UefiBootManagerLibConstructor() is a constructor function in BmBoot.c
that is missing as the constructor in the INF file.
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
EfiShellGetMapFromDevicePath() stops at any end-type node and
converts an end-instance node into an end-entire node. This truncates a
multi-instance device path and modifies the protocol data in place.
Walk until the end-entire node instead. This leaves intermediate
instances and the original device path unchanged.
Signed-off-by: JinKang <2371488344@qq.com>
Break out the PromptForUserConfirmation() function into a lib
so it can be abstracted at the platform level.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
Implemented dynamic TCG log scaling in Tcg2Dxe. When the log would become
truncated it instead now dynamically scales doubling the size each time.
An ERROR log is reported that an increase to your base log size should
occur such that scaling is not necessary. This is a precaution against
platforms that log a lot and the addition of new hashing algorithms for
PQC. The log is allocated in BootServices memory. Tests were added via
TcgLogTest which includes a DXE driver and a UEFI shell UnitTest app. The
DXE driver handles pre-ReadyToBoot tests while the TestApp handles
post-ReadyToBoot tests as well as gathering the test results from the DXE
driver. Markdown documents were created to detail the changes.
Added the Truncation event marker to the end of the FinalEventLog when it
becomes truncated. Added a event signal for when scaling occurs on the
normal event log. Consumers can trigger callbacks on this event; the test
app uses this to know when scaling occurs.
Added an ACPI log region for the ACPI table LAML/LASA. This region does
not scale and can become truncated indicated by the Truncation event
marker.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Add interrupt-enable recursion depth tracking using
mInterruptEnableNestDepth and a bounded assertion in
CoreSetInterruptState().
This provides early detection for unintended recursive
interrupt-enable loops.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Refactor the CoreSetInterruptState(TRUE) flow so EnableInterrupt() is
invoked through a single call site.
Behavior is unchanged: interrupts remain disabled in SMM and are enabled
outside SMM.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
GetTime()/GetWakeupTime() wait for the RTC Update-In-Progress (UIP) bit to
clear, then read the time/date registers (offsets 0-9) back to back. A clear
UIP bit only guarantees a documented minimum before the next update cycle
begins, not that the whole read fits inside it. Where a single RTC access is
slow the read overruns that window and picks up undefined data from registers
the update cycle has disconnected from the bus; the corrupted field fails the
range check and GetTime() returns EFI_DEVICE_ERROR, which intermittently fails
OS boot and resume.
Read the registers through RtcReadTimeDateOrFail(), which samples the Seconds
register before the read and requires both UIP still clear and Seconds
unchanged afterwards. The update cycle is specified to increment the stored
time, so Seconds changes if and only if an update occurred, which detects a
collision anywhere inside the read. RtcReadRegistersSafe() drives that with at
most one retry and copies out only on success. The full reasoning, including
why one retry is enough, is documented at those two functions.
The four read paths (GetTime, Init, GetWakeupTime, SetWakeupTime disable-alarm)
use the helper; write paths already inhibit updates via the Register B SET bit
and are unchanged. The helper enters its own update-free window, so the
up-front RtcWaitToUpdate() in PcRtcGetTime() and in the PcRtcInit() read path is
now redundant and is removed.
Signed-off-by: James Lu <james.lu@intel.com>
pylibfdt currently fails to install. The pre-built wheel files are not
published and it fails to build from source due to having a floating
dependency on the swig package (specified in pylibfdt's pyproject.toml
file).
swig 4.5.0 was released on August 22, 2026 and removed support for
Python 2 APIs still being referenced in pylibfdt. These APIs were
already routing to the Python 3 APIs, but it is still a build break.
Originally, pip-requirements.txt was updated to have a direct git
dependency on the libfdt code in the upstream DTC repostiory.
However, there were concerns about building from source in different
environments with a preference to, at least temporarily, remove the
dependency until a sustainable solution can be found.
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
This currently passes `pefile pylibfdt` to BuildPlatform.yml. However,
those are included in the same pip installation step that installs
the from pip-requirements.txt. This removes them so the dependency
details can be maintained in one place which is pip-requirements.txt.
This also allows local pip installation to install the same versions
installed in CI.
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Large multi-GPU passthrough configurations can exhaust the current
MMIO window sizing rule (1/8 of guest physical address space),
especially with newer GPUs that have very large BAR requirements and
alignment overhead.
With 46-bit guest physical addressing, the 1/8 rule provides an 8TB
MMIO window. Newer GPUs with 512GB VRAM can exhaust an 8TB window
when passing through up to 8 devices.
