3 The sample implementation for SMM variable protocol. And this driver
4 implements an SMI handler to communicate with the DXE runtime driver
5 to provide variable services.
7 Caution: This module requires additional review when modified.
8 This driver will have external input - variable data and communicate buffer in SMM mode.
9 This external input must be validated carefully to avoid security issue like
10 buffer overflow, integer overflow.
12 SmmVariableHandler() will receive untrusted input and do basic validation.
14 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
15 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
16 SmmVariableGetStatistics() should also do validation based on its own knowledge.
18 Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
19 This program and the accompanying materials
20 are licensed and made available under the terms and conditions of the BSD License
21 which accompanies this distribution. The full text of the license may be found at
22 http://opensource.org/licenses/bsd-license.php
24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
28 #include <Protocol/SmmVariable.h>
29 #include <Protocol/SmmFirmwareVolumeBlock.h>
30 #include <Protocol/SmmFaultTolerantWrite.h>
31 #include <Protocol/SmmEndOfDxe.h>
32 #include <Protocol/SmmVarCheck.h>
34 #include <Library/SmmServicesTableLib.h>
35 #include <Library/SmmMemLib.h>
37 #include <Guid/VariableFormat.h>
38 #include <Guid/SmmVariableCommon.h>
41 extern VARIABLE_INFO_ENTRY
*gVariableInfo
;
42 EFI_HANDLE mSmmVariableHandle
= NULL
;
43 EFI_HANDLE mVariableHandle
= NULL
;
44 BOOLEAN mAtRuntime
= FALSE
;
45 EFI_GUID mZeroGuid
= {0, 0, 0, {0, 0, 0, 0, 0, 0, 0, 0}};
46 UINT8
*mVariableBufferPayload
= NULL
;
47 UINTN mVariableBufferPayloadSize
;
48 extern BOOLEAN mEndOfDxe
;
49 extern BOOLEAN mEnableLocking
;
53 This code sets variable in storage blocks (Volatile or Non-Volatile).
55 @param VariableName Name of Variable to be found.
56 @param VendorGuid Variable vendor GUID.
57 @param Attributes Attribute value of the variable found
58 @param DataSize Size of Data found. If size is less than the
59 data, this value contains the required size.
60 @param Data Data pointer.
62 @return EFI_INVALID_PARAMETER Invalid parameter.
63 @return EFI_SUCCESS Set successfully.
64 @return EFI_OUT_OF_RESOURCES Resource not enough to set variable.
65 @return EFI_NOT_FOUND Not found.
66 @return EFI_WRITE_PROTECTED Variable is read-only.
71 SmmVariableSetVariable (
72 IN CHAR16
*VariableName
,
73 IN EFI_GUID
*VendorGuid
,
82 // Disable write protection when the calling SetVariable() through EFI_SMM_VARIABLE_PROTOCOL.
84 mEnableLocking
= FALSE
;
85 Status
= VariableServiceSetVariable (
92 mEnableLocking
= TRUE
;
96 EFI_SMM_VARIABLE_PROTOCOL gSmmVariable
= {
97 VariableServiceGetVariable
,
98 VariableServiceGetNextVariableName
,
99 SmmVariableSetVariable
,
100 VariableServiceQueryVariableInfo
103 EDKII_SMM_VAR_CHECK_PROTOCOL mSmmVarCheck
= { VarCheckRegisterSetVariableCheckHandler
,
104 VarCheckVariablePropertySet
,
105 VarCheckVariablePropertyGet
};
108 Return TRUE if ExitBootServices () has been called.
110 @retval TRUE If ExitBootServices () has been called.
121 Initializes a basic mutual exclusion lock.
123 This function initializes a basic mutual exclusion lock to the released state
124 and returns the lock. Each lock provides mutual exclusion access at its task
125 priority level. Since there is no preemption or multiprocessor support in EFI,
126 acquiring the lock only consists of raising to the locks TPL.
127 If Lock is NULL, then ASSERT().
128 If Priority is not a valid TPL value, then ASSERT().
130 @param Lock A pointer to the lock data structure to initialize.
131 @param Priority EFI TPL is associated with the lock.
