MinnowBoard MRC based support

.github/workflows/build.yml

@@ -264,6 +264,39 @@ jobs:
           path: |
             build/coreboot.rom
           retention-days: 30
+  build_intel_minnowmax:
+    runs-on: ubuntu-22.04
+    container:
+      image: ghcr.io/dasharo/dasharo-sdk:v1.5.0
+      options: --user 1001
+    strategy:
+      matrix:
+        vendor: [ intel ]
+        model: [ minnowmax ]
+        variant: [ no_sb, sb ]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          # Checkout pull request HEAD commit instead of merge commit
+          # See: https://github.com/actions/checkout#checkout-pull-request-head-commit-instead-of-merge-commit
+          ref: ${{ github.event.pull_request.head.sha }}
+          # Fetch complete history
+          fetch-depth: 0
+      - name: Checkout all submodules
+        run: git submodule update --init --recursive --checkout
+      - name: Build Dasharo
+        run: |
+          cp configs/config.${{ matrix.vendor }}_${{ matrix.model }}_${{ matrix.variant }} .config
+          make olddefconfig
+          make
+      - name: Save artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: "dasharo-${{ matrix.vendor }}-${{ matrix.model }}-${{ matrix.variant }}"
+          path: |
+            build/coreboot.rom
+          retention-days: 30
 
   deploy_protectli_adl:
     if: startsWith(github.ref, 'refs/tags/protectli_vault_adl')
@@ -375,4 +408,19 @@ jobs:
     strategy:
       matrix:
         vendor: [ hardkernel ]
-        model: [ odroid_h4 ]
+        model: [ odroid_h4 ]
+  deploy_intel_minnowmax:
+    if: startsWith(github.ref, 'refs/tags/intel_minnowmax')
+    needs: build_intel_minnowmax
+    uses: ./.github/workflows/deploy-template.yml
+    with:
+      platform: intel
+      vendor: ${{ matrix.vendor }}
+      model: ${{ matrix.model }}
+      type: ${{ matrix.type }}
+    secrets: inherit
+    strategy:
+      matrix:
+        vendor: [ intel ]
+        model: [ minnowmax ]
+        type: [ no_sb, sb ]

.github/workflows/deploy-template.yml

@@ -48,6 +48,10 @@ jobs:
             base_dir="msi"
             model=$(echo "$tag" | cut -d'_' -f1-2)
             release=$(echo "$tag" | cut -d'_' -f3)
+          elif [ "${{ inputs.platform }}" == "intel" ]; then
+            base_dir="3mdeb/intel_minnowmax"
+            model=""
+            release=$(echo "$tag" | cut -d'_' -f3)
           fi
           echo "base_dir=$base_dir" >> "$GITHUB_OUTPUT"
           echo "model=$model" >> "$GITHUB_OUTPUT"
@@ -68,6 +72,8 @@ jobs:
             first_part=$(echo ${{ steps.tag_name.outputs.tag }} | cut -d "_" -f1)
             second_part=$(echo ${{ steps.tag_name.outputs.tag }} | cut -d "_" -f2)
             echo "artifact_name=dasharo-$first_part-${second_part}_${{ inputs.type }}" >> "$GITHUB_OUTPUT"
+          elif [ "${{ inputs.platform }}" == "intel" ]; then
+            echo "artifact_name=dasharo-${{ inputs.vendor }}-${{ inputs.model }}-${{ inputs.type }}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Download workflow artifact
@@ -93,6 +99,8 @@ jobs:
             new_name=$(echo "${{ inputs.vendor }}_${{ inputs.model }}_${{ inputs.payload }}_${release}.rom" | sed 's/.*/\L&/')
           elif [ "${{ inputs.platform }}" == "msi" ]; then
             new_name=$(echo "${model}_${{ inputs.type }}_${release}.rom" | sed 's/-/_/g; s/.*/\L&/')
+          elif [ "${{ inputs.platform }}" == "intel" ]; then
+            new_name=$(echo "${{ inputs.vendor }}-${{ inputs.model }}-${{ inputs.type }}_${release}.rom" | sed 's/-/_/g; s/.*/\L&/')
           fi
 
