Merge pull request #224 from woa-msmnile/sunflower2333/2402/test

Spring Update 🌱

.github/workflows/all_silicons.yml → .github/workflows/all_platforms.yml

@@ -11,6 +11,15 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+  # Triggers the workflow on pull request
+  pull_request:
+    types: [opened, reopened]
+
+
+# Indicate that we are running in CI
+env:
+  WM_CI_BUILD: true
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -22,29 +31,29 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - uses: actions/checkout@v3
-      - name: build uefi for all devices in all silicons
-        run: bash scripts/container_setup.sh && ./build_uefi.py -s all
+      - name: build uefi for all devices in all platforms
+        run: bash scripts/ci_setup.sh && ./build_uefi.py -p all
 
       - name: Upload Atoll's Artifact
         uses: actions/upload-artifact@v3
         with:
           name: uefi-images-atoll
-          path: Build/AtollPkg/*.img
+          path: Build/AtollPkg/ci_artifacts
 
       - name: Upload Hana's Artifact
         uses: actions/upload-artifact@v3
         with:
           name: uefi-images-hana
-          path: Build/SurfaceDuo1Pkg/*.img
+          path: Build/SurfaceDuo1Pkg/ci_artifacts
 
       - name: Upload Kodiak's Artifact
         uses: actions/upload-artifact@v3
         with:
           name: uefi-images-kodiak
-          path: Build/KodiakPkg/*.img
+          path: Build/KodiakPkg/ci_artifacts
 
       - name: Upload Kailua's Artifact
         uses: actions/upload-artifact@v3
         with:
           name: uefi-images-kailua
-          path: Build/KailuaPkg/*.img
+          path: Build/KailuaPkg/ci_artifacts

.github/workflows/docker_compose_build.yml

@@ -11,6 +11,10 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+# Indicate that we are running in CI
+env:
+  WM_CI_BUILD: true
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -29,4 +33,4 @@ jobs:
         uses: actions/upload-artifact@v3
         with:
           name: uefi-images-all
-          path: Build/*/*.img
+          path: Build/*/ci_artifacts

.github/workflows/sdm845.yml

@@ -11,6 +11,10 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+# Indicate that we are running in CI
+env:
+  WM_CI_BUILD: true
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -23,10 +27,10 @@ jobs:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - uses: actions/checkout@v3
       - name: build uefi for all devices in HoyaPkg.
-        run: bash scripts/container_setup.sh && ./build_uefi.py -d all -s Sdm845
+        run: bash scripts/ci_setup.sh && ./build_uefi.py -d all -p Sdm845
 
       - name: Upload Artifact
         uses: actions/upload-artifact@v3
         with:
           name: uefi-images-sdm845
-          path: Build/*/*.img
+          path: Build/*/ci_artifacts

.github/workflows/sm7125.yml

@@ -11,6 +11,10 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+# Indicate that we are running in CI
+env:
+  WM_CI_BUILD: true
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -23,10 +27,10 @@ jobs:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - uses: actions/checkout@v3
       - name: build uefi for all devices in AtollPkg.
-        run: bash scripts/container_setup.sh && ./build_uefi.py -d all -s Sm7125
+        run: bash scripts/ci_setup.sh && ./build_uefi.py -d all -p Sm7125
 
       - name: Upload Artifact
         uses: actions/upload-artifact@v3
         with:
           name: uefi-images-sm7125
-          path: Build/*/*.img
+          path: Build/*/ci_artifacts

.github/workflows/sm7325.yml

@@ -11,6 +11,10 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+# Indicate that we are running in CI
+env:
+  WM_CI_BUILD: true
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -23,10 +27,10 @@ jobs:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - uses: actions/checkout@v3
       - name: build uefi for all devices in KodiakPkg.
-        run: bash scripts/container_setup.sh && ./build_uefi.py -d all -s Sm7325
+        run: bash scripts/ci_setup.sh && ./build_uefi.py -d all -p Sm7325
 