138 IN OUT EFI_LOCK
*Lock
,
146 Acquires lock only at boot time. Simply returns at runtime.
148 This is a temperary function that will be removed when
149 EfiAcquireLock() in UefiLib can handle the call in UEFI
150 Runtimer driver in RT phase.
151 It calls EfiAcquireLock() at boot time, and simply returns
154 @param Lock A pointer to the lock to acquire.
158 AcquireLockOnlyAtBootTime (
167 Releases lock only at boot time. Simply returns at runtime.
169 This is a temperary function which will be removed when
170 EfiReleaseLock() in UefiLib can handle the call in UEFI
171 Runtimer driver in RT phase.
172 It calls EfiReleaseLock() at boot time and simply returns
175 @param Lock A pointer to the lock to release.
179 ReleaseLockOnlyAtBootTime (
187 Retrive the SMM Fault Tolerent Write protocol interface.
189 @param[out] FtwProtocol The interface of SMM Ftw protocol
191 @retval EFI_SUCCESS The SMM FTW protocol instance was found and returned in FtwProtocol.
192 @retval EFI_NOT_FOUND The SMM FTW protocol instance was not found.
193 @retval EFI_INVALID_PARAMETER SarProtocol is NULL.
198 OUT VOID
**FtwProtocol
204 // Locate Smm Fault Tolerent Write protocol
206 Status
= gSmst
->SmmLocateProtocol (
207 &gEfiSmmFaultTolerantWriteProtocolGuid
,
216 Retrive the SMM FVB protocol interface by HANDLE.
218 @param[in] FvBlockHandle The handle of SMM FVB protocol that provides services for
219 reading, writing, and erasing the target block.
220 @param[out] FvBlock The interface of SMM FVB protocol
222 @retval EFI_SUCCESS The interface information for the specified protocol was returned.
223 @retval EFI_UNSUPPORTED The device does not support the SMM FVB protocol.
224 @retval EFI_INVALID_PARAMETER FvBlockHandle is not a valid EFI_HANDLE or FvBlock is NULL.
229 IN EFI_HANDLE FvBlockHandle
,
230 OUT EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL
**FvBlock
234 // To get the SMM FVB protocol interface on the handle
236 return gSmst
->SmmHandleProtocol (
238 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
245 Function returns an array of handles that support the SMM FVB protocol
246 in a buffer allocated from pool.
248 @param[out] NumberHandles The number of handles returned in Buffer.
249 @param[out] Buffer A pointer to the buffer to return the requested
250 array of handles that support SMM FVB protocol.
252 @retval EFI_SUCCESS The array of handles was returned in Buffer, and the number of
253 handles in Buffer was returned in NumberHandles.
254 @retval EFI_NOT_FOUND No SMM FVB handle was found.
255 @retval EFI_OUT_OF_RESOURCES There is not enough pool memory to store the matching results.
256 @retval EFI_INVALID_PARAMETER NumberHandles is NULL or Buffer is NULL.
260 GetFvbCountAndBuffer (
261 OUT UINTN
*NumberHandles
,
262 OUT EFI_HANDLE
**Buffer
268 if ((NumberHandles
== NULL
) || (Buffer
== NULL
)) {
269 return EFI_INVALID_PARAMETER
;
275 Status
= gSmst
->SmmLocateHandle (
277 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
282 if (EFI_ERROR(Status
) && Status
!= EFI_BUFFER_TOO_SMALL
) {
283 return EFI_NOT_FOUND
;
286 *Buffer
= AllocatePool (BufferSize
);
287 if (*Buffer
== NULL
) {
288 return EFI_OUT_OF_RESOURCES
;
291 Status
= gSmst
->SmmLocateHandle (
293 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
299 *NumberHandles
= BufferSize
/ sizeof(EFI_HANDLE
);
300 if (EFI_ERROR(Status
)) {
311 Get the variable statistics information from the information buffer pointed by gVariableInfo.
313 Caution: This function may be invoked at SMM runtime.
314 InfoEntry and InfoSize are external input. Care must be taken to make sure not security issue at runtime.
316 @param[in, out] InfoEntry A pointer to the buffer of variable information entry.
