In case EntryPointStructure does not exist yet use a length of zero instead of
skipping the check altogether. Fixes a heap overflow in the following code
flow in case the first smbios table installed is larger than
SMBIOS_TABLE_MAX_LENGTH.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
In some VS22 versions, these code patterns (assiging the scalar in
a loop) have been found to be converted into calls to the `memcpy`
intrinsic. This change updates them to use CopyMem to avoid the
potential error.
Previous:
- MSVC version: 14.31.31103
New:
- MSVC version: 14.32.31326
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Pass zero to the wait callback after a hotkey is detected so the
platform can clear the timeout UI immediately.
Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
When the primary GPT is invalid, PartitionInstallGptChildHandles()
restores it from the backup and re-validates it. Both the restore write
and the re-validation can fail (e.g. write-protected media, or a backup
AlternateLBA pointing beyond the device), yet the existing code only logs
the failure and parses partitions from a known-invalid PrimaryHeader.
Abort GPT processing when either the restore or the validation fails, so
partitions are only ever parsed from a validated primary GPT. The backup
recovery branch is left unchanged, as the primary is already validated.
A device with an unrecoverable primary GPT now installs no child handles
instead of using an invalid header. This keeps the table PartitionDxe uses
in sync with the one DxeTpm2MeasureBootLib measures into PCR[5].
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
As reported in CVE-2024-13745 via oss-sec, DxeTpm2MeasureBootLib can
measure a partition table that differs from the one parsed by the
PartitionDxe driver.
To address this, the more complete GPT parsing logic from PartitionDxe
is extracted into a standalone GptLib library so it can be
shared between PartitionDxe and DxeTpm2MeasureBootLib. This ensures
that the exact same partition table measured into PCR[5] is the one
parsed and used by the system. PartitionDxe behavior is unchanged.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
The debug message introduced by PR#12282 was printed at DEBUG_INFO level,
which caused screen corruption in the UEFI Shell when running in DEBUG
mode. Change the print level to DEBUG_VERBOSE to keep the Shell output
clean during normal DEBUG builds while still retaining the message for
verbose debugging scenarios.
Signed-off-by: Qihang Gao <gaoqihang@loongson.cn>
Cc: Evgenii Shatokhin <euspectre@gmail.com>
Prevent recursive invocation of the PEI Report Status Code (RSC) Router that can lead
to system hang or unexpected re-entrancy behavior during early boot. The defect
was observed when PEI modules reported status codes while the router was already
processing a previous request.
This patch aligns PEI behavior with the robust RSC routing mechanisms already used
in DXE and Runtime phases by adding a lightweight recursion guard to the PEI router.
This ensures consistent behavior across boot stages and improves early-boot
stability.
Signed-off-by: Jared Pan <jared.pan@dell.com>
According to INF specification, UEFI_DRIVER and UEFI_APPLICATION
cannot have Depex section. So remove it.
Signed-off-by: Qihang Gao <gaoqihang@loongson.cn>
For historical reasons, VariableRuntimeDxe performs virtual address
conversion on the FVB protocol member pointers of the protocol instance
that backs the EFI variable store. However, the driver that produces the
actual instance should be doing this, as it is the owner and provides
the actual implementation of those methods.
Unfortunately, we cannot simply remove this: existing FVB drivers may
rely on the Variable driver performing the conversion on their behalf.
So the Variable driver should convert the pointers only when the FVB
producer has not already done so.
The SetVirtualAddressMap event can be delivered in arbitrary order, so
we cannot rely on whether this driver converts its pointers before or
after the FVB protocol owner receives the event.
Fix this by recording the converted addresses in a shadow FVB protocol
rather than converting the live pointers directly. On the first runtime
variable access, check whether the FVB producer has performed its own
conversion; if not, swap in the shadow copy's converted pointers.
Without this fix, platforms where the FVB producer performs its own
SetVirtualAddressMap conversion (e.g., OP-TEE StandaloneMm-backed
EepromFvb on NXP LX2160A) suffer double pointer conversion, causing
runtime variable access to crash.
