MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c

   1 /** @file
   2   Implement all four UEFI Runtime Variable services for the nonvolatile
   3   and volatile storage space and install variable architecture protocol
   4   based on SMM variable module.
   5
   6   Caution: This module requires additional review when modified.
   7   This driver will have external input - variable data.
   8   This external input must be validated carefully to avoid security issue like
   9   buffer overflow, integer overflow.
  10
  11   RuntimeServiceGetVariable() and RuntimeServiceSetVariable() are external API
  12   to receive data buffer. The size should be checked carefully.
  13
  14   InitCommunicateBuffer() is really function to check the variable data size.
  15
  16 Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
  17 This program and the accompanying materials
  18 are licensed and made available under the terms and conditions of the BSD License
  19 which accompanies this distribution.  The full text of the license may be found at
  20 http://opensource.org/licenses/bsd-license.php
  21
  22 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  23 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  24
  25 **/
  26 #include <PiDxe.h>
  27 #include <Protocol/VariableWrite.h>
  28 #include <Protocol/Variable.h>
  29 #include <Protocol/SmmCommunication.h>
  30 #include <Protocol/SmmVariable.h>
  31 #include <Protocol/VariableLock.h>
  32 #include <Protocol/VarCheck.h>
  33
  34 #include <Library/UefiBootServicesTableLib.h>
  35 #include <Library/UefiRuntimeServicesTableLib.h>
  36 #include <Library/MemoryAllocationLib.h>
  37 #include <Library/UefiDriverEntryPoint.h>
  38 #include <Library/UefiRuntimeLib.h>
  39 #include <Library/BaseMemoryLib.h>
  40 #include <Library/DebugLib.h>
  41 #include <Library/UefiLib.h>
  42 #include <Library/BaseLib.h>
  43
  44 #include <Guid/EventGroup.h>
  45 #include <Guid/SmmVariableCommon.h>
  46
  47 EFI_HANDLE                       mHandle                    = NULL;
  48 EFI_SMM_VARIABLE_PROTOCOL       *mSmmVariable               = NULL;
  49 EFI_EVENT                        mVirtualAddressChangeEvent = NULL;
  50 EFI_SMM_COMMUNICATION_PROTOCOL  *mSmmCommunication          = NULL;
  51 UINT8                           *mVariableBuffer            = NULL;
  52 UINT8                           *mVariableBufferPhysical    = NULL;
  53 UINTN                            mVariableBufferSize;
  54 UINTN                            mVariableBufferPayloadSize;
  55 EFI_LOCK                         mVariableServicesLock;
  56 EDKII_VARIABLE_LOCK_PROTOCOL     mVariableLock;
  57 EDKII_VAR_CHECK_PROTOCOL         mVarCheck;
  58
  59 /**
  60   SecureBoot Hook for SetVariable.
  61
  62   @param[in] VariableName                 Name of Variable to be found.
  63   @param[in] VendorGuid                   Variable vendor GUID.
  64
  65 **/
  66 VOID
  67 EFIAPI
  68 SecureBootHook (
  69   IN CHAR16                                 *VariableName,
  70   IN EFI_GUID                               *VendorGuid
  71   );
  72
  73 /**
  74   Acquires lock only at boot time. Simply returns at runtime.
  75
  76   This is a temperary function that will be removed when
  77   EfiAcquireLock() in UefiLib can handle the call in UEFI
  78   Runtimer driver in RT phase.
  79   It calls EfiAcquireLock() at boot time, and simply returns
  80   at runtime.
  81
  82   @param  Lock         A pointer to the lock to acquire.
  83
  84 **/
  85 VOID
  86 AcquireLockOnlyAtBootTime (
  87   IN EFI_LOCK                             *Lock
  88   )
  89 {
  90   if (!EfiAtRuntime ()) {
  91     EfiAcquireLock (Lock);
  92   }
  93 }
  94
  95 /**
  96   Releases lock only at boot time. Simply returns at runtime.
  97
  98   This is a temperary function which will be removed when
  99   EfiReleaseLock() in UefiLib can handle the call in UEFI
 100   Runtimer driver in RT phase.
 101   It calls EfiReleaseLock() at boot time and simply returns
 102   at runtime.
 103
 104   @param  Lock         A pointer to the lock to release.
 105
 106 **/
 107 VOID
 108 ReleaseLockOnlyAtBootTime (
 109   IN EFI_LOCK                             *Lock
 110   )
 111 {
 112   if (!EfiAtRuntime ()) {
 113     EfiReleaseLock (Lock);
 114   }
 115 }
 116
 117 /**
 118   Initialize the communicate buffer using DataSize and Function.
 119
 120   The communicate size is: SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE +
 121   DataSize.
 122
 123   Caution: This function may receive untrusted input.
 124   The data size external input, so this function will validate it carefully to avoid buffer overflow.
 125
 126   @param[out]      DataPtr          Points to the data in the communicate buffer.
 127   @param[in]       DataSize         The data size to send to SMM.
 128   @param[in]       Function         The function number to initialize the communicate header.
 129
 130   @retval EFI_INVALID_PARAMETER     The data size is too big.
 131   @retval EFI_SUCCESS               Find the specified variable.
