Previous changes introduced tests for unsigned
images verified by hash entries in DB/DBX. This commit adds
tests covering verification of signed images, including
certificate chain validation as well as cases where image
hashes are checked against entries in DB/DBX.
Signed-off-by: Alexander Gryanko <xpahos@gmail.com>
The part of DxeImageVerificationHandler responsible for
verifying the image location source has already been
implemented. This commit implements tests for verifying
images in cases where the image has no signature, but
there is a hash record for this file in DB/DBX.
Signed-off-by: Alexander Gryanko <xpahos@gmail.com>
InstallConfigurationTable is used in the AddImageExeInfo
call and is necessary for outputting information about
the binary file in case of an error. Mock has been added
for the DxeImageVerificationHandler subroutine.
Signed-off-by: Alexander Gryanko <xpahos@gmail.com>
Update the test decision matrix and TC6 expected result to reflect
the backward-compatible ForceRebase logic: when ForceRebase=TRUE and
no files have the ,XIP suffix (XipFileCount==0), all files are
rebased using the legacy behavior rather than skipping all files.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Add XipFileCount to FV_INFO to track how many files have the ,XIP
suffix. Update FfsRebase() to only apply selective XIP rebase when
XipFileCount > 0. When no files have the ,XIP suffix (XipFileCount
== 0), preserve the legacy ForceRebase=TRUE behavior of rebasing all
files. This maintains backward compatibility for existing platforms
that use FvForceRebase=TRUE without any Xip rules.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Because there was no negotiation, the SMM controller from QEMU will not
broadcast the SMI to all cores, causing only the BSP getting interrupted
into MMI.
This change fixed the issue by invoking the negotiation routine and
program the register to enable broadcasting.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
When caching the DHCPv6 discover packet to Mode->DhcpDiscover in
PxeBcDhcp6CallBack, the destination was incorrectly specified as
Mode->DhcpDiscover.Dhcpv4 (the DHCPv4 union member). Change it to
Mode->DhcpDiscover to correctly reference the union and avoid
type confusion when copying a DHCPv6 packet.
Signed-off-by: Abuthahir M <abuthahirm@ami.com>
In Ip6ProcessRouterAdvertise, IpSb->InterfaceId is dereferenced in
CopyMem to form a stateless address. Add a guard to ensure
IpSb->InterfaceId is not NULL before entering the block, preventing
a potential NULL pointer dereference.
Signed-off-by: Abuthahir M <abuthahirm@ami.com>
In Ip6CleanService, Ip6FreeNeighborEntry may attempt to send packets via
MNP. Defensively move the neighbor table cleanup to occur before MNP
teardown so that the MNP child handle and its resources remain valid
during neighbor entry cleanup.
Signed-off-by: Abuthahir M <abuthahirm@ami.com>
Replace the ASSERT (Instance->Config != NULL) in Dhcp6UpdateIaInfo with
an explicit NULL check that returns EFI_DEVICE_ERROR. Also add a
complementary guard in Dhcp6GenerateIaCb alongside the existing check
for Instance->IaCb.Ia. These are defensive changes to prevent potential
NULL pointer dereferences.
Signed-off-by: Abuthahir M <abuthahirm@ami.com>
Created ML-DSA API functions to configure public and private keys for
ML-DSA algorithm. This will allow users to sign and verify with ML-DSA.
Unit tests were add to confirm operation of the API.
Signed-off-by: Michael G.A. Holland <michael.holland@intel.com>
In arguments of EFI_PCI_IO_PROTOCOL member functions, replace the
EfiPciWidth* enum literals from
EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_WIDTH with the matching
EfiPciIoWidth* values from EFI_PCI_IO_PROTOCOL_WIDTH.
This keeps the call sites aligned with the protocol they actually use.
The old values were copied from EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL code,
so they obscured the intent of the calls and relied on an explicit
cast.
This mimics commit 8ba64a9a94 ("UefiPayloadPkg: Fix build failure with
CLANGPDB").
Generated by coccinelle script.
