2 The sample implementation for SMM variable protocol. And this driver
3 implements an SMI handler to communicate with the DXE runtime driver
4 to provide variable services.
6 Caution: This module requires additional review when modified.
7 This driver will have external input - variable data and communicate buffer in SMM mode.
8 This external input must be validated carefully to avoid security issue like
9 buffer overflow, integer overflow.
11 SmmVariableHandler() will receive untrusted input and do basic validation.
13 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
14 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
15 SmmVariableGetStatistics() should also do validation based on its own knowledge.
17 Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
18 This program and the accompanying materials
19 are licensed and made available under the terms and conditions of the BSD License
20 which accompanies this distribution. The full text of the license may be found at
21 http://opensource.org/licenses/bsd-license.php
23 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
24 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
28 #include <Protocol/SmmVariable.h>
29 #include <Protocol/SmmFirmwareVolumeBlock.h>
30 #include <Protocol/SmmFaultTolerantWrite.h>
31 #include <Protocol/SmmEndOfDxe.h>
32 #include <Protocol/SmmVarCheck.h>
34 #include <Library/SmmServicesTableLib.h>
35 #include <Library/SmmMemLib.h>
37 #include <Guid/AuthenticatedVariableFormat.h>
38 #include <Guid/SmmVariableCommon.h>
41 extern VARIABLE_INFO_ENTRY
*gVariableInfo
;
42 EFI_HANDLE mSmmVariableHandle
= NULL
;
43 EFI_HANDLE mVariableHandle
= NULL
;
44 BOOLEAN mAtRuntime
= FALSE
;
45 EFI_GUID mZeroGuid
= {0, 0, 0, {0, 0, 0, 0, 0, 0, 0, 0}};
46 UINT8
*mVariableBufferPayload
= NULL
;
47 UINTN mVariableBufferPayloadSize
;
48 extern BOOLEAN mEndOfDxe
;
49 extern BOOLEAN mEnableLocking
;
52 SecureBoot Hook for SetVariable.
54 @param[in] VariableName Name of Variable to be found.
55 @param[in] VendorGuid Variable vendor GUID.
61 IN CHAR16
*VariableName
,
62 IN EFI_GUID
*VendorGuid
70 This code sets variable in storage blocks (Volatile or Non-Volatile).
72 @param VariableName Name of Variable to be found.
73 @param VendorGuid Variable vendor GUID.
74 @param Attributes Attribute value of the variable found
75 @param DataSize Size of Data found. If size is less than the
76 data, this value contains the required size.
77 @param Data Data pointer.
79 @return EFI_INVALID_PARAMETER Invalid parameter.
80 @return EFI_SUCCESS Set successfully.
81 @return EFI_OUT_OF_RESOURCES Resource not enough to set variable.
82 @return EFI_NOT_FOUND Not found.
83 @return EFI_WRITE_PROTECTED Variable is read-only.
88 SmmVariableSetVariable (
89 IN CHAR16
*VariableName
,
90 IN EFI_GUID
*VendorGuid
,
99 // Disable write protection when the calling SetVariable() through EFI_SMM_VARIABLE_PROTOCOL.
101 mEnableLocking
= FALSE
;
102 Status
= VariableServiceSetVariable (
109 mEnableLocking
= TRUE
;
113 EFI_SMM_VARIABLE_PROTOCOL gSmmVariable
= {
114 VariableServiceGetVariable
,
115 VariableServiceGetNextVariableName
,
116 SmmVariableSetVariable
,
117 VariableServiceQueryVariableInfo
120 EDKII_SMM_VAR_CHECK_PROTOCOL mSmmVarCheck
= { VarCheckRegisterSetVariableCheckHandler
,
121 VarCheckVariablePropertySet
,
122 VarCheckVariablePropertyGet
};
125 Return TRUE if ExitBootServices () has been called.
127 @retval TRUE If ExitBootServices () has been called.
138 Initializes a basic mutual exclusion lock.
140 This function initializes a basic mutual exclusion lock to the released state
141 and returns the lock. Each lock provides mutual exclusion access at its task
142 priority level. Since there is no preemption or multiprocessor support in EFI,
143 acquiring the lock only consists of raising to the locks TPL.
