3 The sample implementation for SMM variable protocol. And this driver
4 implements an SMI handler to communicate with the DXE runtime driver
5 to provide variable services.
7 Caution: This module requires additional review when modified.
8 This driver will have external input - variable data and communicate buffer in SMM mode.
9 This external input must be validated carefully to avoid security issue like
10 buffer overflow, integer overflow.
12 SmmVariableHandler() will receive untrusted input and do basic validation.
14 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
15 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
16 SmmVariableGetStatistics() should also do validation based on its own knowledge.
18 Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>
19 This program and the accompanying materials
20 are licensed and made available under the terms and conditions of the BSD License
21 which accompanies this distribution. The full text of the license may be found at
22 http://opensource.org/licenses/bsd-license.php
24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
28 #include <Protocol/SmmVariable.h>
29 #include <Protocol/SmmFirmwareVolumeBlock.h>
30 #include <Protocol/SmmFaultTolerantWrite.h>
31 #include <Protocol/SmmAccess2.h>
33 #include <Library/SmmServicesTableLib.h>
35 #include <Guid/VariableFormat.h>
36 #include <Guid/SmmVariableCommon.h>
39 EFI_SMRAM_DESCRIPTOR
*mSmramRanges
;
40 UINTN mSmramRangeCount
;
42 extern VARIABLE_INFO_ENTRY
*gVariableInfo
;
43 EFI_HANDLE mSmmVariableHandle
= NULL
;
44 EFI_HANDLE mVariableHandle
= NULL
;
45 BOOLEAN mAtRuntime
= FALSE
;
46 EFI_GUID mZeroGuid
= {0, 0, 0, {0, 0, 0, 0, 0, 0, 0, 0}};
48 EFI_SMM_VARIABLE_PROTOCOL gSmmVariable
= {
49 VariableServiceGetVariable
,
50 VariableServiceGetNextVariableName
,
51 VariableServiceSetVariable
,
52 VariableServiceQueryVariableInfo
57 Return TRUE if ExitBootServices () has been called.
59 @retval TRUE If ExitBootServices () has been called.
70 This function check if the address is in SMRAM.
72 @param Buffer the buffer address to be checked.
73 @param Length the buffer length to be checked.
75 @retval TRUE this address is in SMRAM.
76 @retval FALSE this address is NOT in SMRAM.
79 InternalIsAddressInSmram (
80 IN EFI_PHYSICAL_ADDRESS Buffer
,
86 for (Index
= 0; Index
< mSmramRangeCount
; Index
++) {
87 if (((Buffer
>= mSmramRanges
[Index
].CpuStart
) && (Buffer
< mSmramRanges
[Index
].CpuStart
+ mSmramRanges
[Index
].PhysicalSize
)) ||
88 ((mSmramRanges
[Index
].CpuStart
>= Buffer
) && (mSmramRanges
[Index
].CpuStart
< Buffer
+ Length
))) {
98 Initializes a basic mutual exclusion lock.
100 This function initializes a basic mutual exclusion lock to the released state
101 and returns the lock. Each lock provides mutual exclusion access at its task
102 priority level. Since there is no preemption or multiprocessor support in EFI,
103 acquiring the lock only consists of raising to the locks TPL.
104 If Lock is NULL, then ASSERT().
105 If Priority is not a valid TPL value, then ASSERT().
107 @param Lock A pointer to the lock data structure to initialize.
108 @param Priority EFI TPL is associated with the lock.
115 IN OUT EFI_LOCK
*Lock
,
123 Acquires lock only at boot time. Simply returns at runtime.
125 This is a temperary function that will be removed when
126 EfiAcquireLock() in UefiLib can handle the call in UEFI
127 Runtimer driver in RT phase.
128 It calls EfiAcquireLock() at boot time, and simply returns
131 @param Lock A pointer to the lock to acquire.
135 AcquireLockOnlyAtBootTime (
144 Releases lock only at boot time. Simply returns at runtime.
146 This is a temperary function which will be removed when
147 EfiReleaseLock() in UefiLib can handle the call in UEFI
148 Runtimer driver in RT phase.
149 It calls EfiReleaseLock() at boot time and simply returns
152 @param Lock A pointer to the lock to release.
156 ReleaseLockOnlyAtBootTime (
164 Retrive the SMM Fault Tolerent Write protocol interface.
166 @param[out] FtwProtocol The interface of SMM Ftw protocol
168 @retval EFI_SUCCESS The SMM FTW protocol instance was found and returned in FtwProtocol.
