diff --git a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWrite.c b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWrite.c
index 625737eac0..2f110167d7 100644
--- a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWrite.c
+++ b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWrite.c
@@ -3,7 +3,7 @@
   These are the common Fault Tolerant Write (FTW) functions that are shared 
   by DXE FTW driver and SMM FTW driver.
 
-Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials                          
 are licensed and made available under the terms and conditions of the BSD License         
 which accompanies this distribution.  The full text of the license may be found at        
@@ -193,9 +193,12 @@ FtwWriteRecord (
   EFI_FAULT_TOLERANT_WRITE_HEADER *Header;
   EFI_FAULT_TOLERANT_WRITE_RECORD *Record;
   UINTN                           Offset;
+  EFI_LBA                         WorkSpaceLbaOffset;
 
   FtwDevice = FTW_CONTEXT_FROM_THIS (This);
 
+  WorkSpaceLbaOffset = FtwDevice->FtwWorkSpaceLba - FtwDevice->FtwWorkBlockLba;
+
   //
   // Spare Complete but Destination not complete,
   // Recover the target block with the spare block.
@@ -215,7 +218,7 @@ FtwWriteRecord (
     Offset = (UINT8 *) Record - FtwDevice->FtwWorkSpace;
     Status = FtwUpdateFvState (
               FtwDevice->FtwBackupFvb,
-              FtwDevice->FtwWorkSpaceLba,
+              FtwDevice->FtwSpareLba + WorkSpaceLbaOffset,
               FtwDevice->FtwWorkSpaceBase + Offset,
               SPARE_COMPLETED
               );
diff --git a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c
index 47ec118592..2537d22e2c 100644
--- a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c
+++ b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteSmm.c
@@ -209,6 +209,8 @@ GetFvbCountAndBuffer (
   *NumberHandles = BufferSize / sizeof(EFI_HANDLE);
   if (EFI_ERROR(Status)) {
     *NumberHandles = 0;
+    FreePool (*Buffer);
+    *Buffer = NULL;
   }
 
   return Status;
diff --git a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FtwMisc.c b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FtwMisc.c
index 482753f62c..f1d64942b4 100644
--- a/MdeModulePkg/Universal/FaultTolerantWriteDxe/FtwMisc.c
+++ b/MdeModulePkg/Universal/FaultTolerantWriteDxe/FtwMisc.c
@@ -572,6 +572,9 @@ FlushSpareBlockToWorkingBlock (
   if (Buffer == NULL) {
     return EFI_OUT_OF_RESOURCES;
   }
+
+  WorkSpaceLbaOffset = FtwDevice->FtwWorkSpaceLba - FtwDevice->FtwWorkBlockLba;
+
   //
   // To guarantee that the WorkingBlockValid is set on spare block
   //
@@ -581,7 +584,7 @@ FlushSpareBlockToWorkingBlock (
   //
   FtwUpdateFvState (
     FtwDevice->FtwBackupFvb,
-    FtwDevice->FtwWorkSpaceLba,
+    FtwDevice->FtwSpareLba + WorkSpaceLbaOffset,
     FtwDevice->FtwWorkSpaceBase + sizeof (EFI_GUID) + sizeof (UINT32),
     WORKING_BLOCK_VALID
     );
@@ -608,7 +611,6 @@ FlushSpareBlockToWorkingBlock (
   //
   // Clear the CRC and STATE, copy data from spare to working block.
   //
-  WorkSpaceLbaOffset = FtwDevice->FtwWorkSpaceLba - FtwDevice->FtwWorkBlockLba;
   WorkingBlockHeader = (EFI_FAULT_TOLERANT_WORKING_BLOCK_HEADER *) (Buffer + (UINTN) WorkSpaceLbaOffset * FtwDevice->BlockSize + FtwDevice->FtwWorkSpaceBase);
   InitWorkSpaceHeader (WorkingBlockHeader);
   WorkingBlockHeader->WorkingBlockValid   = FTW_ERASE_POLARITY;
diff --git a/MdeModulePkg/Universal/FaultTolerantWriteDxe/UpdateWorkingBlock.c b/MdeModulePkg/Universal/FaultTolerantWriteDxe/UpdateWorkingBlock.c
index 425aa403c3..bbe5fb63b5 100644
--- a/MdeModulePkg/Universal/FaultTolerantWriteDxe/UpdateWorkingBlock.c
+++ b/MdeModulePkg/Universal/FaultTolerantWriteDxe/UpdateWorkingBlock.c
@@ -2,7 +2,7 @@
 
    Internal functions to operate Working Block Space.
 