Signed-off-by: Ard Biesheuvel <ardb+tianocore@kernel.org>
Tested-by: Liz Fong-Jones <lizf@honeycomb.io>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
It's not a proper approach when dealing the return string of
HiiGetString function with ASSERT on REALEASE or NOOPT mode.
This patch add a check for NewString before calling
RegisterHotKey() for the case.
Signed-off-by: Qihang Gao <gaoqihang@loongson.cn>
The return value of HiiGetString function should be freed by using
FreePool(). By the way, add a check for NewString before calling
RegisterHotKey().
Signed-off-by: Qihang Gao <gaoqihang@loongson.cn>
Add support for generation of HEST table with the help of a remote
RAS agent. The HEST table is generated but the error descriptors
(in GHESv2 or other platform specific format) are fetched from the
RAS agent.
Signed-off-by: Himanshu Chauhan <himanshu.chauhan@oss.qualcomm.com>
Fixes: #12281
Currently, TerminalConInRegisterKeyNotify() allows registering a
notification with nonzero KeyShiftState or KeyToggleState. However,
IsKeyRegistered() ignores these when checking if the keys match.
As a result, some firmware component may successfully register a
notification for, say, RCtrl+n, but the notification function will be
called each time the user presses 'n', which is wrong.
Shift state and toggle state are not transferred via a serial line, so
the notification functions for the keys with nonzero KeyShiftState or
KeyToggleState will never trigger in this case.
TerminalConInRegisterKeyNotify() could reject such notifications but it is
unclear if it could break the existing UEFI components.
Instead, this patch adds a debug message when someone tries to register a
notification with nonzero states, it also updates IsKeyRegistered() to take
KeyShiftState and KeyToggleState into account.
This way, IsKeyRegistered() will treat the notifications for 'n' and
'RCtrl+n' as different ones. So, the callback function for 'RCtrl+n' will
not be called when the user presses 'n'.
As it is not prohibited to set only EFI_SHIFT_STATE_VALID flag in the shift
state (leaving the remaining bits zeroed), IsKeyRegistered() ignores
EFI_SHIFT_STATE_VALID.
Signed-off-by: Evgenii Shatokhin <euspectre@gmail.com>
Fix spelling error in definition in Udf.h. Update
consumer in MdeModulePkg.
A temporary backward-compatible alias is provided
for the old misspelled enum name.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
This change updates `VariableSmmRuntimeDxe` to correctly size its runtime
communication buffer when `EFI_MM_COMMUNICATION3_PROTOCOL` is present.
In the current flow, the runtime variable path may use MM communication
v3, but the input size is first validated against the global variable
`mVariableBufferPayloadSize`. The size is then validated a second time
during communication buffer initialization using the v3 header size,
which results in `GetVariable` calls with sufficiently large buffers
consistently failing.
This update makes the allocation logic v3‑aware so that the runtime
variable communication buffer matches the header format actually in use,
avoiding failures for larger variable transactions.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
commit aa02571 ("MdeModulePkg: Change EndofDxeEvent TPLs to TPL_CALLBACK")
changed EndOfDxeEvent TPLs from TPL_NOFIY to TPL_CALLBACK.
However this commit makes a boot failure on the FVP platform when FPDT
ACPI table generation is enabled:
[FirmwarePerformanceDxe] Error when lock variable FirmwarePerformance, Status = Write Protected
ASSERT_EFI_ERROR (Status = Write Protected)
ASSERT [FirmwarePerformanceDxe] FirmwarePerformanceDxe.c(405): !(((RETURN_STATUS)(Status)) >= 0x8000000000000000ULL)
Currently, EVT_NOTIFY_SIGNAL events are managed in FILO order,
as new events are inserted using InsertHeadList().
The sequence is as follows:
1. DxeCore initializes DxeCorePerformanceLib, whose constructor creates
an EndOfDxe event (gEfiEndOfDxeEventGroupGuid) with the
ReportFpdtRecordBuffer() callback.
