Update SmbiosSmcLib to use ArmSmcccSocIdLib for retrieving the JEP106
identification code and SoC revision.
Remove the duplicated SMCCC feature detection and SoC ID calls while
retaining the SMBIOS-specific formatting of the Type 4 Processor ID.
Signed-off-by: Varshit Pandya <Varshit.Pandya@arm.com>
Add ArmSmcccSocIdLib to provide a shared interface for checking support
for the SMCCC Architecture SoC ID service and retrieving the JEP106
identification code and SoC revision.
Move the existing SMCCC SoC ID handling out of ProcessorSubClassDxe and
update the driver to use the new library. Continue to use the MIDR value
for the SMBIOS Processor ID when the SMCCC SoC ID service is unavailable.
This allows other SMBIOS implementations to reuse the SMCCC handling
without duplicating it or depending on the legacy ProcessorSubClassDxe
driver.
Signed-off-by: Varshit Pandya <Varshit.Pandya@arm.com>
Fixing all markdown lint errors found by running markdownlint-cli.
Verified that rendering still shows valid information.
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
In MmiHandlerRegister(), the MmiHandler structure is currently
allocated before looking up the target MmiEntry. If the lookup
fails, the function returns an error but the allocated MmiHandler
is never freed, causing a memory leak.
This patch moves the allocation of MmiHandler and its initialization
to after the MmiEntry lookup and validation. This ensures that memory
is only allocated when the operation can succeed, eliminating the need
for a FreePool() on the error path and simplifying the error handling
logic.
Signed-off-by: Qihang Gao <gaoqihang@loongson.cn>
Suggested-by: Ray Ni <ray.ni@intel.com>
Adds an optional flag that copies the GNU build-id note from the input
ELF file into the output PE/COFF firmware image as a dedicated ".bldid"
section. The build ID is emitted by the linker as a unique fingerprint
of the binary and allows custom post-build and debugging tools to
reliably match a firmware image against its corresponding unstripped
ELF and debug symbols, without relying on file names, timestamps, or
build paths.
This notable opts to use a non-standard section name ".bldid" to store
the build ID. This approach was chosen to keep genfw and the parsers simple
since the full "build-id" name would require redirecting the section name.
While this breaks from standard conventions, this is not impactful since
GenFW is already creating a non-standard artifact for the PE image with
the associated ELF symbol file.
Signed-off-by: Chris Fernald <chfernal@microsoft.com>
Add a DynamicTables SMBIOS generator for the Additional Information
(Type 40) structure.
SMBIOS Type 40 provides additional information for fields in other
SMBIOS structures. Each Type 40 entry references an existing SMBIOS
record by handle and offset, provides an optional entry string, and
carries a supplemental field value.
The generator consumes one or more top-level CM objects, each referencing
a list of Additional Information entries. Each entry provides:
- the CM object token of the referenced SMBIOS structure,
- the referenced table generator ID,
- the offset of the referenced field,
- an optional entry string,
- a token to a typed Additional Information Value object.
Example platform CM object layout:
CM_ARCH_COMMON_ADDITIONAL_INFORMATION AdditionalInformation[] = {
{
REFERENCE_TOKEN (AdditionalInformation[0]),
REFERENCE_TOKEN (AdditionalInformationEntry[0])
}
};
CM_ARCH_COMMON_ADDITIONAL_INFORMATION_ENTRY
AdditionalInformationEntry[] = {
{
REFERENCE_TOKEN (MemoryDeviceInfo[0]),
CREATE_STD_SMBIOS_TABLE_GEN_ID (EStdSmbiosTableIdType17),
OFFSET_OF (SMBIOS_TABLE_TYPE17, MemoryType),
"DIMM0 memory type",
REFERENCE_TOKEN (AdditionalInformationValue[0])
}
};
CM_ARCH_COMMON_ADDITIONAL_INFORMATION_VALUE
AdditionalInformationValue[] = {
{
sizeof (UINT8),
{
MemoryTypeDram
}
}
};
The generator resolves referenced SMBIOS handles using CM object tokens
and table generator IDs. It validates the typed value objects, individual
entry lengths, and aggregate formatted record size. The maximum accepted
value length is controlled by PcdMaxAdditionalInformationValue.
Build the variable-length Type 40 formatted area and append the entry
strings to the SMBIOS string area.
Signed-off-by: Varshit Pandya <varshit.pandya@arm.com>
Add the Configuration Manager objects required to describe SMBIOS
Additional Information (Type 40) structures.
