The GetRandomNumber functions in DxeRngLib can return success without
actually generating a random number. This occurs because there are code
paths through `GenerateRandomNumberViaNist800Algorithm` that do not
initialize the `Status` variable.
- Assume mFirstAlgo == MAX_UINTN (no secure algorithms available)
- Assume none of the secure algorithms have `Available` set.
- Assume PcdEnforceSecureRngAlgorithms is TRUE.
In this condition, the `Status` variable is never initialized, `Buffer`
data is never touched. It is fairly likely that Status is 0, so we can
return EFI_SUCCESS without writing anything to Buffer.
Fix is to set `Status = error_code` in this code path.
`EFI_SECURITY_VIOLATION` seems appropriate.
Signed-off-by: Doug Cook <idigdoug@gmail.com>
DebugLib PCDs are very important, but they're confusing and not
well-explained anywhere. Improve the documentation comments for them to
explain how they work and how they relate to each other.
Signed-off-by: Doug Cook <idigdoug@gmail.com>
With mSecureHashAlgorithms being static this should not be
needed any more.
Suggested-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Update Tpm12.h and Tpm20.h and not use c++ reserved keywords
operator and xor in C structures to support use of these
include files when building with a C++ compiler.
This patch removes the temporary use of anonymous unions and
warning 4201 disable for VS20xx tool chains to complete the
following field name changes:
* operator -> operator_
* xor -> xor_
NOTE: This is a non-backwards compatible change to Tpm12.h
and Tmp20.h. And consumers of these include files that access
the "operator" or "xor" fields must be updated.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Update Tpm12.h and Tpm20.h and not use c++ reserved keywords
operator and xor in C structures to support use of these
include files when building with a C++ compiler.
This patch temporarily introduces an anonymous union to add
operator_ and xor_ fields to support migration from the current
field names to the new field names.
Warning 4201 is disabled for VS20xx tool chains is a temporary
change to allow the use of anonymous unions.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Add definitions for the non-global page tables descriptor attribute, as
well as the E2H TCR bit, so that we can use them in the MMU code.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
As a BASE type library, some PEI drivers could link and use it.
Tcg2Pei.inf is an example. On edk2-stable202408 version, PEI drivers
that link the library include the global variable of mRdRandSupported.
The previous commit (c3a8ca7) that refers to the global variable actually
is found to influence the link status. Updating the global variable
in PEI drivers could affect the following issues.
PEI ROM Boot : Global variable is not updated
PEI RAM Boot : PEI FV integration/security check is failed
To address these issues, remove the global variable usage.
Signed-off-by: Phil Noh <Phil.Noh@amd.com>
The PCD token, PcdPciExpressBaseAddress is referred in the constructor.
If the token is defined as PcdsDynamic type, the PCD function that gets
the token value uses the gBS service to locate PCD protocol internally.
In this case, it is possible for the function to be called before
initializing gBS variable, then cause a system hang due to gBS variable.
Need to ensure the availability of gBS variable.
Signed-off-by: Phil Noh <Phil.Noh@amd.com>
These constants give the set of RES1 bits in CPTR_EL2, as 1s, and the
default value to use for CPTR_EL2 in order to enable all known (or
harmless) features but no unknown ones that require EL2 knowledge. This
will be used by ArmPlatformPkg in the following commit, separated due to
being different packages, even though the combined change is tiny.
Signed-off-by: Jessica Clarke <jrtc27@jrtc27.com>
CP_FULL_ACCESS is a misnomer, we only enable access to SIMD/FP state,
and although the register's mnemonic is CPACR_EL1, its full name is
"Architectural Feature Access Control Register", with AArch64 having no
coprocessors like AArch32 did, so the "CP" is also not appropriate.
Rename it to show it's the default value we use on entry, and define it
in terms of the existing CPACR_FPEN_FULL rather than a magic constant
with the same value to more clearly document that fact. Also update
comments to reflect all this (including the CPTR_EL2 case).
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Jessica Clarke <jrtc27@jrtc27.com>
Now that the ResetVectors are USER_DEFINED modules, they will not
be linked against StackCheckLibNull, which were the only modules
causing issues. So, we can now remove the kludge we had before
and the requirement for every DSC to include StackCheckLibNull
for SEC modules and just apply StackCheckLibNull globally.
This also changes every DSC to drop the SEC definition of
StackCheckLibNull.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
Unit test checks if AppendDevicePathInstance() returns NULL.
In those cases, AppendDevicePathInstance() does not allocate
a device path, so the call to FreePool() must not be performed.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Includes changes across the repo for the following CodeQL rules:
- cpp/comparison-with-wider-type
- cpp/overflow-buffer
- cpp/redundant-null-check-param
- cpp/uselesstest
Co-authored-by: Taylor Beebe <tabeebe@microsoft.com>
Co-authored-by: kenlautner <85201046+kenlautner@users.noreply.github.com>
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
[Issue Description]
CXL_ERROR_PCIE_DEV_ID in Cper.h was renamed to EFI_CXL_ERROR_PCIE_DEV_ID,
but EFI_CXL_COMPONENT_EVENT_LOG still uses previous name.