 132
 133 **/
 134 EFI_STATUS
 135 InitCommunicateBuffer (
 136   OUT     VOID                              **DataPtr OPTIONAL,
 137   IN      UINTN                             DataSize,
 138   IN      UINTN                             Function
 139   )
 140 {
 141   EFI_SMM_COMMUNICATE_HEADER                *SmmCommunicateHeader;
 142   SMM_VARIABLE_COMMUNICATE_HEADER           *SmmVariableFunctionHeader;
 143
 144
 145   if (DataSize + SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE > mVariableBufferSize) {
 146     return EFI_INVALID_PARAMETER;
 147   }
 148
 149   SmmCommunicateHeader = (EFI_SMM_COMMUNICATE_HEADER *) mVariableBuffer;
 150   CopyGuid (&SmmCommunicateHeader->HeaderGuid, &gEfiSmmVariableProtocolGuid);
 151   SmmCommunicateHeader->MessageLength = DataSize + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;
 152
 153   SmmVariableFunctionHeader = (SMM_VARIABLE_COMMUNICATE_HEADER *) SmmCommunicateHeader->Data;
 154   SmmVariableFunctionHeader->Function = Function;
 155   if (DataPtr != NULL) {
 156     *DataPtr = SmmVariableFunctionHeader->Data;
 157   }
 158
 159   return EFI_SUCCESS;
 160 }
 161
 162
 163 /**
 164   Send the data in communicate buffer to SMM.
 165
 166   @param[in]   DataSize               This size of the function header and the data.
 167
 168   @retval      EFI_SUCCESS            Success is returned from the functin in SMM.
 169   @retval      Others                 Failure is returned from the function in SMM.
 170
 171 **/
 172 EFI_STATUS
 173 SendCommunicateBuffer (
 174   IN      UINTN                             DataSize
 175   )
 176 {
 177   EFI_STATUS                                Status;
 178   UINTN                                     CommSize;
 179   EFI_SMM_COMMUNICATE_HEADER                *SmmCommunicateHeader;
 180   SMM_VARIABLE_COMMUNICATE_HEADER           *SmmVariableFunctionHeader;
 181
 182   CommSize = DataSize + SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;
 183   Status = mSmmCommunication->Communicate (mSmmCommunication, mVariableBufferPhysical, &CommSize);
 184   ASSERT_EFI_ERROR (Status);
 185
 186   SmmCommunicateHeader      = (EFI_SMM_COMMUNICATE_HEADER *) mVariableBuffer;
 187   SmmVariableFunctionHeader = (SMM_VARIABLE_COMMUNICATE_HEADER *)SmmCommunicateHeader->Data;
 188   return  SmmVariableFunctionHeader->ReturnStatus;
 189 }
 190
 191 /**
 192   Mark a variable that will become read-only after leaving the DXE phase of execution.
 193
 194   @param[in] This          The VARIABLE_LOCK_PROTOCOL instance.
 195   @param[in] VariableName  A pointer to the variable name that will be made read-only subsequently.
 196   @param[in] VendorGuid    A pointer to the vendor GUID that will be made read-only subsequently.
 197
 198   @retval EFI_SUCCESS           The variable specified by the VariableName and the VendorGuid was marked
 199                                 as pending to be read-only.
 200   @retval EFI_INVALID_PARAMETER VariableName or VendorGuid is NULL.
 201                                 Or VariableName is an empty string.
 202   @retval EFI_ACCESS_DENIED     EFI_END_OF_DXE_EVENT_GROUP_GUID or EFI_EVENT_GROUP_READY_TO_BOOT has
 203                                 already been signaled.
 204   @retval EFI_OUT_OF_RESOURCES  There is not enough resource to hold the lock request.
 205 **/
 206 EFI_STATUS
 207 EFIAPI
 208 VariableLockRequestToLock (
 209   IN CONST EDKII_VARIABLE_LOCK_PROTOCOL *This,
 210   IN       CHAR16                       *VariableName,
 211   IN       EFI_GUID                     *VendorGuid
 212   )
 213 {
 214   EFI_STATUS                                Status;
 215   UINTN                                     VariableNameSize;
 216   UINTN                                     PayloadSize;
 217   SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE    *VariableToLock;
 218
 219   if (VariableName == NULL || VariableName[0] == 0 || VendorGuid == NULL) {
 220     return EFI_INVALID_PARAMETER;
 221   }
 222
 223   VariableNameSize = StrSize (VariableName);
 224   VariableToLock   = NULL;
 225
 226   //
 227   // If VariableName exceeds SMM payload limit. Return failure
 228   //
 229   if (VariableNameSize > mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE, Name)) {
 230     return EFI_INVALID_PARAMETER;
 231   }
 232
 233   AcquireLockOnlyAtBootTime(&mVariableServicesLock);
 234
 235   //
 236   // Init the communicate buffer. The buffer data size is:
 237   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
 238   //
 239   PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE, Name) + VariableNameSize;
 240   Status = InitCommunicateBuffer ((VOID **) &VariableToLock, PayloadSize, SMM_VARIABLE_FUNCTION_LOCK_VARIABLE);
 241   if (EFI_ERROR (Status)) {
 242     goto Done;
 243   }
 244   ASSERT (VariableToLock != NULL);
 245
 246   CopyGuid (&VariableToLock->Guid, VendorGuid);
 247   VariableToLock->NameSize = VariableNameSize;
 248   CopyMem (VariableToLock->Name, VariableName, VariableToLock->NameSize);
 249
 250   //
 251   // Send data to SMM.
 252   //
 253   Status = SendCommunicateBuffer (PayloadSize);
 254
 255 Done:
 256   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
 257   return Status;
 258 }
 259
 260 /**
 261   Register SetVariable check handler.
 262
 263   @param[in] Handler            Pointer to check handler.
 264
 265   @retval EFI_SUCCESS           The SetVariable check handler was registered successfully.
 266   @retval EFI_INVALID_PARAMETER Handler is NULL.
 267   @retval EFI_ACCESS_DENIED     EFI_END_OF_DXE_EVENT_GROUP_GUID or EFI_EVENT_GROUP_READY_TO_BOOT has
 268                                 already been signaled.
 269   @retval EFI_OUT_OF_RESOURCES  There is not enough resource for the SetVariable check handler register request.
 270   @retval EFI_UNSUPPORTED       This interface is not implemented.
 271                                 For example, it is unsupported in VarCheck protocol if both VarCheck and SmmVarCheck protocols are present.
