Temporarily use 3mdeb fork to fix build issues and other bugs.
Change-Id: I4de3f001d335ebf1621f30bb1aa875a7d22c4168
Upstream-Status: Inappropriate [temporary submodule chnage]
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Based on genoa_poc, this patch adds directory structure for Phoenix
OpenSIL as well as git submodule needed to build it.
Subsequent patches will begin adjusting this directory to Phoenix (Zen4)
silicon.
Upstream-Status: Backport [CB:91480]
Change-Id: I04de276c1567c20d1e852efe220efa8131f53843
Signed-off-by: Alicja Michalska <alicja.michalska@9elements.com>
Pass the eSPI configuration to the amdfwtool to be filled in EFS.
Update the Turin SOC fw.cfg file with the blobs from
openSIL/amd_firmwares repository on GitHub. Create a new submodule
to source these blobs into the build.
Unfortunately these blobs are rather not suitable for production CPUs.
See this issue: https://github.com/openSIL/amd_firmwares/issues/1
TEST=Build image for Gigabyte MZ33-AR1.
Change-Id: Ic30fad7a4d95dc20f05d3ce94a23dc39b28eb746
Upstream-Status: Backport [CB:88710]
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signing is performed with test keys by default, set
CONFIG_SIGNING_KEYS_DIR to a non-empty value to use other keys.
Depending on the version of the Talos II firmware this alone might not
allow booting because coreboot replaces only part of the stock firmware
and its newer versions enable secure boot by default (not to be confused
with SecureBoot in EFI). The signing performed in this commit is still
a prerequisite and might as well be done on its own. Fixing operation
with newer stock firmware will be done in a follow-up change.
Change-Id: Id88baef5ecb1f8ffd74a7f464bbbaaaea0ca643d
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/67065
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Krystian Hebel <krystian.hebel@3mdeb.com>
The chromeec submodule is the largest submodule being pulled into the
coreboot tree, at over 400MB. The main branch also contains the majority
of these commits, so restricting it to a single branch still fetches
over 350MB.
Because there is only a single mainboard directory that enables the
build of the chromeec codebase by default, most people are fetching this
repo for no reason.
Based on this, we're going to change the way that the chromeec submodule
is used, fetching it the way we currently fetch external payloads. This
gives us 2 large advantages:
1) Only builds that actually need the chromeec repo will pull it down.
2) Each board that wants to build the chromeec codebase can use a
different commit, unlike submodules which all use the same "current"
commit.
Signed-off-by: Martin Roth <gaumless@gmail.com>
Change-Id: I357c4c9b506dd3817a308232446144ae889bc220
Reviewed-on: https://review.coreboot.org/c/coreboot/+/81024
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Matt DeVillier <matt.devillier@gmail.com>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-by: Elyes Haouas <ehaouas@noos.fr>
Reviewed-by: Felix Singer <service+coreboot-gerrit@felixsinger.de>
Instead of using a relative path for the submodules, specify the sub-
module URLs as pointing at coreboot.org, using https.
While the relative path works well for coreboot itself, when the repo
is forked and fetched from from anywhere other than review.coreboot.org,
this file either needs to be modified, or all the submodules need to be
checked out as well.
Change-Id: Ie4f95c70a7f194d1073dc561c9f33dcc108060cc
Signed-off-by: Martin Roth <gaumless@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/80552
Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Elyes Haouas <ehaouas@noos.fr>
Firmware is typically delivered as one large binary image that gets
flashed. Since this final image consists of binaries and data from
a vast number of different people and companies, it's hard to
determine what all the small parts included in it are. The goal of
the software bill of materials (SBOM) is to take a firmware image
and make it easy to find out what it consists of and where those
pieces came from. Basically, this answers the question, who supplied
the code that's running on my system right now? For example, buyers
of a system can use an SBOM to perform an automated vulnerability
check or license analysis, both of which can be used to evaluate
risk in a product. Furthermore, one can quickly check to see if the
firmware is subject to a new vulnerability included in one of the
software parts (with the specified version) of the firmware.
