2 The sample implementation for SMM variable protocol. And this driver
3 implements an SMI handler to communicate with the DXE runtime driver
4 to provide variable services.
6 Caution: This module requires additional review when modified.
7 This driver will have external input - variable data and communicate buffer in SMM mode.
8 This external input must be validated carefully to avoid security issue like
9 buffer overflow, integer overflow.
11 SmmVariableHandler() will receive untrusted input and do basic validation.
13 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
14 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
15 SmmVariableGetStatistics() should also do validation based on its own knowledge.
17 Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.<BR>
18 This program and the accompanying materials
19 are licensed and made available under the terms and conditions of the BSD License
20 which accompanies this distribution. The full text of the license may be found at
21 http://opensource.org/licenses/bsd-license.php
23 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
24 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
28 #include <Protocol/SmmVariable.h>
29 #include <Protocol/SmmFirmwareVolumeBlock.h>
30 #include <Protocol/SmmFaultTolerantWrite.h>
31 #include <Protocol/SmmEndOfDxe.h>
32 #include <Protocol/SmmVarCheck.h>
34 #include <Library/SmmServicesTableLib.h>
35 #include <Library/SmmMemLib.h>
37 #include <Guid/SmmVariableCommon.h>
40 extern VARIABLE_INFO_ENTRY
*gVariableInfo
;
41 EFI_HANDLE mSmmVariableHandle
= NULL
;
42 EFI_HANDLE mVariableHandle
= NULL
;
43 BOOLEAN mAtRuntime
= FALSE
;
44 UINT8
*mVariableBufferPayload
= NULL
;
45 UINTN mVariableBufferPayloadSize
;
46 extern BOOLEAN mEndOfDxe
;
47 extern VAR_CHECK_REQUEST_SOURCE mRequestSource
;
50 SecureBoot Hook for SetVariable.
52 @param[in] VariableName Name of Variable to be found.
53 @param[in] VendorGuid Variable vendor GUID.
59 IN CHAR16
*VariableName
,
60 IN EFI_GUID
*VendorGuid
68 This code sets variable in storage blocks (Volatile or Non-Volatile).
70 @param VariableName Name of Variable to be found.
71 @param VendorGuid Variable vendor GUID.
72 @param Attributes Attribute value of the variable found
73 @param DataSize Size of Data found. If size is less than the
74 data, this value contains the required size.
75 @param Data Data pointer.
77 @return EFI_INVALID_PARAMETER Invalid parameter.
78 @return EFI_SUCCESS Set successfully.
79 @return EFI_OUT_OF_RESOURCES Resource not enough to set variable.
80 @return EFI_NOT_FOUND Not found.
81 @return EFI_WRITE_PROTECTED Variable is read-only.
86 SmmVariableSetVariable (
87 IN CHAR16
*VariableName
,
88 IN EFI_GUID
*VendorGuid
,
97 // Disable write protection when the calling SetVariable() through EFI_SMM_VARIABLE_PROTOCOL.
99 mRequestSource
= VarCheckFromTrusted
;
100 Status
= VariableServiceSetVariable (
107 mRequestSource
= VarCheckFromUntrusted
;
111 EFI_SMM_VARIABLE_PROTOCOL gSmmVariable
= {
112 VariableServiceGetVariable
,
113 VariableServiceGetNextVariableName
,
114 SmmVariableSetVariable
,
115 VariableServiceQueryVariableInfo
118 EDKII_SMM_VAR_CHECK_PROTOCOL mSmmVarCheck
= { VarCheckRegisterSetVariableCheckHandler
,
119 VarCheckVariablePropertySet
,
120 VarCheckVariablePropertyGet
};
123 Return TRUE if ExitBootServices () has been called.
125 @retval TRUE If ExitBootServices () has been called.
136 Initializes a basic mutual exclusion lock.
138 This function initializes a basic mutual exclusion lock to the released state
139 and returns the lock. Each lock provides mutual exclusion access at its task
140 priority level. Since there is no preemption or multiprocessor support in EFI,
141 acquiring the lock only consists of raising to the locks TPL.
142 If Lock is NULL, then ASSERT().
143 If Priority is not a valid TPL value, then ASSERT().
145 @param Lock A pointer to the lock data structure to initialize.
146 @param Priority EFI TPL is associated with the lock.
