https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
Extend the GptLib host-based tests with negative cases that guard the
security hardening in PartitionValidGptTable(), PartitionCheckGptEntry()
and PartitionRestoreGptTable() against future regressions. These tests
exercise the shared parser, not the specific fix itself.
The new cases drive the parser with malformed GPT structures that an
attacker may present: bad signature/revision, header-size boundaries,
CRC corruption, MyLBA replay, zero/non-power-of-two entry sizes, LBA
multiplication overflow, out-of-range and overlapping entries, and
restore failure on write-protected media. The INF file header is
updated to note the added malformed coverage.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
Add the positive-path host-based tests for the shared GptLib parser
(extracted as part of the parser security hardening), ensuring the
tightened checks in PartitionValidGptTable(), PartitionCheckGptEntry()
and PartitionRestoreGptTable() do not falsely reject well-formed GPTs.
The tests run against an in-memory mock disk and cover accepted
primary/backup headers, boundary but legal header/entry sizes, correct
entry-status flagging on valid entries, and primary/backup restore
round-trips.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
PartitionValidGptTable() checked the signature, header CRC32, MyLBA, the
entry-array CRC32 and the entry-array size overflow, but not several other
UEFI-mandated GPT header constraints. DxeTpm2MeasureBootLib used to enforce
these via Tpm2SanitizeEfiPartitionTableHeader(); once it switched to this
shared parser, the checks were lost on the path.
Also reject a header unless Header.Revision is GPT_HEADER_REVISION_V1,
HeaderSize is at least the 92-byte minimum, NumberOfPartitionEntries is
non-zero, SizeOfPartitionEntry is 128 * 2^n, and PartitionEntryLBA *
BlockSize cannot overflow. The "entries lie before FirstUsableLBA" rule is
intentionally omitted, as this routine also validates the backup header
whose entry array follows the usable region.
This restores the validation the measurement path lost and, because GptLib
is shared, tightens PartitionDxe the same way: malformed headers are now
rejected and the parse and measure paths stay identical.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
As reported in CVE-2024-13745 via oss-sec, DxeTpm2MeasureBootLib can
measure a partition table that differs from the one parsed by the
PartitionDxe driver.
To address this, the more complete GPT parsing logic from PartitionDxe
is extracted into a standalone GptLib library so it can be
shared between PartitionDxe and DxeTpm2MeasureBootLib. This ensures
that the exact same partition table measured into PCR[5] is the one
parsed and used by the system. PartitionDxe behavior is unchanged.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
The direct message arguments stripped off the header, making the
underlying FF-A function interface to lose information when it comes to
certain return code, i.e. FFA_YIELD and FFA_INTERRUPT.
This change adds back the header field for this purpose so that the
callers can decide how to act on the corresponding return codes.
It then populates the header field for this purpose in FFA direct
message functions so that the callers can decide how to act on the
corresponding return codes.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
Output parameter CurrentVersion of ArmFfaLibGetVersion() is
not optional parameter. That means it should return error
when CurrentVersion is NULL.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
According to the FFA specification, when FFA_RX_RELEASE or
FFA_RXTX_UNMAP is invoked from UEFI as a non-secure virtual instance,
the w1 register must be zero (MBZ). Supplying a non-zero value causes the
SPMC to return FFA_INVALID_PARAMETER.
When these interfaces are invoked from UEFI as a non-secure physical
instance, FFA_ID_GET always returns a VM ID of zero. Therefore,
providing a non-zero VM ID in this context is unnecessary and may be
invalid.
Update ArmFfaLib to always set w1 (VM ID / partition ID) to zero when
invoking FFA_RX_RELEASE and FFA_RXTX_UNMAP, ensuring compliance with
the FFA specification.
Signed-off-by: Shenghu Liu <shenghul@qti.qualcomm.com>
When multiple DXE drivers link DxeCapsuleLib, each driver's constructor
calls InitCapsuleVariable() which attempts to lock capsule-related
variables. The second instance fails with EFI_ALREADY_STARTED because
the policy is already registered, triggering a false ASSERT.
EFI_ALREADY_STARTED from RegisterBasicVariablePolicy means the variable
is already locked, which is the desired state. Treat it as success.
Signed-off-by: default avatarAnandh krishna U <anandhkrishnau@ami.com>
In PciSioSerialDxe driver, gEfiDevicePathProtocolGuid appears twice in
[Procotols] section. In PiSmmCore driver, gEfiSmmSxDispatch2ProtocolGuid
appears twice in [Procotols] section. In PiSmmIpl driver,
gEfiEventReadyToBootGuid appears twice in [Procotols] section. In
DxeCapsuleLib driver, gEfiCapsuleVendorGuid appears twice in [Guids]
section. The duplicate ones should be removed.
