptor, traverse the list to figure
 628   out how many legitimate descriptors there are, and how big the capsule it
 629   refers to is.
 630
 631   @param Desc            Pointer to the capsule block descriptors
 632   @param NumDescriptors  Optional pointer to where to return the number of capsule data descriptors, whose Length is non-zero.
 633   @param CapsuleSize     Optional pointer to where to return the capsule image size
 634   @param CapsuleNumber   Optional pointer to where to return the number of capsule
 635
 636   @retval EFI_NOT_FOUND   No descriptors containing data in the list
 637   @retval EFI_SUCCESS     Return data is valid
 638
 639 **/
 640 EFI_STATUS
 641 GetCapsuleInfo (
 642   IN EFI_CAPSULE_BLOCK_DESCRIPTOR   *Desc,
 643   IN OUT UINTN                      *NumDescriptors OPTIONAL,
 644   IN OUT UINTN                      *CapsuleSize OPTIONAL,
 645   IN OUT UINTN                      *CapsuleNumber OPTIONAL
 646   )
 647 {
 648   UINTN                          Count;
 649   UINTN                          Size;
 650   UINTN                          Number;
 651   UINTN                          ThisCapsuleImageSize;
 652   EFI_CAPSULE_HEADER             *CapsuleHeader;
 653
 654   DEBUG ((EFI_D_INFO, "GetCapsuleInfo enter\n"));
 655
 656   ASSERT (Desc != NULL);
 657
 658   Count = 0;
 659   Size  = 0;
 660   Number = 0;
 661   ThisCapsuleImageSize = 0;
 662
 663   while (Desc->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL) {
 664     if (Desc->Length == 0) {
 665       //
 666       // Descriptor points to another list of block descriptors somewhere
 667       //
 668       Desc = (EFI_CAPSULE_BLOCK_DESCRIPTOR  *) (UINTN) Desc->Union.ContinuationPointer;
 669     } else {
 670       //
 671       // Sanity Check
 672       // It is needed, because ValidateCapsuleIntegrity() only validate one individual capsule Size.
 673       // While here we need check all capsules size.
 674       //
 675       if (Desc->Length >= (MAX_ADDRESS - Size)) {
 676         DEBUG ((EFI_D_ERROR, "ERROR: Desc->Length(0x%lx) >= (MAX_ADDRESS - Size(0x%x))\n", Desc->Length, Size));
 677         return EFI_OUT_OF_RESOURCES;
 678       }
 679       Size += (UINTN) Desc->Length;
 680       Count++;
 681
 682       //
 683       // See if this is first capsule's header
 684       //
 685       if (ThisCapsuleImageSize == 0) {
 686         CapsuleHeader = (EFI_CAPSULE_HEADER*)((UINTN)Desc->Union.DataBlock);
 687         //
 688         // This has been checked in ValidateCapsuleIntegrity()
 689         //
 690         Number ++;
 691         ThisCapsuleImageSize = CapsuleHeader->CapsuleImageSize;
 692       }
 693
 694       //
 695       // This has been checked in ValidateCapsuleIntegrity()
 696       //
 697       ASSERT (ThisCapsuleImageSize >= Desc->Length);
 698       ThisCapsuleImageSize = (UINTN)(ThisCapsuleImageSize - Desc->Length);
 699
 700       //
 701       // Move to next
 702       //
 703       Desc++;
 704     }
 705   }
 706   //
 707   // If no descriptors, then fail
 708   //
 709   if (Count == 0) {
 710     DEBUG ((EFI_D_ERROR, "ERROR: Count == 0\n"));
 711     return EFI_NOT_FOUND;
 712   }
 713
 714   //
 715   // checked in ValidateCapsuleIntegrity()
 716   //
 717   ASSERT (ThisCapsuleImageSize == 0);
 718
 719   if (NumDescriptors != NULL) {
 720     *NumDescriptors = Count;
 721   }
 722
 723   if (CapsuleSize != NULL) {
 724     *CapsuleSize = Size;
 725   }
 726
 727   if (CapsuleNumber != NULL) {
 728     *CapsuleNumber = Number;
 729   }
 730
 731   return EFI_SUCCESS;
