Skip to content

Rebase on mrchromebox/uefipayload_2605 - #54

Draft
crawfxrd wants to merge 6853 commits into
system76from
dev/rebase-uefipayload_2605
Draft

Rebase on mrchromebox/uefipayload_2605#54
crawfxrd wants to merge 6853 commits into
system76from
dev/rebase-uefipayload_2605

Conversation

@crawfxrd

@crawfxrd crawfxrd commented Aug 17, 2026

Copy link
Copy Markdown
Member

Update from edk2-stable202108 to mrchromebox/uefipayload_2605 (edk2-stable202605).

Replaces: #50
Resolves: #45

Commits to check

Need to go through these to determine if any more can be dropped or need to be rebased.

  • e728fcd UefiPayloadPkg: Use BasePlatformHookLibNull for logging to EC
  • 85f3fc6 Only check webcam status on laptops
  • 42a443d SecurityPkg: Fix debug build
  • 99891bd SecureBootConfig: Remove blank line
  • 3485d55 SecureBootConfig: Split long strings
  • c1a7127 SecureBootConfig: Clear PK and reset
  • 2f21edd SecureBootConfig: Restore keys and reset
  • 860c29c SecureBootConfig: Update variable and perform reset
  • 8cfead2 SecureBootConfig: Add text key to perform the actions
  • 30f6b2f SecureBootConfig: Modify UI
  • 4de3256 UiApp: Link to SecureBootConfig
  • ff91020 Notify System76 security callback prior to loading boot options
  • a2abc5e UefiPayloadPkg: Add Pop!_OS Recovery to boot text
  • a618e43 MdeModulePkg/BmBootDesciption: Remove device prefixes
  • fc1c47c UefiPayloadPkg: Add System76 Setup menu
  • 05aa27e MdeModulePkg/BM: Update boot options on device change
  • 06cc698 MdeModulePkg/Core: Signal notify events on protocol removal
  • cb870a1 UiApp: Dynamically generated firmware configuration information page
  • 90e04a7 MdeModulePkg/BMM: Unregister F9 and F10 hotkeys
  • 1d01d2a MdeModulePkg/BMM: Remove Commit/Discard buttons
  • 70e9b22 MdeModulePkg/BMM: Save BootOrder on list update
  • e9d6369 MdeModulePkg/BMM: Add some debug logging
  • 58d6aae MdeModulePkg/UiApp: Add warning if no bootable options found
  • 4e0fcab MdeModulePkg/BootMaintenanceManagerUiLib: Make it look like current BMM
  • 2d04a62 MdeModulePkg/UiApp: Make it look like current FrontPage
  • 8a0955d MdeModulePkg/BM: Make it look like current BootMngr
  • 06f4583 UefiPayloadPkg: Disable EFI shell
  • 9daa69a UefiPayloadPkg: Add library for logging to EC
  • 654e595 Fix TPM detection
  • 2af54dd UefiPayloadPkg: Stall before connecting devices
  • 0028331 MdeModulePkg/BdsDxe: Forward any key for booting
  • 552ca5c UefiPayloadPkg: Clear screen on boot error
  • 94e7cfc UefiPayloadPkg: Copy PlatformBootManagerUnableToBoot() from OvmfPkg
  • 726280b UefiPayloadPkg: Disable Device Manager

LeviYeoReum and others added 30 commits April 23, 2026 08:22
There is no mapping ARM_FFA_RET_RETRY with EFI_STATUS but
it falls to EFI_UNSUPPORTED.

Map ARM_FFA_RET_RETRY with EFI_TIMEOUT so that don't make it fall to
EFI_UNSUPPORTED.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
A UEFI timer event firing at TPL_NOTIFY can preempt SynchronousRequest
while it is executing between VirtioPrepare() and VirtioFlush(). If the
timer callback also performs a block I/O operation backed by the same
virtio-blk device, both contexts manipulate the shared virtqueue
concurrently, corrupting its state and likely crashing the firmware.

Raise the TPL to TPL_NOTIFY before VirtioPrepare() and restore it after
the completion poll to make the virtqueue manipulation and the status
check an uninterruptible sequence. This mirrors the fix applied to the
VirtioRng driver in issue tianocore#11987.