2. MmCommunicationDxe (in ArmPkg) creates another EndOfDxe event to
notify StandaloneMm. This event is inserted ahead of the one created
in (1).
3. PlatformBootManagerBeforeConsole() signals EndOfDxe, which triggers
the event created in (2) first.
4. When the callback from (2) runs, StandaloneMm calls
LockVariablePolicy().
5. The callback from (1) is then invoked and attempts to update FPDT via
InstallFirmwarePerformanceDataTable(). During this process, it tries
to register a variable policy for the FirmwarePerformance variable.
However, since the Variable Policy interface was locked in (4), the
operation fails with EFI_WRITE_PROTECTED.
To resolve this issue, revert EndofDxeEvent TPLs to TPL_NOTIFY for FPDT.
Fixes: aa02571 ("MdeModulePkg: Change EndofDxeEvent TPLs to TPL_CALLBACK")
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
When QEMU is launched with -nographic, the Backspace key (DEL, 0x7f)
doesn't work in the UEFI Shell because the VT-UTF8 terminal type
interprets DEL as SCAN_DELETE instead of CHAR_BACKSPACE.
Modern terminal emulators (xterm, gnome-terminal, etc.) send DEL (0x7f)
for Backspace and are UTF-8 compatible. This patch updates
TerminalTypeVtUtf8 to interpret DEL as CHAR_BACKSPACE, consistent with
how TerminalTypeTtyTerm already handles it.
This approach preserves VT-UTF8 as the default terminal type (which
supports full Unicode), while fixing the Backspace functionality for
modern terminal environments.
Signed-off-by: Damien Chen <inkfan130924783@gmail.com>
The current PreferMode selection logic requires both Columns AND Rows to
be strictly greater (>) than the current maximum, which fails when a
text mode has the same column count but more rows.
Example failure case (1920x1200 display):
- Mode 5: 240x56 - Selected as PreferMode
- Mode 6: 240x63 - Rejected because 240 is not > 240
This mismatch causes ConsplitterSetConsoleOutMode to later request
Mode 6, triggering an unnecessary text mode change and clearing the
screen during console init.
Root Cause:
GraphicsConsole used: if ((Col > Max) && (Row > Max))
This fails when only rows increase while columns stay the same.
Solution:
Change to: if ((Col >= Max) && (Row >= Max))
This aligns with ConSplitter mode selection logic and correctly selects
the mode with the highest column and row counts.
After fix (1920x1200 display):
- Mode 5: 240x56
- Mode 6: 240x63 - Correctly selected as PreferMode
This ensures GraphicsConsole and ConSplitter match on the preferred mode
preventing unnecessary screen clears during console initialization.
Signed-off-by: Ashraf Ali S <ashraf.ali.s@intel.com>
Replace traditional `#ifndef`/`#define`/`#endif` include guards with
`#pragma` once.
`#pragma once` is a widely supported preprocessor directive that
prevents header files from being included multiple times. It is
supported by all toolchains used to build edk2: GCC, Clang/LLVM, and
MSVC.
Compared to macro-based include guards, `#pragma once`:
- Eliminates the risk of macro name collisions or copy/paste errors
where two headers inadvertently use the same guard macro.
- Eliminate inconsistency in the way include guard macros are named
(e.g., some files use `__FILE_H__`, others use `FILE_H_`, etc.).
- Reduces boilerplate (three lines replaced by one).
- Avoids polluting the macro namespace with guard symbols.
- Can improve build times as the preprocessor can skip re-opening the
file entirely, rather than re-reading it to find the matching
`#endif` ("multiple-include optimization").
- Note that some compilers may already optimize traditional include
guards, by recognzining the idiomatic pattern.
This change is made acknowledging that overall portability of the
code will technically be reduced, as `#pragma once` is not part of the
C/C++ standards.