``` smpl
@initialize:python@
@@
def to_pci_io_width(name):
return name.replace("EfiPciWidth", "EfiPciIoWidth", 1)
@normalize@
typedef EFI_PCI_IO_PROTOCOL;
typedef EDKII_PCI_DEVICE_PPI;
type T =~ "^EFI_PCI_IO_PROTOCOL_WIDTH$";
EFI_PCI_IO_PROTOCOL *x;
EDKII_PCI_DEVICE_PPI *y;
identifier bad =~ "EfiPciWidth(Uint|FifoUint|FillUint)(8|16|32|64)";
identifier top_op =~ "^(PollMem|PollIo|CopyMem)$";
identifier space =~ "^(Mem|Io|Pci)$";
identifier rw =~ "^(Read|Write)$";
fresh identifier good = script:python(bad) { to_pci_io_width(bad) };
expression first;
expression list rest;
@@
(
x->top_op
|
y->PciIo.top_op
|
x->space.rw
|
y->PciIo.space.rw
) (
first,
- (T)bad
+ good
,
rest
)
```
Verified with:
- `build -p UefiPayloadPkg/UefiPayloadPkg.dsc -a IA32 -a X64 -b DEBUG -t GCC -D BOOTLOADER=SBL`
- temporary IA32 PEIM harness that compiled X86_BuildFdtLib.c
Signed-off-by: Mingjie Shen <shen497@purdue.edu>
In arguments of EFI_PCI_IO_PROTOCOL member functions, replace the
EfiPciWidth* enum literals from
EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_WIDTH with the matching
EfiPciIoWidth* values from EFI_PCI_IO_PROTOCOL_WIDTH.
This keeps the call sites aligned with the protocol they actually use.
The old values were copied from EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL code,
so they obscured the intent of the calls and relied on an explicit
cast.
This mimics commit 8ba64a9a94 ("UefiPayloadPkg: Fix build failure with
CLANGPDB").
Generated by coccinelle script.
``` smpl
@initialize:python@
@@
def to_pci_io_width(name):
return name.replace("EfiPciWidth", "EfiPciIoWidth", 1)
@normalize@
typedef EFI_PCI_IO_PROTOCOL;
typedef EDKII_PCI_DEVICE_PPI;
type T =~ "^EFI_PCI_IO_PROTOCOL_WIDTH$";
EFI_PCI_IO_PROTOCOL *x;
EDKII_PCI_DEVICE_PPI *y;
identifier bad =~ "EfiPciWidth(Uint|FifoUint|FillUint)(8|16|32|64)";
identifier top_op =~ "^(PollMem|PollIo|CopyMem)$";
identifier space =~ "^(Mem|Io|Pci)$";
identifier rw =~ "^(Read|Write)$";
fresh identifier good = script:python(bad) { to_pci_io_width(bad) };
expression first;
expression list rest;
@@
(
x->top_op
|
y->PciIo.top_op
|
x->space.rw
|
y->PciIo.space.rw
) (
first,
- (T)bad
+ good
,
rest
)
```
Verified with:
- `build -p MdeModulePkg/MdeModulePkg.dsc -m MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf -a IA32 -b DEBUG -t GCC`
- `build -p MdeModulePkg/MdeModulePkg.dsc -m MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf -a X64 -b DEBUG -t GCC`
Signed-off-by: Mingjie Shen <shen497@purdue.edu>
This library class is called ResetSystemLib, not EfiResetSystemLib.
Fix this, making resets generated by UEFI and through the runtime service
work as expected.
Signed-off-by: Benjamin Doron <benjamin.doron@9elements.com>
Add the support of reporting Redfish communication time between BIOS
and BMC. This helps to debug the issue of long boot time. This debug
function is default disabled, so it won't add extra time during
Redfish communication on regular boot.
Signed-off-by: Nickle Wang <nicklew@nvidia.com>
Add a maintenance script that updates the CodeQL CLI dependency
YAML files and CodeQlQueries.qls together.
The script refreshes the CLI version, release digests, and cpp query
pack pin from the GitHub release metadata and the corresponding
qlpack.yml in the CodeQL CLI release branch.