The top-level object references a list of Additional Information entries.
Each entry identifies a field in an existing SMBIOS structure and
references a typed value object containing the additional data.
Define the maximum value buffer size from the SMBIOS Type 40 formatted
length limit and add parsers for the new CM objects.
Signed-off-by: Varshit Pandya <varshit.pandya@arm.com>
OVMF already supports MemDebugLogLib for capturing firmware debug
output in a runtime memory buffer. Align the TDX peiless boot path
with OVMF by integrating the same library, so that TDX guests can
use memory-based debug logging.
In PeilessStartupLib, allocate a runtime buffer for the debug log
during PeilessStartup() and copy any early SEC-phase logs from
the pre-allocated FDF region into it.
Register the early debug log memory region in the TDX metadata as
TEMP_MEM so the TDX module accepts it during guest initialization.
Move PlatformDxe/Platform.inf from NCCFV to DXEFV because it
exposes the memory debug log HOB to the guest.
Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
The Null instance of MemDebugLogLib only provides MemDebugLogWrite(),
MemDebugLogPages(), and MemDebugLogEnabled(). Any module that
references MemDebugLogInit() or MemDebugLogCopy() cannot link against
the Null instance, forcing the feature to be gated at the build-system
level rather than at runtime.
Add no-op stubs for MemDebugLogInit() and MemDebugLogCopy().
This will be used by the following commit to add memory debug log
support in TDX.
Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
Some SuperSpeed-capable devices may fall back to High-Speed
mode and cause subsequent commands to fail.
[Suggested Solution]
Check the BOS descriptor to verify SuperSpeed support and
trigger a port reset if needed to re-enumerate the device
properly.
Signed-off-by: Marlboro Chuang <marlboro.chuang@dell.com>
Signed-off-by: Jared Pan <jared.pan@dell.com>
[Suggested Solution]
Add the BOS descriptor structure and definition.
Signed-off-by: Marlboro Chuang <marlboro.chuang@dell.com>
Signed-off-by: Jared Pan <jared.pan@dell.com>
Move SMBIOS_MAX_STRING_SIZE and CFMWS_MAX_INTERLEAVE_WAYS to the
common definitions near the top of ArchCommonNameSpaceObjects.h.
Document that SMBIOS_MAX_STRING_SIZE is an implementation-defined
Configuration Manager storage limit, including the terminating NULL,
rather than an SMBIOS specification limit. Also distinguish it from
the legacy SMBIOS_STRING_MAX_LENGTH definition used for SMBIOS 2.6
MIF compatibility.
Signed-off-by: Varshit Pandya <varshit.pandya@arm.com>
Link VirtioMmioProbeLib to VirtioFdtDxe so that the Virtio MMIO
probe constructor maps the virtio-mmio ranges before the transport
driver accesses the device MMIO regions.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Introduce a Virtio MMIO probe library that discovers virtio-mmio
nodes from the FDT and maps their MMIO ranges before the virtio
transport driver creates virtio devices and accesses the device
MMIO regions.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Refactor the memory mapping configuration for Kvmtool Guest VM to
only setup the memory map for the System Memory, FV and the Serial
Port.
The memory mappings for he remaining devices are expected to be
configured by the respective drivers, this could be done as part
of the DXE drivers itself or using a Probe Library that adds the
device memory regions to the memory map.
The only special cases that remain are the System Memory, FV and
the Serial Port for which the memory mappings are created by the
KvmtoolVirtMemInfoLib. The memory mapping for the Serial port
is added as it is utilised for logging before the DXE driver
is loaded.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Fdt16550SerialPortHookLib does not provide a constructor and
expects SerialPortLib to call PlatformHookSerialPortInitialize().
Add an early FDT 16550 serial port probe library that invokes the
platform serial hook from its constructor. This allows the FDT to be
parsed early, the 16550 serial port base address to be extracted, and
the serial port PCD to be populated. It is needed during early boot so
the serial port memory map can be set up using the populated serial
port PCD.
The probe library wraps the hook call in its constructor instead of
reusing PlatformHookSerialPortInitialize() directly. This avoids
duplicate global definitions in modules that already link against the
PlatformHookLib instance.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Map the PCI MMIO32 and MMIO64 windows into the GCD memory
map after parsing the DT ranges property.
This makes the PCI memory apertures available as MMIO
regions.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Replace the local GCD MMIO mapping helper with MapMmioMemory() when
mapping the PCI ECAM region and the translated I/O MMIO window.
