Skip to content

patina-v22.2.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Jul 00:45
patina-v22.2.1
8eb1e51
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • patina\_dxe\_core: Avoid release panic on unsupported relocation types @makubacki (#1636)
    Change Details
      ## Description

    Resolves #1624

    Right now, a todo!() will cause a panic if a relocation type is encountered that is not supported:

    _ => todo!(), // Other fixups not implemented at this time

    To prevent panics in release builds, this commit replaces the todo!() with return of a new error type UnsupportedRelocation.

    This is used to log an error and return EfiError::Unsupported to the caller (of pecoff::flatten_runtime_relocation_data()).

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • cargo make all (with new unit tests)
    • QEMU ArmVirt & Q35 boot to EFI shell

    Integration Instructions

    • N/A

  • sdk: Prevent unbounded recursion in FFS section extraction @makubacki (#1634)
    Change Details
      ## Description

    Resolves #1623

    Firmware volumes (and FFS sections) are generally trusted coming from signed and verified sources. However, a malformed (or malicious) firmware volume could contain a deeply nested structure of encapsulation sections that would cause unbounded recursion in Section::extract().

    This change limits maximum recursion depth to 16 levels. In practice, only a handful of encapsulation sections are nested in most real-world scenarios.

    A new FirmwareFileSystemError::RecursionLimitExceeded error is added and returned when the limit is exceeded to distinguish this case.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • cargo make all (with new unit tests)
    • QEMU ArmVirt & Q35 boot to EFI shell

    Integration Instructions

    • N/A

  • Constrain `coverage_attribute` unstable feature to coverage runs [Rebase \& FF] @makubacki (#1619)
    Change Details
      ## Description

    Posting commits I made a couple of weeks ago to move the coverage_attribute unstable feature out of usage paths it doesn't need to be in. Removes it from being used in non-coverage tasks.

    Declare coverage_nightly cfg in the workspace Cargo.toml

    cargo-llvm-cov sets the coverage_nightly cfg during coverage runs.

    See the Readme: https://crates.io/crates/cargo-llvm-cov

    This commit declares it once in [workspace.lints.rust] so crates
    can gate the unstable coverage_attribute feature behind it without
    causing the unexpected_cfgs lint to trigger.

    Also drops the now redundant crate-level allow(unexpected_cfgs) in
    patina_performance since the workspace declaration covers it.

    Gate coverage_attribute behind the coverage_nightly cfg

    The coverage_attribute unstable feature is only used to make the
    coverage(off) attribute compile, and coverage(off) only affects
    cargo-llvm-cov instrumentation.

    It is not needed outside of coverage runs (cargo make coverage).

    This commits wraps both the feature gate and every coverage(off)
    attribute in cfg_attr(coverage_nightly, ...) so the unstable feature
    is active only during coverage runs, where cargo-llvm-cov sets the
    coverage_nightlycfg.

    This is documented and the wrapping pattern is suggested in the
    cargo-llvm-cov Readme: https://crates.io/crates/cargo-llvm-cov

    Since #[coverage(off)] is unstable, it is recommended to use it
    together with cfg(coverage) or cfg(coverage_nightly) set by
    cargo-llvm-cov.

    #![cfg_attr(coverage_nightly, feature(coverage_attribute))]

// function
#[cfg_attr(coverage_nightly, coverage(off))]
fn exclude_fn_from_coverage() {
    // ...
}

// module
#[cfg_attr(coverage_nightly, coverage(off))]
mod exclude_mod_from_coverage {
    // ...
}

    This isolates the coverage_attribute feature to coverage runs, so
    the unstable feature is not used in other builds (e.g. check,
    clippy, build, test, etc.).

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • Removed coverage_attribute from the allow-features list and verified non-coverage commands like cargo make test and cargo make check succeed.
    • Verified cargo make coverage passes as-is (RUSTC_BOOTSTRAP=1 + coverage_attribute in -Z allow-features).

    Integration Instructions

    • N/A
  • patina\_ffs\_extractors: Use Decompressed Size Bound Globally @os-d (#1617)
    Change Details
      ## Description

    The LZMA code bounds decompressed section size to 512MB to ensure a corrupted FV does not trigger unbounded memory allocation.

    This commit moves that to the global level and also applies it for Brotli compressed sections.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    N/A.

    Integration Instructions

    Platforms are not expected to have any compressed sections that uncompress to > 512 MB. If so, the limit can be expanded.



