SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c

   1 /** @file
   2   Implement all four UEFI Runtime Variable services for the nonvolatile
   3   and volatile storage space and install variable architecture protocol
   4   based on SMM variable module.
   5
   6   Caution: This module requires additional review when modified.
   7   This driver will have external input - variable data.
   8   This external input must be validated carefully to avoid security issue like
   9   buffer overflow, integer overflow.
  10
  11   RuntimeServiceGetVariable() and RuntimeServiceSetVariable() are external API
  12   to receive data buffer. The size should be checked carefully.
  13
  14   InitCommunicateBuffer() is really function to check the variable data size.
  15
  16 Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.<BR>
  17 This program and the accompanying materials
  18 are licensed and made available under the terms and conditions of the BSD License
  19 which accompanies this distribution.  The full text of the license may be found at
  20 http://opensource.org/licenses/bsd-license.php
  21
  22 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  23 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  24
  25 **/
  26
  27 #include <PiDxe.h>
  28 #include <Protocol/VariableWrite.h>
  29 #include <Protocol/Variable.h>
  30 #include <Protocol/SmmCommunication.h>
  31 #include <Protocol/SmmVariable.h>
  32
  33 #include <Library/UefiBootServicesTableLib.h>
  34 #include <Library/UefiRuntimeServicesTableLib.h>
  35 #include <Library/MemoryAllocationLib.h>
  36 #include <Library/UefiDriverEntryPoint.h>
  37 #include <Library/UefiRuntimeLib.h>
  38 #include <Library/BaseMemoryLib.h>
  39 #include <Library/DebugLib.h>
  40 #include <Library/PcdLib.h>
  41 #include <Library/UefiLib.h>
  42 #include <Library/BaseLib.h>
  43
  44 #include <Guid/EventGroup.h>
  45 #include <Guid/AuthenticatedVariableFormat.h>
  46 #include <Guid/SmmVariableCommon.h>
  47
  48 EFI_HANDLE                       mHandle                    = NULL;
  49 EFI_SMM_VARIABLE_PROTOCOL       *mSmmVariable               = NULL;
  50 EFI_EVENT                        mVirtualAddressChangeEvent = NULL;
  51 EFI_SMM_COMMUNICATION_PROTOCOL  *mSmmCommunication          = NULL;
  52 UINT8                           *mVariableBuffer            = NULL;
  53 UINT8                           *mVariableBufferPhysical    = NULL;
  54 UINTN                            mVariableBufferSize;
  55 EFI_LOCK                         mVariableServicesLock;
  56
  57 /**
  58   Acquires lock only at boot time. Simply returns at runtime.
  59
  60   This is a temperary function that will be removed when
  61   EfiAcquireLock() in UefiLib can handle the call in UEFI
  62   Runtimer driver in RT phase.
  63   It calls EfiAcquireLock() at boot time, and simply returns
  64   at runtime.
  65
  66   @param  Lock         A pointer to the lock to acquire.
  67
  68 **/
  69 VOID
  70 AcquireLockOnlyAtBootTime (
  71   IN EFI_LOCK                             *Lock
  72   )
  73 {
  74   if (!EfiAtRuntime ()) {
  75     EfiAcquireLock (Lock);
  76   }
  77 }
  78
  79 /**
  80   Releases lock only at boot time. Simply returns at runtime.
  81
  82   This is a temperary function which will be removed when
  83   EfiReleaseLock() in UefiLib can handle the call in UEFI
  84   Runtimer driver in RT phase.
  85   It calls EfiReleaseLock() at boot time and simply returns
  86   at runtime.
  87
  88   @param  Lock         A pointer to the lock to release.
  89
  90 **/
  91 VOID
  92 ReleaseLockOnlyAtBootTime (
  93   IN EFI_LOCK                             *Lock
  94   )
  95 {
  96   if (!EfiAtRuntime ()) {
  97     EfiReleaseLock (Lock);
  98   }
  99 }
 100
 101 /**
 102   Initialize the communicate buffer using DataSize and Function.
 103
 104   The communicate size is: SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE +
 105   DataSize.
 106
 107   Caution: This function may receive untrusted input.
 108   The data size external input, so this function will validate it carefully to avoid buffer overflow.
 109
 110   @param[out]      DataPtr          Points to the data in the communicate buffer.