Add comments to the CodeQL CLI dependency YAML files that direct
maintainers to use the script for future version updates.
Signed-off-by: Mingjie Shen <shen497@purdue.edu>
Update CodeQL external dependency definitions to v2.25.3 for generic,
Linux, and Windows archives, including refreshed SHA256 hashes from the
release metadata.
Pin the codeql/cpp-queries query pack to version 1.6.1, as specified in
the qlpack.yml at:
https://github.com/github/codeql/blob/codeql-cli/v2.25.3/cpp/ql/src/qlpack.yml
Signed-off-by: Mingjie Shen <shen497@purdue.edu>
Some combination of fields of Rd Address Space descriptors
are not valid. Check them when updating a Rd Address Space
descriptor.
Cf. ACPI 6.4 Table 6.44:
"Valid Combination of Address Space Descriptor Fields"
Also check that the input length is not 0 to avoid
potential integer underflow.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Adds a reference to the Breaking Change and Release Process for EDK II
in CONTRIBUTING.md, so that contributors are aware of the process when
introducing breaking changes.
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Adds the GitHub issue template files for the EDK II Breaking Change
and Release Process, as well as a link to the process in the pull
request template.
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
RFC 0003 - "Breaking Change and Release Process for EDK II" defined a
new process for how breaking changes are tracked and documented in
EDK II. This commit adds an empty BREAKING-CHANGES.md file to the root
of the EDK II repository with sections for the current and next two
stable tags so the file can be updated in accordance with the RFC.
I add myself as a reviewer of the file to monitor the initial set of
updates against the RFC process.
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Add library mappings, PCDs, and component entries for Tcg2Pei,
Tcg2ConfigPei, Tcg2PlatformPei, Tcg2Dxe, and Tcg2ConfigDxe
when TPM2_ENABLE is TRUE. Also include the corresponding
firmware volume sections.
Signed-off-by: zhuyunfei <zhuyunfei@loongson.cn>
Signed-off-by: gaoqihang <gaoqihang@loongson.cn>
Reviewed-by: qiandongyan <qiandongyan@loongson.cn>
Reviewed-by: lichao <lichao@loongson.cn>
This is preparatory patch for SMBIOS Type 44 record.
SMBIOS Type 44 record have a reference handle of SMBIOS Type 4 record.
Therefore, register SMBIOS Type 4 record into SmbiosHandleMap
with the Socket Processor Hieararchy token.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Commit 43e306806e added support
to DXE Core for EfiUnacceptedMemoryType. However, it incorrectly
added EFI_GCD_MEMORY_TYPE_UNACCEPTED to gMemoryTypeInformation,
which is the GCD memory type that is associated with
EfiUnacceptedMemoryType. All other changes from that PR
appear correct.
This is corrected to the EFI memory type.
The Memory Bin Google Test copied this incorrect definition,
so it is updated as well.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
ArmFfaLibGetPartitionInfo() helper replaces the manual partition info
lookup sequence used by FF-A clients:
* ArmFfaLibPartitionIdGet()
* ArmFfaLibGetRxTxBuffers()
* ArmFfaLibPartitionInfoGet(..., FFA_PART_INFO_FLAG_TYPE_DESC, ...)
* copy EFI_FFA_PART_INFO_DESC from the RX buffer
* ArmFfaLibRxRelease()
The collateral evolutions in b80000847a and 96ad9bd397 use the
helper as the owner of that sequence. Their callers only consume the
copied partition descriptor and do not keep a local partition ID solely for
RX buffer release.
Commit 8955d8db32 converted MmCommunication to call
ArmFfaLibGetPartitionInfo(), but kept caller-side partition ID state
and, in PEI, still released the RX buffer after the helper returned.
That made the ArmPkg conversion inconsistent with b80000847a and
96ad9bd397, and inconsistent with the helper ownership model. In the
ArmFfaLibPartitionInfoGetRegs path, there is no RX buffer to release,
while in the RX/TX buffer path, the buffer is already released inside
ArmFfaLibGetPartitionInfo().