Increase the MMIO window size to 1/4 of guest physical address space.
This provides a 16TB MMIO window on a 46-bit setup.
Tested with 8-GPU passthrough (512GB VRAM per GPU). With this
change, all GPUs are visible and functional in the VM; without it,
one GPU was unusable.
Signed-off-by: ramkumar.s <ramkumar.s@nutanix.com>
Presently, VirtioInputDxe accepts key notifications (RegisterKeyNotifyEx)
but does not act upon them. Despite ConSplitter correctly registering
notifications via all input devices (including PS/2 etc. devices
that implement key notifications correctly), emulators such as QEMU
stop sending input to non-virtio keyboards as soon as the virtio device
is claimed. As a result, preboot hotkeys are non-functional when virtio
is used.
Fixes: https://github.com/tianocore/edk2/issues/12887
Signed-off-by: Ivan Shapovalov <intelfx@intelfx.name>
Tested-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
In addition to maintaining full key state, we also need to maintain
explicit toggle (NumLock/CapsLock/ScrollLock) state. This completes
->KeyState->KeyToggleState handling and SetStateEx() implementation.
When a *Lock key is pressed, update the keyboard toggle state before
doing anything else. This must happen first, as this state is copied
into ->KeyState (and ->KeyState needs to be filled before ->Key, as
Shift state must be cleared after shifting a printable character).
When filling ->Key, apply CapsLock in series with Shift key handling
(CapsLock only applies to alphabetic characters, but otherwise it XORs
with Shift).
Finally, complete SetStateEx() implementation as we can now apply all
KeyToggleState bits properly.
Signed-off-by: Ivan Shapovalov <intelfx@intelfx.name>
Tested-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
Folding Ctrl into a printable character to produce a C0 control code is
not specified by SIMPLE_TEXT_INPUT(_EX). We apply it for narrow
compatibility with other keyboard drivers and TerminalDxe; as such,
only apply it ReadKeyStroke (which is the only interface that does not
convey modifier state explicitly).
Signed-off-by: Ivan Shapovalov <intelfx@intelfx.name>
Tested-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
After applying Shift to a printable character, we must clear
`EFI_*_SHIFT_PRESSED` from ->KeyState to follow SIMPLE_TEXT_INPUT(_EX).
This means that ->KeyState must be populated before key code is parsed.
Signed-off-by: Ivan Shapovalov <intelfx@intelfx.name>
Tested-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
WaitForKey and ReadKeyStroke of SIMPLE_TEXT_INPUT must omit partial
keystrokes, as they do not return modifier and shift state (thus a
partial keystroke would read as an empty struct). Skip over partial
keystrokes in the key queue, should there be any.
Note that WaitForKeyEx of SIMPLE_TEXT_INPUT_EX must also omit partials,
thus it continues to share the implementation with WaitForKey -- unlike
ReadKeyStrokeEx and ReadKeyStroke.
Signed-off-by: Ivan Shapovalov <intelfx@intelfx.name>
Tested-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
With support for partial keystrokes, the one-element "last key" buffer
is now actively lossy, as a single compound key press (such as Shift-S)
will produce two EFI_KEY_DATAs which will likely be processed in the
same GetDeviceData() loop, but only one of them would be retained.
Signed-off-by: Ivan Shapovalov <intelfx@intelfx.name>
Tested-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
- on each event, compute and save full key state at the time of event
rather than just the input key itself
- correctly handle unrepresentable events (events which result in a
null EFI scancode / Unicode value) and do not enqueue them as keys
unless EFI_KEY_STATE_EXPOSED
- on ReadKeyStrokeEx, return the saved full key state rather than
recompute modifier state based on potentially-changed data
- on SetStateEx, update EFI_KEY_STATE_EXPOSED
(toggle state is not implemented yet)
Signed-off-by: Ivan Shapovalov <intelfx@intelfx.name>
Tested-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
EFI_INPUT_KEY's ->ScanCode and ->UnicodeChar are mutually exclusive.
The value space of ->ScanCode only includes representations of keys that
are not representable in Unicode (F1-F10, Esc, arrows etc.) and vice
versa. Furthermore, the integer representations of those fields overlap.
As such, writing ->UnicodeChar values into ->ScanCode is invalid and
produces bogus EFI_INPUT_KEYs that would compare inequal to any
well-formed values that might be passed into e.g. RegisterKeyNotifyEx.
Do not set ->ScanCode when a Unicode value is produced for a printable
character.
