12828 introduced an ASSERT in HiiGetBrowserData() that fires when
InternalHiiBrowserCallback() returns NULL. This is a valid return
value indicating the browser has no data for the requested variable,
and callers already handle this by checking the FALSE return value.
The ASSERT is incorrect because it triggers on a non-error path,
causing a crash when the browser callback legitimately returns no data.
Remove the unnecessary ASSERT while keeping the existing FALSE return
so callers continue to handle this case gracefully.
Cc: Qihang Gao <gaoqihang@loongson.cn>
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
https://github.com/github/codeql/blob/codeql-cli-2.7.3/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.qhelp
Some local variables, when going through a code path, can
end up uninitialized (using the value they had at the start
of the function). This is generally due to an error path
that can occur based on the library instances, or the
unchecked error (i.e. a allocation failing).
These variables should be initialized with a known value
that will result in the function being able to exit
gracefully.
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
In case EntryPointStructure does not exist yet use a length of zero instead of
skipping the check altogether. Fixes a heap overflow in the following code
flow in case the first smbios table installed is larger than
SMBIOS_TABLE_MAX_LENGTH.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Dispatch Shutdown Notification to every NVMe first, then polling
every NVMe t omaake sure all NVMe's shutdown processing is
completed.This will help to save a lot time when BIOS trigger
reset for Servers whose have many NVMes. Tested on a platform
with AMD EPYC cpu with 26 NVMes, this method reduce reset time
from 3 minutes to 10 seconds.
Signed-off-by: Theo <theo.tao@foxmail.com>
MemoryBinGoogleTest.PopulatesFromValidHob asserted fixed page counts for
each memory type. PopulateMemoryTypeInformation, however, rounds the
runtime memory types (EfiReservedMemoryType, EfiACPIMemoryNVS,
EfiRuntimeServicesCode, EfiRuntimeServicesData) up to
RUNTIME_PAGE_ALLOCATION_GRANULARITY. That granularity equals EFI_PAGE_SIZE
on IA32/X64, so the hard-coded values happened to match, but it is 64 KiB
on AArch64, where the same inputs round up to different page counts and the
test failed.
Compute the expected page counts with the same granularity rounding the
production code uses, so the test passes on all host architectures instead
of only x86.
Signed-off-by: Jeff Brasen <jbrasen@nvidia.com>
UsbSelectConfig will introduce the UsbConnectDriver call.
If this UsbPortReset is happened in the Usb device driver Start() routine and the device FW can not be recovered by PortReset, the UsbSelectConfig will introduce the recursive loop.
[Suggested solution]
Since UsbPortReset should not change the Bus Topology, the Reset flow should only SetAddress and reconfigure the device.
Signed-off-by: Marlboro Chuang <marlboro.chuang@dell.com>
Signed-off-by: Jared Pan <jared.pan@dell.com>
In some VS22 versions, these code patterns (assiging the scalar in
a loop) have been found to be converted into calls to the `memcpy`
intrinsic. This change updates them to use CopyMem to avoid the
potential error.
Previous:
- MSVC version: 14.31.31103
New:
- MSVC version: 14.32.31326
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type
If the narrow type (smaller range) is compared against a wide type
(larger range), the narrow value may overflow before reaching the wide
value. This can cause unexpected behavior, such as:
Infinite loops (loop condition never becomes false).
Incorrect logic (comparison results are misleading).
Signed-off-by: Aaron Pop <aaronpop@microsoft.com>
In preparation for the MarkdownLintCheck plugin being added to the
repo, this change defaults the plugin to `AuditOnly` mode in each
package. This allows package maintainers to enable the plugin as they
see fit.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
Some SuperSpeed-capable devices may fall back to High-Speed
mode and cause subsequent commands to fail.
[Suggested Solution]
Check the BOS descriptor to verify SuperSpeed support and
trigger a port reset if needed to re-enumerate the device
properly.
Signed-off-by: Marlboro Chuang <marlboro.chuang@dell.com>
Signed-off-by: Jared Pan <jared.pan@dell.com>
USB devices whose configuration descriptor TotalLength exceeds 1024
bytes (e.g. IR cameras with large descriptor tables) previously hit
an EFI_DEVICE_ERROR hard-limit and failed to enumerate in PEI.