169 @retval EFI_NOT_FOUND The SMM FTW protocol instance was not found.
170 @retval EFI_INVALID_PARAMETER SarProtocol is NULL.
175 OUT VOID
**FtwProtocol
181 // Locate Smm Fault Tolerent Write protocol
183 Status
= gSmst
->SmmLocateProtocol (
184 &gEfiSmmFaultTolerantWriteProtocolGuid
,
193 Retrive the SMM FVB protocol interface by HANDLE.
195 @param[in] FvBlockHandle The handle of SMM FVB protocol that provides services for
196 reading, writing, and erasing the target block.
197 @param[out] FvBlock The interface of SMM FVB protocol
199 @retval EFI_SUCCESS The interface information for the specified protocol was returned.
200 @retval EFI_UNSUPPORTED The device does not support the SMM FVB protocol.
201 @retval EFI_INVALID_PARAMETER FvBlockHandle is not a valid EFI_HANDLE or FvBlock is NULL.
206 IN EFI_HANDLE FvBlockHandle
,
207 OUT EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL
**FvBlock
211 // To get the SMM FVB protocol interface on the handle
213 return gSmst
->SmmHandleProtocol (
215 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
222 Function returns an array of handles that support the SMM FVB protocol
223 in a buffer allocated from pool.
225 @param[out] NumberHandles The number of handles returned in Buffer.
226 @param[out] Buffer A pointer to the buffer to return the requested
227 array of handles that support SMM FVB protocol.
229 @retval EFI_SUCCESS The array of handles was returned in Buffer, and the number of
230 handles in Buffer was returned in NumberHandles.
231 @retval EFI_NOT_FOUND No SMM FVB handle was found.
232 @retval EFI_OUT_OF_RESOURCES There is not enough pool memory to store the matching results.
233 @retval EFI_INVALID_PARAMETER NumberHandles is NULL or Buffer is NULL.
237 GetFvbCountAndBuffer (
238 OUT UINTN
*NumberHandles
,
239 OUT EFI_HANDLE
**Buffer
245 if ((NumberHandles
== NULL
) || (Buffer
== NULL
)) {
246 return EFI_INVALID_PARAMETER
;
252 Status
= gSmst
->SmmLocateHandle (
254 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
259 if (EFI_ERROR(Status
) && Status
!= EFI_BUFFER_TOO_SMALL
) {
260 return EFI_NOT_FOUND
;
263 *Buffer
= AllocatePool (BufferSize
);
264 if (*Buffer
== NULL
) {
265 return EFI_OUT_OF_RESOURCES
;
268 Status
= gSmst
->SmmLocateHandle (
270 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
276 *NumberHandles
= BufferSize
/ sizeof(EFI_HANDLE
);
277 if (EFI_ERROR(Status
)) {
286 Get the variable statistics information from the information buffer pointed by gVariableInfo.
288 Caution: This function may be invoked at SMM runtime.
289 InfoEntry and InfoSize are external input. Care must be taken to make sure not security issue at runtime.
291 @param[in, out] InfoEntry A pointer to the buffer of variable information entry.
292 On input, point to the variable information returned last time. if
293 InfoEntry->VendorGuid is zero, return the first information.
294 On output, point to the next variable information.
295 @param[in, out] InfoSize On input, the size of the variable information buffer.
296 On output, the returned variable information size.
298 @retval EFI_SUCCESS The variable information is found and returned successfully.
299 @retval EFI_UNSUPPORTED No variable inoformation exists in variable driver. The
300 PcdVariableCollectStatistics should be set TRUE to support it.
301 @retval EFI_BUFFER_TOO_SMALL The buffer is too small to hold the next variable information.