🐛 Bug Fixes

  • sdk: Reject device path nodes shorter than the node header @makubacki (#1635)
    Change Details
      ## Description

    Fixes #1626

    The device path walker advanced through nodes using each header's length field without checking that it was at least the size of the 4-byte node header.

    A malformed node with length < 4 made device_path_node_count and remaining_device_path advance by too little (or not at all), re-reading the same node forever.

    This change adds a minimum-length check based on the node header size so both functions return (INVALID_PARAMETER / None) on a short node.

    Some regression tests are added.

    Note: GenericDevicePathNode::new() (and DevicePathWalker) already rejected short nodes using checked_sub().

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • cargo make all (with new unit tests)
    • QEMU ArmVirt & Q35 boot to EFI shell

    Integration Instructions

    • N/A

  • sdk: Prevent underflow and reverse range slicing in FFS section parsing @makubacki (#1631)
    Change Details
      ## Description

    Fixes #1625

    Some code in patina_ffs for parsing sections and files computes content offsets by subtracting header sizes from untrusted size fields, or by slicing between two untrusted offsets, without validating that the declared size is large enough for the header.

    This can produce subtraction underflow and reverse range panics.

    This change uses checked subtraction returning an InvalidHeader error on size mismatches.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • cargo make all
    • QEMU ArmVirt & Q35 boot to EFI shell

    Integration Instructions

    • N/A

  • Prevent panic in CRC32 section extractor on oversized GUID data @makubacki (#1633)
    Change Details
      ## Description

    Fixes #1622

    The CRC32 extractor validated a minimum GUID-specific data length of 4 bytes but then converted the entire slice with try_into::<[u8; 4]>(), which requires exactly 4 bytes. A GUID-defined section whose data_offset placed more than 4 bytes into the GUID data area caused the conversion to fail and the following unwrap() to panic.

    This change slices the first 4 bytes with get(..4) before the conversion so the checksum read is infallible. This handles both the too-short case (clean DataCorrupt error) and the too-long case (only the leading CRC32 bytes are read, per the PI spec).

    Adds tests covering oversized and truncated GUID-specific data.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • cargo make all (with new unit tests)
    • QEMU ArmVirt & Q35 boot to EFI shell

    Integration Instructions

    • N/A

  • Harden HOB parsing [Rebase \& FF] @makubacki (#1632)
    Change Details
      ## Description

    Prevent underflow when calculating GUID HOB data length

    Resolves #1627

    A valid GUID HOB must have a HOB length that coverages at least
    the GUID HOB header. A debug assert is added to catch cases where
    that is not true during develop (debug builds).

    To prevent underflow when the HOB length is reported as
    less than the GUID HOB header size, saturating subtraction
    is used (preventing an oversized slice).

    sdk: Handle malformed HOBs more robustly

    Softens assert_hob_size() in discover_hobs() to avoid panics in
    release builds (ignoring a malformed HOB entry). Malformed entries
    are logged and skipped instead. Debug builds still panic.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • cargo make all (with new unit tests)
    • QEMU ArmVirt & Q35 boot to EFI shell

    Integration Instructions

    • N/A

  • cpu: aarch64: Support EL1 in Exception Handler @os-d (#1629)
    Change Details
      ## Description

    The exception handler currently only supports execution at EL2. Add EL1 support.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Tested by taking exceptions on a platform running at EL1. Prior to this, it would crash accessing the EL2 registers. After this timer interrupts and debugging worked correctly.

    Integration Instructions

    N/A.



  • patina\_internal\_cpu: Prevent sign extension of symbol addresses in x64 interrupt handlers @apop5 (#1620)
    Change Details
      ## Description

    In GAS assembly syntax, lea will create a 32bit absolute address and place it into the register. If the register is a 64 bit register, the value will be signed extended.

    This is a problem if the patina image is loaded above address 0x8000_0000. The 32bit address will be sign extended.

    This was found on a physical platform where patina was loaded into system memory at 0xA000_0000.

    Switch to using RIP relative form syntax.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    On a platform where PEI allocated dxe_core at a higher address, exceptions would occur, but the exception handlers were never reached. After changing assembly syntax, exception handlers were reached.

    Integration Instructions

    No integration necessary.



Full Changelog: patina-v22.2.0...v22.2.1

Contributors

makubacki, os-d, and apop5
Assets 2
Loading