153 IN OUT EFI_LOCK
*Lock
,
161 Acquires lock only at boot time. Simply returns at runtime.
163 This is a temperary function that will be removed when
164 EfiAcquireLock() in UefiLib can handle the call in UEFI
165 Runtimer driver in RT phase.
166 It calls EfiAcquireLock() at boot time, and simply returns
169 @param Lock A pointer to the lock to acquire.
173 AcquireLockOnlyAtBootTime (
182 Releases lock only at boot time. Simply returns at runtime.
184 This is a temperary function which will be removed when
185 EfiReleaseLock() in UefiLib can handle the call in UEFI
186 Runtimer driver in RT phase.
187 It calls EfiReleaseLock() at boot time and simply returns
190 @param Lock A pointer to the lock to release.
194 ReleaseLockOnlyAtBootTime (
202 Retrieve the SMM Fault Tolerent Write protocol interface.
204 @param[out] FtwProtocol The interface of SMM Ftw protocol
206 @retval EFI_SUCCESS The SMM FTW protocol instance was found and returned in FtwProtocol.
207 @retval EFI_NOT_FOUND The SMM FTW protocol instance was not found.
208 @retval EFI_INVALID_PARAMETER SarProtocol is NULL.
213 OUT VOID
**FtwProtocol
219 // Locate Smm Fault Tolerent Write protocol
221 Status
= gSmst
->SmmLocateProtocol (
222 &gEfiSmmFaultTolerantWriteProtocolGuid
,
231 Retrieve the SMM FVB protocol interface by HANDLE.
233 @param[in] FvBlockHandle The handle of SMM FVB protocol that provides services for
234 reading, writing, and erasing the target block.
235 @param[out] FvBlock The interface of SMM FVB protocol
237 @retval EFI_SUCCESS The interface information for the specified protocol was returned.
238 @retval EFI_UNSUPPORTED The device does not support the SMM FVB protocol.
239 @retval EFI_INVALID_PARAMETER FvBlockHandle is not a valid EFI_HANDLE or FvBlock is NULL.
244 IN EFI_HANDLE FvBlockHandle
,
245 OUT EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL
**FvBlock
249 // To get the SMM FVB protocol interface on the handle
251 return gSmst
->SmmHandleProtocol (
253 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
260 Function returns an array of handles that support the SMM FVB protocol
261 in a buffer allocated from pool.
263 @param[out] NumberHandles The number of handles returned in Buffer.
264 @param[out] Buffer A pointer to the buffer to return the requested
265 array of handles that support SMM FVB protocol.
267 @retval EFI_SUCCESS The array of handles was returned in Buffer, and the number of
268 handles in Buffer was returned in NumberHandles.
269 @retval EFI_NOT_FOUND No SMM FVB handle was found.
270 @retval EFI_OUT_OF_RESOURCES There is not enough pool memory to store the matching results.
271 @retval EFI_INVALID_PARAMETER NumberHandles is NULL or Buffer is NULL.
275 GetFvbCountAndBuffer (
276 OUT UINTN
*NumberHandles
,
277 OUT EFI_HANDLE
**Buffer
283 if ((NumberHandles
== NULL
) || (Buffer
== NULL
)) {
284 return EFI_INVALID_PARAMETER
;
290 Status
= gSmst
->SmmLocateHandle (
292 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
297 if (EFI_ERROR(Status
) && Status
!= EFI_BUFFER_TOO_SMALL
) {
298 return EFI_NOT_FOUND
;
301 *Buffer
= AllocatePool (BufferSize
);
302 if (*Buffer
== NULL
) {
303 return EFI_OUT_OF_RESOURCES
;
306 Status
= gSmst
->SmmLocateHandle (
308 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
314 *NumberHandles
= BufferSize
/ sizeof(EFI_HANDLE
);
315 if (EFI_ERROR(Status
)) {
326 Get the variable statistics information from the information buffer pointed by gVariableInfo.
328 Caution: This function may be invoked at SMM runtime.
329 InfoEntry and InfoSize are external input. Care must be taken to make sure not security issue at runtime.
331 @param[in, out] InfoEntry A pointer to the buffer of variable information entry.
332 On input, point to the variable information returned last time. if
333 InfoEntry->VendorGuid is zero, return the first information.
334 On output, point to the next variable information.
335 @param[in, out] InfoSize On input, the size of the variable information buffer.
336 On output, the returned variable information size.
338 @retval EFI_SUCCESS The variable information is found and returned successfully.
