Some SuperSpeed-capable devices may fall back to High-Speed
mode and cause subsequent commands to fail.
[Suggested Solution]
Check the BOS descriptor to verify SuperSpeed support and
trigger a port reset if needed to re-enumerate the device
properly.
Signed-off-by: Marlboro Chuang <marlboro.chuang@dell.com>
Signed-off-by: Jared Pan <jared.pan@dell.com>
USB devices whose configuration descriptor TotalLength exceeds 1024
bytes (e.g. IR cameras with large descriptor tables) previously hit
an EFI_DEVICE_ERROR hard-limit and failed to enumerate in PEI.
Replace the fixed array with a UINT8 * pointer and dynamically
allocate the exact amount of memory required via
PeiServicesAllocatePool() after the TotalLength is learned from the
initial 4-byte descriptor probe.
Signed-off-by: Damien Chen <damien.chen@dell.com>
Commit 7f505d377b in 2024 added the
Type 4 field SocketType. Bump the default SMBIOS version to 3.8
in order for the larger table size to be valid.
Signed-off-by: Rebecca Cran <rebecca@bsdio.com>
Extend the GptLib host-based tests with negative cases that guard the
security hardening in PartitionValidGptTable(), PartitionCheckGptEntry()
and PartitionRestoreGptTable() against future regressions. These tests
exercise the shared parser, not the specific fix itself.
The new cases drive the parser with malformed GPT structures that an
attacker may present: bad signature/revision, header-size boundaries,
CRC corruption, MyLBA replay, zero/non-power-of-two entry sizes, LBA
multiplication overflow, out-of-range and overlapping entries, and
restore failure on write-protected media. The INF file header is
updated to note the added malformed coverage.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
Add the positive-path host-based tests for the shared GptLib parser
(extracted as part of the parser security hardening), ensuring the
tightened checks in PartitionValidGptTable(), PartitionCheckGptEntry()
and PartitionRestoreGptTable() do not falsely reject well-formed GPTs.
The tests run against an in-memory mock disk and cover accepted
primary/backup headers, boundary but legal header/entry sizes, correct
entry-status flagging on valid entries, and primary/backup restore
round-trips.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
When the primary GPT is invalid, PartitionInstallGptChildHandles()
restores it from the backup and re-validates it. Both the restore write
and the re-validation can fail (e.g. write-protected media, or a backup
AlternateLBA pointing beyond the device), yet the existing code only logs
the failure and parses partitions from a known-invalid PrimaryHeader.
Abort GPT processing when either the restore or the validation fails, so
partitions are only ever parsed from a validated primary GPT. The backup
recovery branch is left unchanged, as the primary is already validated.
A device with an unrecoverable primary GPT now installs no child handles
instead of using an invalid header. This keeps the table PartitionDxe uses
in sync with the one DxeTpm2MeasureBootLib measures into PCR[5].
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
PartitionValidGptTable() checked the signature, header CRC32, MyLBA, the
entry-array CRC32 and the entry-array size overflow, but not several other
UEFI-mandated GPT header constraints. DxeTpm2MeasureBootLib used to enforce
these via Tpm2SanitizeEfiPartitionTableHeader(); once it switched to this
shared parser, the checks were lost on the path.
Also reject a header unless Header.Revision is GPT_HEADER_REVISION_V1,
HeaderSize is at least the 92-byte minimum, NumberOfPartitionEntries is
non-zero, SizeOfPartitionEntry is 128 * 2^n, and PartitionEntryLBA *
BlockSize cannot overflow. The "entries lie before FirstUsableLBA" rule is
intentionally omitted, as this routine also validates the backup header
whose entry array follows the usable region.
This restores the validation the measurement path lost and, because GptLib
is shared, tightens PartitionDxe the same way: malformed headers are now
rejected and the parse and measure paths stay identical.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
As reported in CVE-2024-13745 via oss-sec, DxeTpm2MeasureBootLib can
measure a partition table that differs from the one parsed by the
PartitionDxe driver.