       - name: Upload Artifact
         uses: actions/upload-artifact@v3
         with:
           name: uefi-images-sm7325
-          path: Build/*/*.img
+          path: Build/*/ci_artifacts

.github/workflows/sm8150.yml

@@ -11,6 +11,10 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+# Indicate that we are running in CI
+env:
+  WM_CI_BUILD: true
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -23,10 +27,10 @@ jobs:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - uses: actions/checkout@v3
       - name: build uefi for all devices in SurfaceDuo1Pkg.
-        run: bash scripts/container_setup.sh && ./build_uefi.py -d all -s Sm8150
+        run: bash scripts/ci_setup.sh && ./build_uefi.py -d all -p Sm8150
 
       - name: Upload Artifact
         uses: actions/upload-artifact@v3
         with:
           name: uefi-images-sm8150
-          path: Build/*/*.img
+          path: Build/*/ci_artifacts

.github/workflows/sm8550.yml

@@ -11,6 +11,10 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+# Indicate that we are running in CI
+env:
+  WM_CI_BUILD: true
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -23,10 +27,10 @@ jobs:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - uses: actions/checkout@v3
       - name: build uefi for all devices in KailuaPkg.
-        run: bash scripts/container_setup.sh && ./build_uefi.py -d all -s Sm8550
+        run: bash scripts/ci_setup.sh && ./build_uefi.py -d all -p Sm8550
 
       - name: Upload Artifact
         uses: actions/upload-artifact@v3
         with:
           name: uefi-images-sm8550
-          path: Build/*/*.img
+          path: Build/*/ci_artifacts

.gitmodules

@@ -1,23 +1,23 @@
 [submodule "MU_BASECORE"]
 	path = MU_BASECORE
 	url = https://github.com/microsoft/mu_basecore.git
-	branch = release/202302
+	branch = release/202311
 [submodule "Common/MU_TIANO"]
 	path = Common/MU_TIANO
 	url = https://github.com/microsoft/mu_tiano_plus.git
-	branch = release/202302
+	branch = release/202311
 [submodule "Common/MU"]
 	path = Common/MU
 	url = https://github.com/microsoft/mu_plus.git
-	branch = release/202302
+	branch = release/202311
 [submodule "Common/MU_OEM_SAMPLE"]
 	path = Common/MU_OEM_SAMPLE
 	url = https://github.com/microsoft/mu_oem_sample.git
-	branch = release/202302
+	branch = release/202311
 [submodule "Silicon/Arm/MU_TIANO"]
 	path = Silicon/Arm/MU_TIANO
 	url = https://github.com/microsoft/mu_silicon_arm_tiano.git
-	branch = release/202302
+	branch = release/202311
 [submodule "Platforms/SurfaceDuoBinaries"]
 	path = Binaries
 	url = https://github.com/woa-msmnile/SurfaceDuoBinaries-fork
@@ -30,6 +30,3 @@
 [submodule "Features/CONFIG"]
 	path = Features/CONFIG
 	url = https://github.com/microsoft/mu_feature_config.git
-[submodule "Platforms/X86EmulatorPkg"]
-	path = Platforms/X86EmulatorPkg
-	url = https://github.com/ardbiesheuvel/X86EmulatorPkg.git

BootShim/BootShim.S

@@ -1,17 +1,19 @@
 _Head:
 	/* Set _Entry address */
-	adr		x1, _Payload // 保存Payload地址到x1
+	adr		x1, _Payload
+
 	/* Jump to the real code */
-	b		_Start       // 跳转到_Start处运行
+	b		_Start
+
 	/* Fake Linux kernel header */
 
 _StackBase:
 	/* Text Offset */
-	.quad UEFI_BASE // UEFI FD 基地址
+	.quad UEFI_BASE
 
