…penDevicePartnership#1402)

## Description

Closes OpenDevicePartnership#583 
Closes OpenDevicePartnership#1396

Adds safety comments to the remaining unsafe blocks in patina_dxe_core
and enables the clippy lint for missing safety docs.

This allows future contributions to have the lint enforced.

- [ ] Impacts functionality?
- [ ] Impacts security?
- [ ] Breaking change?
- [ ] Includes tests?
- [x] Includes documentation?

## How This Was Tested

- `cargo make all` with the `undocumented_safety_blocks` clippy lint
enabled in `patina_dxe_core`

## Integration Instructions

- N/A - Safety comments that have no functional impact

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

This function wraps `efi::Guid::from_bytes()` which is const. It is
made const as well.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

Add Ord and PartialOrd derives to BinaryGuid, enabling its use as a
BTreeMap key.

Adds a test to verify BinaryGuid's derived ordering matches Guid<'a>'s
byte-order comparison for a set of GUID pairs.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

This change adds a few standard GUID definitions. This is to pave way
for later usage in rust supervisor.

Converts all GUID constants, trait associated types, struct fields,
and other uses to Patina GUID types across the codebase.

Key changes:

- GUID constants mostly use `BinaryGuid::from_string()` since strings
  are more readable than fields. In some cases, a field may have been
  a simple numbering sequence like "123456...", in which case it may
  have been left as `from_fields`.
- Changed `ProtocolInterface::PROTOCOL_GUID` changed to use
  `BinaryGuid`, eliminating duplicated GUID values in implementations.
- Updated `FromHob::HOB_GUID` and `HobParser`s `BTreeMap` key to
  `BinaryGuid`.
- Updated `#[repr(C)]` struct fields (GuidHob, FV/FFS headers,
  MM communicate header) to use `BinaryGuid` since it provides
  binary-compatible GUID storage.
- Updated the `FromHob` proc macro to use `BinaryGuid::from_string()`.
- Updated a lot of code to use Patina GUID types instead of the r-efi
  GUID type.

There were a few places, particularly in UEFI Spec FFI interfaces,
where the `efi::Guid` type is still used. This is intentional to
potentially simplify the r-efi 6.0.0 integration. In code that
interacts with those interfaces, `From` and `Into` functions are used
to simply convert between `BinaryGuid` and `efi::Guid`. Some code
that exclusively interacts with those interfaces, might also use
`efi::Guid` for local GUID definitions instead of Patina GUID types.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

writer.rs tests import `crate::reader::AdvancedLogReader`, but
the reader module is conditionally compiled behind
`#[cfg(any(doc, feature = "reader"))]`.

This works when default features are enabled since the "component"
default feature transitively enables "reader".

This change gates `tests` on `#[cfg(all(test, feature = "reader"))]`
so it compiles cleanly when default features are disabled.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

Without `--no-default-features` testing, feature-gate regressions go
undetected. Code that accidentally uses a gated module or dependency
outside its `cfg` fence compiles fine under default features but
breaks for consumers that disable defaults.

Since workspace crates like `patina_ffs_extractors` gate optional
compression backends (brotli, crc32, lzma) behind features, and
`patina/patina_internal_collections` gates alloc-dependent code
behind an "alloc" default, verifying the `--no-default-features` build
is useful to catch accidental dependencies on gated code.

Add a higher level `check-no-default-features` task with two parallel
subtasks:

  - `check-no-default-features-code`:
    - `cargo check --no-default-features`
  - `check-no-default-features-tests`:
    - `cargo test --no-run --no-default-features`

Run the task in `cargo make all`.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

## Description

Current patina_stacktrace is pulling in alloc from source code. However,
as basic functionality as the crate provides, the dependency is
improperly included.

This change removes the dependency.

Resolves OpenDevicePartnership#1410

- [ ] Impacts functionality?
- [ ] Impacts security?
- [ ] Breaking change?
- [ ] Includes tests?
- [ ] Includes documentation?

## How This Was Tested

The change is not a functional change and was tested with local build.

## Integration Instructions

N/A

Clarifies the expectations for contributions that are AI-assisted
to Patina.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

Add some more detail to clarify common misunderstandings about Patina.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

)

## Description

This change guards the usage of allocators behind "alloc" to a few
remaining instances in Patina SDK. So that the crate can provide more
fundamental functionalities without dependencies on allocator.

In addition, it removes the `extern crate alloc;` within the crate and
only declare it in the `lib.rs`, which serves as a central feature
controller that governs the entirety of the crate.

Resolves OpenDevicePartnership#1403

- [x] Impacts functionality?
- [ ] Impacts security?
- [ ] Breaking change?
- [ ] Includes tests?
- [ ] Includes documentation?

## How This Was Tested

This was tested by building a binary without global allocator and booted
to UEFI shell on Q35.

