Fix the return value bug when updating public key database variable failure.
[mirror_edk2.git] / SecurityPkg / VariableAuthenticated / RuntimeDxe / VariableSmm.c
CommitLineData
0c18794e 1/** @file\r
2 The sample implementation for SMM variable protocol. And this driver \r
3 implements an SMI handler to communicate with the DXE runtime driver \r
4 to provide variable services.\r
5\r
dc204d5a
JY
6 Caution: This module requires additional review when modified.\r
7 This driver will have external input - variable data and communicate buffer in SMM mode.\r
8 This external input must be validated carefully to avoid security issue like\r
9 buffer overflow, integer overflow.\r
10\r
11 SmmVariableHandler() will receive untrusted input and do basic validation.\r
12\r
13 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(), \r
14 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(), \r
15 SmmVariableGetStatistics() should also do validation based on its own knowledge.\r
16\r
25da08c8 17Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>\r
0c18794e 18This program and the accompanying materials \r
19are licensed and made available under the terms and conditions of the BSD License \r
20which accompanies this distribution. The full text of the license may be found at \r
21http://opensource.org/licenses/bsd-license.php\r
22\r
23THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, \r
24WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
25\r
26**/\r
27\r
28#include <Protocol/SmmVariable.h>\r
29#include <Protocol/SmmFirmwareVolumeBlock.h>\r
30#include <Protocol/SmmFaultTolerantWrite.h>\r
25a4e71a 31#include <Protocol/SmmAccess2.h>\r
6ab9f441 32#include <Protocol/SmmEndOfDxe.h>\r
25a4e71a 33\r
0c18794e 34#include <Library/SmmServicesTableLib.h>\r
35\r
36#include <Guid/AuthenticatedVariableFormat.h>\r
37#include <Guid/SmmVariableCommon.h>\r
38#include "Variable.h"\r
39\r
25a4e71a 40EFI_SMRAM_DESCRIPTOR *mSmramRanges;\r
41UINTN mSmramRangeCount;\r
42\r
0c18794e 43extern VARIABLE_INFO_ENTRY *gVariableInfo;\r
44EFI_HANDLE mSmmVariableHandle = NULL;\r
45EFI_HANDLE mVariableHandle = NULL;\r
46BOOLEAN mAtRuntime = FALSE;\r
47EFI_GUID mZeroGuid = {0, 0, 0, {0, 0, 0, 0, 0, 0, 0, 0}};\r
5e5bb2a9
SZ
48UINT8 *mVariableBufferPayload = NULL;\r
49UINTN mVariableBufferPayloadSize;\r
6ab9f441
RN
50extern BOOLEAN mEndOfDxe;\r
51extern BOOLEAN mEnableLocking;\r
52\r
c1d93242
JY
53/**\r
54 SecureBoot Hook for SetVariable.\r
55\r
56 @param[in] VariableName Name of Variable to be found.\r
57 @param[in] VendorGuid Variable vendor GUID.\r
58\r
59**/\r
60VOID\r
61EFIAPI\r
62SecureBootHook (\r
63 IN CHAR16 *VariableName,\r
64 IN EFI_GUID *VendorGuid\r
65 )\r
66{\r
67 return ;\r
68}\r
69\r
6ab9f441
RN
70/**\r
71\r
72 This code sets variable in storage blocks (Volatile or Non-Volatile).\r
73\r
74 @param VariableName Name of Variable to be found.\r
75 @param VendorGuid Variable vendor GUID.\r
76 @param Attributes Attribute value of the variable found\r
77 @param DataSize Size of Data found. If size is less than the\r
78 data, this value contains the required size.\r
79 @param Data Data pointer.\r
80\r
81 @return EFI_INVALID_PARAMETER Invalid parameter.\r
82 @return EFI_SUCCESS Set successfully.\r
83 @return EFI_OUT_OF_RESOURCES Resource not enough to set variable.\r
84 @return EFI_NOT_FOUND Not found.\r
85 @return EFI_WRITE_PROTECTED Variable is read-only.\r
86\r
87**/\r
88EFI_STATUS\r
89EFIAPI\r
90SmmVariableSetVariable (\r
91 IN CHAR16 *VariableName,\r
92 IN EFI_GUID *VendorGuid,\r
93 IN UINT32 Attributes,\r
94 IN UINTN DataSize,\r
95 IN VOID *Data\r
96 )\r
97{\r
98 EFI_STATUS Status;\r
99\r
100 //\r
101 // Disable write protection when the calling SetVariable() through EFI_SMM_VARIABLE_PROTOCOL.\r
102 //\r
103 mEnableLocking = FALSE;\r
104 Status = VariableServiceSetVariable (\r
105 VariableName,\r
106 VendorGuid,\r
107 Attributes,\r
108 DataSize,\r
109 Data\r
110 );\r
111 mEnableLocking = TRUE;\r
112 return Status;\r
113}\r
5e5bb2a9 114\r
0c18794e 115EFI_SMM_VARIABLE_PROTOCOL gSmmVariable = {\r
116 VariableServiceGetVariable,\r
117 VariableServiceGetNextVariableName,\r
6ab9f441 118 SmmVariableSetVariable,\r
0c18794e 119 VariableServiceQueryVariableInfo\r
120};\r
121\r
0c18794e 122/**\r