 111   @param[in]       DataSize         The data size to send to SMM.
 112   @param[in]       Function         The function number to initialize the communicate header.
 113
 114   @retval EFI_INVALID_PARAMETER     The data size is too big.
 115   @retval EFI_SUCCESS               Find the specified variable.
 116
 117 **/
 118 EFI_STATUS
 119 InitCommunicateBuffer (
 120   OUT     VOID                              **DataPtr OPTIONAL,
 121   IN      UINTN                             DataSize,
 122   IN      UINTN                             Function
 123   )
 124 {
 125   EFI_SMM_COMMUNICATE_HEADER                *SmmCommunicateHeader;
 126   SMM_VARIABLE_COMMUNICATE_HEADER           *SmmVariableFunctionHeader;
 127
 128
 129   if (DataSize + SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE > mVariableBufferSize) {
 130     return EFI_INVALID_PARAMETER;
 131   }
 132
 133   SmmCommunicateHeader = (EFI_SMM_COMMUNICATE_HEADER *) mVariableBuffer;
 134   CopyGuid (&SmmCommunicateHeader->HeaderGuid, &gEfiSmmVariableProtocolGuid);
 135   SmmCommunicateHeader->MessageLength = DataSize + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;
 136
 137   SmmVariableFunctionHeader = (SMM_VARIABLE_COMMUNICATE_HEADER *) SmmCommunicateHeader->Data;
 138   SmmVariableFunctionHeader->Function = Function;
 139   if (DataPtr != NULL) {
 140     *DataPtr = SmmVariableFunctionHeader->Data;
 141   }
 142
 143   return EFI_SUCCESS;
 144 }
 145
 146
 147 /**
 148   Send the data in communicate buffer to SMM.
 149
 150   @param[in]   DataSize               This size of the function header and the data.
 151
 152   @retval      EFI_SUCCESS            Success is returned from the functin in SMM.
 153   @retval      Others                 Failure is returned from the function in SMM.
 154
 155 **/
 156 EFI_STATUS
 157 SendCommunicateBuffer (
 158   IN      UINTN                             DataSize
 159   )
 160 {
 161   EFI_STATUS                                Status;
 162   UINTN                                     CommSize;
 163   EFI_SMM_COMMUNICATE_HEADER                *SmmCommunicateHeader;
 164   SMM_VARIABLE_COMMUNICATE_HEADER           *SmmVariableFunctionHeader;
 165
 166   CommSize = DataSize + SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;
 167   Status = mSmmCommunication->Communicate (mSmmCommunication, mVariableBufferPhysical, &CommSize);
 168   ASSERT_EFI_ERROR (Status);
 169
 170   SmmCommunicateHeader      = (EFI_SMM_COMMUNICATE_HEADER *) mVariableBuffer;
 171   SmmVariableFunctionHeader = (SMM_VARIABLE_COMMUNICATE_HEADER *)SmmCommunicateHeader->Data;
 172   return  SmmVariableFunctionHeader->ReturnStatus;
 173 }
 174
 175
 176 /**
 177   This code finds variable in storage blocks (Volatile or Non-Volatile).
 178
 179   Caution: This function may receive untrusted input.
 180   The data size is external input, so this function will validate it carefully to avoid buffer overflow.
 181
 182   @param[in]      VariableName       Name of Variable to be found.
 183   @param[in]      VendorGuid         Variable vendor GUID.
 184   @param[out]     Attributes         Attribute value of the variable found.
 185   @param[in, out] DataSize           Size of Data found. If size is less than the
 186                                      data, this value contains the required size.
 187   @param[out]     Data               Data pointer.
 188
 189   @retval EFI_INVALID_PARAMETER      Invalid parameter.
 190   @retval EFI_SUCCESS                Find the specified variable.