[Resolution]
Modify EFI_CXL_COMPONENT_EVENT_LOG to use EFI_CXL_ERROR_PCIE_DEV_ID
Signed-off-by: Sienski Piotr <piotr.sienski@intel.com>
[Issue Description]
In MdePkg/Include/Guid/Cper.h there are multiple definitions
regarding CXL that can do use EFI_ prefix in their names
[Resolution]
Rename these definitions in MdePkg/Include/Guid/Cper.h
Signed-off-by: Sienski Piotr <piotr.sienski@intel.com>
When building OvmfPkg in RELEASE mode in the XCODE5 toolchain, the
ASSERT_EFI_ERROR change prevents this error:
.../MdePkg/Library/UefiMemoryAllocationLib/MemoryAllocationLib.c:141:15:
error: variable 'Status' set but not used [-Werror,-Wunused-but-set-variable]
EFI_STATUS Status;
^
which is currently stopping the build.
When building in RELEASE mode in the CLANGPDB toolchain,the DEBUG macro
change prevents this error:
.../edk2/OvmfPkg/VirtioSerialDxe/VirtioSerial.c:28:22: error:
variable 'EventNames' is not needed and will not be
emitted [-Werror,-Wunneeded-internal-declaration]
STATIC CONST CHAR8 *EventNames[] = {
^
which is currently stopping the build.
CLANGDWARF produces the same error as CLANGPDB above, if
-Wno-unneeded-internal-declaration is removed from its build flags.
With the null DEBUG macro change, this warning suppression
can be removed from CLANGDWARF, which is considered a benefit
as it has the potential to catch real coding errors. This is
done in a subsequent commit.
This commit has the desirable side effect that we no longer require
(and cannot use) explicit `#ifndef MDEPKG_NDEBUG` around items only
used in DEBUG macros. This requires the ArmPkg change made here to
be in the same commit as the MdePkg changes.
Note: In common with existing macros in EDK II, including the pre-existing
and unchanged DEBUG/NOOPT versions of the macros which are modified here,
we use the standard approach of adding `do { ... } while (FALSE)` wrapping
to ensure that the macros behave correctly with surrounding code
(e.g. require a following ';' and do not combine in unexpected ways with
nearby conditionals).
Continuous-integration-options: PatchCheck.ignore-multi-package
Co-authored-by: Mikhail Krichanov <krichanov@ispras.ru>
Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
[Issue Description]
In MdePkg/Include/Guid/Cper.h there are missing multiple definitions
regarding CXL that can be found in UEFI 2.10 spec
chapters N.2.13 and N.2.14
[Resolution]
Add these definitions to MdePkg/Include/Guid/Cper.h
Signed-off-by: Sienski Piotr <piotr.sienski@intel.com>
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4496
PI spec defined the `Register` function input argument `Delay` as output.
However, this parameter should be used to define the minmal time delay
the callback should fire. Thus it should be an input parameter.
This change fixed the argument type.
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Co-authored-by: Mike Turner <mikeyt@pobox.com>
Co-authored-by: Sachin Ganesh <sachinganesh@ami.com>
Signed-off-by: Kun Qin <kuqin12@gmail.com>
Added comments to describe the storage location of DXE Services Table,
HOB List Table and PEI Vector Handoff Table.
As defined in PI 1.7 A Errata specification.
Cc: Felix Polyudov <felixp@ami.com>
Cc: Dhanaraj V <vdhanaraj@ami.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Signed-off-by: Sachin Ganesh <sachinganesh@ami.com>
Clarified comments regarding the usage of RegisterContext parameter of
Register() API in EFI_MM_SX_DISPATCH_PROTOCOL.
As defined in the PI 1.7 A Errata specification.
Cc: Felix Polyudov <felixp@ami.com>
Cc: Dhanaraj V <vdhanaraj@ami.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Signed-off-by: Sachin Ganesh <sachinganesh@ami.com>
Defined PI specification version.
Used them to define revisions of PEI/DXE/MM system tables.
Cc: Felix Polyudov <felixp@ami.com>
Cc: Dhanaraj V <vdhanaraj@ami.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Signed-off-by: Sachin Ganesh <sachinganesh@ami.com>
The CR macro is used to access an enclosing structure from a
pointer within the structure. In DEBUG builds (i.e. when
MDEPKG_NDEBUG is not set and debug asserts are enabled), this
macro does signature validation checking to ensure that the
structure that has been found is the correct structure, based
on a signature passed in by the caller.
However, if MDEPKG_NDEBUG is set or debug asserts are disabled,
no signature validation is performed, meaning that CR may return
an invalid structure that the caller believes is valid and has had
signature validation on, causing undefined behavior (memory
corruption). We should where at all possible have defined behavior,
particularly in RELEASE builds, which are what typical platforms
will ship to consumers.
This patch updates CR to do the signature validation in all scenarios
to provide defined behavior from the macro. In the event of a
signature failure, CR will either 1) assert if !MDEPKG_NDEBUG and
debug asserts are enabled (existing behavior) or 2) return NULL to
indicate to the caller that signature validation failed.
There exist consumers today who already, erroneously, rely on this
behavior.