317 On input, point to the variable information returned last time. if
318 InfoEntry->VendorGuid is zero, return the first information.
319 On output, point to the next variable information.
320 @param[in, out] InfoSize On input, the size of the variable information buffer.
321 On output, the returned variable information size.
323 @retval EFI_SUCCESS The variable information is found and returned successfully.
324 @retval EFI_UNSUPPORTED No variable inoformation exists in variable driver. The
325 PcdVariableCollectStatistics should be set TRUE to support it.
326 @retval EFI_BUFFER_TOO_SMALL The buffer is too small to hold the next variable information.
330 SmmVariableGetStatistics (
331 IN OUT VARIABLE_INFO_ENTRY
*InfoEntry
,
332 IN OUT UINTN
*InfoSize
335 VARIABLE_INFO_ENTRY
*VariableInfo
;
337 UINTN StatisticsInfoSize
;
341 ASSERT (InfoEntry
!= NULL
);
342 VariableInfo
= gVariableInfo
;
343 if (VariableInfo
== NULL
) {
344 return EFI_UNSUPPORTED
;
347 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + StrSize (VariableInfo
->Name
);
348 if (*InfoSize
< StatisticsInfoSize
) {
349 *InfoSize
= StatisticsInfoSize
;
350 return EFI_BUFFER_TOO_SMALL
;
352 InfoName
= (CHAR16
*)(InfoEntry
+ 1);
354 CopyGuid (&VendorGuid
, &InfoEntry
->VendorGuid
);
356 if (CompareGuid (&VendorGuid
, &mZeroGuid
)) {
358 // Return the first variable info
360 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
361 CopyMem (InfoName
, VariableInfo
->Name
, StrSize (VariableInfo
->Name
));
362 *InfoSize
= StatisticsInfoSize
;
367 // Get the next variable info
369 while (VariableInfo
!= NULL
) {
370 if (CompareGuid (&VariableInfo
->VendorGuid
, &VendorGuid
)) {
371 NameLength
= StrSize (VariableInfo
->Name
);
372 if (NameLength
== StrSize (InfoName
)) {
373 if (CompareMem (VariableInfo
->Name
, InfoName
, NameLength
) == 0) {
375 // Find the match one
377 VariableInfo
= VariableInfo
->Next
;
382 VariableInfo
= VariableInfo
->Next
;
385 if (VariableInfo
== NULL
) {
391 // Output the new variable info
393 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + StrSize (VariableInfo
->Name
);
394 if (*InfoSize
< StatisticsInfoSize
) {
395 *InfoSize
= StatisticsInfoSize
;
396 return EFI_BUFFER_TOO_SMALL
;
399 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
400 CopyMem (InfoName
, VariableInfo
->Name
, StrSize (VariableInfo
->Name
));
401 *InfoSize
= StatisticsInfoSize
;
408 Communication service SMI Handler entry.
410 This SMI handler provides services for the variable wrapper driver.
412 Caution: This function may receive untrusted input.
413 This variable data and communicate buffer are external input, so this function will do basic validation.
414 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
415 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
416 SmmVariableGetStatistics() should also do validation based on its own knowledge.
418 @param[in] DispatchHandle The unique handle assigned to this handler by SmiHandlerRegister().
419 @param[in] RegisterContext Points to an optional handler context which was specified when the
420 handler was registered.
421 @param[in, out] CommBuffer A pointer to a collection of data in memory that will
422 be conveyed from a non-SMM environment into an SMM environment.
423 @param[in, out] CommBufferSize The size of the CommBuffer.
425 @retval EFI_SUCCESS The interrupt was handled and quiesced. No other handlers
426 should still be called.
427 @retval EFI_WARN_INTERRUPT_SOURCE_QUIESCED The interrupt has been quiesced but other handlers should
429 @retval EFI_WARN_INTERRUPT_SOURCE_PENDING The interrupt is still pending and other handlers should still
431 @retval EFI_INTERRUPT_PENDING The interrupt could not be quiesced.