 191   @retval EFI_NOT_FOUND              Not found.
 192   @retval EFI_BUFFER_TO_SMALL        DataSize is too small for the result.
 193
 194 **/
 195 EFI_STATUS
 196 EFIAPI
 197 RuntimeServiceGetVariable (
 198   IN      CHAR16                            *VariableName,
 199   IN      EFI_GUID                          *VendorGuid,
 200   OUT     UINT32                            *Attributes OPTIONAL,
 201   IN OUT  UINTN                             *DataSize,
 202   OUT     VOID                              *Data
 203   )
 204 {
 205   EFI_STATUS                                Status;
 206   UINTN                                     PayloadSize;
 207   SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE  *SmmVariableHeader;
 208   UINTN                                     SmmCommBufPayloadSize;
 209   UINTN                                     TempDataSize;
 210   UINTN                                     VariableNameSize;
 211
 212   if (VariableName == NULL || VendorGuid == NULL || DataSize == NULL) {
 213     return EFI_INVALID_PARAMETER;
 214   }
 215
 216   if ((*DataSize != 0) && (Data == NULL)) {
 217     return EFI_INVALID_PARAMETER;
 218   }
 219
 220   //
 221   // SMM Communication Buffer max payload size
 222   //
 223   SmmCommBufPayloadSize = mVariableBufferSize - (SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE);
 224   TempDataSize          = *DataSize;
 225   VariableNameSize      = StrSize (VariableName);
 226
 227   //
 228   // If VariableName exceeds SMM payload limit. Return failure
 229   //
 230   if (VariableNameSize > SmmCommBufPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name)) {
 231     return EFI_INVALID_PARAMETER;
 232   }
 233
 234   AcquireLockOnlyAtBootTime(&mVariableServicesLock);
 235
 236   //
 237   // Init the communicate buffer. The buffer data size is:
 238   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
 239   //
 240   if (TempDataSize > SmmCommBufPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) - VariableNameSize) {
 241     //
 242     // If output data buffer exceed SMM payload limit. Trim output buffer to SMM payload size
 243     //
 244     TempDataSize = SmmCommBufPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) - VariableNameSize;
 245   }
 246   PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) + VariableNameSize + TempDataSize;
 247
 248   Status = InitCommunicateBuffer ((VOID **)&SmmVariableHeader, PayloadSize, SMM_VARIABLE_FUNCTION_GET_VARIABLE);
 249   if (EFI_ERROR (Status)) {
 250     goto Done;
 251   }
 252   ASSERT (SmmVariableHeader != NULL);
 253
 254   CopyGuid (&SmmVariableHeader->Guid, VendorGuid);
 255   SmmVariableHeader->DataSize   = TempDataSize;
 256   SmmVariableHeader->NameSize   = VariableNameSize;
 257   if (Attributes == NULL) {
 258     SmmVariableHeader->Attributes = 0;
 259   } else {
 260     SmmVariableHeader->Attributes = *Attributes;
 261   }
 262   CopyMem (SmmVariableHeader->Name, VariableName, SmmVariableHeader->NameSize);
 263
 264   //
 265   // Send data to SMM.
 266   //
 267   Status = SendCommunicateBuffer (PayloadSize);
 268
 269   //
 270   // Get data from SMM.
 271   //
 272   if (Status == EFI_SUCCESS || Status == EFI_BUFFER_TOO_SMALL) {
 273     //
 274     // SMM CommBuffer DataSize can be a trimed value
 275     // Only update DataSize when needed
 276     //
 277     *DataSize = SmmVariableHeader->DataSize;
 278   }
 279   if (Attributes != NULL) {
 280     *Attributes = SmmVariableHeader->Attributes;
 281   }
 282
 283   if (EFI_ERROR (Status)) {
 284     goto Done;
 285   }
 286
 287   CopyMem (Data, (UINT8 *)SmmVariableHeader->Name + SmmVariableHeader->NameSize, SmmVariableHeader->DataSize);
 288
 289 Done:
 290   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
 291   return Status;
 292 }
 293
 294
 295 /**
 296   This code Finds the Next available variable.
 297
 298   @param[in, out] VariableNameSize   Size of the variable name.