On-behalf-of: SAP philipp.schuster@sap.com
Signed-off-by: Philipp Schuster <philipp.schuster@cyberus-technology.de>
UEFI driver shouldn't have the [Depex] section in INF file.
Remove Redfish Credential Protocol in dependency section
and locate it when the UEFI driver is connected to execute.

Signed-off-by: Abner Chang <abner.chang@amd.com>
This patch adds ArmFfaConsoleDebugLib. A debug library that utilizes
FF-A Console Log API to print debug messages to the console.

This is useful in context of running the StandaloneMm payload
as a S-EL0 SP on top of SPMC where StandaloneMm isn't allowed to
access console device or no console device (e.x) Hafnium.

NOTE:
  FFA_CONSOLE_LOG* could be used by secure partition only.

Signed-off-by: Mohamed Gamal Morsy <mohamed.morsy@arm.com>
Add FFA_FEATURES_MEM_RETRIEVE_REQ_NS_SUPPORT macro and use it in
FFA_FEATURES call for FFA_MEM_RETRIEVE_REQ to indicate NS bit usage
support.

According to DEN0140 FF-A Memory Management Protocol v1.3 ALP1
specification section 1.10.4.1.1 "Discovery of NS bit usage":

"A v1.1 SP must set Bit[1] in the Input properties parameter."

This bit indicates that the Secure Partition supports interpreting
the NS (Non-Secure) bit in FFA_MEM_RETRIEVE_RESP invocations from
the SPMC (Secure Partition Manager Core). The NS bit is used to
specify the security state of a memory region being retrieved.

The Hafnium SPMC implementation enforces this requirement for FF-A
v1.1+ endpoints. Without this bit set, Hafnium returns FFA_NOT_SUPPORTED:

This change is required for proper operation with Hafnium and other
v1.1+ compliant SPMCs that enforce NS bit negotiation.

Signed-off-by: Kannan Suprayan <kannan.suprayan@arm.com>
Add name conversion arrays:
- ParityBitName
- StopBitsName
to seamlessly convert parity/stop bits to a matching name.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Add a GetParityType() utility function to convert
the Parity to the EFI_PARITY_TYPE type.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Invert error handling to lower the indentation level
in DisplaySettings().

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Add a GetStopBits() utility function to convert
the StopBits to the EFI_STOP_BITS_TYPE type.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Add a ValidDataBits() utility function to check
the Data Bits are valid.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Replace existing checks against L"." and L".." by
a named function.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a DeleteDirectory() function to decrease
the size of CascadeDelete().

The extracted logic is slighly modified to lower
the indendation level.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a UpdateFileLocalTime() function to decrease
the size of PrintLsOutput().

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Move ShellCloseFileMetaArg() calls to close the
MetaArg whenever its usage is not needed anymore.
This prepares for follow-up factorization.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a GetCorrectedPath() function to decrease
the size of PrintLsOutput().

Also free the CorrectedPath in PrintLsOutput() before
re-allocating it to prepare for follow-up factorization.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
If no file/directory has been found, the number of
files/directories must be 0.
Hard-code these values to avoid depending on the
FileCount/FileSize/DirCount variables.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
The TimeZone parameter is not used. Remove it.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a PrintLsOutputRec() function to decrease
the size of PrintLsOutput().

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Invert some conditions in PrintLsOutputRec() to lower
the indentation level.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a PrintLsOutputCurr() function to decrease
the size of PrintLsOutput().

The patch also rationalize the usage of the Found
parameter:
- Found is updated only when a valid MetaFile is found
- a IsRecursive variable is created to distinguish
  the first PrintLsOutput() call from the other
  recursive ones.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a GetCurrentTime() function to factorize error
messages.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a PrintTime() function to factorize the code.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a PrintDaylight() function to decrease the
size of MainCmdTime().

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Extract a GetTimeZoneFromString() function to decrease the
size of MainCmdTime().

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Add definitions for Arm Confidential Compute Architecture (CCA)
Realm Service interface (RSI) definitions.

These FID definitions are specified in the Realm Management
Monitor (RMM) Specification that can be found at:
 https://developer.arm.com/documentation/den0137/

Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
The Realm Management Monitor (RMM) is a software component which
forms part of a system which implements the Arm Confidential Compute
Architecture (CCA) and is responsible for management of Realms.
The RMM specification defines a Realm Service Interface (RSI) that
the Guest can use to request services from the RMM.

Therefore, add a library that implements the RSI interfaces to:
  - query the RSI version
  - get the Realm configuration.

Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
The IPA space of a Realm is divided into two halves: Protected IPA space
and Unprotected IPA space. Software in a Realm should treat the most
significant bit of an IPA as a protection attribute. A Protected IPA is
an address in the lower half of a Realm's IPA space. An Unprotected IPA
is an address in the upper half of a Realm's IPA space.

A Protected IPA has an associated Realm IPA state (RIPAS). The RIPAS
values are:
 * EMPTY  - Unused address
 * RAM    - Private code or data owned by the Realm.

Software in the Realm needs to share memory with the host to communicate
with the outside world, e.g. network, disk image, etc.

To share memory, the software in the Realm first transitions the RIPAS
of memory region it wants to share with the host from RAM to EMPTY. The
Realm software can then access the shared memory region using the
Unprotected IPA address.

The RMM specification defines the following Realm Service Interfaces for
managing the IPA state:
 * RSI_IPA_STATE_GET
 * RSI_IPA_STATE_SET

Therefore, update the ArmCcaRsiLib to add interfaces to get and set the
IPA state of Realm memory pages.

Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
The Section A2.1.3 Realm attributes, RMM Specification, version 1.0-rel0
introduces the concept of REMs as described below:
  DGRFCS - A Realm Extensible Measurement (REM) is a measurement value
           which can be extended during the lifetime of a Realm.
  IFMPYL - Attributes of a Realm include an array of measurement values.
           The first entry in this array is a RIM. The remaining entries
           in this array are REMs.

The Realm Service Interface commands defined in section
B5.3.8 RSI_MEASUREMENT_READ and B5.3.7 RSI_MEASUREMENT_EXTEND
specify the interfaces to read and extend measurements to REMs.

Therefore, update ArmCcaRsiLib to add interfaces to get and extend REMs.

Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
The Section A4.5 Host call, RMM Specification, version 1.0-rel0
describes the programming model for Realm communication with
the Host and specifies the following:
  DYDJWT - A Host call is a call made by the Realm to the Host, by
           execution of the RSI_HOST_CALL command.
  IXNFKZ - A Host call can be used by a Realm to make a hypercall.

Therefore, introduce definition of HOST_CALL_ARGS structure that
represents the arguments to the RSI_HOST_CALL command as defined
in Section B5.3.4 RSI_HOST_CALL command.

Also update the ArmCcaRsiLib library to add a new interface
RsiHostCall () to make a Host call.

Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
A CCA attestation token is a collection of claims about the state of a
Realm and of the CCA platform on which the Realm is running.
A CCA attestation token consists of two parts:
  * Realm token - Contains attributes of the Realm, including:
    # Realm Initial Measurement
    # Realm Extensible Measurements
  * CCA platform token - Contains attributes of the CCA platform
    on which the Realm is running, including:
    # CCA platform identity
    # CCA platform life cycle state
    # CCA platform software component measurements

The CCA attestation token is used by a verification service to validate
these claims.

The Realm Service Interface defines the following interfaces to retrieve
an attestation token from the Realm Management Monitor (RMM).
  - RSI_ATTESTATION_TOKEN_INIT
  - RSI_ATTESTATION_TOKEN_CONTINUE

Therefore, update the ArmCcaRsiLib to add an interface to get an
attestation token from the RMM.

Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
PatrickRudolph and others added 30 commits July 5, 2026 15:07
In coreboot the SMBIOS table generation is optional. When no
SMBIOS tables where found UefiPayloadEntry creates the
gUniversalPayloadSmbiosTableGuid HOB, but never initializeses
the contents, resulting in uninitialized memory, causing SmbiosDxe
to crash when it doesn't point to mapped DRAM.

Fix that by only creating gUniversalPayloadSmbiosTableGuid HOB
when SMBIOS tables where found.

TEST=Can boot using UEFIPayload when coreboot doesn't provide
     SMBIOS tables.

Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
The "Press ESC for Boot Options/Settings" prompt drawn on the boot
splash was only cleared when the user entered the Boot Manager Menu
(ESC/F2/Down), since those keys have a RegisterKeyNotify callback that
overwrites the prompt. ENTER was only wired up as the BDS continue
key, which proceeds with the default boot order but never clears the
prompt, leaving the stale text on screen while booting.

Register an ENTER key-notify callback that calls BootLogoClearProgress
so the prompt is cleared when booting directly, matching the behavior
of the menu-entry keys. Unregister the new notify handle alongside the
existing ones during cleanup.

