2 Implement all four UEFI Runtime Variable services for the nonvolatile
3 and volatile storage space and install variable architecture protocol.
5 Copyright (C) 2013, Red Hat, Inc.
6 Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>
7 (C) Copyright 2015 Hewlett Packard Enterprise Development LP<BR>
8 Copyright (c) Microsoft Corporation.
9 SPDX-License-Identifier: BSD-2-Clause-Patent
15 #include <Protocol/VariablePolicy.h>
16 #include <Library/VariablePolicyLib.h>
20 ProtocolIsVariablePolicyEnabled (
24 EFI_HANDLE mHandle
= NULL
;
25 EFI_EVENT mVirtualAddressChangeEvent
= NULL
;
26 VOID
*mFtwRegistration
= NULL
;
27 VOID
***mVarCheckAddressPointer
= NULL
;
28 UINTN mVarCheckAddressPointerCount
= 0;
29 EDKII_VARIABLE_LOCK_PROTOCOL mVariableLock
= { VariableLockRequestToLock
};
30 EDKII_VARIABLE_POLICY_PROTOCOL mVariablePolicyProtocol
= { EDKII_VARIABLE_POLICY_PROTOCOL_REVISION
,
31 DisableVariablePolicy
,
32 ProtocolIsVariablePolicyEnabled
,
33 RegisterVariablePolicy
,
36 EDKII_VAR_CHECK_PROTOCOL mVarCheck
= { VarCheckRegisterSetVariableCheckHandler
,
37 VarCheckVariablePropertySet
,
38 VarCheckVariablePropertyGet
};
41 Some Secure Boot Policy Variable may update following other variable changes(SecureBoot follows PK change, etc).
42 Record their initial State when variable write service is ready.
47 RecordSecureBootPolicyVarData(
52 Return TRUE if ExitBootServices () has been called.
54 @retval TRUE If ExitBootServices () has been called.
61 return EfiAtRuntime ();
66 Initializes a basic mutual exclusion lock.
68 This function initializes a basic mutual exclusion lock to the released state
69 and returns the lock. Each lock provides mutual exclusion access at its task
70 priority level. Since there is no preemption or multiprocessor support in EFI,
71 acquiring the lock only consists of raising to the locks TPL.
72 If Lock is NULL, then ASSERT().
73 If Priority is not a valid TPL value, then ASSERT().
75 @param Lock A pointer to the lock data structure to initialize.
76 @param Priority EFI TPL is associated with the lock.
83 IN OUT EFI_LOCK
*Lock
,
87 return EfiInitializeLock (Lock
, Priority
);
92 Acquires lock only at boot time. Simply returns at runtime.
94 This is a temperary function that will be removed when
95 EfiAcquireLock() in UefiLib can handle the call in UEFI
96 Runtimer driver in RT phase.
97 It calls EfiAcquireLock() at boot time, and simply returns
100 @param Lock A pointer to the lock to acquire.
104 AcquireLockOnlyAtBootTime (
109 EfiAcquireLock (Lock
);
115 Releases lock only at boot time. Simply returns at runtime.
117 This is a temperary function which will be removed when
118 EfiReleaseLock() in UefiLib can handle the call in UEFI
119 Runtimer driver in RT phase.
120 It calls EfiReleaseLock() at boot time and simply returns
123 @param Lock A pointer to the lock to release.
127 ReleaseLockOnlyAtBootTime (
132 EfiReleaseLock (Lock
);
137 Retrieve the Fault Tolerent Write protocol interface.
139 @param[out] FtwProtocol The interface of Ftw protocol
141 @retval EFI_SUCCESS The FTW protocol instance was found and returned in FtwProtocol.
142 @retval EFI_NOT_FOUND The FTW protocol instance was not found.
143 @retval EFI_INVALID_PARAMETER SarProtocol is NULL.
148 OUT VOID
**FtwProtocol
154 // Locate Fault Tolerent Write protocol
156 Status
= gBS
->LocateProtocol (
157 &gEfiFaultTolerantWriteProtocolGuid
,
165 Retrieve the FVB protocol interface by HANDLE.
167 @param[in] FvBlockHandle The handle of FVB protocol that provides services for
168 reading, writing, and erasing the target block.
169 @param[out] FvBlock The interface of FVB protocol
171 @retval EFI_SUCCESS The interface information for the specified protocol was returned.
172 @retval EFI_UNSUPPORTED The device does not support the FVB protocol.
173 @retval EFI_INVALID_PARAMETER FvBlockHandle is not a valid EFI_HANDLE or FvBlock is NULL.