 299   @param[in, out] VariableName       Pointer to variable name.
 300   @param[in, out] VendorGuid         Variable Vendor Guid.
 301
 302   @retval EFI_INVALID_PARAMETER      Invalid parameter.
 303   @retval EFI_SUCCESS                Find the specified variable.
 304   @retval EFI_NOT_FOUND              Not found.
 305   @retval EFI_BUFFER_TO_SMALL        DataSize is too small for the result.
 306
 307 **/
 308 EFI_STATUS
 309 EFIAPI
 310 RuntimeServiceGetNextVariableName (
 311   IN OUT  UINTN                             *VariableNameSize,
 312   IN OUT  CHAR16                            *VariableName,
 313   IN OUT  EFI_GUID                          *VendorGuid
 314   )
 315 {
 316   EFI_STATUS                                      Status;
 317   UINTN                                           PayloadSize;
 318   SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME *SmmGetNextVariableName;
 319   UINTN                                           SmmCommBufPayloadSize;
 320   UINTN                                           OutVariableNameSize;
 321   UINTN                                           InVariableNameSize;
 322
 323   if (VariableNameSize == NULL || VariableName == NULL || VendorGuid == NULL) {
 324     return EFI_INVALID_PARAMETER;
 325   }
 326
 327   //
 328   // SMM Communication Buffer max payload size
 329   //
 330   SmmCommBufPayloadSize = mVariableBufferSize - (SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE);
 331   OutVariableNameSize   = *VariableNameSize;
 332   InVariableNameSize    = StrSize (VariableName);
 333
 334   //
 335   // If input string exceeds SMM payload limit. Return failure
 336   //
 337   if (InVariableNameSize > SmmCommBufPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name)) {
 338     return EFI_INVALID_PARAMETER;
 339   }
 340
 341   AcquireLockOnlyAtBootTime(&mVariableServicesLock);
 342
 343   //
 344   // Init the communicate buffer. The buffer data size is:
 345   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
 346   //
 347   if (OutVariableNameSize > SmmCommBufPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name)) {
 348     //
 349     // If output buffer exceed SMM payload limit. Trim output buffer to SMM payload size
 350     //
 351     OutVariableNameSize = SmmCommBufPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name);
 352   }
 353   //
 354   // Payload should be Guid + NameSize + MAX of Input & Output buffer
 355   //
 356   PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name) + MAX (OutVariableNameSize, InVariableNameSize);
 357
 358   Status = InitCommunicateBuffer ((VOID **)&SmmGetNextVariableName, PayloadSize, SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME);
 359   if (EFI_ERROR (Status)) {
 360     goto Done;
 361   }
 362   ASSERT (SmmGetNextVariableName != NULL);
 363
 364   //
 365   // SMM comm buffer->NameSize is buffer size for return string
 366   //
 367   SmmGetNextVariableName->NameSize = OutVariableNameSize;
 368
 369   CopyGuid (&SmmGetNextVariableName->Guid, VendorGuid);
 370   //
 371   // Copy whole string
 372   //
 373   CopyMem (SmmGetNextVariableName->Name, VariableName, InVariableNameSize);
 374   if (OutVariableNameSize > InVariableNameSize) {
 375     ZeroMem ((UINT8 *) SmmGetNextVariableName->Name + InVariableNameSize, OutVariableNameSize - InVariableNameSize);
 376   }
 377
 378   //
 379   // Send data to SMM
 380   //
 381   Status = SendCommunicateBuffer (PayloadSize);
 382
 383   //
 384   // Get data from SMM.
