2 The sample implementation for SMM variable protocol. And this driver
3 implements an SMI handler to communicate with the DXE runtime driver
4 to provide variable services.
6 Caution: This module requires additional review when modified.
7 This driver will have external input - variable data and communicate buffer in SMM mode.
8 This external input must be validated carefully to avoid security issue like
9 buffer overflow, integer overflow.
11 SmmVariableHandler() will receive untrusted input and do basic validation.
13 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
14 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
15 SmmVariableGetStatistics() should also do validation based on its own knowledge.
17 Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>
18 This program and the accompanying materials
19 are licensed and made available under the terms and conditions of the BSD License
20 which accompanies this distribution. The full text of the license may be found at
21 http://opensource.org/licenses/bsd-license.php
23 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
24 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
28 #include <Protocol/SmmVariable.h>
29 #include <Protocol/SmmFirmwareVolumeBlock.h>
30 #include <Protocol/SmmFaultTolerantWrite.h>
31 #include <Protocol/SmmAccess2.h>
33 #include <Library/SmmServicesTableLib.h>
35 #include <Guid/AuthenticatedVariableFormat.h>
36 #include <Guid/SmmVariableCommon.h>
39 EFI_SMRAM_DESCRIPTOR
*mSmramRanges
;
40 UINTN mSmramRangeCount
;
42 extern VARIABLE_INFO_ENTRY
*gVariableInfo
;
43 EFI_HANDLE mSmmVariableHandle
= NULL
;
44 EFI_HANDLE mVariableHandle
= NULL
;
45 BOOLEAN mAtRuntime
= FALSE
;
46 EFI_GUID mZeroGuid
= {0, 0, 0, {0, 0, 0, 0, 0, 0, 0, 0}};
48 EFI_SMM_VARIABLE_PROTOCOL gSmmVariable
= {
49 VariableServiceGetVariable
,
50 VariableServiceGetNextVariableName
,
51 VariableServiceSetVariable
,
52 VariableServiceQueryVariableInfo
57 Return TRUE if ExitBootServices () has been called.
59 @retval TRUE If ExitBootServices () has been called.
70 This function check if the address is in SMRAM.
72 @param Buffer the buffer address to be checked.
73 @param Length the buffer length to be checked.
75 @retval TRUE this address is in SMRAM.
76 @retval FALSE this address is NOT in SMRAM.
79 InternalIsAddressInSmram (
80 IN EFI_PHYSICAL_ADDRESS Buffer
,
86 for (Index
= 0; Index
< mSmramRangeCount
; Index
++) {
87 if (((Buffer
>= mSmramRanges
[Index
].CpuStart
) && (Buffer
< mSmramRanges
[Index
].CpuStart
+ mSmramRanges
[Index
].PhysicalSize
)) ||
88 ((mSmramRanges
[Index
].CpuStart
>= Buffer
) && (mSmramRanges
[Index
].CpuStart
< Buffer
+ Length
))) {
98 Initializes a basic mutual exclusion lock.
100 This function initializes a basic mutual exclusion lock to the released state
101 and returns the lock. Each lock provides mutual exclusion access at its task
102 priority level. Since there is no preemption or multiprocessor support in EFI,
103 acquiring the lock only consists of raising to the locks TPL.
104 If Lock is NULL, then ASSERT().
105 If Priority is not a valid TPL value, then ASSERT().
107 @param Lock A pointer to the lock data structure to initialize.
108 @param Priority EFI TPL is associated with the lock.
115 IN OUT EFI_LOCK
*Lock
,
123 Acquires lock only at boot time. Simply returns at runtime.
125 This is a temperary function that will be removed when
126 EfiAcquireLock() in UefiLib can handle the call in UEFI
127 Runtimer driver in RT phase.
128 It calls EfiAcquireLock() at boot time, and simply returns
131 @param Lock A pointer to the lock to acquire.