178 IN EFI_HANDLE FvBlockHandle
,
179 OUT EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL
**FvBlock
183 // To get the FVB protocol interface on the handle
185 return gBS
->HandleProtocol (
187 &gEfiFirmwareVolumeBlockProtocolGuid
,
194 Function returns an array of handles that support the FVB protocol
195 in a buffer allocated from pool.
197 @param[out] NumberHandles The number of handles returned in Buffer.
198 @param[out] Buffer A pointer to the buffer to return the requested
199 array of handles that support FVB protocol.
201 @retval EFI_SUCCESS The array of handles was returned in Buffer, and the number of
202 handles in Buffer was returned in NumberHandles.
203 @retval EFI_NOT_FOUND No FVB handle was found.
204 @retval EFI_OUT_OF_RESOURCES There is not enough pool memory to store the matching results.
205 @retval EFI_INVALID_PARAMETER NumberHandles is NULL or Buffer is NULL.
209 GetFvbCountAndBuffer (
210 OUT UINTN
*NumberHandles
,
211 OUT EFI_HANDLE
**Buffer
217 // Locate all handles of Fvb protocol
219 Status
= gBS
->LocateHandleBuffer (
221 &gEfiFirmwareVolumeBlockProtocolGuid
,
231 Notification function of EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE.
233 This is a notification function registered on EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
234 It convers pointer to new virtual address.
236 @param Event Event whose notification function is being invoked.
237 @param Context Pointer to the notification function's context.
242 VariableClassAddressChangeEvent (
249 if (mVariableModuleGlobal
->FvbInstance
!= NULL
) {
250 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->FvbInstance
->GetBlockSize
);
251 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->FvbInstance
->GetPhysicalAddress
);
252 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->FvbInstance
->GetAttributes
);
253 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->FvbInstance
->SetAttributes
);
254 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->FvbInstance
->Read
);
255 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->FvbInstance
->Write
);
256 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->FvbInstance
->EraseBlocks
);
257 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->FvbInstance
);
259 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->PlatformLangCodes
);
260 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->LangCodes
);
261 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->PlatformLang
);
262 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->VariableGlobal
.NonVolatileVariableBase
);
263 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->VariableGlobal
.VolatileVariableBase
);
264 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
->VariableGlobal
.HobVariableBase
);
265 EfiConvertPointer (0x0, (VOID
**) &mVariableModuleGlobal
);
266 EfiConvertPointer (0x0, (VOID
**) &mNvVariableCache
);
267 EfiConvertPointer (0x0, (VOID
**) &mNvFvHeaderCache
);
269 if (mAuthContextOut
.AddressPointer
!= NULL
) {
270 for (Index
= 0; Index
< mAuthContextOut
.AddressPointerCount
; Index
++) {
271 EfiConvertPointer (0x0, (VOID
**) mAuthContextOut
.AddressPointer
[Index
]);
275 if (mVarCheckAddressPointer
!= NULL
) {
276 for (Index
= 0; Index
< mVarCheckAddressPointerCount
; Index
++) {
277 EfiConvertPointer (0x0, (VOID
**) mVarCheckAddressPointer
[Index
]);
284 Notification function of EVT_GROUP_READY_TO_BOOT event group.
286 This is a notification function registered on EVT_GROUP_READY_TO_BOOT event group.
287 When the Boot Manager is about to load and execute a boot option, it reclaims variable
288 storage if free size is below the threshold.
290 @param Event Event whose notification function is being invoked.
291 @param Context Pointer to the notification function's context.
304 MorLockInitAtEndOfDxe ();
306 Status
= LockVariablePolicy ();
307 ASSERT_EFI_ERROR (Status
);
309 // Set the End Of DXE bit in case the EFI_END_OF_DXE_EVENT_GROUP_GUID event is not signaled.
312 mVarCheckAddressPointer
= VarCheckLibInitializeAtEndOfDxe (&mVarCheckAddressPointerCount
);
314 // The initialization for variable quota.
316 InitializeVariableQuota ();
319 if (FeaturePcdGet (PcdVariableCollectStatistics
)) {
320 if (mVariableModuleGlobal
->VariableGlobal
.AuthFormat
) {
321 gBS
->InstallConfigurationTable (&gEfiAuthenticatedVariableGuid
, gVariableInfo
);
323 gBS
->InstallConfigurationTable (&gEfiVariableGuid
, gVariableInfo
);
327 gBS
->CloseEvent (Event
);
331 Notification function of EFI_END_OF_DXE_EVENT_GROUP_GUID event group.
333 This is a notification function registered on EFI_END_OF_DXE_EVENT_GROUP_GUID event group.
335 @param Event Event whose notification function is being invoked.