Signed-off-by: Qihang Gao <gaoqihang@loongson.cn>
Current ArmFfaLibGetVersion()'s arguments receive two arguments
-- major version and minor version.
However, This gives some impression treating major and minor version
of the ABI as two unrelated 16-bit variables as opposed to
the upper and lower 16-bits of a 32-bit version variable.
Therefore, change the arguments with whole version and
let user to get major/minor version via ARM_FFA_MAJOR/MINOR_VERSION_GET
macros.
Also, add some useful helper to check version compatibility and
mimimum require ABI version.
Continuous-integration-options: PatchCheck.ignore-multi-package
Suggested-by: Leif Lindholm <quic_llindhol@quicinc.com>
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
This patch adds ArmFfaConsoleDebugLib. A debug library that utilizes
FF-A Console Log API to print debug messages to the console.
This is useful in context of running the StandaloneMm payload
as a S-EL0 SP on top of SPMC where StandaloneMm isn't allowed to
access console device or no console device (e.x) Hafnium.
NOTE:
FFA_CONSOLE_LOG* could be used by secure partition only.
Signed-off-by: Mohamed Gamal Morsy <mohamed.morsy@arm.com>
There is no mapping ARM_FFA_RET_RETRY with EFI_STATUS but
it falls to EFI_UNSUPPORTED.
Map ARM_FFA_RET_RETRY with EFI_TIMEOUT so that don't make it fall to
EFI_UNSUPPORTED.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
commit aa02571 ("MdeModulePkg: Change EndofDxeEvent TPLs to TPL_CALLBACK")
changed EndOfDxeEvent TPLs from TPL_NOFIY to TPL_CALLBACK.
However this commit makes a boot failure on the FVP platform when FPDT
ACPI table generation is enabled:
[FirmwarePerformanceDxe] Error when lock variable FirmwarePerformance, Status = Write Protected
ASSERT_EFI_ERROR (Status = Write Protected)
ASSERT [FirmwarePerformanceDxe] FirmwarePerformanceDxe.c(405): !(((RETURN_STATUS)(Status)) >= 0x8000000000000000ULL)
Currently, EVT_NOTIFY_SIGNAL events are managed in FILO order,
as new events are inserted using InsertHeadList().
The sequence is as follows:
1. DxeCore initializes DxeCorePerformanceLib, whose constructor creates
an EndOfDxe event (gEfiEndOfDxeEventGroupGuid) with the
ReportFpdtRecordBuffer() callback.
2. MmCommunicationDxe (in ArmPkg) creates another EndOfDxe event to
notify StandaloneMm. This event is inserted ahead of the one created
in (1).
3. PlatformBootManagerBeforeConsole() signals EndOfDxe, which triggers
the event created in (2) first.
4. When the callback from (2) runs, StandaloneMm calls
LockVariablePolicy().
5. The callback from (1) is then invoked and attempts to update FPDT via
InstallFirmwarePerformanceDataTable(). During this process, it tries
to register a variable policy for the FirmwarePerformance variable.
However, since the Variable Policy interface was locked in (4), the
operation fails with EFI_WRITE_PROTECTED.
To resolve this issue, revert EndofDxeEvent TPLs to TPL_NOTIFY for FPDT.
Fixes: aa02571 ("MdeModulePkg: Change EndofDxeEvent TPLs to TPL_CALLBACK")
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Add the FF-A YIELD command to the FF-A library.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
EFI_HOB_TYPE_UNUSED is not unknown HOB type, instead of printing
"Unknown Hob type, ...", this patch updates code to also print
EFI_HOB_TYPE_UNUSED type HOB.
Signed-off-by: Star Zeng <star.zeng@intel.com>
The DebugPrintMarker function in PeiDxeDebugLibReportStatusCode/DebugLib.c
does not recognize the comma (`,`) flag in printf-style format strings.
When a driver uses format strings with thousand separators like "%,ld" to
format large numbers (e.g., 1234567 as "1,234,567"), the DebugPrintMarker
parser fails to recognize the comma flag and causes incorrect argument
extraction when building the BASE_LIST for status code reporting, leading
to unexpected or corrupted debug output in status code reports.
The change is to add the missing comma flag check to align with
BasePrintLib's format parsing logic, ensuring consistent behavior across
all print library implementations.
Signed-off-by: Ray Ni <ray.ni@intel.com>
The VaListToBaseList function in PeiDebugLibDebugPpi/DebugLib.c does not
recognize the comma (`,`) flag in printf-style format strings. When a
driver uses format strings with thousand separators like "%,ld" to format
large numbers (e.g., 1234567 as "1,234,567"), the VaListToBaseList parser
fails to recognize the comma flag and causes incorrect argument extraction
from the VA_LIST, leading to unexpected or corrupted debug output.