123 Return TRUE if ExitBootServices () has been called.\r
124 \r
125 @retval TRUE If ExitBootServices () has been called.\r
126**/\r
127BOOLEAN\r
128AtRuntime (\r
129 VOID\r
130 )\r
131{\r
132 return mAtRuntime;\r
133}\r
134\r
25a4e71a 135/**\r
136 This function check if the address is in SMRAM.\r
137\r
138 @param Buffer the buffer address to be checked.\r
139 @param Length the buffer length to be checked.\r
140\r
141 @retval TRUE this address is in SMRAM.\r
142 @retval FALSE this address is NOT in SMRAM.\r
143**/\r
144BOOLEAN\r
145InternalIsAddressInSmram (\r
146 IN EFI_PHYSICAL_ADDRESS Buffer,\r
147 IN UINT64 Length\r
148 )\r
149{\r
150 UINTN Index;\r
151\r
152 for (Index = 0; Index < mSmramRangeCount; Index ++) {\r
153 if (((Buffer >= mSmramRanges[Index].CpuStart) && (Buffer < mSmramRanges[Index].CpuStart + mSmramRanges[Index].PhysicalSize)) ||\r
154 ((mSmramRanges[Index].CpuStart >= Buffer) && (mSmramRanges[Index].CpuStart < Buffer + Length))) {\r
155 return TRUE;\r
156 }\r
157 }\r
158\r
159 return FALSE;\r
160}\r
161\r
9d00d20e
SZ
162/**\r
163 This function check if the address refered by Buffer and Length is valid.\r
164\r
165 @param Buffer the buffer address to be checked.\r
166 @param Length the buffer length to be checked.\r
167\r
168 @retval TRUE this address is valid.\r
169 @retval FALSE this address is NOT valid.\r
170**/\r
171BOOLEAN\r
172InternalIsAddressValid (\r
173 IN UINTN Buffer,\r
174 IN UINTN Length\r
175 )\r
176{\r
177 if (Buffer > (MAX_ADDRESS - Length)) {\r
178 //\r
179 // Overflow happen\r
180 //\r
181 return FALSE;\r
182 }\r
183 if (InternalIsAddressInSmram ((EFI_PHYSICAL_ADDRESS)Buffer, (UINT64)Length)) {\r
184 return FALSE;\r
185 }\r
186 return TRUE;\r
187}\r
25a4e71a 188\r
0c18794e 189/**\r
190 Initializes a basic mutual exclusion lock.\r
191\r
192 This function initializes a basic mutual exclusion lock to the released state \r
193 and returns the lock. Each lock provides mutual exclusion access at its task \r
194 priority level. Since there is no preemption or multiprocessor support in EFI,\r
195 acquiring the lock only consists of raising to the locks TPL.\r
196 If Lock is NULL, then ASSERT().\r
197 If Priority is not a valid TPL value, then ASSERT().\r
198\r
199 @param Lock A pointer to the lock data structure to initialize.\r
200 @param Priority EFI TPL is associated with the lock.\r
201\r
202 @return The lock.\r
203\r
204**/\r
205EFI_LOCK *\r
206InitializeLock (\r
207 IN OUT EFI_LOCK *Lock,\r
208 IN EFI_TPL Priority\r
209 )\r
210{\r
211 return Lock;\r
212}\r
213\r
214/**\r
215 Acquires lock only at boot time. Simply returns at runtime.\r
216\r
217 This is a temperary function that will be removed when\r
218 EfiAcquireLock() in UefiLib can handle the call in UEFI\r
219 Runtimer driver in RT phase.\r
220 It calls EfiAcquireLock() at boot time, and simply returns\r
221 at runtime.\r
222\r
223 @param Lock A pointer to the lock to acquire.\r
224\r
225**/\r
226VOID\r
227AcquireLockOnlyAtBootTime (\r
228 IN EFI_LOCK *Lock\r
229 )\r
230{\r
231\r
232}\r
233\r
234\r
235/**\r
236 Releases lock only at boot time. Simply returns at runtime.\r
237\r
238 This is a temperary function which will be removed when\r
239 EfiReleaseLock() in UefiLib can handle the call in UEFI\r
240 Runtimer driver in RT phase.\r
241 It calls EfiReleaseLock() at boot time and simply returns\r
242 at runtime.\r
243\r
244 @param Lock A pointer to the lock to release.\r
245\r
246**/\r
247VOID\r
248ReleaseLockOnlyAtBootTime (\r
249 IN EFI_LOCK *Lock\r
250 )\r
251{\r
252\r
253}\r
254\r
255/**\r
256 Retrive the SMM Fault Tolerent Write protocol interface.\r
257\r
258 @param[out] FtwProtocol The interface of SMM Ftw protocol\r
259\r
260 @retval EFI_SUCCESS The SMM FTW protocol instance was found and returned in FtwProtocol.\r
261 @retval EFI_NOT_FOUND The SMM FTW protocol instance was not found.\r
262 @retval EFI_INVALID_PARAMETER SarProtocol is NULL.\r
263\r
264**/\r
265EFI_STATUS\r
266GetFtwProtocol (\r
267 OUT VOID **FtwProtocol\r
268 )\r
269{\r
270 EFI_STATUS Status;\r
271\r
272 //\r
273 // Locate Smm Fault Tolerent Write protocol\r
274 //\r
275 Status = gSmst->SmmLocateProtocol (\r
276 &gEfiSmmFaultTolerantWriteProtocolGuid, \r
277 NULL, \r
278 FtwProtocol\r
279 );\r
280 return Status;\r
281}\r
282\r
283\r
284/**\r