336 @param Context Pointer to the notification function's context.
348 DEBUG ((EFI_D_INFO
, "[Variable]END_OF_DXE is signaled\n"));
349 MorLockInitAtEndOfDxe ();
350 Status
= LockVariablePolicy ();
351 ASSERT_EFI_ERROR (Status
);
353 mVarCheckAddressPointer
= VarCheckLibInitializeAtEndOfDxe (&mVarCheckAddressPointerCount
);
355 // The initialization for variable quota.
357 InitializeVariableQuota ();
358 if (PcdGetBool (PcdReclaimVariableSpaceAtEndOfDxe
)) {
362 gBS
->CloseEvent (Event
);
366 Initializes variable write service for DXE.
370 VariableWriteServiceInitializeDxe (
376 Status
= VariableWriteServiceInitialize ();
377 if (EFI_ERROR (Status
)) {
378 DEBUG ((DEBUG_ERROR
, "Variable write service initialization failed. Status = %r\n", Status
));
382 // Some Secure Boot Policy Var (SecureBoot, etc) updates following other
383 // Secure Boot Policy Variable change. Record their initial value.
385 RecordSecureBootPolicyVarData();
388 // Install the Variable Write Architectural protocol.
390 Status
= gBS
->InstallProtocolInterface (
392 &gEfiVariableWriteArchProtocolGuid
,
393 EFI_NATIVE_INTERFACE
,
396 ASSERT_EFI_ERROR (Status
);
400 Fault Tolerant Write protocol notification event handler.
402 Non-Volatile variable write may needs FTW protocol to reclaim when
405 @param[in] Event Event whose notification function is being invoked.
406 @param[in] Context Pointer to the notification function's context.
411 FtwNotificationEvent (
417 EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL
*FvbProtocol
;
418 EFI_FAULT_TOLERANT_WRITE_PROTOCOL
*FtwProtocol
;
419 EFI_PHYSICAL_ADDRESS NvStorageVariableBase
;
420 EFI_GCD_MEMORY_SPACE_DESCRIPTOR GcdDescriptor
;
421 EFI_PHYSICAL_ADDRESS BaseAddress
;
423 EFI_PHYSICAL_ADDRESS VariableStoreBase
;
424 UINT64 VariableStoreLength
;
425 UINTN FtwMaxBlockSize
;
428 // Ensure FTW protocol is installed.
430 Status
= GetFtwProtocol ((VOID
**) &FtwProtocol
);
431 if (EFI_ERROR (Status
)) {
435 Status
= FtwProtocol
->GetMaxBlockSize (FtwProtocol
, &FtwMaxBlockSize
);
436 if (!EFI_ERROR (Status
)) {
437 ASSERT (PcdGet32 (PcdFlashNvStorageVariableSize
) <= FtwMaxBlockSize
);
440 NvStorageVariableBase
= NV_STORAGE_VARIABLE_BASE
;
441 VariableStoreBase
= NvStorageVariableBase
+ mNvFvHeaderCache
->HeaderLength
;
444 // Let NonVolatileVariableBase point to flash variable store base directly after FTW ready.
446 mVariableModuleGlobal
->VariableGlobal
.NonVolatileVariableBase
= VariableStoreBase
;
449 // Find the proper FVB protocol for variable.
451 Status
= GetFvbInfoByAddress (NvStorageVariableBase
, NULL
, &FvbProtocol
);
452 if (EFI_ERROR (Status
)) {
455 mVariableModuleGlobal
->FvbInstance
= FvbProtocol
;
458 // Mark the variable storage region of the FLASH as RUNTIME.
460 VariableStoreLength
= mNvVariableCache
->Size
;
461 BaseAddress
= VariableStoreBase
& (~EFI_PAGE_MASK
);
462 Length
= VariableStoreLength
+ (VariableStoreBase
- BaseAddress
);
463 Length
= (Length
+ EFI_PAGE_SIZE
- 1) & (~EFI_PAGE_MASK
);
465 Status
= gDS
->GetMemorySpaceDescriptor (BaseAddress
, &GcdDescriptor
);
466 if (EFI_ERROR (Status
)) {
467 DEBUG ((DEBUG_WARN
, "Variable driver failed to get flash memory attribute.\n"));
469 if ((GcdDescriptor
.Attributes
& EFI_MEMORY_RUNTIME
) == 0) {
470 Status
= gDS
->SetMemorySpaceAttributes (
473 GcdDescriptor
.Attributes
| EFI_MEMORY_RUNTIME
475 if (EFI_ERROR (Status
)) {
476 DEBUG ((DEBUG_WARN
, "Variable driver failed to add EFI_MEMORY_RUNTIME attribute to Flash.\n"));
482 // Initializes variable write service after FTW was ready.
