Add EDKII_VARIABLE_LOCK_PROTOCOL and the implementation in MdeModulePkg variable...

Add code in BdsDxe driver to call the protocol to mark the read-only variables defined in the UEFI Spec.

Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Guo Dong <guo.dong@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@14372 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/Bds.h b/IntelFrameworkModulePkg/Universal/BdsDxe/Bds.h
index 0929f1d27bdc7c6b03c95fdbad28f50479a63dc8..14996f63e6f70ce473d2220632aee53bd23a59fc 100644 (file)
--- a/IntelFrameworkModulePkg/Universal/BdsDxe/Bds.h
+++ b/IntelFrameworkModulePkg/Universal/BdsDxe/Bds.h
@@ -1,7 +1,7 @@
 /** @file\r
   Head file for BDS Architectural Protocol implementation\r
 \r
 /** @file\r
   Head file for BDS Architectural Protocol implementation\r
 \r

-Copyright (c) 2004 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2004 - 2013, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -47,6 +47,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Protocol/SimpleTextInEx.h>\r
 #include <Protocol/DriverHealth.h>\r
 #include <Protocol/BootLogo.h>\r
 #include <Protocol/SimpleTextInEx.h>\r
 #include <Protocol/DriverHealth.h>\r
 #include <Protocol/BootLogo.h>\r

+#include <Protocol/VariableLock.h>\r

 \r
 #include <Library/UefiDriverEntryPoint.h>\r
 #include <Library/PrintLib.h>\r
 \r
 #include <Library/UefiDriverEntryPoint.h>\r
 #include <Library/PrintLib.h>\r

diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/BdsDxe.inf b/IntelFrameworkModulePkg/Universal/BdsDxe/BdsDxe.inf
index a60738e9463356b6f1dbac971e8650b447fd82f8..2424a8a842636a093d773e286c625c801bf4fbd3 100644 (file)
--- a/IntelFrameworkModulePkg/Universal/BdsDxe/BdsDxe.inf
+++ b/IntelFrameworkModulePkg/Universal/BdsDxe/BdsDxe.inf
@@ -14,7 +14,7 @@
 #  BDSDxe also maintain the UI for "Boot Manager, Boot Maintaince Manager, Device Manager" which\r
 #  is used for user to configure boot option or maintain hardware device.\r
 #  \r
 #  BDSDxe also maintain the UI for "Boot Manager, Boot Maintaince Manager, Device Manager" which\r
 #  is used for user to configure boot option or maintain hardware device.\r
 #  \r

-#  Copyright (c) 2008 - 2012, Intel Corporation. All rights reserved.<BR>\r
+#  Copyright (c) 2008 - 2013, Intel Corporation. All rights reserved.<BR>\r

 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
 #  which accompanies this distribution.  The full text of the license may be found at\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
 #  which accompanies this distribution.  The full text of the license may be found at\r


@@ -160,6 +160,7 @@
   gEfiDriverHealthProtocolGuid                  ## PROTOCOL SOMETIMES_CONSUMES\r
   gEfiPciIoProtocolGuid                         ## PROTOCOL CONSUMES\r
   gEfiBootLogoProtocolGuid                      ## PROTOCOL SOMETIMES_CONSUMES\r
   gEfiDriverHealthProtocolGuid                  ## PROTOCOL SOMETIMES_CONSUMES\r
   gEfiPciIoProtocolGuid                         ## PROTOCOL CONSUMES\r
   gEfiBootLogoProtocolGuid                      ## PROTOCOL SOMETIMES_CONSUMES\r

+  gEdkiiVariableLockProtocolGuid                ## PROTOCOL CONSUMES\r

 \r
 [FeaturePcd]\r
   gEfiMdePkgTokenSpaceGuid.PcdUefiVariableDefaultLangDeprecate\r
 \r
 [FeaturePcd]\r
   gEfiMdePkgTokenSpaceGuid.PcdUefiVariableDefaultLangDeprecate\r

diff --git a/IntelFrameworkModulePkg/Universal/BdsDxe/BdsEntry.c b/IntelFrameworkModulePkg/Universal/BdsDxe/BdsEntry.c
index 6eaec886f2317d484021538260a6ba5b0dfc8897..91c6dc72ddbc81176d7ea8a7f3c97d9175b27d47 100644 (file)
--- a/IntelFrameworkModulePkg/Universal/BdsDxe/BdsEntry.c
+++ b/IntelFrameworkModulePkg/Universal/BdsDxe/BdsEntry.c
@@ -38,6 +38,17 @@ EFI_BDS_ARCH_PROTOCOL  gBds = {
 \r
 UINT16                          *mBootNext = NULL;\r
 \r
 \r
 UINT16                          *mBootNext = NULL;\r
 \r

+///\r
+/// The read-only variables defined in UEFI Spec.\r
+///\r
+CHAR16  *mReadOnlyVariables[] = {\r
+  L"PlatformLangCodes",\r
+  L"LangCodes",\r
+  L"BootOptionSupport",\r
+  L"HwErrRecSupport",\r
+  L"OsIndicationsSupported"\r
+  };\r
+\r

 /**\r
 \r
   Install Boot Device Selection Protocol\r
 /**\r
 \r
   Install Boot Device Selection Protocol\r


@@ -459,6 +470,8 @@ BdsEntry (
   CHAR16                          *FirmwareVendor;\r
   EFI_STATUS                      Status;\r
   UINT16                          BootTimeOut;\r
   CHAR16                          *FirmwareVendor;\r
   EFI_STATUS                      Status;\r
   UINT16                          BootTimeOut;\r

+  UINTN                           Index;\r
+  EDKII_VARIABLE_LOCK_PROTOCOL    *VariableLock;\r

 \r
   //\r
   // Insert the performance probe\r
 \r
   //\r
   // Insert the performance probe\r


@@ -496,6 +509,18 @@ BdsEntry (
   //\r
   BdsFormalizeEfiGlobalVariable();\r
 \r
   //\r
   BdsFormalizeEfiGlobalVariable();\r
 \r

+  //\r
+  // Mark the read-only variables if the Variable Lock protocol exists\r
+  //\r
+  Status = gBS->LocateProtocol (&gEdkiiVariableLockProtocolGuid, NULL, (VOID **) &VariableLock);\r
+  DEBUG ((EFI_D_INFO, "[BdsDxe] Locate Variable Lock protocol - %r\n", Status));\r
+  if (!EFI_ERROR (Status)) {\r
+    for (Index = 0; Index < sizeof (mReadOnlyVariables) / sizeof (mReadOnlyVariables[0]); Index++) {\r
+      Status = VariableLock->RequestToLock (VariableLock, mReadOnlyVariables[Index], &gEfiGlobalVariableGuid);\r
+      ASSERT_EFI_ERROR (Status);\r
+    }\r
+  }\r
+\r

   //\r
   // Report Status Code to indicate connecting drivers will happen\r
   //\r
   //\r
   // Report Status Code to indicate connecting drivers will happen\r
   //\r