This keeps the FDT PCI host bridge code aligned with the common MMIO
mapping helper and avoids duplicating AddMemorySpace() and
SetMemorySpaceAttributes() handling.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Replace the local RTC MMIO mapping sequence with MapMmioMemory(), while
keeping the explicit GCD allocation so the RTC page remains owned by the
driver image handle.
This reuses the common MMIO mapping path for GCD attributes.
Also update the incorrect error code documentation to reflect that
EFI_NOT_FOUND can be returned if the GCD space is not found and
drop the depex on gEfiCpuArchProtocolGuid as this is now done
by MapMmioLib which is where the Cpu Arch protocol is utilised.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Discover the GIC register ranges from the device tree and map them into
the GCD memory map before ArmGicDxe configures the interrupt controller.
Map the distributor and redistributor ranges for GICv3, and the
distributor and CPU interface ranges for GICv2, using MapMmioLib.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Add the MapMmioLib instance to the ArmVirt DXE_DRIVER library class
list so DXE drivers can map MMIO regions through the common helper.
Also add the runtime-driver library class mapping in ArmVirt.dsc.inc
so that runtime modules like KvmtoolRtcFdtClientLib can use
MapMmioLib.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Allow MapMmioLib to be consumed by DXE_RUNTIME_DRIVER modules.
MapMmioMemory() depends on DXE services, so it cannot map new
ranges after ExitBootServices(). Return EFI_ACCESS_DENIED when
called at runtime.
This allows runtime drivers such as
ArmVirtPkg/Library/KvmtoolRtcFdtClientLib to use MapMmioLib for
boot-time MMIO setup.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Introduce MapMmioLib to add MMIO regions to the GCD memory map.
MapMmioMemory() normalizes the requested range to page boundaries, adds
missing MMIO descriptors, and updates attributes for new and existing MMIO
descriptors. Existing descriptors of any other type are reported as
conflicts.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
TPIDR_EL0 is used to hold the PrePi HOB list pointer, but its reset
value is unknown. Some early boot paths can call GetHobList() before
PrePiMain() creates and installs the HOB list.
Clear TPIDR_EL0 at the SEC entry point so those early lookups see NULL
rather than an invalid pointer.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Created SLH-DSA API functions to configure public and private keys for
SLH-DSA algorithm. This will allow users to sign and verify with
SLH-DSA. Unit tests were added to confirm operation of the API.
Signed-off-by: Michael G.A. Holland <michael.holland@intel.com>
USB devices whose configuration descriptor TotalLength exceeds 1024
bytes (e.g. IR cameras with large descriptor tables) previously hit
an EFI_DEVICE_ERROR hard-limit and failed to enumerate in PEI.
Replace the fixed array with a UINT8 * pointer and dynamically
allocate the exact amount of memory required via
PeiServicesAllocatePool() after the TotalLength is learned from the
initial 4-byte descriptor probe.
Signed-off-by: Damien Chen <damien.chen@dell.com>
This file was added as part of the new TianoCore EDK II breaking
changes process defined in the following RFC:
https://github.com/tianocore/tianocore-wiki.github.io/blob/main/rfc/text/0001-rfc-process.md
In order to make the file accurate for the upcoming edk2-stable202605
stable tag, this commit adds all breaking changes that have been
merged into the master branch since the last stable tag
(edk2-stable202605).
Because these changes did not follow the full process, they do not
have some required information like tracking issues.
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
This change adds dynamic initialization of gHobList in GetHobList() to handle cases where library constructors are executed before DxeHobListLibConstructor.
Issue:
On ARM platforms using ArmMmuBaseLib, the ArmMmuBaseLibConstructor calls GetFirstGuidHob() before xeHobListLibConstructor has initialized gHobList, causing an ASSERT.
Root Cause:
ArmMmuBaseLib's constructor uses HobLib functions, but UefiPayloadPkg's DxeHobLib assumes gHobList is already initialized by DxeHobListLib's constructor.
Solution:
Add the same lazy initialization pattern already used in MdePkg/Library/DxeHobLib, which dynamically retrieves the HOB list from the System Configuration Table if gHobList is NULL.
This change:
- Aligns behavior with MdePkg/Library/DxeHobLib
- Has no impact on existing functionality
- Improves robustness for ARM platforms
Signed-off-by: Jared Pan <jared.pan@dell.com>
The IsaStringInfoParser() routine currently sets the ISA string length
to PropSize + 1 and used AsciiStrCpyS() with PropSize + 1 as the
destination size. This could lead to incorrect length handling and
potential buffer issues.