 272
 273 **/
 274 EFI_STATUS
 275 EFIAPI
 276 VarCheckRegisterSetVariableCheckHandler (
 277   IN VAR_CHECK_SET_VARIABLE_CHECK_HANDLER   Handler
 278   )
 279 {
 280   return EFI_UNSUPPORTED;
 281 }
 282
 283 /**
 284   Variable property set.
 285
 286   @param[in] Name               Pointer to the variable name.
 287   @param[in] Guid               Pointer to the vendor GUID.
 288   @param[in] VariableProperty   Pointer to the input variable property.
 289
 290   @retval EFI_SUCCESS           The property of variable specified by the Name and Guid was set successfully.
 291   @retval EFI_INVALID_PARAMETER Name, Guid or VariableProperty is NULL, or Name is an empty string,
 292                                 or the fields of VariableProperty are not valid.
 293   @retval EFI_ACCESS_DENIED     EFI_END_OF_DXE_EVENT_GROUP_GUID or EFI_EVENT_GROUP_READY_TO_BOOT has
 294                                 already been signaled.
 295   @retval EFI_OUT_OF_RESOURCES  There is not enough resource for the variable property set request.
 296
 297 **/
 298 EFI_STATUS
 299 EFIAPI
 300 VarCheckVariablePropertySet (
 301   IN CHAR16                         *Name,
 302   IN EFI_GUID                       *Guid,
 303   IN VAR_CHECK_VARIABLE_PROPERTY    *VariableProperty
 304   )
 305 {
 306   EFI_STATUS                                Status;
 307   UINTN                                     VariableNameSize;
 308   UINTN                                     PayloadSize;
 309   SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY *CommVariableProperty;
 310
 311   if (Name == NULL || Name[0] == 0 || Guid == NULL) {
 312     return EFI_INVALID_PARAMETER;
 313   }
 314
 315   if (VariableProperty == NULL) {
 316     return EFI_INVALID_PARAMETER;
 317   }
 318
 319   if (VariableProperty->Revision != VAR_CHECK_VARIABLE_PROPERTY_REVISION) {
 320     return EFI_INVALID_PARAMETER;
 321   }
 322
 323   VariableNameSize = StrSize (Name);
 324   CommVariableProperty = NULL;
 325
 326   //
 327   // If VariableName exceeds SMM payload limit. Return failure
 328   //
 329   if (VariableNameSize > mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY, Name)) {
 330     return EFI_INVALID_PARAMETER;
 331   }
 332
 333   AcquireLockOnlyAtBootTime (&mVariableServicesLock);
 334
 335   //
 336   // Init the communicate buffer. The buffer data size is:
 337   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
 338   //
 339   PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY, Name) + VariableNameSize;
 340   Status = InitCommunicateBuffer ((VOID **) &CommVariableProperty, PayloadSize, SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_SET);
 341   if (EFI_ERROR (Status)) {
 342     goto Done;
 343   }
 344   ASSERT (CommVariableProperty != NULL);
 345
 346   CopyGuid (&CommVariableProperty->Guid, Guid);
 347   CopyMem (&CommVariableProperty->VariableProperty, VariableProperty, sizeof (*VariableProperty));
 348   CommVariableProperty->NameSize = VariableNameSize;
 349   CopyMem (CommVariableProperty->Name, Name, CommVariableProperty->NameSize);
 350
 351   //
 352   // Send data to SMM.
 353   //
 354   Status = SendCommunicateBuffer (PayloadSize);
 355
 356 Done:
 357   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
 358   return Status;
 359 }
 360
 361 /**
 362   Variable property get.
 363
 364   @param[in]  Name              Pointer to the variable name.
 365   @param[in]  Guid              Pointer to the vendor GUID.
 366   @param[out] VariableProperty  Pointer to the output variable property.
 367
 368   @retval EFI_SUCCESS           The property of variable specified by the Name and Guid was got successfully.
 369   @retval EFI_INVALID_PARAMETER Name, Guid or VariableProperty is NULL, or Name is an empty string.
 370   @retval EFI_NOT_FOUND         The property of variable specified by the Name and Guid was not found.
 371
 372 **/
 373 EFI_STATUS
 374 EFIAPI
 375 VarCheckVariablePropertyGet (
 376   IN CHAR16                         *Name,
 377   IN EFI_GUID                       *Guid,
 378   OUT VAR_CHECK_VARIABLE_PROPERTY   *VariableProperty
 379   )
 380 {
 381   EFI_STATUS                                Status;
 382   UINTN                                     VariableNameSize;
 383   UINTN                                     PayloadSize;
 384   SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY *CommVariableProperty;
 385
 386   if (Name == NULL || Name[0] == 0 || Guid == NULL) {
 387     return EFI_INVALID_PARAMETER;
 388   }
 389
 390   if (VariableProperty == NULL) {
 391     return EFI_INVALID_PARAMETER;
 392   }
 393
 394   VariableNameSize = StrSize (Name);
 395   CommVariableProperty = NULL;
 396
 397   //
 398   // If VariableName exceeds SMM payload limit. Return failure
 399   //
 400   if (VariableNameSize > mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY, Name)) {
 401     return EFI_INVALID_PARAMETER;
 402   }
 403
 404   AcquireLockOnlyAtBootTime (&mVariableServicesLock);
 405
 406   //
 407   // Init the communicate buffer. The buffer data size is:
 408   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
 409   //
 410   PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_VAR_CHECK_VARIABLE_PROPERTY, Name) + VariableNameSize;
 411   Status = InitCommunicateBuffer ((VOID **) &CommVariableProperty, PayloadSize, SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_GET);
 412   if (EFI_ERROR (Status)) {
 413     goto Done;
 414   }
 415   ASSERT (CommVariableProperty != NULL);
 416
 417   CopyGuid (&CommVariableProperty->Guid, Guid);
 418   CommVariableProperty->NameSize = VariableNameSize;
 419   CopyMem (CommVariableProperty->Name, Name, CommVariableProperty->NameSize);
 420
 421   //
 422   // Send data to SMM.