To address this, the more complete GPT parsing logic from PartitionDxe
is extracted into a standalone GptLib library so it can be
shared between PartitionDxe and DxeTpm2MeasureBootLib. This ensures
that the exact same partition table measured into PCR[5] is the one
parsed and used by the system. PartitionDxe behavior is unchanged.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
The direct message arguments stripped off the header, making the
underlying FF-A function interface to lose information when it comes to
certain return code, i.e. FFA_YIELD and FFA_INTERRUPT.
This change adds back the header field for this purpose so that the
callers can decide how to act on the corresponding return codes.
It then populates the header field for this purpose in FFA direct
message functions so that the callers can decide how to act on the
corresponding return codes.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
When UpdatePciInfo() downgrades a PciBarTypePMem64 BAR to a 32-bit type
via EFI_INCOMPATIBLE_PCI_DEVICE_SUPPORT_PROTOCOL, it unconditionally
assigns PciBarTypePMem32 regardless of SpecificFlag, placing the BAR in
the prefetchable bridge window even when the platform intended the
non-prefetchable window.
The ACPI resource descriptor's SpecificFlag field encodes the intended
prefetchability of the constrained resource, using the bit:
EFI_ACPI_MEMORY_RESOURCE_SPECIFIC_FLAG_CACHEABLE_PREFETCHABLE.
Fix this by checking the bit in SpecificFlag to select PciBarTypePMem32 or
PciBarTypeMem32, consistent with DumpPpbPaddingResource() in
PciEnumeratorSupport.c that uses the bit as the sole discriminator
between the two 32-bit BAR types.
Signed-off-by: Phil Noh <Phil.Noh@amd.com>
In arguments of EFI_PCI_IO_PROTOCOL member functions, replace the
EfiPciWidth* enum literals from
EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_WIDTH with the matching
EfiPciIoWidth* values from EFI_PCI_IO_PROTOCOL_WIDTH.
This keeps the call sites aligned with the protocol they actually use.
The old values were copied from EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL code,
so they obscured the intent of the calls and relied on an explicit
cast.
This mimics commit 8ba64a9a94 ("UefiPayloadPkg: Fix build failure with
CLANGPDB").
Generated by coccinelle script.
``` smpl
@initialize:python@
@@
def to_pci_io_width(name):
return name.replace("EfiPciWidth", "EfiPciIoWidth", 1)
@normalize@
typedef EFI_PCI_IO_PROTOCOL;
typedef EDKII_PCI_DEVICE_PPI;
type T =~ "^EFI_PCI_IO_PROTOCOL_WIDTH$";
EFI_PCI_IO_PROTOCOL *x;
EDKII_PCI_DEVICE_PPI *y;
identifier bad =~ "EfiPciWidth(Uint|FifoUint|FillUint)(8|16|32|64)";
identifier top_op =~ "^(PollMem|PollIo|CopyMem)$";
identifier space =~ "^(Mem|Io|Pci)$";
identifier rw =~ "^(Read|Write)$";
fresh identifier good = script:python(bad) { to_pci_io_width(bad) };
expression first;
expression list rest;
@@
(
x->top_op
|
y->PciIo.top_op
|
x->space.rw
|
y->PciIo.space.rw
) (
first,
- (T)bad
+ good
,
rest
)
```
Verified with:
- `build -p MdeModulePkg/MdeModulePkg.dsc -m MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf -a IA32 -b DEBUG -t GCC`
- `build -p MdeModulePkg/MdeModulePkg.dsc -m MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf -a X64 -b DEBUG -t GCC`
Signed-off-by: Mingjie Shen <shen497@purdue.edu>
Commit 43e306806e added support
to DXE Core for EfiUnacceptedMemoryType. However, it incorrectly
added EFI_GCD_MEMORY_TYPE_UNACCEPTED to gMemoryTypeInformation,
which is the GCD memory type that is associated with
EfiUnacceptedMemoryType. All other changes from that PR
appear correct.