 732 }
 733
 734 /**
 735   Check every capsule header.
 736
 737   @param CapsuleHeader   The pointer to EFI_CAPSULE_HEADER
 738
 739   @retval FALSE  Capsule is OK
 740   @retval TRUE   Capsule is corrupted
 741
 742 **/
 743 BOOLEAN
 744 IsCapsuleCorrupted (
 745   IN EFI_CAPSULE_HEADER       *CapsuleHeader
 746   )
 747 {
 748   //
 749   //A capsule to be updated across a system reset should contain CAPSULE_FLAGS_PERSIST_ACROSS_RESET.
 750   //
 751   if ((CapsuleHeader->Flags & CAPSULE_FLAGS_PERSIST_ACROSS_RESET) == 0) {
 752     return TRUE;
 753   }
 754   //
 755   //Make sure the flags combination is supported by the platform.
 756   //
 757   if ((CapsuleHeader->Flags & (CAPSULE_FLAGS_PERSIST_ACROSS_RESET | CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE)) == CAPSULE_FLAGS_POPULATE_SYSTEM_TABLE) {
 758     return TRUE;
 759   }
 760   if ((CapsuleHeader->Flags & (CAPSULE_FLAGS_PERSIST_ACROSS_RESET | CAPSULE_FLAGS_INITIATE_RESET)) == CAPSULE_FLAGS_INITIATE_RESET) {
 761     return TRUE;
 762   }
 763
 764   return FALSE;
 765 }
 766
 767 /**
 768   Try to verify the integrity of a capsule test pattern before the
 769   capsule gets coalesced. This can be useful in narrowing down
 770   where capsule data corruption occurs.
 771
 772   The test pattern mode fills in memory with a counting UINT32 value.
 773   If the capsule is not divided up in a multiple of 4-byte blocks, then
 774   things get messy doing the check. Therefore there are some cases
 775   here where we just give up and skip the pre-coalesce check.
 776
 777   @param PeiServices  PEI services table
 778   @param Desc         Pointer to capsule descriptors
 779 **/
 780 VOID
 781 CapsuleTestPatternPreCoalesce (
 782   IN EFI_PEI_SERVICES              **PeiServices,
 783   IN EFI_CAPSULE_BLOCK_DESCRIPTOR  *Desc
 784   )
 785 {
 786   UINT32  *TestPtr;
 787   UINT32  TestCounter;
 788   UINT32  TestSize;
 789
 790   DEBUG ((EFI_D_INFO, "CapsuleTestPatternPreCoalesce\n"));
 791
 792   //
 793   // Find first data descriptor
 794   //
 795   while ((Desc->Length == 0) && (Desc->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL)) {
 796     Desc = (EFI_CAPSULE_BLOCK_DESCRIPTOR  *) (UINTN) Desc->Union.ContinuationPointer;
 797   }
 798
 799   if (Desc->Union.ContinuationPointer == 0) {
 800     return ;
 801   }
 802   //
 803   // First one better be long enough to at least hold the test signature
 804   //
 805   if (Desc->Length < sizeof (UINT32)) {
 806     DEBUG ((EFI_D_INFO, "Capsule test pattern pre-coalesce punted #1\n"));
 807     return ;
 808   }
 809
 810   TestPtr = (UINT32 *) (UINTN) Desc->Union.DataBlock;
 811   //
 812   // 0x54534554 "TEST"
 813   //
 814   if (*TestPtr != 0x54534554) {
 815     return ;
 816   }
 817
 818   TestCounter = 0;
 819   TestSize    = (UINT32) Desc->Length - 2 * sizeof (UINT32);
 820   //
 821   // Skip over the signature and the size fields in the pattern data header
 822   //
 823   TestPtr += 2;
 824   while (1) {
 825     if ((TestSize & 0x03) != 0) {
 826       DEBUG ((EFI_D_INFO, "Capsule test pattern pre-coalesce punted #2\n"));
 827       return ;
 828     }
 829
 830     while (TestSize > 0) {
 831       if (*TestPtr != TestCounter) {
 832         DEBUG ((EFI_D_INFO, "Capsule test pattern pre-coalesce failed data corruption check\n"));
 833         return ;
 834       }
 835
 836       TestSize -= sizeof (UINT32);
 837       TestCounter++;
 838       TestPtr++;
 839     }
 840     Desc++;
 841     while ((Desc->Length == 0) && (Desc->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL)) {
 842       Desc = (EFI_CAPSULE_BLOCK_DESCRIPTOR  *) (UINTN) Desc->Union.ContinuationPointer;
 843     }
 844
 845     if (Desc->Union.ContinuationPointer == (EFI_PHYSICAL_ADDRESS) (UINTN) NULL) {
 846       return ;