           # Create release directory if it doesn't exist

build.sh

@@ -23,6 +23,8 @@ usage() {
   echo -e "\toptiplex_9010  - build Dasharo compatible with Dell OptiPlex 7010/9010"
   echo -e "\tqemu           - build Dasharo for QEMU Q35"
   echo -e "\tqemu_full      - build Dasharo for QEMU Q35 with all menus available"
+  echo -e "\tminnow_no_sb   - build Dasharo compatbile with Intel MinnowMax without TXE Secure Boot"
+  echo -e "\tminnow_sb      - build Dasharo compatbile with Intel MinnowMax with TXE Secure Boot"
 }
 
 SDKVER="2023-11-24_2731fa619b"
@@ -220,6 +222,41 @@ function build_qemu {
   fi
 }
 
+function build_minnowboard {
+  DEFCONFIG="configs/config.intel_minnowmax_$1"
+  FW_VERSION=$(cat ${DEFCONFIG} | grep CONFIG_LOCALVERSION | cut -d '=' -f 2 | tr -d '"')
+  SDKVER=v1.5.0
+
+  # checkout several submodules needed by these boards (some others are checked
+  # out by coreboot's Makefile)
+  git submodule update --init --force --checkout \
+      3rdparty/dasharo-blobs
+
+  docker run --rm -t -e USER_ID=$(id -u) -e GROUP=$(id -g) -e GROUP_ID=$(id -g) \
+    -v $PWD:/home/coreboot/coreboot -v $HOME/.ssh:/home/coreboot/.ssh \
+    -v $HOME/.ssh:/home/coreboot/.ssh \
+    -w /home/coreboot/coreboot ghcr.io/dasharo/dasharo-sdk:$SDKVER \
+    /bin/bash -c "make distclean"
+
+  cp $DEFCONFIG .config
+
+  echo "Building Dasharo compatbile with Intel Minnowmax (version $FW_VERSION)"
+
+  docker run --rm -t -e USER_ID=$(id -u) -e GROUP=$(id -g) -e GROUP_ID=$(id -g) \
+    -v $PWD:/home/coreboot/coreboot -v $HOME/.ssh:/home/coreboot/.ssh \
+    -w /home/coreboot/coreboot ghcr.io/dasharo/dasharo-sdk:$SDKVER \
+    /bin/bash -c "make olddefconfig && make -j$(nproc)"
+
+  cp build/coreboot.rom intel_minnowmax_${FW_VERSION}_$1.rom
+  if [ $? -eq 0 ]; then
+    echo "Result binary placed in $PWD/intel_minnowmax_${FW_VERSION}_$1.rom"
+    sha256sum intel_minnowmax_${FW_VERSION}_$1.rom > intel_minnowmax_${FW_VERSION}_$1.rom.sha256
+  else
+    echo "Build failed!"
+    exit 1
+  fi
+}
+
 CMD="$1"
 
 case "$CMD" in
@@ -289,6 +326,12 @@ case "$CMD" in
     "qemu_full" | "QEMU_full" | "q35_full" | "Q35_full" )
         build_qemu "_all_menus"
         ;;
+    "minnow_no_sb" )
+        build_minnowboard "no_sb"
+        ;;
+    "minnow_sb" )
+        build_minnowboard "sb"
+        ;;
     *)
         echo "Invalid command: \"$CMD\""
         usage

