Tianocore/edk2.git/SecurityPkg/Library/HashLibBaseCryptoRouter, branch master

SecurityPkg: Propagate Cryptographic Operation Failures

2026-09-08T18:20:17+00:00

Check and propagate failures in HashLibBaseCryptoRouter and RngDxe. Signed-off-by: Oliver Smith-Denny

SecurityPkg: Guard nullable return values

2026-09-08T18:20:17+00:00

Makes changes to comply with CodeQL unguarded-null-return-dereference alerts. Signed-off-by: Oliver Smith-Denny

SecurityPkg: Update HashLibBaseCryptoRouter

2026-06-17T19:16:45+00:00

HashLibBaseCryptoRouterCommon contained a version of Tpm2GetHashMaskFromAlgo which was causing conflicts with the version in Tpm2HelpLib. This version used a GUID to query the HashMask, updated the name to remove the conflict and be more inline with the actual function implementation. Signed-off-by: Raymond Diaz

SecurityPkg: Integrate Tpm2HelpLib

2026-06-17T19:16:45+00:00

Replace instances of the old Tpm2Help.c functions with the new Tpm2HelpLib versions. Update files to use Tpm2HelpLib in place of Tpm2Help.c from Tpm2CommandLib. Signed-off-by: Raymond Diaz

SecurityPkg: Replace include guards with #pragma once

2026-02-23T21:01:28+00:00

Replace traditional `#ifndef`/`#define`/`#endif` include guards with `#pragma` once. `#pragma once` is a widely supported preprocessor directive that prevents header files from being included multiple times. It is supported by all toolchains used to build edk2: GCC, Clang/LLVM, and MSVC. Compared to macro-based include guards, `#pragma once`: - Eliminates the risk of macro name collisions or copy/paste errors where two headers inadvertently use the same guard macro. - Eliminate inconsistency in the way include guard macros are named (e.g., some files use `__FILE_H__`, others use `FILE_H_`, etc.). - Reduces boilerplate (three lines replaced by one). - Avoids polluting the macro namespace with guard symbols. - Can improve build times as the preprocessor can skip re-opening the file entirely, rather than re-reading it to find the matching `#endif` ("multiple-include optimization"). - Note that some compilers may already optimize traditional include guards, by recognzining the idiomatic pattern. This change is made acknowledging that overall portability of the code will technically be reduced, as `#pragma once` is not part of the C/C++ standards. However, this is considered acceptable given: 1. edk2 already defines a subset of supported compilers in BaseTools/Conf/tools_def.template, all of which have supported `#pragma once` for over two decades. 2. There have been concerns raised to the project about inconsistent include guard naming and potential macro collisions. Approximate compiler support dates: - MSVC: Supported since Visual C++ 4.2 (1996) - GCC: Supported since 3.4 (2004) (http://gnu.ist.utl.pt/software/gcc/gcc-3.4/changes.html) - Clang (LLVM based): Since initial release in 2007 Signed-off-by: Michael Kubacki

Revert "SecurityPkg: CodeQL Fixes."

2025-08-12T03:50:30+00:00

This reverts commit ba6a8eb045aededbc1472cce7314ab1911f0ea1c. PR https://github.com/tianocore/edk2/pull/11307 introduced a logic change that caused regressions in FV verification on some platforms. This PR is being reverted to restore the prior logic. The Code QL fixes in https://github.com/tianocore/edk2/pull/11307 can be resubmitted without the logic change along with one commit for each type of Code QL issue being addressed. Signed-off-by: Michael D Kinney

SecurityPkg: CodeQL Fixes.

2025-07-24T01:58:06+00:00

Makes changes to comply with alerts raised by CodeQL. Most of the issues here fall into the following two categories: 1. Potential use of uninitialized pointer. 2. Inconsistent integer width in comparison. Co-authored-by: Taylor Beebe <31827475+TaylorBeebe@users.noreply.github.com> Co-authored-by: kenlautner <85201046+kenlautner@users.noreply.github.com> Co-authored-by: Bret Barkelew Signed-off-by: Doug Flick

SecurityPkg: Add TCG PFP 1.06 support.

2024-04-30T02:21:13+00:00

Add new api Tpm2ExtendNvIndex. It is uesd in HashCompleteAndExtend when PcrIndex > MAX_PCR_INDEX. Cc: Jiewen Yao Cc: Rahul Kumar Signed-off-by: Wenxing Hou Reviewed-by: Jiewen Yao

SecurityPkg: Reallocate TPM Active PCRs based on platform support

2021-12-17T15:03:43+00:00

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3515 In V4: Fixed patch format and uncrustify cleanup In V3: Cleaned up comments, debug prints and updated patch to use the new debug ENUM definitions. - Replaced EFI_D_INFO with DEBUG_INFO. - Replaced EFI_D_VERBOSE with DEBUG_VERBOSE. In V2: Add case to RegisterHashInterfaceLib logic RegisterHashInterfaceLib needs to correctly handle registering the HashLib instance supported algorithm bitmap when PcdTpm2HashMask is set to zero. The current implementation of SyncPcrAllocationsAndPcrMask() triggers PCR bank reallocation only based on the intersection between TpmActivePcrBanks and PcdTpm2HashMask. When the software HashLibBaseCryptoRouter solution is used, no PCR bank reallocation is occurring based on the supported hashing algorithms registered by the HashLib instances. Need to have an additional check for the intersection between the TpmActivePcrBanks and the PcdTcg2HashAlgorithmBitmap populated by the HashLib instances present on the platform's BIOS. Signed-off-by: Rodrigo Gonzalez del Cueto Cc: Jian J Wang Cc: Jiewen Yao Reviewed-by: Jiewen Yao

SecurityPkg: Apply uncrustify changes

2021-12-07T17:24:28+00:00

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3737 Apply uncrustify changes to .c/.h files in the SecurityPkg package Cc: Andrew Fish Cc: Leif Lindholm Cc: Michael D Kinney Signed-off-by: Michael Kubacki Reviewed-by: Jian J Wang