Rebase on mrchromebox/uefipayload_2605 - #54
Draft
crawfxrd wants to merge 6857 commits into
Draft
Conversation
Add FFA_FEATURES_MEM_RETRIEVE_REQ_NS_SUPPORT macro and use it in FFA_FEATURES call for FFA_MEM_RETRIEVE_REQ to indicate NS bit usage support. According to DEN0140 FF-A Memory Management Protocol v1.3 ALP1 specification section 1.10.4.1.1 "Discovery of NS bit usage": "A v1.1 SP must set Bit[1] in the Input properties parameter." This bit indicates that the Secure Partition supports interpreting the NS (Non-Secure) bit in FFA_MEM_RETRIEVE_RESP invocations from the SPMC (Secure Partition Manager Core). The NS bit is used to specify the security state of a memory region being retrieved. The Hafnium SPMC implementation enforces this requirement for FF-A v1.1+ endpoints. Without this bit set, Hafnium returns FFA_NOT_SUPPORTED: This change is required for proper operation with Hafnium and other v1.1+ compliant SPMCs that enforce NS bit negotiation. Signed-off-by: Kannan Suprayan <kannan.suprayan@arm.com>
Add name conversion arrays: - ParityBitName - StopBitsName to seamlessly convert parity/stop bits to a matching name. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Add a GetParityType() utility function to convert the Parity to the EFI_PARITY_TYPE type. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Invert error handling to lower the indentation level in DisplaySettings(). No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Add a GetStopBits() utility function to convert the StopBits to the EFI_STOP_BITS_TYPE type. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Add a ValidDataBits() utility function to check the Data Bits are valid. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Replace existing checks against L"." and L".." by a named function. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a DeleteDirectory() function to decrease the size of CascadeDelete(). The extracted logic is slighly modified to lower the indendation level. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a UpdateFileLocalTime() function to decrease the size of PrintLsOutput(). No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Move ShellCloseFileMetaArg() calls to close the MetaArg whenever its usage is not needed anymore. This prepares for follow-up factorization. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a GetCorrectedPath() function to decrease the size of PrintLsOutput(). Also free the CorrectedPath in PrintLsOutput() before re-allocating it to prepare for follow-up factorization. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
If no file/directory has been found, the number of files/directories must be 0. Hard-code these values to avoid depending on the FileCount/FileSize/DirCount variables. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
The TimeZone parameter is not used. Remove it. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a PrintLsOutputRec() function to decrease the size of PrintLsOutput(). No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Invert some conditions in PrintLsOutputRec() to lower the indentation level. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a PrintLsOutputCurr() function to decrease the size of PrintLsOutput(). The patch also rationalize the usage of the Found parameter: - Found is updated only when a valid MetaFile is found - a IsRecursive variable is created to distinguish the first PrintLsOutput() call from the other recursive ones. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a GetCurrentTime() function to factorize error messages. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a PrintTime() function to factorize the code. No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a PrintDaylight() function to decrease the size of MainCmdTime(). No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a GetTimeZoneFromString() function to decrease the size of MainCmdTime(). No functional change. Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Add definitions for Arm Confidential Compute Architecture (CCA) Realm Service interface (RSI) definitions. These FID definitions are specified in the Realm Management Monitor (RMM) Specification that can be found at: https://developer.arm.com/documentation/den0137/ Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
The Realm Management Monitor (RMM) is a software component which forms part of a system which implements the Arm Confidential Compute Architecture (CCA) and is responsible for management of Realms. The RMM specification defines a Realm Service Interface (RSI) that the Guest can use to request services from the RMM. Therefore, add a library that implements the RSI interfaces to: - query the RSI version - get the Realm configuration. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Leif Lindholm <leif.lindholm@oss.qualcomm.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
The IPA space of a Realm is divided into two halves: Protected IPA space and Unprotected IPA space. Software in a Realm should treat the most significant bit of an IPA as a protection attribute. A Protected IPA is an address in the lower half of a Realm's IPA space. An Unprotected IPA is an address in the upper half of a Realm's IPA space. A Protected IPA has an associated Realm IPA state (RIPAS). The RIPAS values are: * EMPTY - Unused address * RAM - Private code or data owned by the Realm. Software in the Realm needs to share memory with the host to communicate with the outside world, e.g. network, disk image, etc. To share memory, the software in the Realm first transitions the RIPAS of memory region it wants to share with the host from RAM to EMPTY. The Realm software can then access the shared memory region using the Unprotected IPA address. The RMM specification defines the following Realm Service Interfaces for managing the IPA state: * RSI_IPA_STATE_GET * RSI_IPA_STATE_SET Therefore, update the ArmCcaRsiLib to add interfaces to get and set the IPA state of Realm memory pages. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Leif Lindholm <leif.lindholm@oss.qualcomm.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
The Section A2.1.3 Realm attributes, RMM Specification, version 1.0-rel0
introduces the concept of REMs as described below:
DGRFCS - A Realm Extensible Measurement (REM) is a measurement value
which can be extended during the lifetime of a Realm.
