2 The sample implementation for SMM variable protocol. And this driver
3 implements an SMI handler to communicate with the DXE runtime driver
4 to provide variable services.
6 Caution: This module requires additional review when modified.
7 This driver will have external input - variable data and communicate buffer in SMM mode.
8 This external input must be validated carefully to avoid security issue like
9 buffer overflow, integer overflow.
11 SmmVariableHandler() will receive untrusted input and do basic validation.
13 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
14 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
15 SmmVariableGetStatistics() should also do validation based on its own knowledge.
17 Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.<BR>
18 This program and the accompanying materials
19 are licensed and made available under the terms and conditions of the BSD License
20 which accompanies this distribution. The full text of the license may be found at
21 http://opensource.org/licenses/bsd-license.php
23 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
24 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
28 #include <Protocol/SmmVariable.h>
29 #include <Protocol/SmmFirmwareVolumeBlock.h>
30 #include <Protocol/SmmFaultTolerantWrite.h>
31 #include <Protocol/SmmEndOfDxe.h>
32 #include <Protocol/SmmVarCheck.h>
34 #include <Library/SmmServicesTableLib.h>
35 #include <Library/SmmMemLib.h>
37 #include <Guid/SmmVariableCommon.h>
40 extern VARIABLE_INFO_ENTRY
*gVariableInfo
;
41 EFI_HANDLE mSmmVariableHandle
= NULL
;
42 EFI_HANDLE mVariableHandle
= NULL
;
43 BOOLEAN mAtRuntime
= FALSE
;
44 UINT8
*mVariableBufferPayload
= NULL
;
45 UINTN mVariableBufferPayloadSize
;
46 extern BOOLEAN mEndOfDxe
;
47 extern VAR_CHECK_REQUEST_SOURCE mRequestSource
;
50 SecureBoot Hook for SetVariable.
52 @param[in] VariableName Name of Variable to be found.
53 @param[in] VendorGuid Variable vendor GUID.
59 IN CHAR16
*VariableName
,
60 IN EFI_GUID
*VendorGuid
68 This code sets variable in storage blocks (Volatile or Non-Volatile).
70 @param VariableName Name of Variable to be found.
71 @param VendorGuid Variable vendor GUID.
72 @param Attributes Attribute value of the variable found
73 @param DataSize Size of Data found. If size is less than the
74 data, this value contains the required size.
75 @param Data Data pointer.
77 @return EFI_INVALID_PARAMETER Invalid parameter.
78 @return EFI_SUCCESS Set successfully.
79 @return EFI_OUT_OF_RESOURCES Resource not enough to set variable.
80 @return EFI_NOT_FOUND Not found.
81 @return EFI_WRITE_PROTECTED Variable is read-only.
86 SmmVariableSetVariable (
87 IN CHAR16
*VariableName
,
88 IN EFI_GUID
*VendorGuid
,
97 // Disable write protection when the calling SetVariable() through EFI_SMM_VARIABLE_PROTOCOL.
99 mRequestSource
= VarCheckFromTrusted
;
100 Status
= VariableServiceSetVariable (
107 mRequestSource
= VarCheckFromUntrusted
;
111 EFI_SMM_VARIABLE_PROTOCOL gSmmVariable
= {
112 VariableServiceGetVariable
,
113 VariableServiceGetNextVariableName
,
114 SmmVariableSetVariable
,
115 VariableServiceQueryVariableInfo
118 EDKII_SMM_VAR_CHECK_PROTOCOL mSmmVarCheck
= { VarCheckRegisterSetVariableCheckHandler
,
119 VarCheckVariablePropertySet
,
120 VarCheckVariablePropertyGet
};
123 Return TRUE if ExitBootServices () has been called.
125 @retval TRUE If ExitBootServices () has been called.
136 Initializes a basic mutual exclusion lock.
138 This function initializes a basic mutual exclusion lock to the released state
139 and returns the lock. Each lock provides mutual exclusion access at its task
140 priority level. Since there is no preemption or multiprocessor support in EFI,
141 acquiring the lock only consists of raising to the locks TPL.
142 If Lock is NULL, then ASSERT().
143 If Priority is not a valid TPL value, then ASSERT().
145 @param Lock A pointer to the lock data structure to initialize.
146 @param Priority EFI TPL is associated with the lock.