This is corrected to the EFI memory type.
The Memory Bin Google Test copied this incorrect definition,
so it is updated as well.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
Certain devices require immediate follow-up commands
after reading the LANGID string to fetch Manufacturer,
Product, or SerialNumber strings.
[Suggested Solution]
These strings are now cached after initial retrieval
to allow UsbIoGetStringDescriptor() to return them
directly, improving efficiency and stability.
Signed-off-by: Marlboro Chuang <marlboro.chuang@dell.com>
Signed-off-by: Jared Pan <jared.pan@dell.com>
The patch enhances the USB enumeration process in EDK2 to improve compatibility with non-standards-compliant devices that may fail during standard enumeration sequences.
The suggested solution is based on USB specifications and references implementations from both Linux and Windows environments.
[Suggested solution]
- Integrated a retry mechanism to sequentially execute enumeration scripts, inspired by the enumeration flows of Windows, Linux, and EDK2. This improves robustness when handling corner-case devices.
- Do sanity check while the device report the device descriptor.
- AMD XHCI might need to wait for more time while sending the CLEAR_FEATURE reuqest.
Signed-off-by: Marlboro Chuang <marlboro.chuang@dell.com>
Signed-off-by: Jared Pan <jared.pan@dell.com>
IsPciDeviceRejected() masks BAR value with 0xFFFFFFF0 before testing
the type bits (2:1) that mark a 64-bit memory BAR, essentially clears
them, making the 64-bit BAR code path unreachable and treated as if
it were 32-bit.
The function rejects a device when BAR looks unprogrammed by comparing
if its size mask equals its value. When a 64-bit BAR is mistaken for a
32-bit one, only its lower part is compared, possibly leading a valid
BAR being falsely rejected. For example, a 2G BAR with size mask
0x80000000 at 0x180000000 matches and the device is dropped.
This code runs during light enumeration (PciEnumeratorLight), used when
PCI resources are already assigned by the platform (e.g. Xen HVM, where
hvmloader programs the BARs). The rejected device never receives a
PciIo handle, so no driver can bind to it. For example, a virtio-vga
with a 64-bit BAR vanishes under OVMF on Xen, leaving the guest with
no graphics output.
Fix by testing the type bits on the raw BAR value before masking.
Signed-off-by: Jiaqing Zhao <Zhao.Jiaqing@amd.com>
CxlDxe is currently compiled as part of the MdeModulePkg
IA32 CI. When running CI with VS2022 version 14.44.35228.0,
the CI build fails with:
CxlDxe.lib(CxlDxe.obj) : unresolved external symbol __allmul
CxlDxe(CxlDxe.obj) : unresolved external symbol __allshl
CxlDxe is not intended to run on IA32 DXE systems, as such
systems are legacy, but until edk2 drops build support for
IA32 DXE (or at least CI for it), the build needs to work.
This fixes the 64 bit multiplication/shifting that occurs
in CxlDxe to use the BaseLib functions that avoid the
compiler intrinsics.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
The PCI specification normally requires function 0 to be present
before functions 1 through 7 are used. PciBusDxe therefore stops
scanning a slot when probing function 0 fails.
Some virtualized PCI topologies may expose selected non-zero functions
to a guest while function 0 is hidden. Add an opt-in Feature PCD so a
platform can continue collecting device information for functions 1
through 7 when function 0 is absent.
The default remains FALSE, so existing platform behavior is unchanged
unless the platform explicitly enables the PCD.
Signed-off-by: Dongyan Qian <qiandongyan@loongson.cn>
If memory bins are enabled for PEI, PEI will produce
Memory Allocation HOBs marked with gEfiMemoryTypeInformationGuid.
If these exist, DXE core will now process the stats from them
to have accurate numbers.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
This commit adds opt-in support for post-mem PEI memory bins.
See the README for full details.