144 If Lock is NULL, then ASSERT().
145 If Priority is not a valid TPL value, then ASSERT().
147 @param Lock A pointer to the lock data structure to initialize.
148 @param Priority EFI TPL is associated with the lock.
155 IN OUT EFI_LOCK
*Lock
,
163 Acquires lock only at boot time. Simply returns at runtime.
165 This is a temperary function that will be removed when
166 EfiAcquireLock() in UefiLib can handle the call in UEFI
167 Runtimer driver in RT phase.
168 It calls EfiAcquireLock() at boot time, and simply returns
171 @param Lock A pointer to the lock to acquire.
175 AcquireLockOnlyAtBootTime (
184 Releases lock only at boot time. Simply returns at runtime.
186 This is a temperary function which will be removed when
187 EfiReleaseLock() in UefiLib can handle the call in UEFI
188 Runtimer driver in RT phase.
189 It calls EfiReleaseLock() at boot time and simply returns
192 @param Lock A pointer to the lock to release.
196 ReleaseLockOnlyAtBootTime (
204 Retrive the SMM Fault Tolerent Write protocol interface.
206 @param[out] FtwProtocol The interface of SMM Ftw protocol
208 @retval EFI_SUCCESS The SMM FTW protocol instance was found and returned in FtwProtocol.
209 @retval EFI_NOT_FOUND The SMM FTW protocol instance was not found.
210 @retval EFI_INVALID_PARAMETER SarProtocol is NULL.
215 OUT VOID
**FtwProtocol
221 // Locate Smm Fault Tolerent Write protocol
223 Status
= gSmst
->SmmLocateProtocol (
224 &gEfiSmmFaultTolerantWriteProtocolGuid
,
233 Retrive the SMM FVB protocol interface by HANDLE.
235 @param[in] FvBlockHandle The handle of SMM FVB protocol that provides services for
236 reading, writing, and erasing the target block.
237 @param[out] FvBlock The interface of SMM FVB protocol
239 @retval EFI_SUCCESS The interface information for the specified protocol was returned.
240 @retval EFI_UNSUPPORTED The device does not support the SMM FVB protocol.
241 @retval EFI_INVALID_PARAMETER FvBlockHandle is not a valid EFI_HANDLE or FvBlock is NULL.
246 IN EFI_HANDLE FvBlockHandle
,
247 OUT EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL
**FvBlock
251 // To get the SMM FVB protocol interface on the handle
253 return gSmst
->SmmHandleProtocol (
255 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
262 Function returns an array of handles that support the SMM FVB protocol
263 in a buffer allocated from pool.
265 @param[out] NumberHandles The number of handles returned in Buffer.
266 @param[out] Buffer A pointer to the buffer to return the requested
267 array of handles that support SMM FVB protocol.
269 @retval EFI_SUCCESS The array of handles was returned in Buffer, and the number of
270 handles in Buffer was returned in NumberHandles.
271 @retval EFI_NOT_FOUND No SMM FVB handle was found.
272 @retval EFI_OUT_OF_RESOURCES There is not enough pool memory to store the matching results.
273 @retval EFI_INVALID_PARAMETER NumberHandles is NULL or Buffer is NULL.
277 GetFvbCountAndBuffer (
278 OUT UINTN
*NumberHandles
,
279 OUT EFI_HANDLE
**Buffer
285 if ((NumberHandles
== NULL
) || (Buffer
== NULL
)) {
286 return EFI_INVALID_PARAMETER
;
292 Status
= gSmst
->SmmLocateHandle (
294 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
299 if (EFI_ERROR(Status
) && Status
!= EFI_BUFFER_TOO_SMALL
) {
300 return EFI_NOT_FOUND
;
303 *Buffer
= AllocatePool (BufferSize
);
304 if (*Buffer
== NULL
) {
305 return EFI_OUT_OF_RESOURCES
;
308 Status
= gSmst
->SmmLocateHandle (
310 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
316 *NumberHandles
= BufferSize
/ sizeof(EFI_HANDLE
);
317 if (EFI_ERROR(Status
)) {
328 Get the variable statistics information from the information buffer pointed by gVariableInfo.
330 Caution: This function may be invoked at SMM runtime.
331 InfoEntry and InfoSize are external input. Care must be taken to make sure not security issue at runtime.
333 @param[in, out] InfoEntry A pointer to the buffer of variable information entry.