IFMPYL - Attributes of a Realm include an array of measurement values.
The first entry in this array is a RIM. The remaining entries
in this array are REMs.
The Realm Service Interface commands defined in section
B5.3.8 RSI_MEASUREMENT_READ and B5.3.7 RSI_MEASUREMENT_EXTEND
specify the interfaces to read and extend measurements to REMs.
Therefore, update ArmCcaRsiLib to add interfaces to get and extend REMs.
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
The Section A4.5 Host call, RMM Specification, version 1.0-rel0
describes the programming model for Realm communication with
the Host and specifies the following:
DYDJWT - A Host call is a call made by the Realm to the Host, by
execution of the RSI_HOST_CALL command.
IXNFKZ - A Host call can be used by a Realm to make a hypercall.
Therefore, introduce definition of HOST_CALL_ARGS structure that
represents the arguments to the RSI_HOST_CALL command as defined
in Section B5.3.4 RSI_HOST_CALL command.
Also update the ArmCcaRsiLib library to add a new interface
RsiHostCall () to make a Host call.
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
A CCA attestation token is a collection of claims about the state of a
Realm and of the CCA platform on which the Realm is running.
A CCA attestation token consists of two parts:
* Realm token - Contains attributes of the Realm, including:
# Realm Initial Measurement
# Realm Extensible Measurements
* CCA platform token - Contains attributes of the CCA platform
on which the Realm is running, including:
# CCA platform identity
# CCA platform life cycle state
# CCA platform software component measurements
The CCA attestation token is used by a verification service to validate
these claims.
The Realm Service Interface defines the following interfaces to retrieve
an attestation token from the Realm Management Monitor (RMM).
- RSI_ATTESTATION_TOKEN_INIT
- RSI_ATTESTATION_TOKEN_CONTINUE
Therefore, update the ArmCcaRsiLib to add an interface to get an
attestation token from the RMM.
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
The RMM Specification, version 1.0-rel0 provides an interface RSI_FEATURES to query the RSI features that have been implemented by the RMM. Therefore, introduce a new function RsiGetFeatures to query the features supported by the RSI. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Leif Lindholm <leif.lindholm@oss.qualcomm.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Cper.h files conatains register names (for example X0) as variable names which doesnot contain lower case characters and hence EccCheck fails. Keeping these variable name same as the specification makes more sense. Signed-off-by: Varshit Pandya <varshit.pandya@arm.com>
Add CPER definitions for ARM Processor error section per UEFI spec. The definitions are part of Section N.2.4.4 (ARM Processor Error Section) of Appendix N (Common Platform Error Record). Signed-off-by: Varshit Pandya <varshit.pandya@arm.com>
Update the mbedtls submodule from v3.6.5 to v3.6.6 to mitigate the CVEs CVE-2026-25833, CVE-2026-25834, CVE-2026-25835 CVE-2026-34874. Signed-off-by: Richard Lyu <richard.lyu@suse.com>
In custom mode an empty subtitle sat between "Enter Setup Mode" and "Custom Secure Boot Options", leaving an awkward gap. Drop the spacer so the two entries render together. Co-authored-by: Cursor <cursoragent@cursor.com>
The Custom Secure Boot Options menu nested each key type (PK/KEK/DB/DBX/DBT) behind its own intermediate options sub-page. Collapse that middle layer into a single page that lists every key type's Enroll/Delete actions directly under a section heading, and remove the now-unused per-key option forms. The multi-step Enroll/Delete leaf forms are kept as-is. Redirect the dynamic "Delete All List" back-goto to the flattened page and reset any open enrolled file when entering it. Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
…iables Publish PKDefault/KEKDefault/dbDefault/dbxDefault from the firmware-embedded default key material on every boot, so the Secure Boot setup UI has an authoritative reference to distinguish default keys from user-customized ones. The signature-list payloads are built to match what GetVariable() returns for the corresponding live variables, and are written volatile (BS+RT) so they always reflect the firmware's current defaults regardless of Setup/User Mode. Co-authored-by: Cursor <cursoragent@cursor.com>
Add a read-only "Secure Boot Keys" indicator to the Secure Boot Configuration form that compares the live PK/KEK/db/dbx against their *Default references and reports Default, Custom, None (Setup Mode) or Unknown. Also derive the displayed Secure Boot Mode from actual state instead of the volatile CustomMode variable: present Custom whenever Setup Mode has been entered (PK deleted) or the enrolled keys differ from the defaults, and keep it there until the keys are reset to defaults. This makes the mode meaningful across reboots, since the variable driver resets CustomMode to Standard on every boot. Co-authored-by: Cursor <cursoragent@cursor.com>