MemoryBin.c is duplicated to PeiCore per request.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
This commits splits out logic currently contained in
Gcd.c and Page.c to a new file called
MemoryBin.c. This is set up in preparation to
add support to PEI for memory bins (an S4 resume stability
feature).
MemoryBin.c takes all global state in as parameters so that
DXE core can use globals and PEI core can use HOBs.
There is no logic change here, just consolidating the
functionality to share with PEI.
This was requested not to be a library.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
This commit adds a parameter to the memory bin allocation function
to tell it whether it should create the Resource Descriptor HOB
owned by gMemoryTypeInformationGuid. This will be used by PEI to
tell DXE where the memory bins are.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
This adds a helper function to initialize the
memory bin statistics as the same logic is
repeated in several places.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
Migrate CoreSetMemoryTypeInformationRange() to not use globals so
it can be used in PEI as well.
This temporarily moves the EFI_MEMORY_STATISTICS structure to
DxeMain.h so that it can be used in Gcd.c as well as Page.c.
This will migrate to a different private header once that is included.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
In preparation for sharing logic with PEI, create a helper
function to update the memory bin statistics.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
In preparation for sharing logic with PEI for memory bins,
add AllocateMemoryTypeInformationBins().
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
In preparation for sharing memory bin logic with PEI, create a
helper function that finds and validates a resource descriptor
HOB owned by gEfiMemoryTypeInformationGuid.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
In preparation for supporting shared memory bin logic in DXE
and PEI, create a PopulateMemoryTypeInformation() helper function.
This function searches for a Memory Type Information Hob and
populates an EFI_MEMORY_TYPE_INFORMATION struct with it.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
In preparation for sharing memory bin logic between
PEI and DXE, update CaclulateTotalMemoryBinSizeNeeded()
to take gMemoryTypeInformation by reference.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
In CxlWriteRegblockRegisters() and PciUefiMemReadUInt32Array(),
Status is only assigned inside the for loop but is returned after
the loop exits, causing an uninitialized variable warning. Return
immediately on error to fix this.
Signed-off-by: Tuan Phan <tuan.phan@oss.qualcomm.com>
In SdPeimIdentification(), the compiler may inline SdPeimHcRwMmio()
because it only performs simple MMIO reads and writes. When inlined, the
fourth argument can appear to follow multiple control-flow paths
(MMIO read versus MMIO write), which may cause the compiler to report
a potential uninitialized variable warning when the value is used
later if it was not initialized up front.
Add an explicit Status check, consistent with other code in this file,
to make the control flow explicit and eliminate the compiler warning.
Signed-off-by: Tuan Phan <tuan.phan@oss.qualcomm.com>
In NetworkCommonDriverStart(), if gPxe is not NULL, TmpPxePointer should
be initialized as it is referenced later in the clean up code.
Signed-off-by: Tuan Phan <tuan.phan@oss.qualcomm.com>
In GetEraseTypeRecord(), ensure ValueToCompare is initialized on all
code paths to prevent uninitialized variable warnings.
In SpiReadSfdpPtp(), return an error code immediately if any
iteration of the for loop fails, otherwise return EFI_SUCCESS
on success at the end of function.
Signed-off-by: Tuan Phan <tuan.phan@oss.qualcomm.com>
Fix the GCD memory type selection logic in DXE GCD initialization so persistent memory correctly takes precedence over special-purpose memory when both attributes are present.
The existing code/comment said persistent should win, but the condition order allowed special-purpose to overwrite persistent. This change swaps the checks so behavior matches the intended precedence and comment.
Signed-off-by: Sureshkumar Ponnusamy <sponnusamy@microsoft.com>
The debug message introduced by PR#12282 was printed at DEBUG_INFO level,
which caused screen corruption in the UEFI Shell when running in DEBUG
mode. Change the print level to DEBUG_VERBOSE to keep the Shell output
clean during normal DEBUG builds while still retaining the message for
verbose debugging scenarios.