@@ -504,12 +529,6 @@ BdsEntry (
     (EFI_SOFTWARE_DXE_BS_DRIVER | EFI_SW_DXE_BS_PC_BEGIN_CONNECTING_DRIVERS)\r
     );\r
 \r
     (EFI_SOFTWARE_DXE_BS_DRIVER | EFI_SW_DXE_BS_PC_BEGIN_CONNECTING_DRIVERS)\r
     );\r
 \r

-  //\r
-  // Do the platform init, can be customized by OEM/IBV\r
-  //\r
-  PERF_START (NULL, "PlatformBds", "BDS", 0);\r
-  PlatformBdsInit ();\r
-\r

   InitializeHwErrRecSupport();\r
 \r
   //\r
   InitializeHwErrRecSupport();\r
 \r
   //\r


@@ -539,6 +558,12 @@ BdsEntry (
   InitializeLanguage (TRUE);\r
   InitializeFrontPage (TRUE);\r
 \r
   InitializeLanguage (TRUE);\r
   InitializeFrontPage (TRUE);\r
 \r

+  //\r
+  // Do the platform init, can be customized by OEM/IBV\r
+  //\r
+  PERF_START (NULL, "PlatformBds", "BDS", 0);\r
+  PlatformBdsInit ();\r
+\r

   //\r
   // Set up the device list based on EFI 1.1 variables\r
   // process Driver#### and Load the driver's in the\r
   //\r
   // Set up the device list based on EFI 1.1 variables\r
   // process Driver#### and Load the driver's in the\r

diff --git a/MdeModulePkg/Include/Guid/SmmVariableCommon.h b/MdeModulePkg/Include/Guid/SmmVariableCommon.h
index 478fd056b07eeeb26f695182c1de71a4dd613d23..a2daae8fe3e17ea4a78993fbfd3190baf808893b 100644 (file)
--- a/MdeModulePkg/Include/Guid/SmmVariableCommon.h
+++ b/MdeModulePkg/Include/Guid/SmmVariableCommon.h
@@ -60,6 +60,10 @@ typedef struct {
 // is gEfiSmmVariableProtocolGuid.\r
 //\r
 #define SMM_VARIABLE_FUNCTION_GET_STATISTICS          7\r
 // is gEfiSmmVariableProtocolGuid.\r
 //\r
 #define SMM_VARIABLE_FUNCTION_GET_STATISTICS          7\r

+//\r
+// The payload for this function is SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE\r
+//\r
+#define SMM_VARIABLE_FUNCTION_LOCK_VARIABLE           8\r

 \r
 ///\r
 /// Size of SMM communicate header, without including the payload.\r
 \r
 ///\r
 /// Size of SMM communicate header, without including the payload.\r


@@ -101,4 +105,6 @@ typedef struct {
   UINT32          Attributes; \r
 } SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO;\r
 \r
   UINT32          Attributes; \r
 } SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO;\r
 \r

+typedef SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE;\r
+\r

 #endif // _SMM_VARIABLE_COMMON_H_
\ No newline at end of file
 #endif // _SMM_VARIABLE_COMMON_H_
\ No newline at end of file

diff --git a/MdeModulePkg/Include/Protocol/VariableLock.h b/MdeModulePkg/Include/Protocol/VariableLock.h
new file mode 100644 (file)
index 0000000..a2a73bc
--- /dev/null
+++ b/MdeModulePkg/Include/Protocol/VariableLock.h
@@ -0,0 +1,63 @@
+/** @file\r
+  Variable Lock Protocol is related to EDK II-specific implementation of variables\r
+  and intended for use as a means to mark a variable read-only after the event\r
+  EFI_END_OF_DXE_EVENT_GUID is signaled.\r
+\r
+  Copyright (c) 2013, Intel Corporation. All rights reserved.<BR>\r
+  This program and the accompanying materials                          \r
+  are licensed and made available under the terms and conditions of the BSD License         \r
+  which accompanies this distribution.  The full text of the license may be found at        \r
+  http://opensource.org/licenses/bsd-license.php                                            \r
+\r
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,                     \r
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.             \r
+\r
+**/\r
+\r
+#ifndef __VARIABLE_LOCK_H__\r
+#define __VARIABLE_LOCK_H__\r
+\r
+#define EDKII_VARIABLE_LOCK_PROTOCOL_GUID \\r
+  { \\r
+    0xcd3d0a05, 0x9e24, 0x437c, { 0xa8, 0x91, 0x1e, 0xe0, 0x53, 0xdb, 0x76, 0x38 } \\r
+  }\r
+\r
+typedef struct _EDKII_VARIABLE_LOCK_PROTOCOL  EDKII_VARIABLE_LOCK_PROTOCOL;\r
+\r
+/**\r
+  Mark a variable that will become read-only after leaving the DXE phase of execution.\r
+  Write request coming from SMM environment through EFI_SMM_VARIABLE_PROTOCOL is allowed.\r
+\r
+  @param[in] This          The EDKII_VARIABLE_LOCK_PROTOCOL instance.\r
+  @param[in] VariableName  A pointer to the variable name that will be made read-only subsequently.\r
+  @param[in] VendorGuid    A pointer to the vendor GUID that will be made read-only subsequently.\r
+\r
+  @retval EFI_SUCCESS           The variable specified by the VariableName and the VendorGuid was marked\r
+                                as pending to be read-only.\r
+  @retval EFI_INVALID_PARAMETER VariableName or VendorGuid is NULL.\r
+                                Or VariableName is an empty string.\r
+  @retval EFI_ACCESS_DENIED     EFI_END_OF_DXE_EVENT_GROUP_GUID or EFI_EVENT_GROUP_READY_TO_BOOT has\r
+                                already been signaled.\r
+  @retval EFI_OUT_OF_RESOURCES  There is not enough resource to hold the lock request.\r
+**/\r
+typedef\r
+EFI_STATUS\r
+(EFIAPI * EDKII_VARIABLE_LOCK_PROTOCOL_REQUEST_TO_LOCK) (\r
+  IN CONST EDKII_VARIABLE_LOCK_PROTOCOL *This,\r
+  IN       CHAR16                       *VariableName,\r
+  IN       EFI_GUID                     *VendorGuid\r
+  );\r
+\r
+///\r
+/// Variable Lock Protocol is related to EDK II-specific implementation of variables\r
+/// and intended for use as a means to mark a variable read-only after the event\r
+/// EFI_END_OF_DXE_EVENT_GUID is signaled.\r
+///\r
+struct _EDKII_VARIABLE_LOCK_PROTOCOL {\r
+  EDKII_VARIABLE_LOCK_PROTOCOL_REQUEST_TO_LOCK RequestToLock;\r
+};\r
+\r
+extern EFI_GUID gEdkiiVariableLockProtocolGuid;\r
+\r
+#endif  \r
+\r

diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
index 309450792a8bee9e3c3430085c28e304d10be5b9..3c07c69a9748429c1f4c7c94c124e5c06db7e3e8 100644 (file)
--- a/MdeModulePkg/MdeModulePkg.dec
+++ b/MdeModulePkg/MdeModulePkg.dec
@@ -326,6 +326,10 @@
   #  Include/Protocol/SmmVariableProtocol.h\r
   gEfiSmmVariableProtocolGuid = { 0xed32d533, 0x99e6, 0x4209, { 0x9c, 0xc0, 0x2d, 0x72, 0xcd, 0xd9, 0x98, 0xa7 }}\r
 \r
   #  Include/Protocol/SmmVariableProtocol.h\r
   gEfiSmmVariableProtocolGuid = { 0xed32d533, 0x99e6, 0x4209, { 0x9c, 0xc0, 0x2d, 0x72, 0xcd, 0xd9, 0x98, 0xa7 }}\r
 \r