339 @retval EFI_UNSUPPORTED No variable inoformation exists in variable driver. The
340 PcdVariableCollectStatistics should be set TRUE to support it.
341 @retval EFI_BUFFER_TOO_SMALL The buffer is too small to hold the next variable information.
342 @retval EFI_INVALID_PARAMETER Input parameter is invalid.
346 SmmVariableGetStatistics (
347 IN OUT VARIABLE_INFO_ENTRY
*InfoEntry
,
348 IN OUT UINTN
*InfoSize
351 VARIABLE_INFO_ENTRY
*VariableInfo
;
353 UINTN StatisticsInfoSize
;
355 UINTN InfoNameMaxSize
;
358 if (InfoEntry
== NULL
) {
359 return EFI_INVALID_PARAMETER
;
362 VariableInfo
= gVariableInfo
;
363 if (VariableInfo
== NULL
) {
364 return EFI_UNSUPPORTED
;
367 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
);
368 if (*InfoSize
< StatisticsInfoSize
) {
369 *InfoSize
= StatisticsInfoSize
;
370 return EFI_BUFFER_TOO_SMALL
;
372 InfoName
= (CHAR16
*)(InfoEntry
+ 1);
373 InfoNameMaxSize
= (*InfoSize
- sizeof (VARIABLE_INFO_ENTRY
));
375 CopyGuid (&VendorGuid
, &InfoEntry
->VendorGuid
);
377 if (IsZeroGuid (&VendorGuid
)) {
379 // Return the first variable info
381 NameSize
= StrSize (VariableInfo
->Name
);
382 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + NameSize
;
383 if (*InfoSize
< StatisticsInfoSize
) {
384 *InfoSize
= StatisticsInfoSize
;
385 return EFI_BUFFER_TOO_SMALL
;
387 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
388 CopyMem (InfoName
, VariableInfo
->Name
, NameSize
);
389 *InfoSize
= StatisticsInfoSize
;
394 // Get the next variable info
396 while (VariableInfo
!= NULL
) {
397 if (CompareGuid (&VariableInfo
->VendorGuid
, &VendorGuid
)) {
398 NameSize
= StrSize (VariableInfo
->Name
);
399 if (NameSize
<= InfoNameMaxSize
) {
400 if (CompareMem (VariableInfo
->Name
, InfoName
, NameSize
) == 0) {
402 // Find the match one
404 VariableInfo
= VariableInfo
->Next
;
409 VariableInfo
= VariableInfo
->Next
;
412 if (VariableInfo
== NULL
) {
418 // Output the new variable info
420 NameSize
= StrSize (VariableInfo
->Name
);
421 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + NameSize
;
422 if (*InfoSize
< StatisticsInfoSize
) {
423 *InfoSize
= StatisticsInfoSize
;
424 return EFI_BUFFER_TOO_SMALL
;
427 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
428 CopyMem (InfoName
, VariableInfo
->Name
, NameSize
);
429 *InfoSize
= StatisticsInfoSize
;
436 Communication service SMI Handler entry.
438 This SMI handler provides services for the variable wrapper driver.
440 Caution: This function may receive untrusted input.
441 This variable data and communicate buffer are external input, so this function will do basic validation.
442 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
443 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
444 SmmVariableGetStatistics() should also do validation based on its own knowledge.
446 @param[in] DispatchHandle The unique handle assigned to this handler by SmiHandlerRegister().
447 @param[in] RegisterContext Points to an optional handler context which was specified when the
448 handler was registered.
449 @param[in, out] CommBuffer A pointer to a collection of data in memory that will
450 be conveyed from a non-SMM environment into an SMM environment.
451 @param[in, out] CommBufferSize The size of the CommBuffer.
453 @retval EFI_SUCCESS The interrupt was handled and quiesced. No other handlers
454 should still be called.
455 @retval EFI_WARN_INTERRUPT_SOURCE_QUIESCED The interrupt has been quiesced but other handlers should
457 @retval EFI_WARN_INTERRUPT_SOURCE_PENDING The interrupt is still pending and other handlers should still
459 @retval EFI_INTERRUPT_PENDING The interrupt could not be quiesced.