135 AcquireLockOnlyAtBootTime (
144 Releases lock only at boot time. Simply returns at runtime.
146 This is a temperary function which will be removed when
147 EfiReleaseLock() in UefiLib can handle the call in UEFI
148 Runtimer driver in RT phase.
149 It calls EfiReleaseLock() at boot time and simply returns
152 @param Lock A pointer to the lock to release.
156 ReleaseLockOnlyAtBootTime (
164 Retrive the SMM Fault Tolerent Write protocol interface.
166 @param[out] FtwProtocol The interface of SMM Ftw protocol
168 @retval EFI_SUCCESS The SMM FTW protocol instance was found and returned in FtwProtocol.
169 @retval EFI_NOT_FOUND The SMM FTW protocol instance was not found.
170 @retval EFI_INVALID_PARAMETER SarProtocol is NULL.
175 OUT VOID
**FtwProtocol
181 // Locate Smm Fault Tolerent Write protocol
183 Status
= gSmst
->SmmLocateProtocol (
184 &gEfiSmmFaultTolerantWriteProtocolGuid
,
193 Retrive the SMM FVB protocol interface by HANDLE.
195 @param[in] FvBlockHandle The handle of SMM FVB protocol that provides services for
196 reading, writing, and erasing the target block.
197 @param[out] FvBlock The interface of SMM FVB protocol
199 @retval EFI_SUCCESS The interface information for the specified protocol was returned.
200 @retval EFI_UNSUPPORTED The device does not support the SMM FVB protocol.
201 @retval EFI_INVALID_PARAMETER FvBlockHandle is not a valid EFI_HANDLE or FvBlock is NULL.
206 IN EFI_HANDLE FvBlockHandle
,
207 OUT EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL
**FvBlock
211 // To get the SMM FVB protocol interface on the handle
213 return gSmst
->SmmHandleProtocol (
215 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
222 Function returns an array of handles that support the SMM FVB protocol
223 in a buffer allocated from pool.
225 @param[out] NumberHandles The number of handles returned in Buffer.
226 @param[out] Buffer A pointer to the buffer to return the requested
227 array of handles that support SMM FVB protocol.
229 @retval EFI_SUCCESS The array of handles was returned in Buffer, and the number of
230 handles in Buffer was returned in NumberHandles.
231 @retval EFI_NOT_FOUND No SMM FVB handle was found.
232 @retval EFI_OUT_OF_RESOURCES There is not enough pool memory to store the matching results.
233 @retval EFI_INVALID_PARAMETER NumberHandles is NULL or Buffer is NULL.
237 GetFvbCountAndBuffer (
238 OUT UINTN
*NumberHandles
,
239 OUT EFI_HANDLE
**Buffer
245 if ((NumberHandles
== NULL
) || (Buffer
== NULL
)) {
246 return EFI_INVALID_PARAMETER
;
252 Status
= gSmst
->SmmLocateHandle (
254 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
259 if (EFI_ERROR(Status
) && Status
!= EFI_BUFFER_TOO_SMALL
) {
260 return EFI_NOT_FOUND
;
263 *Buffer
= AllocatePool (BufferSize
);
264 if (*Buffer
== NULL
) {
265 return EFI_OUT_OF_RESOURCES
;
268 Status
= gSmst
->SmmLocateHandle (
270 &gEfiSmmFirmwareVolumeBlockProtocolGuid
,
276 *NumberHandles
= BufferSize
/ sizeof(EFI_HANDLE
);
277 if (EFI_ERROR(Status
)) {
286 Get the variable statistics information from the information buffer pointed by gVariableInfo.
288 Caution: This function may be invoked at SMM runtime.
289 InfoEntry and InfoSize are external input. Care must be taken to make sure not security issue at runtime.
291 @param[in, out] InfoEntry A pointer to the buffer of variable information entry.