 _StackSize:
 	/* Image Size */
-	.quad UEFI_SIZE // UEFI FD 大小
+	.quad UEFI_SIZE
 
 	/* Flags */
 	.quad 0
@@ -31,42 +33,26 @@ _StackSize:
 	/* Reserved */
 	.long 0
 
-// Alignment Patch Start
-_PaddingSize:
-    .quad PADDING_SIZE // 2MB对齐 空白文件大小
-// Alignment Patch End
-
 _Start:
-    adr     x7, _Head       // 保存abl头地址到x7
-	mov		x4, x1          // 将Payload的起始地址保存到x4之中
-	ldr		x5, _StackBase  // 将StackBase保存到x5
-	cmp		x4, x5          // 判断 StackBase是否为UEFI FD地址
-	beq		_Entry          // 如果是，那么就直接跳转到Entry
-	ldr		x6, _StackSize  // 将StackSize 保存到 x6
-
-// 拷贝UEFI FD 到Stack Base, 拷贝的大小为Stack Size
+	mov		x4, x1
+	ldr		x5, _StackBase
+	cmp		x4, x5
+	beq		_Entry
+	ldr		x6,  _StackSize
+
 _CopyLoop:
-	ldp		x2, x3, [x4], #16 // 将x4和 [x4+8] 内地址指向的数据保存到 x2, x3, 同时x4自己偏移16字节
-	stp		x2, x3, [x5], #16 // 将x2, x3 的内容存储到 x5地址指向的内存中，同时x5自己偏移16字节
-	subs	x6, x6, #16       // 将x6 - 16字节 保存到x6, 如果发生借位操作，则将CPSR的C位设置为0
-	b.ne	_CopyLoop         // 判断CPSR的0标志位是否为0，如果不是，就跳转到CopyLoop
-	ldr		x5, _StackBase    // 将StackBase的值保存到x5
-
-// Alignment Patch Start
-_PatchPayLoadAddr:
-    // x1: Payload Addr
-    // x1 + FD Size + Padding Size = Linux Kernel
-    // Linux Utils will add FD Size later.
-    ldr x2, _PaddingSize // 将_PaddingSize中的内容加载到x2中
-    add x1, x1, x2          // 计算x1与x2的和
-// Alignment Patch End
+	ldp		x2, x3, [x4], #16
+	stp		x2, x3, [x5], #16
+	subs	x6, x6, #16
+	b.ne	_CopyLoop
+	ldr		x5, _StackBase
 
 _Entry:
-	br		x5 // 跳向 x5指向的内存地址去执行，也就是StackBase指向的地方(UEFI FD)
+	br		x5
 
 _Dead:
 	/* We should never get here */
-	b		_Dead // 死循环
+	b		_Dead
 
 .text
 .align 4

BootShim/Makefile

@@ -10,6 +10,6 @@ BootShim.bin: BootShim.elf
 	$(OBJCOPY) -O binary $< $@
 
 BootShim.elf: BootShim.S
-	$(CC) -c $< -o $@ -DUEFI_BASE=$(UEFI_BASE) -DUEFI_SIZE=$(UEFI_SIZE) -DPADDING_SIZE=${PADDING_SIZE}
+	$(CC) -c $< -o $@ -DUEFI_BASE=$(UEFI_BASE) -DUEFI_SIZE=$(UEFI_SIZE)
 
 BootShim.S:

Dockerfile

@@ -8,10 +8,10 @@ RUN apt update -y && \
     apt upgrade -y && \
     apt -y install python3-venv pip git build-essential nuget build-essential uuid-dev \
                 iasl nasm gcc-aarch64-linux-gnu python3.10 python3-distutils python3-git python3-pip \
-                gettext locales gnupg ca-certificates python3-venv git git-core clang llvm curl mono-devel
+                gettext locales gnupg ca-certificates python3-venv git git-core clang llvm curl mono-devel lld
 
-ENV CLANG38_BIN /usr/lib/llvm-14/bin/
-ENV CLANG38_AARCH64_PREFIX aarch64-linux-gnu-
+ENV CLANGDWARF_BIN /usr/lib/llvm-38/bin/
+ENV CLANGDWARF_AARCH64_PREFIX aarch64-linux-gnu-
 RUN update-alternatives --install /usr/bin/objcopy objcopy /bin/aarch64-linux-gnu-objcopy 70
 