464 IN EFI_HANDLE DispatchHandle
,
465 IN CONST VOID
*RegisterContext
,
466 IN OUT VOID
*CommBuffer
,
467 IN OUT UINTN
*CommBufferSize
471 SMM_VARIABLE_COMMUNICATE_HEADER
*SmmVariableFunctionHeader
;
472 SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*SmmVariableHeader
;
473 SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*GetNextVariableName
;
474 SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*QueryVariableInfo
;
475 SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE
*GetPayloadSize
;
476 VARIABLE_INFO_ENTRY
*VariableInfo
;
477 SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE
*VariableToLock
;
478 SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*CommVariableProperty
;
480 UINTN NameBufferSize
;
481 UINTN CommBufferPayloadSize
;
482 UINTN TempCommBufferSize
;
485 // If input is invalid, stop processing this SMI
487 if (CommBuffer
== NULL
|| CommBufferSize
== NULL
) {
491 TempCommBufferSize
= *CommBufferSize
;
493 if (TempCommBufferSize
< SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
) {
494 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer size invalid!\n"));
497 CommBufferPayloadSize
= TempCommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
498 if (CommBufferPayloadSize
> mVariableBufferPayloadSize
) {
499 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer payload size invalid!\n"));
503 if (!SmmIsBufferOutsideSmmValid ((UINTN
)CommBuffer
, TempCommBufferSize
)) {
504 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer in SMRAM or overflow!\n"));
508 SmmVariableFunctionHeader
= (SMM_VARIABLE_COMMUNICATE_HEADER
*)CommBuffer
;
509 switch (SmmVariableFunctionHeader
->Function
) {
510 case SMM_VARIABLE_FUNCTION_GET_VARIABLE
:
511 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) {
512 DEBUG ((EFI_D_ERROR
, "GetVariable: SMM communication buffer size invalid!\n"));
516 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
518 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
519 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) mVariableBufferPayload
;
520 if (((UINTN
)(~0) - SmmVariableHeader
->DataSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) ||
521 ((UINTN
)(~0) - SmmVariableHeader
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
) + SmmVariableHeader
->DataSize
)) {
523 // Prevent InfoSize overflow happen
525 Status
= EFI_ACCESS_DENIED
;
528 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
529 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
532 // SMRAM range check already covered before
534 if (InfoSize
> CommBufferPayloadSize
) {
535 DEBUG ((EFI_D_ERROR
, "GetVariable: Data size exceed communication buffer size limit!\n"));
536 Status
= EFI_ACCESS_DENIED
;
541 // The MemoryLoadFence() call here is to ensure the previous range/content
542 // checks for the CommBuffer have been completed before the subsequent
543 // consumption of the CommBuffer content.
546 if (SmmVariableHeader
->NameSize
< sizeof (CHAR16
) || SmmVariableHeader
->Name
[SmmVariableHeader
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
548 // Make sure VariableName is A Null-terminated string.
550 Status
= EFI_ACCESS_DENIED
;
554 Status
= VariableServiceGetVariable (
555 SmmVariableHeader
->Name
,
556 &SmmVariableHeader
->Guid
,
557 &SmmVariableHeader
->Attributes
,
558 &SmmVariableHeader
->DataSize
,
559 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
561 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
564 case SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME
:
565 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
)) {
566 DEBUG ((EFI_D_ERROR
, "GetNextVariableName: SMM communication buffer size invalid!\n"));
570 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
572 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
573 GetNextVariableName
= (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*) mVariableBufferPayload
;
574 if ((UINTN
)(~0) - GetNextVariableName
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
)) {
576 // Prevent InfoSize overflow happen
578 Status
= EFI_ACCESS_DENIED
;
581 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
) + GetNextVariableName
->NameSize
;
584 // SMRAM range check already covered before
586 if (InfoSize
> CommBufferPayloadSize
) {
587 DEBUG ((EFI_D_ERROR
, "GetNextVariableName: Data size exceed communication buffer size limit!\n"));
588 Status
= EFI_ACCESS_DENIED
;
592 NameBufferSize
= CommBufferPayloadSize
- OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
);
593 if (NameBufferSize
< sizeof (CHAR16
) || GetNextVariableName
->Name
[NameBufferSize
/sizeof (CHAR16
) - 1] != L
'\0') {
595 // Make sure input VariableName is A Null-terminated string.