292 On input, point to the variable information returned last time. if
293 InfoEntry->VendorGuid is zero, return the first information.
294 On output, point to the next variable information.
295 @param[in, out] InfoSize On input, the size of the variable information buffer.
296 On output, the returned variable information size.
298 @retval EFI_SUCCESS The variable information is found and returned successfully.
299 @retval EFI_UNSUPPORTED No variable inoformation exists in variable driver. The
300 PcdVariableCollectStatistics should be set TRUE to support it.
301 @retval EFI_BUFFER_TOO_SMALL The buffer is too small to hold the next variable information.
302 @retval EFI_INVALID_PARAMETER Input parameter is invalid.
306 SmmVariableGetStatistics (
307 IN OUT VARIABLE_INFO_ENTRY
*InfoEntry
,
308 IN OUT UINTN
*InfoSize
311 VARIABLE_INFO_ENTRY
*VariableInfo
;
313 UINTN StatisticsInfoSize
;
316 if (InfoEntry
== NULL
) {
317 return EFI_INVALID_PARAMETER
;
320 VariableInfo
= gVariableInfo
;
321 if (VariableInfo
== NULL
) {
322 return EFI_UNSUPPORTED
;
325 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + StrSize (VariableInfo
->Name
);
326 if (*InfoSize
< StatisticsInfoSize
) {
327 *InfoSize
= StatisticsInfoSize
;
328 return EFI_BUFFER_TOO_SMALL
;
330 InfoName
= (CHAR16
*)(InfoEntry
+ 1);
332 if (CompareGuid (&InfoEntry
->VendorGuid
, &mZeroGuid
)) {
334 // Return the first variable info
336 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
337 CopyMem (InfoName
, VariableInfo
->Name
, StrSize (VariableInfo
->Name
));
338 *InfoSize
= StatisticsInfoSize
;
343 // Get the next variable info
345 while (VariableInfo
!= NULL
) {
346 if (CompareGuid (&VariableInfo
->VendorGuid
, &InfoEntry
->VendorGuid
)) {
347 NameLength
= StrSize (VariableInfo
->Name
);
348 if (NameLength
== StrSize (InfoName
)) {
349 if (CompareMem (VariableInfo
->Name
, InfoName
, NameLength
) == 0) {
351 // Find the match one
353 VariableInfo
= VariableInfo
->Next
;
358 VariableInfo
= VariableInfo
->Next
;
361 if (VariableInfo
== NULL
) {
367 // Output the new variable info
369 StatisticsInfoSize
= sizeof (VARIABLE_INFO_ENTRY
) + StrSize (VariableInfo
->Name
);
370 if (*InfoSize
< StatisticsInfoSize
) {
371 *InfoSize
= StatisticsInfoSize
;
372 return EFI_BUFFER_TOO_SMALL
;
375 CopyMem (InfoEntry
, VariableInfo
, sizeof (VARIABLE_INFO_ENTRY
));
376 CopyMem (InfoName
, VariableInfo
->Name
, StrSize (VariableInfo
->Name
));
377 *InfoSize
= StatisticsInfoSize
;
384 Communication service SMI Handler entry.
386 This SMI handler provides services for the variable wrapper driver.
388 Caution: This function may receive untrusted input.
389 This variable data and communicate buffer are external input, so this function will do basic validation.
390 Each sub function VariableServiceGetVariable(), VariableServiceGetNextVariableName(),
391 VariableServiceSetVariable(), VariableServiceQueryVariableInfo(), ReclaimForOS(),
392 SmmVariableGetStatistics() should also do validation based on its own knowledge.
394 @param[in] DispatchHandle The unique handle assigned to this handler by SmiHandlerRegister().
395 @param[in] RegisterContext Points to an optional handler context which was specified when the
396 handler was registered.
397 @param[in, out] CommBuffer A pointer to a collection of data in memory that will
398 be conveyed from a non-SMM environment into an SMM environment.
399 @param[in, out] CommBufferSize The size of the CommBuffer.