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Trust the FAT32 BPB instead of requiring MaxCluster >= 65525, which
rejected valid UFS EFS volumes and blocked internal boot.

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Convert the "configuration changed, reset now" reminders in UiApp
(FrontPage), BootManagerUiLib, and BootMaintenanceManagerUiLib from the
legacy console CreatePopUp to EFI_HII_POPUP_PROTOCOL. The reminder now
renders through the active display engine -- a graphical dialog under a
graphical display engine, the standard HII popup in text mode -- instead
of a text overlay drawn on top of the UI.

Add an HII string token for the reminder message in each module since
the popup protocol takes a string ID rather than a raw string.

Co-authored-by: Cursor <cursoragent@cursor.com>
Convert the TPM PPI-version / ACPI-revision mismatch warnings and the
"failed to set PTP interface" error from the legacy console CreatePopUp
to EFI_HII_POPUP_PROTOCOL via a small Tcg2ShowPopup helper. The dialogs
now render through the active display engine (graphical under a graphical
display engine, standard HII popup in text mode) instead of a text
overlay on top of the UI.

Add HII string tokens for the three messages since the popup protocol
takes string IDs rather than raw strings.

Co-authored-by: Cursor <cursoragent@cursor.com>
Convert the five RAM-disk creation error messages (file info, size too
large, out of memory, file read, register failure) from the legacy
console CreatePopUp to EFI_HII_POPUP_PROTOCOL via a RamDiskShowPopup
helper. HiiCreateRamDisk now takes the HII handle from the caller's
config private data so it can address the message strings. The dialogs
render through the active display engine instead of a text overlay.

Add HII string tokens for the five messages since the popup protocol
takes string IDs rather than raw strings.

Co-authored-by: Cursor <cursoragent@cursor.com>
Being able to highlight this just confuses users.

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Add a dedicated Enter Setup Mode action on the Secure Boot
Configuration form when Custom mode is selected. The option clears
PK after confirmation, with clearer prompts than the existing Delete
PK checkbox buried under PK Options.

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Convert all remaining CreatePopUp dialogs in SecureBootCallback (the
enable/disable "configuration changed" reminder, delete-PK and
delete-signature confirmations, and the various enroll error messages)
from the legacy console CreatePopUp to EFI_HII_POPUP_PROTOCOL. They now
render through the active display engine -- a graphical dialog under the
LVGL display engine, the standard HII popup in text mode -- instead of a
text overlay drawn on top of the UI.

Add a SecureBootPopup helper that registers the message text into a
runtime scratch HII string, so both literal and dynamically-built
messages work without a dedicated string token per message.

Co-authored-by: Cursor <cursoragent@cursor.com>
The Secure Boot mode oneof always displayed Standard and the platform was
forced back to Standard Mode on form close, so users could not tell whether
custom keys were in effect. Reflect the persisted CustomMode variable when
the form opens, apply the user's Standard/Custom selection through
SetSecureBootMode, and stop resetting the mode on exit so the selection
persists across reboots.

Co-authored-by: Cursor <cursoragent@cursor.com>
In custom mode an empty subtitle sat between "Enter Setup Mode" and
"Custom Secure Boot Options", leaving an awkward gap. Drop the spacer so the
two entries render together.

Co-authored-by: Cursor <cursoragent@cursor.com>
The Custom Secure Boot Options menu nested each key type (PK/KEK/DB/DBX/DBT)
behind its own intermediate options sub-page. Collapse that middle layer into
a single page that lists every key type's Enroll/Delete actions directly under
a section heading, and remove the now-unused per-key option forms. The
multi-step Enroll/Delete leaf forms are kept as-is. Redirect the dynamic
"Delete All List" back-goto to the flattened page and reset any open enrolled
file when entering it.

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
…iables

Publish PKDefault/KEKDefault/dbDefault/dbxDefault from the firmware-embedded
default key material on every boot, so the Secure Boot setup UI has an
authoritative reference to distinguish default keys from user-customized ones.
The signature-list payloads are built to match what GetVariable() returns for
the corresponding live variables, and are written volatile (BS+RT) so they
always reflect the firmware's current defaults regardless of Setup/User Mode.