 847     }
 848     TestSize = (UINT32) Desc->Length;
 849     TestPtr  = (UINT32 *) (UINTN) Desc->Union.DataBlock;
 850   }
 851 }
 852
 853 /**
 854   Checks for the presence of capsule descriptors.
 855   Get capsule descriptors from variable CapsuleUpdateData, CapsuleUpdateData1, CapsuleUpdateData2...
 856
 857   @param BlockListBuffer            Pointer to the buffer of capsule descriptors variables
 858   @param MemoryResource             Pointer to the buffer of memory resource descriptor.
 859   @param BlockDescriptorList        Pointer to the capsule descriptors list
 860
 861   @retval EFI_SUCCESS               a valid capsule is present
 862   @retval EFI_NOT_FOUND             if a valid capsule is not present
 863 **/
 864 EFI_STATUS
 865 BuildCapsuleDescriptors (
 866   IN  EFI_PHYSICAL_ADDRESS            *BlockListBuffer,
 867   IN  MEMORY_RESOURCE_DESCRIPTOR      *MemoryResource,
 868   OUT EFI_CAPSULE_BLOCK_DESCRIPTOR    **BlockDescriptorList
 869   )
 870 {
 871   UINTN                            Index;
 872   EFI_CAPSULE_BLOCK_DESCRIPTOR     *LastBlock;
 873   EFI_CAPSULE_BLOCK_DESCRIPTOR     *TempBlock;
 874   EFI_CAPSULE_BLOCK_DESCRIPTOR     *HeadBlock;
 875
 876   DEBUG ((EFI_D_INFO, "BuildCapsuleDescriptors enter\n"));
 877
 878   LastBlock         = NULL;
 879   HeadBlock         = NULL;
 880   TempBlock         = NULL;
 881   Index             = 0;
 882
 883   while (BlockListBuffer[Index] != 0) {
 884     //
 885     // Test integrity of descriptors.
 886     //
 887     if (BlockListBuffer[Index] < MAX_ADDRESS) {
 888       TempBlock = ValidateCapsuleIntegrity ((EFI_CAPSULE_BLOCK_DESCRIPTOR *)(UINTN)BlockListBuffer[Index], MemoryResource);
 889       if (TempBlock != NULL) {
 890         if (LastBlock == NULL) {
 891           LastBlock = TempBlock;
 892
 893           //
 894           // Return the base of the block descriptors
 895           //
 896           HeadBlock = (EFI_CAPSULE_BLOCK_DESCRIPTOR *)(UINTN)BlockListBuffer[Index];
 897         } else {
 898           //
 899           // Combine the different BlockList into single BlockList.
 900           //
 901           LastBlock->Union.DataBlock = (EFI_PHYSICAL_ADDRESS)(UINTN)BlockListBuffer[Index];
 902           LastBlock->Length          = 0;
 903           LastBlock                  = TempBlock;
 904         }
 905       }
 906     } else {
 907       DEBUG ((EFI_D_ERROR, "ERROR: BlockListBuffer[Index](0x%lx) < MAX_ADDRESS\n", BlockListBuffer[Index]));
 908     }
 909     Index ++;
 910   }
 911
 912   if (HeadBlock != NULL) {
 913     *BlockDescriptorList = HeadBlock;
 914     return EFI_SUCCESS;
 915   }
 916   return EFI_NOT_FOUND;