configs/config.intel_minnowmax → configs/config.intel_minnowmax_no_sb

@@ -1,30 +1,38 @@
+CONFIG_LOCALVERSION="0.9.0-rc3"
 CONFIG_VENDOR_INTEL=y
 CONFIG_ONBOARD_VGA_IS_PRIMARY=y
 # CONFIG_VGA_BIOS is not set
 CONFIG_PXE_ROM_ID="8086,1539"
-CONFIG_IFD_BIN_PATH="IFWI_HEADER.bin"
-CONFIG_ME_BIN_PATH="VLV_SEC_REGION.bin"
+CONFIG_IFD_BIN_PATH="3rdparty/dasharo-blobs/$(MAINBOARDDIR)/descriptor.bin"
+CONFIG_ME_BIN_PATH="3rdparty/dasharo-blobs/$(MAINBOARDDIR)/txe.bin"
 CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x100000
 CONFIG_EDK2_BOOT_TIMEOUT=3
 CONFIG_BOARD_INTEL_MINNOWMAX=y
 CONFIG_HAVE_IFD_BIN=y
 CONFIG_EDK2_BOOTSPLASH_FILE="3rdparty/dasharo-blobs/dasharo/bootsplash.bmp"
+CONFIG_DISABLE_HPET=y
 CONFIG_HAVE_MRC=y
+CONFIG_MRC_FILE="3rdparty/dasharo-blobs/$(MAINBOARDDIR)/mrc.elf"
+CONFIG_MRC_RMT=y
 CONFIG_HAVE_ME_BIN=y
 CONFIG_NO_GFX_INIT=y
-CONFIG_BOOTMEDIA_SMM_BWP=y
+CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
+CONFIG_DRIVERS_GENERIC_CBFS_SERIAL=y
+CONFIG_DRIVERS_GENERIC_CBFS_UUID=y
+CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
+CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
 CONFIG_DEFAULT_CONSOLE_LOGLEVEL_0=y
 CONFIG_PAYLOAD_EDK2=y
 CONFIG_EDK2_REPOSITORY="https://github.com/Dasharo/edk2"
-CONFIG_EDK2_TAG_OR_REV="ae0ecedb0c0e57157f11e320f6a4e66806355404"
+CONFIG_EDK2_TAG_OR_REV="e91a6e499eff7ff601fe65383d16811ee96fce2c"
 CONFIG_EDK2_USE_EDK2_PLATFORMS=y
 CONFIG_EDK2_PLATFORMS_REPOSITORY="https://github.com/Dasharo/edk2-platforms"
 CONFIG_EDK2_PLATFORMS_TAG_OR_REV="3323ed481d35096fb6a7eae7b49f35eff00f86cf"
 CONFIG_EDK2_CBMEM_LOGGING=y
 CONFIG_EDK2_FOLLOW_BGRT_SPEC=y
 # CONFIG_EDK2_PS2_SUPPORT is not set
 CONFIG_EDK2_SERIAL_SUPPORT=y
-CONFIG_EDK2_GOP_FILE="IntelBYTGopDriver.efi"
+CONFIG_EDK2_GOP_FILE="3rdparty/dasharo-blobs/$(MAINBOARDDIR)/IntelGopDriver.efi"
 CONFIG_EDK2_DISABLE_TPM=y
 CONFIG_BUILD_IPXE=y
 # CONFIG_IPXE_SERIAL_CONSOLE is not set
@@ -39,7 +47,6 @@ CONFIG_EDK2_DASHARO_SYSTEM_FEATURES=y
 CONFIG_EDK2_DASHARO_SECURITY_OPTIONS=y
 CONFIG_EDK2_DASHARO_USB_CONFIG=y
 CONFIG_EDK2_DASHARO_NETWORK_CONFIG=y
-CONFIG_EDK2_DASHARO_NETWORK_BOOT_DEFAULT_ENABLE=y
 CONFIG_EDK2_DASHARO_SERIAL_REDIRECTION_DEFAULT_ENABLE=y
 CONFIG_EDK2_BOOT_MENU_KEY=0x0011
 CONFIG_EDK2_SETUP_MENU_KEY=0x000C

