MdePkg/Base.h: Introduce various alignment-related macros

ALIGNOF: Determining the alignment requirement of data types is
crucial to ensure safe memory accesses when parsing untrusted data.

IS_POW2: Determining whether a value is a power of two is important
to verify whether untrusted values are valid alignment values.

IS_ALIGNED: In combination with ALIGNOF data offsets can be verified.
A more general version of the IS_ALIGNED macro previously defined by
several modules.

ADDRESS_IS_ALIGNED: Variant of IS_ALIGNED for pointers and addresses.
Replaces module-specific definitions throughout the code base.

ALIGN_VALUE_ADDEND: The addend to align up can be used to directly
determine the required offset for data alignment.

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Vitaly Cheptsov <vit9696@protonmail.com>
Signed-off-by: Marvin Häuser <mhaeuser@posteo.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>

diff --git a/MdePkg/Include/Base.h b/MdePkg/Include/Base.h
index e89c84962ab26ffe70ff4fd4e4f5206296b30c8f..6597e441a6e251003a0aa856598a3177f0d5921b 100644 (file)
--- a/MdePkg/Include/Base.h
+++ b/MdePkg/Include/Base.h
@@ -758,6 +758,40 @@ typedef UINTN *BASE_LIST;
 #define OFFSET_OF(TYPE, Field)  ((UINTN) &(((TYPE *)0)->Field))\r
 #endif\r
 \r
+/**\r
+  Returns the alignment requirement of a type.\r
+\r
+  @param   TYPE  The name of the type to retrieve the alignment requirement of.\r
+\r
+  @return  Alignment requirement, in Bytes, of TYPE.\r
+**/\r
+#if defined (__cplusplus)\r
+//\r
+// Standard C++ operator.\r
+//\r
+#define ALIGNOF(TYPE)  alignof (TYPE)\r
+#elif defined (__GNUC__) || defined (__clang__) || (defined (_MSC_VER) && _MSC_VER >= 1900)\r
+//\r
+// All supported versions of GCC and Clang, as well as MSVC 2015 and later,\r
+// support the standard operator _Alignof.\r
+//\r
+#define ALIGNOF(TYPE)  _Alignof (TYPE)\r
+#elif defined (_MSC_EXTENSIONS)\r
+//\r
+// Earlier versions of MSVC, at least MSVC 2008 and later, support the vendor\r
+// extension __alignof.\r
+//\r
+#define ALIGNOF(TYPE)  __alignof (TYPE)\r
+#else\r
+//\r
+// For compilers that do not support inbuilt alignof operators, use OFFSET_OF.\r
+// CHAR8 is known to have both a size and an alignment requirement of 1 Byte.\r
+// As such, A must be located exactly at the offset equal to its alignment\r
+// requirement.\r
+//\r
+#define ALIGNOF(TYPE)  OFFSET_OF (struct { CHAR8 C; TYPE A; }, A)\r
+#endif\r
+\r
 /**\r
   Portable definition for compile time assertions.\r
   Equivalent to C11 static_assert macro from assert.h.\r
@@ -793,6 +827,21 @@ STATIC_ASSERT (sizeof (CHAR16)  == 2, "sizeof (CHAR16) does not meet UEFI Specif
 STATIC_ASSERT (sizeof (L'A')    == 2, "sizeof (L'A') does not meet UEFI Specification Data Type requirements");\r
 STATIC_ASSERT (sizeof (L"A")    == 4, "sizeof (L\"A\") does not meet UEFI Specification Data Type requirements");\r
 \r
+STATIC_ASSERT (ALIGNOF (BOOLEAN) == sizeof (BOOLEAN), "Alignment of BOOLEAN does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (INT8)    == sizeof (INT8), "Alignment of INT8 does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (UINT8)   == sizeof (UINT8), "Alignment of INT16 does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (INT16)   == sizeof (INT16), "Alignment of INT16 does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (UINT16)  == sizeof (UINT16), "Alignment of UINT16 does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (INT32)   == sizeof (INT32), "Alignment of INT32 does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (UINT32)  == sizeof (UINT32), "Alignment of UINT32 does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (INT64)   == sizeof (INT64), "Alignment of INT64 does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (UINT64)  == sizeof (UINT64), "Alignment of UINT64 does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (CHAR8)   == sizeof (CHAR8), "Alignment of CHAR8 does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (CHAR16)  == sizeof (CHAR16), "Alignment of CHAR16 does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (INTN)    == sizeof (INTN), "Alignment of INTN does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (UINTN)   == sizeof (UINTN), "Alignment of UINTN does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (VOID *)  == sizeof (VOID *), "Alignment of VOID * does not meet UEFI Specification Data Type requirements");\r
