Attention is currently required from: Nico Huber, Martin L Roth, Benjamin Doron, Stefan Reinauer, Paul Menzel, Lean Sheng Tan.
Sean Rhodes has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74336 )
Change subject: payloads/edk2: Remove ABOVE_4G_MEMORY option
......................................................................
Set Ready For Review
--
To view, visit https://review.coreboot.org/c/coreboot/+/74336
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I8d5ee79ef3f7ecfcd1463c612aad2e3d629df22a
Gerrit-Change-Number: 74336
Gerrit-PatchSet: 4
Gerrit-Owner: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Reviewer: Benjamin Doron <benjamin.doron00(a)gmail.com>
Gerrit-Reviewer: Lean Sheng Tan <sheng.tan(a)9elements.com>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-CC: Nico Huber <nico.h(a)gmx.de>
Gerrit-Attention: Nico Huber <nico.h(a)gmx.de>
Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Attention: Benjamin Doron <benjamin.doron00(a)gmail.com>
Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Lean Sheng Tan <sheng.tan(a)9elements.com>
Gerrit-Comment-Date: Sun, 30 Apr 2023 20:37:08 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Martin L Roth, Matt DeVillier, Stefan Reinauer.
Sean Rhodes has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74868 )
Change subject: payloads/edk2: Update default branch for MrChromebox repo
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit https://review.coreboot.org/c/coreboot/+/74868
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I096eaa4e065db731a70ba238ba5a3bb49e5db867
Gerrit-Change-Number: 74868
Gerrit-PatchSet: 1
Gerrit-Owner: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Attention: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Comment-Date: Sun, 30 Apr 2023 20:36:36 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Martin L Roth, Matt DeVillier, Stefan Reinauer.
Sean Rhodes has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74869 )
Change subject: payloads/edk2: Add Kconfig to enable UEFI SecureBoot support
......................................................................
Patch Set 1: Code-Review+1
--
To view, visit https://review.coreboot.org/c/coreboot/+/74869
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I4be58c3315cabe08729d717c59203fdc6a3e2958
Gerrit-Change-Number: 74869
Gerrit-PatchSet: 1
Gerrit-Owner: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Attention: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Comment-Date: Sun, 30 Apr 2023 20:36:06 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Martin L Roth, Matt DeVillier, Stefan Reinauer.
Sean Rhodes has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74869 )
Change subject: payloads/edk2: Add Kconfig to enable UEFI SecureBoot support
......................................................................
Patch Set 1: Code-Review+2
(2 comments)
File payloads/external/edk2/Kconfig:
https://review.coreboot.org/c/coreboot/+/74869/comment/797e0ea0_698470aa
PS1, Line 246: feature
support?
https://review.coreboot.org/c/coreboot/+/74869/comment/cee400a7_c683c0ec
PS1, Line 248: default y if EDK2_REPO_MRCHROMEBOX && SMMSTORE_V2
No help text?
--
To view, visit https://review.coreboot.org/c/coreboot/+/74869
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I4be58c3315cabe08729d717c59203fdc6a3e2958
Gerrit-Change-Number: 74869
Gerrit-PatchSet: 1
Gerrit-Owner: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Attention: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Comment-Date: Sun, 30 Apr 2023 20:35:58 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Martin L Roth, Stefan Reinauer.
Matt DeVillier has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/74869 )
Change subject: payloads/edk2: Add Kconfig to enable UEFI SecureBoot support
......................................................................
payloads/edk2: Add Kconfig to enable UEFI SecureBoot support
Now that MrChromebox's default edk2 branch supports SecureBoot, add a
Kconfig to enable it, and do so by default when MrChromebox's branch
is used and SMMSTORE_V2 is enabled.
TEST=build/boot various boards, verify SecureBoot options available in
payload, SecureBoot status reported properly by Linux/Windows.