 385   //
 386   if (Status == EFI_SUCCESS || Status == EFI_BUFFER_TOO_SMALL) {
 387     //
 388     // SMM CommBuffer NameSize can be a trimed value
 389     // Only update VariableNameSize when needed
 390     //
 391     *VariableNameSize = SmmGetNextVariableName->NameSize;
 392   }
 393   if (EFI_ERROR (Status)) {
 394     goto Done;
 395   }
 396
 397   CopyGuid (VendorGuid, &SmmGetNextVariableName->Guid);
 398   CopyMem (VariableName, SmmGetNextVariableName->Name, SmmGetNextVariableName->NameSize);
 399
 400 Done:
 401   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
 402   return Status;
 403 }
 404
 405 /**
 406   This code sets variable in storage blocks (Volatile or Non-Volatile).
 407
 408   Caution: This function may receive untrusted input.
 409   The data size and data are external input, so this function will validate it carefully to avoid buffer overflow.
 410
 411   @param[in] VariableName                 Name of Variable to be found.
 412   @param[in] VendorGuid                   Variable vendor GUID.
 413   @param[in] Attributes                   Attribute value of the variable found
 414   @param[in] DataSize                     Size of Data found. If size is less than the
 415                                           data, this value contains the required size.
 416   @param[in] Data                         Data pointer.
 417
 418   @retval EFI_INVALID_PARAMETER           Invalid parameter.
 419   @retval EFI_SUCCESS                     Set successfully.
 420   @retval EFI_OUT_OF_RESOURCES            Resource not enough to set variable.
 421   @retval EFI_NOT_FOUND                   Not found.
 422   @retval EFI_WRITE_PROTECTED             Variable is read-only.
 423
 424 **/
 425 EFI_STATUS
 426 EFIAPI
 427 RuntimeServiceSetVariable (
 428   IN CHAR16                                 *VariableName,
 429   IN EFI_GUID                               *VendorGuid,
 430   IN UINT32                                 Attributes,
 431   IN UINTN                                  DataSize,
 432   IN VOID                                   *Data
 433   )
 434 {
 435   EFI_STATUS                                Status;
 436   UINTN                                     PayloadSize;
 437   SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE  *SmmVariableHeader;
 438   UINTN                                     VariableNameSize;
 439
 440   //
 441   // Check input parameters.
 442   //
 443   if (VariableName == NULL || VariableName[0] == 0 || VendorGuid == NULL) {
 444     return EFI_INVALID_PARAMETER;
 445   }
 446
 447   if (DataSize != 0 && Data == NULL) {
 448     return EFI_INVALID_PARAMETER;
 449   }
 450
 451   if (DataSize >= mVariableBufferSize) {
 452     //
 453     // DataSize may be near MAX_ADDRESS incorrectly, this can cause the computed PayLoadSize to
 454     // overflow to a small value and pass the check in InitCommunicateBuffer().
 455     // To protect against this vulnerability, return EFI_INVALID_PARAMETER if DataSize is >= mVariableBufferSize.
 456     // And there will be further check to ensure the total size is also not > mVariableBufferSize.
 457     //
 458     return EFI_INVALID_PARAMETER;
 459   }
 460   VariableNameSize      = StrSize (VariableName);
 461
 462   if ((UINTN)(~0) - VariableNameSize < OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) + DataSize) {
 463     //
 464     // Prevent PayloadSize overflow
 465     //
 466     return EFI_INVALID_PARAMETER;
 467   }
 468
 469   AcquireLockOnlyAtBootTime(&mVariableServicesLock);
 470
 471   //
 472   // Init the communicate buffer. The buffer data size is:
 473   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
 474   //
 475   PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) + VariableNameSize + DataSize;
 476   Status = InitCommunicateBuffer ((VOID **)&SmmVariableHeader, PayloadSize, SMM_VARIABLE_FUNCTION_SET_VARIABLE);
 477   if (EFI_ERROR (Status)) {
 478     goto Done;
 479   }
 480   ASSERT (SmmVariableHeader != NULL);
 481
 482   CopyGuid ((EFI_GUID *) &SmmVariableHeader->Guid, VendorGuid);
 483   SmmVariableHeader->DataSize   = DataSize;
 484   SmmVariableHeader->NameSize   = VariableNameSize;
 485   SmmVariableHeader->Attributes = Attributes;
 486   CopyMem (SmmVariableHeader->Name, VariableName, SmmVariableHeader->NameSize);
 487   CopyMem ((UINT8 *) SmmVariableHeader->Name + SmmVariableHeader->NameSize, Data, DataSize);
 488
 489   //
 490   // Send data to SMM.