Update the code to:
- Set IsaStringInfo.Length to PropSize (actual property size).
- Use MAX_ISA_STRING_LENGTH as the destination buffer size when
copying the ISA string.
- Check the return status of AsciiStrCpyS() and abort with an error
message if the copy fails.
This ensures safe string handling and prevents buffer overflow or
truncation when parsing ISA strings.
Reported-by: Zhenyu Liu <lzy00419@outlook.com>
Signed-off-by: Sunil V L <sunilvl@oss.qualcomm.com>
Commit 7f505d377b in 2024 added the
Type 4 field SocketType. Bump the default SMBIOS version to 3.8
in order for the larger table size to be valid.
Signed-off-by: Rebecca Cran <rebecca@bsdio.com>
The SMBIOS Type 4 field SocketType was added in commit
7f505d377b in 2024. This
caused the table size to be invalid when platforms specify
versions of SMBIOS before 3.8.
Update ProcessorSubClassDxe to handle fetching the string for the
socket type including calling into OemMiscLib to retrieve it.
Signed-off-by: Rebecca Cran <rebecca@bsdio.com>
Introduce a helper library that implements wrappers for the
cryptographic functionality required by the Arm Boot Sync
Blocks protocol implementation.
This library implements the following:
- Key Exchange: ECDH key using the ECC Curve-P384
- Key Derivation: SHA512 HMAC-based Extract-and-Expand HKDF
- Encryption/Decryption: AEAD AES-GCM authenticated encryption
and decryption
Also register the library class in ArmVirtPkg.dec, wire the
instance into the KvmTool guest firmware and update the CI YAML
file to add CryptoPkg/CryptoPkg.dec as an acceptable dependency.
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Per the Breaking Change and Release Process RFC, a non-removal breaking
change must add an entry to BREAKING-CHANGES.md in the PR that introduces
the change.
Add the entry for the new GptLib library class dependency under
edk2-stable202608, Source-Level Breaking Changes, Changes without Removal.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
Extend the GptLib host-based tests with negative cases that guard the
security hardening in PartitionValidGptTable(), PartitionCheckGptEntry()
and PartitionRestoreGptTable() against future regressions. These tests
exercise the shared parser, not the specific fix itself.
The new cases drive the parser with malformed GPT structures that an
attacker may present: bad signature/revision, header-size boundaries,
CRC corruption, MyLBA replay, zero/non-power-of-two entry sizes, LBA
multiplication overflow, out-of-range and overlapping entries, and
restore failure on write-protected media. The INF file header is
updated to note the added malformed coverage.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
Add the positive-path host-based tests for the shared GptLib parser
(extracted as part of the parser security hardening), ensuring the
tightened checks in PartitionValidGptTable(), PartitionCheckGptEntry()
and PartitionRestoreGptTable() do not falsely reject well-formed GPTs.
The tests run against an in-memory mock disk and cover accepted
primary/backup headers, boundary but legal header/entry sizes, correct
entry-status flagging on valid entries, and primary/backup restore
round-trips.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
TcgMeasureGptTable() reads the primary GPT header directly from LBA 1
and validates it with field checks only: no header CRC32, no
partition-entry-array CRC32 and no backup fallback. This is the same
divergence between the measured and the parsed partition table that
CVE-2024-13745 reports against DxeTpm2MeasureBootLib, and the tracking
issue lists both libraries as affected.
Mirror the DxeTpm2MeasureBootLib fix: select the GPT header to measure
via the shared GptLib parser. Validate the current primary GPT or, when
it is invalid, validate the backup and the header at its AlternateLBA.
Do not extend PCR[5] if no valid header can be selected.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
When the primary GPT is invalid, PartitionInstallGptChildHandles()
restores it from the backup and re-validates it. Both the restore write
and the re-validation can fail (e.g. write-protected media, or a backup
AlternateLBA pointing beyond the device), yet the existing code only logs
the failure and parses partitions from a known-invalid PrimaryHeader.
Abort GPT processing when either the restore or the validation fails, so
partitions are only ever parsed from a validated primary GPT. The backup
recovery branch is left unchanged, as the primary is already validated.
A device with an unrecoverable primary GPT now installs no child handles
instead of using an invalid header. This keeps the table PartitionDxe uses
in sync with the one DxeTpm2MeasureBootLib measures into PCR[5].