KeyEnrollReset() re-enrolls the default keys, ending with the default PK. Enrolling a PK moves the platform to User Mode, which makes the variable driver (AuthVariableLib) auto-create SecureBootEnable = ENABLE. As a result, "Reset to Default" silently turned Secure Boot on even when it had been disabled, changing the enable/disable policy rather than just restoring the default keys. Snapshot the SecureBootEnable state before the reset and, if Secure Boot was not enabled beforehand, restore it to DISABLE after the enroll so the key reset no longer changes the user's enable/disable choice. Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
The file explorer rebuilds a single form in place while descending into volumes and directories, so it keeps no parent/history and ESC exits the whole browser. The on-disk "." and ".." entries only appear on FAT sub-directories, never at a volume root nor on other file systems, leaving no reliable way to back up a level. Track the directory currently displayed and synthesize an "Up one level" entry at the top of every directory listing: at a volume root it returns to the volume list, otherwise it opens the parent directory. The raw "." and ".." entries are filtered so parent navigation is uniform across file systems. Also close the final directory handle on exit. Co-authored-by: Cursor <cursoragent@cursor.com>
Commit ee58614 ("MdeModulePkg/ScsiDiskDxe: Check Write Caching and FUA support") added a best-effort FUA-support query to ScsiDiskDetectMedia(). It issues a MODE SENSE(10) for the Caching mode page via ScsiDiskFuaMode() and assigns the result to the function's shared Status variable. When the device rejects that command, Status is left as EFI_DEVICE_ERROR and falls through to the function's return, even though the media was already detected successfully (capacity read, media present). Callers treat this as fatal: ScsiDiskDriverBindingStart() skips installing Block I/O, and ScsiDiskReadBlocks()/WriteBlocks() return EFI_DEVICE_ERROR. For non-fixed devices DetectMedia() re-runs on every access, so the disk is never usable. This is observed on UFS: the LUN answers the MODE SENSE with a Target Failure ("UfsExecScsiCmds() fails with Target Failure"), which previously worked (edk2-stable202602) now breaks UFS drive detection (edk2-stable202605). The FUA query is only used to refine ScsiDiskDevice->FuaMode, which already defaults to TRUE (the prior always-set-FUA behavior). Its failure must not affect media detection, so stop assigning its result to Status and hoist the device-type check out of the retry loop. Fixes: ee58614 ("MdeModulePkg/ScsiDiskDxe: Check Write Caching and FUA support") TEST=build/boot google/yaviks Chromebook with UFS, drive is detected and bootable. Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
When no Option ROM is present, PciGetPciRom returned immediately after clobbering the ROM BAR during sizing, leaving the BAR modified and the PciIo protocol open reference leaked. Route this case through the shared RestoreBar/CloseAndReturn cleanup instead. Also initialize CodeType, which was only assigned for PCAT images but read unconditionally in the legacy image length fixup. Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Upstream commit 777a055980 expanded the SEC/PEI/SMM IDT from 32 to 256
entries and changed CommonExceptionHandlerWorker() to CpuDeadLoop() on
any unhandled vector below 256. That breaks UefiPayload on several
coreboot platforms.
coreboot enables IOAPIC virtual wire mode in register_new_ioapic_gsi0(),
which routes legacy PIC activity (including IRQ0) as ExtINT, typically
delivered on vector 32. coreboot only installs a 20-entry IDT; edk2
CpuDxe expands it to 256 entries in DXE, but PiSmmCpuDxeSmm installs its
own 256-entry SMM IDT during init. On Ivy Bridge Chromebooks such as
google/link, a spurious timer interrupt during SMM bring-up (SMMSTORE
variable access) hits vector 32 with no ExternalInterruptHandler
registered, causing an immediate hang.
Haswell and newer boards (e.g. google/panther) use the same IOAPIC setup
but do not appear to deliver ExtINT into SMM during init, so the
regression was not observed there.
Restore the pre-777a055 behavior for external hardware interrupts: only
CPU exceptions (vectors 0-31) and the stack cookie vector
(PcdStackCookieExceptionVector, default 0x42) are treated as fatal when
unhandled. The full 256-entry IDT is retained so stack cookie routing
continues to work.
Affected coreboot platforms (UefiPayload + SMMSTORE or other PiSmmCpu
users), ordered by likelihood:
- Intel Sandy Bridge / Ivy Bridge (bd82x6x, ibexpeak PCH): all boards
using register_new_ioapic_gsi0(), including Chromebooks (link,
parrot, stout, lumpy, etc.) and ThinkPads (x220/x230/t420/t430s/...)
