From 2b8d1a2b5ceca14980f786ff44f424cf0713f825 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Filip=20Go=C5=82a=C5=9B?= Date: Tue, 30 Jun 2026 13:20:48 +0200 Subject: [PATCH 1/5] novacustom_tgl: Enable SBOM generation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Gołaś --- configs/config.novacustom_ns5x_tgl | 11 +++++++++++ configs/config.novacustom_nv4x_tgl | 11 +++++++++++ 2 files changed, 22 insertions(+) diff --git a/configs/config.novacustom_ns5x_tgl b/configs/config.novacustom_ns5x_tgl index fc4da4275c1..6dbf7e253e4 100644 --- a/configs/config.novacustom_ns5x_tgl +++ b/configs/config.novacustom_ns5x_tgl @@ -1,5 +1,16 @@ CONFIG_LOCALVERSION="v1.6.0-rc3" CONFIG_OPTION_BACKEND_NONE=y +CONFIG_SBOM=y +CONFIG_SBOM_PAYLOAD=y +CONFIG_SBOM_ME=y +CONFIG_SBOM_EC=y +CONFIG_SBOM_SINIT_ACM=y +CONFIG_SBOM_BIOS_ACM=y +CONFIG_SBOM_INTEL_MICROCODE=y +CONFIG_SBOM_INTEL_FSP=y +CONFIG_SBOM_IFD=y +CONFIG_SBOM_VBOOT=y +CONFIG_SBOM_IPXE=y CONFIG_VENDOR_NOVACUSTOM=y CONFIG_FMDFILE="src/mainboard/clevo/tgl-u/vboot-rwa.fmd" # CONFIG_CONSOLE_SERIAL is not set diff --git a/configs/config.novacustom_nv4x_tgl b/configs/config.novacustom_nv4x_tgl index b9dedf91466..9b4a2ad845a 100644 --- a/configs/config.novacustom_nv4x_tgl +++ b/configs/config.novacustom_nv4x_tgl @@ -1,5 +1,16 @@ CONFIG_LOCALVERSION="v1.6.0-rc3" CONFIG_OPTION_BACKEND_NONE=y +CONFIG_SBOM=y +CONFIG_SBOM_PAYLOAD=y +CONFIG_SBOM_ME=y +CONFIG_SBOM_EC=y +CONFIG_SBOM_SINIT_ACM=y +CONFIG_SBOM_BIOS_ACM=y +CONFIG_SBOM_INTEL_MICROCODE=y +CONFIG_SBOM_INTEL_FSP=y +CONFIG_SBOM_IFD=y +CONFIG_SBOM_VBOOT=y +CONFIG_SBOM_IPXE=y CONFIG_VENDOR_NOVACUSTOM=y CONFIG_FMDFILE="src/mainboard/clevo/tgl-u/vboot-rwa.fmd" # CONFIG_CONSOLE_SERIAL is not set From 2480ddc8322cc640355973695468fe9fe3b1bc41 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Filip=20Go=C5=82a=C5=9B?= Date: Tue, 30 Jun 2026 15:44:35 +0200 Subject: [PATCH 2/5] src/sbom/Makefile.mk: Clone EDK2 before accessing it for SBOM MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Gołaś --- src/sbom/Makefile.mk | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/sbom/Makefile.mk b/src/sbom/Makefile.mk index 2502099b998..2c072d94b1b 100644 --- a/src/sbom/Makefile.mk +++ b/src/sbom/Makefile.mk @@ -378,6 +378,17 @@ $(build-dir)/payload-iPXE.json: $(src-dir)/payload-iPXE.json $(if $(ipxe-gitdir) git_comm_hash=$$(git --git-dir payloads/external/iPXE/ipxe/.git log -n 1 --format=%H); \ sed -i -e "s//$$git_tree_hash/" -e "s//$$git_comm_hash/" $@ +# The edk2 payload is cloned into its nested workspace (workspace//) only +# as a side effect of building the payload binary (recursive make in +# payloads/external/edk2). On a fresh tree that .git does not exist yet and no +# other rule produces it, so the order-only prerequisite below would fail with +# "No rule to make target". Tie it to the payload binary so building the +# payload satisfies it. The other payloads are submodules already checked out +# at parse time, so they need no such rule. +ifeq ($(CONFIG_PAYLOAD_EDK2),y) +$(payload-git-dir-y)/.git: $(CONFIG_PAYLOAD_FILE) ; +endif + # Order-only dep on the .git dir ensures the payload is cloned before we try # to read it. We do NOT depend on the payload binary ($(CONFIG_PAYLOAD_FILE)) # because: (a) the recipe never reads the binary, only .git; (b) with make -B From b82adb820b801179d8b75d922488f7d62b89862d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Filip=20Go=C5=82a=C5=9B?= Date: Tue, 30 Jun 2026 15:52:58 +0200 Subject: [PATCH 3/5] security/intel/cbnt/measurement.c: Disable flexarray check for zero-length arr MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Gołaś --- src/security/intel/cbnt/measurement.