153 IN OUT EFI_LOCK
*Lock
,
161 Acquires lock only at boot time. Simply returns at runtime.
163 This is a temperary function that will be removed when
164 EfiAcquireLock() in UefiLib can handle the call in UEFI
165 Runtimer driver in RT phase.
166 It calls EfiAcquireLock() at boot time, and simply returns
169 @param Lock A pointer to the lock to acquire.
173 AcquireLockOnlyAtBootTime (
182 Releases lock only at boot time. Simply returns at runtime.
184 This is a temperary function which will be removed when
185 EfiReleaseLock() in UefiLib can handle the call in UEFI
186 Runtimer driver in RT phase.
187 It calls EfiReleaseLock() at boot time and simply returns
190 @param Lock A pointer to the lock to release.
194 ReleaseLockOnlyAtBootTime (
202 Retrieve the SMM Fault Tolerent Write protocol interface.
204 @param[out] FtwProtocol The interface of SMM Ftw protocol
206 @retval EFI_SUCCESS The SMM FTW protocol instance was found and returned in FtwProtocol.
207 @retval EFI_NOT_FOUND The SMM FTW protocol instance was not found.
208 @retval EFI_INVALID_PARAMETER SarProtocol is NULL.
213 OUT VOID
**FtwProtocol
219 // Locate Smm Fault Tolerent Write protocol
221 Status
= gSmst
->SmmLocateProtocol (
222 &gEfiSmmFaultTolerantWriteProtocolGuid
,
231 Retrieve the SMM FVB protocol interface by HANDLE.
233 @param[in] FvBlockHandle The handle of SMM FVB protocol that provides services for
234 reading, writing, and erasing the target block.
235 @param[out] FvBlock The interface of SMM FVB protocol
237 @retval EFI_SUCCESS The interface information for the specified protocol was returned.
238 @retval EFI_UNSUPPORTED The device does not support the SMM FVB protocol.
239 @retval EFI_INVALID_PARAMETER FvBlockHandle is not a valid EFI_HANDLE or FvBlock is NULL.
244 IN EFI_HANDLE FvBlockHandle
,
245 OUT EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL
**FvBlock
249 // To get the SMM FVB protocol interface on the handle
251 return gSmst
->SmmHandleProtocol (
253 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
260 Function returns an array of handles that support the SMM FVB protocol
261 in a buffer allocated from pool.
263 @param[out] NumberHandles The number of handles returned in Buffer.
264 @param[out] Buffer A pointer to the buffer to return the requested
265 array of handles that support SMM FVB protocol.
267 @retval EFI_SUCCESS The array of handles was returned in Buffer, and the number of
268 handles in Buffer was returned in NumberHandles.
269 @retval EFI_NOT_FOUND No SMM FVB handle was found.
270 @retval EFI_OUT_OF_RESOURCES There is not enough pool memory to store the matching results.
271 @retval EFI_INVALID_PARAMETER NumberHandles is NULL or Buffer is NULL.
275 GetFvbCountAndBuffer (
276 OUT UINTN
*NumberHandles
,
277 OUT EFI_HANDLE
**Buffer
283 if ((NumberHandles
== NULL
) || (Buffer
== NULL
)) {
284 return EFI_INVALID_PARAMETER
;
290 Status
= gSmst
->SmmLocateHandle (
292 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
297 if (EFI_ERROR(Status
) && Status
!= EFI_BUFFER_TOO_SMALL
) {
298 return EFI_NOT_FOUND
;
301 *Buffer
= AllocatePool (BufferSize
);
302 if (*Buffer
== NULL
) {
303 return EFI_OUT_OF_RESOURCES
;
306 Status
= gSmst
->SmmLocateHandle (
308 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
314 *NumberHandles
= BufferSize
/ sizeof(EFI_HANDLE
);
315 if (EFI_ERROR(Status
)) {
326 Get the variable statistics information from the information buffer pointed by gVariableInfo.
328 Caution: This function may be invoked at SMM runtime.
329 InfoEntry and InfoSize are external input. Care must be taken to make sure not security issue at runtime.
331 @param[in, out] InfoEntry A pointer to the buffer of variable information entry.
332 On input, point to the variable information returned last time. if
333 InfoEntry->VendorGuid is zero, return the first information.
334 On output, point to the next variable information.
335 @param[in, out] InfoSize On input, the size of the variable information buffer.