 423   //
 424   Status = SendCommunicateBuffer (PayloadSize);
 425   if (Status == EFI_SUCCESS) {
 426     CopyMem (VariableProperty, &CommVariableProperty->VariableProperty, sizeof (*VariableProperty));
 427   }
 428
 429 Done:
 430   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
 431   return Status;
 432 }
 433
 434 /**
 435   This code finds variable in storage blocks (Volatile or Non-Volatile).
 436
 437   Caution: This function may receive untrusted input.
 438   The data size is external input, so this function will validate it carefully to avoid buffer overflow.
 439
 440   @param[in]      VariableName       Name of Variable to be found.
 441   @param[in]      VendorGuid         Variable vendor GUID.
 442   @param[out]     Attributes         Attribute value of the variable found.
 443   @param[in, out] DataSize           Size of Data found. If size is less than the
 444                                      data, this value contains the required size.
 445   @param[out]     Data               Data pointer.
 446
 447   @retval EFI_INVALID_PARAMETER      Invalid parameter.
 448   @retval EFI_SUCCESS                Find the specified variable.
 449   @retval EFI_NOT_FOUND              Not found.
 450   @retval EFI_BUFFER_TO_SMALL        DataSize is too small for the result.
 451
 452 **/
 453 EFI_STATUS
 454 EFIAPI
 455 RuntimeServiceGetVariable (
 456   IN      CHAR16                            *VariableName,
 457   IN      EFI_GUID                          *VendorGuid,
 458   OUT     UINT32                            *Attributes OPTIONAL,
 459   IN OUT  UINTN                             *DataSize,
 460   OUT     VOID                              *Data
 461   )
 462 {
 463   EFI_STATUS                                Status;
 464   UINTN                                     PayloadSize;
 465   SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE  *SmmVariableHeader;
 466   UINTN                                     TempDataSize;
 467   UINTN                                     VariableNameSize;
 468
 469   if (VariableName == NULL || VendorGuid == NULL || DataSize == NULL) {
 470     return EFI_INVALID_PARAMETER;
 471   }
 472
 473   TempDataSize          = *DataSize;
 474   VariableNameSize      = StrSize (VariableName);
 475   SmmVariableHeader     = NULL;
 476
 477   //
 478   // If VariableName exceeds SMM payload limit. Return failure
 479   //
 480   if (VariableNameSize > mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name)) {
 481     return EFI_INVALID_PARAMETER;
 482   }
 483
 484   AcquireLockOnlyAtBootTime(&mVariableServicesLock);
 485
 486   //
 487   // Init the communicate buffer. The buffer data size is:
 488   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
 489   //
 490   if (TempDataSize > mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) - VariableNameSize) {
 491     //
 492     // If output data buffer exceed SMM payload limit. Trim output buffer to SMM payload size
 493     //
 494     TempDataSize = mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) - VariableNameSize;
 495   }
 496   PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) + VariableNameSize + TempDataSize;
 497
 498   Status = InitCommunicateBuffer ((VOID **)&SmmVariableHeader, PayloadSize, SMM_VARIABLE_FUNCTION_GET_VARIABLE);
 499   if (EFI_ERROR (Status)) {
 500     goto Done;
 501   }
 502   ASSERT (SmmVariableHeader != NULL);
 503
 504   CopyGuid (&SmmVariableHeader->Guid, VendorGuid);
 505   SmmVariableHeader->DataSize   = TempDataSize;
 506   SmmVariableHeader->NameSize   = VariableNameSize;
 507   if (Attributes == NULL) {
 508     SmmVariableHeader->Attributes = 0;
 509   } else {
 510     SmmVariableHeader->Attributes = *Attributes;
 511   }
 512   CopyMem (SmmVariableHeader->Name, VariableName, SmmVariableHeader->NameSize);
 513
 514   //
 515   // Send data to SMM.
 516   //
 517   Status = SendCommunicateBuffer (PayloadSize);
 518
 519   //
 520   // Get data from SMM.
 521   //
 522   if (Status == EFI_SUCCESS || Status == EFI_BUFFER_TOO_SMALL) {
 523     //
 524     // SMM CommBuffer DataSize can be a trimed value
 525     // Only update DataSize when needed
 526     //
 527     *DataSize = SmmVariableHeader->DataSize;
 528   }
 529   if (Attributes != NULL) {
 530     *Attributes = SmmVariableHeader->Attributes;
 531   }
 532
 533   if (EFI_ERROR (Status)) {
 534     goto Done;
 535   }
 536
 537   if (Data != NULL) {
 538     CopyMem (Data, (UINT8 *)SmmVariableHeader->Name + SmmVariableHeader->NameSize, SmmVariableHeader->DataSize);
 539   } else {
 540     Status = EFI_INVALID_PARAMETER;
 541   }
 542
 543 Done:
 544   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
 545   return Status;
 546 }
 547
 548
 549 /**
 550   This code Finds the Next available variable.
 551
 552   @param[in, out] VariableNameSize   Size of the variable name.
 553   @param[in, out] VariableName       Pointer to variable name.
 554   @param[in, out] VendorGuid         Variable Vendor Guid.
 555
 556   @retval EFI_INVALID_PARAMETER      Invalid parameter.
 557   @retval EFI_SUCCESS                Find the specified variable.
 558   @retval EFI_NOT_FOUND              Not found.
 559   @retval EFI_BUFFER_TO_SMALL        DataSize is too small for the result.