Co-authored-by: Cursor <cursoragent@cursor.com>
Add a read-only "Secure Boot Keys" indicator to the Secure Boot Configuration
form that compares the live PK/KEK/db/dbx against their *Default references and
reports Default, Custom, None (Setup Mode) or Unknown.

Also derive the displayed Secure Boot Mode from actual state instead of the
volatile CustomMode variable: present Custom whenever Setup Mode has been
entered (PK deleted) or the enrolled keys differ from the defaults, and keep it
there until the keys are reset to defaults. This makes the mode meaningful
across reboots, since the variable driver resets CustomMode to Standard on
every boot.

Co-authored-by: Cursor <cursoragent@cursor.com>
KeyEnrollReset() re-enrolls the default keys, ending with the default PK.
Enrolling a PK moves the platform to User Mode, which makes the variable
driver (AuthVariableLib) auto-create SecureBootEnable = ENABLE. As a result,
"Reset to Default" silently turned Secure Boot on even when it had been
disabled, changing the enable/disable policy rather than just restoring the
default keys.

Snapshot the SecureBootEnable state before the reset and, if Secure Boot was
not enabled beforehand, restore it to DISABLE after the enroll so the key
reset no longer changes the user's enable/disable choice.

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
The file explorer rebuilds a single form in place while descending into
volumes and directories, so it keeps no parent/history and ESC exits the
whole browser. The on-disk "." and ".." entries only appear on FAT
sub-directories, never at a volume root nor on other file systems, leaving
no reliable way to back up a level.

Track the directory currently displayed and synthesize an "Up one level"
entry at the top of every directory listing: at a volume root it returns
to the volume list, otherwise it opens the parent directory. The raw
"." and ".." entries are filtered so parent navigation is uniform across
file systems. Also close the final directory handle on exit.

Co-authored-by: Cursor <cursoragent@cursor.com>
Commit ee58614 ("MdeModulePkg/ScsiDiskDxe: Check Write Caching and
FUA support") added a best-effort FUA-support query to
ScsiDiskDetectMedia(). It issues a MODE SENSE(10) for the Caching mode
page via ScsiDiskFuaMode() and assigns the result to the function's
shared Status variable.

When the device rejects that command, Status is left as
EFI_DEVICE_ERROR and falls through to the function's return, even
though the media was already detected successfully (capacity read,
media present). Callers treat this as fatal:
ScsiDiskDriverBindingStart() skips installing Block I/O, and
ScsiDiskReadBlocks()/WriteBlocks() return EFI_DEVICE_ERROR. For
non-fixed devices DetectMedia() re-runs on every access, so the disk
is never usable.

This is observed on UFS: the LUN answers the MODE SENSE with a Target
Failure ("UfsExecScsiCmds() fails with Target Failure"), which
previously worked (edk2-stable202602) now breaks UFS drive detection
(edk2-stable202605).

The FUA query is only used to refine ScsiDiskDevice->FuaMode, which
already defaults to TRUE (the prior always-set-FUA behavior). Its
failure must not affect media detection, so stop assigning its result
to Status and hoist the device-type check out of the retry loop.

Fixes: ee58614 ("MdeModulePkg/ScsiDiskDxe: Check Write Caching and
FUA support")

TEST=build/boot google/yaviks Chromebook with UFS, drive is detected
and bootable.

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
When no Option ROM is present, PciGetPciRom returned immediately after
clobbering the ROM BAR during sizing, leaving the BAR modified and the
PciIo protocol open reference leaked. Route this case through the shared
RestoreBar/CloseAndReturn cleanup instead.

Also initialize CodeType, which was only assigned for PCAT images but
read unconditionally in the legacy image length fixup.

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Upstream commit 777a055980 expanded the SEC/PEI/SMM IDT from 32 to 256
entries and changed CommonExceptionHandlerWorker() to CpuDeadLoop() on
any unhandled vector below 256.  That breaks UefiPayload on several
coreboot platforms.

coreboot enables IOAPIC virtual wire mode in register_new_ioapic_gsi0(),
which routes legacy PIC activity (including IRQ0) as ExtINT, typically
delivered on vector 32.  coreboot only installs a 20-entry IDT; edk2
CpuDxe expands it to 256 entries in DXE, but PiSmmCpuDxeSmm installs its
own 256-entry SMM IDT during init.  On Ivy Bridge Chromebooks such as
google/link, a spurious timer interrupt during SMM bring-up (SMMSTORE
variable access) hits vector 32 with no ExternalInterruptHandler
registered, causing an immediate hang.