597 Status
= EFI_ACCESS_DENIED
;
601 Status
= VariableServiceGetNextVariableName (
602 &GetNextVariableName
->NameSize
,
603 GetNextVariableName
->Name
,
604 &GetNextVariableName
->Guid
606 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
609 case SMM_VARIABLE_FUNCTION_SET_VARIABLE
:
610 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) {
611 DEBUG ((EFI_D_ERROR
, "SetVariable: SMM communication buffer size invalid!\n"));
615 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
617 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
618 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) mVariableBufferPayload
;
619 if (((UINTN
)(~0) - SmmVariableHeader
->DataSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) ||
620 ((UINTN
)(~0) - SmmVariableHeader
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
) + SmmVariableHeader
->DataSize
)) {
622 // Prevent InfoSize overflow happen
624 Status
= EFI_ACCESS_DENIED
;
627 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
628 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
631 // SMRAM range check already covered before
632 // Data buffer should not contain SMM range
634 if (InfoSize
> CommBufferPayloadSize
) {
635 DEBUG ((EFI_D_ERROR
, "SetVariable: Data size exceed communication buffer size limit!\n"));
636 Status
= EFI_ACCESS_DENIED
;
641 // The MemoryLoadFence() call here is to ensure the previous range/content
642 // checks for the CommBuffer have been completed before the subsequent
643 // consumption of the CommBuffer content.
646 if (SmmVariableHeader
->NameSize
< sizeof (CHAR16
) || SmmVariableHeader
->Name
[SmmVariableHeader
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
648 // Make sure VariableName is A Null-terminated string.
650 Status
= EFI_ACCESS_DENIED
;
654 Status
= VariableServiceSetVariable (
655 SmmVariableHeader
->Name
,
656 &SmmVariableHeader
->Guid
,
657 SmmVariableHeader
->Attributes
,
658 SmmVariableHeader
->DataSize
,
659 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
663 case SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO
:
664 if (CommBufferPayloadSize
< sizeof (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
)) {
665 DEBUG ((EFI_D_ERROR
, "QueryVariableInfo: SMM communication buffer size invalid!\n"));
668 QueryVariableInfo
= (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*) SmmVariableFunctionHeader
->Data
;
670 Status
= VariableServiceQueryVariableInfo (
671 QueryVariableInfo
->Attributes
,
672 &QueryVariableInfo
->MaximumVariableStorageSize
,
673 &QueryVariableInfo
->RemainingVariableStorageSize
,
674 &QueryVariableInfo
->MaximumVariableSize
678 case SMM_VARIABLE_FUNCTION_GET_PAYLOAD_SIZE
:
679 if (CommBufferPayloadSize
< sizeof (SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE
)) {
680 DEBUG ((EFI_D_ERROR
, "GetPayloadSize: SMM communication buffer size invalid!\n"));
683 GetPayloadSize
= (SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE
*) SmmVariableFunctionHeader
->Data
;
684 GetPayloadSize
->VariablePayloadSize
= mVariableBufferPayloadSize
;
685 Status
= EFI_SUCCESS
;
688 case SMM_VARIABLE_FUNCTION_READY_TO_BOOT
:
690 Status
= EFI_UNSUPPORTED
;
694 MorLockInitAtEndOfDxe ();
696 VarCheckLibInitializeAtEndOfDxe (NULL
);
698 // The initialization for variable quota.
700 InitializeVariableQuota ();
703 Status
= EFI_SUCCESS
;
706 case SMM_VARIABLE_FUNCTION_EXIT_BOOT_SERVICE
:
708 Status
= EFI_SUCCESS
;
711 case SMM_VARIABLE_FUNCTION_GET_STATISTICS
:
712 VariableInfo
= (VARIABLE_INFO_ENTRY
*) SmmVariableFunctionHeader
->Data
;
713 InfoSize
= TempCommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
716 // Do not need to check SmmVariableFunctionHeader->Data in SMRAM here.
717 // It is covered by previous CommBuffer check
721 // Do not need to check CommBufferSize buffer as it should point to SMRAM
722 // that was used by SMM core to cache CommSize from SmmCommunication protocol.
