2 The sample implementation for SMM variable protocol. And this driver
3 implements an SMI handler to communicate with the DXE runtime driver
4 to provide variable services.
6 Caution: This module requires additional review when modified.
7 This driver will have external input - variable data and communicate buffer in SMM mode.
8 This external input must be validated carefully to avoid security issue like
9 buffer overflow, integer overflow.
11 SmmVariableHandler() will receive untrusted input and do basic validation.
13 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
14 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
15 SmmVariableGetStatistics() should also do validation based on its own knowledge.
17 Copyright (c) 2010 - 2019, Intel Corporation. All rights reserved.<BR>
18 Copyright (c) 2018, Linaro, Ltd. All rights reserved.<BR>
19 This program and the accompanying materials
20 are licensed and made available under the terms and conditions of the BSD License
21 which accompanies this distribution. The full text of the license may be found at
22 http://opensource.org/licenses/bsd-license.php
24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
29 #include <Protocol/SmmVariable.h>
30 #include <Protocol/SmmFirmwareVolumeBlock.h>
31 #include <Protocol/SmmFaultTolerantWrite.h>
32 #include <Protocol/MmEndOfDxe.h>
33 #include <Protocol/SmmVarCheck.h>
35 #include <Library/MmServicesTableLib.h>
37 #include <Guid/SmmVariableCommon.h>
40 BOOLEAN mAtRuntime
= FALSE
;
41 UINT8
*mVariableBufferPayload
= NULL
;
42 UINTN mVariableBufferPayloadSize
;
45 SecureBoot Hook for SetVariable.
47 @param[in] VariableName Name of Variable to be found.
48 @param[in] VendorGuid Variable vendor GUID.
54 IN CHAR16
*VariableName
,
55 IN EFI_GUID
*VendorGuid
63 This code sets variable in storage blocks (Volatile or Non-Volatile).
65 @param VariableName Name of Variable to be found.
66 @param VendorGuid Variable vendor GUID.
67 @param Attributes Attribute value of the variable found
68 @param DataSize Size of Data found. If size is less than the
69 data, this value contains the required size.
70 @param Data Data pointer.
72 @return EFI_INVALID_PARAMETER Invalid parameter.
73 @return EFI_SUCCESS Set successfully.
74 @return EFI_OUT_OF_RESOURCES Resource not enough to set variable.
75 @return EFI_NOT_FOUND Not found.
76 @return EFI_WRITE_PROTECTED Variable is read-only.
81 SmmVariableSetVariable (
82 IN CHAR16
*VariableName
,
83 IN EFI_GUID
*VendorGuid
,
92 // Disable write protection when the calling SetVariable() through EFI_SMM_VARIABLE_PROTOCOL.
94 mRequestSource
= VarCheckFromTrusted
;
95 Status
= VariableServiceSetVariable (
102 mRequestSource
= VarCheckFromUntrusted
;
106 EFI_SMM_VARIABLE_PROTOCOL gSmmVariable
= {
107 VariableServiceGetVariable
,
108 VariableServiceGetNextVariableName
,
109 SmmVariableSetVariable
,
110 VariableServiceQueryVariableInfo
113 EDKII_SMM_VAR_CHECK_PROTOCOL mSmmVarCheck
= { VarCheckRegisterSetVariableCheckHandler
,
114 VarCheckVariablePropertySet
,
115 VarCheckVariablePropertyGet
};
118 Return TRUE if ExitBootServices () has been called.
120 @retval TRUE If ExitBootServices () has been called.
131 Initializes a basic mutual exclusion lock.
133 This function initializes a basic mutual exclusion lock to the released state
134 and returns the lock. Each lock provides mutual exclusion access at its task
135 priority level. Since there is no preemption or multiprocessor support in EFI,
136 acquiring the lock only consists of raising to the locks TPL.
137 If Lock is NULL, then ASSERT().
138 If Priority is not a valid TPL value, then ASSERT().
140 @param Lock A pointer to the lock data structure to initialize.
141 @param Priority EFI TPL is associated with the lock.
148 IN OUT EFI_LOCK
*Lock
,
156 Acquires lock only at boot time. Simply returns at runtime.
158 This is a temperary function that will be removed when
159 EfiAcquireLock() in UefiLib can handle the call in UEFI
160 Runtimer driver in RT phase.
161 It calls EfiAcquireLock() at boot time, and simply returns
164 @param Lock A pointer to the lock to acquire.