+\r
 //\r
 // The following three enum types are used to verify that the compiler\r
 // configuration for enum types is compliant with Section 2.3.1 of the\r
@@ -816,6 +865,10 @@ STATIC_ASSERT (sizeof (__VERIFY_UINT8_ENUM_SIZE) == 4, "Size of enum does not me
 STATIC_ASSERT (sizeof (__VERIFY_UINT16_ENUM_SIZE) == 4, "Size of enum does not meet UEFI Specification Data Type requirements");\r
 STATIC_ASSERT (sizeof (__VERIFY_INT32_ENUM_SIZE) == 4, "Size of enum does not meet UEFI Specification Data Type requirements");\r
 \r
+STATIC_ASSERT (ALIGNOF (__VERIFY_UINT8_ENUM_SIZE)  == sizeof (__VERIFY_UINT8_ENUM_SIZE), "Alignment of enum does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (__VERIFY_UINT16_ENUM_SIZE) == sizeof (__VERIFY_UINT16_ENUM_SIZE), "Alignment of enum does not meet UEFI Specification Data Type requirements");\r
+STATIC_ASSERT (ALIGNOF (__VERIFY_INT32_ENUM_SIZE) == sizeof (__VERIFY_INT32_ENUM_SIZE), "Alignment of enum does not meet UEFI Specification Data Type requirements");\r
+\r
 /**\r
   Macro that returns a pointer to the data structure that contains a specified field of\r
   that data structure.  This is a lightweight method to hide information by placing a\r
@@ -837,6 +890,49 @@ STATIC_ASSERT (sizeof (__VERIFY_INT32_ENUM_SIZE) == 4, "Size of enum does not me
 **/\r
 #define BASE_CR(Record, TYPE, Field)  ((TYPE *) ((CHAR8 *) (Record) - OFFSET_OF (TYPE, Field)))\r
 \r
+/**\r
+  Checks whether a value is a power of two.\r
+\r
+  @param   Value  The value to check.\r
+\r
+  @retval TRUE   Value is a power of two.\r
+  @retval FALSE  Value is not a power of two.\r
+**/\r
+#define IS_POW2(Value)  ((Value) != 0U && ((Value) & ((Value) - 1U)) == 0U)\r
+\r
+/**\r
+  Checks whether a value is aligned by a specified alignment.\r
+\r
+  @param   Value      The value to check.\r
+  @param   Alignment  The alignment boundary used to check against.\r
+\r
+  @retval TRUE   Value is aligned by Alignment.\r
+  @retval FALSE  Value is not aligned by Alignment.\r
+**/\r
+#define IS_ALIGNED(Value, Alignment)  (((Value) & ((Alignment) - 1U)) == 0U)\r
+\r
+/**\r
+  Checks whether a pointer or address is aligned by a specified alignment.\r
+\r
+  @param   Address    The pointer or address to check.\r
+  @param   Alignment  The alignment boundary used to check against.\r
+\r
+  @retval TRUE   Address is aligned by Alignment.\r
+  @retval FALSE  Address is not aligned by Alignment.\r
+**/\r
+#define ADDRESS_IS_ALIGNED(Address, Alignment)  IS_ALIGNED ((UINTN) (Address), Alignment)\r
+\r
+/**\r
+  Determines the addend to add to a value to round it up to the next boundary of\r
+  a specified alignment.\r
+\r
+  @param   Value      The value to round up.\r
+  @param   Alignment  The alignment boundary used to return the addend.\r
+\r
+  @return  Addend to round Value up to alignment boundary Alignment.\r
+**/\r
+#define ALIGN_VALUE_ADDEND(Value, Alignment)  (((Alignment) - (Value)) & ((Alignment) - 1U))\r
+\r
 /**\r
   Rounds a value up to the next boundary using a specified alignment.\r
 \r
@@ -849,7 +945,7 @@ STATIC_ASSERT (sizeof (__VERIFY_INT32_ENUM_SIZE) == 4, "Size of enum does not me
   @return  A value up to the next boundary.\r
 \r
 **/\r
-#define ALIGN_VALUE(Value, Alignment)  ((Value) + (((Alignment) - (Value)) & ((Alignment) - 1)))\r
+#define ALIGN_VALUE(Value, Alignment)  ((Value) + ALIGN_VALUE_ADDEND (Value, Alignment))\r
 \r
 /**\r
   Adjust a pointer by adding the minimum offset required for it to be aligned on\r