patina: normal-boot skip-USB connect and self-gating capsule signaling

[kat-perez]

On the normal boot path, SreBootManager connects the device tree except USB host controllers via connect_all_skip_usb: storage, partitions, filesystems and graphics bind so short-form Boot#### paths resolve through expand_device_path, while USB host controllers (PCI base class 0x0C subclass 0x03) are skipped. A full connect_all second pass guarantees boot if the skip-USB pass leaves the boot device unreachable. bp_has_sre_payload no longer connects the whole tree; connect_all connects each handle once instead of re-sweeping the stable set.

Capsule-queue signaling is extracted from SreBootManager::execute into patina_sre::capsule::process, a self-gating unit: it draws the boot logo and signals gMuReadyToProcessCapsulesNotifyGuid only on a BOOT_ON_FLASH_UPDATE boot and returns immediately otherwise. The boot mode is recorded by the platform binary at core entry from the PHIT HOB via the new patina_boot::boot_mode flag; signal_event_group is factored into patina_sre::events. Signaling runs before EndOfDxe while the flash is writable, using the firmware-management protocols the connect above already bound.

[Copilot]

Pull request overview

This PR updates patina_sre’s normal-boot orchestration to reduce boot-time device enumeration by connecting the device tree while explicitly skipping PCI USB host controllers on the first pass, then falling back to a full-tree connect only if needed. It also gates MU capsule-queue processing behind a flash-update boot mode read via a new proxy protocol entry.

Changes:

• Reworks SreBootManager::execute flow: signal start-of-BDS earlier, dispatch DXE drivers up front, and connect devices on the normal boot path with a “skip USB host controllers” first pass plus a full-tree retry.
• Adds connect_all_skip_usb (PCI class filter) and adjusts connect_all to avoid re-sweeping already-attempted handles across passes.
• Extends the Patina proxy protocol (revision bump) with get_boot_mode and adds is_flash_update_boot() helper to gate flash-update-only work.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
uefi/crates/patina_sre/src/sre_boot_manager.rs	Restructures the boot orchestration, including DXE dispatch timing, capsule gating, and two-pass boot enumeration (skip-USB then full connect).
uefi/crates/patina_sre/src/bp_recovery.rs	Removes whole-tree connect from bp_has_sre_payload, relying on caller-side device connectivity.
uefi/crates/patina_boot/src/proxy.rs	Bumps proxy protocol revision and adds boot-mode query (get_boot_mode) plus is_flash_update_boot().
uefi/crates/patina_boot/src/helpers.rs	Changes connect_all to avoid reconnecting stable handles and introduces connect_all_skip_usb (PCI USB host controller filtering).

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (5)

uefi/crates/patina_sre/src/sre_boot_manager.rs:22

• Step 6 says the normal boot path will boot each Boot#### entry and the constructor main_os_path “in order”, but the implementation only tries main_os_path when Boot#### discovery yields no entries (tried_any == false). Either the docs should reflect that, or the logic should be changed to always attempt main_os_path after Boot#### exhaustion.

//! 6. Normal boot: connect the device tree except USB host controllers (storage,
//!    partitions, filesystems and graphics bind, so short-form `Boot####` paths
//!    resolve; USB port enumeration — not on the boot path — is skipped), then
//!    boot each `Boot####` entry, and the constructor `main_os_path`, in order
//! 7. Safety net: if nothing booted, connect the full tree (including USB) and

uefi/crates/patina_sre/src/sre_boot_manager.rs:11

• The module-level flow description says capsule-queue processing is “on a flash-update boot … (connects the tree …); skipped on a normal boot”, but execute() unconditionally does connect_all_skip_usb and only gates the capsule signal on self.capsule_processing (the capsule processor itself no-ops on normal boots). Updating this bullet to match the actual behavior will avoid misleading future readers.

This issue also appears on line 18 of the same file.

//! 3. Optional capsule-queue processing on a flash-update boot, before EndOfDxe
//!    while the flash is still writable (connects the tree for firmware-
//!    management protocols); skipped on a normal boot

uefi/crates/patina_sre/src/sre_boot_manager.rs:628

• This comment says the normal boot path “connects only its boot device path below”, but execute() already performed a pre-EndOfDxe connect_all_skip_usb (and later may do a full connect_all fallback). Updating the comment will better match the actual connection behavior.

        // connects only its boot device path below.

uefi/crates/patina_sre/src/bp_recovery.rs:818

• The new comment claims the caller “connects the boot device path before calling this”, but the only current caller (SreBootManager) performs a general pre-EndOfDxe connect (connect_all_skip_usb), not a specific boot-device-path connect. Rewording avoids baking in an inaccurate precondition.