168 AcquireLockOnlyAtBootTime (
177 Releases lock only at boot time. Simply returns at runtime.
179 This is a temperary function which will be removed when
180 EfiReleaseLock() in UefiLib can handle the call in UEFI
181 Runtimer driver in RT phase.
182 It calls EfiReleaseLock() at boot time and simply returns
185 @param Lock A pointer to the lock to release.
189 ReleaseLockOnlyAtBootTime (
197 Retrieve the SMM Fault Tolerent Write protocol interface.
199 @param[out] FtwProtocol The interface of SMM Ftw protocol
201 @retval EFI_SUCCESS The SMM FTW protocol instance was found and returned in FtwProtocol.
202 @retval EFI_NOT_FOUND The SMM FTW protocol instance was not found.
203 @retval EFI_INVALID_PARAMETER SarProtocol is NULL.
208 OUT VOID
**FtwProtocol
214 // Locate Smm Fault Tolerent Write protocol
216 Status
= gMmst
->MmLocateProtocol (
217 &gEfiSmmFaultTolerantWriteProtocolGuid
,
226 Retrieve the SMM FVB protocol interface by HANDLE.
228 @param[in] FvBlockHandle The handle of SMM FVB protocol that provides services for
229 reading, writing, and erasing the target block.
230 @param[out] FvBlock The interface of SMM FVB protocol
232 @retval EFI_SUCCESS The interface information for the specified protocol was returned.
233 @retval EFI_UNSUPPORTED The device does not support the SMM FVB protocol.
234 @retval EFI_INVALID_PARAMETER FvBlockHandle is not a valid EFI_HANDLE or FvBlock is NULL.
239 IN EFI_HANDLE FvBlockHandle
,
240 OUT EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL
**FvBlock
244 // To get the SMM FVB protocol interface on the handle
246 return gMmst
->MmHandleProtocol (
248 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
255 Function returns an array of handles that support the SMM FVB protocol
256 in a buffer allocated from pool.
258 @param[out] NumberHandles The number of handles returned in Buffer.
259 @param[out] Buffer A pointer to the buffer to return the requested
260 array of handles that support SMM FVB protocol.
262 @retval EFI_SUCCESS The array of handles was returned in Buffer, and the number of
263 handles in Buffer was returned in NumberHandles.
264 @retval EFI_NOT_FOUND No SMM FVB handle was found.
265 @retval EFI_OUT_OF_RESOURCES There is not enough pool memory to store the matching results.
266 @retval EFI_INVALID_PARAMETER NumberHandles is NULL or Buffer is NULL.
270 GetFvbCountAndBuffer (
271 OUT UINTN
*NumberHandles
,
272 OUT EFI_HANDLE
**Buffer
278 if ((NumberHandles
== NULL
) || (Buffer
== NULL
)) {
279 return EFI_INVALID_PARAMETER
;
285 Status
= gMmst
->MmLocateHandle (
287 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
292 if (EFI_ERROR(Status
) && Status
!= EFI_BUFFER_TOO_SMALL
) {
293 return EFI_NOT_FOUND
;
296 *Buffer
= AllocatePool (BufferSize
);
297 if (*Buffer
== NULL
) {
298 return EFI_OUT_OF_RESOURCES
;
301 Status
= gMmst
->MmLocateHandle (
303 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
309 *NumberHandles
= BufferSize
/ sizeof(EFI_HANDLE
);
310 if (EFI_ERROR(Status
)) {
321 Get the variable statistics information from the information buffer pointed by gVariableInfo.
323 Caution: This function may be invoked at SMM runtime.
324 InfoEntry and InfoSize are external input. Care must be taken to make sure not security issue at runtime.
326 @param[in, out] InfoEntry A pointer to the buffer of variable information entry.
327 On input, point to the variable information returned last time. if
328 InfoEntry->VendorGuid is zero, return the first information.
329 On output, point to the next variable information.
330 @param[in, out] InfoSize On input, the size of the variable information buffer.
331 On output, the returned variable information size.
333 @retval EFI_SUCCESS The variable information is found and returned successfully.
334 @retval EFI_UNSUPPORTED No variable inoformation exists in variable driver. The
335 PcdVariableCollectStatistics should be set TRUE to support it.
336 @retval EFI_BUFFER_TOO_SMALL The buffer is too small to hold the next variable information.
337 @retval EFI_INVALID_PARAMETER Input parameter is invalid.