Signed-off-by: Ivan Shapovalov <intelfx@intelfx.name>
Tested-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
Technically, beyond KEY_PRESSED and its inverse KEY_RELEASED, a third
type of event is possible for autorepeated keystrokes. Invert the
condition on Event->Value to handle autorepeat events as (successive)
key presses rather than repeated releases (essentially ignoring them).
Signed-off-by: Ivan Shapovalov <intelfx@intelfx.name>
Tested-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
The original implementation of AcpiAmlObjectUpdateInteger had a critical
bug when updating integer objects that were encoded with AML_ZERO_OP(0x00)
or AML_ONE_OP(0x01), which are 1-byte optimized encodings.
When the caller tried to update such an object to a value other than 0
or 1, the code would:
1. Overwrite the opcode byte with the new value's LSB
2. This changed the opcode itself, e.g. 0x0B becomes AML_WORD_PREFIX
3. Subsequent AML bytes (name segments of following objects) get
misinterpreted as integer data
4. Result: silent AML structure is silently corrupted, causing the OS to
fail parsing ACPI tables and eventually crash.
The fix:
1. Only allow 0 -> 0 or 1 updates using the original 1-byte encoding
2. For any other value, explicitly fail with a diagnostic
3. Provide clear debug instructions on how to fix the ASL source
Reviewed-by: jie.fu <jie.fu@cixtech.com>
Signed-off-by: Johnny.Fan <Johnny.Fan@cixtech.com>
I've missed that this handle should be my GitHub handle. Correct it to point
contributors to the right GitHub account.
Fixes: d795fb571b ("Maintainer.txt: add myself as reviewer for bhyve's OvmfPkg")
Signed-off-by: Corvin Köhne <corvink@FreeBSD.org>
12828 introduced an ASSERT in HiiGetBrowserData() that fires when
InternalHiiBrowserCallback() returns NULL. This is a valid return
value indicating the browser has no data for the requested variable,
and callers already handle this by checking the FALSE return value.
The ASSERT is incorrect because it triggers on a non-error path,
causing a crash when the browser callback legitimately returns no data.
Remove the unnecessary ASSERT while keeping the existing FALSE return
so callers continue to handle this case gracefully.
Cc: Qihang Gao <gaoqihang@loongson.cn>
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
Performs a check that will verify that the library instance implements
the library specified in the dsc by ensuring a LIBRARY_CLASS definition
exists in the INF [Defines] section and the value matches the library it
says it is implementing.
As an example, from a platform dsc file:
BaseBmpSupportLib|MdeModulePkg/Library/BaseBmpSupportLib/BaseBmpSupportLib.inf
BaseBmpSupportLib is supposed to be of library class BmpSupportLib, but the
dsc defines it incorrectly, the warning message will be displayed during
build.
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
Co-authored-by: Poncho Figueroa <poncho.figueroa.esqueda@intel.com>
Updates the fork repo to the TianoCore Uncrustify fork at:
https://github.com/tianocore/uncrustify
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Runs the Black formatter against UncrustifyCheck.py so is formatted
to PEP-8. No functional changes are made.
https://pypi.org/project/black/
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
The plugin previously assumed that the workspace was a git repository
and made that pacakges would largely reside in that same repository.
A few changes are made to better support multi-repo workspaces:
1. Added a new method to find the git repo that contains the package
being checked: `_get_git_repo_path()`.
2. Removes exceptions on git not being present and ignore/submodule
exceptions.
3. Checks for git ignored files (and similar) in the repo containing
the package being checked in `_get_git_ignored_paths()`.
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
https://github.com/github/codeql/blob/codeql-cli-2.7.3/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.qhelp
Some local variables, when going through a code path, can
end up uninitialized (using the value they had at the start
of the function). This is generally due to an error path
that can occur based on the library instances, or the
unchecked error (i.e. a allocation failing).
These variables should be initialized with a known value
that will result in the function being able to exit
gracefully.
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
Fix codeql reported issues by flattening MainCmdEfiDecompress(),
making it easier for the tool to evaluate potential risks.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Refactor the Comp command and extract 2 functions:
- OpenFileOperand()
- CompareFiles()
This allows to simplify the logic of MainCmdComp() and
fix some codeql reported potential errors.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Check the return value of LocateProtocol() before
using the decompression protocol. This avoids a
potential NULL pointer derefence spotted by codeql.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract file opening and compression code into helpers.
Upon calling:
- gEfiShellProtocol->GetFileSize()
- gEfiShellProtocol->ReadFile()
the returned Status is now checked.
Upon calling AllocateZeroPool, the failed status is now set to
EFI_OUT_OF_RESOURCES.
Other than that, no functional change.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