Replace the fixed array with a UINT8 * pointer and dynamically
allocate the exact amount of memory required via
PeiServicesAllocatePool() after the TotalLength is learned from the
initial 4-byte descriptor probe.
Signed-off-by: Damien Chen <damien.chen@dell.com>
Commit 7f505d377b in 2024 added the
Type 4 field SocketType. Bump the default SMBIOS version to 3.8
in order for the larger table size to be valid.
Signed-off-by: Rebecca Cran <rebecca@bsdio.com>
Extend the GptLib host-based tests with negative cases that guard the
security hardening in PartitionValidGptTable(), PartitionCheckGptEntry()
and PartitionRestoreGptTable() against future regressions. These tests
exercise the shared parser, not the specific fix itself.
The new cases drive the parser with malformed GPT structures that an
attacker may present: bad signature/revision, header-size boundaries,
CRC corruption, MyLBA replay, zero/non-power-of-two entry sizes, LBA
multiplication overflow, out-of-range and overlapping entries, and
restore failure on write-protected media. The INF file header is
updated to note the added malformed coverage.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
Add the positive-path host-based tests for the shared GptLib parser
(extracted as part of the parser security hardening), ensuring the
tightened checks in PartitionValidGptTable(), PartitionCheckGptEntry()
and PartitionRestoreGptTable() do not falsely reject well-formed GPTs.
The tests run against an in-memory mock disk and cover accepted
primary/backup headers, boundary but legal header/entry sizes, correct
entry-status flagging on valid entries, and primary/backup restore
round-trips.
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
When the primary GPT is invalid, PartitionInstallGptChildHandles()
restores it from the backup and re-validates it. Both the restore write
and the re-validation can fail (e.g. write-protected media, or a backup
AlternateLBA pointing beyond the device), yet the existing code only logs
the failure and parses partitions from a known-invalid PrimaryHeader.
Abort GPT processing when either the restore or the validation fails, so
partitions are only ever parsed from a validated primary GPT. The backup
recovery branch is left unchanged, as the primary is already validated.
A device with an unrecoverable primary GPT now installs no child handles
instead of using an invalid header. This keeps the table PartitionDxe uses
in sync with the one DxeTpm2MeasureBootLib measures into PCR[5].
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
PartitionValidGptTable() checked the signature, header CRC32, MyLBA, the
entry-array CRC32 and the entry-array size overflow, but not several other
UEFI-mandated GPT header constraints. DxeTpm2MeasureBootLib used to enforce
these via Tpm2SanitizeEfiPartitionTableHeader(); once it switched to this
shared parser, the checks were lost on the path.
Also reject a header unless Header.Revision is GPT_HEADER_REVISION_V1,
HeaderSize is at least the 92-byte minimum, NumberOfPartitionEntries is
non-zero, SizeOfPartitionEntry is 128 * 2^n, and PartitionEntryLBA *
BlockSize cannot overflow. The "entries lie before FirstUsableLBA" rule is
intentionally omitted, as this routine also validates the backup header
whose entry array follows the usable region.
This restores the validation the measurement path lost and, because GptLib
is shared, tightens PartitionDxe the same way: malformed headers are now
rejected and the parse and measure paths stay identical.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
As reported in CVE-2024-13745 via oss-sec, DxeTpm2MeasureBootLib can
measure a partition table that differs from the one parsed by the
PartitionDxe driver.
To address this, the more complete GPT parsing logic from PartitionDxe
is extracted into a standalone GptLib library so it can be
shared between PartitionDxe and DxeTpm2MeasureBootLib. This ensures
that the exact same partition table measured into PCR[5] is the one
parsed and used by the system. PartitionDxe behavior is unchanged.
Ref: https://seclists.org/oss-sec/2026/q2/727
Signed-off-by: Richard Lyu <richard.lyu@suse.com>
The direct message arguments stripped off the header, making the
underlying FF-A function interface to lose information when it comes to
certain return code, i.e. FFA_YIELD and FFA_INTERRUPT.