725 Status
= SmmVariableGetStatistics (VariableInfo
, &InfoSize
);
726 *CommBufferSize
= InfoSize
+ SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
729 case SMM_VARIABLE_FUNCTION_LOCK_VARIABLE
:
731 Status
= EFI_ACCESS_DENIED
;
733 VariableToLock
= (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE
*) SmmVariableFunctionHeader
->Data
;
734 Status
= VariableLockRequestToLock (
736 VariableToLock
->Name
,
737 &VariableToLock
->Guid
741 case SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_SET
:
743 Status
= EFI_ACCESS_DENIED
;
745 CommVariableProperty
= (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*) SmmVariableFunctionHeader
->Data
;
746 Status
= VarCheckVariablePropertySet (
747 CommVariableProperty
->Name
,
748 &CommVariableProperty
->Guid
,
749 &CommVariableProperty
->VariableProperty
753 case SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_GET
:
754 if (CommBufferPayloadSize
< OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
)) {
755 DEBUG ((EFI_D_ERROR
, "VarCheckVariablePropertyGet: SMM communication buffer size invalid!\n"));
759 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
761 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
762 CommVariableProperty
= (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*) mVariableBufferPayload
;
763 if ((UINTN
) (~0) - CommVariableProperty
->NameSize
< OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
)) {
765 // Prevent InfoSize overflow happen
767 Status
= EFI_ACCESS_DENIED
;
770 InfoSize
= OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
) + CommVariableProperty
->NameSize
;
773 // SMRAM range check already covered before
775 if (InfoSize
> CommBufferPayloadSize
) {
776 DEBUG ((EFI_D_ERROR
, "VarCheckVariablePropertyGet: Data size exceed communication buffer size limit!\n"));
777 Status
= EFI_ACCESS_DENIED
;
782 // The MemoryLoadFence() call here is to ensure the previous range/content
783 // checks for the CommBuffer have been completed before the subsequent
784 // consumption of the CommBuffer content.
787 if (CommVariableProperty
->NameSize
< sizeof (CHAR16
) || CommVariableProperty
->Name
[CommVariableProperty
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
789 // Make sure VariableName is A Null-terminated string.
791 Status
= EFI_ACCESS_DENIED
;
795 Status
= VarCheckVariablePropertyGet (
796 CommVariableProperty
->Name
,
797 &CommVariableProperty
->Guid
,
798 &CommVariableProperty
->VariableProperty
800 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
804 Status
= EFI_UNSUPPORTED
;
809 SmmVariableFunctionHeader
->ReturnStatus
= Status
;
815 SMM END_OF_DXE protocol notification event handler.
817 @param Protocol Points to the protocol's unique identifier
818 @param Interface Points to the interface instance
819 @param Handle The handle on which the interface was installed
821 @retval EFI_SUCCESS SmmEndOfDxeCallback runs successfully
826 SmmEndOfDxeCallback (
827 IN CONST EFI_GUID
*Protocol
,
832 DEBUG ((EFI_D_INFO
, "[Variable]SMM_END_OF_DXE is signaled\n"));
833 MorLockInitAtEndOfDxe ();
835 VarCheckLibInitializeAtEndOfDxe (NULL
);
837 // The initialization for variable quota.
839 InitializeVariableQuota ();
840 if (PcdGetBool (PcdReclaimVariableSpaceAtEndOfDxe
)) {
848 SMM Fault Tolerant Write protocol notification event handler.
850 Non-Volatile variable write may needs FTW protocol to reclaim when
853 @param Protocol Points to the protocol's unique identifier
854 @param Interface Points to the interface instance
855 @param Handle The handle on which the interface was installed
857 @retval EFI_SUCCESS SmmEventCallback runs successfully
858 @retval EFI_NOT_FOUND The Fvb protocol for variable is not found.
863 SmmFtwNotificationEvent (
864 IN CONST EFI_GUID
*Protocol
,
870 EFI_SMM_FIRMWARE_VOLUME_BLOCK_PROTOCOL
*FvbProtocol
;
871 EFI_SMM_FAULT_TOLERANT_WRITE_PROTOCOL
*FtwProtocol
;
872 EFI_PHYSICAL_ADDRESS NvStorageVariableBase
;
873 UINTN FtwMaxBlockSize
;
875 if (mVariableModuleGlobal
->FvbInstance
!= NULL
) {
880 // Ensure SMM FTW protocol is installed.
882 Status
= GetFtwProtocol ((VOID
**)&FtwProtocol
);
883 if (EFI_ERROR (Status
)) {
887 Status
= FtwProtocol
->GetMaxBlockSize (FtwProtocol
, &FtwMaxBlockSize
);
888 if (!EFI_ERROR (Status
)) {
889 ASSERT (PcdGet32 (PcdFlashNvStorageVariableSize
) <= FtwMaxBlockSize
);
893 // Find the proper FVB protocol for variable.