 560
 561 **/
 562 EFI_STATUS
 563 EFIAPI
 564 RuntimeServiceGetNextVariableName (
 565   IN OUT  UINTN                             *VariableNameSize,
 566   IN OUT  CHAR16                            *VariableName,
 567   IN OUT  EFI_GUID                          *VendorGuid
 568   )
 569 {
 570   EFI_STATUS                                      Status;
 571   UINTN                                           PayloadSize;
 572   SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME *SmmGetNextVariableName;
 573   UINTN                                           OutVariableNameSize;
 574   UINTN                                           InVariableNameSize;
 575
 576   if (VariableNameSize == NULL || VariableName == NULL || VendorGuid == NULL) {
 577     return EFI_INVALID_PARAMETER;
 578   }
 579
 580   OutVariableNameSize   = *VariableNameSize;
 581   InVariableNameSize    = StrSize (VariableName);
 582   SmmGetNextVariableName = NULL;
 583
 584   //
 585   // If input string exceeds SMM payload limit. Return failure
 586   //
 587   if (InVariableNameSize > mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name)) {
 588     return EFI_INVALID_PARAMETER;
 589   }
 590
 591   AcquireLockOnlyAtBootTime(&mVariableServicesLock);
 592
 593   //
 594   // Init the communicate buffer. The buffer data size is:
 595   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
 596   //
 597   if (OutVariableNameSize > mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name)) {
 598     //
 599     // If output buffer exceed SMM payload limit. Trim output buffer to SMM payload size
 600     //
 601     OutVariableNameSize = mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name);
 602   }
 603   //
 604   // Payload should be Guid + NameSize + MAX of Input & Output buffer
 605   //
 606   PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name) + MAX (OutVariableNameSize, InVariableNameSize);
 607
 608   Status = InitCommunicateBuffer ((VOID **)&SmmGetNextVariableName, PayloadSize, SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME);
 609   if (EFI_ERROR (Status)) {
 610     goto Done;
 611   }
 612   ASSERT (SmmGetNextVariableName != NULL);
 613
 614   //
 615   // SMM comm buffer->NameSize is buffer size for return string
 616   //
 617   SmmGetNextVariableName->NameSize = OutVariableNameSize;
 618
 619   CopyGuid (&SmmGetNextVariableName->Guid, VendorGuid);
 620   //
 621   // Copy whole string
 622   //
 623   CopyMem (SmmGetNextVariableName->Name, VariableName, InVariableNameSize);
 624   if (OutVariableNameSize > InVariableNameSize) {
 625     ZeroMem ((UINT8 *) SmmGetNextVariableName->Name + InVariableNameSize, OutVariableNameSize - InVariableNameSize);
 626   }
 627
 628   //
 629   // Send data to SMM
 630   //
 631   Status = SendCommunicateBuffer (PayloadSize);
 632
 633   //
 634   // Get data from SMM.
 635   //
 636   if (Status == EFI_SUCCESS || Status == EFI_BUFFER_TOO_SMALL) {
 637     //
 638     // SMM CommBuffer NameSize can be a trimed value
 639     // Only update VariableNameSize when needed
 640     //
 641     *VariableNameSize = SmmGetNextVariableName->NameSize;
 642   }
 643   if (EFI_ERROR (Status)) {
 644     goto Done;
 645   }
 646
 647   CopyGuid (VendorGuid, &SmmGetNextVariableName->Guid);
 648   CopyMem (VariableName, SmmGetNextVariableName->Name, SmmGetNextVariableName->NameSize);
 649
 650 Done:
 651   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
 652   return Status;
 653 }
 654
 655 /**
 656   This code sets variable in storage blocks (Volatile or Non-Volatile).
 657
 658   Caution: This function may receive untrusted input.
 659   The data size and data are external input, so this function will validate it carefully to avoid buffer overflow.
 660
 661   @param[in] VariableName                 Name of Variable to be found.
 662   @param[in] VendorGuid                   Variable vendor GUID.
 663   @param[in] Attributes                   Attribute value of the variable found
 664   @param[in] DataSize                     Size of Data found. If size is less than the
 665                                           data, this value contains the required size.
 666   @param[in] Data                         Data pointer.
 667
 668   @retval EFI_INVALID_PARAMETER           Invalid parameter.
 669   @retval EFI_SUCCESS                     Set successfully.
 670   @retval EFI_OUT_OF_RESOURCES            Resource not enough to set variable.
 671   @retval EFI_NOT_FOUND                   Not found.
 672   @retval EFI_WRITE_PROTECTED             Variable is read-only.
 673
 674 **/
 675 EFI_STATUS
 676 EFIAPI
 677 RuntimeServiceSetVariable (
 678   IN CHAR16                                 *VariableName,
 679   IN EFI_GUID                               *VendorGuid,
 680   IN UINT32                                 Attributes,
 681   IN UINTN                                  DataSize,
 682   IN VOID                                   *Data
 683   )
 684 {
 685   EFI_STATUS                                Status;
 686   UINTN                                     PayloadSize;
 687   SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE  *SmmVariableHeader;
 688   UINTN                                     VariableNameSize;
 689
 690   //
 691   // Check input parameters.
 692   //
 693   if (VariableName == NULL || VariableName[0] == 0 || VendorGuid == NULL) {
 694     return EFI_INVALID_PARAMETER;
 695   }
 696
 697   if (DataSize != 0 && Data == NULL) {
 698     return EFI_INVALID_PARAMETER;
 699   }
 700
 701   VariableNameSize      = StrSize (VariableName);
 702   SmmVariableHeader     = NULL;
 703
 704   //
 705   // If VariableName or DataSize exceeds SMM payload limit. Return failure
 706   //
 707   if ((VariableNameSize > mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name)) ||
 708       (DataSize > mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) - VariableNameSize)){
 709     return EFI_INVALID_PARAMETER;
 710   }
 711
 712   AcquireLockOnlyAtBootTime(&mVariableServicesLock);
 713
 714   //
 715   // Init the communicate buffer. The buffer data size is:
 716   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
 717   //
 718   PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) + VariableNameSize + DataSize;
 719   Status = InitCommunicateBuffer ((VOID **)&SmmVariableHeader, PayloadSize, SMM_VARIABLE_FUNCTION_SET_VARIABLE);
 720   if (EFI_ERROR (Status)) {
 721     goto Done;
 722   }
 723   ASSERT (SmmVariableHeader != NULL);
 724
 725   CopyGuid ((EFI_GUID *) &SmmVariableHeader->Guid, VendorGuid);
 726   SmmVariableHeader->DataSize   = DataSize;
 727   SmmVariableHeader->NameSize   = VariableNameSize;
 728   SmmVariableHeader->Attributes = Attributes;
 729   CopyMem (SmmVariableHeader->Name, VariableName, SmmVariableHeader->NameSize);
 730   CopyMem ((UINT8 *) SmmVariableHeader->Name + SmmVariableHeader->NameSize, Data, DataSize);
 731
 732   //
 733   // Send data to SMM.