436 IN EFI_HANDLE DispatchHandle
,
437 IN CONST VOID
*RegisterContext
,
438 IN OUT VOID
*CommBuffer
,
439 IN OUT UINTN
*CommBufferSize
443 SMM_VARIABLE_COMMUNICATE_HEADER
*SmmVariableFunctionHeader
;
444 SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*SmmVariableHeader
;
445 SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*GetNextVariableName
;
446 SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*QueryVariableInfo
;
447 VARIABLE_INFO_ENTRY
*VariableInfo
;
448 SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE
*VariableToLock
;
449 SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*CommVariableProperty
;
451 UINTN NameBufferSize
;
452 UINTN CommBufferPayloadSize
;
453 UINTN TempCommBufferSize
;
456 // If input is invalid, stop processing this SMI
458 if (CommBuffer
== NULL
|| CommBufferSize
== NULL
) {
462 TempCommBufferSize
= *CommBufferSize
;
464 if (TempCommBufferSize
< SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
) {
465 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer size invalid!\n"));
468 CommBufferPayloadSize
= TempCommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
469 if (CommBufferPayloadSize
> mVariableBufferPayloadSize
) {
470 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer payload size invalid!\n"));
474 if (!SmmIsBufferOutsideSmmValid ((UINTN
)CommBuffer
, TempCommBufferSize
)) {
475 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer in SMRAM or overflow!\n"));
479 SmmVariableFunctionHeader
= (SMM_VARIABLE_COMMUNICATE_HEADER
*)CommBuffer
;
480 switch (SmmVariableFunctionHeader
->Function
) {
481 case SMM_VARIABLE_FUNCTION_GET_VARIABLE
:
482 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) {
483 DEBUG ((EFI_D_ERROR
, "GetVariable: SMM communication buffer size invalid!\n"));
487 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
489 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
490 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) mVariableBufferPayload
;
491 if (((UINTN
)(~0) - SmmVariableHeader
->DataSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) ||
492 ((UINTN
)(~0) - SmmVariableHeader
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
) + SmmVariableHeader
->DataSize
)) {
494 // Prevent InfoSize overflow happen
496 Status
= EFI_ACCESS_DENIED
;
499 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
500 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
503 // SMRAM range check already covered before
505 if (InfoSize
> CommBufferPayloadSize
) {
506 DEBUG ((EFI_D_ERROR
, "GetVariable: Data size exceed communication buffer size limit!\n"));
507 Status
= EFI_ACCESS_DENIED
;
511 if (SmmVariableHeader
->NameSize
< sizeof (CHAR16
) || SmmVariableHeader
->Name
[SmmVariableHeader
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
513 // Make sure VariableName is A Null-terminated string.
515 Status
= EFI_ACCESS_DENIED
;
519 Status
= VariableServiceGetVariable (
520 SmmVariableHeader
->Name
,
521 &SmmVariableHeader
->Guid
,
522 &SmmVariableHeader
->Attributes
,
523 &SmmVariableHeader
->DataSize
,
524 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
526 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
529 case SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME
:
530 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
)) {
531 DEBUG ((EFI_D_ERROR
, "GetNextVariableName: SMM communication buffer size invalid!\n"));
535 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
537 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
538 GetNextVariableName
= (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*) mVariableBufferPayload
;
539 if ((UINTN
)(~0) - GetNextVariableName
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
)) {
541 // Prevent InfoSize overflow happen
543 Status
= EFI_ACCESS_DENIED
;
546 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
) + GetNextVariableName
->NameSize
;
549 // SMRAM range check already covered before
551 if (InfoSize
> CommBufferPayloadSize
) {
552 DEBUG ((EFI_D_ERROR
, "GetNextVariableName: Data size exceed communication buffer size limit!\n"));
553 Status
= EFI_ACCESS_DENIED
;
557 NameBufferSize
= CommBufferPayloadSize
- OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
);
558 if (NameBufferSize
< sizeof (CHAR16
) || GetNextVariableName
->Name
[NameBufferSize
/sizeof (CHAR16
) - 1] != L
'\0') {
560 // Make sure input VariableName is A Null-terminated string.