The change is to add a check for the comma character in the format string
parsing logic to align with BasePrintLib's format parsing logic,
ensuring consistent behavior across all print library implementations.
Signed-off-by: Ray Ni <ray.ni@intel.com>
Replace traditional `#ifndef`/`#define`/`#endif` include guards with
`#pragma` once.
`#pragma once` is a widely supported preprocessor directive that
prevents header files from being included multiple times. It is
supported by all toolchains used to build edk2: GCC, Clang/LLVM, and
MSVC.
Compared to macro-based include guards, `#pragma once`:
- Eliminates the risk of macro name collisions or copy/paste errors
where two headers inadvertently use the same guard macro.
- Eliminate inconsistency in the way include guard macros are named
(e.g., some files use `__FILE_H__`, others use `FILE_H_`, etc.).
- Reduces boilerplate (three lines replaced by one).
- Avoids polluting the macro namespace with guard symbols.
- Can improve build times as the preprocessor can skip re-opening the
file entirely, rather than re-reading it to find the matching
`#endif` ("multiple-include optimization").
- Note that some compilers may already optimize traditional include
guards, by recognzining the idiomatic pattern.
This change is made acknowledging that overall portability of the
code will technically be reduced, as `#pragma once` is not part of the
C/C++ standards.
However, this is considered acceptable given:
1. edk2 already defines a subset of supported compilers in
BaseTools/Conf/tools_def.template, all of which have supported
`#pragma once` for over two decades.
2. There have been concerns raised to the project about inconsistent
include guard naming and potential macro collisions.
Approximate compiler support dates:
- MSVC: Supported since Visual C++ 4.2 (1996)
- GCC: Supported since 3.4 (2004)
(http://gnu.ist.utl.pt/software/gcc/gcc-3.4/changes.html)
- Clang (LLVM based): Since initial release in 2007
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Add Unmap callback for when PEI and SEC need to invalidate the
Rx/Tx buffer HOB on a call to Unmap.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Cleaned various comments and debug messages as well as
headers to either fix typos or for readability.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Replaced all instances of PcdGet64 (PcdFfaTxRxPageCount) *
EFI_PAGE_SIZE, with EFI_PAGES_TO_SIZE macro.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Removed the global variables in ArmFfaSecRxTxMap. Rx/Tx
buffer HOB is now created within the Map function rather
than in the constructor of ArmFfaSecLib. This allows for
the use of the HOB to find the Rx/Tx buffer information.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Removed global variables in ArmFfaCommon. Moved the globals to
locals in each phase's ArmFfaLib implementation. SEC and PEI
will query when necessary to avoid setting globals when memory
is unavailable.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
Added ArmFfaLibIsFfaSupported to ArmFfaCommon to allow for
queries of FF-A support outside of ArmFfaCommonInit.
Signed-off-by: Raymond Diaz <raymonddiaz@microsoft.com>
MdeModulePkg/Library/VarCheckHiiLib/VarCheckHiiGenFromFv.c: In function ‘ParseFv’:
MdeModulePkg/Library/VarCheckHiiLib/VarCheckHiiGenFromFv.c:263:34: error: variable ‘FfsIndex’ set but not used [-Werror=unused-but-set-variable=]
263 | UINTN FfsIndex;
| ^~~~~~~~
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
MdeModulePkg/Library/CustomizedDisplayLib/CustomizedDisplayLib.c: In function ‘CreateDialog’:
MdeModulePkg/Library/CustomizedDisplayLib/CustomizedDisplayLib.c:435:18: error: variable ‘Count’ set but not used [-Werror=unused-but-set-variable=]
435 | UINTN Count;
| ^~~~~
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit adds a host based unit test for DxeReportStatusCodeLib
that ensures that the platform cannot invert the TPL on an initial
call to ReportStatusCode functionality.
Signed-off-by: Joey Vagedes <joey.vagedes@gmail.com>
This commit stops the library from querying the protocol database for
the status code protocol at the time of library function use. This logic
can result in a TPL inversion if the protocol has not yet been cached
and the caller is calling the library function when the TPL is higher
then TPL_NOTIFY.
Instead, the protocol is now located during the constructor of the
library. If the protocol is not found, then an on-protocol install event
is registered which will cache the protocol. A destructor is also added
to close the event in the scenario that the driver is unloaded before
the protocol is installed.