Change-Id: I4be58c3315cabe08729d717c59203fdc6a3e2958
Signed-off-by: Matt DeVillier <matt.devillier(a)gmail.com>
---
M payloads/external/Makefile.inc
M payloads/external/edk2/Kconfig
M payloads/external/edk2/Makefile
3 files changed, 27 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/69/74869/1
diff --git a/payloads/external/Makefile.inc b/payloads/external/Makefile.inc
index effab43..5f29063 100644
--- a/payloads/external/Makefile.inc
+++ b/payloads/external/Makefile.inc
@@ -188,6 +188,7 @@
CONFIG_ECAM_MMCONF_LENGTH=$(CONFIG_ECAM_MMCONF_LENGTH) \
CONFIG_CPU_XTAL_HZ=$(CONFIG_CPU_XTAL_HZ) \
CONFIG_SMMSTORE_V2=$(CONFIG_SMMSTORE_v2) \
+ CONFIG_EDK2_SECURE_BOOT_SUPPORT=$(CONFIG_EDK2_SECURE_BOOT_SUPPORT) \
GCC_CC_x86_32=$(GCC_CC_x86_32) \
GCC_CC_x86_64=$(GCC_CC_x86_64) \
GCC_CC_arm=$(GCC_CC_arm) \
diff --git a/payloads/external/edk2/Kconfig b/payloads/external/edk2/Kconfig
index 2c8152f..1c00be0 100644
--- a/payloads/external/edk2/Kconfig
+++ b/payloads/external/edk2/Kconfig
@@ -242,6 +242,11 @@
Enable serial port output in edk2. Serial output limits the performance of edk2's
FrontPage.
+config EDK2_SECURE_BOOT_SUPPORT
+ bool "Enable UEFI Secure Boot feature"
+ depends on EDK2_REPO_MRCHROMEBOX && SMMSTORE_V2
+ default y if EDK2_REPO_MRCHROMEBOX && SMMSTORE_V2
+
config EDK2_CUSTOM_BUILD_PARAMS
string "edk2 additional custom build parameters"
default "-D VARIABLE_SUPPORT=SMMSTORE" if EDK2_REPO_MRCHROMEBOX && SMMSTORE_V2
diff --git a/payloads/external/edk2/Makefile b/payloads/external/edk2/Makefile
index b241cf9..2181242 100644
--- a/payloads/external/edk2/Makefile
+++ b/payloads/external/edk2/Makefile
@@ -111,6 +111,10 @@
ifneq ($(CONFIG_EDK2_SD_MMC_TIMEOUT),)
BUILD_STR += -D SD_MMC_TIMEOUT=$(shell echo $$(( $(CONFIG_EDK2_SD_MMC_TIMEOUT) * 1000)) )
endif
+# EDK2_SECURE_BOOT_SUPPORT = FALSE
+ifeq ($(CONFIG_EDK2_SECURE_BOOT_SUPPORT), y)
+BUILD_STR += -D SECURE_BOOT_ENABLE=TRUE
+endif
#
# EDKII has the below PCDs that are relevant to coreboot:
--
To view, visit https://review.coreboot.org/c/coreboot/+/74869
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I4be58c3315cabe08729d717c59203fdc6a3e2958
Gerrit-Change-Number: 74869
Gerrit-PatchSet: 1
Gerrit-Owner: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-MessageType: newchange
Matt DeVillier has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/74868 )
Change subject: payloads/edk2: Update default branch for MrChromebox repo
......................................................................
payloads/edk2: Update default branch for MrChromebox repo
Update the default branch used for MrChromebox's edk2 fork from 2022-07
to 2023-04. This updated branch has been rebased on the latest upstream
stable tag (edk2-stable202302), and adds support for UEFI SecureBoot,
PXE network booting, and TPM 1.2/2.0 management (though it does not
currently support Google CR50/Ti50 TPMs).
TEST=build/boot various boards with edk2 payload selected.
Change-Id: I096eaa4e065db731a70ba238ba5a3bb49e5db867
Signed-off-by: Matt DeVillier <matt.devillier(a)gmail.com>
---
M payloads/external/edk2/Kconfig
1 file changed, 19 insertions(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/68/74868/1
diff --git a/payloads/external/edk2/Kconfig b/payloads/external/edk2/Kconfig
index e3bb157..2c8152f 100644
--- a/payloads/external/edk2/Kconfig
+++ b/payloads/external/edk2/Kconfig
@@ -53,7 +53,7 @@
config EDK2_TAG_OR_REV
string "Insert a commit's SHA-1 or a branch name"
- default "origin/uefipayload_202207" if EDK2_REPO_MRCHROMEBOX
+ default "origin/uefipayload_202304" if EDK2_REPO_MRCHROMEBOX
default "origin/master" if EDK2_REPO_OFFICIAL
default "" if EDK2_REPO_CUSTOM
help
--
To view, visit https://review.coreboot.org/c/coreboot/+/74868
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I096eaa4e065db731a70ba238ba5a3bb49e5db867
Gerrit-Change-Number: 74868
Gerrit-PatchSet: 1
Gerrit-Owner: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-MessageType: newchange
Attention is currently required from: Sean Rhodes, Angel Pons, Maximilian Brune, Lean Sheng Tan.