285 Retrive the SMM FVB protocol interface by HANDLE.\r
286\r
287 @param[in] FvBlockHandle The handle of SMM FVB protocol that provides services for\r
288 reading, writing, and erasing the target block.\r
289 @param[out] FvBlock The interface of SMM FVB protocol\r
290\r
291 @retval EFI_SUCCESS The interface information for the specified protocol was returned.\r
292 @retval EFI_UNSUPPORTED The device does not support the SMM FVB protocol.\r
293 @retval EFI_INVALID_PARAMETER FvBlockHandle is not a valid EFI_HANDLE or FvBlock is NULL.\r
294\r
295**/\r
296EFI_STATUS\r
297GetFvbByHandle (\r
298 IN EFI_HANDLE FvBlockHandle,\r
299 OUT EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL **FvBlock\r
300 )\r
301{\r
302 //\r
303 // To get the SMM FVB protocol interface on the handle\r
304 //\r
305 return gSmst->SmmHandleProtocol (\r
306 FvBlockHandle,\r
307 &gEfiSmmFirmwareVolumeBlockProtocolGuid,\r
308 (VOID **) FvBlock\r
309 );\r
310}\r
311\r
312\r
313/**\r
314 Function returns an array of handles that support the SMM FVB protocol\r
315 in a buffer allocated from pool. \r
316\r
317 @param[out] NumberHandles The number of handles returned in Buffer.\r
318 @param[out] Buffer A pointer to the buffer to return the requested\r
319 array of handles that support SMM FVB protocol.\r
320\r
321 @retval EFI_SUCCESS The array of handles was returned in Buffer, and the number of\r
322 handles in Buffer was returned in NumberHandles.\r
323 @retval EFI_NOT_FOUND No SMM FVB handle was found.\r
324 @retval EFI_OUT_OF_RESOURCES There is not enough pool memory to store the matching results.\r
325 @retval EFI_INVALID_PARAMETER NumberHandles is NULL or Buffer is NULL.\r
326\r
327**/\r
328EFI_STATUS\r
329GetFvbCountAndBuffer (\r
330 OUT UINTN *NumberHandles,\r
331 OUT EFI_HANDLE **Buffer\r
332 )\r
333{\r
334 EFI_STATUS Status;\r
335 UINTN BufferSize;\r
336\r
337 if ((NumberHandles == NULL) || (Buffer == NULL)) {\r
338 return EFI_INVALID_PARAMETER;\r
339 }\r
340\r
341 BufferSize = 0;\r
342 *NumberHandles = 0;\r
343 *Buffer = NULL;\r
344 Status = gSmst->SmmLocateHandle (\r
345 ByProtocol,\r
346 &gEfiSmmFirmwareVolumeBlockProtocolGuid,\r
347 NULL,\r
348 &BufferSize,\r
349 *Buffer\r
350 );\r
351 if (EFI_ERROR(Status) && Status != EFI_BUFFER_TOO_SMALL) {\r
352 return EFI_NOT_FOUND;\r
353 }\r
354\r
355 *Buffer = AllocatePool (BufferSize);\r
356 if (*Buffer == NULL) {\r
357 return EFI_OUT_OF_RESOURCES;\r
358 }\r
359\r
360 Status = gSmst->SmmLocateHandle (\r
361 ByProtocol,\r
362 &gEfiSmmFirmwareVolumeBlockProtocolGuid,\r
363 NULL,\r
364 &BufferSize,\r
365 *Buffer\r
366 );\r
367\r
368 *NumberHandles = BufferSize / sizeof(EFI_HANDLE);\r
369 if (EFI_ERROR(Status)) {\r
370 *NumberHandles = 0;\r
5e5bb2a9
SZ
371 FreePool (*Buffer);\r
372 *Buffer = NULL;\r
0c18794e 373 }\r
374\r
375 return Status;\r
376}\r
377\r
378\r
379/**\r
380 Get the variable statistics information from the information buffer pointed by gVariableInfo.\r
381\r
dc204d5a
JY
382 Caution: This function may be invoked at SMM runtime.\r
383 InfoEntry and InfoSize are external input. Care must be taken to make sure not security issue at runtime.\r
384\r
648f98d1 385 @param[in, out] InfoEntry A pointer to the buffer of variable information entry.\r
386 On input, point to the variable information returned last time. if \r
387 InfoEntry->VendorGuid is zero, return the first information.\r
388 On output, point to the next variable information.\r
389 @param[in, out] InfoSize On input, the size of the variable information buffer.\r
390 On output, the returned variable information size.\r
391\r
392 @retval EFI_SUCCESS The variable information is found and returned successfully.\r
393 @retval EFI_UNSUPPORTED No variable inoformation exists in variable driver. The \r
394 PcdVariableCollectStatistics should be set TRUE to support it.\r
395 @retval EFI_BUFFER_TOO_SMALL The buffer is too small to hold the next variable information.\r
396 @retval EFI_INVALID_PARAMETER Input parameter is invalid.\r
0c18794e 397\r
398**/\r
399EFI_STATUS\r
400SmmVariableGetStatistics (\r
401 IN OUT VARIABLE_INFO_ENTRY *InfoEntry,\r
402 IN OUT UINTN *InfoSize\r
403 )\r
404{\r
405 VARIABLE_INFO_ENTRY *VariableInfo;\r
406 UINTN NameLength;\r
407 UINTN StatisticsInfoSize;\r
408 CHAR16 *InfoName;\r