Signed-off-by: Joey Vagedes <joey.vagedes@gmail.com>
This commit stops the library from querying the protocol database for
the status code protocol at the time of library function use. This logic
can result in a TPL inversion if the protocol has not yet been cached
and the caller is calling the library function when the TPL is higher
then TPL_NOTIFY.
Instead, the protocol is now located during the constructor of the
library. If the protocol is not found, then an on-protocol install event
is registered which will cache the protocol. A destructor is also added
to close the event in the scenario that the driver is unloaded before
the protocol is installed.
Signed-off-by: Joey Vagedes <joey.vagedes@gmail.com>
Introduce ArmFfaGetPartitionInfo(), which retrieves the first partition
associated with the service GUID. This allows us to remove duplicated
code previously used to obtain the partition ID.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Continuous-integration-options: PatchCheck.ignore-multi-package
In the normal world, it is possible to communicate with
a secure partition using the ARM_FFA_PARTITION_INFO_GET_REGS ABI,
even when the Rx/Tx buffer ABI is not supported.
Therefore, treat the EFI_UNSUPPORTED error returned
during Rx/Tx buffer mapping as a valid result
when the ARM_FFA_PARTITION_INFO_GET_REGS ABI is supported.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Starting from FF-A v1.2 [0], the FFA_PARTITION_INFO_GET_REGS
interface was added to retrieve partition information
through registers.
This ABI is useful in environments where the Rx/Tx buffer
does not need to be mapped, or where buffer mapping
is not supported for retrieving partition information.
To support this, two new APIs are introduced:
ArmFfaLibPartitionInfoGetRegs() and ArmFfaLibPartitionCountGetRegs().
Link: https://developer.arm.com/documentation/den0077/latest [0]
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Update GCC Family to undefined _MSC_VER to match settings used
by other compilers. This addresses clang compatibility issues
for host-based unit test builds.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
DestSize should have been received and passed as a pointer in order to
successfully pass the output value.
The existence of this error was spotted by XCODE5 toolchain, which gave:
BrotliDecompress.c:85:18: error: parameter 'DestSize' set but not used
As discussed in https://github.com/tianocore/edk2/pull/11729, since the
method is in fact internal and only called in one place, and since the
DestSize return value is in fact unused, instead of fixing the parameter
and method call we instead remove the parameter, also marking the method
STATIC and renaming it to ...Internal.
Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
Update the brotli submodule to the commit (e230f474).
to avoid build failures in the IA64/LoongArch architecture's
native compiler.
The fundamental reason is that GCC does not support the
__attribute__((model("small"))).
REF:https://github.com/google/brotli/pull/1369
Signed-off-by: Dongyan Qian <qiandongyan@loongson.cn>
# Description
Update brotli from v1.0.9 to v1.2.0
https://github.com/google/brotli/releases/tag/v1.2.0
- [ ] Breaking change?
- **Breaking change** - Does this PR cause a
break in build or boot behavior?
- Examples: Does it add a new library class
or move a module to a different repo.
- [x] Impacts security?
- **Security** - Does this PR have a direct security impact?
- Fixes CVE-2025-6176 reported in brotli < 1.2.0.
- [ ] Includes tests?
- **Tests** - Does this PR include any explicit test code?
- Examples: Unit tests or integration tests.
## How This Was Tested
Verified booting on a virtual platform by
compressing/decompressing PEI/DXE sections.
## Integration Instructions
NA
Signed-off-by: Vineel Kovvuri[MSFT] <vineelko@microsoft.com>
If a secure partition on AArch64 platforms would consume extended time
to operate with peripherals, it might elect to yield the control back to
normal world and expect the normal world to callback after hinted period
of time.
This change adds the FFA_YIELD handling from ArmFfaLib to support long
operations from secure partitions. Timeout arguments are ignored because
systems in this context cannot benefit from the timeout period. Treating
FFA_YIELD like FFA_INTERRUPT and expecting the caller to invoke FFA_RUN
is the least disruptive approach while achieving the intended behavior.
This was tested on proprietary hardware platforms and booted to Windows.
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
The DXE_SAL_DRIVER module type was introduced to support
Itanium (IPF) platforms. Since support for Itanium processors
has been dropped, the instances of DXE_SAL_DRIVER
have been removed.
Ref: [3cb0a311cb]
Cc: Sachin Ganesh <sachinganesh@ami.com>
Signed-off-by: Sathya Ravichandran <sathyar@ami.com>
Currently, CpuExceptionHandlerLibNull returns EFI_UNSUPPORTED for
InitializeSeparateExceptionStacks. However, CpuMpPei, CpuDxe, and
DXE Core are all moving to call this function unconditionally and
expect it returns success. As such, the null lib is updated to
return success.
This fixes a hang on EmulatorPkg where DXE Core asserts if this
function returns an error.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