305 SmmVariableGetStatistics (
306 IN OUT VARIABLE_INFO_ENTRY
*InfoEntry
,
307 IN OUT UINTN
*InfoSize
310 VARIABLE_INFO_ENTRY
*VariableInfo
;
312 UINTN StatisticsInfoSize
;
315 ASSERT (InfoEntry
!= NULL
);
316 VariableInfo
= gVariableInfo
;
317 if (VariableInfo
== NULL
) {
318 return EFI_UNSUPPORTED
;
321 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + StrSize (VariableInfo
->Name
);
322 if (*InfoSize
< StatisticsInfoSize
) {
323 *InfoSize
= StatisticsInfoSize
;
324 return EFI_BUFFER_TOO_SMALL
;
326 InfoName
= (CHAR16
*)(InfoEntry
+ 1);
328 if (CompareGuid (&InfoEntry
->VendorGuid
, &mZeroGuid
)) {
330 // Return the first variable info
332 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
333 CopyMem (InfoName
, VariableInfo
->Name
, StrSize (VariableInfo
->Name
));
334 *InfoSize
= StatisticsInfoSize
;
339 // Get the next variable info
341 while (VariableInfo
!= NULL
) {
342 if (CompareGuid (&VariableInfo
->VendorGuid
, &InfoEntry
->VendorGuid
)) {
343 NameLength
= StrSize (VariableInfo
->Name
);
344 if (NameLength
== StrSize (InfoName
)) {
345 if (CompareMem (VariableInfo
->Name
, InfoName
, NameLength
) == 0) {
347 // Find the match one
349 VariableInfo
= VariableInfo
->Next
;
354 VariableInfo
= VariableInfo
->Next
;
357 if (VariableInfo
== NULL
) {
363 // Output the new variable info
365 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + StrSize (VariableInfo
->Name
);
366 if (*InfoSize
< StatisticsInfoSize
) {
367 *InfoSize
= StatisticsInfoSize
;
368 return EFI_BUFFER_TOO_SMALL
;
371 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
372 CopyMem (InfoName
, VariableInfo
->Name
, StrSize (VariableInfo
->Name
));
373 *InfoSize
= StatisticsInfoSize
;
380 Communication service SMI Handler entry.
382 This SMI handler provides services for the variable wrapper driver.
384 Caution: This function may receive untrusted input.
385 This variable data and communicate buffer are external input, so this function will do basic validation.
386 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
387 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
388 SmmVariableGetStatistics() should also do validation based on its own knowledge.
390 @param[in] DispatchHandle The unique handle assigned to this handler by SmiHandlerRegister().
391 @param[in] RegisterContext Points to an optional handler context which was specified when the
392 handler was registered.
393 @param[in, out] CommBuffer A pointer to a collection of data in memory that will
394 be conveyed from a non-SMM environment into an SMM environment.
395 @param[in, out] CommBufferSize The size of the CommBuffer.
397 @retval EFI_SUCCESS The interrupt was handled and quiesced. No other handlers
398 should still be called.
399 @retval EFI_WARN_INTERRUPT_SOURCE_QUIESCED The interrupt has been quiesced but other handlers should
401 @retval EFI_WARN_INTERRUPT_SOURCE_PENDING The interrupt is still pending and other handlers should still
403 @retval EFI_INTERRUPT_PENDING The interrupt could not be quiesced.
408 IN EFI_HANDLE DispatchHandle
,
409 IN CONST VOID
*RegisterContext
,
410 IN OUT VOID
*CommBuffer
,
411 IN OUT UINTN
*CommBufferSize
415 SMM_VARIABLE_COMMUNICATE_HEADER
*SmmVariableFunctionHeader
;
416 SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*SmmVariableHeader
;
417 SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*GetNextVariableName
;
418 SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*QueryVariableInfo
;
419 VARIABLE_INFO_ENTRY
*VariableInfo
;
423 // If input is invalid, stop processing this SMI
425 if (CommBuffer
== NULL
|| CommBufferSize
== NULL
) {
429 if (*CommBufferSize
< SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
) {
433 if (InternalIsAddressInSmram ((EFI_PHYSICAL_ADDRESS
)(UINTN
)CommBuffer
, *CommBufferSize
)) {
434 DEBUG ((EFI_D_ERROR
, "SMM communication buffer size is in SMRAM!\n"));
438 SmmVariableFunctionHeader
= (SMM_VARIABLE_COMMUNICATE_HEADER
*)CommBuffer
;
439 switch (SmmVariableFunctionHeader
->Function
) {
440 case SMM_VARIABLE_FUNCTION_GET_VARIABLE
:
441 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) SmmVariableFunctionHeader
->Data
;
442 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
443 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
446 // SMRAM range check already covered before
448 if (InfoSize