5e5bb2a9 409 EFI_GUID VendorGuid;\r
0c18794e 410 \r
648f98d1 411 if (InfoEntry == NULL) {\r
412 return EFI_INVALID_PARAMETER;\r
413 }\r
414 \r
0c18794e 415 VariableInfo = gVariableInfo; \r
416 if (VariableInfo == NULL) {\r
417 return EFI_UNSUPPORTED;\r
418 }\r
419\r
420 StatisticsInfoSize = sizeof (VARIABLE_INFO_ENTRY) + StrSize (VariableInfo->Name);\r
12373f2c 421 if (*InfoSize < StatisticsInfoSize) {\r
0c18794e 422 *InfoSize = StatisticsInfoSize;\r
423 return EFI_BUFFER_TOO_SMALL;\r
424 }\r
425 InfoName = (CHAR16 *)(InfoEntry + 1);\r
426\r
5e5bb2a9
SZ
427 CopyGuid (&VendorGuid, &InfoEntry->VendorGuid);\r
428\r
429 if (CompareGuid (&VendorGuid, &mZeroGuid)) {\r
0c18794e 430 //\r
431 // Return the first variable info\r
432 //\r
433 CopyMem (InfoEntry, VariableInfo, sizeof (VARIABLE_INFO_ENTRY));\r
434 CopyMem (InfoName, VariableInfo->Name, StrSize (VariableInfo->Name));\r
435 *InfoSize = StatisticsInfoSize;\r
436 return EFI_SUCCESS;\r
437 }\r
438\r
439 //\r
440 // Get the next variable info\r
441 //\r
442 while (VariableInfo != NULL) {\r
5e5bb2a9 443 if (CompareGuid (&VariableInfo->VendorGuid, &VendorGuid)) {\r
0c18794e 444 NameLength = StrSize (VariableInfo->Name);\r
445 if (NameLength == StrSize (InfoName)) {\r
446 if (CompareMem (VariableInfo->Name, InfoName, NameLength) == 0) {\r
447 //\r
448 // Find the match one\r
449 //\r
450 VariableInfo = VariableInfo->Next;\r
451 break;\r
452 }\r
453 }\r
454 }\r
455 VariableInfo = VariableInfo->Next;\r
456 };\r
457 \r
458 if (VariableInfo == NULL) {\r
459 *InfoSize = 0;\r
460 return EFI_SUCCESS;\r
461 }\r
462\r
463 //\r
464 // Output the new variable info\r
465 //\r
466 StatisticsInfoSize = sizeof (VARIABLE_INFO_ENTRY) + StrSize (VariableInfo->Name);\r
467 if (*InfoSize < StatisticsInfoSize) {\r
468 *InfoSize = StatisticsInfoSize;\r
469 return EFI_BUFFER_TOO_SMALL;\r
470 }\r
471\r
472 CopyMem (InfoEntry, VariableInfo, sizeof (VARIABLE_INFO_ENTRY));\r
473 CopyMem (InfoName, VariableInfo->Name, StrSize (VariableInfo->Name));\r
474 *InfoSize = StatisticsInfoSize;\r
475 \r
476 return EFI_SUCCESS;\r
477}\r
478\r
479\r
480/**\r
481 Communication service SMI Handler entry.\r
482\r
483 This SMI handler provides services for the variable wrapper driver.\r
484\r
dc204d5a
JY
485 Caution: This function may receive untrusted input.\r
486 This variable data and communicate buffer are external input, so this function will do basic validation.\r
487 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(), \r
488 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(), \r
489 SmmVariableGetStatistics() should also do validation based on its own knowledge.\r
490\r
0c18794e 491 @param[in] DispatchHandle The unique handle assigned to this handler by SmiHandlerRegister().\r
492 @param[in] RegisterContext Points to an optional handler context which was specified when the\r
493 handler was registered.\r
494 @param[in, out] CommBuffer A pointer to a collection of data in memory that will\r
495 be conveyed from a non-SMM environment into an SMM environment.\r
496 @param[in, out] CommBufferSize The size of the CommBuffer.\r
497\r
498 @retval EFI_SUCCESS The interrupt was handled and quiesced. No other handlers \r
499 should still be called.\r
500 @retval EFI_WARN_INTERRUPT_SOURCE_QUIESCED The interrupt has been quiesced but other handlers should \r
501 still be called.\r
502 @retval EFI_WARN_INTERRUPT_SOURCE_PENDING The interrupt is still pending and other handlers should still \r
503 be called.\r
504 @retval EFI_INTERRUPT_PENDING The interrupt could not be quiesced.\r
648f98d1 505\r
0c18794e 506**/\r
507EFI_STATUS\r
508EFIAPI\r
509SmmVariableHandler (\r
510 IN EFI_HANDLE DispatchHandle,\r
511 IN CONST VOID *RegisterContext,\r
512 IN OUT VOID *CommBuffer,\r
513 IN OUT UINTN *CommBufferSize\r
514 )\r
515{\r
516 EFI_STATUS Status;\r
517 SMM_VARIABLE_COMMUNICATE_HEADER *SmmVariableFunctionHeader;\r
518 SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE *SmmVariableHeader;\r
519 SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME *GetNextVariableName;\r
520 SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO *QueryVariableInfo;\r
521 VARIABLE_INFO_ENTRY *VariableInfo;\r
6ab9f441 522 SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE *VariableToLock;\r