341 SmmVariableGetStatistics (
342 IN OUT VARIABLE_INFO_ENTRY
*InfoEntry
,
343 IN OUT UINTN
*InfoSize
346 VARIABLE_INFO_ENTRY
*VariableInfo
;
348 UINTN StatisticsInfoSize
;
350 UINTN InfoNameMaxSize
;
353 if (InfoEntry
== NULL
) {
354 return EFI_INVALID_PARAMETER
;
357 VariableInfo
= gVariableInfo
;
358 if (VariableInfo
== NULL
) {
359 return EFI_UNSUPPORTED
;
362 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
);
363 if (*InfoSize
< StatisticsInfoSize
) {
364 *InfoSize
= StatisticsInfoSize
;
365 return EFI_BUFFER_TOO_SMALL
;
367 InfoName
= (CHAR16
*)(InfoEntry
+ 1);
368 InfoNameMaxSize
= (*InfoSize
- sizeof (VARIABLE_INFO_ENTRY
));
370 CopyGuid (&VendorGuid
, &InfoEntry
->VendorGuid
);
372 if (IsZeroGuid (&VendorGuid
)) {
374 // Return the first variable info
376 NameSize
= StrSize (VariableInfo
->Name
);
377 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + NameSize
;
378 if (*InfoSize
< StatisticsInfoSize
) {
379 *InfoSize
= StatisticsInfoSize
;
380 return EFI_BUFFER_TOO_SMALL
;
382 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
383 CopyMem (InfoName
, VariableInfo
->Name
, NameSize
);
384 *InfoSize
= StatisticsInfoSize
;
389 // Get the next variable info
391 while (VariableInfo
!= NULL
) {
392 if (CompareGuid (&VariableInfo
->VendorGuid
, &VendorGuid
)) {
393 NameSize
= StrSize (VariableInfo
->Name
);
394 if (NameSize
<= InfoNameMaxSize
) {
395 if (CompareMem (VariableInfo
->Name
, InfoName
, NameSize
) == 0) {
397 // Find the match one
399 VariableInfo
= VariableInfo
->Next
;
404 VariableInfo
= VariableInfo
->Next
;
407 if (VariableInfo
== NULL
) {
413 // Output the new variable info
415 NameSize
= StrSize (VariableInfo
->Name
);
416 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + NameSize
;
417 if (*InfoSize
< StatisticsInfoSize
) {
418 *InfoSize
= StatisticsInfoSize
;
419 return EFI_BUFFER_TOO_SMALL
;
422 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
423 CopyMem (InfoName
, VariableInfo
->Name
, NameSize
);
424 *InfoSize
= StatisticsInfoSize
;
431 Communication service SMI Handler entry.
433 This SMI handler provides services for the variable wrapper driver.
435 Caution: This function may receive untrusted input.
436 This variable data and communicate buffer are external input, so this function will do basic validation.
437 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
438 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
439 SmmVariableGetStatistics() should also do validation based on its own knowledge.
441 @param[in] DispatchHandle The unique handle assigned to this handler by SmiHandlerRegister().
442 @param[in] RegisterContext Points to an optional handler context which was specified when the
443 handler was registered.
444 @param[in, out] CommBuffer A pointer to a collection of data in memory that will
445 be conveyed from a non-SMM environment into an SMM environment.
446 @param[in, out] CommBufferSize The size of the CommBuffer.
448 @retval EFI_SUCCESS The interrupt was handled and quiesced. No other handlers
449 should still be called.
450 @retval EFI_WARN_INTERRUPT_SOURCE_QUIESCED The interrupt has been quiesced but other handlers should
452 @retval EFI_WARN_INTERRUPT_SOURCE_PENDING The interrupt is still pending and other handlers should still
454 @retval EFI_INTERRUPT_PENDING The interrupt could not be quiesced.