 491   //
 492   Status = SendCommunicateBuffer (PayloadSize);
 493
 494 Done:
 495   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
 496   return Status;
 497 }
 498
 499
 500 /**
 501   This code returns information about the EFI variables.
 502
 503   @param[in]  Attributes                   Attributes bitmask to specify the type of variables
 504                                            on which to return information.
 505   @param[out] MaximumVariableStorageSize   Pointer to the maximum size of the storage space available
 506                                            for the EFI variables associated with the attributes specified.
 507   @param[out] RemainingVariableStorageSize Pointer to the remaining size of the storage space available
 508                                            for EFI variables associated with the attributes specified.
 509   @param[out] MaximumVariableSize          Pointer to the maximum size of an individual EFI variables
 510                                            associated with the attributes specified.
 511
 512   @retval EFI_INVALID_PARAMETER            An invalid combination of attribute bits was supplied.
 513   @retval EFI_SUCCESS                      Query successfully.
 514   @retval EFI_UNSUPPORTED                  The attribute is not supported on this platform.
 515
 516 **/
 517 EFI_STATUS
 518 EFIAPI
 519 RuntimeServiceQueryVariableInfo (
 520   IN  UINT32                                Attributes,
 521   OUT UINT64                                *MaximumVariableStorageSize,
 522   OUT UINT64                                *RemainingVariableStorageSize,
 523   OUT UINT64                                *MaximumVariableSize
 524   )
 525 {
 526   EFI_STATUS                                Status;
 527   UINTN                                     PayloadSize;
 528   SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO *SmmQueryVariableInfo;
 529
 530   if(MaximumVariableStorageSize == NULL || RemainingVariableStorageSize == NULL || MaximumVariableSize == NULL || Attributes == 0) {
 531     return EFI_INVALID_PARAMETER;
 532   }
 533
 534   AcquireLockOnlyAtBootTime(&mVariableServicesLock);
 535
 536   //
 537   // Init the communicate buffer. The buffer data size is:
 538   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize;
 539   //
 540   PayloadSize = sizeof (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO);
 541   Status = InitCommunicateBuffer ((VOID **)&SmmQueryVariableInfo, PayloadSize, SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO);
 542   if (EFI_ERROR (Status)) {
 543     goto Done;
 544   }
 545   ASSERT (SmmQueryVariableInfo != NULL);
 546
 547   SmmQueryVariableInfo->Attributes  = Attributes;
 548
 549   //
 550   // Send data to SMM.
 551   //
 552   Status = SendCommunicateBuffer (PayloadSize);
 553   if (EFI_ERROR (Status)) {
 554     goto Done;
 555   }
 556
 557   //
 558   // Get data from SMM.
 559   //
 560   *MaximumVariableSize          = SmmQueryVariableInfo->MaximumVariableSize;
 561   *MaximumVariableStorageSize   = SmmQueryVariableInfo->MaximumVariableStorageSize;
 562   *RemainingVariableStorageSize = SmmQueryVariableInfo->RemainingVariableStorageSize;
 563
 564 Done:
 565   ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
 566   return Status;
 567 }
 568
 569
 570 /**
 571   Exit Boot Services Event notification handler.
 572
 573   Notify SMM variable driver about the event.
 574
 575   @param[in]  Event     Event whose notification function is being invoked.
 576   @param[in]  Context   Pointer to the notification function's context.
 577
 578 **/
 579 VOID
 580 EFIAPI
 581 OnExitBootServices (
 582   IN      EFI_EVENT                         Event,
 583   IN      VOID                              *Context
 584   )
 585 {
 586   //
 587   // Init the communicate buffer. The buffer data size is:
 588   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE.