 917 }
 918
 919 /**
 920   The function to coalesce a fragmented capsule in memory.
 921
 922   Memory Map for coalesced capsule:
 923   MemBase +   ---->+---------------------------+<-----------+
 924   MemSize          | ------------------------- |            |
 925                    | |  Capsule [Num-1]      | |            |
 926                    | ------------------------- |            |
 927                    | |  ................     | |            |
 928                    | ------------------------- |            |
 929                    | |  Capsule [1]          | |            |
 930                    | ------------------------- |            |
 931                    | |  Capsule [0]          | |            |
 932                    | ------------------------- |            |
 933                    |    Capsule Image          |            |
 934 CapsuleImageBase-->+---------------------------+
 935                    | ------------------------- |            |
 936                    | |  CapsuleOffset[Num-1] | |            |
 937                    | ------------------------- |            |
 938                    | |  ................     | |        CapsuleSize
 939                    | ------------------------- |            |
 940                    | |  CapsuleOffset[1]     | |            |
 941                    | ------------------------- |            |
 942                    | |  CapsuleOffset[0]     | |            |
 943                    |---------------------------|            |
 944                    | |  CapsuleNumber        | |            |
 945                    | ------------------------- |            |
 946                    | |  CapsuleAllImageSize  | |            |
 947                    | ------------------------- |            |
 948                    |    PrivateData            |            |
 949      DestPtr  ---->+---------------------------+<-----------+
 950                    |                           |            |
 951                    |     FreeMem               |        FreeMemSize
 952                    |                           |            |
 953    FreeMemBase --->+---------------------------+<-----------+
 954                    |    Terminator             |
 955                    +---------------------------+
 956                    |    BlockDescriptor n      |
 957                    +---------------------------+
 958                    |    .................      |
 959                    +---------------------------+
 960                    |    BlockDescriptor 1      |
 961                    +---------------------------+
 962                    |    BlockDescriptor 0      |
 963                    +---------------------------+
 964                    |    PrivateDataDesc 0      |
 965       MemBase ---->+---------------------------+<----- BlockList
 966
 967   Caution: This function may receive untrusted input.
 968   The capsule data is external input, so this routine will do basic validation before
 969   coalesce capsule data into memory.
 970
 971   @param PeiServices        General purpose services available to every PEIM.
 972   @param BlockListBuffer    Pointer to the buffer of Capsule Descriptor Variables.
 973   @param MemoryResource     Pointer to the buffer of memory resource descriptor.
 974   @param MemoryBase         Pointer to the base of a block of memory that we can walk
 975                             all over while trying to coalesce our buffers.
 976                             On output, this variable will hold the base address of
 977                             a coalesced capsule.
 978   @param MemorySize         Size of the memory region pointed to by MemoryBase.
 979                             On output, this variable will contain the size of the
 980                             coalesced capsule.
 981
 982   @retval EFI_NOT_FOUND     If we could not find the capsule descriptors.
 983
 984   @retval EFI_BUFFER_TOO_SMALL
 985                             If we could not coalesce the capsule in the memory
 986                             region provided to us.
 987
 988   @retval EFI_SUCCESS       Processed the capsule successfully.