Another macro, BASE_CR, exists for callers who do not wish to perform
signature validation. Any code that wishes to avoid the signature
validation should move to this macro.
Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* Define CSR fcsr
* Define bitmasks for vs and fs bit fields in the mstatus register
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
In order to support a platform overriding StackCheckLibNull
provided by MdeLibs.dsc.inc, the CUSTOM_STACK_CHECK_LIB macro
is introduced. If this macro is defined, MdeLibs.dsc.inc will
not link StackCheckLibNull and it is expected that the platform
will link the version(s) of StackCheckLib that it requires.
The StackCheckLib README is also updated in this patch to
document the new macro and provide additional information.
Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
Adds macro which defines SPMI table revision
and interface type as per the specification.
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Sami Mujawar <Sami.Mujawar@arm.com>
Cc: Pierre Gondois <pierre.gondois@arm.com>
Signed-off-by: Abdul Lateef Attar <AbdulLateef.Attar@amd.com>
This change adds parantheses to the if condition detecting overflow in
the PeCoffLoaderRelocateImage function to improve readability.
Follow on change for:
REF!: https://github.com/tianocore/edk2/pull/6249
Signed-off-by: Doug Flick <dougflick@microsoft.com>
FdtLib.h uses CONST FDT_PROPERTY * return values for some wrapper
functions, but the implementation in FdtLib.c used to original
CONST struct fdt_property * instead of the exported typedef.
Import LibFdt.h in the implementation file and make the
implementation consistent with the declaration.
Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
Add a wrapper for fdt_strerror () and add the currently supported error
code defines from submodule.
Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
There is currently a mix on functions named as Prop or Property.
The latter is in majority, and the better fit for tianocore coding style,
so rename FdtNodeOffsetByPropValue () and FdtSetProp () for consistency.
To avoid breaking bisect, change existing users in UefiPayloadPkg.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
FdtNumRsv and FdtGetMemRsv were added for the benefit of UefiPayloadPkg,
but their naming matches neither upstream libfdt nor tianocore coding
style rules. And there was scope for improvement of the doxygen
descriptions as well.
These functions currently have only one in-tree user, UefiPayloadPkg
FdtParserLib. So rename them more conformant
FdtGetNumberOfReserveMapEntries
and
FdtGetReserveMapEntry
and update the description comment blocks, at the same time as
updating the existing user.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
The RelocDir->Size is a UINT32 value, and RelocDir->VirtualAddress is
also a UINT32 value. The current code does not check for overflow when
adding RelocDir->Size to RelocDir->VirtualAddress. This patch adds a
check to ensure that the addition does not overflow.
Signed-off-by: Doug Flick <dougflick@microsoft.com>
Authored-by: sriraamx gobichettipalayam <sri..@intel.com>
Without these changes, we get the error:
error: variable '__DebugCodeLocal' set but not used
from the DebugLib.h DEBUG_CODE_BEGIN()/END() macros on XCODE5.
Similarly, in NOOPT builds only, we get:
error: variable '__PerformanceCodeLocal' set but not used
from the PerformanceLib.h PERF_CODE_BEGIN()/END() macros on XCODE5.
It is important to note that the previous code involving a local
variable was intended to ensure correct behaviour of ; following
the macros, in particular that ; should be required:
- https://github.com/tianocore/edk2/pull/6226#issuecomment-2364087866
- https://github.com/tianocore/edk2/pull/6226#issuecomment-2364619759
This converted version repeats the
standard do { ... } while (FALSE) idiom (which is already used in
the END macro) to achieve the same affect.
The modified versions work on all toolchains.
Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
Devicetree defines a short hand way of defining reserved memory
ranges. Add APIs to access such nodes
Signed-off-by: Dhaval Sharma <dhaval@rivosinc.com>
DxeRngLib iterates over a list of secure algorithms before trying
to use the default algorithm provided by the Rng protocol. Add
gEfiRngAlgorithmArmRndr to this list. The algorithm represented by
this GUID is a secure DRBG of an unknown type, implemented by the
aarch64 RNDR instruction.
On AARCH64 platform, use the RNDR instruction as the first option
if it is available.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Use PcdEnforceSecureRngAlgorithms to allow using the Rng protocol
with the default algorithm. All previous call to the Rng protocol
are requesting a secure Rng algorithm.
Not specifying the Rng algorithm GUID to use is considered unsecure.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Add a library constructor which:
- locate the RNG prototocol and keep a reference to it in order to avoid
locating it multiple times (for each random number generation)
- check which secure algorithm is available on the platform.
This avoids to try each secure algorithm until finding one
available for each random number generation call.
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
John Chung
Doug Cook (WINDOWS)
Gerd Hoffmann
Michael D Kinney
Ard Biesheuvel
Phil Noh
Jessica Clarke
Oliver Smith-Denny
Kun Qin
Michael Kubacki
TsunFeng
v-sbolisetti
Sienski Piotr
Revathy V
Mike Beaton
v-chhsieh
Oleg Ilyasov
INDIA\sachinganesh
Heinrich Schuchardt
Abdul Lateef Attar
Doug Flick
Leif Lindholm
Dhaval
Pierre Gondois