M900 Tiny Dasharo - #728
Draft
mkopec wants to merge 971 commits into
Draft
Conversation
This change look for AIRGAP environment variable and if it is set it
perform airgap build of Dasharo for Odroid H4 and its version for
Intel Boot Guard.
This is required for security, privacy and trainers who would like to
perform 100% offline build.
To make that possible couple requirements have to be fulfilled:
- repository cannot be distcleaned, because it remove all artifacts, the
assumption is that provided repository already has all dependencies
fetched, so only make clean is made before proceeding
- since whole process rely on mounting edk2 as volume inside Dasharo SDK
container, workspace directory to which it would be mount needs proper
permissions otherwise docker will create mountpoint with root
privileges, what cause issues in further use and build process
- finally we take into consideration BUILD_TIMELESS environment
variable, which improve testability of build process and toolchain
change
This change was tested by:
1. cloning relevant version of edk2
2. cloning coreboot, cd coreboot
3. running checkout on ipxe:
docker run --rm --user $(id -u):$(id -g) -v $PWD:/home/coreboot/coreboot \
${DASHARO_SDK} \
make -C /home/coreboot/coreboot/payloads/external/iPXE checkout
4. Build
EDK2_REPO_PATH="${PWD}/../edk2" AIRGAP=1 BUILD_TIMELESS=1 ./build.sh odroid_h4_btg
EDK2_REPO_PATH="${PWD}/../edk2" AIRGAP=1 BUILD_TIMELESS=1 ./build.sh odroid_h4
Upstream-Status: Inappropriate [custom build script]
Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Upstream-Status: Inappropriate [CI workflow and custom build script] Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Upstream-Status: Inappropriate [CI workflow] Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
The NV4X and NS5X ADL are the only with enabled ccache. Disable it for consistency. Also dasharo-sdk v1.6.0 does not have ccache installed which causes the build to fail. Upstream-Status: Inappropriate [custom configs] Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
This corrects change-id I885252a488bd35fc3afef571e6178642a059f883
("soc/intel/fast_spi/mmap_boot.c: allow mapping whole flash"). Looks
like hardware/chipset/ME/whatever limits what can be accessed via the
memory mapping to IFD BIOS region.
Instead of requesting mapping whatever is in front of IFD BIOS region,
add another xlate window for accessing that part of the flash via
implementation in src/soc/intel/common/block/fast_spi/fast_spi_flash.c
Upstream-Status: Pending
Change-Id: I2363f88655461951662c1a6fda9333785527e258
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
- Restart APs after BIOS ACM LOCK_CONFIG - Prepare TXT environment for BIOS ACM LOCK_CONFIG - Set the TXT platform type if CBNT is used - Restart APs after clearing secrets - Invalidate cache and reset system depending on ACM parameters Upstream-Status: Pending Change-Id: Ib57b4c7e60e37a8f48dd528bc5b23f0306b730e1 Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com> Co-authored-by: SergiiDmytruk <sergii.dmytruk@3mdeb.com> Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
This is required for CBnT Upstream-Status: Pending Change-Id: I5e8fd3ae48908da9d7316fb0c453025b216f291c Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
…ching ME image Upstream-Status: Pending Change-Id: I76a4313bbc3a84dff51dfd5d3c74ea98d25db7c6 Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Fix printing minor CBnT error codes Upstream-Status: Pending Change-Id: I5ba0965233783c47e86b8899cf0cab048df14180 Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Add BtG and TXT FSP configuration parameters and add a defconfig for V560TNx with CBnT enabled. Upstream-Status: Pending Change-Id: I84fffa4e4463a2b52f21ae6e768f732ad9cf956d Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Trust that CBnT has set up a safe environment, if NO_XIP_EARLY_STAGES is not set by the platform. Upstream-Status: Pending Change-Id: I29fba8c5beb367feffe49e8cdfee995adec9cfba Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Log CBnT status if CBnT is enabled. Upstream-Status: Pending Change-Id: I938461176812431e46281832393d64b9bb6a64d4 Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
There is no need to have them in RW sections. Upstream-Status: Pending Change-Id: I1cd6bc4dfc862313493b9cb45eb058c41fdc514a Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Enable CBnT with placeholder manifests for NovaCustom laptops. The manifests are replaced with their actual contents by the BtG provisioning scripts. Upstream-Status: Pending Change-Id: I06c57195e08330aa92cce0e25d9555b8b09a792b Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Increase RW_FWID and RO_FRID to accomodate larger FW IDs. Upstream-Status: Pending Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Change-Id: I536b36ec4c1e3c5a0e3912bdc6f04b5a88a12c0c