895 NvStorageVariableBase
= (EFI_PHYSICAL_ADDRESS
) PcdGet64 (PcdFlashNvStorageVariableBase64
);
896 if (NvStorageVariableBase
== 0) {
897 NvStorageVariableBase
= (EFI_PHYSICAL_ADDRESS
) PcdGet32 (PcdFlashNvStorageVariableBase
);
899 Status
= GetFvbInfoByAddress (NvStorageVariableBase
, NULL
, &FvbProtocol
);
900 if (EFI_ERROR (Status
)) {
901 return EFI_NOT_FOUND
;
904 mVariableModuleGlobal
->FvbInstance
= FvbProtocol
;
906 Status
= VariableWriteServiceInitialize ();
907 if (EFI_ERROR (Status
)) {
908 DEBUG ((DEBUG_ERROR
, "Variable write service initialization failed. Status = %r\n", Status
));
912 // Notify the variable wrapper driver the variable write service is ready
914 Status
= gBS
->InstallProtocolInterface (
916 &gSmmVariableWriteGuid
,
917 EFI_NATIVE_INTERFACE
,
920 ASSERT_EFI_ERROR (Status
);
927 Variable Driver main entry point. The Variable driver places the 4 EFI
928 runtime services in the EFI System Table and installs arch protocols
929 for variable read and write services being available. It also registers
930 a notification function for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
932 @param[in] ImageHandle The firmware allocated handle for the EFI image.
933 @param[in] SystemTable A pointer to the EFI System Table.
935 @retval EFI_SUCCESS Variable service successfully initialized.
940 VariableServiceInitialize (
941 IN EFI_HANDLE ImageHandle
,
942 IN EFI_SYSTEM_TABLE
*SystemTable
946 EFI_HANDLE VariableHandle
;
947 VOID
*SmmFtwRegistration
;
948 VOID
*SmmEndOfDxeRegistration
;
951 // Variable initialize.
953 Status
= VariableCommonInitialize ();
954 ASSERT_EFI_ERROR (Status
);
957 // Install the Smm Variable Protocol on a new handle.
959 VariableHandle
= NULL
;
960 Status
= gSmst
->SmmInstallProtocolInterface (
962 &gEfiSmmVariableProtocolGuid
,
963 EFI_NATIVE_INTERFACE
,
966 ASSERT_EFI_ERROR (Status
);
968 Status
= gSmst
->SmmInstallProtocolInterface (
970 &gEdkiiSmmVarCheckProtocolGuid
,
971 EFI_NATIVE_INTERFACE
,
974 ASSERT_EFI_ERROR (Status
);
976 mVariableBufferPayloadSize
= GetMaxVariableSize () +
977 OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
) - GetVariableHeaderSize ();
979 Status
= gSmst
->SmmAllocatePool (
980 EfiRuntimeServicesData
,
981 mVariableBufferPayloadSize
,
982 (VOID
**)&mVariableBufferPayload
984 ASSERT_EFI_ERROR (Status
);
987 /// Register SMM variable SMI handler
989 VariableHandle
= NULL
;
990 Status
= gSmst
->SmiHandlerRegister (SmmVariableHandler
, &gEfiSmmVariableProtocolGuid
, &VariableHandle
);
991 ASSERT_EFI_ERROR (Status
);
994 // Notify the variable wrapper driver the variable service is ready
996 Status
= SystemTable
->BootServices
->InstallProtocolInterface (
998 &gEfiSmmVariableProtocolGuid
,
999 EFI_NATIVE_INTERFACE
,
1002 ASSERT_EFI_ERROR (Status
);
1005 // Register EFI_SMM_END_OF_DXE_PROTOCOL_GUID notify function.
1007 Status
= gSmst
->SmmRegisterProtocolNotify (
1008 &gEfiSmmEndOfDxeProtocolGuid
,
1009 SmmEndOfDxeCallback
,
1010 &SmmEndOfDxeRegistration
1012 ASSERT_EFI_ERROR (Status
);
1015 // Register FtwNotificationEvent () notify function.
1017 Status
= gSmst
->SmmRegisterProtocolNotify (
1018 &gEfiSmmFaultTolerantWriteProtocolGuid
,
1019 SmmFtwNotificationEvent
,
1022 ASSERT_EFI_ERROR (Status
);
1024 SmmFtwNotificationEvent (NULL
, NULL
, NULL
);