    // The NVMe pass-thru protocol is produced by connecting the NVMe
    // controller; the caller connects the boot device path before calling
    // this, so no whole-tree connect is needed here. If NVMe is not connected,
    // the locate below fails cleanly and this returns false.

uefi/crates/patina_boot/src/helpers.rs:275

• connect_all_skip_usb introduces new logic (PCI class probing + skipping USB host controllers + non-recursive connect loop), but there are currently no unit tests covering the skip behavior. Since this module already has helper unit tests (including connect_all tests), adding a focused test would help prevent regressions (e.g., asserting that a handle with PCI class 0x0C/0x03 is not passed to connect_controller).

pub fn connect_all_skip_usb<B: BootServices>(boot_services: &B) -> Result<()> {

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

uefi/crates/patina_boot/src/helpers.rs:270

• connect_all_skip_usb() introduces new PCI-class filtering logic (pci_class / is_usb_host_controller) and changes connect semantics (non-recursive connect, skip set) but there are no unit tests covering the skip behavior (e.g., that a 0x0C/0x03 USB host controller is never passed to connect_controller, while non-USB handles still are). Since this file already has unit tests for connect_all, adding a focused mock-based test for the skip path would help prevent regressions.

/// Connect the device tree but skip PCI USB host controllers. Uses
/// `recursive = false` so each controller is bound individually and USB hosts
/// can be excluded (a recursive connect of the PCI root would bind them as a
/// side effect). Connects storage, partitions, filesystems, and graphics —
/// enough for short-form boot paths to resolve via `expand_device_path` —

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (3)

uefi/crates/patina_boot/src/helpers.rs:314

• connect_all_skip_usb logs at INFO on every boot, which can be noisy in early-boot logs (especially if skipped is often 0). Consider lowering this to DEBUG or logging only when skipped > 0.

    if !stabilized {
        log::warn!("connect_all_skip_usb: did not stabilize within {MAX_ITERATIONS} iterations");
    }
    log::info!("connect_all_skip_usb: skipped {skipped} USB host controller(s)");

uefi/crates/patina_boot/src/helpers.rs:276

• connect_all_skip_usb introduces new behavior (PCI class probing + skipping USB host controllers, plus recursive=false) but there are no unit tests for it, while this file already has unit tests for connect_all. Adding a focused test would help prevent regressions (e.g., verify USB-class handles are skipped and others get connect_controller(..., recursive=false)).

/// Connect the device tree but skip PCI USB host controllers. Uses
/// `recursive = false` so each controller is bound individually and USB hosts
/// can be excluded (a recursive connect of the PCI root would bind them as a
/// side effect). Connects storage, partitions, filesystems, and graphics —
/// enough for short-form boot paths to resolve via `expand_device_path` —
/// without paying for USB port power-on/enumeration.
///
/// Not a full substitute for [`connect_all`]: callers that need USB (recovery,
/// USB boot) must still call [`connect_all`].
pub fn connect_all_skip_usb<B: BootServices>(boot_services: &B) -> Result<()> {
    const MAX_ITERATIONS: usize = 20;

uefi/crates/patina_sre/src/sre_boot_manager.rs:666

• The comment says main_os_path is only used when boot-option discovery yields no entries, but the code also falls back to main_os_path when discover_boot_options returns an error (Err(e) => ... leaves tried_any == false). Please update the comment to match the actual behavior ("yields no entries or fails").

        // Try boot options in two passes. Pass 0 runs after the USB-skip
        // connect. If nothing boots (a boot targets a controller USB-skip left
        // unbound), pass 1 connects the full tree, including USB, and retries —
        // so a normal boot always succeeds. The constructor's `main_os_path` is
        // the fallback when discovery yields no entries.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (2)

uefi/crates/patina_sre/src/sre_boot_manager.rs:589

• Normal-boot path no longer calls helpers::discover_console_devices, so ConIn/ConOut/ErrOut variables may remain unset for the main boot attempts. discover_console_devices is the mechanism patina_boot provides for OS loaders/UEFI apps to discover consoles, and SimpleBootManager runs it unconditionally before attempting boots; gating it behind hotkey != None risks breaking console discovery on the standard boot path.

        // Recovery paths (Vol-Up SRE / bp_recovery, Vol-Down USB) enumerate and
        // display devices beyond the boot chain, so connect the full tree and
        // set up consoles before them. A normal boot (no hotkey) skips both and
        // connects only its boot device path below.
        if hotkey != SreHotkey::None {

uefi/crates/patina_boot/src/helpers.rs:270

• connect_all_skip_usb introduces non-trivial logic (PCI class probing + selective controller connection with recursive = false) but there are no unit tests validating that USB host controllers (class 0x0C03) are actually skipped and that non-USB handles are still connected across passes. Since this affects core boot-time enumeration behavior, adding focused tests would help prevent regressions.

/// Connect the device tree but skip PCI USB host controllers. Uses
/// `recursive = false` so each controller is bound individually and USB hosts
/// can be excluded (a recursive connect of the PCI root would bind them as a
/// side effect). Connects storage, partitions, filesystems, and graphics —
/// enough for short-form boot paths to resolve via `expand_device_path` —