CbnT does the TPM startup as a part of the ACM execution. It will cause an invalid postinit error on TPM startup in bootblock or verstage. Avoid it by selecting the option to ignore invalid postinit. Upstream-Status: Pending Change-Id: Idf5e481faf7aa21a8cd934957c5e676de1ee0638 Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Log CBnT status if CBnT is enabled. Upstream-Status: Pending Change-Id: I3ef5cc73ac6440bf76457952f9352dd446be8082 Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Enable CBnT on NovaCustom TGL platforms with sample manifests, which are replaced by BtG provisioning scripts. Upstream-Status: Pending Change-Id: I0f5115a752d899b55fe84b58b669bd3841a79588 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Configure the necessary FSP parameters for TXT on Alder Lake Upstream-Status: Pending Change-Id: If301749bdc6ddb12129b7c86f1926c8ad4d07a62 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Enable CBnT with sample manifests on NovaCustom ADL platforms. The sample manifests are replaced with their actual contents by BtG provisioning scripts. Upstream-Status: Pending Change-Id: Ifa79f037f86716aa1275e27bdda0db5f1c9b5ec4 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
CBnT requires a larger ME region, so use an FMAP with enlarged ME and shrunken BIOS region with RW-A support only. Upstream-Status: Pending Change-Id: Ib88f34c7479f41792b13dc6df6dd934e8e62488a Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
CBnT has been integrated into the default defconfig, so remove the redundant TXT defconfig. Upstream-Status: Pending Change-Id: Iba0f6952781b85d3cdc2aaf9f6309be68160cff7 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Allow building from source without providing BIOS ACM at build time. Upstream-Status: Pending Change-Id: I249a44816e813ba7c4fc1349ba0532deee04f5b3 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
The bitfield values are: 0 for locality 3, 1 for locality 0. Upstream-Status: Pending Change-Id: I5ac9671d978af70a8a547e63edc2fe8ff894a371 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Allow building from source by not requiring ACMs at build time. ACMs are added at provisioning time by the provisioning scripts. Upstream-Status: Pending Change-Id: Iacc3a1609b4baf051168b4a5b623802117a838d5 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Use public CBnT manifests that have been uploaded to dasharo-blobs. Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: Ia005e36fd16c09784f38abdc3c7a5415fbe8f380 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
- Add missing comment to Clevo NS50PU board - Don't double-check CONFIG(INTEL_TXT) if it's already guarded by the preprocessor Upstream-Status: Pending Change-Id: If5b99655357f055a1b204d1c02c220f9b6a1fc7d Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Originally km_sample was used as the BPM due to a copy-paste error. Upstream-Status: Pending Change-Id: Icc44520ba9da62b15ad1c45c4ed25e98de523412 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I6665532a6c69622e4e8436d9e7fb689534759569 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: Ia3d19e1b745396bc81c5d0888a73810c784ce4a2 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
When picking a persistent name for a network device systemd checks ID_NET_NAME_ONBOARD, ID_NET_NAME_SLOT, ID_NET_NAME_PATH and ID_NET_NAME_MAC udev attributes in this order and uses the first which is present [0]. ID_NET_NAME_ONBOARD is derived (by systemd) from Type 41 records when available. Do not publish the records to force the use of geographical/physical persistent names in ID_NET_NAME_PATH (derived from PCIe paths). This requirement seems to be motivated by compatibility, so considering this a local change. [0]: https://github.com/systemd/systemd/blob/778e95420a66ca34eb78008ccfac6153adf26310/src/shared/netif-util.c#L64 Change-Id: I61d3e7be39eea58a3c736ac97425e0721eefd31f Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
The value of 10 is outdated since smbios_onboard_device_type enumeration was extended with 6 more types in commit f6c100f ("include/smbios.h: Update misc_slot_type and smbios_onboard_device_type"): * SMBIOS_DEVICE_TYPE_WIRELESS_LAN * SMBIOS_DEVICE_TYPE_BLUETOOTH * SMBIOS_DEVICE_TYPE_WWAN * SMBIOS_DEVICE_TYPE_EMMC * SMBIOS_DEVICE_TYPE_NVME * SMBIOS_DEVICE_TYPE_UFS One side-effect of this is that devices with the new types won't have Type 41 SMBIOS records generated for them automatically. Haven't observed this happening, but shouldn't hurt fixing the issue since it has been noticed. Change-Id: Iddaff8f71d9f028cdc9af692370a46e114e47332 Upstream-Status: Pending Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I15b326d4d47b101ce31ecb4e07c5c704c51d89c2 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