336 On output, the returned variable information size.
338 @retval EFI_SUCCESS The variable information is found and returned successfully.
339 @retval EFI_UNSUPPORTED No variable inoformation exists in variable driver. The
340 PcdVariableCollectStatistics should be set TRUE to support it.
341 @retval EFI_BUFFER_TOO_SMALL The buffer is too small to hold the next variable information.
342 @retval EFI_INVALID_PARAMETER Input parameter is invalid.
346 SmmVariableGetStatistics (
347 IN OUT VARIABLE_INFO_ENTRY
*InfoEntry
,
348 IN OUT UINTN
*InfoSize
351 VARIABLE_INFO_ENTRY
*VariableInfo
;
353 UINTN StatisticsInfoSize
;
355 UINTN InfoNameMaxSize
;
358 if (InfoEntry
== NULL
) {
359 return EFI_INVALID_PARAMETER
;
362 VariableInfo
= gVariableInfo
;
363 if (VariableInfo
== NULL
) {
364 return EFI_UNSUPPORTED
;
367 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
);
368 if (*InfoSize
< StatisticsInfoSize
) {
369 *InfoSize
= StatisticsInfoSize
;
370 return EFI_BUFFER_TOO_SMALL
;
372 InfoName
= (CHAR16
*)(InfoEntry
+ 1);
373 InfoNameMaxSize
= (*InfoSize
- sizeof (VARIABLE_INFO_ENTRY
));
375 CopyGuid (&VendorGuid
, &InfoEntry
->VendorGuid
);
377 if (IsZeroGuid (&VendorGuid
)) {
379 // Return the first variable info
381 NameSize
= StrSize (VariableInfo
->Name
);
382 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + NameSize
;
383 if (*InfoSize
< StatisticsInfoSize
) {
384 *InfoSize
= StatisticsInfoSize
;
385 return EFI_BUFFER_TOO_SMALL
;
387 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
388 CopyMem (InfoName
, VariableInfo
->Name
, NameSize
);
389 *InfoSize
= StatisticsInfoSize
;
394 // Get the next variable info
396 while (VariableInfo
!= NULL
) {
397 if (CompareGuid (&VariableInfo
->VendorGuid
, &VendorGuid
)) {
398 NameSize
= StrSize (VariableInfo
->Name
);
399 if (NameSize
<= InfoNameMaxSize
) {
400 if (CompareMem (VariableInfo
->Name
, InfoName
, NameSize
) == 0) {
402 // Find the match one
404 VariableInfo
= VariableInfo
->Next
;
409 VariableInfo
= VariableInfo
->Next
;
412 if (VariableInfo
== NULL
) {
418 // Output the new variable info
420 NameSize
= StrSize (VariableInfo
->Name
);
421 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + NameSize
;
422 if (*InfoSize
< StatisticsInfoSize
) {
423 *InfoSize
= StatisticsInfoSize
;
424 return EFI_BUFFER_TOO_SMALL
;
427 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
428 CopyMem (InfoName
, VariableInfo
->Name
, NameSize
);
429 *InfoSize
= StatisticsInfoSize
;
436 Communication service SMI Handler entry.
438 This SMI handler provides services for the variable wrapper driver.
440 Caution: This function may receive untrusted input.
441 This variable data and communicate buffer are external input, so this function will do basic validation.
442 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
443 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
444 SmmVariableGetStatistics() should also do validation based on its own knowledge.
446 @param[in] DispatchHandle The unique handle assigned to this handler by SmiHandlerRegister().
447 @param[in] RegisterContext Points to an optional handler context which was specified when the
448 handler was registered.
449 @param[in, out] CommBuffer A pointer to a collection of data in memory that will
450 be conveyed from a non-SMM environment into an SMM environment.
451 @param[in, out] CommBufferSize The size of the CommBuffer.
453 @retval EFI_SUCCESS The interrupt was handled and quiesced. No other handlers
454 should still be called.
455 @retval EFI_WARN_INTERRUPT_SOURCE_QUIESCED The interrupt has been quiesced but other handlers should
457 @retval EFI_WARN_INTERRUPT_SOURCE_PENDING The interrupt is still pending and other handlers should still
459 @retval EFI_INTERRUPT_PENDING The interrupt could not be quiesced.