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/security/intel/cbnt/measurement.c b/src/security/intel/cbnt/measurement.c index ba7203df807..7f1792892f4 100644 --- a/src/security/intel/cbnt/measurement.c +++ b/src/security/intel/cbnt/measurement.c @@ -86,6 +86,15 @@ struct bpm_hash_list { struct hash_struct hashes[]; } __packed; +/* + * post_ibb_hash and obb_hash below are deprecated and per the spec always carry + * a zero-length digest ({ TPM_ALG_NULL, 0 }), so embedding the hash_struct (which + * ends in a flexible array) mid-structure is safe here. Silence GCC's + * flex-array-member-not-at-end for these two spec layouts. + */ +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wflex-array-member-not-at-end" + /* IBB Segment Element (upper part) */ struct bpm_ibbs { char structure_id[8]; /* "__IBBS__" */ @@ -117,6 +126,8 @@ struct bpm_ibbs_bottom { /* ibb_segments[segment_count]; */ } __packed; +#pragma GCC diagnostic pop + /* KMHASH_STRUCT */ struct km_hash { uint64_t usage; /* see KM_HASH_USAGE_* constants for values */ From f3eb29c618e3214e3475b3b2967051347b908adc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Filip=20Go=C5=82a=C5=9B?= Date: Wed, 1 Jul 2026 07:34:21 +0200 Subject: [PATCH 4/5] configs/config.novacustom_*_tgl: Bump to v1.6.0-rc4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Gołaś --- configs/config.novacustom_ns5x_tgl | 6 +++--- configs/config.novacustom_nv4x_tgl | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/configs/config.novacustom_ns5x_tgl b/configs/config.novacustom_ns5x_tgl index 6dbf7e253e4..8cc898cf366 100644 --- a/configs/config.novacustom_ns5x_tgl +++ b/configs/config.novacustom_ns5x_tgl @@ -1,4 +1,4 @@ -CONFIG_LOCALVERSION="v1.6.0-rc3" +CONFIG_LOCALVERSION="v1.6.0-rc4" CONFIG_OPTION_BACKEND_NONE=y CONFIG_SBOM=y CONFIG_SBOM_PAYLOAD=y @@ -33,8 +33,8 @@ CONFIG_PCIEXP_HOTPLUG_IO=0x2000 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y CONFIG_DRIVERS_EFI_FW_INFO=y CONFIG_DRIVERS_EFI_MAIN_FW_GUID="2c033395-4de7-4de5-b610-eafa2e0b6300" -CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01060003 -CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x01060003 +CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01060004 +CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x01060000 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y CONFIG_DRIVERS_GENERIC_CBFS_SERIAL=y CONFIG_DRIVERS_GENERIC_CBFS_UUID=y diff --git a/configs/config.novacustom_nv4x_tgl b/configs/config.novacustom_nv4x_tgl index 9b4a2ad845a..9d2c0ee3562 100644 --- a/configs/config.novacustom_nv4x_tgl +++ b/configs/config.novacustom_nv4x_tgl @@ -1,4 +1,4 @@ -CONFIG_LOCALVERSION="v1.6.0-rc3" +CONFIG_LOCALVERSION="v1.6.0-rc4" CONFIG_OPTION_BACKEND_NONE=y CONFIG_SBOM=y CONFIG_SBOM_PAYLOAD=y @@ -33,8 +33,8 @@ CONFIG_PCIEXP_HOTPLUG_IO=0x2000 CONFIG_DRIVERS_EFI_VARIABLE_STORE=y CONFIG_DRIVERS_EFI_FW_INFO=y CONFIG_DRIVERS_EFI_MAIN_FW_GUID="ffe49861-809c-4aa4-8d3e-2b1640b3c96c" -CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01060003 -CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x01060003 +CONFIG_DRIVERS_EFI_MAIN_FW_VERSION=0x01060004 +CONFIG_DRIVERS_EFI_MAIN_FW_LSV=0x01060000 CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y CONFIG_DRIVERS_GENERIC_CBFS_SERIAL=y CONFIG_DRIVERS_GENERIC_CBFS_UUID=y From 4e56d2bbe18553a63b557bc35a36eb3224976a1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Filip=20Go=C5=82a=C5=9B?= Date: Wed, 8 Jul 2026 12:35:51 +0200 Subject: [PATCH 5/5] build.sh: Bump dasharo-sdk to v1.9.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Gołaś --- build.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.sh b/build.sh index 587e5287048..932b9f217af 100755 --- a/build.sh +++ b/build.sh @@ -43,7 +43,7 @@ usage() { echo -e "\tasrock_spc741d8 - build Dasharo compatible with ASRock Rack SPC741D8-2L2T/BCM" } -DASHARO_SDK=${DASHARO_SDK:-"ghcr.io/dasharo/dasharo-sdk:v1.6.0"} +DASHARO_SDK=${DASHARO_SDK:-"ghcr.io/dasharo/dasharo-sdk:v1.9.1"} BUILD_TIMELESS=${BUILD_TIMELESS:-0} AIRGAP=${AIRGAP:-0}