484 VariableWriteServiceInitializeDxe ();
487 // Close the notify event to avoid install gEfiVariableWriteArchProtocolGuid again.
489 gBS
->CloseEvent (Event
);
495 This API function returns whether or not the policy engine is
496 currently being enforced.
498 @param[out] State Pointer to a return value for whether the policy enforcement
499 is currently enabled.
502 @retval Others An error has prevented this command from completing.
507 ProtocolIsVariablePolicyEnabled (
511 *State
= IsVariablePolicyEnabled ();
517 Variable Driver main entry point. The Variable driver places the 4 EFI
518 runtime services in the EFI System Table and installs arch protocols
519 for variable read and write services being available. It also registers
520 a notification function for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
522 @param[in] ImageHandle The firmware allocated handle for the EFI image.
523 @param[in] SystemTable A pointer to the EFI System Table.
525 @retval EFI_SUCCESS Variable service successfully initialized.
530 VariableServiceInitialize (
531 IN EFI_HANDLE ImageHandle
,
532 IN EFI_SYSTEM_TABLE
*SystemTable
536 EFI_EVENT ReadyToBootEvent
;
537 EFI_EVENT EndOfDxeEvent
;
539 Status
= VariableCommonInitialize ();
540 ASSERT_EFI_ERROR (Status
);
542 Status
= gBS
->InstallMultipleProtocolInterfaces (
544 &gEdkiiVariableLockProtocolGuid
,
548 ASSERT_EFI_ERROR (Status
);
550 Status
= gBS
->InstallMultipleProtocolInterfaces (
552 &gEdkiiVarCheckProtocolGuid
,
556 ASSERT_EFI_ERROR (Status
);
558 SystemTable
->RuntimeServices
->GetVariable
= VariableServiceGetVariable
;
559 SystemTable
->RuntimeServices
->GetNextVariableName
= VariableServiceGetNextVariableName
;
560 SystemTable
->RuntimeServices
->SetVariable
= VariableServiceSetVariable
;
561 SystemTable
->RuntimeServices
->QueryVariableInfo
= VariableServiceQueryVariableInfo
;
564 // Now install the Variable Runtime Architectural protocol on a new handle.
566 Status
= gBS
->InstallProtocolInterface (
568 &gEfiVariableArchProtocolGuid
,
569 EFI_NATIVE_INTERFACE
,
572 ASSERT_EFI_ERROR (Status
);
574 if (!PcdGetBool (PcdEmuVariableNvModeEnable
)) {
576 // Register FtwNotificationEvent () notify function.
578 EfiCreateProtocolNotifyEvent (
579 &gEfiFaultTolerantWriteProtocolGuid
,
581 FtwNotificationEvent
,
587 // Emulated non-volatile variable mode does not depend on FVB and FTW.
589 VariableWriteServiceInitializeDxe ();
592 Status
= gBS
->CreateEventEx (
595 VariableClassAddressChangeEvent
,
597 &gEfiEventVirtualAddressChangeGuid
,
598 &mVirtualAddressChangeEvent
600 ASSERT_EFI_ERROR (Status
);
603 // Register the event handling function to reclaim variable for OS usage.
605 Status
= EfiCreateEventReadyToBootEx (
611 ASSERT_EFI_ERROR (Status
);
614 // Register the event handling function to set the End Of DXE flag.
616 Status
= gBS
->CreateEventEx (
621 &gEfiEndOfDxeEventGroupGuid
,
624 ASSERT_EFI_ERROR (Status
);
626 // Register and initialize the VariablePolicy engine.
627 Status
= InitVariablePolicyLib (VariableServiceGetVariable
);
628 ASSERT_EFI_ERROR (Status
);
629 Status
= VarCheckRegisterSetVariableCheckHandler (ValidateSetVariable
);
630 ASSERT_EFI_ERROR (Status
);
631 Status
= gBS
->InstallMultipleProtocolInterfaces (
633 &gEdkiiVariablePolicyProtocolGuid
,
634 &mVariablePolicyProtocol
,
637 ASSERT_EFI_ERROR (Status
);