UefiBootManagerLibConstructor() is a constructor function in BmBoot.c
that is missing as the constructor in the INF file.
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
12828 introduced an ASSERT in HiiGetBrowserData() that fires when
InternalHiiBrowserCallback() returns NULL. This is a valid return
value indicating the browser has no data for the requested variable,
and callers already handle this by checking the FALSE return value.
The ASSERT is incorrect because it triggers on a non-error path,
causing a crash when the browser callback legitimately returns no data.
Remove the unnecessary ASSERT while keeping the existing FALSE return
so callers continue to handle this case gracefully.
Cc: Qihang Gao <gaoqihang@loongson.cn>
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
https://github.com/github/codeql/blob/codeql-cli-2.7.3/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.qhelp
Some local variables, when going through a code path, can
end up uninitialized (using the value they had at the start
of the function). This is generally due to an error path
that can occur based on the library instances, or the
unchecked error (i.e. a allocation failing).
These variables should be initialized with a known value
that will result in the function being able to exit
gracefully.
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
Extend the GptLib host-based tests with negative cases that guard the
security hardening in PartitionValidGptTable(), PartitionCheckGptEntry()
and PartitionRestoreGptTable() against future regressions. These tests
exercise the shared parser, not the specific fix itself.
The new cases drive the parser with malformed GPT structures that an
attacker may present: bad signature/revision, header-size boundaries,
CRC corruption, MyLBA replay, zero/non-power-of-two entry sizes, LBA
multiplication overflow, out-of-range and overlapping entries, and
restore failure on write-protected media. The INF file header is
updated to note the added malformed coverage.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
Add the positive-path host-based tests for the shared GptLib parser
(extracted as part of the parser security hardening), ensuring the
tightened checks in PartitionValidGptTable(), PartitionCheckGptEntry()
and PartitionRestoreGptTable() do not falsely reject well-formed GPTs.
The tests run against an in-memory mock disk and cover accepted
primary/backup headers, boundary but legal header/entry sizes, correct
entry-status flagging on valid entries, and primary/backup restore
round-trips.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
PartitionValidGptTable() checked the signature, header CRC32, MyLBA, the
entry-array CRC32 and the entry-array size overflow, but not several other
UEFI-mandated GPT header constraints. DxeTpm2MeasureBootLib used to enforce
these via Tpm2SanitizeEfiPartitionTableHeader(); once it switched to this
shared parser, the checks were lost on the path.
Also reject a header unless Header.Revision is GPT_HEADER_REVISION_V1,
HeaderSize is at least the 92-byte minimum, NumberOfPartitionEntries is
non-zero, SizeOfPartitionEntry is 128 * 2^n, and PartitionEntryLBA *
BlockSize cannot overflow. The "entries lie before FirstUsableLBA" rule is
intentionally omitted, as this routine also validates the backup header
whose entry array follows the usable region.
This restores the validation the measurement path lost and, because GptLib
is shared, tightens PartitionDxe the same way: malformed headers are now
rejected and the parse and measure paths stay identical.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
As reported in CVE-2024-13745 via oss-sec, DxeTpm2MeasureBootLib can
measure a partition table that differs from the one parsed by the
PartitionDxe driver.
To address this, the more complete GPT parsing logic from PartitionDxe
is extracted into a standalone GptLib library so it can be
shared between PartitionDxe and DxeTpm2MeasureBootLib. This ensures
that the exact same partition table measured into PCR[5] is the one
parsed and used by the system. PartitionDxe behavior is unchanged.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
The direct message arguments stripped off the header, making the
underlying FF-A function interface to lose information when it comes to
certain return code, i.e. FFA_YIELD and FFA_INTERRUPT.
This change adds back the header field for this purpose so that the
callers can decide how to act on the corresponding return codes.
It then populates the header field for this purpose in FFA direct
message functions so that the callers can decide how to act on the
corresponding return codes.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
Output parameter CurrentVersion of ArmFfaLibGetVersion() is
not optional parameter. That means it should return error
when CurrentVersion is NULL.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
According to the FFA specification, when FFA_RX_RELEASE or
FFA_RXTX_UNMAP is invoked from UEFI as a non-secure virtual instance,
the w1 register must be zero (MBZ). Supplying a non-zero value causes the
SPMC to return FFA_INVALID_PARAMETER.
When these interfaces are invoked from UEFI as a non-secure physical
instance, FFA_ID_GET always returns a VM ID of zero. Therefore,
providing a non-zero VM ID in this context is unnecessary and may be
invalid.
Update ArmFfaLib to always set w1 (VM ID / partition ID) to zero when
invoking FFA_RX_RELEASE and FFA_RXTX_UNMAP, ensuring compliance with
the FFA specification.
Signed-off-by: Shenghu Liu <shenghul@qti.qualcomm.com>
When multiple DXE drivers link DxeCapsuleLib, each driver's constructor
calls InitCapsuleVariable() which attempts to lock capsule-related
variables. The second instance fails with EFI_ALREADY_STARTED because
the policy is already registered, triggering a false ASSERT.
EFI_ALREADY_STARTED from RegisterBasicVariablePolicy means the variable
is already locked, which is the desired state. Treat it as success.