334 On input, point to the variable information returned last time. if
335 InfoEntry->VendorGuid is zero, return the first information.
336 On output, point to the next variable information.
337 @param[in, out] InfoSize On input, the size of the variable information buffer.
338 On output, the returned variable information size.
340 @retval EFI_SUCCESS The variable information is found and returned successfully.
341 @retval EFI_UNSUPPORTED No variable inoformation exists in variable driver. The
342 PcdVariableCollectStatistics should be set TRUE to support it.
343 @retval EFI_BUFFER_TOO_SMALL The buffer is too small to hold the next variable information.
344 @retval EFI_INVALID_PARAMETER Input parameter is invalid.
348 SmmVariableGetStatistics (
349 IN OUT VARIABLE_INFO_ENTRY
*InfoEntry
,
350 IN OUT UINTN
*InfoSize
353 VARIABLE_INFO_ENTRY
*VariableInfo
;
355 UINTN StatisticsInfoSize
;
359 if (InfoEntry
== NULL
) {
360 return EFI_INVALID_PARAMETER
;
363 VariableInfo
= gVariableInfo
;
364 if (VariableInfo
== NULL
) {
365 return EFI_UNSUPPORTED
;
368 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + StrSize (VariableInfo
->Name
);
369 if (*InfoSize
< StatisticsInfoSize
) {
370 *InfoSize
= StatisticsInfoSize
;
371 return EFI_BUFFER_TOO_SMALL
;
373 InfoName
= (CHAR16
*)(InfoEntry
+ 1);
375 CopyGuid (&VendorGuid
, &InfoEntry
->VendorGuid
);
377 if (CompareGuid (&VendorGuid
, &mZeroGuid
)) {
379 // Return the first variable info
381 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
382 CopyMem (InfoName
, VariableInfo
->Name
, StrSize (VariableInfo
->Name
));
383 *InfoSize
= StatisticsInfoSize
;
388 // Get the next variable info
390 while (VariableInfo
!= NULL
) {
391 if (CompareGuid (&VariableInfo
->VendorGuid
, &VendorGuid
)) {
392 NameLength
= StrSize (VariableInfo
->Name
);
393 if (NameLength
== StrSize (InfoName
)) {
394 if (CompareMem (VariableInfo
->Name
, InfoName
, NameLength
) == 0) {
396 // Find the match one
398 VariableInfo
= VariableInfo
->Next
;
403 VariableInfo
= VariableInfo
->Next
;
406 if (VariableInfo
== NULL
) {
412 // Output the new variable info
414 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + StrSize (VariableInfo
->Name
);
415 if (*InfoSize
< StatisticsInfoSize
) {
416 *InfoSize
= StatisticsInfoSize
;
417 return EFI_BUFFER_TOO_SMALL
;
420 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
421 CopyMem (InfoName
, VariableInfo
->Name
, StrSize (VariableInfo
->Name
));
422 *InfoSize
= StatisticsInfoSize
;
429 Communication service SMI Handler entry.
431 This SMI handler provides services for the variable wrapper driver.
433 Caution: This function may receive untrusted input.
434 This variable data and communicate buffer are external input, so this function will do basic validation.
435 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
436 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
437 SmmVariableGetStatistics() should also do validation based on its own knowledge.
439 @param[in] DispatchHandle The unique handle assigned to this handler by SmiHandlerRegister().
440 @param[in] RegisterContext Points to an optional handler context which was specified when the
441 handler was registered.
442 @param[in, out] CommBuffer A pointer to a collection of data in memory that will
443 be conveyed from a non-SMM environment into an SMM environment.
444 @param[in, out] CommBufferSize The size of the CommBuffer.
446 @retval EFI_SUCCESS The interrupt was handled and quiesced. No other handlers
447 should still be called.
448 @retval EFI_WARN_INTERRUPT_SOURCE_QUIESCED The interrupt has been quiesced but other handlers should
450 @retval EFI_WARN_INTERRUPT_SOURCE_PENDING The interrupt is still pending and other handlers should still
452 @retval EFI_INTERRUPT_PENDING The interrupt could not be quiesced.