This change adds back the header field for this purpose so that the
callers can decide how to act on the corresponding return codes.
It then populates the header field for this purpose in FFA direct
message functions so that the callers can decide how to act on the
corresponding return codes.
Continuous-integration-options: PatchCheck.ignore-multi-package
Signed-off-by: Kun Qin <kun.qin@microsoft.com>
When UpdatePciInfo() downgrades a PciBarTypePMem64 BAR to a 32-bit type
via EFI_INCOMPATIBLE_PCI_DEVICE_SUPPORT_PROTOCOL, it unconditionally
assigns PciBarTypePMem32 regardless of SpecificFlag, placing the BAR in
the prefetchable bridge window even when the platform intended the
non-prefetchable window.
The ACPI resource descriptor's SpecificFlag field encodes the intended
prefetchability of the constrained resource, using the bit:
EFI_ACPI_MEMORY_RESOURCE_SPECIFIC_FLAG_CACHEABLE_PREFETCHABLE.
Fix this by checking the bit in SpecificFlag to select PciBarTypePMem32 or
PciBarTypeMem32, consistent with DumpPpbPaddingResource() in
PciEnumeratorSupport.c that uses the bit as the sole discriminator
between the two 32-bit BAR types.
Signed-off-by: Phil Noh <Phil.Noh@amd.com>
In arguments of EFI_PCI_IO_PROTOCOL member functions, replace the
EfiPciWidth* enum literals from
EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_WIDTH with the matching
EfiPciIoWidth* values from EFI_PCI_IO_PROTOCOL_WIDTH.
This keeps the call sites aligned with the protocol they actually use.
The old values were copied from EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL code,
so they obscured the intent of the calls and relied on an explicit
cast.
This mimics commit 8ba64a9a94 ("UefiPayloadPkg: Fix build failure with
CLANGPDB").
Generated by coccinelle script.
``` smpl
@initialize:python@
@@
def to_pci_io_width(name):
return name.replace("EfiPciWidth", "EfiPciIoWidth", 1)
@normalize@
typedef EFI_PCI_IO_PROTOCOL;
typedef EDKII_PCI_DEVICE_PPI;
type T =~ "^EFI_PCI_IO_PROTOCOL_WIDTH$";
EFI_PCI_IO_PROTOCOL *x;
EDKII_PCI_DEVICE_PPI *y;
identifier bad =~ "EfiPciWidth(Uint|FifoUint|FillUint)(8|16|32|64)";
identifier top_op =~ "^(PollMem|PollIo|CopyMem)$";
identifier space =~ "^(Mem|Io|Pci)$";
identifier rw =~ "^(Read|Write)$";
fresh identifier good = script:python(bad) { to_pci_io_width(bad) };
expression first;
expression list rest;
@@
(
x->top_op
|
y->PciIo.top_op
|
x->space.rw
|
y->PciIo.space.rw
) (
first,
- (T)bad
+ good
,
rest
)
```
Verified with:
- `build -p MdeModulePkg/MdeModulePkg.dsc -m MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf -a IA32 -b DEBUG -t GCC`
- `build -p MdeModulePkg/MdeModulePkg.dsc -m MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf -a X64 -b DEBUG -t GCC`
Signed-off-by: Mingjie Shen <shen497@purdue.edu>
Commit 43e306806e added support
to DXE Core for EfiUnacceptedMemoryType. However, it incorrectly
added EFI_GCD_MEMORY_TYPE_UNACCEPTED to gMemoryTypeInformation,
which is the GCD memory type that is associated with
EfiUnacceptedMemoryType. All other changes from that PR
appear correct.
This is corrected to the EFI memory type.
The Memory Bin Google Test copied this incorrect definition,
so it is updated as well.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
Certain devices require immediate follow-up commands
after reading the LANGID string to fetch Manufacturer,
Product, or SerialNumber strings.
[Suggested Solution]
These strings are now cached after initial retrieval
to allow UsbIoGetStringDescriptor() to return them
directly, improving efficiency and stability.