However, this is considered acceptable given:
1. edk2 already defines a subset of supported compilers in
BaseTools/Conf/tools_def.template, all of which have supported
`#pragma once` for over two decades.
2. There have been concerns raised to the project about inconsistent
include guard naming and potential macro collisions.
Approximate compiler support dates:
- MSVC: Supported since Visual C++ 4.2 (1996)
- GCC: Supported since 3.4 (2004)
(http://gnu.ist.utl.pt/software/gcc/gcc-3.4/changes.html)
- Clang (LLVM based): Since initial release in 2007
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
This commit removes an wrong goto statement which may cause DXE_ASSERT!
`ConfigRequest` example: `&NameValueVar0&NameValueVar1&NameValueVar2`.
When `*Progress` is `&NameValueVar2`, code will run to `goto Done;`,
then return NULL.
Signed-off-by: Yang Gang <yanggang@byosoft.com.cn>
When using MM communicate v3 to fetch variable, the header calculation
was incorrect, causing the variable driver on the secure environment to
have random behavior.
This change refactored the original routine by following the current
DXE instance (mostly).
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
`if (CurrentForm != NULL)` and
`if (InScopeDisable && (CurrentForm == NULL))`conflict.
`if (CurrentForm != NULL)` should be `if (CurrentExpression != NULL)`.
Signed-off-by: Yang Gang <yanggang@byosoft.com.cn>
This PR introduces a new feature to enable infinite boot retries based on a newly created PCD.
When true, the system will continuously loop over all boot options.
PCD default is FALSE to match existing functionality.
This change is tested on QEMU based virtual platforms and physical
platforms.
This change is useful for certain server cases. Infinite retries allows
a server to continuously attempt boot in case of network failure and
recovery, and for such attempts to be accurately recorded in the TCG
logs.
Co-authored-by: Kun Qin <kun.qin@microsoft.com>
Co-authored-by: Aaron Pop <aaron.pop@microsoft.com>
Co-authored-by: Michael Kubacki <michael.kubacki@microsoft.com>
Signed-off-by: Sherry Fan <sherryfan@microsoft.com>
MdeModulePkg/Universal/CapsuleOnDiskLoadPei/CapsuleOnDiskLoadPei.c:176:11: error: variable ‘Index’ set but not used [-Werror=unused-but-set-variable=]
176 | UINTN Index;
| ^~~~~
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c: In function ‘CreateSharedPopUp’:
MdeModulePkg/Universal/DisplayEngineDxe/ProcessOptions.c:590:11: error: variable ‘Count’ set but not used [-Werror=unused-but-set-variable=]
590 | UINTN Count;
| ^~~~~
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
MdeModulePkg/Universal/SmbiosMeasurementDxe/SmbiosMeasurementDxe.c: In function ‘GetSmbiosStringById’:
MdeModulePkg/Universal/SmbiosMeasurementDxe/SmbiosMeasurementDxe.c:221:10: error: variable ‘Size’ set but not used [-Werror=unused-but-set-variable=]
221 | UINTN Size;
| ^~~~
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
The comment for the Buffer parameter incorrectly said
"then no the size" instead of "then the size".
This patch fixes the typo only; no functional changes.
Reported-by: Yao Zi <ziyao@disroot.org>
Signed-off-by: Dongyan Qian <qiandongyan@loongson.cn>
The RSDP table come from ACPI HOB which may no store in the
EfiACPIReclaimMemory-type memory. Therefore need to reserve an
EfiACPIReclaimMemory-type memory for it.
Signed-off-by: George Liao <george.liao@intel.com>
In StandaloneMM mode, IsStatusCodeUsingSerialPort is expecting to
find gMmStatusCodeUseSerialHobGuid, and will assert if it is not found.
Change the logic so that if the Guided Hob is not found, to let
the function return FALSE and progress to proceed.
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
In the current code, the HiiPackageList will be created and destroyed
each time the form is closed, which is unneccessary. This patch makes a
function that produces the origin HiiPackageList. The function will only
be called when the driver is initialized and the HiiPackageList will be
directly updated in DriverHealthManagerCleanDynamicString function. This
approach can avoid the unneccessary creation and destruction of the
HiiPackageList.