 989 **/
 990 EFI_STATUS
 991 EFIAPI
 992 CapsuleDataCoalesce (
 993   IN EFI_PEI_SERVICES                **PeiServices,
 994   IN EFI_PHYSICAL_ADDRESS            *BlockListBuffer,
 995   IN MEMORY_RESOURCE_DESCRIPTOR      *MemoryResource,
 996   IN OUT VOID                        **MemoryBase,
 997   IN OUT UINTN                       *MemorySize
 998   )
 999 {
1000   VOID                           *NewCapsuleBase;
1001   VOID                           *CapsuleImageBase;
1002   UINTN                          CapsuleIndex;
1003   UINT8                          *FreeMemBase;
1004   UINT8                          *DestPtr;
1005   UINTN                          DestLength;
1006   UINT8                          *RelocPtr;
1007   UINTN                          CapsuleTimes;
1008   UINT64                         SizeLeft;
1009   UINT64                         CapsuleImageSize;
1010   UINTN                          CapsuleSize;
1011   UINTN                          CapsuleNumber;
1012   UINTN                          DescriptorsSize;
1013   UINTN                          FreeMemSize;
1014   UINTN                          NumDescriptors;
1015   BOOLEAN                        CapsuleBeginFlag;
1016   EFI_STATUS                     Status;
1017   EFI_CAPSULE_HEADER             *CapsuleHeader;
1018   EFI_CAPSULE_PEIM_PRIVATE_DATA  PrivateData;
1019   EFI_CAPSULE_PEIM_PRIVATE_DATA  *PrivateDataPtr;
1020   EFI_CAPSULE_BLOCK_DESCRIPTOR   *BlockList;
1021   EFI_CAPSULE_BLOCK_DESCRIPTOR   *CurrentBlockDesc;
1022   EFI_CAPSULE_BLOCK_DESCRIPTOR   *TempBlockDesc;
1023   EFI_CAPSULE_BLOCK_DESCRIPTOR   PrivateDataDesc[2];
1024
1025   DEBUG ((EFI_D_INFO, "CapsuleDataCoalesce enter\n"));
1026
1027   CapsuleIndex     = 0;
1028   SizeLeft         = 0;
1029   CapsuleTimes     = 0;
1030   CapsuleImageSize = 0;
1031   PrivateDataPtr   = NULL;
1032   CapsuleHeader    = NULL;
1033   CapsuleBeginFlag = TRUE;
1034   CapsuleSize      = 0;
1035   NumDescriptors   = 0;
1036
1037   //
1038   // Build capsule descriptors list
1039   //
1040   Status = BuildCapsuleDescriptors (BlockListBuffer, MemoryResource, &BlockList);
1041   if (EFI_ERROR (Status)) {
1042     return Status;
1043   }
1044
1045   DEBUG_CODE (
1046     CapsuleTestPatternPreCoalesce (PeiServices, BlockList);
1047   );
1048
1049   //
1050   // Get the size of our descriptors and the capsule size. GetCapsuleInfo()
1051   // returns the number of descriptors that actually point to data, so add
1052   // one for a terminator. Do that below.
1053   //
1054   Status = GetCapsuleInfo (BlockList, &NumDescriptors, &CapsuleSize, &CapsuleNumber);
1055   if (EFI_ERROR (Status)) {
1056     return Status;
1057   }
1058   DEBUG ((EFI_D_INFO, "CapsuleSize - 0x%x\n", CapsuleSize));
1059   DEBUG ((EFI_D_INFO, "CapsuleNumber - 0x%x\n", CapsuleNumber));
1060   DEBUG ((EFI_D_INFO, "NumDescriptors - 0x%x\n", NumDescriptors));
1061   if ((CapsuleSize == 0) || (NumDescriptors == 0) || (CapsuleNumber == 0)) {
1062     return EFI_NOT_FOUND;
1063   }
1064
1065   if (CapsuleNumber - 1 >= (MAX_ADDRESS - (sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA)  + sizeof(UINT64))) / sizeof(UINT64)) {
1066     DEBUG ((EFI_D_ERROR, "ERROR: CapsuleNumber - 0x%x\n", CapsuleNumber));
1067     return EFI_BUFFER_TOO_SMALL;
1068   }
1069
1070   //
1071   // Initialize our local copy of private data. When we're done, we'll create a
1072   // descriptor for it as well so that it can be put into free memory without
1073   // trashing anything.
1074   //
1075   PrivateData.Signature           = EFI_CAPSULE_PEIM_PRIVATE_DATA_SIGNATURE;
1076   PrivateData.CapsuleAllImageSize = (UINT64) CapsuleSize;
1077   PrivateData.CapsuleNumber       = (UINT64) CapsuleNumber;
1078   PrivateData.CapsuleOffset[0]    = 0;
1079   //
1080   // NOTE: Only data in sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA) is valid, CapsuleOffset field is uninitialized at this moment.
1081   // The code sets partial length here for Descriptor.Length check, but later it will use full length to reserve those PrivateData region.