562 Status
= EFI_ACCESS_DENIED
;
566 Status
= VariableServiceGetNextVariableName (
567 &GetNextVariableName
->NameSize
,
568 GetNextVariableName
->Name
,
569 &GetNextVariableName
->Guid
571 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
574 case SMM_VARIABLE_FUNCTION_SET_VARIABLE
:
575 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) {
576 DEBUG ((EFI_D_ERROR
, "SetVariable: SMM communication buffer size invalid!\n"));
580 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
582 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
583 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) mVariableBufferPayload
;
584 if (((UINTN
)(~0) - SmmVariableHeader
->DataSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) ||
585 ((UINTN
)(~0) - SmmVariableHeader
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
) + SmmVariableHeader
->DataSize
)) {
587 // Prevent InfoSize overflow happen
589 Status
= EFI_ACCESS_DENIED
;
592 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
593 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
596 // SMRAM range check already covered before
597 // Data buffer should not contain SMM range
599 if (InfoSize
> CommBufferPayloadSize
) {
600 DEBUG ((EFI_D_ERROR
, "SetVariable: Data size exceed communication buffer size limit!\n"));
601 Status
= EFI_ACCESS_DENIED
;
605 if (SmmVariableHeader
->NameSize
< sizeof (CHAR16
) || SmmVariableHeader
->Name
[SmmVariableHeader
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
607 // Make sure VariableName is A Null-terminated string.
609 Status
= EFI_ACCESS_DENIED
;
613 Status
= VariableServiceSetVariable (
614 SmmVariableHeader
->Name
,
615 &SmmVariableHeader
->Guid
,
616 SmmVariableHeader
->Attributes
,
617 SmmVariableHeader
->DataSize
,
618 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
622 case SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO
:
623 if (CommBufferPayloadSize
< sizeof (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
)) {
624 DEBUG ((EFI_D_ERROR
, "QueryVariableInfo: SMM communication buffer size invalid!\n"));
627 QueryVariableInfo
= (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*) SmmVariableFunctionHeader
->Data
;
629 Status
= VariableServiceQueryVariableInfo (
630 QueryVariableInfo
->Attributes
,
631 &QueryVariableInfo
->MaximumVariableStorageSize
,
632 &QueryVariableInfo
->RemainingVariableStorageSize
,
633 &QueryVariableInfo
->MaximumVariableSize
637 case SMM_VARIABLE_FUNCTION_READY_TO_BOOT
:
640 // The initialization for variable quota.
642 InitializeVariableQuota ();
644 Status
= EFI_UNSUPPORTED
;
648 Status
= EFI_SUCCESS
;
651 case SMM_VARIABLE_FUNCTION_EXIT_BOOT_SERVICE
:
653 Status
= EFI_SUCCESS
;
656 case SMM_VARIABLE_FUNCTION_GET_STATISTICS
:
657 VariableInfo
= (VARIABLE_INFO_ENTRY
*) SmmVariableFunctionHeader
->Data
;
658 InfoSize
= TempCommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
661 // Do not need to check SmmVariableFunctionHeader->Data in SMRAM here.