Signed-off-by: Qihang Gao <gaoqihang@loongson.cn>
The DriverHealthManagerStrings.uni file defines both English and French
languages, resulting in the generation of two Unicode string packages: the
first for English and the second for French. When cleaning the dynamic
strings from the HII package list, the pointer which should point to
dynamic string package incorrectly points to the static French package,
causing it to be unexpectedly cleaned.
This patch fixes the pointer of EFI_HII_PACKAGE_END type PackageHeader.
This way, there is no need for concern regarding the number of language
packages available.
Signed-off-by: Qihang Gao <gaoqihang@loongson.cn>
Correct a typographical error in the DebugServicePei module by renaming
the function and entry point from DebugSerivceInitialize to
DebugServiceInitialize in both the C source file and the INF
configuration file.
Signed-off-by: Jeremy Compostella <jeremy.compostella@intel.com>
11687 introduced a null check and break on the orderedlist
carriage return input handler. The carriage return is a special
case that should result in exiting the menu, but the null check
that prevented null pointer access changed the logic to continue
in the input wait loop.
Removed the break while still preventing null variable access
and allow function to exit.
11689 introduced checks on the call to EfiBootManagerGetLoadOptions,
but this encounterd a problem with the way that a default
platform recovery option was created.
The default platform recovery option was attempting to go through
existing recovery options to get the next available recovery option
number. The introduced null check short circuited these additional
calls and resulted in the platform recovery option not being created.
Modified the logic to no longer attempt to access recovery options
when non exist, and still create the default platform recovery option.
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
11686, 11687, 11688, 11689 included some inverted conditionals
during the refactor. While the system booted, some behavior
was incorrect based on the inverted conditionals.
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
Address the build regressions, introduced in #11724, #11688, #11686#11685.
These build regressions are for uninitialized variables before use.
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
Since VariableLock compromises security in the SMM environment,
it is deprecated. Used VariablePolicy instead for stronger and
more flexible UEFI variable protection.
Ref: [acd66e4]
Cc: Sachin Ganesh <sachinganesh@ami.com>
Signed-off-by: Sathya Ravichandran <sathyar@ami.com>
Since VariableLock compromises security in the SMM environment,
it is deprecated. Used VariablePolicy instead for stronger and
more flexible UEFI variable protection.
Ref: [acd66e4]
Cc: Sachin Ganesh <sachinganesh@ami.com>
Signed-off-by: Sathya Ravichandran <sathyar@ami.com>
Since VariableLock compromises security in the SMM environment,
it is deprecated. Used VariablePolicy instead for stronger and
more flexible UEFI variable protection.
Ref: [acd66e4]
Cc: Sachin Ganesh <sachinganesh@ami.com>
Signed-off-by: Sathya Ravichandran <sathyar@ami.com>
https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Why is this casting instead of just changing the type?
Its because the compiler for IA32 will optimize by
inserting a 64bit multiply to dereference into the
array. This will be turned into an unresoled _allmul
that is trying to call into the msvc runtime library,
which doesn't exist.
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
Co-authored-by: Michael Kubacki <michael.kubacki@microsoft.com>
Co-authored-by: Taylor Beebe <tabeebe@microsoft.com>
Co-authored-by: pohanch <125842322+pohanch@users.noreply.github.com>
Co-authored-by: kenlautner <85201046+kenlautner@users.noreply.github.com>
Co-authored-by: Oliver Smith-Denny <osde@linux.microsoft.com>
Co-authored-by: Sean Brogan <sean.brogan@microsoft.com>
Co-authored-by: Aaron <aaronpop@microsoft>
Bds will get the List of Boot Options and attempt to boot.
If there were no valid load options, the system could
infinitely be stuck in the attempt boot loop.
Add NULL checks to prevent a protentional infinite
boot retry loop.
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