0c18794e 523 UINTN InfoSize;\r
9d00d20e 524 UINTN NameBufferSize;\r
5e5bb2a9 525 UINTN CommBufferPayloadSize;\r
164a9b67 526 UINTN TempCommBufferSize;\r
0c18794e 527\r
25a4e71a 528 //\r
529 // If input is invalid, stop processing this SMI\r
530 //\r
531 if (CommBuffer == NULL || CommBufferSize == NULL) {\r
532 return EFI_SUCCESS;\r
648f98d1 533 }\r
0c18794e 534\r
164a9b67
SZ
535 TempCommBufferSize = *CommBufferSize;\r
536\r
537 if (TempCommBufferSize < SMM_VARIABLE_COMMUNICATE_HEADER_SIZE) {\r
5e5bb2a9
SZ
538 DEBUG ((EFI_D_ERROR, "SmmVariableHandler: SMM communication buffer size invalid!\n"));\r
539 return EFI_SUCCESS;\r
540 }\r
164a9b67 541 CommBufferPayloadSize = TempCommBufferSize - SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;\r
5e5bb2a9
SZ
542 if (CommBufferPayloadSize > mVariableBufferPayloadSize) {\r
543 DEBUG ((EFI_D_ERROR, "SmmVariableHandler: SMM communication buffer payload size invalid!\n"));\r
25a4e71a 544 return EFI_SUCCESS;\r
545 }\r
546\r
164a9b67 547 if (!InternalIsAddressValid ((UINTN)CommBuffer, TempCommBufferSize)) {\r
5e5bb2a9 548 DEBUG ((EFI_D_ERROR, "SmmVariableHandler: SMM communication buffer in SMRAM or overflow!\n"));\r
25a4e71a 549 return EFI_SUCCESS;\r
550 }\r
551 \r
0c18794e 552 SmmVariableFunctionHeader = (SMM_VARIABLE_COMMUNICATE_HEADER *)CommBuffer;\r
25a4e71a 553 \r
0c18794e 554 switch (SmmVariableFunctionHeader->Function) {\r
555 case SMM_VARIABLE_FUNCTION_GET_VARIABLE:\r
5e5bb2a9
SZ
556 if (CommBufferPayloadSize < OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name)) {\r
557 DEBUG ((EFI_D_ERROR, "GetVariable: SMM communication buffer size invalid!\n"));\r
558 return EFI_SUCCESS;\r
559 }\r
560 //\r
561 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.\r
562 //\r
563 CopyMem (mVariableBufferPayload, SmmVariableFunctionHeader->Data, CommBufferPayloadSize);\r
564 SmmVariableHeader = (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE *) mVariableBufferPayload;\r
9d00d20e
SZ
565 if (((UINTN)(~0) - SmmVariableHeader->DataSize < OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name)) ||\r
566 ((UINTN)(~0) - SmmVariableHeader->NameSize < OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) + SmmVariableHeader->DataSize)) {\r
567 //\r
568 // Prevent InfoSize overflow happen\r
569 //\r
570 Status = EFI_ACCESS_DENIED;\r
571 goto EXIT;\r
572 }\r
25a4e71a 573 InfoSize = OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) \r
574 + SmmVariableHeader->DataSize + SmmVariableHeader->NameSize;\r
575\r
576 //\r
577 // SMRAM range check already covered before\r
578 //\r
5e5bb2a9
SZ
579 if (InfoSize > CommBufferPayloadSize) {\r
580 DEBUG ((EFI_D_ERROR, "GetVariable: Data size exceed communication buffer size limit!\n"));\r
25a4e71a 581 Status = EFI_ACCESS_DENIED;\r
582 goto EXIT;\r
583 }\r
584\r
9d00d20e
SZ
585 if (SmmVariableHeader->NameSize < sizeof (CHAR16) || SmmVariableHeader->Name[SmmVariableHeader->NameSize/sizeof (CHAR16) - 1] != L'\0') {\r
586 //\r
587 // Make sure VariableName is A Null-terminated string.\r
588 //\r
589 Status = EFI_ACCESS_DENIED;\r
590 goto EXIT;\r
591 }\r
592\r
0c18794e 593 Status = VariableServiceGetVariable (\r
594 SmmVariableHeader->Name,\r
595 &SmmVariableHeader->Guid,\r
596 &SmmVariableHeader->Attributes,\r
597 &SmmVariableHeader->DataSize,\r
598 (UINT8 *)SmmVariableHeader->Name + SmmVariableHeader->NameSize\r
599 );\r
5e5bb2a9 600 CopyMem (SmmVariableFunctionHeader->Data, mVariableBufferPayload, CommBufferPayloadSize);\r
0c18794e 601 break;\r
602 \r
603 case SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME:\r
5e5bb2a9
SZ
604 if (CommBufferPayloadSize < OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name)) {\r
605 DEBUG ((EFI_D_ERROR, "GetNextVariableName: SMM communication buffer size invalid!\n"));\r
606 return EFI_SUCCESS;\r
607 }\r
608 //\r
609 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.\r
610 //\r
611 CopyMem (mVariableBufferPayload, SmmVariableFunctionHeader->Data, CommBufferPayloadSize);\r
612 GetNextVariableName = (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME *) mVariableBufferPayload;\r
9d00d20e
SZ
613 if ((UINTN)(~0) - GetNextVariableName->NameSize < OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name)) {\r
614 //\r