458 IN EFI_HANDLE DispatchHandle
,
459 IN CONST VOID
*RegisterContext
,
460 IN OUT VOID
*CommBuffer
,
461 IN OUT UINTN
*CommBufferSize
465 SMM_VARIABLE_COMMUNICATE_HEADER
*SmmVariableFunctionHeader
;
466 SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*SmmVariableHeader
;
467 SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*GetNextVariableName
;
468 SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*QueryVariableInfo
;
469 VARIABLE_INFO_ENTRY
*VariableInfo
;
470 SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE
*VariableToLock
;
471 SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*CommVariableProperty
;
473 UINTN NameBufferSize
;
474 UINTN CommBufferPayloadSize
;
475 UINTN TempCommBufferSize
;
478 // If input is invalid, stop processing this SMI
480 if (CommBuffer
== NULL
|| CommBufferSize
== NULL
) {
484 TempCommBufferSize
= *CommBufferSize
;
486 if (TempCommBufferSize
< SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
) {
487 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer size invalid!\n"));
490 CommBufferPayloadSize
= TempCommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
491 if (CommBufferPayloadSize
> mVariableBufferPayloadSize
) {
492 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer payload size invalid!\n"));
496 if (!SmmIsBufferOutsideSmmValid ((UINTN
)CommBuffer
, TempCommBufferSize
)) {
497 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer in SMRAM or overflow!\n"));
501 SmmVariableFunctionHeader
= (SMM_VARIABLE_COMMUNICATE_HEADER
*)CommBuffer
;
503 switch (SmmVariableFunctionHeader
->Function
) {
504 case SMM_VARIABLE_FUNCTION_GET_VARIABLE
:
505 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) {
506 DEBUG ((EFI_D_ERROR
, "GetVariable: SMM communication buffer size invalid!\n"));
510 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
512 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
513 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) mVariableBufferPayload
;
514 if (((UINTN
)(~0) - SmmVariableHeader
->DataSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) ||
515 ((UINTN
)(~0) - SmmVariableHeader
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
) + SmmVariableHeader
->DataSize
)) {
517 // Prevent InfoSize overflow happen
519 Status
= EFI_ACCESS_DENIED
;
522 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
523 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
526 // SMRAM range check already covered before
528 if (InfoSize
> CommBufferPayloadSize
) {
529 DEBUG ((EFI_D_ERROR
, "GetVariable: Data size exceed communication buffer size limit!\n"));
530 Status
= EFI_ACCESS_DENIED
;
534 if (SmmVariableHeader
->NameSize
< sizeof (CHAR16
) || SmmVariableHeader
->Name
[SmmVariableHeader
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
536 // Make sure VariableName is A Null-terminated string.
538 Status
= EFI_ACCESS_DENIED
;
542 Status
= VariableServiceGetVariable (
543 SmmVariableHeader
->Name
,
544 &SmmVariableHeader
->Guid
,
545 &SmmVariableHeader
->Attributes
,
546 &SmmVariableHeader
->DataSize
,
547 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
549 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
552 case SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME
:
553 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
)) {
554 DEBUG ((EFI_D_ERROR
, "GetNextVariableName: SMM communication buffer size invalid!\n"));
558 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
560 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
561 GetNextVariableName
= (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*) mVariableBufferPayload
;
562 if ((UINTN
)(~0) - GetNextVariableName
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
)) {
564 // Prevent InfoSize overflow happen
566 Status
= EFI_ACCESS_DENIED
;
569 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
) + GetNextVariableName
->NameSize
;
572 // SMRAM range check already covered before
574 if (InfoSize
> CommBufferPayloadSize
) {
575 DEBUG ((EFI_D_ERROR
, "GetNextVariableName: Data size exceed communication buffer size limit!\n"));
576 Status
= EFI_ACCESS_DENIED
;
580 NameBufferSize
= CommBufferPayloadSize
- OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
);
581 if (NameBufferSize
< sizeof (CHAR16
) || GetNextVariableName
->Name
[NameBufferSize
/sizeof (CHAR16
) - 1] != L
'\0') {
583 // Make sure input VariableName is A Null-terminated string.