459 IN EFI_HANDLE DispatchHandle
,
460 IN CONST VOID
*RegisterContext
,
461 IN OUT VOID
*CommBuffer
,
462 IN OUT UINTN
*CommBufferSize
466 SMM_VARIABLE_COMMUNICATE_HEADER
*SmmVariableFunctionHeader
;
467 SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*SmmVariableHeader
;
468 SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*GetNextVariableName
;
469 SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*QueryVariableInfo
;
470 SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE
*GetPayloadSize
;
471 VARIABLE_INFO_ENTRY
*VariableInfo
;
472 SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE
*VariableToLock
;
473 SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*CommVariableProperty
;
475 UINTN NameBufferSize
;
476 UINTN CommBufferPayloadSize
;
477 UINTN TempCommBufferSize
;
480 // If input is invalid, stop processing this SMI
482 if (CommBuffer
== NULL
|| CommBufferSize
== NULL
) {
486 TempCommBufferSize
= *CommBufferSize
;
488 if (TempCommBufferSize
< SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
) {
489 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer size invalid!\n"));
492 CommBufferPayloadSize
= TempCommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
493 if (CommBufferPayloadSize
> mVariableBufferPayloadSize
) {
494 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer payload size invalid!\n"));
498 if (!VariableSmmIsBufferOutsideSmmValid ((UINTN
)CommBuffer
, TempCommBufferSize
)) {
499 DEBUG ((EFI_D_ERROR
, "SmmVariableHandler: SMM communication buffer in SMRAM or overflow!\n"));
503 SmmVariableFunctionHeader
= (SMM_VARIABLE_COMMUNICATE_HEADER
*)CommBuffer
;
504 switch (SmmVariableFunctionHeader
->Function
) {
505 case SMM_VARIABLE_FUNCTION_GET_VARIABLE
:
506 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) {
507 DEBUG ((EFI_D_ERROR
, "GetVariable: SMM communication buffer size invalid!\n"));
511 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
513 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
514 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) mVariableBufferPayload
;
515 if (((UINTN
)(~0) - SmmVariableHeader
->DataSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) ||
516 ((UINTN
)(~0) - SmmVariableHeader
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
) + SmmVariableHeader
->DataSize
)) {
518 // Prevent InfoSize overflow happen
520 Status
= EFI_ACCESS_DENIED
;
523 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
524 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
527 // SMRAM range check already covered before
529 if (InfoSize
> CommBufferPayloadSize
) {
530 DEBUG ((EFI_D_ERROR
, "GetVariable: Data size exceed communication buffer size limit!\n"));
531 Status
= EFI_ACCESS_DENIED
;
536 // The VariableSpeculationBarrier() call here is to ensure the previous
537 // range/content checks for the CommBuffer have been completed before the
538 // subsequent consumption of the CommBuffer content.
540 VariableSpeculationBarrier ();
541 if (SmmVariableHeader
->NameSize
< sizeof (CHAR16
) || SmmVariableHeader
->Name
[SmmVariableHeader
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
543 // Make sure VariableName is A Null-terminated string.
545 Status
= EFI_ACCESS_DENIED
;
549 Status
= VariableServiceGetVariable (
550 SmmVariableHeader
->Name
,
551 &SmmVariableHeader
->Guid
,
552 &SmmVariableHeader
->Attributes
,
553 &SmmVariableHeader
->DataSize
,
554 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
556 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
559 case SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME
:
560 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
)) {
561 DEBUG ((EFI_D_ERROR
, "GetNextVariableName: SMM communication buffer size invalid!\n"));
565 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
567 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
568 GetNextVariableName
= (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*) mVariableBufferPayload
;
569 if ((UINTN
)(~0) - GetNextVariableName
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
)) {
571 // Prevent InfoSize overflow happen
573 Status
= EFI_ACCESS_DENIED
;
576 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
) + GetNextVariableName
->NameSize
;
579 // SMRAM range check already covered before
581 if (InfoSize
> CommBufferPayloadSize
) {
582 DEBUG ((EFI_D_ERROR
, "GetNextVariableName: Data size exceed communication buffer size limit!\n"));
583 Status
= EFI_ACCESS_DENIED
;
587 NameBufferSize
= CommBufferPayloadSize
- OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
);
588 if (NameBufferSize
< sizeof (CHAR16
) || GetNextVariableName
->Name
[NameBufferSize
/sizeof (CHAR16
) - 1] != L
'\0') {
590 // Make sure input VariableName is A Null-terminated string.