 734   //
 735   Status = SendCommunicateBuffer (PayloadSize);
 736
 737 Done:
 738   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
 739
 740   if (!EfiAtRuntime ()) {
 741     if (!EFI_ERROR (Status)) {
 742       SecureBootHook (
 743         VariableName,
 744         VendorGuid
 745         );
 746     }
 747   }
 748   return Status;
 749 }
 750
 751
 752 /**
 753   This code returns information about the EFI variables.
 754
 755   @param[in]  Attributes                   Attributes bitmask to specify the type of variables
 756                                            on which to return information.
 757   @param[out] MaximumVariableStorageSize   Pointer to the maximum size of the storage space available
 758                                            for the EFI variables associated with the attributes specified.
 759   @param[out] RemainingVariableStorageSize Pointer to the remaining size of the storage space available
 760                                            for EFI variables associated with the attributes specified.
 761   @param[out] MaximumVariableSize          Pointer to the maximum size of an individual EFI variables
 762                                            associated with the attributes specified.
 763
 764   @retval EFI_INVALID_PARAMETER            An invalid combination of attribute bits was supplied.
 765   @retval EFI_SUCCESS                      Query successfully.
 766   @retval EFI_UNSUPPORTED                  The attribute is not supported on this platform.
 767
 768 **/
 769 EFI_STATUS
 770 EFIAPI
 771 RuntimeServiceQueryVariableInfo (
 772   IN  UINT32                                Attributes,
 773   OUT UINT64                                *MaximumVariableStorageSize,
 774   OUT UINT64                                *RemainingVariableStorageSize,
 775   OUT UINT64                                *MaximumVariableSize
 776   )
 777 {
 778   EFI_STATUS                                Status;
 779   UINTN                                     PayloadSize;
 780   SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO *SmmQueryVariableInfo;
 781
 782   SmmQueryVariableInfo = NULL;
 783
 784   if(MaximumVariableStorageSize == NULL || RemainingVariableStorageSize == NULL || MaximumVariableSize == NULL || Attributes == 0) {
 785     return EFI_INVALID_PARAMETER;
 786   }
 787
 788   AcquireLockOnlyAtBootTime(&mVariableServicesLock);
 789
 790   //
 791   // Init the communicate buffer. The buffer data size is:
 792   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize;
 793   //
 794   PayloadSize = sizeof (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO);
 795   Status = InitCommunicateBuffer ((VOID **)&SmmQueryVariableInfo, PayloadSize, SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO);
 796   if (EFI_ERROR (Status)) {
 797     goto Done;
 798   }
 799   ASSERT (SmmQueryVariableInfo != NULL);
 800
 801   SmmQueryVariableInfo->Attributes  = Attributes;
 802
 803   //
 804   // Send data to SMM.
 805   //
 806   Status = SendCommunicateBuffer (PayloadSize);
 807   if (EFI_ERROR (Status)) {
 808     goto Done;
 809   }
 810
 811   //
 812   // Get data from SMM.
 813   //
 814   *MaximumVariableSize          = SmmQueryVariableInfo->MaximumVariableSize;
 815   *MaximumVariableStorageSize   = SmmQueryVariableInfo->MaximumVariableStorageSize;
 816   *RemainingVariableStorageSize = SmmQueryVariableInfo->RemainingVariableStorageSize;
 817
 818 Done:
 819   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
 820   return Status;
 821 }
 822
 823
 824 /**
 825   Exit Boot Services Event notification handler.
 826
 827   Notify SMM variable driver about the event.
 828
 829   @param[in]  Event     Event whose notification function is being invoked.
 830   @param[in]  Context   Pointer to the notification function's context.
 831
 832 **/
 833 VOID
 834 EFIAPI
 835 OnExitBootServices (
 836   IN      EFI_EVENT                         Event,
 837   IN      VOID                              *Context
 838   )
 839 {
 840   //
 841   // Init the communicate buffer. The buffer data size is:
 842   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE.
 843   //
 844   InitCommunicateBuffer (NULL, 0, SMM_VARIABLE_FUNCTION_EXIT_BOOT_SERVICE);
 845
 846   //
 847   // Send data to SMM.
 848   //
 849   SendCommunicateBuffer (0);
 850 }
 851
 852
 853 /**
 854   On Ready To Boot Services Event notification handler.
 855
 856   Notify SMM variable driver about the event.
 857
 858   @param[in]  Event     Event whose notification function is being invoked
 859   @param[in]  Context   Pointer to the notification function's context
 860
 861 **/
 862 VOID
 863 EFIAPI
 864 OnReadyToBoot (
 865   IN      EFI_EVENT                         Event,
 866   IN      VOID                              *Context
 867   )
 868 {
 869   //
 870   // Init the communicate buffer. The buffer data size is:
 871   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE.
 872   //
 873   InitCommunicateBuffer (NULL, 0, SMM_VARIABLE_FUNCTION_READY_TO_BOOT);
 874
 875   //
 876   // Send data to SMM.