585 Status
= EFI_ACCESS_DENIED
;
589 Status
= VariableServiceGetNextVariableName (
590 &GetNextVariableName
->NameSize
,
591 GetNextVariableName
->Name
,
592 &GetNextVariableName
->Guid
594 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
597 case SMM_VARIABLE_FUNCTION_SET_VARIABLE
:
598 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) {
599 DEBUG ((EFI_D_ERROR
, "SetVariable: SMM communication buffer size invalid!\n"));
603 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
605 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
606 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) mVariableBufferPayload
;
607 if (((UINTN
)(~0) - SmmVariableHeader
->DataSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) ||
608 ((UINTN
)(~0) - SmmVariableHeader
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
) + SmmVariableHeader
->DataSize
)) {
610 // Prevent InfoSize overflow happen
612 Status
= EFI_ACCESS_DENIED
;
615 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
616 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
619 // SMRAM range check already covered before
620 // Data buffer should not contain SMM range
622 if (InfoSize
> CommBufferPayloadSize
) {
623 DEBUG ((EFI_D_ERROR
, "SetVariable: Data size exceed communication buffer size limit!\n"));
624 Status
= EFI_ACCESS_DENIED
;
628 if (SmmVariableHeader
->NameSize
< sizeof (CHAR16
) || SmmVariableHeader
->Name
[SmmVariableHeader
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
630 // Make sure VariableName is A Null-terminated string.
632 Status
= EFI_ACCESS_DENIED
;
636 Status
= VariableServiceSetVariable (
637 SmmVariableHeader
->Name
,
638 &SmmVariableHeader
->Guid
,
639 SmmVariableHeader
->Attributes
,
640 SmmVariableHeader
->DataSize
,
641 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
645 case SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO
:
646 if (CommBufferPayloadSize
< sizeof (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
)) {
647 DEBUG ((EFI_D_ERROR
, "QueryVariableInfo: SMM communication buffer size invalid!\n"));
650 QueryVariableInfo
= (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*) SmmVariableFunctionHeader
->Data
;
652 Status
= VariableServiceQueryVariableInfo (
653 QueryVariableInfo
->Attributes
,
654 &QueryVariableInfo
->MaximumVariableStorageSize
,
655 &QueryVariableInfo
->RemainingVariableStorageSize
,
656 &QueryVariableInfo
->MaximumVariableSize
660 case SMM_VARIABLE_FUNCTION_READY_TO_BOOT
:
663 // The initialization for variable quota.
665 InitializeVariableQuota ();
667 Status
= EFI_UNSUPPORTED
;
671 Status
= EFI_SUCCESS
;
674 case SMM_VARIABLE_FUNCTION_EXIT_BOOT_SERVICE
:
676 Status
= EFI_SUCCESS
;
679 case SMM_VARIABLE_FUNCTION_GET_STATISTICS
:
680 VariableInfo
= (VARIABLE_INFO_ENTRY
*) SmmVariableFunctionHeader
->Data
;
681 InfoSize
= TempCommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
684 // Do not need to check SmmVariableFunctionHeader->Data in SMRAM here.