-Copyright (c) 2006 - 2011, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials                          
 are licensed and made available under the terms and conditions of the BSD License         
 which accompanies this distribution.  The full text of the license may be found at        
@@ -22,8 +22,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 
   @param WorkingHeader   Pointer of working block header
 
-  @retval  EFI_SUCCESS    The function completed successfully
-  @retval  EFI_ABORTED    The function could not complete successfully.
+  @retval TRUE          The work space is valid.
+  @retval FALSE         The work space is invalid.
 
 **/
 BOOLEAN
@@ -166,8 +166,6 @@ WorkSpaceRefresh (
 {
   EFI_STATUS                      Status;
   UINTN                           Length;
-  UINTN                           Offset;
-  EFI_FAULT_TOLERANT_WRITE_HEADER *FtwHeader;
 
   //
   // Initialize WorkSpace as FTW_ERASED_BYTE
@@ -200,14 +198,7 @@ WorkSpaceRefresh (
             FtwDevice->FtwWorkSpaceSize,
             &FtwDevice->FtwLastWriteHeader
             );
-
-  FtwHeader = FtwDevice->FtwLastWriteHeader;
-  Offset    = (UINTN) (UINT8 *) FtwHeader - (UINTN) FtwDevice->FtwWorkSpace;
-
-  //
-  // if the Header is out of the workspace limit, call reclaim.
-  //
-  if (EFI_ERROR (Status) && (Offset >= FtwDevice->FtwWorkSpaceSize)) {
+  if (EFI_ERROR (Status)) {
     //
     // reclaim work space in working block.
     //
@@ -236,6 +227,9 @@ WorkSpaceRefresh (
               FtwDevice->FtwWorkSpaceSize,
               &FtwDevice->FtwLastWriteHeader
               );
+    if (EFI_ERROR (Status)) {
+      return EFI_ABORTED;
+    }
   }
   //
   // Refresh the FtwLastWriteRecord
@@ -278,9 +272,12 @@ FtwReclaimWorkSpace (
   EFI_FAULT_TOLERANT_WORKING_BLOCK_HEADER *WorkingBlockHeader;
   UINTN                                   Index;
   UINT8                                   *Ptr;
+  EFI_LBA                                 WorkSpaceLbaOffset;
 
   DEBUG ((EFI_D_ERROR, "Ftw: start to reclaim work space\n"));
 
+  WorkSpaceLbaOffset = FtwDevice->FtwWorkSpaceLba - FtwDevice->FtwWorkBlockLba;
+
   //
   // Read all original data from working block to a memory buffer
   //
@@ -311,7 +308,7 @@ FtwReclaimWorkSpace (
   // Clean up the workspace, remove all the completed records.
   //
   Ptr = TempBuffer +
-        ((UINTN) (FtwDevice->FtwWorkSpaceLba - FtwDevice->FtwWorkBlockLba)) * FtwDevice->BlockSize + 
+        (UINTN) WorkSpaceLbaOffset * FtwDevice->BlockSize +
         FtwDevice->FtwWorkSpaceBase;
 
   //
@@ -358,10 +355,17 @@ FtwReclaimWorkSpace (
     &FtwDevice->FtwLastWriteHeader
     );
 
+  FtwGetLastWriteRecord (
+    FtwDevice->FtwLastWriteHeader,
+    &FtwDevice->FtwLastWriteRecord
+    );
+
   //
   // Set the WorkingBlockValid and WorkingBlockInvalid as INVALID
   //
-  WorkingBlockHeader                      = (EFI_FAULT_TOLERANT_WORKING_BLOCK_HEADER *) (TempBuffer + FtwDevice->FtwWorkSpaceBase);
+  WorkingBlockHeader                      = (EFI_FAULT_TOLERANT_WORKING_BLOCK_HEADER *) (TempBuffer +
+                                            (UINTN) WorkSpaceLbaOffset * FtwDevice->BlockSize +
+                                            FtwDevice->FtwWorkSpaceBase);
   WorkingBlockHeader->WorkingBlockValid   = FTW_INVALID_STATE;
   WorkingBlockHeader->WorkingBlockInvalid = FTW_INVALID_STATE;
 
@@ -426,7 +430,7 @@ FtwReclaimWorkSpace (
   //
   Status = FtwUpdateFvState (
             FtwDevice->FtwBackupFvb,
-            FtwDevice->FtwWorkSpaceLba,
+            FtwDevice->FtwSpareLba + WorkSpaceLbaOffset,
             FtwDevice->FtwWorkSpaceBase + sizeof (EFI_GUID) + sizeof (UINT32),
             WORKING_BLOCK_VALID
             );