Signed-off-by: Qihang Gao <gaoqihang@loongson.cn>
Cc: Evgenii Shatokhin <euspectre@gmail.com>
Currently, the DXE dispatcher will skip extracting an FV file
when an FV2 HOB is found for it, as that indicates pre-DXE
extracted it.
However, the dispatcher does not check for FV3 HOBs, which also
can describe extracted FVs. That can result in extracting the
same FV in DXE that is already extracted, which can be a large
performance hit.
This updates the DXE dispatcher to check for the existence of
either an FV2 or FV3 HOB for this FV and skip extracting if either
is found.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
Move the ACPI table helper macros from EmbeddedPkg's AcpiLib.h to
MdeModulePkg's AcpiHelperMacros.h.
These macros describe ACPI data initializers and do not depend on the
AcpiLib library interface. Keeping them in AcpiLib.h forces users that
only need the macros to include the AcpiLib library header unnecessarily.
Place the macros in a common MdeModulePkg public header so ACPI table
producers can include the macro definitions directly without implying
use of AcpiLib.
The companion edk2-platforms change is:
"Global: Include AcpiHelperMacros.h for ACPI helper macros"
Tested:
DynamicTablesPkg: X64/AARCH64 DEBUG/RELEASE/NOOPT
MdeModulePkg: X64/AARCH64 DEBUG/RELEASE/NOOPT
EmbeddedPkg: X64/AARCH64 DEBUG/RELEASE/NOOPT
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Varshit Pandya <varshit.pandya@arm.com>
Currently, there is no guarantee that the memory bins will be
allocated contiguously. However, there are assumptions in the
code that bins are allocated contiguously, such as the GCD
init code requiring a free memory region be large enough for
a contiguous bin range on DXE Core init.
Ensuring contiguous bins also makes a cleaner model for the
bins and keeps the memory map in a more standard configuration
between different configurations, as platforms today can
pass a resource descriptor HOB to DXE core to describe the bin
range and this only supports a contiguous range.
This also sets up reusing the memory bin logic for PEI memory
bin support which will use the aforementioned resource descriptor
HOB to pass the bin range to DXE.
This commit updates CoreAddMemoryDescriptor() to
allocate a contiguous range.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
Prevent recursive invocation of the PEI Report Status Code (RSC) Router that can lead
to system hang or unexpected re-entrancy behavior during early boot. The defect
was observed when PEI modules reported status codes while the router was already
processing a previous request.
This patch aligns PEI behavior with the robust RSC routing mechanisms already used
in DXE and Runtime phases by adding a lightweight recursion guard to the PEI router.
This ensures consistent behavior across boot stages and improves early-boot
stability.
Signed-off-by: Jared Pan <jared.pan@dell.com>
Update CoreLoadImageCommon to return EFI_NOT_FOUND instead of
EFI_INVALID_PARAMETER when both SourceBuffer and DevicePath are NULL.
UEFI 2.11 specification requires this change for LoadImage().
Signed-off-by: jie.fu <jie.fu@cixtech.com>
According to INF specification, UEFI_DRIVER and UEFI_APPLICATION
cannot have Depex section. So remove it.
Signed-off-by: Qihang Gao <gaoqihang@loongson.cn>
Off by one error in the code of NvmExpressMediaClear() causes the last
LBA to be missed when clearing the media.
This patch fixes the issue by adjusting the loop condition to ensure
that all LBAs are cleared properly.
Signed-off-by: Sean Brogan <sebrogan@microsoft.com>
CoreSetMemoryTypeInformationRange() currently calculates the bin
size needed independently from the CalculateTotalMemoryBinSizeNeeded()
function. This commit updates to use that function and remove the
duplication.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
Currently CalculateTotalMemoryBinSizeNeeded() does not take
runtime alignment granularity considerations into account. This
means that the GCD initialization code can choose resource desc
HOBs to use for the bin region that are actually too small and
fail to initialize the bins.
This fixes CalculateTotalMemoryBinSizeNeeded() to take the
alignment requirements into consideration, both for size and for
alignment of the bin address range.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