+  ## This protocol is intended for use as a means to mark a variable read-only after the event EFI_END_OF_DXE_EVENT_GUID is signaled.\r
+  #  Include/Protocol/VariableLock.h\r
+  gEdkiiVariableLockProtocolGuid = { 0xcd3d0a05, 0x9e24, 0x437c, { 0xa8, 0x91, 0x1e, 0xe0, 0x53, 0xdb, 0x76, 0x38 }}\r
+\r

   ## This protocol is similar with DXE FVB protocol and used in the UEFI SMM evvironment.\r
   #  Include/Protocol/SmmFirmwareVolumeBlock.h\r
   gEfiSmmFirmwareVolumeBlockProtocolGuid = { 0xd326d041, 0xbd31, 0x4c01, { 0xb5, 0xa8, 0x62, 0x8b, 0xe8, 0x7f, 0x6, 0x53 }}\r
   ## This protocol is similar with DXE FVB protocol and used in the UEFI SMM evvironment.\r
   #  Include/Protocol/SmmFirmwareVolumeBlock.h\r
   gEfiSmmFirmwareVolumeBlockProtocolGuid = { 0xd326d041, 0xbd31, 0x4c01, { 0xb5, 0xa8, 0x62, 0x8b, 0xe8, 0x7f, 0x6, 0x53 }}\r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
index cd3f5ef475dd21022ca1b9b60961f3bf0337869f..9f983ffc9f1db493d308fc11124b785341d53fb3 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
@@ -21,12 +21,28 @@ VARIABLE_MODULE_GLOBAL  *mVariableModuleGlobal;
 ///\r
 /// Define a memory cache that improves the search performance for a variable.\r
 ///\r
 ///\r
 /// Define a memory cache that improves the search performance for a variable.\r
 ///\r

-VARIABLE_STORE_HEADER  *mNvVariableCache = NULL;\r
+VARIABLE_STORE_HEADER  *mNvVariableCache      = NULL;\r

 \r
 ///\r
 /// The memory entry used for variable statistics data.\r
 ///\r
 \r
 ///\r
 /// The memory entry used for variable statistics data.\r
 ///\r

-VARIABLE_INFO_ENTRY    *gVariableInfo    = NULL;\r
+VARIABLE_INFO_ENTRY    *gVariableInfo         = NULL;\r
+\r
+///\r
+/// The list to store the variables which cannot be set after the EFI_END_OF_DXE_EVENT_GROUP_GUID\r
+/// or EVT_GROUP_READY_TO_BOOT event.\r
+///\r
+LIST_ENTRY             mLockedVariableList    = INITIALIZE_LIST_HEAD_VARIABLE (mLockedVariableList);\r
+\r
+///\r
+/// The flag to indicate whether the platform has left the DXE phase of execution.\r
+///\r
+BOOLEAN                mEndOfDxe              = FALSE;\r
+\r
+///\r
+/// The flag to indicate whether the variable storage locking is enabled.\r
+///\r
+BOOLEAN                mEnableLocking         = TRUE;\r

 \r
 \r
 /**\r
 \r
 \r
 /**\r


@@ -1918,6 +1934,58 @@ IsHwErrRecVariable (
   return TRUE;\r
 }\r
 \r
   return TRUE;\r
 }\r
 \r

+/**\r
+  Mark a variable that will become read-only after leaving the DXE phase of execution.\r
+\r
+  @param[in] This          The VARIABLE_LOCK_PROTOCOL instance.\r
+  @param[in] VariableName  A pointer to the variable name that will be made read-only subsequently.\r
+  @param[in] VendorGuid    A pointer to the vendor GUID that will be made read-only subsequently.\r
+\r
+  @retval EFI_SUCCESS           The variable specified by the VariableName and the VendorGuid was marked\r
+                                as pending to be read-only.\r
+  @retval EFI_INVALID_PARAMETER VariableName or VendorGuid is NULL.\r
+                                Or VariableName is an empty string.\r
+  @retval EFI_ACCESS_DENIED     EFI_END_OF_DXE_EVENT_GROUP_GUID or EFI_EVENT_GROUP_READY_TO_BOOT has\r
+                                already been signaled.\r
+  @retval EFI_OUT_OF_RESOURCES  There is not enough resource to hold the lock request.\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+VariableLockRequestToLock (\r
+  IN CONST EDKII_VARIABLE_LOCK_PROTOCOL *This,\r
+  IN       CHAR16                       *VariableName,\r
+  IN       EFI_GUID                     *VendorGuid\r
+  )\r
+{\r
+  VARIABLE_ENTRY                  *Entry;\r
+\r
+  if (VariableName == NULL || VariableName[0] == 0 || VendorGuid == NULL) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
+  if (mEndOfDxe) {\r
+    return EFI_ACCESS_DENIED;\r
+  }\r
+\r
+  Entry = AllocateRuntimePool (sizeof (*Entry) + StrSize (VariableName));\r
+  if (Entry == NULL) {\r
+    return EFI_OUT_OF_RESOURCES;\r
+  }\r
+\r
+  DEBUG ((EFI_D_INFO, "[Variable] Lock: %g:%s\n", VendorGuid, VariableName));\r
+\r
+  AcquireLockOnlyAtBootTime(&mVariableModuleGlobal->VariableGlobal.VariableServicesLock);\r
+\r
+  Entry->Name = (CHAR16 *) (Entry + 1);\r
+  StrCpy   (Entry->Name, VariableName);\r
+  CopyGuid (&Entry->Guid, VendorGuid);\r
+  InsertTailList (&mLockedVariableList, &Entry->Link);\r
+\r
+  ReleaseLockOnlyAtBootTime (&mVariableModuleGlobal->VariableGlobal.VariableServicesLock);\r
+\r
+  return EFI_SUCCESS;\r
+}\r
+\r

 /**\r
 \r
   This code finds variable in storage blocks (Volatile or Non-Volatile).\r
 /**\r
 \r
   This code finds variable in storage blocks (Volatile or Non-Volatile).\r


@@ -2192,6 +2260,8 @@ VariableServiceSetVariable (
   EFI_STATUS                          Status;\r
   VARIABLE_HEADER                     *NextVariable;\r
   EFI_PHYSICAL_ADDRESS                Point;\r
   EFI_STATUS                          Status;\r
   VARIABLE_HEADER                     *NextVariable;\r
   EFI_PHYSICAL_ADDRESS                Point;\r