1082   //
1083   PrivateDataDesc[0].Union.DataBlock  = (EFI_PHYSICAL_ADDRESS) (UINTN) &PrivateData;
1084   PrivateDataDesc[0].Length           = sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA);
1085   PrivateDataDesc[1].Union.DataBlock  = (EFI_PHYSICAL_ADDRESS) (UINTN) BlockList;
1086   PrivateDataDesc[1].Length           = 0;
1087   //
1088   // Add PrivateDataDesc[0] in beginning, as it is new descriptor. PrivateDataDesc[1] is NOT needed.
1089   // In addition, one NULL terminator is added in the end. See RelocateBlockDescriptors().
1090   //
1091   NumDescriptors  += 2;
1092   //
1093   // Sanity check
1094   //
1095   if (CapsuleSize >= (MAX_ADDRESS - (sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA) + (CapsuleNumber - 1) * sizeof(UINT64) + sizeof(UINT64)))) {
1096     DEBUG ((EFI_D_ERROR, "ERROR: CapsuleSize - 0x%x\n", CapsuleSize));
1097     return EFI_BUFFER_TOO_SMALL;
1098   }
1099   //
1100   // Need add sizeof(UINT64) for PrivateData alignment
1101   //
1102   CapsuleSize     += sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA) + (CapsuleNumber - 1) * sizeof(UINT64) + sizeof(UINT64);
1103   BlockList        = PrivateDataDesc;
1104   //
1105   // Sanity check
1106   //
1107   if (NumDescriptors >= (MAX_ADDRESS / sizeof(EFI_CAPSULE_BLOCK_DESCRIPTOR))) {
1108     DEBUG ((EFI_D_ERROR, "ERROR: NumDescriptors - 0x%x\n", NumDescriptors));
1109     return EFI_BUFFER_TOO_SMALL;
1110   }
1111   DescriptorsSize  = NumDescriptors * sizeof (EFI_CAPSULE_BLOCK_DESCRIPTOR);
1112   //
1113   // Sanity check
1114   //
1115   if (DescriptorsSize >= (MAX_ADDRESS - CapsuleSize)) {
1116     DEBUG ((EFI_D_ERROR, "ERROR: DescriptorsSize - 0x%lx, CapsuleSize - 0x%lx\n", (UINT64)DescriptorsSize, (UINT64)CapsuleSize));
1117     return EFI_BUFFER_TOO_SMALL;
1118   }
1119
1120   //
1121   // Don't go below some min address. If the base is below it,
1122   // then move it up and adjust the size accordingly.
1123   //
1124   DEBUG ((EFI_D_INFO, "Capsule Memory range from 0x%8X to 0x%8X\n", (UINTN) *MemoryBase, (UINTN)*MemoryBase + *MemorySize));
1125   if ((UINTN)*MemoryBase < (UINTN) MIN_COALESCE_ADDR) {
1126     if (((UINTN)*MemoryBase + *MemorySize) < (UINTN) MIN_COALESCE_ADDR) {
1127       DEBUG ((EFI_D_ERROR, "ERROR: *MemoryBase + *MemorySize - 0x%x\n", (UINTN)*MemoryBase + *MemorySize));
1128       return EFI_BUFFER_TOO_SMALL;
1129     } else {
1130       *MemorySize = *MemorySize - ((UINTN) MIN_COALESCE_ADDR - (UINTN) *MemoryBase);
1131       *MemoryBase = (VOID *) (UINTN) MIN_COALESCE_ADDR;
1132     }
1133   }
1134
1135   if (*MemorySize <= (CapsuleSize + DescriptorsSize)) {
1136     DEBUG ((EFI_D_ERROR, "ERROR: CapsuleSize + DescriptorsSize - 0x%x\n", CapsuleSize + DescriptorsSize));
1137     return EFI_BUFFER_TOO_SMALL;
1138   }
1139
1140   FreeMemBase = *MemoryBase;
1141   FreeMemSize = *MemorySize;
1142   DEBUG ((EFI_D_INFO, "Capsule Free Memory from 0x%8X to 0x%8X\n", (UINTN) FreeMemBase, (UINTN) FreeMemBase + FreeMemSize));
1143
1144   //
1145   // Relocate all the block descriptors to low memory to make further
1146   // processing easier.