 RUN rm -rf /var/lib/apt/lists/* \

Platforms/AtollPkg/Atoll.dsc

@@ -30,20 +30,41 @@
   FLASH_DEFINITION               = AtollPkg/Atoll.fdf
 
   # Notice: TRUE == 1, FALSE == 0
-  SECURE_BOOT_ENABLE             = 1
+!if $(SEC_BOOT) == 1
+  SECURE_BOOT_ENABLE             = TRUE
+  DEFAULT_KEYS                   = TRUE
+!else
+  SECURE_BOOT_ENABLE             = FALSE
+  DEFAULT_KEYS                   = FALSE
+!endif
+
   USE_PHYSICAL_TIMER             = 1
-  USE_SCREEN_FOR_SERIAL_OUTPUT   = 1
+  USE_SCREEN_FOR_SERIAL_OUTPUT   = 0
   USE_UART_FOR_SERIAL_OUTPUT     = 0
   USE_MEMORY_FOR_SERIAL_OUTPUT   = 0
   SEND_HEARTBEAT_TO_SERIAL       = 0
   USE_SIMPLEFBDXE                = 1
-  DEFAULT_KEYS                   = TRUE
-  PK_DEFAULT_FILE                = SurfaceDuoFamilyPkg/Include/Resources/pk.bin.p7
-  KEK_DEFAULT_FILE1              = SurfaceDuoFamilyPkg/Include/Resources/kek.bin.p7
-  DB_DEFAULT_FILE1               = SurfaceDuoFamilyPkg/Include/Resources/db.bin.p7
-  DBX_DEFAULT_FILE1              = SurfaceDuoFamilyPkg/Include/Resources/dbx.bin
+
+  PK_DEFAULT_FILE                = SurfaceDuoFamilyPkg/Include/Resources/SecureBoot/keystore/OEMA0-PK.der
+  KEK_DEFAULT_FILE1              = SurfaceDuoFamilyPkg/Include/Resources/SecureBoot/keystore/Kek/MicCorKEKCA2011_2011-06-24.der
+  KEK_DEFAULT_FILE2              = SurfaceDuoFamilyPkg/Include/Resources/SecureBoot/keystore/Kek/microsoft_corporation_kek_2k_ca_2023.der
+  KEK_DEFAULT_FILE3              = SurfaceDuoFamilyPkg/Include/Resources/SecureBoot/keystore/OEMA0-KEK.der
+  DB_DEFAULT_FILE1               = SurfaceDuoFamilyPkg/Include/Resources/SecureBoot/keystore/Db/MicWinProPCA2011_2011-10-19.der
+  DB_DEFAULT_FILE2               = SurfaceDuoFamilyPkg/Include/Resources/SecureBoot/keystore/Db/windows_uefi_ca_2023.der
+  DB_DEFAULT_FILE3               = SurfaceDuoFamilyPkg/Include/Resources/SecureBoot/keystore/Db/MicCorUEFCA2011_2011-06-27.der
+  DB_DEFAULT_FILE4               = SurfaceDuoFamilyPkg/Include/Resources/SecureBoot/keystore/Db/microsoft_uefi_ca_2023.der
+  DBX_DEFAULT_FILE1              = SurfaceDuoFamilyPkg/Include/Resources/SecureBoot/Artifacts/Aarch64/DefaultDbx.bin
+
   DXE_CRYPTO_SERVICES            = STANDARD
+  PEI_CRYPTO_SERVICES            = NONE
+  RUNTIMEDXE_CRYPTO_SERVICES     = NONE
+  SMM_CRYPTO_SERVICES            = NONE
+  STANDALONEMM_CRYPTO_SERVICES   = NONE
   DXE_CRYPTO_ARCH                = AARCH64
+  RUNTIMEDXE_CRYPTO_ARCH         = AARCH64
+  PEI_CRYPTO_ARCH                = NONE
+  SMM_CRYPTO_ARCH                = NONE
+  STANDALONEMM_CRYPTO_ARCH       = NONE
 
 !include AtollPkg/Device/$(TARGET_DEVICE)/Defines.dsc.inc