592 Status
= EFI_ACCESS_DENIED
;
596 Status
= VariableServiceGetNextVariableName (
597 &GetNextVariableName
->NameSize
,
598 GetNextVariableName
->Name
,
599 &GetNextVariableName
->Guid
601 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
604 case SMM_VARIABLE_FUNCTION_SET_VARIABLE
:
605 if (CommBufferPayloadSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) {
606 DEBUG ((EFI_D_ERROR
, "SetVariable: SMM communication buffer size invalid!\n"));
610 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
612 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
613 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) mVariableBufferPayload
;
614 if (((UINTN
)(~0) - SmmVariableHeader
->DataSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)) ||
615 ((UINTN
)(~0) - SmmVariableHeader
->NameSize
< OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
) + SmmVariableHeader
->DataSize
)) {
617 // Prevent InfoSize overflow happen
619 Status
= EFI_ACCESS_DENIED
;
622 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
623 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
626 // SMRAM range check already covered before
627 // Data buffer should not contain SMM range
629 if (InfoSize
> CommBufferPayloadSize
) {
630 DEBUG ((EFI_D_ERROR
, "SetVariable: Data size exceed communication buffer size limit!\n"));
631 Status
= EFI_ACCESS_DENIED
;
636 // The VariableSpeculationBarrier() call here is to ensure the previous
637 // range/content checks for the CommBuffer have been completed before the
638 // subsequent consumption of the CommBuffer content.
640 VariableSpeculationBarrier ();
641 if (SmmVariableHeader
->NameSize
< sizeof (CHAR16
) || SmmVariableHeader
->Name
[SmmVariableHeader
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
643 // Make sure VariableName is A Null-terminated string.
645 Status
= EFI_ACCESS_DENIED
;
649 Status
= VariableServiceSetVariable (
650 SmmVariableHeader
->Name
,
651 &SmmVariableHeader
->Guid
,
652 SmmVariableHeader
->Attributes
,
653 SmmVariableHeader
->DataSize
,
654 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
658 case SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO
:
659 if (CommBufferPayloadSize
< sizeof (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
)) {
660 DEBUG ((EFI_D_ERROR
, "QueryVariableInfo: SMM communication buffer size invalid!\n"));
663 QueryVariableInfo
= (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*) SmmVariableFunctionHeader
->Data
;
665 Status
= VariableServiceQueryVariableInfo (
666 QueryVariableInfo
->Attributes
,
667 &QueryVariableInfo
->MaximumVariableStorageSize
,
668 &QueryVariableInfo
->RemainingVariableStorageSize
,
669 &QueryVariableInfo
->MaximumVariableSize
673 case SMM_VARIABLE_FUNCTION_GET_PAYLOAD_SIZE
:
674 if (CommBufferPayloadSize
< sizeof (SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE
)) {
675 DEBUG ((EFI_D_ERROR
, "GetPayloadSize: SMM communication buffer size invalid!\n"));
678 GetPayloadSize
= (SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE
*) SmmVariableFunctionHeader
->Data
;
679 GetPayloadSize
->VariablePayloadSize
= mVariableBufferPayloadSize
;
680 Status
= EFI_SUCCESS
;
683 case SMM_VARIABLE_FUNCTION_READY_TO_BOOT
:
685 Status
= EFI_UNSUPPORTED
;
689 MorLockInitAtEndOfDxe ();
691 VarCheckLibInitializeAtEndOfDxe (NULL
);
693 // The initialization for variable quota.
695 InitializeVariableQuota ();
698 Status
= EFI_SUCCESS
;
701 case SMM_VARIABLE_FUNCTION_EXIT_BOOT_SERVICE
:
703 Status
= EFI_SUCCESS
;
706 case SMM_VARIABLE_FUNCTION_GET_STATISTICS
:
707 VariableInfo
= (VARIABLE_INFO_ENTRY
*) SmmVariableFunctionHeader
->Data
;
708 InfoSize
= TempCommBufferSize
- SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
711 // Do not need to check SmmVariableFunctionHeader->Data in SMRAM here.
712 // It is covered by previous CommBuffer check
716 // Do not need to check CommBufferSize buffer as it should point to SMRAM
717 // that was used by SMM core to cache CommSize from SmmCommunication protocol.
720 Status
= SmmVariableGetStatistics (VariableInfo
, &InfoSize
);
721 *CommBufferSize
= InfoSize
+ SMM_VARIABLE_COMMUNICATE_HEADER_SIZE
;
724 case SMM_VARIABLE_FUNCTION_LOCK_VARIABLE
:
726 Status
= EFI_ACCESS_DENIED
;
728 VariableToLock
= (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE
*) SmmVariableFunctionHeader
->Data
;
729 Status
= VariableLockRequestToLock (
731 VariableToLock
->Name
,
732 &VariableToLock
->Guid
736 case SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_SET
:
738 Status
= EFI_ACCESS_DENIED
;
740 CommVariableProperty
= (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*) SmmVariableFunctionHeader
->Data
;
741 Status
= VarCheckVariablePropertySet (
742 CommVariableProperty
->Name
,
743 &CommVariableProperty
->Guid
,
744 &CommVariableProperty
->VariableProperty
748 case SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_GET
:
749 if (CommBufferPayloadSize
< OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
)) {
750 DEBUG ((EFI_D_ERROR
, "VarCheckVariablePropertyGet: SMM communication buffer size invalid!\n"));
754 // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.