464 IN EFI_HANDLE DispatchHandle
,
465 IN CONST VOID
*RegisterContext
,
466 IN OUT VOID
*CommBuffer
,
467 IN OUT UINTN
*CommBufferSize
471 SMM_VARIABLE_COMMUNICATE_HEADER
*SmmVariableFunctionHeader
;
472 SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*SmmVariableHeader
;
473 SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*GetNextVariableName
;
474 SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*QueryVariableInfo
;
475 SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE
*GetPayloadSize
;
476 VARIABLE_INFO_ENTRY
*VariableInfo
;
477 SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE
*VariableToLock
;
478 SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*CommVariableProperty
;
480 UINTN NameBufferSize
;
481 UINTN CommBufferPayloadSize
;
482 UINTN TempCommBufferSize
;
485 // If input is invalid, stop processing this SMI
487 if (CommBuffer
== NULL
|| CommBufferSize
== NULL
) {
491 TempCommBufferSize
= *CommBufferSize
;
493 if (TempCommBufferSize
< SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
) {
494 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer size invalid!\n"));
497 CommBufferPayloadSize
= TempCommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
498 if (CommBufferPayloadSize
> mVariableBufferPayloadSize
) {
499 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer payload size invalid!\n"));
503 if (!SmmIsBufferOutsideSmmValid ((UINTN
)CommBuffer
, TempCommBufferSize
)) {
504 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer in SMRAM or overflow!\n"));
508 SmmVariableFunctionHeader
= (SMM_VARIABLE_COMMUNICATE_HEADER
*)CommBuffer
;
509 switch (SmmVariableFunctionHeader
->Function
) {
510 case SMM_VARIABLE_FUNCTION_GET_VARIABLE
:
511 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) {
512 DEBUG ((EFI_D_ERROR
, "GetVariable: SMM communication buffer size invalid!\n"));
516 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
518 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
519 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) mVariableBufferPayload
;
520 if (((UINTN
)(~0) - SmmVariableHeader
->DataSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) ||
521 ((UINTN
)(~0) - SmmVariableHeader
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
) + SmmVariableHeader
->DataSize
)) {
523 // Prevent InfoSize overflow happen
525 Status
= EFI_ACCESS_DENIED
;
528 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
529 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
532 // SMRAM range check already covered before
534 if (InfoSize
> CommBufferPayloadSize
) {
535 DEBUG ((EFI_D_ERROR
, "GetVariable: Data size exceed communication buffer size limit!\n"));
536 Status
= EFI_ACCESS_DENIED
;
540 if (SmmVariableHeader
->NameSize
< sizeof (CHAR16
) || SmmVariableHeader
->Name
[SmmVariableHeader
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
542 // Make sure VariableName is A Null-terminated string.
544 Status
= EFI_ACCESS_DENIED
;
548 Status
= VariableServiceGetVariable (
549 SmmVariableHeader
->Name
,
550 &SmmVariableHeader
->Guid
,
551 &SmmVariableHeader
->Attributes
,
552 &SmmVariableHeader
->DataSize
,
553 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
555 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
558 case SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME
:
559 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
)) {
560 DEBUG ((EFI_D_ERROR
, "GetNextVariableName: SMM communication buffer size invalid!\n"));
564 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
566 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
567 GetNextVariableName
= (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*) mVariableBufferPayload
;
568 if ((UINTN
)(~0) - GetNextVariableName
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
)) {
570 // Prevent InfoSize overflow happen
572 Status
= EFI_ACCESS_DENIED
;
575 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
) + GetNextVariableName
->NameSize
;
578 // SMRAM range check already covered before
580 if (InfoSize
> CommBufferPayloadSize
) {
581 DEBUG ((EFI_D_ERROR
, "GetNextVariableName: Data size exceed communication buffer size limit!\n"));
582 Status
= EFI_ACCESS_DENIED
;
586 NameBufferSize
= CommBufferPayloadSize
- OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
);
587 if (NameBufferSize
< sizeof (CHAR16
) || GetNextVariableName
->Name
[NameBufferSize
/sizeof (CHAR16
) - 1] != L
'\0') {
589 // Make sure input VariableName is A Null-terminated string.