This patch removes the stale local mPartId state and the remaining
caller-side ArmFfaLibRxRelease() from the DXE and PEI MM communication
drivers. The callers now match the helper contract: get the descriptor,
validate DIRECT_MSG_REQ support, and store the StandaloneMM partition
ID.
The current version was generated by running the following Coccinelle
script on 8955d8db32^, then rebasing the resulting fixup to master.
``` smpl
@replace_old_sequence@
typedef EFI_STATUS;
identifier Fn;
identifier Info, Count, TxBuffer, TxBufferSize, RxBuffer, RxBufferSize;
identifier PartId, Status, Size;
expression Guid;
position p;
statement S1, S2;
type SizeArgT;
@@
EFI_STATUS Fn@p (...) {
...
- EFI_FFA_PART_INFO_DESC *Info;
+ EFI_FFA_PART_INFO_DESC Info;
...
- Status = ArmFfaLibPartitionIdGet (&PartId);
- if (EFI_ERROR (Status)) S1
...
- Status = ArmFfaLibGetRxTxBuffers (
- &TxBuffer,
- &TxBufferSize,
- &RxBuffer,
- &RxBufferSize
- );
- if (EFI_ERROR (Status)) S2
...
- Status = ArmFfaLibPartitionInfoGet (
- Guid,
- FFA_PART_INFO_FLAG_TYPE_DESC,
- &Count,
- (SizeArgT)&Size
- );
+ Status = ArmFfaLibGetPartitionInfo (Guid, &Info);
...
(
- if ((Count != 1) || (Size < sizeof (EFI_FFA_PART_INFO_DESC))) {
- ...
- } else {
- Info = (EFI_FFA_PART_INFO_DESC *)RxBuffer;
...
- }
|
- if ((Count != 1) || (Size < sizeof (EFI_FFA_PART_INFO_DESC))) {
- ...
- }
...
- Info = (EFI_FFA_PART_INFO_DESC *)RxBuffer;
)
...
- ArmFfaLibRxRelease (PartId);
...
}
@part_info_members depends on replace_old_sequence@
identifier replace_old_sequence.Info;
identifier Field =~ "^(PartitionId|PartitionProps)$";
@@
- Info->Field
+ Info.Field
@remove_old_variables depends on replace_old_sequence@
identifier replace_old_sequence.Count, replace_old_sequence.TxBuffer;
identifier replace_old_sequence.TxBufferSize, replace_old_sequence.RxBuffer, replace_old_sequence.RxBufferSize;
identifier replace_old_sequence.PartId;
identifier replace_old_sequence.Size;
type T;
@@
(
- T *TxBuffer;
|
- UINT64 TxBufferSize;
|
- T *RxBuffer;
|
- UINT64 RxBufferSize;
|
- UINT32 Count;
|
- UINT32 Size;
|
- UINT16 PartId;
|
- static UINT16 PartId;
)
```
Signed-off-by: Mingjie Shen <shen497@purdue.edu>
TcgMeasureGptTable() ignored the return status of
TpmSanitizePrimaryHeaderGptEventSize(). On failure the EventSize output
is unreliable and was passed straight into AllocateZeroPool() and the
subsequent CopyMem() operations, which can result in an incorrectly
sized allocation and out-of-bounds access when parsing an untrusted GPT.
Check the status and, on error, free the already-allocated PrimaryHeader
and EntryPtr buffers and return EFI_DEVICE_ERROR, matching the handling
already used in DxeTpm2MeasureBootLib's TcgMeasureGptTable().
Signed-off-by: Mingjie Shen <shen497@purdue.edu>
Add support for generating SMBIOS Type 37 Memory Channel structures from
Configuration Manager data.
Introduce the Memory Channel CM object and the associated Memory Channel
Device CM object. The channel object describes the Type 37 fixed fields,
including channel type, maximum channel load, memory device count, and the
token for the device-list object. The device-list object describes each
memory device attached to the channel using a device load and a Type 17
Memory Device CM token.