662 // It is covered by previous CommBuffer check
665 if (!SmmIsBufferOutsideSmmValid ((EFI_PHYSICAL_ADDRESS
)(UINTN
)CommBufferSize
, sizeof(UINTN
))) {
666 DEBUG ((EFI_D_ERROR
, "GetStatistics: SMM communication buffer in SMRAM!\n"));
667 Status
= EFI_ACCESS_DENIED
;
671 Status
= SmmVariableGetStatistics (VariableInfo
, &InfoSize
);
672 *CommBufferSize
= InfoSize
+ SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
675 case SMM_VARIABLE_FUNCTION_LOCK_VARIABLE
:
677 Status
= EFI_ACCESS_DENIED
;
679 VariableToLock
= (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE
*) SmmVariableFunctionHeader
->Data
;
680 Status
= VariableLockRequestToLock (
682 VariableToLock
->Name
,
683 &VariableToLock
->Guid
687 case SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_SET
:
689 Status
= EFI_ACCESS_DENIED
;
691 CommVariableProperty
= (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*) SmmVariableFunctionHeader
->Data
;
692 Status
= VarCheckVariablePropertySet (
693 CommVariableProperty
->Name
,
694 &CommVariableProperty
->Guid
,
695 &CommVariableProperty
->VariableProperty
699 case SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_GET
:
700 if (CommBufferPayloadSize
< OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
)) {
701 DEBUG ((EFI_D_ERROR
, "VarCheckVariablePropertyGet: SMM communication buffer size invalid!\n"));
705 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
707 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
708 CommVariableProperty
= (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*) mVariableBufferPayload
;
709 if ((UINTN
) (~0) - CommVariableProperty
->NameSize
< OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
)) {
711 // Prevent InfoSize overflow happen
713 Status
= EFI_ACCESS_DENIED
;
716 InfoSize
= OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
) + CommVariableProperty
->NameSize
;
719 // SMRAM range check already covered before
721 if (InfoSize
> CommBufferPayloadSize
) {
722 DEBUG ((EFI_D_ERROR
, "VarCheckVariablePropertyGet: Data size exceed communication buffer size limit!\n"));
723 Status
= EFI_ACCESS_DENIED
;
727 if (CommVariableProperty
->NameSize
< sizeof (CHAR16
) || CommVariableProperty
->Name
[CommVariableProperty
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
729 // Make sure VariableName is A Null-terminated string.
731 Status
= EFI_ACCESS_DENIED
;
735 Status
= VarCheckVariablePropertyGet (
736 CommVariableProperty
->Name
,
737 &CommVariableProperty
->Guid
,
738 &CommVariableProperty
->VariableProperty
740 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
744 Status
= EFI_UNSUPPORTED
;
749 SmmVariableFunctionHeader
->ReturnStatus
= Status
;
755 SMM END_OF_DXE protocol notification event handler.
757 @param Protocol Points to the protocol's unique identifier
758 @param Interface Points to the interface instance
759 @param Handle The handle on which the interface was installed
761 @retval EFI_SUCCESS SmmEndOfDxeCallback runs successfully
766 SmmEndOfDxeCallback (
767 IN CONST EFI_GUID
*Protocol
,
772 DEBUG ((EFI_D_INFO
, "[Variable]END_OF_DXE is signaled\n"));
775 // The initialization for variable quota.
777 InitializeVariableQuota ();
778 if (PcdGetBool (PcdReclaimVariableSpaceAtEndOfDxe
)) {
785 SMM Fault Tolerant Write protocol notification event handler.
787 Non-Volatile variable write may needs FTW protocol to reclaim when
790 @param Protocol Points to the protocol's unique identifier
791 @param Interface Points to the interface instance
792 @param Handle The handle on which the interface was installed
794 @retval EFI_SUCCESS SmmEventCallback runs successfully
795 @retval EFI_NOT_FOUND The Fvb protocol for variable is not found.
800 SmmFtwNotificationEvent (
801 IN CONST EFI_GUID
*Protocol
,
807 EFI_SMM_FIRMWARE_VOLUME_BLOCK_PROTOCOL
*FvbProtocol
;
808 EFI_SMM_FAULT_TOLERANT_WRITE_PROTOCOL
*FtwProtocol
;
809 EFI_PHYSICAL_ADDRESS NvStorageVariableBase
;
810 UINTN FtwMaxBlockSize
;
812 if (mVariableModuleGlobal
->FvbInstance
!= NULL
) {
817 // Ensure SMM FTW protocol is installed.
819 Status
= GetFtwProtocol ((VOID
**)&FtwProtocol
);
820 if (EFI_ERROR (Status
)) {
824 Status
= FtwProtocol
->GetMaxBlockSize (FtwProtocol
, &FtwMaxBlockSize
);
825 if (!EFI_ERROR (Status
)) {
826 ASSERT (PcdGet32 (PcdFlashNvStorageVariableSize
) <= FtwMaxBlockSize
);
830 // Find the proper FVB protocol for variable.
