microsoft/mu_basecore v2025020003.0.1

v2025020003.0.1

Repository: microsoft/mu_basecore

Tag: v2025020003.0.1

Published: 2026-02-04T23:28:19Z

Prerelease: no

Release notes:

What's Changed

[CHERRY-PICK] .pytool: Add uncrustify disable/enable inline strings @makubacki (#1630)

Change Details

Description

Adds strings that can be specified in files to disable/enable uncrustify processing inline.

For example:

// BEGIN_UNCRUSTIFY_DISABLE
...code that should not be processed by uncrustify...
// END_UNCRUSTIFY_DISABLE

(cherry picked from commit 4febebe9c2e8c6b53c2814b2ac113bac1ca335c6)

• [ ] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

• Run uncrustify against code using the strings and verify code exempted from formatting.

Integration Instructions

• N/A

NetworkPkg: DxeNetLib Stability Improvements [Rebase \& FF] @makubacki (#1624)

Change Details

• ## Description

NetworkPkg/DxeNetLib: Initialize MediaState to EFI_NOT_READY

Initializes the MediaState output parameter to EFI_NOT_READY at the start of DxeNetLibGetMediaState(). This ensures that the status only reflects a successful media state after either NetLibDetectMedia() or GetInfomation() confirms media is present.

---

NetworkPkg/DxeNetLib: Make NetLibDetectMedia() calls at TPL_CALLBACK

Ensures that calls to NetLibDetectMedia() in NetLibDetectMediaWaitTimeout() are made at least at TPL_CALLBACK.

There are cases where NetLibDetectMedia() is being called at TPL_APPLICATION and a teardown of the network interface occurring at TPL_CALLBACK can interrrupt the media detection process, leading to errors using the Simple Network Protocol.

---

• [x] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

• PXE server setup on a separate device (TFTP + DHCP)
• On DUT, set PXE boot as the first boot option
• Boot
• Wait for PXE boot over IPv4 to start
• Unplug a USB hub during network media detection

Integration Instructions

• N/A

NetworkPkg: Reset DHCP Service Binding IO Status on Stop @makubacki (#1620)

Change Details

Description

Resets DhcpSb->IoStatus on stop to prevent a stale state from persisting which might impact future operations dependent on the IO status.

• [x] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

• PXE Boot (TFTP + DHCP)

Integration Instructions

• N/A

NetworkPkg/Mtftp4Dxe: Prevent invalid memory dereference on MTFTP poll @makubacki (#1623)

Change Details

Description

Sequence of events:

1. Mtftp4Driver.c: In Mtftp4DriverBindingStart(), Mtftp4CreateService() is called to create the periodic timer event for notification function Mtftp4OnTimerTick() at TPL_CALLBACK. 2. Mtftp4Driver.c: Mtftp4DriverBindingStart() starts the timer by calling gBS->SetTimer (MtftpSb->Timer, TimerPeriodic, TICKS_PER_SECOND) 3. Eventually, Mtftp4Start() is called to interact with a MTFTPv4 server (from a function like EfiMtftp4ReadFile() in EFI_MTFTP4_PROTOCOL) 4. Toward the end of this function the condition Token->Event != NULL returns false, so execution continues to a loop that continuously calls Poll() in EFI_MTFTP4_PROTOCOL while Token->Status == EFI_NOT_READY

In the above sequence, Mtftp4Start() was invoked at TPL_APPLICATION.

Now, the MTFTP protocol functions are being used as needed to transmit and receive data files.

The functions that depend on processing incoming/outgoing data packets all eventually call Mtftp4Start(). These functions include:

• EfiMtftp4ReadDirectory()
• EfiMtftp4ReadFile()
• EfiMtftp4WriteFile()

---

Meanwhile, an unexpected device disconnect can cause teardown of the driver stack to begin. When this happens:

• Mtftp4Driver.c: Mtftp4DriverBindingStop() (at TPL_CALLBACK potentially interrupting an active loop in Mtftp4Start()). Eventually, it enumerates the children on the service binding handle and calls NetDestroyLinkList() with Mtftp4DestroyChildEntryInHandleBuffer() as the callback on each child handle.
• Mtftp4Driver.c: Mtftp4DestroyChildEntryInHandleBuffer() calls ServiceBinding->DestroyChild() which ends up in Mtftp4ServiceBindingDestroyChild()
• Mtftp4Driver.c: Mtftp4ServiceBindingDestroyChild() begins removing protocols from the child handle, eventually uninstalling the gEfiMtftp4ProtocolGuid protocol.

At this point the protocol is uninstalled from the protocol database, but MTFTP4_PROTOCOL Instance itself is still valid until Mtftp4CleanOperation() is called next.

• Mtftp4Driver.c: Mtftp4ServiceBindingDestroyChild() then makes a TPL raise to TPL_CALLBACK (no-op if TPL is already TPL_CALLBACK) and cleans up the MTFTP session:

Mtftp4CleanOperation (Instance, EFI_DEVICE_ERROR); UdpIoFreeIo (Instance->UnicastPort);

RemoveEntryList (&Instance->Link); MtftpSb->ChildrenNum--;

gBS->RestoreTPL (OldTpl); ```

Note: The timer is stopped in `Mtftp4CleanService()` which is called in `Mtftp4DriverBindingStop()` after `Mtftp4ServiceBindingDestroyChild()` is called and `gEfiMtftp4ServiceBindingProtocolGuid` is uninstalled.

It is possible that during `Mtftp4ServiceBindingDestroyChild()` execution, the `Poll()` function is being repeatedly invoked in the wait loop in `Mtftp4Start()` (depending on whether a MTFTP operation is in progress at the time of disconnect).

// // Return immediately for asynchronous operation or poll the // instance for synchronous operation. // while (Token->Status == EFI_NOT_READY) { This->Poll (This); }

It is also possible that it is being invoked at a TPL less than `TPL_CALLBACK`, such as `TPL_APPLICATION` as allowed by UEFI Specification calling restrictions on `MTFTP4` operations which is `TPL_CALLBACK` or lower.

So, it is possible that `This->Poll()` could be interrupted by the disconnect flow and when execution resumes, the instance data `EfiMtftp4Poll` is operating on is invalid.

---

This change raises the TPL to `TPL_CALLBACK` around invocation of `This->Poll()` in `Mtftp4Start()`, preventing interruption by the teardown flow in `Mtftp4ServiceBindingDestroyChild()`.

---

- [x] Impacts functionality?
- [ ] Impacts security?
- [ ] Breaking change?
- [ ] Includes tests?
- [ ] Includes...