Add parser entries for both CM objects and register the Type 37 generator in
the DynamicTablesPkg DSC so it is available through the SMBIOS table factory.
The Type 37 generator builds one SMBIOS record per Memory Channel CM object.
For each channel, it retrieves the referenced Memory Channel Device list,
validates the channel type, maximum channel load, device count, device load,
and device tokens, resolves each referenced Type 17 CM token to an SMBIOS
handle, and emits the variable-length MemoryDevice array in the Type 37
record.
This allows platforms to describe memory channels and link them to generated
Type 17 Memory Device records through CM tokens instead of hard-coded SMBIOS
handles.
Signed-off-by: Varshit Pandya <varshit.pandya@arm.com>
Commit 0a0919607c ("OvmfPkg/PlatformInitLib: redefine low memory") narrowed
PlatformGetLowMemoryCB() to consider only the first below-4G memory block
whose base address is zero. The change was intended to fix SVSM guests,
where SVSM caves a chunk out of below-4G RAM and OVMF must not stray into
that hole.
TDVF, however, reports its below-4G RAM through the TdHob as two adjacent
resource descriptors:
[0, 0x800000) EFI_RESOURCE_SYSTEM_MEMORY (pre-accepted)
[0x800000, ~4G) EFI_RESOURCE_MEMORY_UNACCEPTED
PlatformScanE820Tdx() surfaces both as EfiAcpiAddressRangeMemory E820
entries. After 0a0919607c only the first, tiny 8 MiB block is picked up,
so PlatformInfoHob->LowMemory becomes 0x800000.
In OvmfPkg/PlatformPei/MemDetect.c PublishPeiMemory() this drives:
LowerMemorySize = 0x00800000 // LowMemory
PeiMemoryCap = 0x04F82000 // ~81 MiB
MemoryBase = LowerMemorySize - PeiMemoryCap // UINT32 underflow
= 0xFB87E000
Permanent PEI memory is then published at 0xFB87E000, which is not backed
by RAM. TemporaryRamMigration()'s first CopyMem into that phantom range
(observed as 0xFB898000 in the failing log) faults, tearing down the TD.
Fold adjacent below-4G memory blocks into the low-memory span: accept an
entry whose base equals the current LowMemory and advance LowMemory by
its length. LowMemory starts at zero, so the first accepted block at
address 0 still starts the sequence; non-adjacent above-4G or SVSM-carved
blocks continue to be skipped (their base does not match LowMemory); and
the TDVF accepted+unaccepted pair, which is contiguous, is now grouped
correctly.
Co-authored-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Stanislaw Grams <stanislaw.grams@intel.com>
LoongArch64 GCC or CLANG currently does not support the parameter
`-mstack-protector-guard=global`, but if `-fstack-protector` is enabled,
the guard is global.
The `-mstack-protector-guard` may be get supportted in the next GCC
release, possibly GCC17.
Signed-off-by: Chao Li <lichao@loongson.cn>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Guillermo Antonio Palomino Sosa <guillermo.a.palomino.sosa@intel.com>
Cc: Yuwei Chen <yuwei.chen@intel.com>
Cc: Poncho Figueroa <poncho.figueroa.esqueda@intel.com>
Cc: Mike Beaton <mjsbeaton@gmail.com>
Added LoongArch64 support. Currently, LoongArch64 doesn't supports TRNG,
it uses the `RDTIME` instruction and a xorshif64 alorithms to compose a
PRNG(RngLib).
It may supports the SE TRNG in the future, and will change to the TRNG
when SE support becomes available.
Signed-off-by: Chao Li <lichao@loongson.cn>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Added LoongArch64 stack cookie interrupt instance, calling `CpuBreakpoint`
to stop the CPU.
Signed-off-by: Chao Li <lichao@loongson.cn>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Add constants for HMAT table's SSLBI and ProximityDoman structures to
industry standards headers for Acpi 6.4, 6.5, and 6.6.
Co-authored-by: Sophia Wang <yodagump@google.com>
Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