configs/config.intel_minnowmax_sb

@@ -0,0 +1,58 @@
+CONFIG_LOCALVERSION="0.9.0-rc3"
+CONFIG_VENDOR_INTEL=y
+CONFIG_ONBOARD_VGA_IS_PRIMARY=y
+# CONFIG_VGA_BIOS is not set
+CONFIG_PXE_ROM_ID="8086,1539"
+CONFIG_IFD_BIN_PATH="3rdparty/dasharo-blobs/$(MAINBOARDDIR)/descriptor.bin"
+CONFIG_ME_BIN_PATH="3rdparty/dasharo-blobs/$(MAINBOARDDIR)/txe_sb.bin"
+CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x100000
+CONFIG_EDK2_BOOT_TIMEOUT=3
+CONFIG_BOARD_INTEL_MINNOWMAX=y
+CONFIG_HAVE_IFD_BIN=y
+CONFIG_EDK2_BOOTSPLASH_FILE="3rdparty/dasharo-blobs/dasharo/bootsplash.bmp"
+CONFIG_HAVE_MRC=y
+CONFIG_MRC_FILE="3rdparty/dasharo-blobs/$(MAINBOARDDIR)/mrc.elf"
+CONFIG_MRC_RMT=y
+CONFIG_TXE_SECURE_BOOT=y
+CONFIG_TXE_SB_INCLUDE_KEY_MANIFEST=y
+CONFIG_TXE_SB_GENERATE_KEY_MANIFEST=y
+CONFIG_TXE_SB_KEY_MANIFEST_KEY_PATH="3rdparty/dasharo-blobs/$(MAINBOARDDIR)/oem_key_priv_sample.pem"
+CONFIG_TXE_SB_SBM_MANIFEST_KEY_PATH="3rdparty/dasharo-blobs/$(MAINBOARDDIR)/sb_key_priv_sample.pem"
+CONFIG_HAVE_ME_BIN=y
+CONFIG_NO_GFX_INIT=y
+CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
+CONFIG_DRIVERS_GENERIC_CBFS_SERIAL=y
+CONFIG_DRIVERS_GENERIC_CBFS_UUID=y
+CONFIG_CBFS_VERIFICATION=y
+CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
+CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
+CONFIG_DEFAULT_CONSOLE_LOGLEVEL_0=y
+CONFIG_PAYLOAD_EDK2=y
+CONFIG_EDK2_REPOSITORY="https://github.com/Dasharo/edk2"
+CONFIG_EDK2_TAG_OR_REV="e91a6e499eff7ff601fe65383d16811ee96fce2c"
+CONFIG_EDK2_USE_EDK2_PLATFORMS=y
+CONFIG_EDK2_PLATFORMS_REPOSITORY="https://github.com/Dasharo/edk2-platforms"
+CONFIG_EDK2_PLATFORMS_TAG_OR_REV="3323ed481d35096fb6a7eae7b49f35eff00f86cf"
+CONFIG_EDK2_CBMEM_LOGGING=y
+CONFIG_EDK2_FOLLOW_BGRT_SPEC=y
+# CONFIG_EDK2_PS2_SUPPORT is not set
+CONFIG_EDK2_SERIAL_SUPPORT=y
+CONFIG_EDK2_GOP_FILE="3rdparty/dasharo-blobs/$(MAINBOARDDIR)/IntelGopDriver.efi"
+CONFIG_EDK2_DISABLE_TPM=y
+CONFIG_BUILD_IPXE=y
+# CONFIG_IPXE_SERIAL_CONSOLE is not set
+CONFIG_IPXE_NO_PROMPT=y
+CONFIG_IPXE_ADD_SCRIPT=y
+CONFIG_IPXE_SCRIPT="3rdparty/dasharo-blobs/dasharo/dasharo.ipxe"
+CONFIG_IPXE_CUSTOM_BUILD_ID="0123456789"
+CONFIG_EDK2_ENABLE_IPXE=y
+# CONFIG_EDK2_SECURE_BOOT_DEFAULT_ENABLE is not set
+CONFIG_EDK2_SETUP_PASSWORD=y
+CONFIG_EDK2_DASHARO_SYSTEM_FEATURES=y
+CONFIG_EDK2_DASHARO_SECURITY_OPTIONS=y
+CONFIG_EDK2_DASHARO_USB_CONFIG=y
+CONFIG_EDK2_DASHARO_NETWORK_CONFIG=y
+CONFIG_EDK2_DASHARO_SERIAL_REDIRECTION_DEFAULT_ENABLE=y
+CONFIG_EDK2_BOOT_MENU_KEY=0x0011
+CONFIG_EDK2_SETUP_MENU_KEY=0x000C
+CONFIG_EDK2_CREATE_PREINSTALLED_BOOT_OPTIONS=y