591 Status
= EFI_ACCESS_DENIED
;
595 Status
= VariableServiceGetNextVariableName (
596 &GetNextVariableName
->NameSize
,
597 GetNextVariableName
->Name
,
598 &GetNextVariableName
->Guid
600 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
603 case SMM_VARIABLE_FUNCTION_SET_VARIABLE
:
604 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) {
605 DEBUG ((EFI_D_ERROR
, "SetVariable: SMM communication buffer size invalid!\n"));
609 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
611 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
612 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) mVariableBufferPayload
;
613 if (((UINTN
)(~0) - SmmVariableHeader
->DataSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) ||
614 ((UINTN
)(~0) - SmmVariableHeader
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
) + SmmVariableHeader
->DataSize
)) {
616 // Prevent InfoSize overflow happen
618 Status
= EFI_ACCESS_DENIED
;
621 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
622 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
625 // SMRAM range check already covered before
626 // Data buffer should not contain SMM range
628 if (InfoSize
> CommBufferPayloadSize
) {
629 DEBUG ((EFI_D_ERROR
, "SetVariable: Data size exceed communication buffer size limit!\n"));
630 Status
= EFI_ACCESS_DENIED
;
634 if (SmmVariableHeader
->NameSize
< sizeof (CHAR16
) || SmmVariableHeader
->Name
[SmmVariableHeader
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
636 // Make sure VariableName is A Null-terminated string.
638 Status
= EFI_ACCESS_DENIED
;
642 Status
= VariableServiceSetVariable (
643 SmmVariableHeader
->Name
,
644 &SmmVariableHeader
->Guid
,
645 SmmVariableHeader
->Attributes
,
646 SmmVariableHeader
->DataSize
,
647 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
651 case SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO
:
652 if (CommBufferPayloadSize
< sizeof (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
)) {
653 DEBUG ((EFI_D_ERROR
, "QueryVariableInfo: SMM communication buffer size invalid!\n"));
656 QueryVariableInfo
= (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*) SmmVariableFunctionHeader
->Data
;
658 Status
= VariableServiceQueryVariableInfo (
659 QueryVariableInfo
->Attributes
,
660 &QueryVariableInfo
->MaximumVariableStorageSize
,
661 &QueryVariableInfo
->RemainingVariableStorageSize
,
662 &QueryVariableInfo
->MaximumVariableSize
666 case SMM_VARIABLE_FUNCTION_GET_PAYLOAD_SIZE
:
667 if (CommBufferPayloadSize
< sizeof (SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE
)) {
668 DEBUG ((EFI_D_ERROR
, "GetPayloadSize: SMM communication buffer size invalid!\n"));
671 GetPayloadSize
= (SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE
*) SmmVariableFunctionHeader
->Data
;
672 GetPayloadSize
->VariablePayloadSize
= mVariableBufferPayloadSize
;
673 Status
= EFI_SUCCESS
;
676 case SMM_VARIABLE_FUNCTION_READY_TO_BOOT
:
678 Status
= EFI_UNSUPPORTED
;
682 MorLockInitAtEndOfDxe ();
684 VarCheckLibInitializeAtEndOfDxe (NULL
);
686 // The initialization for variable quota.
688 InitializeVariableQuota ();
691 Status
= EFI_SUCCESS
;
694 case SMM_VARIABLE_FUNCTION_EXIT_BOOT_SERVICE
:
696 Status
= EFI_SUCCESS
;
699 case SMM_VARIABLE_FUNCTION_GET_STATISTICS
:
700 VariableInfo
= (VARIABLE_INFO_ENTRY
*) SmmVariableFunctionHeader
->Data
;
701 InfoSize
= TempCommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
704 // Do not need to check SmmVariableFunctionHeader->Data in SMRAM here.
705 // It is covered by previous CommBuffer check
709 // Do not need to check CommBufferSize buffer as it should point to SMRAM
710 // that was used by SMM core to cache CommSize from SmmCommunication protocol.
