MdeModulePkg/Variable: Init var policy after SMM variable is ready

[makubacki]

Description

This series is going to edk2 but it is being made available in parallel to Project Mu since the edk2 202502 soft freeze began today. The plan is to not backport this Mu series but keep in the "dev" branch. Once the changes are in edk2, we can pull this into the next Mu release branch if we'd like.

---

On a MM system, the main UEFI variable logic resides in MMRAM. In that case, the variable policy logic in VarCheckPolicyLib, such as VarCheckPolicyLibStandaloneMm is linked against the MM driver also in that case VariableStandaloneMm.

The MM variable driver indicates its presence to the RT DXE driver via gEfiSmmVariableProtocolGuid to indicate variable read support is available from MM. This triggers installation of the variable architectural protocol in DXE.

Today, variable policy is initialized by calling VariablePolicySmmDxeMain() in VariableSmmRuntimeInitialize(). In turn, this installs gEdkiiVariablePolicyProtocolGuid. Functions in gEdkiiVariablePolicyProtocolGuid may trigger MMIs. However, it is possible that the MM variable driver which is linked against the code with the variable policy MMI handlers (i.e. VarCheckPolicyLib) is not loaded yet.

Therefore, this change moves invocation of VariablePolicySmmDxeMain() to SmmVariableReady() which is called on installation of gEfiSmmVariableProtocolGuid indicating variable MM services are ready. gEdkiiVariablePolicyProtocolGuid is still installed prior to the variable architectural protocol being installed.

• Impacts functionality?
• Impacts security?
• Breaking change?
• Includes tests?
• Includes documentation?
• Backport to release branch?

How This Was Tested

• Verify variable policy is initialized as expected on QEMU Q35/SBSA and a physical Intel system.
• Check that the variable image handle passed to VariablePolicySmmDxeMain() is correct.

Integration Instructions

N/A - Some drivers may dispatch differently if they depend on gEdkiiVariablePolicyProtocolGuid. However, this is not considered breaking as that is an inherent expectation in dispatch based on dependency expressions.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.

Project coverage is 1.60%. Comparing base (c75e4c8) to head (39b365c).

Files with missing lines	Patch %	Lines
...versal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c	0.00%	2 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff               @@
##           dev/202405    #1269      +/-   ##
==============================================
- Coverage        1.60%    1.60%   -0.01%     
==============================================
  Files            1379     1379              
  Lines          359694   359696       +2     
  Branches         5524     5524              
==============================================
  Hits             5760     5760              
- Misses         353827   353829       +2     
  Partials          107      107              

Flag	Coverage Δ
MdeModulePkg	0.67% <0.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.