Signed-off-by: Marlboro Chuang <marlboro.chuang@dell.com>
Signed-off-by: Jared Pan <jared.pan@dell.com>
The patch enhances the USB enumeration process in EDK2 to improve compatibility with non-standards-compliant devices that may fail during standard enumeration sequences.
The suggested solution is based on USB specifications and references implementations from both Linux and Windows environments.
[Suggested solution]
- Integrated a retry mechanism to sequentially execute enumeration scripts, inspired by the enumeration flows of Windows, Linux, and EDK2. This improves robustness when handling corner-case devices.
- Do sanity check while the device report the device descriptor.
- AMD XHCI might need to wait for more time while sending the CLEAR_FEATURE reuqest.
Signed-off-by: Marlboro Chuang <marlboro.chuang@dell.com>
Signed-off-by: Jared Pan <jared.pan@dell.com>
IsPciDeviceRejected() masks BAR value with 0xFFFFFFF0 before testing
the type bits (2:1) that mark a 64-bit memory BAR, essentially clears
them, making the 64-bit BAR code path unreachable and treated as if
it were 32-bit.
The function rejects a device when BAR looks unprogrammed by comparing
if its size mask equals its value. When a 64-bit BAR is mistaken for a
32-bit one, only its lower part is compared, possibly leading a valid
BAR being falsely rejected. For example, a 2G BAR with size mask
0x80000000 at 0x180000000 matches and the device is dropped.
This code runs during light enumeration (PciEnumeratorLight), used when
PCI resources are already assigned by the platform (e.g. Xen HVM, where
hvmloader programs the BARs). The rejected device never receives a
PciIo handle, so no driver can bind to it. For example, a virtio-vga
with a 64-bit BAR vanishes under OVMF on Xen, leaving the guest with
no graphics output.
Fix by testing the type bits on the raw BAR value before masking.
Signed-off-by: Jiaqing Zhao <Zhao.Jiaqing@amd.com>
CxlDxe is currently compiled as part of the MdeModulePkg
IA32 CI. When running CI with VS2022 version 14.44.35228.0,
the CI build fails with:
CxlDxe.lib(CxlDxe.obj) : unresolved external symbol __allmul
CxlDxe(CxlDxe.obj) : unresolved external symbol __allshl
CxlDxe is not intended to run on IA32 DXE systems, as such
systems are legacy, but until edk2 drops build support for
IA32 DXE (or at least CI for it), the build needs to work.
This fixes the 64 bit multiplication/shifting that occurs
in CxlDxe to use the BaseLib functions that avoid the
compiler intrinsics.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
The PCI specification normally requires function 0 to be present
before functions 1 through 7 are used. PciBusDxe therefore stops
scanning a slot when probing function 0 fails.
Some virtualized PCI topologies may expose selected non-zero functions
to a guest while function 0 is hidden. Add an opt-in Feature PCD so a
platform can continue collecting device information for functions 1
through 7 when function 0 is absent.
The default remains FALSE, so existing platform behavior is unchanged
unless the platform explicitly enables the PCD.
Signed-off-by: Dongyan Qian <qiandongyan@loongson.cn>
If memory bins are enabled for PEI, PEI will produce
Memory Allocation HOBs marked with gEfiMemoryTypeInformationGuid.
If these exist, DXE core will now process the stats from them
to have accurate numbers.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
This commit adds opt-in support for post-mem PEI memory bins.
See the README for full details.
MemoryBin.c is duplicated to PeiCore per request.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
This commits splits out logic currently contained in
Gcd.c and Page.c to a new file called
MemoryBin.c. This is set up in preparation to
add support to PEI for memory bins (an S4 resume stability
feature).
MemoryBin.c takes all global state in as parameters so that
DXE core can use globals and PEI core can use HOBs.
There is no logic change here, just consolidating the
functionality to share with PEI.
This was requested not to be a library.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
This commit adds a parameter to the memory bin allocation function
to tell it whether it should create the Resource Descriptor HOB
owned by gMemoryTypeInformationGuid. This will be used by PEI to
tell DXE where the memory bins are.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