713 Status
= SmmVariableGetStatistics (VariableInfo
, &InfoSize
);
714 *CommBufferSize
= InfoSize
+ SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
717 case SMM_VARIABLE_FUNCTION_LOCK_VARIABLE
:
719 Status
= EFI_ACCESS_DENIED
;
721 VariableToLock
= (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE
*) SmmVariableFunctionHeader
->Data
;
722 Status
= VariableLockRequestToLock (
724 VariableToLock
->Name
,
725 &VariableToLock
->Guid
729 case SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_SET
:
731 Status
= EFI_ACCESS_DENIED
;
733 CommVariableProperty
= (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*) SmmVariableFunctionHeader
->Data
;
734 Status
= VarCheckVariablePropertySet (
735 CommVariableProperty
->Name
,
736 &CommVariableProperty
->Guid
,
737 &CommVariableProperty
->VariableProperty
741 case SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_GET
:
742 if (CommBufferPayloadSize
< OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
)) {
743 DEBUG ((EFI_D_ERROR
, "VarCheckVariablePropertyGet: SMM communication buffer size invalid!\n"));
747 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
749 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
750 CommVariableProperty
= (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*) mVariableBufferPayload
;
751 if ((UINTN
) (~0) - CommVariableProperty
->NameSize
< OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
)) {
753 // Prevent InfoSize overflow happen
755 Status
= EFI_ACCESS_DENIED
;
758 InfoSize
= OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
) + CommVariableProperty
->NameSize
;
761 // SMRAM range check already covered before
763 if (InfoSize
> CommBufferPayloadSize
) {
764 DEBUG ((EFI_D_ERROR
, "VarCheckVariablePropertyGet: Data size exceed communication buffer size limit!\n"));
765 Status
= EFI_ACCESS_DENIED
;
769 if (CommVariableProperty
->NameSize
< sizeof (CHAR16
) || CommVariableProperty
->Name
[CommVariableProperty
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
771 // Make sure VariableName is A Null-terminated string.
773 Status
= EFI_ACCESS_DENIED
;
777 Status
= VarCheckVariablePropertyGet (
778 CommVariableProperty
->Name
,
779 &CommVariableProperty
->Guid
,
780 &CommVariableProperty
->VariableProperty
782 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
786 Status
= EFI_UNSUPPORTED
;
791 SmmVariableFunctionHeader
->ReturnStatus
= Status
;
797 SMM END_OF_DXE protocol notification event handler.
799 @param Protocol Points to the protocol's unique identifier
800 @param Interface Points to the interface instance
801 @param Handle The handle on which the interface was installed
803 @retval EFI_SUCCESS SmmEndOfDxeCallback runs successfully
808 SmmEndOfDxeCallback (
809 IN CONST EFI_GUID
*Protocol
,
814 DEBUG ((EFI_D_INFO
, "[Variable]SMM_END_OF_DXE is signaled\n"));
815 MorLockInitAtEndOfDxe ();
817 VarCheckLibInitializeAtEndOfDxe (NULL
);
819 // The initialization for variable quota.
821 InitializeVariableQuota ();
822 if (PcdGetBool (PcdReclaimVariableSpaceAtEndOfDxe
)) {
830 SMM Fault Tolerant Write protocol notification event handler.
832 Non-Volatile variable write may needs FTW protocol to reclaim when
835 @param Protocol Points to the protocol's unique identifier
836 @param Interface Points to the interface instance
837 @param Handle The handle on which the interface was installed
839 @retval EFI_SUCCESS SmmEventCallback runs successfully
840 @retval EFI_NOT_FOUND The Fvb protocol for variable is not found.
845 SmmFtwNotificationEvent (
846 IN CONST EFI_GUID
*Protocol
,
852 EFI_SMM_FIRMWARE_VOLUME_BLOCK_PROTOCOL
*FvbProtocol
;
853 EFI_SMM_FAULT_TOLERANT_WRITE_PROTOCOL
*FtwProtocol
;
854 EFI_PHYSICAL_ADDRESS NvStorageVariableBase
;
855 UINTN FtwMaxBlockSize
;
857 if (mVariableModuleGlobal
->FvbInstance
!= NULL
) {
862 // Ensure SMM FTW protocol is installed.
864 Status
= GetFtwProtocol ((VOID
**)&FtwProtocol
);
865 if (EFI_ERROR (Status
)) {
869 Status
= FtwProtocol
->GetMaxBlockSize (FtwProtocol
, &FtwMaxBlockSize
);
870 if (!EFI_ERROR (Status
)) {
871 ASSERT (PcdGet32 (PcdFlashNvStorageVariableSize
) <= FtwMaxBlockSize
);
875 // Find the proper FVB protocol for variable.
