Commit Graph

59535 Commits

Author SHA1 Message Date
Filip Lewiński 3683094cc4 src/sbom: extend for Dasharo components
Extend to include most used components, e.g. FSP, ME, IFD, microcode,
edk2, AGESA, EC.

Upstream-Status: Pending
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
2026-03-17 10:14:47 +01:00
mkopec 6a19c7f385 [automated change] Update µcode 2026-02-27
Upstream-Status: Inappropriate (Dasharo automation)
Change-Id: Ib073a38d1ca458d681ab58a68e9de3037424107b
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-03-03 13:52:36 +01:00
Filip Lewiński 857372d84f security/intel/acm/Makefile.mk: add ACM's to both FIT tables
Prior to this, with redundancy and Boot Guard enabled, FIT in TOPSWAP
lacked the BIOS ACM.

Upstream-Status: Pending
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
2026-03-02 11:38:39 +01:00
Filip Lewiński 1520908961 configs/config.novacustom_n*x_adl: bump to rc8
Upstream-Status: Inappropriate [Dasharo downstream]
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
novacustom_ns5x_adl_v1.8.0-rc8 novacustom_nv4x_adl_v1.8.0-rc8
2026-02-27 13:40:05 +01:00
Filip Lewiński fa9eb76c65 security/intel/cbnt/measurement.c: fix PCR-0 hash missing BPM
When the per-bank hash loop was introduced, the hash length
was accidentally left pointing at the pre-loop write position, so BPM
signature and IBB digest were never included in the computed hash. Fix
by using the correct post-write length.

Makes PCR-0 reconstruction valid on ADL-P.

Upstream-Status: Pending
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
2026-02-26 16:16:55 +01:00
Filip Lewiński 22c38c734f configs/config.novacustom_n*x_adl: bump to rc7
Upstream-Status: Inappropriate [Dasharo downstream]
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
protectli_vault_adl_v0.9.3-rc5 novacustom_nv4x_adl_v1.8.0-rc7 novacustom_ns5x_adl_v1.8.0-rc7
2026-02-26 09:42:58 +01:00
Filip Lewiński 5efdb5a69c src/security/intel/acm: add BIOSACM stub to reserve CBFS space
After updating the FSP to a newer version, there was no room to add
required IBG ACMs into cbfs, with proper alignment. Since the ACMs
cannot be redistributed, and keeping placeholders in the final
binaries didn't work, the problem was addressed by introducing a Kconfig
option to add placeholders during build and remove them from the final
image.

This ensures there's room for inserting ACMs, and there are no
potentially faulty placeholders in the final ROM.

Upstream-Status: Pending
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
2026-02-26 09:42:58 +01:00
Filip Lewiński ce45208c07 src/mainboard/clevo/adl-p/: move mainboard_configure_gpios(); earlier
After switching to IoT FSP, TPM 2.0 would no longer initialize. To fix
this, GPIO configuration had to be moved earlier, before ramstage
enumeration, mimicking Protectli VP66XX.

Upstream-Status: Pending
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
2026-02-26 09:42:57 +01:00
Michał Kopeć 8bdeada357 3rdparty/dasharo-blobs: Update for VP66xx ME v16.1.40.2768
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: Id809b8e4e644fe023270e23b8c219284072fd2bb
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-02-25 15:48:49 +01:00
Michał Kopeć b28eba6ff2 configs/config.protectli_vp66xx: enable SMM_BWP
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: Iae8490b5e5a75f5428f3a490e5415b0d3e5b98f0
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-02-24 20:22:45 +02:00
Michał Kopeć f214c261c7 Make BIOS Lock work with all BOOTMEDIA_LOCK types
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I0941aa969c356df939b9eb2ccbaef9f1ca772b6b
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-02-24 20:22:45 +02:00
Michał Kopeć b6f2a14baf configs/config.protectli_vp66xx: bump version to rc5
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: Id2571e08c2ddb59d73d0808229ed3460d996b211
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-02-24 20:22:45 +02:00
Michał Kopeć 3c0c468a1b payloads/external/edk2/Kconfig.dasharo: bump for attempt_slot_b setting
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I2672cd90ad23f7f9f6b516b113c5ca4957485b9a
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-02-24 20:22:44 +02:00
Michał Kopeć 4e463177f2 Revert "drivers/efi/capsules.c: auto-set attempt_slot_b on capsule detection"
This reverts commit c7bf17c810.

Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I6cf60a15cc7d7d6a2e452b033f46d06a530f2a9a
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-02-20 10:59:55 +01:00
Filip Lewiński e617bc6b6c configs/config.novacustom_n*x_adl: bump to rc6
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I86c27d1b49a501b08eaabd10b6e66c2c1cd975b0
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
novacustom_nv4x_adl_v1.8.0-rc6 novacustom_ns5x_adl_v1.8.0-rc6
2026-02-19 09:33:35 +01:00
Filip Lewiński e7c7699692 edk2/Kconfig.dasharo: bump revision for nv4x_adl fixes
Includes adding an SD card driver and extended description of
DMA-related security options

Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I5ad3c1f2b41de9cf221e0e2f22757b7884157d25
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
2026-02-18 10:49:12 +01:00
Filip Lewiński 08b09351ad clevo/adl-p/Kconfig: build nv4x_adl with IoT FSP
The IoT FSP seems to be maintained for longer and more actively for the
Alder Lake P (Raptor Lake P) platforms. For the nv4x_adl platforms,
going from Client to IoT FSP resolved issues with waking from S3 suspend
and detecting Thunderbolt devices as USB fallbacks.

Upstream-Status: Pending
Change-Id: I46f47971691b3a76ef9926941b5cabf5c48ef10e
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
2026-02-18 10:48:35 +01:00
Filip Lewiński 4db0b0a5da mb/clevo/adl-p/acpi/mainboard.asl: add GPE 6B handling
The GPE 6B event had no handler defined, which resulted in an ACPI Error
appearing in dmesg after a s0ix-wake cycle by closing and opening the
lid.

After adding the matching method, the issue does not reproduce.

Upstream-Status: Pending
Change-Id: I7f7c8fe5ee8245c6f0558ae080b66fa29beccf23
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
2026-02-18 10:48:35 +01:00
Michał Kopeć 3730ed8034 mb/novacustom/mtl-h: Bump Energy Performance Preference to 45%
Improve performance by lowering the EPP value from the power-on default
of 0xb3 (70%) to 0x73 (45%). Lower value = higher performance.

Upstream-Status: Pending
Change-Id: I5a1f48dd2b563cf7dc37f7682317e5b7f81ad13c
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-02-13 16:06:49 +02:00
Michał Kopeć 459a846b82 configs/config.hardkernel_odroid_h4*: Bump version to v0.9.2-rc1
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I1840f28d16835e83ace3cd23871762138aa44844
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
hardkernel_odroid_h4_v0.9.2-rc1
2026-02-12 20:06:06 +02:00
Michał Kopeć d46f26172d payloads/external/edk2/Kconfig.dasharo: bump for BB update fix
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I700848e20427f1cdcefbb6ee18075dff6ad53a14
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-02-12 20:06:03 +02:00
Michał Kopeć 4ef3103f8a payloads/external/edk2/Kconfig.dasharo: Bump for FUM fixes
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I671d7b4762453a411a17b78ec5ec9d4e4b25e1b3
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-02-12 12:39:00 +01:00
Michał Kopeć c89083c699 vc/dasharo/options.c: Use the FUM Request variable for determining FUM
Keep in sync with the changes on the EDK2 side, where a separate FUM
Request variable was added for allowing booting FUM twice in a row.

Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I7a553e9dc82192022594d017392d778619b269d8
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-02-12 12:39:00 +01:00
mkopec eeacbc3504 [automated change] Update µcode 2026-02-10
Upstream-Status: Inappropriate (Dasharo automation)
Change-Id: Ia2a747da8ade3a594c1e817d173f9aa21dabdb34
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-02-12 12:25:34 +01:00
Michał Kopeć a4dd840b67 mb/novacustom/mtl-h: Use ARL-UH FSP
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I226fce12502b9cf2379c4a57c64569f7a05d5c34
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2026-02-06 12:01:22 +01:00