## Integration Instructions

Nothing in addition to building the binary with `--features alloc` if a
binary needs allocator functionality.

Removes the `communicator` pointer from the `ProtocolNotifyContext`
struct and referencing code. This pointer has not been used since a
refactor and is only used for a debug print.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

Replaces `Box<dyn MmExecutor>` with a generic type parameter
(`E: MmExecutor + 'static`) that defaults to `RealMmExecutor`. This
keeps the expected default executor for non-test scenarios while
allowing test code to specify other executor types without needing
to box them.

Generic methods (e.g. `with_executor()` and `set_test_comm_buffers()`)
are split into a separate `impl<E>` block since `#[component]` applies
to the default-type impl only. `Debug` and `MmCommunication` impls are
similarly updated to be generic over `E`.

Unit and integration tests now use concrete executor types directly
instead of boxing them.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

…icePartnership#1421)

## Description

Add a `DxeDispatch` service trait in the SDK and a `CoreDxeDispatch`
implementation in patina_dxe_core that delegates to the PI dispatcher.
The service is registered alongside other core services (MemoryManager,
PerfTimer, etc.) and consumed via dependency injection by components
that need to trigger driver dispatch passes.

- [x] Impacts functionality?
- [ ] Impacts security?
- [ ] Breaking change?
- [ ] Includes tests?
- [ ] Includes documentation?

## How This Was Tested

- Built SBSA DXE core binary with `BootDispatcher` + `SimpleBootManager`
consuming the service via DI
- Booted Windows ARM64 under QEMU SBSA-ref with Patina BDS handling the
full boot flow
- Connect-dispatch interleaving discovered AHCI device, expanded partial
device path, loaded Windows bootloader, ExitBootServices completed
- 106 on-system unit tests passed (0 fails)

## Integration Instructions

The `DxeDispatch` service is registered automatically by the DXE core.
Components consume it via dependency injection:

```rust
fn entry_point(self, dxe_dispatch: Service<dyn DxeDispatch>) -> Result<()> {
    dxe_dispatch.dispatch()?;
    Ok(())
}
```

## Description

Patina internal CPU hosts the interrupt manager and other fundamental
functionalities, which should not work on top of the allocator.

Admittedly, the current crate can support more advanced components that
works on top of exception forwarding, but this should not be treated as
a required dependency.

- [x] Impacts functionality?
- [ ] Impacts security?
- [ ] Breaking change?
- [ ] Includes tests?
- [ ] Includes documentation?

## How This Was Tested

This was tested on QEMU Q35 and booted to UEFI shell.

## Integration Instructions

N/A

…1438)

## Description

The previous
[PR](OpenDevicePartnership#1423) merged
with intermittent testing stability: when the tests are run
concurrently, some tests could fail based on timing. i.e.:

https://github.com/OpenDevicePartnership/patina/actions/runs/23577664570/job/68653514272#step:5:1395

The idea is to put a lock on the test and extend the test to register
and unregister within each individual test.

- [x] Impacts functionality?
- [ ] Impacts security?
- [ ] Breaking change?
- [x] Includes tests?
- [ ] Includes documentation?

## How This Was Tested

This was tested locally and on the pipeline to not trip on the same
error.

## Integration Instructions

N/A

The HII string lookup in `load_resource_section` calculated the string
data offset as `name_offset + 1`, but `DirectoryString` has a
2-byte length field (followed by the string data), so the correct
offset is `name_offset + sizeof(DirectoryString)`.

"Resource Directory String" is defined here in the PE/COFF spec:

https://learn.microsoft.com/windows/win32/debug/pe-format#resource-directory-string

The comparison constant used was `[0x00, 0x48, 0x00, 0x49, 0x00, 0x49]`
which matched the shifted byte sequence from the wrong offset instead
of the correct UTF-16LE bytes for "HII" which is:
`[0x48, 0x00, 0x49, 0x00, 0x49, 0x00]`.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

Today, the code in `load_resource_section` iterates the number of
named entry times but doesn't actually update the `directory_entry`
to the offset for the current iteration. This change makes that
adjustment.

This worked before because images with HII resource sections either
had a sinlge section or the HII section was the first section.

I couldn't find any existing images that have more than one resource
directory entry, so I had to create a simple section with two entries
in the unit test.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

Since `resource_directory_string.length` is a `u16`, a `.length`
value of > 32767 could cause an overflow when multiplied by 2
since the multiplication done before the cast to `usize`.

This change updates the code to perform the multiplication after the
cast to `usize` which is the type the result is assigned to
(the type of `name_end_offset`).

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>

Per RFC 25, this patch adds config.toml enforcement
of the Patina config version.

config.toml is updated to reflect the various settings Patina wants
to use. Each is documented on why.

build.rs verifies the patina config version is the correct one and
will fail the build if not.

Docs are updated.

Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>

Introduce a `Filter` enum with `Include` and `Exclude` variants rather
than a generic string that is only an inclusion filter.

Exclude filters take priority over include filters. If no include
filters are specified, all non-excluded tests run. The match arms in
`should_run` are exhaustive to ensure new variants cause a compile break.

…p#1377)

The patina_test framework was originally developed inside the SDK crate
to keep `patina_macro` as only a dependency for the `patina` crate. As
we have evolved, other patina related crates have taken a dependency on
`patina_macro`, which means the patina_test framework can be it's own
crate.

This has one large benefit: It simplfies feature logic related to
actually enable or disable the tests. There is now a single feature flag
that is off by default (`test-runner`), and this is how test writers will
consume the crate. When a platform wants to register a test runner with
the Core, it will enable the `test-runner` feature flag, which does two
things: (1) Make the `TestRunner` component public and (2) enable a
feature flag in `patina_macro` to actually register all found patina
tests globally.

The second, smaller benefit, is that we are moving some of the non-sdk
logic out of our SDK crate, and this framework makes sense as a
standalone crate.

This commit updates the `Recorder` service to output test results as
both a human readable format and as a json blob so that it can be
more easily parsed by tooling.

Signed-off-by: Patina Automation Bot <patina@microsoft.com>

## Description

Cleans up and clarifies some elements of existing docs, adds a new
section for rules of thumb for synchronization within Patina.

- [ ] Impacts functionality?
- [ ] Impacts security?
- [ ] Breaking change?
- [ ] Includes tests?
- [x] Includes documentation?

## How This Was Tested

Passes md lint.

## Integration Instructions

N/A - documentation.

…nership#1444)

synced local file(s) with
[OpenDevicePartnership/patina-devops](https://github.com/OpenDevicePartnership/patina-devops).

🤖: View the [Repo File Sync Configuration
File](https://github.com/OpenDevicePartnership/patina-devops/blob/main/.sync/Files.yml)
to see how files are synced.



---

This PR was created automatically by the
[repo-file-sync-action](https://github.com/BetaHuhn/repo-file-sync-action)
workflow run
[#23773809455](https://github.com/OpenDevicePartnership/patina-devops/actions/runs/23773809455)

Signed-off-by: Patina Automation Bot <patina@microsoft.com>
Co-authored-by: patina-automation[bot] <196234736+patina-automation[bot]@users.noreply.github.com>

…evicePartnership#1430)

## Description

Allows platforms to provide hardware log level filters for specific log
targets, allowing fine-tuning of the serial port logs. For example,
allows configuring certain info / warn level records to print to serial
when the platform-wide `hw_print_level` is set to error-only.

Implements this by adding a new `hw_filter_override:
Option<log::LevelFilter>` field to the `target_filters` passed to
`AdvancedLogger::new` (which are now a new struct instead of a tuple).
If present, that filter is used for determining whether to print
messages matching the given target prefix to the serial port, instead of
the platform-wide mask from the log header.

Resolves OpenDevicePartnership#1429 

- [x] Impacts functionality?
- [ ] Impacts security?
- [x] Breaking change?
- [x] Includes tests?
- [ ] Includes documentation?

## How This Was Tested

Verified HW filtering behavior works as expected on a physical platform
(ARM).

## Integration Instructions

Change `target_filters` parameter of `AdvancedLogger::new()` to use a
list of the new `TargetFilter` struct instead of the previous tuple of
`(&'a str, log::LevelFilter)`.

For example:
```rust
static LOGGER: AdvancedLogger<UartNull> = AdvancedLogger::new(
   Format::Standard, // How logs are formatted
   &[("allocations", LevelFilter::Off)], // set custom log levels per module
   log::LevelFilter::Info, // Default log level
   UartNull { }, // Serial writer instance
);
```
becomes
```rust
static LOGGER: AdvancedLogger<UartNull> = AdvancedLogger::new(
   Format::Standard, // How logs are formatted
   &[TargetFilter { target: "allocations", log_level: LevelFilter::Off, hw_filter_override: None }], // set custom log levels per module
   log::LevelFilter::Info, // Default log level
   UartNull { }, // Serial writer instance
);
```

---------

Co-authored-by: Thomas Hinds <hindsthomas@microsoft.com>

…mption (OpenDevicePartnership#1413)

## Description

Current patina_mm carries some definitions that can be shared by
external users (mm communication header, buffer status, etc).

This change moves those files to a sub-module that does not require
alloc.

It also separates the supervisor related definitions into its own file.

Resolves OpenDevicePartnership#1437.

- [x] Impacts functionality?
- [ ] Impacts security?
- [ ] Breaking change?
- [ ] Includes tests?
- [ ] Includes documentation?

## How This Was Tested

This was tested with local builds and booted to UEFI shell.

## Integration Instructions

N/A