685 // It is covered by previous CommBuffer check
688 if (!SmmIsBufferOutsideSmmValid ((EFI_PHYSICAL_ADDRESS
)(UINTN
)CommBufferSize
, sizeof(UINTN
))) {
689 DEBUG ((EFI_D_ERROR
, "GetStatistics: SMM communication buffer in SMRAM!\n"));
690 Status
= EFI_ACCESS_DENIED
;
694 Status
= SmmVariableGetStatistics (VariableInfo
, &InfoSize
);
695 *CommBufferSize
= InfoSize
+ SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
698 case SMM_VARIABLE_FUNCTION_LOCK_VARIABLE
:
700 Status
= EFI_ACCESS_DENIED
;
702 VariableToLock
= (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE
*) SmmVariableFunctionHeader
->Data
;
703 Status
= VariableLockRequestToLock (
705 VariableToLock
->Name
,
706 &VariableToLock
->Guid
710 case SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_SET
:
712 Status
= EFI_ACCESS_DENIED
;
714 CommVariableProperty
= (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*) SmmVariableFunctionHeader
->Data
;
715 Status
= VarCheckVariablePropertySet (
716 CommVariableProperty
->Name
,
717 &CommVariableProperty
->Guid
,
718 &CommVariableProperty
->VariableProperty
722 case SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_GET
:
723 if (CommBufferPayloadSize
< OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
)) {
724 DEBUG ((EFI_D_ERROR
, "VarCheckVariablePropertyGet: SMM communication buffer size invalid!\n"));
728 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
730 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
731 CommVariableProperty
= (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*) mVariableBufferPayload
;
732 if ((UINTN
) (~0) - CommVariableProperty
->NameSize
< OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
)) {
734 // Prevent InfoSize overflow happen
736 Status
= EFI_ACCESS_DENIED
;
739 InfoSize
= OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
) + CommVariableProperty
->NameSize
;
742 // SMRAM range check already covered before
744 if (InfoSize
> CommBufferPayloadSize
) {
745 DEBUG ((EFI_D_ERROR
, "VarCheckVariablePropertyGet: Data size exceed communication buffer size limit!\n"));
746 Status
= EFI_ACCESS_DENIED
;
750 if (CommVariableProperty
->NameSize
< sizeof (CHAR16
) || CommVariableProperty
->Name
[CommVariableProperty
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
752 // Make sure VariableName is A Null-terminated string.
754 Status
= EFI_ACCESS_DENIED
;
758 Status
= VarCheckVariablePropertyGet (
759 CommVariableProperty
->Name
,
760 &CommVariableProperty
->Guid
,
761 &CommVariableProperty
->VariableProperty
763 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
767 Status
= EFI_UNSUPPORTED
;
772 SmmVariableFunctionHeader
->ReturnStatus
= Status
;
777 SMM END_OF_DXE protocol notification event handler.
779 @param Protocol Points to the protocol's unique identifier
780 @param Interface Points to the interface instance
781 @param Handle The handle on which the interface was installed
783 @retval EFI_SUCCESS SmmEndOfDxeCallback runs successfully
788 SmmEndOfDxeCallback (
789 IN CONST EFI_GUID
*Protocol
,
794 DEBUG ((EFI_D_INFO
, "[Variable]END_OF_DXE is signaled\n"));
797 // The initialization for variable quota.
799 InitializeVariableQuota ();
800 if (PcdGetBool (PcdReclaimVariableSpaceAtEndOfDxe
)) {
807 SMM Fault Tolerant Write protocol notification event handler.
809 Non-Volatile variable write may needs FTW protocol to reclaim when
812 @param Protocol Points to the protocol's unique identifier
813 @param Interface Points to the interface instance
814 @param Handle The handle on which the interface was installed
816 @retval EFI_SUCCESS SmmEventCallback runs successfully
817 @retval EFI_NOT_FOUND The Fvb protocol for variable is not found.
822 SmmFtwNotificationEvent (
823 IN CONST EFI_GUID
*Protocol
,
829 EFI_SMM_FIRMWARE_VOLUME_BLOCK_PROTOCOL
*FvbProtocol
;
830 EFI_SMM_FAULT_TOLERANT_WRITE_PROTOCOL
*FtwProtocol
;
831 EFI_PHYSICAL_ADDRESS NvStorageVariableBase
;
832 UINTN FtwMaxBlockSize
;
834 if (mVariableModuleGlobal
->FvbInstance
!= NULL
) {
839 // Ensure SMM FTW protocol is installed.
841 Status
= GetFtwProtocol ((VOID
**)&FtwProtocol
);
842 if (EFI_ERROR (Status
)) {
846 Status
= FtwProtocol
->GetMaxBlockSize (FtwProtocol
, &FtwMaxBlockSize
);
847 if (!EFI_ERROR (Status
)) {
848 ASSERT (PcdGet32 (PcdFlashNvStorageVariableSize
) <= FtwMaxBlockSize
);
852 // Find the proper FVB protocol for variable.