615 // Prevent InfoSize overflow happen\r
616 //\r
617 Status = EFI_ACCESS_DENIED;\r
618 goto EXIT;\r
619 }\r
25a4e71a 620 InfoSize = OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name) + GetNextVariableName->NameSize;\r
621\r
622 //\r
623 // SMRAM range check already covered before\r
624 //\r
5e5bb2a9
SZ
625 if (InfoSize > CommBufferPayloadSize) {\r
626 DEBUG ((EFI_D_ERROR, "GetNextVariableName: Data size exceed communication buffer size limit!\n"));\r
25a4e71a 627 Status = EFI_ACCESS_DENIED;\r
628 goto EXIT;\r
629 }\r
630\r
5e5bb2a9 631 NameBufferSize = CommBufferPayloadSize - OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name);\r
9d00d20e
SZ
632 if (NameBufferSize < sizeof (CHAR16) || GetNextVariableName->Name[NameBufferSize/sizeof (CHAR16) - 1] != L'\0') {\r
633 //\r
634 // Make sure input VariableName is A Null-terminated string.\r
635 //\r
636 Status = EFI_ACCESS_DENIED;\r
637 goto EXIT;\r
638 }\r
639\r
0c18794e 640 Status = VariableServiceGetNextVariableName (\r
641 &GetNextVariableName->NameSize,\r
642 GetNextVariableName->Name,\r
643 &GetNextVariableName->Guid\r
644 );\r
5e5bb2a9 645 CopyMem (SmmVariableFunctionHeader->Data, mVariableBufferPayload, CommBufferPayloadSize);\r
0c18794e 646 break;\r
647 \r
648 case SMM_VARIABLE_FUNCTION_SET_VARIABLE:\r
5e5bb2a9
SZ
649 if (CommBufferPayloadSize < OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name)) {\r
650 DEBUG ((EFI_D_ERROR, "SetVariable: SMM communication buffer size invalid!\n"));\r
651 return EFI_SUCCESS;\r
652 }\r
653 //\r
654 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.\r
655 //\r
656 CopyMem (mVariableBufferPayload, SmmVariableFunctionHeader->Data, CommBufferPayloadSize);\r
657 SmmVariableHeader = (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE *) mVariableBufferPayload;\r
9d00d20e
SZ
658 if (((UINTN)(~0) - SmmVariableHeader->DataSize < OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name)) ||\r
659 ((UINTN)(~0) - SmmVariableHeader->NameSize < OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) + SmmVariableHeader->DataSize)) {\r
660 //\r
661 // Prevent InfoSize overflow happen\r
662 //\r
663 Status = EFI_ACCESS_DENIED;\r
664 goto EXIT;\r
665 }\r
d17c4eac 666 InfoSize = OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name)\r
667 + SmmVariableHeader->DataSize + SmmVariableHeader->NameSize;\r
668\r
669 //\r
670 // SMRAM range check already covered before\r
671 // Data buffer should not contain SMM range\r
672 //\r
5e5bb2a9
SZ
673 if (InfoSize > CommBufferPayloadSize) {\r
674 DEBUG ((EFI_D_ERROR, "SetVariable: Data size exceed communication buffer size limit!\n"));\r
d17c4eac 675 Status = EFI_ACCESS_DENIED;\r
676 goto EXIT;\r
677 }\r
678\r
9d00d20e
SZ
679 if (SmmVariableHeader->NameSize < sizeof (CHAR16) || SmmVariableHeader->Name[SmmVariableHeader->NameSize/sizeof (CHAR16) - 1] != L'\0') {\r
680 //\r
681 // Make sure VariableName is A Null-terminated string.\r
682 //\r
683 Status = EFI_ACCESS_DENIED;\r
684 goto EXIT;\r
685 }\r
686\r
0c18794e 687 Status = VariableServiceSetVariable (\r
688 SmmVariableHeader->Name,\r
689 &SmmVariableHeader->Guid,\r
690 SmmVariableHeader->Attributes,\r
691 SmmVariableHeader->DataSize,\r
692 (UINT8 *)SmmVariableHeader->Name + SmmVariableHeader->NameSize\r
693 );\r
694 break;\r
695 \r
696 case SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO:\r
5e5bb2a9
SZ
697 if (CommBufferPayloadSize < sizeof (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO)) {\r
698 DEBUG ((EFI_D_ERROR, "QueryVariableInfo: SMM communication buffer size invalid!\n"));\r
699 return EFI_SUCCESS;\r
25a4e71a 700 }\r
5e5bb2a9 701 QueryVariableInfo = (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO *) SmmVariableFunctionHeader->Data;\r
25a4e71a 702 \r
0c18794e 703 Status = VariableServiceQueryVariableInfo (\r
704 QueryVariableInfo->Attributes,\r
705 &QueryVariableInfo->MaximumVariableStorageSize,\r
706 &QueryVariableInfo->RemainingVariableStorageSize,\r
707 &QueryVariableInfo->MaximumVariableSize\r
708 );\r
709 break;\r
710\r
711 case SMM_VARIABLE_FUNCTION_READY_TO_BOOT:\r
6ab9f441 712 mEndOfDxe = TRUE;\r
876ac395 713 if (AtRuntime()) {\r
714 Status = EFI_UNSUPPORTED;\r
715 break;\r
716 }\r
0c18794e 717 ReclaimForOS ();\r
718 Status = EFI_SUCCESS;\r
719 break;\r
720 \r