> *CommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
) {
449 DEBUG ((EFI_D_ERROR
, "Data size exceed communication buffer size limit!\n"));
450 Status
= EFI_ACCESS_DENIED
;
454 Status
= VariableServiceGetVariable (
455 SmmVariableHeader
->Name
,
456 &SmmVariableHeader
->Guid
,
457 &SmmVariableHeader
->Attributes
,
458 &SmmVariableHeader
->DataSize
,
459 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
463 case SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME
:
464 GetNextVariableName
= (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*) SmmVariableFunctionHeader
->Data
;
465 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
) + GetNextVariableName
->NameSize
;
468 // SMRAM range check already covered before
470 if (InfoSize
> *CommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
) {
471 DEBUG ((EFI_D_ERROR
, "Data size exceed communication buffer size limit!\n"));
472 Status
= EFI_ACCESS_DENIED
;
476 Status
= VariableServiceGetNextVariableName (
477 &GetNextVariableName
->NameSize
,
478 GetNextVariableName
->Name
,
479 &GetNextVariableName
->Guid
483 case SMM_VARIABLE_FUNCTION_SET_VARIABLE
:
484 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) SmmVariableFunctionHeader
->Data
;
485 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
486 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
489 // SMRAM range check already covered before
490 // Data buffer should not contain SMM range
492 if (InfoSize
> *CommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
) {
493 DEBUG ((EFI_D_ERROR
, "Data size exceed communication buffer size limit!\n"));
494 Status
= EFI_ACCESS_DENIED
;
498 Status
= VariableServiceSetVariable (
499 SmmVariableHeader
->Name
,
500 &SmmVariableHeader
->Guid
,
501 SmmVariableHeader
->Attributes
,
502 SmmVariableHeader
->DataSize
,
503 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
507 case SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO
:
508 QueryVariableInfo
= (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*) SmmVariableFunctionHeader
->Data
;
509 InfoSize
= sizeof(SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
);
512 // SMRAM range check already covered before
514 if (InfoSize
> *CommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
) {
515 DEBUG ((EFI_D_ERROR
, "Data size exceed communication buffer size limit!\n"));
516 Status
= EFI_ACCESS_DENIED
;
520 Status
= VariableServiceQueryVariableInfo (
521 QueryVariableInfo
->Attributes
,
522 &QueryVariableInfo
->MaximumVariableStorageSize
,
523 &QueryVariableInfo
->RemainingVariableStorageSize
,
524 &QueryVariableInfo
->MaximumVariableSize
528 case SMM_VARIABLE_FUNCTION_READY_TO_BOOT
:
530 Status
= EFI_UNSUPPORTED
;
534 Status
= EFI_SUCCESS
;
537 case SMM_VARIABLE_FUNCTION_EXIT_BOOT_SERVICE
:
539 Status
= EFI_SUCCESS
;
542 case SMM_VARIABLE_FUNCTION_GET_STATISTICS
:
543 VariableInfo
= (VARIABLE_INFO_ENTRY
*) SmmVariableFunctionHeader
->Data
;
544 InfoSize
= *CommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
547 // Do not need to check SmmVariableFunctionHeader->Data in SMRAM here.
548 // It is covered by previous CommBuffer check
551 if (InternalIsAddressInSmram ((EFI_PHYSICAL_ADDRESS
)(UINTN
)CommBufferSize
, sizeof(UINTN
))) {
552 DEBUG ((EFI_D_ERROR
, "SMM communication buffer size is in SMRAM!\n"));
553 Status
= EFI_ACCESS_DENIED
;
557 Status
= SmmVariableGetStatistics (VariableInfo
, &InfoSize
);
558 *CommBufferSize
= InfoSize
+ SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
562 Status
= EFI_UNSUPPORTED
;
567 SmmVariableFunctionHeader
->ReturnStatus
= Status
;
574 SMM Fault Tolerant Write protocol notification event handler.
576 Non-Volatile variable write may needs FTW protocol to reclaim when
579 @param Protocol Points to the protocol's unique identifier
580 @param Interface Points to the interface instance
581 @param Handle The handle on which the interface was installed
583 @retval EFI_SUCCESS SmmEventCallback runs successfully
584 @retval EFI_NOT_FOUND The Fvb protocol for variable is not found.
589 SmmFtwNotificationEvent (
590 IN CONST EFI_GUID
*Protocol
,
596 EFI_SMM_FIRMWARE_VOLUME_BLOCK_PROTOCOL
*FvbProtocol
;
597 EFI_SMM_FAULT_TOLERANT_WRITE_PROTOCOL
*FtwProtocol
;
598 EFI_PHYSICAL_ADDRESS NvStorageVariableBase
;
600 if (mVariableModuleGlobal
->FvbInstance
!= NULL
) {
605 // Ensure SMM FTW protocol is installed.