Benjamin Doron has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74121 )
Change subject: [RFC] drivers/option: Add option list in cbtable
......................................................................
Patch Set 3:
(1 comment)
File src/drivers/option/cfr.c:
https://review.coreboot.org/c/coreboot/+/74121/comment/766719a1_5a9c2996
PS3, Line 103: option_id
> Is this intended to be an index?
I know it's used in EDK2's HII backend as the "question" identifier.
In CFR, I'd rather move it to the backend too, or establish that CFR should be sorted by these IDs. For instance, suppose the developer initialises and adds options in the order 1, 3, 2. At the moment, in EDK2, they're processed in struct-order not ID-order.
--
To view, visit https://review.coreboot.org/c/coreboot/+/74121
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I304de7d26d79245a2e31a6d01f6c5643b31cb772
Gerrit-Change-Number: 74121
Gerrit-PatchSet: 3
Gerrit-Owner: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Benjamin Doron <benjamin.doron00(a)gmail.com>
Gerrit-Reviewer: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Daniel Maslowski <info(a)orangecms.org>
Gerrit-CC: Lean Sheng Tan <sheng.tan(a)9elements.com>
Gerrit-CC: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-CC: Nico Huber <nico.h(a)gmx.de>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-CC: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Attention: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Attention: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Attention: Lean Sheng Tan <sheng.tan(a)9elements.com>
Gerrit-Comment-Date: Sun, 30 Apr 2023 17:53:42 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-MessageType: comment
Attention is currently required from: Subrata Banik, Karthik Ramasubramanian, Felix Held.
Kyösti Mälkki has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74513 )
Change subject: mb/google,intel: Use common ChromeEC code for SMI APMC
......................................................................
Patch Set 5:
(1 comment)
Patchset:
PS3:
> since Matt's test didn't result in some noticeable breakage, i'll mark this one as resolved
Let's keep this series on hold and merge after release tag.
--
To view, visit https://review.coreboot.org/c/coreboot/+/74513
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: If4b7c2b94e0fec84831740336ccdbea0922ffbfe
Gerrit-Change-Number: 74513
Gerrit-PatchSet: 5
Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Elyes Haouas <ehaouas(a)noos.fr>
Gerrit-Reviewer: Karthik Ramasubramanian <kramasub(a)google.com>
Gerrit-Reviewer: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-Attention: Subrata Banik <subratabanik(a)google.com>
Gerrit-Attention: Karthik Ramasubramanian <kramasub(a)google.com>
Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-Comment-Date: Sun, 30 Apr 2023 09:23:50 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Comment-In-Reply-To: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-MessageType: comment
Attention is currently required from: Christian Walter, Julius Werner.
Matt DeVillier has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74856 )
Change subject: security/tpm: Add Kconfig to allow payload control of TPM1
......................................................................
Patch Set 2:
(1 comment)
Patchset:
PS2:
> if CONFIG_TPM1 isn't selected, then you're selecting CONFIG_NO_TPM. […]
ok, I tested with CONFIG_NO_TPM selected, and the TPM was no longer manageable from the payload (no TPM admin menu), so this patch or something equivalent is definitely needed
--
To view, visit https://review.coreboot.org/c/coreboot/+/74856
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ieb7db109cbcc1a0166d95b6130b624b635bb7ac9
Gerrit-Change-Number: 74856
Gerrit-PatchSet: 2
Gerrit-Owner: Matt DeVillier <matt.devillier(a)gmail.com>
Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Christian Walter <christian.walter(a)9elements.com>
Gerrit-Attention: Julius Werner <jwerner(a)chromium.org>
Gerrit-Comment-Date: Sun, 30 Apr 2023 02:12:25 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Matt DeVillier <matt.devillier(a)gmail.com>
Comment-In-Reply-To: Julius Werner <jwerner(a)chromium.org>
Gerrit-MessageType: comment