Signed-off-by: default avatarAnandh krishna U <anandhkrishnau@ami.com>
In PciSioSerialDxe driver, gEfiDevicePathProtocolGuid appears twice in
[Procotols] section. In PiSmmCore driver, gEfiSmmSxDispatch2ProtocolGuid
appears twice in [Procotols] section. In PiSmmIpl driver,
gEfiEventReadyToBootGuid appears twice in [Procotols] section. In
DxeCapsuleLib driver, gEfiCapsuleVendorGuid appears twice in [Guids]
section. The duplicate ones should be removed.
Signed-off-by: Qihang Gao <gaoqihang@loongson.cn>
Current ArmFfaLibGetVersion()'s arguments receive two arguments
-- major version and minor version.
However, This gives some impression treating major and minor version
of the ABI as two unrelated 16-bit variables as opposed to
the upper and lower 16-bits of a 32-bit version variable.
Therefore, change the arguments with whole version and
let user to get major/minor version via ARM_FFA_MAJOR/MINOR_VERSION_GET
macros.
Also, add some useful helper to check version compatibility and
mimimum require ABI version.
Continuous-integration-options: PatchCheck.ignore-multi-package
Suggested-by: Leif Lindholm <quic_llindhol@quicinc.com>
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
This patch adds ArmFfaConsoleDebugLib. A debug library that utilizes
FF-A Console Log API to print debug messages to the console.
This is useful in context of running the StandaloneMm payload
as a S-EL0 SP on top of SPMC where StandaloneMm isn't allowed to
access console device or no console device (e.x) Hafnium.
NOTE:
FFA_CONSOLE_LOG* could be used by secure partition only.
Signed-off-by: Mohamed Gamal Morsy <mohamed.morsy@arm.com>
There is no mapping ARM_FFA_RET_RETRY with EFI_STATUS but
it falls to EFI_UNSUPPORTED.
Map ARM_FFA_RET_RETRY with EFI_TIMEOUT so that don't make it fall to
EFI_UNSUPPORTED.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
commit aa02571 ("MdeModulePkg: Change EndofDxeEvent TPLs to TPL_CALLBACK")
changed EndOfDxeEvent TPLs from TPL_NOFIY to TPL_CALLBACK.
However this commit makes a boot failure on the FVP platform when FPDT
ACPI table generation is enabled:
[FirmwarePerformanceDxe] Error when lock variable FirmwarePerformance, Status = Write Protected
ASSERT_EFI_ERROR (Status = Write Protected)
ASSERT [FirmwarePerformanceDxe] FirmwarePerformanceDxe.c(405): !(((RETURN_STATUS)(Status)) >= 0x8000000000000000ULL)
Currently, EVT_NOTIFY_SIGNAL events are managed in FILO order,
as new events are inserted using InsertHeadList().
The sequence is as follows:
1. DxeCore initializes DxeCorePerformanceLib, whose constructor creates
an EndOfDxe event (gEfiEndOfDxeEventGroupGuid) with the
ReportFpdtRecordBuffer() callback.
2. MmCommunicationDxe (in ArmPkg) creates another EndOfDxe event to
notify StandaloneMm. This event is inserted ahead of the one created
in (1).
3. PlatformBootManagerBeforeConsole() signals EndOfDxe, which triggers
the event created in (2) first.
4. When the callback from (2) runs, StandaloneMm calls
LockVariablePolicy().
5. The callback from (1) is then invoked and attempts to update FPDT via
InstallFirmwarePerformanceDataTable(). During this process, it tries
to register a variable policy for the FirmwarePerformance variable.
However, since the Variable Policy interface was locked in (4), the
operation fails with EFI_WRITE_PROTECTED.
To resolve this issue, revert EndofDxeEvent TPLs to TPL_NOTIFY for FPDT.
Fixes: aa02571 ("MdeModulePkg: Change EndofDxeEvent TPLs to TPL_CALLBACK")
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Add the FF-A YIELD command to the FF-A library.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
EFI_HOB_TYPE_UNUSED is not unknown HOB type, instead of printing
"Unknown Hob type, ...", this patch updates code to also print
EFI_HOB_TYPE_UNUSED type HOB.
Signed-off-by: Star Zeng <star.zeng@intel.com>
The DebugPrintMarker function in PeiDxeDebugLibReportStatusCode/DebugLib.c
does not recognize the comma (`,`) flag in printf-style format strings.
When a driver uses format strings with thousand separators like "%,ld" to
format large numbers (e.g., 1234567 as "1,234,567"), the DebugPrintMarker
parser fails to recognize the comma flag and causes incorrect argument
extraction when building the BASE_LIST for status code reporting, leading
to unexpected or corrupted debug output in status code reports.
The change is to add the missing comma flag check to align with
BasePrintLib's format parsing logic, ensuring consistent behavior across
all print library implementations.