 589   //
 590   InitCommunicateBuffer (NULL, 0, SMM_VARIABLE_FUNCTION_EXIT_BOOT_SERVICE);
 591
 592   //
 593   // Send data to SMM.
 594   //
 595   SendCommunicateBuffer (0);
 596 }
 597
 598
 599 /**
 600   On Ready To Boot Services Event notification handler.
 601
 602   Notify SMM variable driver about the event.
 603
 604   @param[in]  Event     Event whose notification function is being invoked
 605   @param[in]  Context   Pointer to the notification function's context
 606
 607 **/
 608 VOID
 609 EFIAPI
 610 OnReadyToBoot (
 611   IN      EFI_EVENT                         Event,
 612   IN      VOID                              *Context
 613   )
 614 {
 615   //
 616   // Init the communicate buffer. The buffer data size is:
 617   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE.
 618   //
 619   InitCommunicateBuffer (NULL, 0, SMM_VARIABLE_FUNCTION_READY_TO_BOOT);
 620
 621   //
 622   // Send data to SMM.
 623   //
 624   SendCommunicateBuffer (0);
 625 }
 626
 627
 628 /**
 629   Notification function of EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE.
 630
 631   This is a notification function registered on EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
 632   It convers pointer to new virtual address.
 633
 634   @param[in]  Event        Event whose notification function is being invoked.
 635   @param[in]  Context      Pointer to the notification function's context.
 636
 637 **/
 638 VOID
 639 EFIAPI
 640 VariableAddressChangeEvent (
 641   IN EFI_EVENT                              Event,
 642   IN VOID                                   *Context
 643   )
 644 {
 645   EfiConvertPointer (0x0, (VOID **) &mVariableBuffer);
 646   EfiConvertPointer (0x0, (VOID **) &mSmmCommunication);
 647 }
 648
 649
 650 /**
 651   Initialize variable service and install Variable Architectural protocol.
 652
 653   @param[in] Event    Event whose notification function is being invoked.
 654   @param[in] Context  Pointer to the notification function's context.
 655
 656 **/
 657 VOID
 658 EFIAPI
 659 SmmVariableReady (
 660   IN  EFI_EVENT                             Event,
 661   IN  VOID                                  *Context
 662   )
 663 {
 664   EFI_STATUS                                Status;
 665
 666   Status = gBS->LocateProtocol (&gEfiSmmVariableProtocolGuid, NULL, (VOID **)&mSmmVariable);
 667   if (EFI_ERROR (Status)) {
 668     return;
 669   }
 670
 671   Status = gBS->LocateProtocol (&gEfiSmmCommunicationProtocolGuid, NULL, (VOID **) &mSmmCommunication);
 672   ASSERT_EFI_ERROR (Status);
 673
 674   //
 675   // Allocate memory for variable store.
 676   //
 677   mVariableBufferSize  = SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;
 678   mVariableBufferSize += MAX (PcdGet32 (PcdMaxVariableSize), PcdGet32 (PcdMaxHardwareErrorVariableSize));
 679   mVariableBuffer      = AllocateRuntimePool (mVariableBufferSize);
 680   ASSERT (mVariableBuffer != NULL);
 681
 682   //
 683   // Save the buffer physical address used for SMM conmunication.
 684   //
 685   mVariableBufferPhysical = mVariableBuffer;
 686
 687   gRT->GetVariable         = RuntimeServiceGetVariable;
 688   gRT->GetNextVariableName = RuntimeServiceGetNextVariableName;
 689   gRT->SetVariable         = RuntimeServiceSetVariable;
 690   gRT->QueryVariableInfo   = RuntimeServiceQueryVariableInfo;
 691
 692   //
 693   // Install the Variable Architectural Protocol on a new handle.
 694   //
 695   Status = gBS->InstallProtocolInterface (
 696                   &mHandle,
 697                   &gEfiVariableArchProtocolGuid,
 698                   EFI_NATIVE_INTERFACE,
 699                   NULL
 700                   );
 701   ASSERT_EFI_ERROR (Status);
 702 }
 703
 704
 705 /**
 706   SMM Non-Volatile variable write service is ready notify event handler.
 707
 708   @param[in] Event    Event whose notification function is being invoked.