+  LIST_ENTRY                          *Link;\r
+  VARIABLE_ENTRY                      *Entry;\r

 \r
   //\r
   // Check input parameters.\r
 \r
   //\r
   // Check input parameters.\r


@@ -2247,16 +2317,6 @@ VariableServiceSetVariable (
     }  \r
   }\r
 \r
     }  \r
   }\r
 \r

-  if (AtRuntime ()) {\r
-    //\r
-    // HwErrRecSupport Global Variable identifies the level of hardware error record persistence\r
-    // support implemented by the platform. This variable is only modified by firmware and is read-only to the OS.\r
-    //\r
-    if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, L"HwErrRecSupport") == 0)) {\r
-      return EFI_WRITE_PROTECTED;\r
-    }\r
-  }\r
-\r

   AcquireLockOnlyAtBootTime(&mVariableModuleGlobal->VariableGlobal.VariableServicesLock);\r
 \r
   //\r
   AcquireLockOnlyAtBootTime(&mVariableModuleGlobal->VariableGlobal.VariableServicesLock);\r
 \r
   //\r


@@ -2275,13 +2335,31 @@ VariableServiceSetVariable (
     mVariableModuleGlobal->NonVolatileLastVariableOffset = (UINTN) NextVariable - (UINTN) Point;\r
   }\r
 \r
     mVariableModuleGlobal->NonVolatileLastVariableOffset = (UINTN) NextVariable - (UINTN) Point;\r
   }\r
 \r

+  if (mEndOfDxe && mEnableLocking) {\r
+    //\r
+    // Treat the variables listed in the forbidden variable list as read-only after leaving DXE phase.\r
+    //\r
+    for ( Link = GetFirstNode (&mLockedVariableList)\r
+        ; !IsNull (&mLockedVariableList, Link)\r
+        ; Link = GetNextNode (&mLockedVariableList, Link)\r
+        ) {\r
+      Entry = BASE_CR (Link, VARIABLE_ENTRY, Link);\r
+      if (CompareGuid (&Entry->Guid, VendorGuid) && (StrCmp (Entry->Name, VariableName) == 0)) {\r
+        Status = EFI_WRITE_PROTECTED;\r
+        DEBUG ((EFI_D_INFO, "[Variable]: Changing readonly variable after leaving DXE phase - %g:%s\n", VendorGuid, VariableName));\r
+        goto Done;\r
+      }\r
+    }\r
+  }\r
+\r

   //\r
   // Check whether the input variable is already existed.\r
   //\r
   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, TRUE);\r
   if (!EFI_ERROR (Status)) {\r
     if (((Variable.CurrPtr->Attributes & EFI_VARIABLE_RUNTIME_ACCESS) == 0) && AtRuntime ()) {\r
   //\r
   // Check whether the input variable is already existed.\r
   //\r
   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, TRUE);\r
   if (!EFI_ERROR (Status)) {\r
     if (((Variable.CurrPtr->Attributes & EFI_VARIABLE_RUNTIME_ACCESS) == 0) && AtRuntime ()) {\r

-      return EFI_WRITE_PROTECTED;\r
+      Status = EFI_WRITE_PROTECTED;\r
+      goto Done;\r

     }\r
   }\r
 \r
     }\r
   }\r
 \r


@@ -2292,6 +2370,7 @@ VariableServiceSetVariable (
 \r
   Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, &Variable);\r
 \r
 \r
   Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, &Variable);\r
 \r

+Done:\r

   InterlockedDecrement (&mVariableModuleGlobal->VariableGlobal.ReentrantState);\r
   ReleaseLockOnlyAtBootTime (&mVariableModuleGlobal->VariableGlobal.VariableServicesLock);\r
 \r
   InterlockedDecrement (&mVariableModuleGlobal->VariableGlobal.ReentrantState);\r
   ReleaseLockOnlyAtBootTime (&mVariableModuleGlobal->VariableGlobal.VariableServicesLock);\r
 \r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h
index 8504ce05f7302c9701530567808413da824df7de..b5e6edec930d4246a14d6f8478129c92305e0172 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h
@@ -22,6 +22,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Protocol/FaultTolerantWrite.h>\r
 #include <Protocol/FirmwareVolumeBlock.h>\r
 #include <Protocol/Variable.h>\r
 #include <Protocol/FaultTolerantWrite.h>\r
 #include <Protocol/FirmwareVolumeBlock.h>\r
 #include <Protocol/Variable.h>\r

+#include <Protocol/VariableLock.h>\r

 #include <Library/PcdLib.h>\r
 #include <Library/HobLib.h>\r
 #include <Library/UefiDriverEntryPoint.h>\r
 #include <Library/PcdLib.h>\r
 #include <Library/HobLib.h>\r
 #include <Library/UefiDriverEntryPoint.h>\r


@@ -97,6 +98,12 @@ typedef struct {
   VOID        *Data;\r
 } VARIABLE_CACHE_ENTRY;\r
 \r
   VOID        *Data;\r
 } VARIABLE_CACHE_ENTRY;\r
 \r

+typedef struct {\r
+  EFI_GUID    Guid;\r
+  CHAR16      *Name;\r
+  LIST_ENTRY  Link;\r
+} VARIABLE_ENTRY;\r
+\r

 /**\r
   Flush the HOB variable to flash.\r
 \r
 /**\r
   Flush the HOB variable to flash.\r
 \r


@@ -456,7 +463,30 @@ VariableServiceQueryVariableInfo (
   OUT UINT64                 *RemainingVariableStorageSize,\r
   OUT UINT64                 *MaximumVariableSize\r
   );  \r
   OUT UINT64                 *RemainingVariableStorageSize,\r
   OUT UINT64                 *MaximumVariableSize\r
   );  \r

-  \r
+\r
+/**\r
+  Mark a variable that will become read-only after leaving the DXE phase of execution.\r
+\r
+  @param[in] This          The VARIABLE_LOCK_PROTOCOL instance.\r
+  @param[in] VariableName  A pointer to the variable name that will be made read-only subsequently.\r
+  @param[in] VendorGuid    A pointer to the vendor GUID that will be made read-only subsequently.\r
+\r
+  @retval EFI_SUCCESS           The variable specified by the VariableName and the VendorGuid was marked\r
+                                as pending to be read-only.\r
+  @retval EFI_INVALID_PARAMETER VariableName or VendorGuid is NULL.\r
+                                Or VariableName is an empty string.\r
+  @retval EFI_ACCESS_DENIED     EFI_END_OF_DXE_EVENT_GROUP_GUID or EFI_EVENT_GROUP_READY_TO_BOOT has\r
+                                already been signaled.\r
+  @retval EFI_OUT_OF_RESOURCES  There is not enough resource to hold the lock request.\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+VariableLockRequestToLock (\r
+  IN CONST EDKII_VARIABLE_LOCK_PROTOCOL *This,\r
+  IN       CHAR16                       *VariableName,\r
+  IN       EFI_GUID                     *VendorGuid\r
+  );\r
+\r

 extern VARIABLE_MODULE_GLOBAL  *mVariableModuleGlobal;\r
 \r
 #endif\r
 extern VARIABLE_MODULE_GLOBAL  *mVariableModuleGlobal;\r
 \r
 #endif\r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c
index ba4d29ab30fae90f47dc61d143a625542468c25d..9e371c0a8577c3251716632c5b8137ff9e74cd26 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c
@@ -3,7 +3,7 @@
   Implement all four UEFI Runtime Variable services for the nonvolatile\r
   and volatile storage space and install variable architecture protocol.\r
   \r
   Implement all four UEFI Runtime Variable services for the nonvolatile\r
   and volatile storage space and install variable architecture protocol.\r
   \r

-Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r
 This program and the accompanying materials                          \r
 are licensed and made available under the terms and conditions of the BSD License         \r
 which accompanies this distribution.  The full text of the license may be found at        \r


@@ -21,6 +21,9 @@ extern VARIABLE_INFO_ENTRY     *gVariableInfo;
 EFI_HANDLE                     mHandle                    = NULL;\r
 EFI_EVENT                      mVirtualAddressChangeEvent = NULL;\r
 EFI_EVENT                      mFtwRegistration           = NULL;\r
 EFI_HANDLE                     mHandle                    = NULL;\r
 EFI_EVENT                      mVirtualAddressChangeEvent = NULL;\r
 EFI_EVENT                      mFtwRegistration           = NULL;\r

+extern BOOLEAN                 mEndOfDxe;\r
+extern BOOLEAN                 mEnableLocking;\r
+EDKII_VARIABLE_LOCK_PROTOCOL   mVariableLock              = { VariableLockRequestToLock };\r

 \r
 /**\r
   Return TRUE if ExitBootServices () has been called.\r
 \r
 /**\r
   Return TRUE if ExitBootServices () has been called.\r


@@ -255,12 +258,34 @@ OnReadyToBoot (
   VOID                                    *Context\r
   )\r
 {\r
   VOID                                    *Context\r
   )\r
 {\r

+  //\r
+  // Set the End Of DXE bit in case the EFI_END_OF_DXE_EVENT_GROUP_GUID event is not signaled.\r
+  //\r
+  mEndOfDxe = TRUE;\r

   ReclaimForOS ();\r
   if (FeaturePcdGet (PcdVariableCollectStatistics)) {\r
     gBS->InstallConfigurationTable (&gEfiVariableGuid, gVariableInfo);\r
   }\r
 }\r
 \r
   ReclaimForOS ();\r
   if (FeaturePcdGet (PcdVariableCollectStatistics)) {\r
     gBS->InstallConfigurationTable (&gEfiVariableGuid, gVariableInfo);\r
   }\r
 }\r
 \r

+/**\r
+  Notification function of EFI_END_OF_DXE_EVENT_GROUP_GUID event group.\r
+\r
+  This is a notification function registered on EFI_END_OF_DXE_EVENT_GROUP_GUID event group.\r
+\r
+  @param  Event        Event whose notification function is being invoked.\r
+  @param  Context      Pointer to the notification function's context.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+OnEndOfDxe (\r
+  EFI_EVENT                               Event,\r
+  VOID                                    *Context\r
+  )\r
+{\r
+  mEndOfDxe = TRUE;\r
+}\r

 \r
 /**\r
   Fault Tolerant Write protocol notification event handler.\r
 \r
 /**\r
   Fault Tolerant Write protocol notification event handler.\r


@@ -375,11 +400,20 @@ VariableServiceInitialize (
   )\r
 {\r
   EFI_STATUS                            Status;\r
   )\r
 {\r
   EFI_STATUS                            Status;\r

-  EFI_EVENT                             ReadyToBootEvent;    \r
+  EFI_EVENT                             ReadyToBootEvent;\r
+  EFI_EVENT                             EndOfDxeEvent;\r

 \r
   Status = VariableCommonInitialize ();\r
   ASSERT_EFI_ERROR (Status);\r
 \r
 \r
   Status = VariableCommonInitialize ();\r
   ASSERT_EFI_ERROR (Status);\r
 \r

+  Status = gBS->InstallMultipleProtocolInterfaces (\r
+                  &mHandle,\r
+                  &gEdkiiVariableLockProtocolGuid,\r
+                  &mVariableLock,\r
+                  NULL\r
+                  );\r
+  ASSERT_EFI_ERROR (Status);\r
+\r

   SystemTable->RuntimeServices->GetVariable         = VariableServiceGetVariable;\r
   SystemTable->RuntimeServices->GetNextVariableName = VariableServiceGetNextVariableName;\r
   SystemTable->RuntimeServices->SetVariable         = VariableServiceSetVariable;\r
   SystemTable->RuntimeServices->GetVariable         = VariableServiceGetVariable;\r
   SystemTable->RuntimeServices->GetNextVariableName = VariableServiceGetNextVariableName;\r
   SystemTable->RuntimeServices->SetVariable         = VariableServiceSetVariable;\r


@@ -426,6 +460,20 @@ VariableServiceInitialize (
              NULL, \r
              &ReadyToBootEvent\r
              );\r
              NULL, \r
              &ReadyToBootEvent\r
              );\r

+  ASSERT_EFI_ERROR (Status);\r
+\r
+  //\r
+  // Register the event handling function to set the End Of DXE flag.\r
+  //\r
+  Status = gBS->CreateEventEx (\r
+                  EVT_NOTIFY_SIGNAL,\r
+                  TPL_NOTIFY,\r
+                  OnEndOfDxe,\r
+                  NULL,\r
+                  &gEfiEndOfDxeEventGroupGuid,\r
+                  &EndOfDxeEvent\r
+                  );\r
+  ASSERT_EFI_ERROR (Status);\r

 \r
   return EFI_SUCCESS;\r
 }\r
 \r
   return EFI_SUCCESS;\r
 }\r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
index 28b69c34deb4859885d5c57335b7275778f1b1f7..8cbefefa1b79126dde7ae016f6f754343b8d473c 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
@@ -2,7 +2,7 @@
 # Component description file for Variable module.\r
 #\r
 # This module installs three EFI_RUNTIME_SERVICES: SetVariable, GetVariable, GetNextVariableName.\r
 # Component description file for Variable module.\r
 #\r
 # This module installs three EFI_RUNTIME_SERVICES: SetVariable, GetVariable, GetNextVariableName.\r

-# Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
+# Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>\r

 #\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
 #\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r


@@ -59,13 +59,15 @@
   gEfiVariableWriteArchProtocolGuid             ## ALWAYS_PRODUCES\r
   gEfiVariableArchProtocolGuid                  ## ALWAYS_PRODUCES\r
   gEfiFaultTolerantWriteProtocolGuid            ## SOMETIMES_CONSUMES\r
   gEfiVariableWriteArchProtocolGuid             ## ALWAYS_PRODUCES\r
   gEfiVariableArchProtocolGuid                  ## ALWAYS_PRODUCES\r
   gEfiFaultTolerantWriteProtocolGuid            ## SOMETIMES_CONSUMES\r