721 case SMM_VARIABLE_FUNCTION_EXIT_BOOT_SERVICE:\r
722 mAtRuntime = TRUE;\r
723 Status = EFI_SUCCESS;\r
724 break;\r
725\r
726 case SMM_VARIABLE_FUNCTION_GET_STATISTICS:\r
727 VariableInfo = (VARIABLE_INFO_ENTRY *) SmmVariableFunctionHeader->Data;\r
164a9b67 728 InfoSize = TempCommBufferSize - SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;\r
25a4e71a 729\r
730 //\r
731 // Do not need to check SmmVariableFunctionHeader->Data in SMRAM here. \r
732 // It is covered by previous CommBuffer check \r
733 //\r
734 \r
735 if (InternalIsAddressInSmram ((EFI_PHYSICAL_ADDRESS)(UINTN)CommBufferSize, sizeof(UINTN))) {\r
5e5bb2a9 736 DEBUG ((EFI_D_ERROR, "GetStatistics: SMM communication buffer in SMRAM!\n"));\r
25a4e71a 737 Status = EFI_ACCESS_DENIED;\r
738 goto EXIT;\r
739 } \r
740\r
0c18794e 741 Status = SmmVariableGetStatistics (VariableInfo, &InfoSize);\r
3f5c168f 742 *CommBufferSize = InfoSize + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;\r
0c18794e 743 break;\r
744\r
6ab9f441
RN
745 case SMM_VARIABLE_FUNCTION_LOCK_VARIABLE:\r
746 if (mEndOfDxe) {\r
747 Status = EFI_ACCESS_DENIED;\r
748 } else {\r
749 VariableToLock = (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE *) SmmVariableFunctionHeader->Data;\r
750 Status = VariableLockRequestToLock (\r
751 NULL,\r
752 VariableToLock->Name,\r
753 &VariableToLock->Guid\r
754 );\r
755 }\r
756 break;\r
757\r
0c18794e 758 default:\r
0c18794e 759 Status = EFI_UNSUPPORTED;\r
760 }\r
761\r
25a4e71a 762EXIT:\r
0c18794e 763\r
25a4e71a 764 SmmVariableFunctionHeader->ReturnStatus = Status;\r
0c18794e 765 return EFI_SUCCESS;\r
766}\r
767\r
6ab9f441
RN
768/**\r
769 SMM END_OF_DXE protocol notification event handler.\r
770\r
771 @param Protocol Points to the protocol's unique identifier\r
772 @param Interface Points to the interface instance\r
773 @param Handle The handle on which the interface was installed\r
774\r
775 @retval EFI_SUCCESS SmmEndOfDxeCallback runs successfully\r
776\r
777**/\r
778EFI_STATUS\r
779EFIAPI\r
780SmmEndOfDxeCallback (\r
781 IN CONST EFI_GUID *Protocol,\r
782 IN VOID *Interface,\r
783 IN EFI_HANDLE Handle\r
784 )\r
785{\r
786 DEBUG ((EFI_D_INFO, "[Variable]END_OF_DXE is signaled\n"));\r
787 mEndOfDxe = TRUE;\r
788 return EFI_SUCCESS;\r
789}\r
0c18794e 790\r
791/**\r
792 SMM Fault Tolerant Write protocol notification event handler.\r
793\r
794 Non-Volatile variable write may needs FTW protocol to reclaim when \r
795 writting variable.\r
796 \r
797 @param Protocol Points to the protocol's unique identifier\r
798 @param Interface Points to the interface instance\r
799 @param Handle The handle on which the interface was installed\r
800\r
801 @retval EFI_SUCCESS SmmEventCallback runs successfully\r
802 @retval EFI_NOT_FOUND The Fvb protocol for variable is not found.\r
803 \r
804 **/\r
805EFI_STATUS\r
806EFIAPI\r
807SmmFtwNotificationEvent (\r
808 IN CONST EFI_GUID *Protocol,\r
809 IN VOID *Interface,\r
810 IN EFI_HANDLE Handle\r
811 )\r
812{\r
813 EFI_STATUS Status;\r
814 EFI_SMM_FIRMWARE_VOLUME_BLOCK_PROTOCOL *FvbProtocol;\r
815 EFI_SMM_FAULT_TOLERANT_WRITE_PROTOCOL *FtwProtocol;\r
816 EFI_PHYSICAL_ADDRESS NvStorageVariableBase;\r
41982ebb 817 UINTN FtwMaxBlockSize;\r
0c18794e 818 \r
819 if (mVariableModuleGlobal->FvbInstance != NULL) {\r
820 return EFI_SUCCESS;\r
821 }\r
822\r
823 //\r
824 // Ensure SMM FTW protocol is installed.\r
825 //\r
826 Status = GetFtwProtocol ((VOID **)&FtwProtocol);\r
827 if (EFI_ERROR (Status)) {\r
828 return Status;\r
829 }\r
830\r
41982ebb
SZ
831 Status = FtwProtocol->GetMaxBlockSize (FtwProtocol, &FtwMaxBlockSize);\r
832 if (!EFI_ERROR (Status)) {\r
833 ASSERT (PcdGet32 (PcdFlashNvStorageVariableSize) <= FtwMaxBlockSize);\r
834 }\r
835\r
0c18794e 836 //\r
837 // Find the proper FVB protocol for variable.\r
838 //\r
839 NvStorageVariableBase = (EFI_PHYSICAL_ADDRESS) PcdGet64 (PcdFlashNvStorageVariableBase64);\r
840 if (NvStorageVariableBase == 0) {\r
841 NvStorageVariableBase = (EFI_PHYSICAL_ADDRESS) PcdGet32 (PcdFlashNvStorageVariableBase);\r
842 }\r
843 Status = GetFvbInfoByAddress (NvStorageVariableBase, NULL, &FvbProtocol);\r
844 if (EFI_ERROR (Status)) {\r
845 return EFI_NOT_FOUND;\r
846 }\r
847\r
848 mVariableModuleGlobal->FvbInstance = FvbProtocol;\r
849 \r