payloads/external/Makefile.mk

@@ -87,7 +87,8 @@ $(SEABIOS_TARGET_PATH): $(DOTCONFIG)
 			CONFIG_DRIVERS_UART_8250MEM_32=$(CONFIG_DRIVERS_UART_8250MEM_32) \
 			CONFIG_ENABLE_HSUART=$(CONFIG_ENABLE_HSUART) \
 			CONFIG_CONSOLE_UART_BASE_ADDRESS=$(CONFIG_CONSOLE_UART_BASE_ADDRESS) \
-			CONFIG_SEABIOS_HARDWARE_IRQ=$(CONFIG_SEABIOS_HARDWARE_IRQ)
+			CONFIG_SEABIOS_HARDWARE_IRQ=$(CONFIG_SEABIOS_HARDWARE_IRQ) \
+			CONFIG_SEABIOS_CBFS_LOCATION=$(CONFIG_SEABIOS_CBFS_LOCATION)
 
 payloads/external/SeaBIOS/seabios/out/vgabios.bin: $(SEABIOS_TARGET_PATH)
 payloads/external/SeaBIOS/seabios/.config: $(SEABIOS_TARGET_PATH)

payloads/external/SeaBIOS/Kconfig

@@ -141,6 +141,10 @@ config SEABIOS_SERCON_PORT_ADDR
 
 	  By default primary console UART defined by TTYS0_BASE is used.
 
+config SEABIOS_CBFS_LOCATION
+	hex
+	default 0x0
+
 config PAYLOAD_VGABIOS_FILE
 	string
 	depends on SEABIOS_VGA_COREBOOT

payloads/external/SeaBIOS/Makefile

@@ -39,6 +39,7 @@ checkout: fetch
 config: checkout
 	echo "    CONFIG     SeaBIOS $(TAG-y)"
 	echo "CONFIG_COREBOOT=y" > seabios/.config
+	echo "CONFIG_CBFS_LOCATION=$(CONFIG_SEABIOS_CBFS_LOCATION)" >> seabios/.config
 ifeq ($(CONFIG_CONSOLE_SERIAL)$(CONFIG_DRIVERS_UART_8250IO),yy)
 	echo "CONFIG_DEBUG_SERIAL=y" >> seabios/.config
 	echo "CONFIG_DEBUG_SERIAL_PORT=$(CONFIG_TTYS0_BASE)" >> seabios/.config

payloads/external/iPXE/Makefile

@@ -4,7 +4,7 @@
 # When updating, change the name both here and in payloads/external/iPXE/Kconfig
 
 # Temporarily Dasharo fork is used until i225/i226 native support is merged.
-STABLE_COMMIT_ID=35d84756c8fc55b55922a24a8cd9e7ea27f92edb
+STABLE_COMMIT_ID=de0e1cf11bf9f29fde4e6da77f1199091f6b90fa
 
 TAG-$(CONFIG_IPXE_MASTER)=origin/master
 TAG-$(CONFIG_IPXE_STABLE)=$(STABLE_COMMIT_ID)