 709   @param[in] Context  Pointer to the notification function's context.
 710
 711 **/
 712 VOID
 713 EFIAPI
 714 SmmVariableWriteReady (
 715   IN  EFI_EVENT                             Event,
 716   IN  VOID                                  *Context
 717   )
 718 {
 719   EFI_STATUS                                Status;
 720   VOID                                      *ProtocolOps;
 721
 722   //
 723   // Check whether the protocol is installed or not.
 724   //
 725   Status = gBS->LocateProtocol (&gSmmVariableWriteGuid, NULL, (VOID **) &ProtocolOps);
 726   if (EFI_ERROR (Status)) {
 727     return;
 728   }
 729
 730   Status = gBS->InstallProtocolInterface (
 731                   &mHandle,
 732                   &gEfiVariableWriteArchProtocolGuid,
 733                   EFI_NATIVE_INTERFACE,
 734                   NULL
 735                   );
 736   ASSERT_EFI_ERROR (Status);
 737 }
 738
 739
 740 /**
 741   Variable Driver main entry point. The Variable driver places the 4 EFI
 742   runtime services in the EFI System Table and installs arch protocols
 743   for variable read and write services being available. It also registers
 744   a notification function for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
 745
 746   @param[in] ImageHandle    The firmware allocated handle for the EFI image.
 747   @param[in] SystemTable    A pointer to the EFI System Table.
 748
 749   @retval EFI_SUCCESS       Variable service successfully initialized.
 750
 751 **/
 752 EFI_STATUS
 753 EFIAPI
 754 VariableSmmRuntimeInitialize (
 755   IN EFI_HANDLE                             ImageHandle,
 756   IN EFI_SYSTEM_TABLE                       *SystemTable
 757   )
 758 {
 759   VOID                                      *SmmVariableRegistration;
 760   VOID                                      *SmmVariableWriteRegistration;
 761   EFI_EVENT                                 OnReadyToBootEvent;
 762   EFI_EVENT                                 ExitBootServiceEvent;
 763
 764   EfiInitializeLock (&mVariableServicesLock, TPL_NOTIFY);
 765
 766   //
 767   // Smm variable service is ready
 768   //
 769   EfiCreateProtocolNotifyEvent (
 770     &gEfiSmmVariableProtocolGuid,
 771     TPL_CALLBACK,
 772     SmmVariableReady,
 773     NULL,
 774     &SmmVariableRegistration
 775     );
 776
 777   //
 778   // Smm Non-Volatile variable write service is ready
 779   //
 780   EfiCreateProtocolNotifyEvent (
 781     &gSmmVariableWriteGuid,
 782     TPL_CALLBACK,
 783     SmmVariableWriteReady,
 784     NULL,
 785     &SmmVariableWriteRegistration
 786     );
 787
 788   //
 789   // Register the event to reclaim variable for OS usage.
 790   //
 791   EfiCreateEventReadyToBootEx (
 792     TPL_NOTIFY,
 793     OnReadyToBoot,
 794     NULL,
 795     &OnReadyToBootEvent
 796     );
 797
 798   //
 799   // Register the event to inform SMM variable that it is at runtime.
 800   //
 801   gBS->CreateEventEx (
 802          EVT_NOTIFY_SIGNAL,
 803          TPL_NOTIFY,
 804          OnExitBootServices,
 805          NULL,
 806          &gEfiEventExitBootServicesGuid,
 807          &ExitBootServiceEvent
 808          );
 809
 810   //
 811   // Register the event to convert the pointer for runtime.
 812   //
 813   gBS->CreateEventEx (
 814          EVT_NOTIFY_SIGNAL,
 815          TPL_NOTIFY,
 816          VariableAddressChangeEvent,
 817          NULL,
 818          &gEfiEventVirtualAddressChangeGuid,
 819          &mVirtualAddressChangeEvent
 820          );
 821
 822   return EFI_SUCCESS;
 823 }
 824