850 Status = VariableWriteServiceInitialize ();\r
25da08c8
DG
851 if (EFI_ERROR (Status)) {\r
852 DEBUG ((DEBUG_ERROR, "Variable write service initialization failed. Status = %r\n", Status));\r
853 }\r
0c18794e 854 \r
855 //\r
856 // Notify the variable wrapper driver the variable write service is ready\r
857 //\r
858 Status = gBS->InstallProtocolInterface (\r
859 &mSmmVariableHandle,\r
860 &gSmmVariableWriteGuid,\r
861 EFI_NATIVE_INTERFACE,\r
862 NULL\r
863 );\r
864 ASSERT_EFI_ERROR (Status);\r
865 \r
866 return EFI_SUCCESS;\r
867}\r
868\r
869\r
870/**\r
871 Variable Driver main entry point. The Variable driver places the 4 EFI\r
872 runtime services in the EFI System Table and installs arch protocols \r
873 for variable read and write services being available. It also registers\r
874 a notification function for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.\r
875\r
876 @param[in] ImageHandle The firmware allocated handle for the EFI image. \r
877 @param[in] SystemTable A pointer to the EFI System Table.\r
878 \r
879 @retval EFI_SUCCESS Variable service successfully initialized.\r
880\r
881**/\r
882EFI_STATUS\r
883EFIAPI\r
884VariableServiceInitialize (\r
885 IN EFI_HANDLE ImageHandle,\r
886 IN EFI_SYSTEM_TABLE *SystemTable\r
887 )\r
888{\r
889 EFI_STATUS Status;\r
890 EFI_HANDLE VariableHandle;\r
891 VOID *SmmFtwRegistration;\r
25a4e71a 892 EFI_SMM_ACCESS2_PROTOCOL *SmmAccess;\r
893 UINTN Size;\r
6ab9f441 894 VOID *SmmEndOfDxeRegistration;\r
25a4e71a 895\r
0c18794e 896 //\r
897 // Variable initialize.\r
898 //\r
899 Status = VariableCommonInitialize ();\r
900 ASSERT_EFI_ERROR (Status);\r
901\r
902 //\r
903 // Install the Smm Variable Protocol on a new handle.\r
904 //\r
905 VariableHandle = NULL;\r
906 Status = gSmst->SmmInstallProtocolInterface (\r
907 &VariableHandle,\r
908 &gEfiSmmVariableProtocolGuid,\r
909 EFI_NATIVE_INTERFACE,\r
910 &gSmmVariable\r
911 );\r
912 ASSERT_EFI_ERROR (Status);\r
913\r
25a4e71a 914 //\r
915 // Get SMRAM information\r
916 //\r
917 Status = gBS->LocateProtocol (&gEfiSmmAccess2ProtocolGuid, NULL, (VOID **)&SmmAccess);\r
918 ASSERT_EFI_ERROR (Status);\r
919\r
920 Size = 0;\r
921 Status = SmmAccess->GetCapabilities (SmmAccess, &Size, NULL);\r
922 ASSERT (Status == EFI_BUFFER_TOO_SMALL);\r
923\r
924 Status = gSmst->SmmAllocatePool (\r
925 EfiRuntimeServicesData,\r
926 Size,\r
927 (VOID **)&mSmramRanges\r
928 );\r
929 ASSERT_EFI_ERROR (Status);\r
930\r
931 Status = SmmAccess->GetCapabilities (SmmAccess, &Size, mSmramRanges);\r
932 ASSERT_EFI_ERROR (Status);\r
933\r
934 mSmramRangeCount = Size / sizeof (EFI_SMRAM_DESCRIPTOR);\r
935\r
5e5bb2a9
SZ
936 mVariableBufferPayloadSize = MAX (PcdGet32 (PcdMaxVariableSize), PcdGet32 (PcdMaxHardwareErrorVariableSize)) +\r
937 OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) - sizeof (VARIABLE_HEADER);\r
938\r
939 Status = gSmst->SmmAllocatePool (\r
940 EfiRuntimeServicesData,\r
941 mVariableBufferPayloadSize,\r
942 (VOID **)&mVariableBufferPayload\r
943 );\r
944 ASSERT_EFI_ERROR (Status);\r
945\r
0c18794e 946 ///\r
947 /// Register SMM variable SMI handler\r
948 ///\r
949 VariableHandle = NULL;\r
950 Status = gSmst->SmiHandlerRegister (SmmVariableHandler, &gEfiSmmVariableProtocolGuid, &VariableHandle);\r
951 ASSERT_EFI_ERROR (Status);\r
952 \r
953 //\r
954 // Notify the variable wrapper driver the variable service is ready\r
955 //\r
956 Status = SystemTable->BootServices->InstallProtocolInterface (\r
957 &mVariableHandle,\r
958 &gEfiSmmVariableProtocolGuid,\r
959 EFI_NATIVE_INTERFACE,\r
960 &gSmmVariable\r
961 );\r
962 ASSERT_EFI_ERROR (Status);\r
963 \r
6ab9f441
RN
964 //\r
965 // Register EFI_SMM_END_OF_DXE_PROTOCOL_GUID notify function.\r
966 //\r
967 Status = gSmst->SmmRegisterProtocolNotify (\r
968 &gEfiSmmEndOfDxeProtocolGuid,\r
969 SmmEndOfDxeCallback,\r
970 &SmmEndOfDxeRegistration\r
971 );\r
972 ASSERT_EFI_ERROR (Status);\r
973\r
0c18794e 974 //\r
975 // Register FtwNotificationEvent () notify function.\r
976 // \r
977 Status = gSmst->SmmRegisterProtocolNotify (\r
978 &gEfiSmmFaultTolerantWriteProtocolGuid,\r
979 SmmFtwNotificationEvent,\r
980 &SmmFtwRegistration\r
981 );\r
982 ASSERT_EFI_ERROR (Status);\r
983\r
984 SmmFtwNotificationEvent (NULL, NULL, NULL);\r
985 \r
986 return EFI_SUCCESS;\r
987}\r
988\r
989\r