1147   //
1148   BlockList = RelocateBlockDescriptors (PeiServices, BlockList, NumDescriptors, FreeMemBase, FreeMemSize);
1149   if (BlockList == NULL) {
1150     //
1151     // Not enough room to relocate the descriptors
1152     //
1153     return EFI_BUFFER_TOO_SMALL;
1154   }
1155
1156   //
1157   // Take the top of memory for the capsule. UINT64 align up.
1158   //
1159   DestPtr         = FreeMemBase + FreeMemSize - CapsuleSize;
1160   DestPtr         = (UINT8 *) (((UINTN)DestPtr + sizeof (UINT64) - 1) & ~(sizeof (UINT64) - 1));
1161   FreeMemBase     = (UINT8 *) BlockList + DescriptorsSize;
1162   FreeMemSize     = (UINTN) DestPtr - (UINTN) FreeMemBase;
1163   NewCapsuleBase  = (VOID *) DestPtr;
1164   CapsuleImageBase = (UINT8 *)NewCapsuleBase + sizeof(EFI_CAPSULE_PEIM_PRIVATE_DATA) + (CapsuleNumber - 1) * sizeof(UINT64);
1165
1166   PrivateDataPtr = (EFI_CAPSULE_PEIM_PRIVATE_DATA *) NewCapsuleBase;
1167
1168   //
1169   // Move all the blocks to the top (high) of memory.
1170   // Relocate all the obstructing blocks. Note that the block descriptors
1171   // were coalesced when they were relocated, so we can just ++ the pointer.
1172   //
1173   CurrentBlockDesc = BlockList;
1174   while ((CurrentBlockDesc->Length != 0) || (CurrentBlockDesc->Union.ContinuationPointer != (EFI_PHYSICAL_ADDRESS) (UINTN) NULL)) {
1175     if (CapsuleTimes == 0) {
1176       //
1177       // The first entry is the block descriptor for EFI_CAPSULE_PEIM_PRIVATE_DATA.
1178       // CapsuleOffset field is uninitialized at this time. No need copy it, but need to reserve for future use.
1179       //
1180       ASSERT (CurrentBlockDesc->Union.DataBlock == (UINT64)(UINTN)&PrivateData);
1181       DestLength = sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA) + (CapsuleNumber - 1) * sizeof(UINT64);
1182     } else {
1183       DestLength = (UINTN)CurrentBlockDesc->Length;
1184     }
1185     //
1186     // See if any of the remaining capsule blocks are in the way
1187     //
1188     TempBlockDesc = CurrentBlockDesc;
1189     while (TempBlockDesc->Length != 0) {
1190       //
1191       // Is this block in the way of where we want to copy the current descriptor to?
1192       //
1193       if (IsOverlapped (
1194             (UINT8 *) DestPtr,
1195             (UINTN) DestLength,
1196             (UINT8 *) (UINTN) TempBlockDesc->Union.DataBlock,
1197             (UINTN) TempBlockDesc->Length
1198             )) {
1199         //
1200         // Relocate the block
1201         //
1202         RelocPtr = FindFreeMem (BlockList, FreeMemBase, FreeMemSize, (UINTN) TempBlockDesc->Length);
1203         if (RelocPtr == NULL) {
1204           return EFI_BUFFER_TOO_SMALL;
1205         }
1206
1207         CopyMem ((VOID *) RelocPtr, (VOID *) (UINTN) TempBlockDesc->Union.DataBlock, (UINTN) TempBlockDesc->Length);
1208         DEBUG ((EFI_D_INFO, "Capsule reloc data block from 0x%8X to 0x%8X with size 0x%8X\n",
1209                 (UINTN) TempBlockDesc->Union.DataBlock, (UINTN) RelocPtr, (UINTN) TempBlockDesc->Length));
1210
1211         TempBlockDesc->Union.DataBlock = (EFI_PHYSICAL_ADDRESS) (UINTN) RelocPtr;
1212       }
1213       //
1214       // Next descriptor
1215       //
1216       TempBlockDesc++;
1217     }
1218     //
1219     // Ok, we made it through. Copy the block.
1220     // we just support greping one capsule from the lists of block descs list.