756 CopyMem (mVariableBufferPayload
, SmmVariableFunctionHeader
->Data
, CommBufferPayloadSize
);
757 CommVariableProperty
= (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
*) mVariableBufferPayload
;
758 if ((UINTN
) (~0) - CommVariableProperty
->NameSize
< OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
)) {
760 // Prevent InfoSize overflow happen
762 Status
= EFI_ACCESS_DENIED
;
765 InfoSize
= OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
) + CommVariableProperty
->NameSize
;
768 // SMRAM range check already covered before
770 if (InfoSize
> CommBufferPayloadSize
) {
771 DEBUG ((EFI_D_ERROR
, "VarCheckVariablePropertyGet: Data size exceed communication buffer size limit!\n"));
772 Status
= EFI_ACCESS_DENIED
;
777 // The VariableSpeculationBarrier() call here is to ensure the previous
778 // range/content checks for the CommBuffer have been completed before the
779 // subsequent consumption of the CommBuffer content.
781 VariableSpeculationBarrier ();
782 if (CommVariableProperty
->NameSize
< sizeof (CHAR16
) || CommVariableProperty
->Name
[CommVariableProperty
->NameSize
/sizeof (CHAR16
) - 1] != L
'\0') {
784 // Make sure VariableName is A Null-terminated string.
786 Status
= EFI_ACCESS_DENIED
;
790 Status
= VarCheckVariablePropertyGet (
791 CommVariableProperty
->Name
,
792 &CommVariableProperty
->Guid
,
793 &CommVariableProperty
->VariableProperty
795 CopyMem (SmmVariableFunctionHeader
->Data
, mVariableBufferPayload
, CommBufferPayloadSize
);
799 Status
= EFI_UNSUPPORTED
;
804 SmmVariableFunctionHeader
->ReturnStatus
= Status
;
810 SMM END_OF_DXE protocol notification event handler.
812 @param Protocol Points to the protocol's unique identifier
813 @param Interface Points to the interface instance
814 @param Handle The handle on which the interface was installed
816 @retval EFI_SUCCESS SmmEndOfDxeCallback runs successfully
821 SmmEndOfDxeCallback (
822 IN CONST EFI_GUID
*Protocol
,
827 DEBUG ((EFI_D_INFO
, "[Variable]SMM_END_OF_DXE is signaled\n"));
828 MorLockInitAtEndOfDxe ();
830 VarCheckLibInitializeAtEndOfDxe (NULL
);
832 // The initialization for variable quota.
834 InitializeVariableQuota ();
835 if (PcdGetBool (PcdReclaimVariableSpaceAtEndOfDxe
)) {
843 Initializes variable write service for SMM.
847 VariableWriteServiceInitializeSmm (
853 Status
= VariableWriteServiceInitialize ();
854 if (EFI_ERROR (Status
)) {
855 DEBUG ((DEBUG_ERROR
, "Variable write service initialization failed. Status = %r\n", Status
));
859 // Notify the variable wrapper driver the variable write service is ready
861 VariableNotifySmmWriteReady ();
865 SMM Fault Tolerant Write protocol notification event handler.
867 Non-Volatile variable write may needs FTW protocol to reclaim when
870 @param Protocol Points to the protocol's unique identifier
871 @param Interface Points to the interface instance
872 @param Handle The handle on which the interface was installed
874 @retval EFI_SUCCESS SmmEventCallback runs successfully
875 @retval EFI_NOT_FOUND The Fvb protocol for variable is not found.
