Reject duplicate ACPI entries and document clean rebuilds

Author: seankd3

README.md

@@ -135,6 +135,15 @@ python3 scripts/build-acpi.py
 
 The build uses the included ACPICA **20260408** source and checks the original tables and the generated ASUS SSDT override against pinned SHA-256 hashes. It rejects other firmware tables and tables that have already been patched. The dump script creates the parent `build/` directory with ownership assigned to the user who will compile the sources. It refuses to overwrite an existing `build/firmware/` directory.
 
+If you generated ACPI files with an older version, retain `build/firmware/` and move the old output aside before rebuilding:
+
+```bash
+mv -T --no-clobber build/acpi build/acpi-before-native-dsdt
+python3 scripts/build-acpi.py
+```
+
+If the backup directory already exists, choose another unused name. The builder refuses to replace different existing output bytes.
+
 Outputs:
 
 ```text

scripts/verify-boot.py

@@ -55,7 +55,7 @@ def verify_image(path):
         raise ValueError('Unzulässige ACPI-Deaktivierung im UKI')
     data = sec['.initrd']
     offset = 0
-    files = {}
+    files = []
     while data[offset:offset + 6] in (b'070701', b'070702'):
         fields = [int(data[offset + 6 + i * 8:offset + 14 + i * 8], 16) for i in range(13)]
         size, namesize = (fields[6], fields[11])
@@ -64,16 +64,16 @@ def verify_image(path):
         start = start + namesize + 3 & ~3
         if not start + size <= len(data):
             raise ValueError('Abgeschnittenes frühes CPIO-Archiv')
-        files[name] = data[start:start + size]
+        if name.startswith('kernel/firmware/acpi/'):
+            files.append((name, data[start:start + size]))
         offset = start + size + 3 & ~3
         if name == 'TRAILER!!!':
             break
-    expected = {'kernel/firmware/acpi/' + name for name in PINS}
-    actual = {name for name in files if name.startswith('kernel/firmware/acpi/')}
-    if actual != expected:
+    expected = sorted('kernel/firmware/acpi/' + name for name in PINS)
+    if sorted(name for name, content in files) != expected:
         raise ValueError('Only the ASUS SSDT override is allowed; use the native firmware DSDT')
-    for name, pin in PINS.items():
-        if not hashlib.sha256(files['kernel/firmware/acpi/' + name]).hexdigest() == pin:
+    for name, content in files:
+        if not hashlib.sha256(content).hexdigest() == PINS[name.removeprefix('kernel/firmware/acpi/')]:
             raise ValueError('Falsche ACPI-Tabelle im UKI: ' + name)
     with tempfile.NamedTemporaryFile() as tmp:
         tmp.write(data)

tests/test_installation.py

@@ -35,25 +35,6 @@ def module(name, filename):
 
 
 class NativeDSDTTests(unittest.TestCase):
-    def test_relocated_dsdt_does_not_change_selected_asus_table(self):
-        ssdt = bytearray(36)
-        ssdt[:4] = b'SSDT'
-        struct.pack_into('<I', ssdt, 4, len(ssdt))
-        ssdt[10:24] = acpi.ASUS_SSDT
-        ssdt[9] = -sum(ssdt) % 256
-        with tempfile.TemporaryDirectory() as tmp:
-            dump = Path(tmp)
-            (dump / 'SSDT9').write_bytes(ssdt)
-            for address in (0x86f50000, 0x86f70000):
-                dsdt = bytearray(40)
-                dsdt[:4] = b'DSDT'
-                struct.pack_into('<I', dsdt, 4, len(dsdt))
-                struct.pack_into('<I', dsdt, 36, address)
-                dsdt[9] = -sum(dsdt) % 256
-                (dump / 'DSDT').write_bytes(dsdt)
-                found = acpi.dumped_tables(dump)
-                self.assertEqual(found, {b'SSDT': {bytes(ssdt): ['SSDT9']}})
-
     def test_initramfs_hook_embeds_only_asus_ssdt(self):
         script = 'source "$1"\nadd_file_early() { printf "%s %s\\n" "$1" "$2"; }\nbuild\n'
         result = subprocess.check_output(
@@ -93,6 +74,12 @@ def output(args, **kwargs):
                                       acpi.member('TRAILER!!!', b'', 0, 3))
                     with self.assertRaisesRegex(ValueError, 'native firmware DSDT'):
                         boot.verify_image('fixture.efi')
+            # A later valid entry must not hide a preceding table under the same path.
+            sec['.initrd'] = (acpi.member('kernel/firmware/acpi/SSDT.aml',
+                                         b'DSDT with stale addresses', 0o100644, 3) +
+                              early + acpi.member('TRAILER!!!', b'', 0, 4))
+            with self.assertRaisesRegex(ValueError, 'native firmware DSDT'):
+                boot.verify_image('fixture.efi')
 
 
 class MenuTests(unittest.TestCase):