+  gEdkiiVariableLockProtocolGuid                ## ALWAYS_PRODUCES\r

 \r
 [Guids]\r
   gEfiVariableGuid                              ## PRODUCES ## Configuration Table Guid \r
   gEfiGlobalVariableGuid                        ## PRODUCES ## Variable Guid\r
 \r
 [Guids]\r
   gEfiVariableGuid                              ## PRODUCES ## Configuration Table Guid \r
   gEfiGlobalVariableGuid                        ## PRODUCES ## Variable Guid\r

-  gEfiEventVirtualAddressChangeGuid             ## PRODUCES ## Event\r
+  gEfiEventVirtualAddressChangeGuid             ## CONSUMES ## Event\r

   gEfiSystemNvDataFvGuid                        ## CONSUMES\r
   gEfiHardwareErrorVariableGuid                 ## SOMETIMES_CONSUMES\r
   gEfiSystemNvDataFvGuid                        ## CONSUMES\r
   gEfiHardwareErrorVariableGuid                 ## SOMETIMES_CONSUMES\r

+  gEfiEndOfDxeEventGroupGuid                    ## CONSUMES ## Event\r

 \r
 [Pcd]\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize\r
 \r
 [Pcd]\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize\r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c
index 111a6cd41174f4cb581c3ec5ec6ea8c5bbd2f838..4009fcb1712eaded50b18d740c91a814e19c46f6 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c
@@ -29,6 +29,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Protocol/SmmFirmwareVolumeBlock.h>\r
 #include <Protocol/SmmFaultTolerantWrite.h>\r
 #include <Protocol/SmmAccess2.h>\r
 #include <Protocol/SmmFirmwareVolumeBlock.h>\r
 #include <Protocol/SmmFaultTolerantWrite.h>\r
 #include <Protocol/SmmAccess2.h>\r

+#include <Protocol/SmmEndOfDxe.h>\r

 \r
 #include <Library/SmmServicesTableLib.h>\r
 \r
 \r
 #include <Library/SmmServicesTableLib.h>\r
 \r


@@ -46,15 +47,61 @@ BOOLEAN                                              mAtRuntime              = F
 EFI_GUID                                             mZeroGuid               = {0, 0, 0, {0, 0, 0, 0, 0, 0, 0, 0}};\r
 UINT8                                                *mVariableBufferPayload = NULL;\r
 UINTN                                                mVariableBufferPayloadSize;\r
 EFI_GUID                                             mZeroGuid               = {0, 0, 0, {0, 0, 0, 0, 0, 0, 0, 0}};\r
 UINT8                                                *mVariableBufferPayload = NULL;\r
 UINTN                                                mVariableBufferPayloadSize;\r

+extern BOOLEAN                                       mEndOfDxe;\r
+extern BOOLEAN                                       mEnableLocking;\r
+\r
+/**\r
+\r
+  This code sets variable in storage blocks (Volatile or Non-Volatile).\r
+\r
+  @param VariableName                     Name of Variable to be found.\r
+  @param VendorGuid                       Variable vendor GUID.\r
+  @param Attributes                       Attribute value of the variable found\r
+  @param DataSize                         Size of Data found. If size is less than the\r
+                                          data, this value contains the required size.\r
+  @param Data                             Data pointer.\r
+\r
+  @return EFI_INVALID_PARAMETER           Invalid parameter.\r
+  @return EFI_SUCCESS                     Set successfully.\r
+  @return EFI_OUT_OF_RESOURCES            Resource not enough to set variable.\r
+  @return EFI_NOT_FOUND                   Not found.\r
+  @return EFI_WRITE_PROTECTED             Variable is read-only.\r
+\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+SmmVariableSetVariable (\r
+  IN CHAR16                  *VariableName,\r
+  IN EFI_GUID                *VendorGuid,\r
+  IN UINT32                  Attributes,\r
+  IN UINTN                   DataSize,\r
+  IN VOID                    *Data\r
+  )\r
+{\r
+  EFI_STATUS                 Status;\r
+\r
+  //\r
+  // Disable write protection when the calling SetVariable() through EFI_SMM_VARIABLE_PROTOCOL.\r
+  //\r
+  mEnableLocking = FALSE;\r
+  Status         = VariableServiceSetVariable (\r
+                     VariableName,\r
+                     VendorGuid,\r
+                     Attributes,\r
+                     DataSize,\r
+                     Data\r
+                     );\r
+  mEnableLocking = TRUE;\r
+  return Status;\r
+}\r

 \r
 EFI_SMM_VARIABLE_PROTOCOL      gSmmVariable = {\r
   VariableServiceGetVariable,\r
   VariableServiceGetNextVariableName,\r
 \r
 EFI_SMM_VARIABLE_PROTOCOL      gSmmVariable = {\r
   VariableServiceGetVariable,\r
   VariableServiceGetNextVariableName,\r

-  VariableServiceSetVariable,\r
+  SmmVariableSetVariable,\r

   VariableServiceQueryVariableInfo\r
 };\r
 \r
   VariableServiceQueryVariableInfo\r
 };\r
 \r

-\r

 /**\r
   Return TRUE if ExitBootServices () has been called.\r
   \r
 /**\r
   Return TRUE if ExitBootServices () has been called.\r
   \r


@@ -450,6 +497,7 @@ SmmVariableHandler (
   SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME  *GetNextVariableName;\r
   SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO     *QueryVariableInfo;\r
   VARIABLE_INFO_ENTRY                              *VariableInfo;\r
   SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME  *GetNextVariableName;\r
   SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO     *QueryVariableInfo;\r
   VARIABLE_INFO_ENTRY                              *VariableInfo;\r

+  SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE           *VariableToLock;\r

   UINTN                                            InfoSize;\r
   UINTN                                            NameBufferSize;\r
   UINTN                                            CommBufferPayloadSize;\r
   UINTN                                            InfoSize;\r
   UINTN                                            NameBufferSize;\r
   UINTN                                            CommBufferPayloadSize;\r


@@ -635,6 +683,7 @@ SmmVariableHandler (
       break;\r
 \r
     case SMM_VARIABLE_FUNCTION_READY_TO_BOOT:\r
       break;\r
 \r
     case SMM_VARIABLE_FUNCTION_READY_TO_BOOT:\r

+      mEndOfDxe = TRUE;\r

       if (AtRuntime()) {\r
         Status = EFI_UNSUPPORTED;\r
         break;\r
       if (AtRuntime()) {\r
         Status = EFI_UNSUPPORTED;\r
         break;\r


@@ -667,6 +716,51 @@ SmmVariableHandler (
       *CommBufferSize = InfoSize + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;\r
       break;\r
 \r
       *CommBufferSize = InfoSize + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE;\r
       break;\r
 \r