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
PartitionValidGptTable() checked the signature, header CRC32, MyLBA, the
entry-array CRC32 and the entry-array size overflow, but not several other
UEFI-mandated GPT header constraints. DxeTpm2MeasureBootLib used to enforce
these via Tpm2SanitizeEfiPartitionTableHeader(); once it switched to this
shared parser, the checks were lost on the path.
Also reject a header unless Header.Revision is GPT_HEADER_REVISION_V1,
HeaderSize is at least the 92-byte minimum, NumberOfPartitionEntries is
non-zero, SizeOfPartitionEntry is 128 * 2^n, and PartitionEntryLBA *
BlockSize cannot overflow. The "entries lie before FirstUsableLBA" rule is
intentionally omitted, as this routine also validates the backup header
whose entry array follows the usable region.
This restores the validation the measurement path lost and, because GptLib
is shared, tightens PartitionDxe the same way: malformed headers are now
rejected and the parse and measure paths stay identical.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
GptLib is a new library class consumed both by PartitionDxe (built by
essentially every platform) and by DxeTpm2MeasureBootLib. Any platform DSC
that builds either module must resolve the GptLib library class, otherwise
the build fails with "Instance of library class [GptLib] is not found".
Resolve GptLib in UefiPayloadPkg/UefiPayloadPkg.dsc, which builds
PartitionDxe.
Out-of-tree platforms consuming either module need the same one-line
resolution.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
GptLib is a new library class consumed both by PartitionDxe (built by
essentially every platform) and by DxeTpm2MeasureBootLib. Any platform DSC
that builds either module must resolve the GptLib library class, otherwise
the build fails with "Instance of library class [GptLib] is not found".
Resolve GptLib in each OVMF DSC. Every OVMF DSC builds PartitionDxe.
IntelTdx, LoongArchVirt and RiscVVirt additionally link
DxeTpm2MeasureBootLib directly; AmdSev, Bhyve, CloudHv, Microvm,
OvmfPkgX64 and OvmfPkgIa32X64 pull it in through
OvmfTpmSecurityStub.dsc.inc.
Out-of-tree platforms consuming either module need the same one-line
resolution.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
GptLib is a new library class consumed both by PartitionDxe (built by
essentially every platform) and by DxeTpm2MeasureBootLib. Any platform DSC
that builds either module must resolve the GptLib library class, otherwise
the build fails with "Instance of library class [GptLib] is not found".
Resolve GptLib in EmulatorPkg/EmulatorPkg.dsc, which builds PartitionDxe.
Out-of-tree platforms consuming either module need the same one-line
resolution.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
GptLib is a new library class consumed both by PartitionDxe (built by
essentially every platform) and by DxeTpm2MeasureBootLib. Any platform DSC
that builds either module must resolve the GptLib library class, otherwise
the build fails with "Instance of library class [GptLib] is not found".
Resolve GptLib once in ArmVirtPkg/ArmVirt.dsc.inc for the whole ArmVirt
family, whose platforms build PartitionDxe and, for ArmVirtQemu, link
DxeTpm2MeasureBootLib.
Out-of-tree platforms consuming either module need the same one-line
resolution.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
The previous commit introduced GptLib by extracting PartitionDxe's GPT
parsing and validation code. It provides a shared implementation for edk2
components that need to parse and validate GPT data consistently.
Update DxeTpm2MeasureBootLib to use GptLib when selecting on-disk GPT
data for measurement. Validate the current primary GPT or, when it is
invalid, validate the backup and the header at its AlternateLBA. Do not
extend PCR[5] if no valid header can be selected. The measurement therefore
uses GPT data read from disk at measurement time and applies the shared
parser and validation logic.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
As reported in CVE-2024-13745 via oss-sec, DxeTpm2MeasureBootLib can
measure a partition table that differs from the one parsed by the
PartitionDxe driver.
To address this, the more complete GPT parsing logic from PartitionDxe
is extracted into a standalone GptLib library so it can be
shared between PartitionDxe and DxeTpm2MeasureBootLib. This ensures
that the exact same partition table measured into PCR[5] is the one
parsed and used by the system. PartitionDxe behavior is unchanged.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
As the FFA function now returns the target ID properly, instead of
hardcoding the FFA_RUN target ID being the TPM SP, we use the parsed
ID to issue the FFA_RUN.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
As the FFA function now returns the target ID properly, instead of
hardcoding the FFA_RUN target ID being the STMM, we use the parsed
ID to issue the FFA_RUN.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