Further reference:
https://web.archive.org/web/20220310104905/https://blogs.gnome.org/hughsie/2022/03/10/firmware-software-bill-of-materials/
- Add Makefile.inc to generate and build coswid tags
- Add templates for most payloads, coreboot, intel-microcode,
amd-microcode. intel FSP-S/M/T, EC, BIOS_ACM, SINIT_ACM,
intel ME and compiler (gcc,clang,other)
- Add Kconfig entries to optionally supply a path to CoSWID tags
instead of using the default CoSWID tags
- Add CBFS entry called SBOM to each build via Makefile.inc
- Add goswid utility tool to generate SBOM data
Signed-off-by: Maximilian Brune <maximilian.brune@9elements.com>
Change-Id: Icb7481d4903f95d200eddbfed7728fbec51819d0
Reviewed-on: https://review.coreboot.org/c/coreboot/+/63639
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Martin Roth <martin.roth@amd.corp-partner.google.com>
The 3rdparty submodule 'intel-microcode' has changed the branch from
'master' to 'main'. As we do not set any specific branch name in our
config, it defaults to 'master' which makes
"git submodule update --remote --rebase 3rdparty/intel-microcode"
to fail.
This patch adds the branch name in .gitmodules to match the upstream
name.
Change-Id: I7b6d7921a21af4eb3bcc7ce4e5a8ea21c38c89a3
Signed-off-by: Werner Zeh <werner.zeh@siemens.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/55304
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Tested-by: siemens-bot
vboot has been updated to track main branch, however the
.gitmodules defaults to master branch following the
coreboot default. This impacts the rebase of submodule
git submodule update --remote --rebase 3rdparty/vboot/
With this change the rebase to latest commit is successful
Signed-off-by: Balaji Manigandan B <balaji.manigandan@intel.com>
Change-Id: I7713aecdec43a5d5623ef81803ac0fc02ce14070
Reviewed-on: https://review.coreboot.org/c/coreboot/+/52664
Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org>
Reviewed-by: Furquan Shaikh <furquan@google.com>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
The patch incorporates the STM build as a part of the coreboot
build. A separate patch lists and documents the options that
the developer can use. In most cases the default options will
suffice.
Change-Id: I8c6e0c85edd4e2b0658791553bd9947656e8c796
Signed-off-by: Eugene D Myers <cedarhouse@comcast.net>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/44687
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: ron minnich <rminnich@gmail.com>
This patch adds a separate blobs repository for Qualcomm blobs,
analogous to the existing AMD blobs. Qualcomm's binary licenses allow
files to be redistributed and used by anyone, but they explicitly
require the user to agree to the license terms when just *downloading*
the binary (even if they're not using them to build any firmware). Some
community members do not like to have to agree to licenses for files
they're not actually using, so we are keeping these files separate from
the main blobs repository and adding an extra Kconfig to make sure the
user is aware of and must explicitly agree to this before downloading
these files.
Signed-off-by: Julius Werner <jwerner@chromium.org>
Change-Id: I247746c1b633343064c9f32ef1556000475d6c4a
Reviewed-on: https://review.coreboot.org/c/coreboot/+/42548
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
This is currently an empty repo. The intention for amd_blobs may be
found in Documentation/soc/amd/amdblobs_license.md. A subsequent
patch will make the repo's init and checkout optional based on a
Kconfig symbol.
Change-Id: Ia93fb2711beaea4cb1c8e5d71dc3a9e0facc5485
Signed-off-by: Marshall Dawson <marshalldawson3rd@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/36441
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Nico Huber <nico.h@gmx.de>
Michał Żygowski
Alicja Michalska
Michał Kopeć
Martin Roth
Maximilian Brune
Maximilian Brune
Jakub Czapiga
Werner Zeh
Balaji Manigandan B
Eugene D Myers
Philipp Deppenwiese
Julius Werner
Jan Dabros
Marshall Dawson
Marty E. Plummer
zaolin