877 NvStorageVariableBase
= (EFI_PHYSICAL_ADDRESS
) PcdGet64 (PcdFlashNvStorageVariableBase64
);
878 if (NvStorageVariableBase
== 0) {
879 NvStorageVariableBase
= (EFI_PHYSICAL_ADDRESS
) PcdGet32 (PcdFlashNvStorageVariableBase
);
881 Status
= GetFvbInfoByAddress (NvStorageVariableBase
, NULL
, &FvbProtocol
);
882 if (EFI_ERROR (Status
)) {
883 return EFI_NOT_FOUND
;
886 mVariableModuleGlobal
->FvbInstance
= FvbProtocol
;
888 Status
= VariableWriteServiceInitialize ();
889 if (EFI_ERROR (Status
)) {
890 DEBUG ((DEBUG_ERROR
, "Variable write service initialization failed. Status = %r\n", Status
));
894 // Notify the variable wrapper driver the variable write service is ready
896 Status
= gBS
->InstallProtocolInterface (
898 &gSmmVariableWriteGuid
,
899 EFI_NATIVE_INTERFACE
,
902 ASSERT_EFI_ERROR (Status
);
909 Variable Driver main entry point. The Variable driver places the 4 EFI
910 runtime services in the EFI System Table and installs arch protocols
911 for variable read and write services being available. It also registers
912 a notification function for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
914 @param[in] ImageHandle The firmware allocated handle for the EFI image.
915 @param[in] SystemTable A pointer to the EFI System Table.
917 @retval EFI_SUCCESS Variable service successfully initialized.
922 VariableServiceInitialize (
923 IN EFI_HANDLE ImageHandle
,
924 IN EFI_SYSTEM_TABLE
*SystemTable
928 EFI_HANDLE VariableHandle
;
929 VOID
*SmmFtwRegistration
;
930 VOID
*SmmEndOfDxeRegistration
;
933 // Variable initialize.
935 Status
= VariableCommonInitialize ();
936 ASSERT_EFI_ERROR (Status
);
939 // Install the Smm Variable Protocol on a new handle.
941 VariableHandle
= NULL
;
942 Status
= gSmst
->SmmInstallProtocolInterface (
944 &gEfiSmmVariableProtocolGuid
,
945 EFI_NATIVE_INTERFACE
,
948 ASSERT_EFI_ERROR (Status
);
950 Status
= gSmst
->SmmInstallProtocolInterface (
952 &gEdkiiSmmVarCheckProtocolGuid
,
953 EFI_NATIVE_INTERFACE
,
956 ASSERT_EFI_ERROR (Status
);
958 mVariableBufferPayloadSize
= GetMaxVariableSize () +
959 OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
) - GetVariableHeaderSize ();
961 Status
= gSmst
->SmmAllocatePool (
962 EfiRuntimeServicesData
,
963 mVariableBufferPayloadSize
,
964 (VOID
**)&mVariableBufferPayload
966 ASSERT_EFI_ERROR (Status
);
969 /// Register SMM variable SMI handler
971 VariableHandle
= NULL
;
972 Status
= gSmst
->SmiHandlerRegister (SmmVariableHandler
, &gEfiSmmVariableProtocolGuid
, &VariableHandle
);
973 ASSERT_EFI_ERROR (Status
);
976 // Notify the variable wrapper driver the variable service is ready
978 Status
= SystemTable
->BootServices
->InstallProtocolInterface (
980 &gEfiSmmVariableProtocolGuid
,
981 EFI_NATIVE_INTERFACE
,
984 ASSERT_EFI_ERROR (Status
);
987 // Register EFI_SMM_END_OF_DXE_PROTOCOL_GUID notify function.
989 Status
= gSmst
->SmmRegisterProtocolNotify (
990 &gEfiSmmEndOfDxeProtocolGuid
,
992 &SmmEndOfDxeRegistration
994 ASSERT_EFI_ERROR (Status
);
997 // Register FtwNotificationEvent () notify function.
999 Status
= gSmst
->SmmRegisterProtocolNotify (
1000 &gEfiSmmFaultTolerantWriteProtocolGuid
,
1001 SmmFtwNotificationEvent
,
1004 ASSERT_EFI_ERROR (Status
);
1006 SmmFtwNotificationEvent (NULL
, NULL
, NULL
);