ME Soft Disable is not available on this platform, therefore disable the ME menu. Power state after power failure is not implemented, so also hide it. Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I657c63bafdd1463769a8517bbd826671ab7958f9 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Required for the persistent bootsplash functionality. Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I4ad9ff55d4fd3e50c2aa7be63c53bd6a3b773b92 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: Ic5f0f43f48ae7bd13f42d44328ec18eba3194144 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Pending Change-Id: Idb9065444f8da2b7e2c70f6f9cc4ed2c9362f6af Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Inappropriate [custom configs] Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Upstream-Status: Inappropriate [custom configs] Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Upstream-Status: Inappropriate [custom config] Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Upstream-Status: Inappropriate [custom configs] Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Upstream-Status: Inappropriate [custom config] Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I349f3dbaccd8d4aefc0adaec1274770f278eff24 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Member
Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
This fixes EFI runtime services crashing when called by a FreeBSD as it enforces aligned accesses. Change-Id: I55b9965de237dae0f212d46c10fafd5d53d4666e Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Update VBT to one extracted from newer Lenovo UEFI, version FWKTBFA. The newer VBT has build number 1037 and supports Kaby Lake graphics, while the old VBT with build number 1000 only supports Skylake. The old VBT starts with $VBT_SKYLAKE while the new one starts with $VBT_KABYLAKE. TEST=Insert CPU with integrated HD 630 graphics (i3-7100) and check if all video outputs work in firmware. Upstream-Status: Backport Change-Id: I5e108d4ad8bf0663f3e1fa32145e40ea9babeac5 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/84873 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Paul Menzel <paulepanter@mailbox.org> Reviewed-by: Matt DeVillier <matt.devillier@gmail.com> Reviewed-by: Alicja Michalska <ahplka19@gmail.com> Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
It's been observed that at least on some M700 Tiny boards, CLKREQ signals aren't wired as per the schematic. Disable them and configure their pads as per original Lenovo UEFI. This change fixes Wi-Fi card detection on M700 Tiny. TEST=Boot M700 Tiny with AX200 card in Wi-Fi card slot and boot to Windows 10. Check that Wi-Fi works correctly. Upstream-Status: Backport Change-Id: I5b26937cd4a6937b516304fefad9186b9e1cdc76 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/84813 Reviewed-by: Martin L Roth <gaumless@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Backport Change-Id: I259f88a3ceb9aee54016bb88a7d4de2b58dffa83 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/87048 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Matt DeVillier <matt.devillier@gmail.com> Reviewed-by: Paul Menzel <paulepanter@mailbox.org> Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
The power LED may be disabled by GPP_D1. The pin is PWM capable, so configure it in PWM mode with a frequency of 0.5Hz, duty cycle of 50% when entering sleep. The result is that the power LED toggles on/off every second. TEST=Boot to Windows 10, enter S3, and wake. The power LED will blink when system is asleep and glow continuously when awake. Upstream-Status: Backport Change-Id: I121e0ef3e47aec1cacdace3f2af47a3fdacf69cf Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/84860 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Matt DeVillier <matt.devillier@gmail.com> Reviewed-by: Felix Held <felix-coreboot@felixheld.de> Reviewed-by: Paul Menzel <paulepanter@mailbox.org> Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Add Vboot configuration (Kconfig and FMDs for RO only and RW_A layouts). TEST=Build with UEFIPayload and boot to payload. Verify in cbmem logs that verstage has executed and selected Slot A in the case of RW_A layout. Upstream-Status: Backport Change-Id: Ide2a3a4b59be5b27bf7315690520c9392a98d044 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Allow user to select it via menuconfig if they want it. Upstream-Status: Pending Change-Id: Iefe8ec161c1266af3568695f06b5bf500f94f4b1 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Fixes compilation which failed due to missing function definitions for e.g. recovery switch. Upstream-Status: Pending Change-Id: I11b6da0587b3e7f37ed78bb9d5da2bfce7cca9e9 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I1cd6916191ddf45cf5f9c5a82c965e476595c11c Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I530e6e2a46e24e485a39a5cd870f07f47e1216d4 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Change-Id: I3795b154349ddcafd501ed861f2a40ccafc1a74c Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
mkopec
force-pushed
the
m900_tiny_backport
branch
from
September 27, 2025 13:52
70b39fe to
2247965
Compare
Member
Author
|
some observations:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
13 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dasharo enablement and backports of some fixes.