880 SmmFtwNotificationEvent (
881 IN CONST EFI_GUID
*Protocol
,
887 EFI_PHYSICAL_ADDRESS VariableStoreBase
;
888 EFI_SMM_FIRMWARE_VOLUME_BLOCK_PROTOCOL
*FvbProtocol
;
889 EFI_SMM_FAULT_TOLERANT_WRITE_PROTOCOL
*FtwProtocol
;
890 EFI_PHYSICAL_ADDRESS NvStorageVariableBase
;
891 UINTN FtwMaxBlockSize
;
893 if (mVariableModuleGlobal
->FvbInstance
!= NULL
) {
898 // Ensure SMM FTW protocol is installed.
900 Status
= GetFtwProtocol ((VOID
**)&FtwProtocol
);
901 if (EFI_ERROR (Status
)) {
905 Status
= FtwProtocol
->GetMaxBlockSize (FtwProtocol
, &FtwMaxBlockSize
);
906 if (!EFI_ERROR (Status
)) {
907 ASSERT (PcdGet32 (PcdFlashNvStorageVariableSize
) <= FtwMaxBlockSize
);
910 NvStorageVariableBase
= NV_STORAGE_VARIABLE_BASE
;
911 VariableStoreBase
= NvStorageVariableBase
+ mNvFvHeaderCache
->HeaderLength
;
914 // Let NonVolatileVariableBase point to flash variable store base directly after FTW ready.
916 mVariableModuleGlobal
->VariableGlobal
.NonVolatileVariableBase
= VariableStoreBase
;
919 // Find the proper FVB protocol for variable.
921 Status
= GetFvbInfoByAddress (NvStorageVariableBase
, NULL
, &FvbProtocol
);
922 if (EFI_ERROR (Status
)) {
923 return EFI_NOT_FOUND
;
926 mVariableModuleGlobal
->FvbInstance
= FvbProtocol
;
929 // Initializes variable write service after FTW was ready.
931 VariableWriteServiceInitializeSmm ();
938 Variable Driver main entry point. The Variable driver places the 4 EFI
939 runtime services in the EFI System Table and installs arch protocols
940 for variable read and write services being available. It also registers
941 a notification function for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
943 @retval EFI_SUCCESS Variable service successfully initialized.
948 MmVariableServiceInitialize (
953 EFI_HANDLE VariableHandle
;
954 VOID
*SmmFtwRegistration
;
955 VOID
*SmmEndOfDxeRegistration
;
958 // Variable initialize.
960 Status
= VariableCommonInitialize ();
961 ASSERT_EFI_ERROR (Status
);
964 // Install the Smm Variable Protocol on a new handle.
966 VariableHandle
= NULL
;
967 Status
= gMmst
->MmInstallProtocolInterface (
969 &gEfiSmmVariableProtocolGuid
,
970 EFI_NATIVE_INTERFACE
,
973 ASSERT_EFI_ERROR (Status
);
975 Status
= gMmst
->MmInstallProtocolInterface (
977 &gEdkiiSmmVarCheckProtocolGuid
,
978 EFI_NATIVE_INTERFACE
,
981 ASSERT_EFI_ERROR (Status
);
983 mVariableBufferPayloadSize
= GetMaxVariableSize () +
984 OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY
, Name
) - GetVariableHeaderSize ();
986 Status
= gMmst
->MmAllocatePool (
987 EfiRuntimeServicesData
,
988 mVariableBufferPayloadSize
,
989 (VOID
**)&mVariableBufferPayload
991 ASSERT_EFI_ERROR (Status
);
994 /// Register SMM variable SMI handler
996 VariableHandle
= NULL
;
997 Status
= gMmst
->MmiHandlerRegister (SmmVariableHandler
, &gEfiSmmVariableProtocolGuid
, &VariableHandle
);
998 ASSERT_EFI_ERROR (Status
);
1001 // Notify the variable wrapper driver the variable service is ready
1003 VariableNotifySmmReady ();
1006 // Register EFI_SMM_END_OF_DXE_PROTOCOL_GUID notify function.
1008 Status
= gMmst
->MmRegisterProtocolNotify (
1009 &gEfiMmEndOfDxeProtocolGuid
,
1010 SmmEndOfDxeCallback
,
1011 &SmmEndOfDxeRegistration
1013 ASSERT_EFI_ERROR (Status
);
1016 // Register FtwNotificationEvent () notify function.
1018 Status
= gMmst
->MmRegisterProtocolNotify (
1019 &gEfiSmmFaultTolerantWriteProtocolGuid
,
1020 SmmFtwNotificationEvent
,
1023 ASSERT_EFI_ERROR (Status
);
1025 SmmFtwNotificationEvent (NULL
, NULL
, NULL
);