+    case SMM_VARIABLE_FUNCTION_LOCK_VARIABLE:\r
+      if (CommBufferPayloadSize < OFFSET_OF(SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE, Name)) {\r
+        DEBUG ((EFI_D_ERROR, "RequestToLock: SMM communication buffer size invalid!\n"));\r
+        return EFI_SUCCESS;\r
+      }\r
+      //\r
+      // Copy the input communicate buffer payload to pre-allocated SMM variable buffer payload.\r
+      //\r
+      CopyMem (mVariableBufferPayload, SmmVariableFunctionHeader->Data, CommBufferPayloadSize);\r
+      VariableToLock = (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE *) mVariableBufferPayload;\r
+\r
+      if (VariableToLock->NameSize > MAX_ADDRESS - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE, Name)) {\r
+        //\r
+        // Prevent InfoSize overflow happen\r
+        //\r
+        Status = EFI_ACCESS_DENIED;\r
+        goto EXIT;\r
+      }\r
+\r
+      if (VariableToLock->NameSize < sizeof (CHAR16) || VariableToLock->Name[VariableToLock->NameSize/sizeof (CHAR16) - 1] != L'\0') {\r
+        //\r
+        // Make sure VariableName is A Null-terminated string.\r
+        //\r
+        Status = EFI_ACCESS_DENIED;\r
+        goto EXIT;\r
+      }\r
+      \r
+      InfoSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE, Name) + VariableToLock->NameSize;\r
+      \r
+      //\r
+      // SMRAM range check already covered before\r
+      //\r
+      if (InfoSize > CommBufferPayloadSize) {\r
+        DEBUG ((EFI_D_ERROR, "Data size exceed communication buffer size limit!\n"));\r
+        Status = EFI_ACCESS_DENIED;\r
+        goto EXIT;\r
+      }\r
+\r
+      Status = VariableLockRequestToLock (\r
+                 NULL,\r
+                 VariableToLock->Name,\r
+                 &VariableToLock->Guid\r
+                 );\r
+      break;\r
+\r

     default:\r
       Status = EFI_UNSUPPORTED;\r
   }\r
     default:\r
       Status = EFI_UNSUPPORTED;\r
   }\r


@@ -678,6 +772,28 @@ EXIT:
   return EFI_SUCCESS;\r
 }\r
 \r
   return EFI_SUCCESS;\r
 }\r
 \r

+/**\r
+  SMM END_OF_DXE protocol notification event handler.\r
+\r
+  @param  Protocol   Points to the protocol's unique identifier\r
+  @param  Interface  Points to the interface instance\r
+  @param  Handle     The handle on which the interface was installed\r
+\r
+  @retval EFI_SUCCESS   SmmEndOfDxeCallback runs successfully\r
+\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+SmmEndOfDxeCallback (\r
+  IN CONST EFI_GUID                       *Protocol,\r
+  IN VOID                                 *Interface,\r
+  IN EFI_HANDLE                           Handle\r
+  )\r
+{\r
+  DEBUG ((EFI_D_INFO, "[Variable]END_OF_DXE is signaled\n"));\r
+  mEndOfDxe = TRUE;\r
+  return EFI_SUCCESS;\r
+}\r

 \r
 /**\r
   SMM Fault Tolerant Write protocol notification event handler.\r
 \r
 /**\r
   SMM Fault Tolerant Write protocol notification event handler.\r


@@ -774,6 +890,7 @@ VariableServiceInitialize (
   VOID                                    *SmmFtwRegistration;\r
   EFI_SMM_ACCESS2_PROTOCOL                *SmmAccess;\r
   UINTN                                   Size;\r
   VOID                                    *SmmFtwRegistration;\r
   EFI_SMM_ACCESS2_PROTOCOL                *SmmAccess;\r
   UINTN                                   Size;\r

+  VOID                                    *SmmEndOfDxeRegistration;\r

 \r
   //\r
   // Variable initialize.\r
 \r
   //\r
   // Variable initialize.\r


@@ -843,6 +960,16 @@ VariableServiceInitialize (
                                         );\r
   ASSERT_EFI_ERROR (Status);\r
  \r
                                         );\r
   ASSERT_EFI_ERROR (Status);\r
  \r

+  //\r
+  // Register EFI_SMM_END_OF_DXE_PROTOCOL_GUID notify function.\r
+  //\r
+  Status = gSmst->SmmRegisterProtocolNotify (\r
+                    &gEfiSmmEndOfDxeProtocolGuid,\r
+                    SmmEndOfDxeCallback,\r
+                    &SmmEndOfDxeRegistration\r
+                    );\r
+  ASSERT_EFI_ERROR (Status);\r
+\r

   //\r
   // Register FtwNotificationEvent () notify function.\r
   // \r
   //\r
   // Register FtwNotificationEvent () notify function.\r
   // \r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf
index e2c5d9c40d73db7fc2b9e9ecb02ac78954d0b325..c229805bc9c6249984660a395f9463a27a142357 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf
@@ -14,7 +14,7 @@
 #  This external input must be validated carefully to avoid security issue like
 #  buffer overflow, integer overflow.
 #
 #  This external input must be validated carefully to avoid security issue like
 #  buffer overflow, integer overflow.
 #

-# Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>
+# Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.<BR>

 # This program and the accompanying materials
 # are licensed and made available under the terms and conditions of the BSD License
 # which accompanies this distribution. The full text of the license may be found at
 # This program and the accompanying materials
 # are licensed and made available under the terms and conditions of the BSD License
 # which accompanies this distribution. The full text of the license may be found at


@@ -69,6 +69,7 @@
   gEfiSmmVariableProtocolGuid                   ## ALWAYS_PRODUCES
   gEfiSmmFaultTolerantWriteProtocolGuid         ## SOMETIMES_CONSUMES
   gEfiSmmAccess2ProtocolGuid                    ## ALWAYS_CONSUMES
   gEfiSmmVariableProtocolGuid                   ## ALWAYS_PRODUCES
   gEfiSmmFaultTolerantWriteProtocolGuid         ## SOMETIMES_CONSUMES
   gEfiSmmAccess2ProtocolGuid                    ## ALWAYS_CONSUMES

+  gEfiSmmEndOfDxeProtocolGuid                   ## ALWAYS_CONSUMES

 
 [Guids]
   gEfiVariableGuid                              ## PRODUCES ## Configuration Table Guid 
 
 [Guids]
   gEfiVariableGuid                              ## PRODUCES ## Configuration Table Guid 

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
index eb67bae748fe0e15bcd78f7a279e5afce064bb4e..865b9ad1a408a30bab9ee5b5f8852d5cad919567 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
@@ -19,6 +19,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Protocol/Variable.h>\r
 #include <Protocol/SmmCommunication.h>\r
 #include <Protocol/SmmVariable.h>\r
 #include <Protocol/Variable.h>\r
 #include <Protocol/SmmCommunication.h>\r
 #include <Protocol/SmmVariable.h>\r