Signed-off-by: Ray Ni <ray.ni@intel.com>
The VaListToBaseList function in PeiDebugLibDebugPpi/DebugLib.c does not
recognize the comma (`,`) flag in printf-style format strings. When a
driver uses format strings with thousand separators like "%,ld" to format
large numbers (e.g., 1234567 as "1,234,567"), the VaListToBaseList parser
fails to recognize the comma flag and causes incorrect argument extraction
from the VA_LIST, leading to unexpected or corrupted debug output.
The change is to add a check for the comma character in the format string
parsing logic to align with BasePrintLib's format parsing logic,
ensuring consistent behavior across all print library implementations.
Signed-off-by: Ray Ni <ray.ni@intel.com>
Replace traditional `#ifndef`/`#define`/`#endif` include guards with
`#pragma` once.
`#pragma once` is a widely supported preprocessor directive that
prevents header files from being included multiple times. It is
supported by all toolchains used to build edk2: GCC, Clang/LLVM, and
MSVC.
Compared to macro-based include guards, `#pragma once`:
- Eliminates the risk of macro name collisions or copy/paste errors
where two headers inadvertently use the same guard macro.
- Eliminate inconsistency in the way include guard macros are named
(e.g., some files use `__FILE_H__`, others use `FILE_H_`, etc.).
- Reduces boilerplate (three lines replaced by one).
- Avoids polluting the macro namespace with guard symbols.
- Can improve build times as the preprocessor can skip re-opening the
file entirely, rather than re-reading it to find the matching
`#endif` ("multiple-include optimization").
- Note that some compilers may already optimize traditional include
guards, by recognzining the idiomatic pattern.
This change is made acknowledging that overall portability of the
code will technically be reduced, as `#pragma once` is not part of the
C/C++ standards.
However, this is considered acceptable given:
1. edk2 already defines a subset of supported compilers in
BaseTools/Conf/tools_def.template, all of which have supported
`#pragma once` for over two decades.
2. There have been concerns raised to the project about inconsistent
include guard naming and potential macro collisions.
Approximate compiler support dates:
- MSVC: Supported since Visual C++ 4.2 (1996)
- GCC: Supported since 3.4 (2004)
(http://gnu.ist.utl.pt/software/gcc/gcc-3.4/changes.html)
- Clang (LLVM based): Since initial release in 2007
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Add Unmap callback for when PEI and SEC need to invalidate the
Rx/Tx buffer HOB on a call to Unmap.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Cleaned various comments and debug messages as well as
headers to either fix typos or for readability.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Replaced all instances of PcdGet64 (PcdFfaTxRxPageCount) *
EFI_PAGE_SIZE, with EFI_PAGES_TO_SIZE macro.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Removed the global variables in ArmFfaSecRxTxMap. Rx/Tx
buffer HOB is now created within the Map function rather
than in the constructor of ArmFfaSecLib. This allows for
the use of the HOB to find the Rx/Tx buffer information.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Removed global variables in ArmFfaCommon. Moved the globals to
locals in each phase's ArmFfaLib implementation. SEC and PEI
will query when necessary to avoid setting globals when memory
is unavailable.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Added ArmFfaLibIsFfaSupported to ArmFfaCommon to allow for
queries of FF-A support outside of ArmFfaCommonInit.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
MdeModulePkg/Library/VarCheckHiiLib/VarCheckHiiGenFromFv.c: In function ‘ParseFv’:
MdeModulePkg/Library/VarCheckHiiLib/VarCheckHiiGenFromFv.c:263:34: error: variable ‘FfsIndex’ set but not used [-Werror=unused-but-set-variable=]
263 | UINTN FfsIndex;
| ^~~~~~~~
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
MdeModulePkg/Library/CustomizedDisplayLib/CustomizedDisplayLib.c: In function ‘CreateDialog’:
MdeModulePkg/Library/CustomizedDisplayLib/CustomizedDisplayLib.c:435:18: error: variable ‘Count’ set but not used [-Werror=unused-but-set-variable=]
435 | UINTN Count;
| ^~~~~
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit adds a host based unit test for DxeReportStatusCodeLib
that ensures that the platform cannot invert the TPL on an initial
call to ReportStatusCode functionality.
Signed-off-by: Joey Vagedes <joey.vagedes@gmail.com>
This commit stops the library from querying the protocol database for
the status code protocol at the time of library function use. This logic
can result in a TPL inversion if the protocol has not yet been cached
and the caller is calling the library function when the TPL is higher
then TPL_NOTIFY.
Instead, the protocol is now located during the constructor of the
library. If the protocol is not found, then an on-protocol install event
is registered which will cache the protocol. A destructor is also added
to close the event in the scenario that the driver is unloaded before
the protocol is installed.
Signed-off-by: Joey Vagedes <joey.vagedes@gmail.com>
This commit stops the library from querying the protocol database for
the status code protocol at the time of library function use. This logic
can result in a TPL inversion if the protocol has not yet been cached
and the caller is calling the library function when the TPL is higher
then TPL_NOTIFY.
Instead, the protocol is now located during the constructor of the
library. If the protocol is not found, then an on-protocol install event
is registered which will cache the protocol. A destructor is also added
to close the event in the scenario that the driver is unloaded before
the protocol is installed.
Signed-off-by: Joey Vagedes <joey.vagedes@gmail.com>