607 Status
= GetFtwProtocol ((VOID
**)&FtwProtocol
);
608 if (EFI_ERROR (Status
)) {
613 // Find the proper FVB protocol for variable.
615 NvStorageVariableBase
= (EFI_PHYSICAL_ADDRESS
) PcdGet64 (PcdFlashNvStorageVariableBase64
);
616 if (NvStorageVariableBase
== 0) {
617 NvStorageVariableBase
= (EFI_PHYSICAL_ADDRESS
) PcdGet32 (PcdFlashNvStorageVariableBase
);
619 Status
= GetFvbInfoByAddress (NvStorageVariableBase
, NULL
, &FvbProtocol
);
620 if (EFI_ERROR (Status
)) {
621 return EFI_NOT_FOUND
;
624 mVariableModuleGlobal
->FvbInstance
= FvbProtocol
;
626 Status
= VariableWriteServiceInitialize ();
627 ASSERT_EFI_ERROR (Status
);
630 // Notify the variable wrapper driver the variable write service is ready
632 Status
= gBS
->InstallProtocolInterface (
634 &gSmmVariableWriteGuid
,
635 EFI_NATIVE_INTERFACE
,
638 ASSERT_EFI_ERROR (Status
);
645 Variable Driver main entry point. The Variable driver places the 4 EFI
646 runtime services in the EFI System Table and installs arch protocols
647 for variable read and write services being available. It also registers
648 a notification function for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
650 @param[in] ImageHandle The firmware allocated handle for the EFI image.
651 @param[in] SystemTable A pointer to the EFI System Table.
653 @retval EFI_SUCCESS Variable service successfully initialized.
658 VariableServiceInitialize (
659 IN EFI_HANDLE ImageHandle
,
660 IN EFI_SYSTEM_TABLE
*SystemTable
664 EFI_HANDLE VariableHandle
;
665 VOID
*SmmFtwRegistration
;
666 EFI_SMM_ACCESS2_PROTOCOL
*SmmAccess
;
670 // Variable initialize.
672 Status
= VariableCommonInitialize ();
673 ASSERT_EFI_ERROR (Status
);
676 // Install the Smm Variable Protocol on a new handle.
678 VariableHandle
= NULL
;
679 Status
= gSmst
->SmmInstallProtocolInterface (
681 &gEfiSmmVariableProtocolGuid
,
682 EFI_NATIVE_INTERFACE
,
685 ASSERT_EFI_ERROR (Status
);
688 // Get SMRAM information
690 Status
= gBS
->LocateProtocol (&gEfiSmmAccess2ProtocolGuid
, NULL
, (VOID
**)&SmmAccess
);
691 ASSERT_EFI_ERROR (Status
);
694 Status
= SmmAccess
->GetCapabilities (SmmAccess
, &Size
, NULL
);
695 ASSERT (Status
== EFI_BUFFER_TOO_SMALL
);
697 Status
= gSmst
->SmmAllocatePool (
698 EfiRuntimeServicesData
,
700 (VOID
**)&mSmramRanges
702 ASSERT_EFI_ERROR (Status
);
704 Status
= SmmAccess
->GetCapabilities (SmmAccess
, &Size
, mSmramRanges
);
705 ASSERT_EFI_ERROR (Status
);
707 mSmramRangeCount
= Size
/ sizeof (EFI_SMRAM_DESCRIPTOR
);
710 /// Register SMM variable SMI handler
712 VariableHandle
= NULL
;
713 Status
= gSmst
->SmiHandlerRegister (SmmVariableHandler
, &gEfiSmmVariableProtocolGuid
, &VariableHandle
);
714 ASSERT_EFI_ERROR (Status
);
717 // Notify the variable wrapper driver the variable service is ready
719 Status
= SystemTable
->BootServices
->InstallProtocolInterface (
721 &gEfiSmmVariableProtocolGuid
,
722 EFI_NATIVE_INTERFACE
,
725 ASSERT_EFI_ERROR (Status
);
728 // Register FtwNotificationEvent () notify function.
730 Status
= gSmst
->SmmRegisterProtocolNotify (
731 &gEfiSmmFaultTolerantWriteProtocolGuid
,
732 SmmFtwNotificationEvent
,
735 ASSERT_EFI_ERROR (Status
);
737 SmmFtwNotificationEvent (NULL
, NULL
, NULL
);