1221     //
1222     CapsuleTimes ++;
1223     //
1224     //Skip the first block descriptor that filled with EFI_CAPSULE_PEIM_PRIVATE_DATA
1225     //
1226     if (CapsuleTimes > 1) {
1227       //
1228       //For every capsule entry point, check its header to determine whether to relocate it.
1229       //If it is invalid, skip it and move on to the next capsule. If it is valid, relocate it.
1230       //
1231       if (CapsuleBeginFlag) {
1232         CapsuleBeginFlag  = FALSE;
1233         CapsuleHeader     = (EFI_CAPSULE_HEADER*)(UINTN)CurrentBlockDesc->Union.DataBlock;
1234         SizeLeft          = CapsuleHeader->CapsuleImageSize;
1235
1236         //
1237         // No more check here is needed, because IsCapsuleCorrupted() already in ValidateCapsuleIntegrity()
1238         //
1239         ASSERT (CapsuleIndex < CapsuleNumber);
1240
1241         //
1242         // Relocate this capsule
1243         //
1244         CapsuleImageSize += SizeLeft;
1245         //
1246         // Cache the begin offset of this capsule
1247         //
1248         ASSERT (PrivateDataPtr->Signature == EFI_CAPSULE_PEIM_PRIVATE_DATA_SIGNATURE);
1249         ASSERT ((UINTN)DestPtr >= (UINTN)CapsuleImageBase);
1250         PrivateDataPtr->CapsuleOffset[CapsuleIndex++] = (UINTN)DestPtr - (UINTN)CapsuleImageBase;
1251       }
1252
1253       //
1254       // Below ASSERT is checked in ValidateCapsuleIntegrity()
1255       //
1256       ASSERT (CurrentBlockDesc->Length <= SizeLeft);
1257
1258       CopyMem ((VOID *) DestPtr, (VOID *) (UINTN) (CurrentBlockDesc->Union.DataBlock), (UINTN)CurrentBlockDesc->Length);
1259       DEBUG ((EFI_D_INFO, "Capsule coalesce block no.0x%lX from 0x%lX to 0x%lX with size 0x%lX\n",(UINT64)CapsuleTimes,
1260              CurrentBlockDesc->Union.DataBlock, (UINT64)(UINTN)DestPtr, CurrentBlockDesc->Length));
1261       DestPtr += CurrentBlockDesc->Length;
1262       SizeLeft -= CurrentBlockDesc->Length;
1263
1264       if (SizeLeft == 0) {
1265         //
1266         //Here is the end of the current capsule image.
1267         //
1268         CapsuleBeginFlag = TRUE;
1269       }
1270     } else {
1271       //
1272       // The first entry is the block descriptor for EFI_CAPSULE_PEIM_PRIVATE_DATA.
1273       // CapsuleOffset field is uninitialized at this time. No need copy it, but need to reserve for future use.
1274       //
1275       ASSERT (CurrentBlockDesc->Length == sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA));
1276       ASSERT ((UINTN)DestPtr == (UINTN)NewCapsuleBase);
1277       CopyMem ((VOID *) DestPtr, (VOID *) (UINTN) CurrentBlockDesc->Union.DataBlock, (UINTN) CurrentBlockDesc->Length);
1278       DestPtr += sizeof (EFI_CAPSULE_PEIM_PRIVATE_DATA) + (CapsuleNumber - 1) * sizeof(UINT64);
1279     }
1280     //
1281     //Walk through the block descriptor list.
1282     //
1283     CurrentBlockDesc++;
1284   }
1285   //
1286   // We return the base of memory we want reserved, and the size.
1287   // The memory peim should handle it appropriately from there.
1288   //
1289   *MemorySize = (UINTN) CapsuleSize;
1290   *MemoryBase = (VOID *) NewCapsuleBase;
1291
1292   ASSERT (PrivateDataPtr->Signature == EFI_CAPSULE_PEIM_PRIVATE_DATA_SIGNATURE);
1293   ASSERT (PrivateDataPtr->CapsuleAllImageSize == CapsuleImageSize);
1294   ASSERT (PrivateDataPtr->CapsuleNumber == CapsuleIndex);
1295
1296   return EFI_SUCCESS;
1297 }