854 NvStorageVariableBase
= (EFI_PHYSICAL_ADDRESS
) PcdGet64 (PcdFlashNvStorageVariableBase64
);
855 if (NvStorageVariableBase
== 0) {
856 NvStorageVariableBase
= (EFI_PHYSICAL_ADDRESS
) PcdGet32 (PcdFlashNvStorageVariableBase
);
858 Status
= GetFvbInfoByAddress (NvStorageVariableBase
, NULL
, &FvbProtocol
);
859 if (EFI_ERROR (Status
)) {
860 return EFI_NOT_FOUND
;
863 mVariableModuleGlobal
->FvbInstance
= FvbProtocol
;
865 Status
= VariableWriteServiceInitialize ();
866 if (EFI_ERROR (Status
)) {
867 DEBUG ((DEBUG_ERROR
, "Variable write service initialization failed. Status = %r\n", Status
));
871 // Notify the variable wrapper driver the variable write service is ready
873 Status
= gBS
->InstallProtocolInterface (
875 &gSmmVariableWriteGuid
,
876 EFI_NATIVE_INTERFACE
,
879 ASSERT_EFI_ERROR (Status
);
886 Variable Driver main entry point. The Variable driver places the 4 EFI
887 runtime services in the EFI System Table and installs arch protocols
888 for variable read and write services being available. It also registers
889 a notification function for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
891 @param[in] ImageHandle The firmware allocated handle for the EFI image.
892 @param[in] SystemTable A pointer to the EFI System Table.
894 @retval EFI_SUCCESS Variable service successfully initialized.
899 VariableServiceInitialize (
900 IN EFI_HANDLE ImageHandle
,
901 IN EFI_SYSTEM_TABLE
*SystemTable
905 EFI_HANDLE VariableHandle
;
906 VOID
*SmmFtwRegistration
;
907 VOID
*SmmEndOfDxeRegistration
;
910 // Variable initialize.
912 Status
= VariableCommonInitialize ();
913 ASSERT_EFI_ERROR (Status
);
916 // Install the Smm Variable Protocol on a new handle.
918 VariableHandle
= NULL
;
919 Status
= gSmst
->SmmInstallProtocolInterface (
921 &gEfiSmmVariableProtocolGuid
,
922 EFI_NATIVE_INTERFACE
,
925 ASSERT_EFI_ERROR (Status
);
927 Status
= gSmst
->SmmInstallProtocolInterface (
929 &gEdkiiSmmVarCheckProtocolGuid
,
930 EFI_NATIVE_INTERFACE
,
933 ASSERT_EFI_ERROR (Status
);
935 mVariableBufferPayloadSize
= MAX_NV_VARIABLE_SIZE
+
936 OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
) - sizeof (VARIABLE_HEADER
);
938 Status
= gSmst
->SmmAllocatePool (
939 EfiRuntimeServicesData
,
940 mVariableBufferPayloadSize
,
941 (VOID
**)&mVariableBufferPayload
943 ASSERT_EFI_ERROR (Status
);
946 /// Register SMM variable SMI handler
948 VariableHandle
= NULL
;
949 Status
= gSmst
->SmiHandlerRegister (SmmVariableHandler
, &gEfiSmmVariableProtocolGuid
, &VariableHandle
);
950 ASSERT_EFI_ERROR (Status
);
953 // Notify the variable wrapper driver the variable service is ready
955 Status
= SystemTable
->BootServices
->InstallProtocolInterface (
957 &gEfiSmmVariableProtocolGuid
,
958 EFI_NATIVE_INTERFACE
,
961 ASSERT_EFI_ERROR (Status
);
964 // Register EFI_SMM_END_OF_DXE_PROTOCOL_GUID notify function.
966 Status
= gSmst
->SmmRegisterProtocolNotify (
967 &gEfiSmmEndOfDxeProtocolGuid
,
969 &SmmEndOfDxeRegistration
971 ASSERT_EFI_ERROR (Status
);
974 // Register FtwNotificationEvent () notify function.
976 Status
= gSmst
->SmmRegisterProtocolNotify (
977 &gEfiSmmFaultTolerantWriteProtocolGuid
,
978 SmmFtwNotificationEvent
,
981 ASSERT_EFI_ERROR (Status
);
983 SmmFtwNotificationEvent (NULL
, NULL
, NULL
);