401 @retval EFI_SUCCESS The interrupt was handled and quiesced. No other handlers
402 should still be called.
403 @retval EFI_WARN_INTERRUPT_SOURCE_QUIESCED The interrupt has been quiesced but other handlers should
405 @retval EFI_WARN_INTERRUPT_SOURCE_PENDING The interrupt is still pending and other handlers should still
407 @retval EFI_INTERRUPT_PENDING The interrupt could not be quiesced.
413 IN EFI_HANDLE DispatchHandle
,
414 IN CONST VOID
*RegisterContext
,
415 IN OUT VOID
*CommBuffer
,
416 IN OUT UINTN
*CommBufferSize
420 SMM_VARIABLE_COMMUNICATE_HEADER
*SmmVariableFunctionHeader
;
421 SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*SmmVariableHeader
;
422 SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*GetNextVariableName
;
423 SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*QueryVariableInfo
;
424 VARIABLE_INFO_ENTRY
*VariableInfo
;
428 // If input is invalid, stop processing this SMI
430 if (CommBuffer
== NULL
|| CommBufferSize
== NULL
) {
434 if (*CommBufferSize
< sizeof(SMM_VARIABLE_COMMUNICATE_HEADER
) - 1) {
438 if (InternalIsAddressInSmram ((EFI_PHYSICAL_ADDRESS
)(UINTN
)CommBuffer
, *CommBufferSize
)) {
439 DEBUG ((EFI_D_ERROR
, "SMM communication buffer size is in SMRAM!\n"));
443 SmmVariableFunctionHeader
= (SMM_VARIABLE_COMMUNICATE_HEADER
*)CommBuffer
;
445 switch (SmmVariableFunctionHeader
->Function
) {
446 case SMM_VARIABLE_FUNCTION_GET_VARIABLE
:
447 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) SmmVariableFunctionHeader
->Data
;
448 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
, Name
)
449 + SmmVariableHeader
->DataSize
+ SmmVariableHeader
->NameSize
;
452 // SMRAM range check already covered before
454 if (InfoSize
> *CommBufferSize
- OFFSET_OF (SMM_VARIABLE_COMMUNICATE_HEADER
, Data
)) {
455 DEBUG ((EFI_D_ERROR
, "Data size exceed communication buffer size limit!\n"));
456 Status
= EFI_ACCESS_DENIED
;
460 Status
= VariableServiceGetVariable (
461 SmmVariableHeader
->Name
,
462 &SmmVariableHeader
->Guid
,
463 &SmmVariableHeader
->Attributes
,
464 &SmmVariableHeader
->DataSize
,
465 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
469 case SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME
:
470 GetNextVariableName
= (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
*) SmmVariableFunctionHeader
->Data
;
471 InfoSize
= OFFSET_OF(SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME
, Name
) + GetNextVariableName
->NameSize
;
474 // SMRAM range check already covered before
476 if (InfoSize
> *CommBufferSize
- OFFSET_OF (SMM_VARIABLE_COMMUNICATE_HEADER
, Data
)) {
477 DEBUG ((EFI_D_ERROR
, "Data size exceed communication buffer size limit!\n"));
478 Status
= EFI_ACCESS_DENIED
;
482 Status
= VariableServiceGetNextVariableName (
483 &GetNextVariableName
->NameSize
,
484 GetNextVariableName
->Name
,
485 &GetNextVariableName
->Guid
489 case SMM_VARIABLE_FUNCTION_SET_VARIABLE
:
490 SmmVariableHeader
= (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE
*) SmmVariableFunctionHeader
->Data
;
491 Status
= VariableServiceSetVariable (
492 SmmVariableHeader
->Name
,
493 &SmmVariableHeader
->Guid
,
494 SmmVariableHeader
->Attributes
,
495 SmmVariableHeader
->DataSize
,
496 (UINT8
*)SmmVariableHeader
->Name
+ SmmVariableHeader
->NameSize
500 case SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO
:
501 QueryVariableInfo
= (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
*) SmmVariableFunctionHeader
->Data
;
502 InfoSize
= sizeof(SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO
);
505 // SMRAM range check already covered before
507 if (InfoSize
> *CommBufferSize
- OFFSET_OF (SMM_VARIABLE_COMMUNICATE_HEADER
, Data
)) {
508 DEBUG ((EFI_D_ERROR
, "Data size exceed communication buffer size limit!\n"));
509 Status
= EFI_ACCESS_DENIED
;
513 Status
= VariableServiceQueryVariableInfo (
514 QueryVariableInfo
->Attributes
,
515 &QueryVariableInfo
->MaximumVariableStorageSize
,
516 &QueryVariableInfo
->RemainingVariableStorageSize
,
517 &QueryVariableInfo
->MaximumVariableSize
521 case SMM_VARIABLE_FUNCTION_READY_TO_BOOT
:
523 Status
= EFI_UNSUPPORTED
;
527 Status
= EFI_SUCCESS
;
530 case SMM_VARIABLE_FUNCTION_EXIT_BOOT_SERVICE
:
532 Status
= EFI_SUCCESS
;
535 case SMM_VARIABLE_FUNCTION_GET_STATISTICS
:
536 VariableInfo
= (VARIABLE_INFO_ENTRY
*) SmmVariableFunctionHeader
->Data
;
537 InfoSize
= *CommBufferSize
- OFFSET_OF (SMM_VARIABLE_COMMUNICATE_HEADER
, Data
);
540 // Do not need to check SmmVariableFunctionHeader->Data in SMRAM here.
541 // It is covered by previous CommBuffer check
544 if (InternalIsAddressInSmram ((EFI_PHYSICAL_ADDRESS
)(UINTN
)CommBufferSize
, sizeof(UINTN
))) {
545 DEBUG ((EFI_D_ERROR
, "SMM communication buffer size is in SMRAM!\n"));
546 Status
= EFI_ACCESS_DENIED
;
550 Status
= SmmVariableGetStatistics (VariableInfo
, &InfoSize
);
551 *CommBufferSize
= InfoSize
+ OFFSET_OF (SMM_VARIABLE_COMMUNICATE_HEADER
, Data
);
555 Status
= EFI_UNSUPPORTED
;
560 SmmVariableFunctionHeader
->ReturnStatus
= Status
;
566 SMM Fault Tolerant Write protocol notification event handler.
568 Non-Volatile variable write may needs FTW protocol to reclaim when
571 @param Protocol Points to the protocol's unique identifier
572 @param Interface Points to the interface instance
573 @param Handle The handle on which the interface was installed
575 @retval EFI_SUCCESS SmmEventCallback runs successfully
576 @retval EFI_NOT_FOUND The Fvb protocol for variable is not found.
581 SmmFtwNotificationEvent (
582 IN CONST EFI_GUID
*Protocol
,
588 EFI_SMM_FIRMWARE_VOLUME_BLOCK_PROTOCOL
*FvbProtocol
;
589 EFI_SMM_FAULT_TOLERANT_WRITE_PROTOCOL
*FtwProtocol
;
590 EFI_PHYSICAL_ADDRESS NvStorageVariableBase
;
592 if (mVariableModuleGlobal
->FvbInstance
!= NULL
) {
597 // Ensure SMM FTW protocol is installed.
599 Status
= GetFtwProtocol ((VOID
**)&FtwProtocol
);
600 if (EFI_ERROR (Status
)) {
605 // Find the proper FVB protocol for variable.