Haswell and newer boards (e.g. google/panther) use the same IOAPIC setup
but do not appear to deliver ExtINT into SMM during init, so the
regression was not observed there.

Restore the pre-777a055 behavior for external hardware interrupts: only
CPU exceptions (vectors 0-31) and the stack cookie vector
(PcdStackCookieExceptionVector, default 0x42) are treated as fatal when
unhandled.  The full 256-entry IDT is retained so stack cookie routing
continues to work.

Affected coreboot platforms (UefiPayload + SMMSTORE or other PiSmmCpu
users), ordered by likelihood:

  - Intel Sandy Bridge / Ivy Bridge (bd82x6x, ibexpeak PCH): all boards
    using register_new_ioapic_gsi0(), including Chromebooks (link,
    parrot, stout, lumpy, etc.) and ThinkPads (x220/x230/t420/t430s/...)
  - Intel 5-series / X58 (i82801jx, i82801ix): same IOAPIC ExtINT setup
  - Intel 4-series (i82801gx, i82801dx, i82801hx): same setup
  - Intel Wildcat Point (HSW ULT): uses register_new_ioapic_gsi0(); may
    be less timing-sensitive but shares the code path
  - AMD platforms using Hudson register_new_ioapic_gsi0() with edk2 SMM

Tested: boots google/link (IVB) on uefipayload_2605

Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Add LvglPkg (MrChromebox fork) as a submodule and, when LVGL_ENABLE is
set to TRUE, replace the text-mode DisplayEngineDxe with the LVGL-based
LvglDisplayEngineDxe in the UefiPayloadPkg DSC and FDF. In that
config, UsbMouseDxe is also switched to UsbMouseAbsolutePointerDxe
(LVGL input needs AbsolutePointer) and the LvglLib library class plus
LVGL's compiler-warning suppressions are pulled in.

When the set to FALSE (the default), the stock DisplayEngineDxe and
UsbMouseDxe are used as before.

Override some LvglPkg PCDs for visual tweaks.

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
The driver previously forced boot protocol and always decoded interrupt
data as the classic 3-byte boot mouse report. That breaks HID devices
that do not implement a usable boot protocol, or that only expose a
report-protocol layout with a Report ID and wider axes (common on cheap
wireless dongles such as YICHIP 3151:3020). Mis-parsing those packets
swaps/shifts the X/Y bytes and remaps cursor movement by 90°.

Parse the HID report descriptor into a field layout, select report
protocol when the layout is not boot-compatible (with boot fallback if
set-protocol fails), and decode buttons/X/Y/wheel from that map.

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
bump to match upstream master; add flag to suppress unused variable
warning on gcc 15/16

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Recent coreboot trees override this define rather than patching the FMP
root certificate file in the repo. To make this work, it must exist.

Signed-off-by: Florian Jung <fju@tuxedocomputers.com>
…rollment

Add SECURE_BOOT_DEFAULT_ENABLE / PcdSecureBootDefaultEnable so
EnrollDefaultKeys can leave SecureBoot enabled after provisioning
default keys, instead of always forcing it off.

Use '-D SECURE_BOOT_DEFUALT_ENABLE=TRUE' to enable by default.

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Revert the always-on InitializeMpExceptionStackSwitchHandlers()
behavior from e67f405.  That path copies the current GDT,
appends a TSS, and reloads GDTR/TR via ArchSetupExceptionStack().

UefiPayload sets PcdCpuStackGuard to FALSE.  Running the exception
stack setup unconditionally faults during early CpuDxe and causes
repeated platform resets before DXE can finish loading.

With the default FALSE setting, UefiPayload skips GDT/TSS rewriting
entirely, matching the working 2408 behavior.  CpuDxe already
installs its own GDT via InitGlobalDescriptorTable() before MP init,
so no payload-entry GDT setup is required for this configuration.

Restore PcdCpuStackGuard in CpuDxe.inf; e67f405 dropped the PCD
consumption when the gate was removed.

Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Signed-off-by: Tim Crawford <tcrawford@system76.com>
- Use VBT file GUID from edk2-platforms instead of proprietary BIOS
- Use System76 GOP Policy driver if defined
- Update paths for firmware-open

Signed-off-by: Tim Crawford <tcrawford@system76.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Rebase on edk2-stable202505