Tianocore/edk2.git/MdeModulePkg, branch dependabot/github_actions/github/codeql-action-4.39.1

MdePkg,MdeModulePkg: Introduce Enter4Byte/Exit4Byte In SpiNorFlashJedecSfdp

2026-10-23T18:55:11+00:00

Follow JESD216H 6.4.19, DWORD 16 Introduce Enter4Byte/Exit4Byte In SpiNorFlashJedecSfdp And SpiNorFlash Fixes: #13171 Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Vincent Ke

MdeModulePkg/LogoDxe: Add support for loading logo from FV

2026-10-23T04:43:48+00:00

Add support for loading logos from FREEFORM FFS files identified by PcdLogoFileGuid. When the PCD is zero or invalid, preserve the existing HII-based logo loading path. When the PCD is valid non-zero, select the logo from the corresponding RAW FFS file in the firmware volume, including compressed and uncompressed section layouts. Key Difference - LogoDxe: HII fallback always works (embedded logo available) - LogoFfsDxe: HII fallback returns EFI_NOT_FOUND (no embedded logo) Update LogoDxe file descriptions, copyright notices, include ordering, and INF annotations. Consolidate module includes into single shared header. Signed-off-by: Thamballi Sreelalitha

MdeModulePkg: Use DUMP_HEX Macro

2026-10-23T03:44:49+00:00

Several places in MdeModulePkg were implementing their own versions of hex dumping logic; use the DebugLib.h macro instead. Prints change slightly, they are now standardized with uppercase hex, prefixes on every row instead of in the header only, and VarCheckHiiLib no longer indents rows with *ASCII*. Signed-off-by: Oliver Smith-Denny

MdeModulePkg/Core: Add resource and GCD verification

2026-10-22T23:28:02+00:00

Add debug verification for Resource Descriptor HOBs. Parse both v1 and v2 Resource Descriptor HOBs, and warn about overlapping ranges. Check I/O resources separately from memory and MMIO resources. Print the complete GCD memory space map starting at address zero and represent any gaps as non-existent memory with These changes are for debug purposes only. Examining the debug output will enable a platform owner to view overlapping resource hobs, and show gaps in the memory map based upon input from the PEI phase. Signed-off-by: Aaron Pop

MdeModulePkg/Core: Add EFI_HOB_RESOURCE_DESCRIPTOR2 support

2026-10-22T23:28:02+00:00

Add IS_RESOURCE_DESCRIPTOR_HOB() and GET_RESOURCE_HOB_ATTRIBUTE() macros to handle both EFI_HOB_TYPE_RESOURCE_DESCRIPTOR and EFI_HOB_TYPE_RESOURCE_DESCRIPTOR2 HOB types. Resource Descriptor v2 HOBs use ResourceCapabilities instead of ResourceAttribute, so they cannot be accessed through the same union member. Update consumers of ResourceDescriptorHobs to understand both EFI_HOB_TYPE_RESOURCE_DESCRIPTOR and EFI_HOB_TYPE_RESOURCE_DESCRIPTOR2. Signed-off-by: Aaron Pop

MdeModulePkg/HobPrintLib: Enable EFI_HOB_TYPE_RESOURCE_DESCRIPTOR2

2026-10-22T23:28:02+00:00

Enable printing EFI_HOB_TYPE_RESOURCE_DESCRIPTOR2 type hobs from HobPrintLib. PrintResourceDiscriptorHob was misspelled. While adding Descriptor2 support, fix up spelling of Descriptor in existing function. Signed-off-by: Aaron Pop

MdeModulePkg: Add BuildResourceDescriptor2Hob to HobLibs

2026-10-22T23:28:02+00:00

Add BuildResourceDescriptor2Hob to HobLib implementations as described in PI 1.10 specification. Signed-off-by: Aaron Pop

MdeModulePkg/UsbBusDxe: Free BOS buffer on read failure

2026-10-21T21:53:42+00:00

UsbGetDevBosDesc() allocates a buffer for the initial BOS descriptor request. If that request fails, the success-only cleanup is skipped and the function returns without freeing the buffer. Repeated enumeration attempts can leak one allocation per failure. Free the initial buffer before returning the transfer error. The leaking retrieval helper was introduced by PR #12714: https://github.com/tianocore/edk2/pull/12714 Signed-off-by: Michael D Kinney

MdeModulePkg/UsbBusDxe: Bound BOS capability parsing

2026-10-21T21:53:42+00:00

UsbIsSSDevice() trusts device-reported NumDeviceCaps and capability Length fields without bounding reads to the BOS buffer. Malformed values can cause out-of-bounds reads and an exception during device enumeration. Validate the BOS header and total length. Before reading each capability, check that its header and declared length fit in the remaining bytes. Reject malformed or truncated descriptors and recognize SuperSpeed only after validating the complete capability list. The unbounded parser was introduced by PR #12714: https://github.com/tianocore/edk2/pull/12714 Signed-off-by: Michael D Kinney

MdeModulePkg/UsbBusDxe: Guard descriptor on SS retry

2026-10-21T21:53:42+00:00

UsbEnumerateNewDev() frees DevDesc before resetting the port for an enumeration retry. UsbRootHubResetPort() scans that device during the reset and previously dereferenced DevDesc without checking it. For a SuperSpeed-capable device running below SuperSpeed, IsSSDev and Speed still satisfy the scan's preceding conditions after DevDesc is cleared. The DeviceClass access can therefore cause a null-pointer exception. Add descriptor checks before those dereferences and clear IsSSDev when freeing the descriptor. The unsafe reset dereference was introduced by PR #12714: https://github.com/tianocore/edk2/pull/12714 Signed-off-by: Michael D Kinney