+#include <Protocol/VariableLock.h>\r

 \r
 #include <Library/UefiBootServicesTableLib.h>\r
 #include <Library/UefiRuntimeServicesTableLib.h>\r
 \r
 #include <Library/UefiBootServicesTableLib.h>\r
 #include <Library/UefiRuntimeServicesTableLib.h>\r


@@ -44,6 +45,7 @@ UINT8                           *mVariableBufferPhysical    = NULL;
 UINTN                            mVariableBufferSize;\r
 UINTN                            mVariableBufferPayloadSize;\r
 EFI_LOCK                         mVariableServicesLock;\r
 UINTN                            mVariableBufferSize;\r
 UINTN                            mVariableBufferPayloadSize;\r
 EFI_LOCK                         mVariableServicesLock;\r

+EDKII_VARIABLE_LOCK_PROTOCOL     mVariableLock;\r

 \r
 /**\r
   Acquires lock only at boot time. Simply returns at runtime.\r
 \r
 /**\r
   Acquires lock only at boot time. Simply returns at runtime.\r


@@ -160,6 +162,63 @@ SendCommunicateBuffer (
   return  SmmVariableFunctionHeader->ReturnStatus;\r
 }\r
 \r
   return  SmmVariableFunctionHeader->ReturnStatus;\r
 }\r
 \r

+/**\r
+  Mark a variable that will become read-only after leaving the DXE phase of execution.\r
+\r
+  @param[in] This          The VARIABLE_LOCK_PROTOCOL instance.\r
+  @param[in] VariableName  A pointer to the variable name that will be made read-only subsequently.\r
+  @param[in] VendorGuid    A pointer to the vendor GUID that will be made read-only subsequently.\r
+\r
+  @retval EFI_SUCCESS           The variable specified by the VariableName and the VendorGuid was marked\r
+                                as pending to be read-only.\r
+  @retval EFI_INVALID_PARAMETER VariableName or VendorGuid is NULL.\r
+                                Or VariableName is an empty string.\r
+  @retval EFI_ACCESS_DENIED     EFI_END_OF_DXE_EVENT_GROUP_GUID or EFI_EVENT_GROUP_READY_TO_BOOT has\r
+                                already been signaled.\r
+  @retval EFI_OUT_OF_RESOURCES  There is not enough resource to hold the lock request.\r
+**/\r
+EFI_STATUS\r
+EFIAPI\r
+VariableLockRequestToLock (\r
+  IN CONST EDKII_VARIABLE_LOCK_PROTOCOL *This,\r
+  IN       CHAR16                       *VariableName,\r
+  IN       EFI_GUID                     *VendorGuid\r
+  )\r
+{\r
+  EFI_STATUS                                Status;\r
+  UINTN                                     PayloadSize;\r
+  SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE    *VariableToLock;\r
+\r
+  if (VariableName == NULL || VariableName[0] == 0 || VendorGuid == NULL) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
+  AcquireLockOnlyAtBootTime(&mVariableServicesLock);\r
+\r
+  //\r
+  // Init the communicate buffer. The buffer data size is:\r
+  // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.\r
+  //\r
+  PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE, Name) + StrSize (VariableName);\r
+  Status = InitCommunicateBuffer ((VOID **) &VariableToLock, PayloadSize, SMM_VARIABLE_FUNCTION_LOCK_VARIABLE);\r
+  if (EFI_ERROR (Status)) {\r
+    goto Done;\r
+  }\r
+  ASSERT (VariableToLock != NULL);\r
+\r
+  CopyGuid (&VariableToLock->Guid, VendorGuid);\r
+  VariableToLock->NameSize = StrSize (VariableName);\r
+  CopyMem (VariableToLock->Name, VariableName, VariableToLock->NameSize);\r
+\r
+  //\r
+  // Send data to SMM.\r
+  //\r
+  Status = SendCommunicateBuffer (PayloadSize);\r
+\r
+Done:\r
+  ReleaseLockOnlyAtBootTime (&mVariableServicesLock);\r
+  return Status;\r
+}\r

 \r
 /**\r
   This code finds variable in storage blocks (Volatile or Non-Volatile).\r
 \r
 /**\r
   This code finds variable in storage blocks (Volatile or Non-Volatile).\r


@@ -722,6 +781,7 @@ VariableSmmRuntimeInitialize (
   IN EFI_SYSTEM_TABLE                       *SystemTable\r
   )\r
 {\r
   IN EFI_SYSTEM_TABLE                       *SystemTable\r
   )\r
 {\r

+  EFI_STATUS                                Status;\r

   VOID                                      *SmmVariableRegistration;\r
   VOID                                      *SmmVariableWriteRegistration;\r
   EFI_EVENT                                 OnReadyToBootEvent;\r
   VOID                                      *SmmVariableRegistration;\r
   VOID                                      *SmmVariableWriteRegistration;\r
   EFI_EVENT                                 OnReadyToBootEvent;\r


@@ -729,6 +789,15 @@ VariableSmmRuntimeInitialize (
 \r
   EfiInitializeLock (&mVariableServicesLock, TPL_NOTIFY);\r
 \r
 \r
   EfiInitializeLock (&mVariableServicesLock, TPL_NOTIFY);\r
 \r

+  mVariableLock.RequestToLock = VariableLockRequestToLock;\r
+  Status = gBS->InstallMultipleProtocolInterfaces (\r
+                  &mHandle,\r
+                  &gEdkiiVariableLockProtocolGuid,\r
+                  &mVariableLock,\r
+                  NULL\r
+                  );\r
+  ASSERT_EFI_ERROR (Status);\r
+\r

   //\r
   // Smm variable service is ready\r
   //\r
   //\r
   // Smm variable service is ready\r
   //\r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
index 05dd49d368c40d0791517c709419c5e474162704..761ea66e6b4416b30bd81fdde75b2c119d68731f 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
@@ -4,7 +4,7 @@
 #  This module is the Runtime DXE part correspond to SMM variable module. It \r
 #  installs variable arch protocol and variable write arch protocol and works \r
 #  with SMM variable module together. \r
 #  This module is the Runtime DXE part correspond to SMM variable module. It \r
 #  installs variable arch protocol and variable write arch protocol and works \r
 #  with SMM variable module together. \r

-# Copyright (c) 2010 - 2011, Intel Corporation. All rights reserved.<BR>\r
+# Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.<BR>\r

 #\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
 #\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r


@@ -54,6 +54,7 @@
   gEfiVariableArchProtocolGuid                  ## ALWAYS_PRODUCES  \r
   gEfiSmmCommunicationProtocolGuid\r
   gEfiSmmVariableProtocolGuid\r
   gEfiVariableArchProtocolGuid                  ## ALWAYS_PRODUCES  \r
   gEfiSmmCommunicationProtocolGuid\r
   gEfiSmmVariableProtocolGuid\r

+  gEdkiiVariableLockProtocolGuid                ## ALWAYS_PRODUCES\r

 \r
 [Guids]\r
   gEfiEventVirtualAddressChangeGuid             ## PRODUCES ## Event\r
 \r
 [Guids]\r
   gEfiEventVirtualAddressChangeGuid             ## PRODUCES ## Event\r