 877   //
 878   SendCommunicateBuffer (0);
 879
 880   gBS->CloseEvent (Event);
 881 }
 882
 883
 884 /**
 885   Notification function of EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE.
 886
 887   This is a notification function registered on EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
 888   It convers pointer to new virtual address.
 889
 890   @param[in]  Event        Event whose notification function is being invoked.
 891   @param[in]  Context      Pointer to the notification function's context.
 892
 893 **/
 894 VOID
 895 EFIAPI
 896 VariableAddressChangeEvent (
 897   IN EFI_EVENT                              Event,
 898   IN VOID                                   *Context
 899   )
 900 {
 901   EfiConvertPointer (0x0, (VOID **) &mVariableBuffer);
 902   EfiConvertPointer (0x0, (VOID **) &mSmmCommunication);
 903 }
 904
 905 /**
 906   This code gets variable payload size.
 907
 908   @param[out] VariablePayloadSize   Output pointer to variable payload size.
 909
 910   @retval EFI_SUCCESS               Get successfully.
 911   @retval Others                    Get unsuccessfully.
 912
 913 **/
 914 EFI_STATUS
 915 EFIAPI
 916 GetVariablePayloadSize (
 917   OUT UINTN                         *VariablePayloadSize
 918   )
 919 {
 920   EFI_STATUS                                Status;
 921   SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE *SmmGetPayloadSize;
 922   EFI_SMM_COMMUNICATE_HEADER                *SmmCommunicateHeader;
 923   SMM_VARIABLE_COMMUNICATE_HEADER           *SmmVariableFunctionHeader;
 924   UINTN                                     CommSize;
 925   UINT8                                     *CommBuffer;
 926
 927   SmmGetPayloadSize = NULL;
 928   CommBuffer = NULL;
 929
 930   if(VariablePayloadSize == NULL) {
 931     return EFI_INVALID_PARAMETER;
 932   }
 933
 934   AcquireLockOnlyAtBootTime(&mVariableServicesLock);
 935
 936   //
 937   // Init the communicate buffer. The buffer data size is:
 938   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + sizeof (SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE);
 939   //
 940   CommSize = SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + sizeof (SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE);
 941   CommBuffer = AllocateZeroPool (CommSize);
 942   if (CommBuffer == NULL) {
 943     Status = EFI_OUT_OF_RESOURCES;
 944     goto Done;
 945   }
 946
 947   SmmCommunicateHeader = (EFI_SMM_COMMUNICATE_HEADER *) CommBuffer;
 948   CopyGuid (&SmmCommunicateHeader->HeaderGuid, &gEfiSmmVariableProtocolGuid);
 949   SmmCommunicateHeader->MessageLength = SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + sizeof (SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE);
 950
 951   SmmVariableFunctionHeader = (SMM_VARIABLE_COMMUNICATE_HEADER *) SmmCommunicateHeader->Data;
 952   SmmVariableFunctionHeader->Function = SMM_VARIABLE_FUNCTION_GET_PAYLOAD_SIZE;
 953   SmmGetPayloadSize = (SMM_VARIABLE_COMMUNICATE_GET_PAYLOAD_SIZE *) SmmVariableFunctionHeader->Data;
 954
 955   //
 956   // Send data to SMM.
 957   //
 958   Status = mSmmCommunication->Communicate (mSmmCommunication, CommBuffer, &CommSize);
 959   ASSERT_EFI_ERROR (Status);
 960
 961   Status = SmmVariableFunctionHeader->ReturnStatus;
 962   if (EFI_ERROR (Status)) {
 963     goto Done;
 964   }
 965
 966   //
 967   // Get data from SMM.
 968   //
 969   *VariablePayloadSize = SmmGetPayloadSize->VariablePayloadSize;
 970
 971 Done:
 972   if (CommBuffer != NULL) {
 973     FreePool (CommBuffer);
 974   }
 975   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
 976   return Status;
 977 }
 978
 979 /**
 980   Initialize variable service and install Variable Architectural protocol.
 981
 982   @param[in] Event    Event whose notification function is being invoked.
 983   @param[in] Context  Pointer to the notification function's context.
 984
 985 **/
 986 VOID
 987 EFIAPI
 988 SmmVariableReady (
 989   IN  EFI_EVENT                             Event,
 990   IN  VOID                                  *Context
 991   )
 992 {
 993   EFI_STATUS                                Status;
 994
 995   Status = gBS->LocateProtocol (&gEfiSmmVariableProtocolGuid, NULL, (VOID **)&mSmmVariable);
 996   if (EFI_ERROR (Status)) {
 997     return;
 998   }
 999
1000   Status = gBS->LocateProtocol (&gEfiSmmCommunicationProtocolGuid, NULL, (VOID **) &mSmmCommunication);
1001   ASSERT_EFI_ERROR (Status);
1002
1003   //
1004   // Allocate memory for variable communicate buffer.
1005   //
1006   Status = GetVariablePayloadSize (&mVariableBufferPayloadSize);
1007   ASSERT_EFI_ERROR (Status);
1008   mVariableBufferSize  = SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + mVariableBufferPayloadSize;
1009   mVariableBuffer      = AllocateRuntimePool (mVariableBufferSize);
1010   ASSERT (mVariableBuffer != NULL);
1011
1012   //
1013   // Save the buffer physical address used for SMM conmunication.
1014   //
1015   mVariableBufferPhysical = mVariableBuffer;
1016
1017   gRT->GetVariable         = RuntimeServiceGetVariable;
1018   gRT->GetNextVariableName = RuntimeServiceGetNextVariableName;
1019   gRT->SetVariable         = RuntimeServiceSetVariable;
1020   gRT->QueryVariableInfo   = RuntimeServiceQueryVariableInfo;
1021
1022   //
1023   // Install the Variable Architectural Protocol on a new handle.
