Tianocore/edk2.git/SecurityPkg, branch dependabot/github_actions/actions/setup-python-6

Global: fix ArmFfaLibRun() caller couldn't get ret-args

2025-09-08T13:14:00+00:00

When ArmFfaLibDirectMsgReq(2) is preempted, caller of these functions should resume it works via ArmFfaLibRun() and the secure partition will be return with FFA_DIRECT_MSG_RESP(2) with return arguments. However, since ArmFfaLibRun() gets its return in its stack variable, So caller of ArmFfaLibRun() doesn't get the return arguments from secure partition. To resolve this, add output parameter to ArmFfaLibRun() to receive return arguments. Continuous-integration-options: PatchCheck.ignore-multi-package Fixes: 5d1b38dd07c4 ("ArmPkg: Add ArmFfaLib used in Dxe driver") Reported-by: Mariam Elshakfy Signed-off-by: Yeoreum Yun

SecurityPkg/FvReportPei: Improve CheckStoredHashFv() description

2025-08-30T01:00:08+00:00

Adds more detail to the function description so the dependencies and outcomes of the verification process are easier for a reviewer and consumer to understand. Signed-off-by: Michael Kubacki

SecurityPkg/Tpm2CommandLib: Update not found RC for Public NV Read

2025-08-23T00:48:06+00:00

Currently a EFI_DEVICE_ERROR is returned if `TPM_RC_HANDLE` is the return code from a TPM2_NV_ReadPublic command. However, in the TCG TPM Library Part 3: Commands specification, `TPM_RC_HANDLE` is a return code if: 1. An Index does not exist that corresponds to the handle (TPM_RC_HANDLE) 2. The hierarchy associated with the existing NV Index is not enabled (TPM_RC_HANDLE) Therefore, return EFI_NOT_FOUND in this case, since that more precisely allows a caller to identify this condition and act on it as opposed to a more generic device error. Signed-off-by: Michael Kubacki

Revert "SecurityPkg: CodeQL Fixes."

2025-08-12T03:50:30+00:00

This reverts commit ba6a8eb045aededbc1472cce7314ab1911f0ea1c. PR https://github.com/tianocore/edk2/pull/11307 introduced a logic change that caused regressions in FV verification on some platforms. This PR is being reverted to restore the prior logic. The Code QL fixes in https://github.com/tianocore/edk2/pull/11307 can be resubmitted without the logic change along with one commit for each type of Code QL issue being addressed. Signed-off-by: Michael D Kinney

SecurityPkg/Tcg/OpalPasswordDxe: Fix logic for RemoveDevice()

2025-08-07T06:40:28+00:00

First, If there are multiple devices in DeviceList and are going to remove the first device in the DeviceList, the DeviceList will be cleared up with setting to NULL. This is not the expected behavior, as it should keep the rest of the devices in the DeviceList. DeviceList should point to the next device, Dev->Next. Second, there is a potential infinite while loop if TmpDev->Next not equal to Dev. TmpDev should point to next device. Signed-off-by: Hunter Chang

SecurityPkg: Added basic DxeImageVerificationLib tests

2025-08-07T01:18:26+00:00

Add initial unit test for DxeImageVerificationHandler to validate signature verification bypass for selected image types. Signed-off-by: Alexander Gryanko

SecurityPkg/Tcg2Config: add Tcg2ConfigFfaPei

2025-07-24T04:48:50+00:00

To support TPM2 devices that operate over the FF-A specification using CRB in the Tcg2Pei PEIM, add the Tcg2ConfigFfaPei PEIM to detect the presence of such TPM2 devices. Signed-off-by: Yeoreum Yun

SecurityPkg/Library: Tpm2DeviceSecLibFfa for PeilessSec

2025-07-24T03:54:43+00:00

To support measurement and extend PCR in PeilessSec with TPM device using FF-A over CRB, add Tpm2DeviceSecLibFfa for PeilessSec. Signed-off-by: Yeoreum Yun

SecurityPkg/Library: separate logics geting TPM2 information with FF-A

2025-07-24T03:54:43+00:00

This is preparation patch to add Tpm2DeviceSecLibFfa for SEC used in PeilessSec. In SEC phase, DynamicPcd used for cacahing TPM2 information couldn't be used. To resolve this, writes wrapper functions to get TPM2 information so that in the wrapper functions used in SEC wouldn't use the related DyanmicPcd. Signed-off-by: Yeoreum Yun

SecurityPkg: CodeQL Fixes.

2025-07-24T01:58:06+00:00

Makes changes to comply with alerts raised by CodeQL. Most of the issues here fall into the following two categories: 1. Potential use of uninitialized pointer. 2. Inconsistent integer width in comparison. Co-authored-by: Taylor Beebe <31827475+TaylorBeebe@users.noreply.github.com> Co-authored-by: kenlautner <85201046+kenlautner@users.noreply.github.com> Co-authored-by: Bret Barkelew Signed-off-by: Doug Flick