607 NvStorageVariableBase
= (EFI_PHYSICAL_ADDRESS
) PcdGet64 (PcdFlashNvStorageVariableBase64
);
608 if (NvStorageVariableBase
== 0) {
609 NvStorageVariableBase
= (EFI_PHYSICAL_ADDRESS
) PcdGet32 (PcdFlashNvStorageVariableBase
);
611 Status
= GetFvbInfoByAddress (NvStorageVariableBase
, NULL
, &FvbProtocol
);
612 if (EFI_ERROR (Status
)) {
613 return EFI_NOT_FOUND
;
616 mVariableModuleGlobal
->FvbInstance
= FvbProtocol
;
618 Status
= VariableWriteServiceInitialize ();
619 ASSERT_EFI_ERROR (Status
);
622 // Notify the variable wrapper driver the variable write service is ready
624 Status
= gBS
->InstallProtocolInterface (
626 &gSmmVariableWriteGuid
,
627 EFI_NATIVE_INTERFACE
,
630 ASSERT_EFI_ERROR (Status
);
637 Variable Driver main entry point. The Variable driver places the 4 EFI
638 runtime services in the EFI System Table and installs arch protocols
639 for variable read and write services being available. It also registers
640 a notification function for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
642 @param[in] ImageHandle The firmware allocated handle for the EFI image.
643 @param[in] SystemTable A pointer to the EFI System Table.
645 @retval EFI_SUCCESS Variable service successfully initialized.
650 VariableServiceInitialize (
651 IN EFI_HANDLE ImageHandle
,
652 IN EFI_SYSTEM_TABLE
*SystemTable
656 EFI_HANDLE VariableHandle
;
657 VOID
*SmmFtwRegistration
;
658 EFI_SMM_ACCESS2_PROTOCOL
*SmmAccess
;
662 // Variable initialize.
664 Status
= VariableCommonInitialize ();
665 ASSERT_EFI_ERROR (Status
);
668 // Install the Smm Variable Protocol on a new handle.
670 VariableHandle
= NULL
;
671 Status
= gSmst
->SmmInstallProtocolInterface (
673 &gEfiSmmVariableProtocolGuid
,
674 EFI_NATIVE_INTERFACE
,
677 ASSERT_EFI_ERROR (Status
);
680 // Get SMRAM information
682 Status
= gBS
->LocateProtocol (&gEfiSmmAccess2ProtocolGuid
, NULL
, (VOID
**)&SmmAccess
);
683 ASSERT_EFI_ERROR (Status
);
686 Status
= SmmAccess
->GetCapabilities (SmmAccess
, &Size
, NULL
);
687 ASSERT (Status
== EFI_BUFFER_TOO_SMALL
);
689 Status
= gSmst
->SmmAllocatePool (
690 EfiRuntimeServicesData
,
692 (VOID
**)&mSmramRanges
694 ASSERT_EFI_ERROR (Status
);
696 Status
= SmmAccess
->GetCapabilities (SmmAccess
, &Size
, mSmramRanges
);
697 ASSERT_EFI_ERROR (Status
);
699 mSmramRangeCount
= Size
/ sizeof (EFI_SMRAM_DESCRIPTOR
);
702 /// Register SMM variable SMI handler
704 VariableHandle
= NULL
;
705 Status
= gSmst
->SmiHandlerRegister (SmmVariableHandler
, &gEfiSmmVariableProtocolGuid
, &VariableHandle
);
706 ASSERT_EFI_ERROR (Status
);
709 // Notify the variable wrapper driver the variable service is ready
711 Status
= SystemTable
->BootServices
->InstallProtocolInterface (
713 &gEfiSmmVariableProtocolGuid
,
714 EFI_NATIVE_INTERFACE
,
717 ASSERT_EFI_ERROR (Status
);
720 // Register FtwNotificationEvent () notify function.
722 Status
= gSmst
->SmmRegisterProtocolNotify (
723 &gEfiSmmFaultTolerantWriteProtocolGuid
,
724 SmmFtwNotificationEvent
,
727 ASSERT_EFI_ERROR (Status
);
729 SmmFtwNotificationEvent (NULL
, NULL
, NULL
);