1024   //
1025   Status = gBS->InstallProtocolInterface (
1026                   &mHandle,
1027                   &gEfiVariableArchProtocolGuid,
1028                   EFI_NATIVE_INTERFACE,
1029                   NULL
1030                   );
1031   ASSERT_EFI_ERROR (Status);
1032
1033   mVariableLock.RequestToLock = VariableLockRequestToLock;
1034   Status = gBS->InstallMultipleProtocolInterfaces (
1035                   &mHandle,
1036                   &gEdkiiVariableLockProtocolGuid,
1037                   &mVariableLock,
1038                   NULL
1039                   );
1040   ASSERT_EFI_ERROR (Status);
1041
1042   mVarCheck.RegisterSetVariableCheckHandler = VarCheckRegisterSetVariableCheckHandler;
1043   mVarCheck.VariablePropertySet = VarCheckVariablePropertySet;
1044   mVarCheck.VariablePropertyGet = VarCheckVariablePropertyGet;
1045   Status = gBS->InstallMultipleProtocolInterfaces (
1046                   &mHandle,
1047                   &gEdkiiVarCheckProtocolGuid,
1048                   &mVarCheck,
1049                   NULL
1050                   );
1051   ASSERT_EFI_ERROR (Status);
1052
1053   gBS->CloseEvent (Event);
1054 }
1055
1056
1057 /**
1058   SMM Non-Volatile variable write service is ready notify event handler.
1059
1060   @param[in] Event    Event whose notification function is being invoked.
1061   @param[in] Context  Pointer to the notification function's context.
1062
1063 **/
1064 VOID
1065 EFIAPI
1066 SmmVariableWriteReady (
1067   IN  EFI_EVENT                             Event,
1068   IN  VOID                                  *Context
1069   )
1070 {
1071   EFI_STATUS                                Status;
1072   VOID                                      *ProtocolOps;
1073
1074   //
1075   // Check whether the protocol is installed or not.
1076   //
1077   Status = gBS->LocateProtocol (&gSmmVariableWriteGuid, NULL, (VOID **) &ProtocolOps);
1078   if (EFI_ERROR (Status)) {
1079     return;
1080   }
1081
1082   Status = gBS->InstallProtocolInterface (
1083                   &mHandle,
1084                   &gEfiVariableWriteArchProtocolGuid,
1085                   EFI_NATIVE_INTERFACE,
1086                   NULL
1087                   );
1088   ASSERT_EFI_ERROR (Status);
1089
1090   gBS->CloseEvent (Event);
1091 }
1092
1093
1094 /**
1095   Variable Driver main entry point. The Variable driver places the 4 EFI
1096   runtime services in the EFI System Table and installs arch protocols
1097   for variable read and write services being available. It also registers
1098   a notification function for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
1099
1100   @param[in] ImageHandle    The firmware allocated handle for the EFI image.
1101   @param[in] SystemTable    A pointer to the EFI System Table.
1102
1103   @retval EFI_SUCCESS       Variable service successfully initialized.
1104
1105 **/
1106 EFI_STATUS
1107 EFIAPI
1108 VariableSmmRuntimeInitialize (
1109   IN EFI_HANDLE                             ImageHandle,
1110   IN EFI_SYSTEM_TABLE                       *SystemTable
1111   )
1112 {
1113   VOID                                      *SmmVariableRegistration;
1114   VOID                                      *SmmVariableWriteRegistration;
1115   EFI_EVENT                                 OnReadyToBootEvent;
1116   EFI_EVENT                                 ExitBootServiceEvent;
1117   EFI_EVENT                                 LegacyBootEvent;
1118
1119   EfiInitializeLock (&mVariableServicesLock, TPL_NOTIFY);
1120
1121   //
1122   // Smm variable service is ready
1123   //
1124   EfiCreateProtocolNotifyEvent (
1125     &gEfiSmmVariableProtocolGuid,
1126     TPL_CALLBACK,
1127     SmmVariableReady,
1128     NULL,
1129     &SmmVariableRegistration
1130     );
1131
1132   //
1133   // Smm Non-Volatile variable write service is ready
1134   //
1135   EfiCreateProtocolNotifyEvent (
1136     &gSmmVariableWriteGuid,
1137     TPL_CALLBACK,
1138     SmmVariableWriteReady,
1139     NULL,
1140     &SmmVariableWriteRegistration
1141     );
1142
1143   //
1144   // Register the event to reclaim variable for OS usage.
1145   //
1146   EfiCreateEventReadyToBootEx (
1147     TPL_NOTIFY,
1148     OnReadyToBoot,
1149     NULL,
1150     &OnReadyToBootEvent
1151     );
1152
1153   //
1154   // Register the event to inform SMM variable that it is at runtime.
1155   //
1156   gBS->CreateEventEx (
1157          EVT_NOTIFY_SIGNAL,
1158          TPL_NOTIFY,
1159          OnExitBootServices,
1160          NULL,
1161          &gEfiEventExitBootServicesGuid,
1162          &ExitBootServiceEvent
1163          );
1164
1165   //
1166   // Register the event to inform SMM variable that it is at runtime for legacy boot.
1167   // Reuse OnExitBootServices() here.
1168   //
1169   EfiCreateEventLegacyBootEx(
1170     TPL_NOTIFY,
1171     OnExitBootServices,
1172     NULL,
1173     &LegacyBootEvent
1174     );
1175
1176   //
1177   // Register the event to convert the pointer for runtime.
1178   //
1179   gBS->CreateEventEx (
1180          EVT_NOTIFY_SIGNAL,
1181          TPL_NOTIFY,
1182          VariableAddressChangeEvent,
1183          NULL,
1184          &gEfiEventVirtualAddressChangeGuid,
1185          &mVirtualAddressChangeEvent
1186          );
1187
1188   return EFI_SUCCESS;
1189 }
1190