- Intel 5-series / X58 (i82801jx, i82801ix): same IOAPIC ExtINT setup
- Intel 4-series (i82801gx, i82801dx, i82801hx): same setup
- Intel Wildcat Point (HSW ULT): uses register_new_ioapic_gsi0(); may
be less timing-sensitive but shares the code path
- AMD platforms using Hudson register_new_ioapic_gsi0() with edk2 SMM
Tested: boots google/link (IVB) on uefipayload_2605
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Add LvglPkg (MrChromebox fork) as a submodule and, when LVGL_ENABLE is set to TRUE, replace the text-mode DisplayEngineDxe with the LVGL-based LvglDisplayEngineDxe in the UefiPayloadPkg DSC and FDF. In that config, UsbMouseDxe is also switched to UsbMouseAbsolutePointerDxe (LVGL input needs AbsolutePointer) and the LvglLib library class plus LVGL's compiler-warning suppressions are pulled in. When the set to FALSE (the default), the stock DisplayEngineDxe and UsbMouseDxe are used as before. Override some LvglPkg PCDs for visual tweaks. Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
The driver previously forced boot protocol and always decoded interrupt data as the classic 3-byte boot mouse report. That breaks HID devices that do not implement a usable boot protocol, or that only expose a report-protocol layout with a Report ID and wider axes (common on cheap wireless dongles such as YICHIP 3151:3020). Mis-parsing those packets swaps/shifts the X/Y bytes and remaps cursor movement by 90°. Parse the HID report descriptor into a field layout, select report protocol when the layout is not boot-compatible (with boot fallback if set-protocol fails), and decode buttons/X/Y/wheel from that map. Signed-off-by: Matt DeVillier <matt.devillier@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
bump to match upstream master; add flag to suppress unused variable warning on gcc 15/16 Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Recent coreboot trees override this define rather than patching the FMP root certificate file in the repo. To make this work, it must exist. Signed-off-by: Florian Jung <fju@tuxedocomputers.com>
…rollment Add SECURE_BOOT_DEFAULT_ENABLE / PcdSecureBootDefaultEnable so EnrollDefaultKeys can leave SecureBoot enabled after provisioning default keys, instead of always forcing it off. Use '-D SECURE_BOOT_DEFUALT_ENABLE=TRUE' to enable by default. Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Revert the always-on InitializeMpExceptionStackSwitchHandlers() behavior from e67f405. That path copies the current GDT, appends a TSS, and reloads GDTR/TR via ArchSetupExceptionStack(). UefiPayload sets PcdCpuStackGuard to FALSE. Running the exception stack setup unconditionally faults during early CpuDxe and causes repeated platform resets before DXE can finish loading. With the default FALSE setting, UefiPayload skips GDT/TSS rewriting entirely, matching the working 2408 behavior. CpuDxe already installs its own GDT via InitGlobalDescriptorTable() before MP init, so no payload-entry GDT setup is required for this configuration. Restore PcdCpuStackGuard in CpuDxe.inf; e67f405 dropped the PCD consumption when the gate was removed. Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
crawfxrd
force-pushed
the
dev/rebase-uefipayload_2605
branch
2 times, most recently
from
August 18, 2026 18:54
ed338ab to
218f904
Compare
Signed-off-by: Tim Crawford <tcrawford@system76.com>
Make use of the SMFI command interface to forward logs from edk2 to System76 EC. Signed-off-by: Jeremy Soller <jeremy@system76.com> Signed-off-by: Tim Crawford <tcrawford@system76.com>
- Use VBT file GUID from edk2-platforms instead of proprietary BIOS - Use System76 GOP Policy driver if defined - Update paths for firmware-open Signed-off-by: Tim Crawford <tcrawford@system76.com>
crawfxrd
force-pushed
the
dev/rebase-uefipayload_2605
branch
4 times, most recently
from
August 20, 2026 19:38
ca62733 to
9542754
Compare
Signed-off-by: Tim Crawford <tcrawford@system76.com>
…ot options Signed-off-by: Tim Crawford <tcrawford@system76.com>
QEMU fails to boot with the following error:
DXE_ASSERT!: [BdsDxe] DxeTcgPhysicalPresenceLib.c (713): mPpStringPackHandle != ((void *) 0)
Make use of the `TPM1_ENABLE` define to disable TPM 1.2 support to avoid
hitting the issue.
Signed-off-by: Tim Crawford <tcrawford@system76.com>
Add a copy of UiApp from commit b03a21a (edk2-stable202605) and rename it to System76Setup. Signed-off-by: Tim Crawford <tcrawford@system76.com>
crawfxrd
force-pushed
the
dev/rebase-uefipayload_2605
branch
from
August 20, 2026 21:38
9542754 to
b8b76a9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update from edk2-stable202108 to mrchromebox/uefipayload_2605 (edk2-stable202605).
Replaces: #50
Resolves: #45
Commits to check
Need to go through these to determine if any more can be dropped or need to be rebased.