832 NvStorageVariableBase
= (EFI_PHYSICAL_ADDRESS
) PcdGet64 (PcdFlashNvStorageVariableBase64
);
833 if (NvStorageVariableBase
== 0) {
834 NvStorageVariableBase
= (EFI_PHYSICAL_ADDRESS
) PcdGet32 (PcdFlashNvStorageVariableBase
);
836 Status
= GetFvbInfoByAddress (NvStorageVariableBase
, NULL
, &FvbProtocol
);
837 if (EFI_ERROR (Status
)) {
838 return EFI_NOT_FOUND
;
841 mVariableModuleGlobal
->FvbInstance
= FvbProtocol
;
843 Status
= VariableWriteServiceInitialize ();
844 ASSERT_EFI_ERROR (Status
);
847 // Notify the variable wrapper driver the variable write service is ready
849 Status
= gBS
->InstallProtocolInterface (
851 &gSmmVariableWriteGuid
,
852 EFI_NATIVE_INTERFACE
,
855 ASSERT_EFI_ERROR (Status
);
862 Variable Driver main entry point. The Variable driver places the 4 EFI
863 runtime services in the EFI System Table and installs arch protocols
864 for variable read and write services being available. It also registers
865 a notification function for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
867 @param[in] ImageHandle The firmware allocated handle for the EFI image.
868 @param[in] SystemTable A pointer to the EFI System Table.
870 @retval EFI_SUCCESS Variable service successfully initialized.
875 VariableServiceInitialize (
876 IN EFI_HANDLE ImageHandle
,
877 IN EFI_SYSTEM_TABLE
*SystemTable
881 EFI_HANDLE VariableHandle
;
882 VOID
*SmmFtwRegistration
;
883 VOID
*SmmEndOfDxeRegistration
;
886 // Variable initialize.
888 Status
= VariableCommonInitialize ();
889 ASSERT_EFI_ERROR (Status
);
892 // Install the Smm Variable Protocol on a new handle.
894 VariableHandle
= NULL
;
895 Status
= gSmst
->SmmInstallProtocolInterface (
897 &gEfiSmmVariableProtocolGuid
,
898 EFI_NATIVE_INTERFACE
,
901 ASSERT_EFI_ERROR (Status
);
903 Status
= gSmst
->SmmInstallProtocolInterface (
905 &gEdkiiSmmVarCheckProtocolGuid
,
906 EFI_NATIVE_INTERFACE
,
909 ASSERT_EFI_ERROR (Status
);
911 mVariableBufferPayloadSize
= MAX (PcdGet32 (PcdMaxVariableSize
), PcdGet32 (PcdMaxHardwareErrorVariableSize
)) +
912 OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
) - sizeof (VARIABLE_HEADER
);
914 Status
= gSmst
->SmmAllocatePool (
915 EfiRuntimeServicesData
,
916 mVariableBufferPayloadSize
,
917 (VOID
**)&mVariableBufferPayload
919 ASSERT_EFI_ERROR (Status
);
922 /// Register SMM variable SMI handler
924 VariableHandle
= NULL
;
925 Status
= gSmst
->SmiHandlerRegister (SmmVariableHandler
, &gEfiSmmVariableProtocolGuid
, &VariableHandle
);
926 ASSERT_EFI_ERROR (Status
);
929 // Notify the variable wrapper driver the variable service is ready
931 Status
= SystemTable
->BootServices
->InstallProtocolInterface (
933 &gEfiSmmVariableProtocolGuid
,
934 EFI_NATIVE_INTERFACE
,
937 ASSERT_EFI_ERROR (Status
);
940 // Register EFI_SMM_END_OF_DXE_PROTOCOL_GUID notify function.
942 Status
= gSmst
->SmmRegisterProtocolNotify (
943 &gEfiSmmEndOfDxeProtocolGuid
,
945 &SmmEndOfDxeRegistration
947 ASSERT_EFI_ERROR (Status
);
950 // Register FtwNotificationEvent () notify function.
952 Status
= gSmst
->SmmRegisterProtocolNotify (
953 &gEfiSmmFaultTolerantWriteProtocolGuid
,
954 SmmFtwNotificationEvent
,
957 ASSERT_EFI_ERROR (Status
);
959 SmmFtwNotificationEvent (NULL
, NULL
, NULL
);