payloads/external: Add more option related to SeaBIOS and GRUB2

Also known as "SeaGRUB", running GRUB2 atop SeaBIOS proves to be a
useful configuration, since SeaBIOS has improved its hardware
compatibility. For example, some USB drive can work under SeaBIOS but
do not work under native GRUB2, and GRUB2 can use BIOS call (provided
by SeaBIOS) as a fallback method to access hardware if it is present.

But more option is added addition to "SeaGRUB": now GRUB2 and SeaBIOS
can be built as secondary payloads, and "SeaGRUB" is now implemented
as "Primary SeaBIOS + Secondary GRUB2 (selected) + config files".

Signed-off-by: Bill XIE <persmule@hardenedlinux.org>
Change-Id: Ie681fa231abfe4a8f1e4510b3c17957550a9d2f8
Reviewed-on: https://review.coreboot.org/c/coreboot/+/60640
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Martin L Roth <gaumless@tutanota.com>
Reviewed-by: Paul Menzel <paulepanter@mailbox.org>

7 files changed, 104 insertions, 13 deletions

diff --git a/payloads/Kconfig b/payloads/Kconfig
index 386b207e7a4c..e184b35668be 100644
--- a/payloads/Kconfig
+++ b/payloads/Kconfig
@@ -121,6 +121,15 @@ config COREINFO_SECONDARY_PAYLOAD
 	  coreinfo can be loaded as a secondary payload under SeaBIOS, GRUB,
 	  or any other payload that can load additional payloads.
 
+config GRUB2_SECONDARY_PAYLOAD
+	bool "Load GRUB2 as a secondary payload"
+	default n
+	depends on !PAYLOAD_GRUB2
+	select PAYLOAD_BUILD_GRUB2
+	help
+	  GRUB2 can be loaded as a secondary payload under SeaBIOS or any
+	  other payload that can load additional payloads.
+
 config MEMTEST_SECONDARY_PAYLOAD
 	bool "Load Memtest86+ as a secondary payload"
 	default n
@@ -137,6 +146,17 @@ config NVRAMCUI_SECONDARY_PAYLOAD
 	  nvramcui can be loaded as a secondary payload under SeaBIOS, GRUB,
 	  or any other payload that can load additional payloads.
 
+config SEABIOS_SECONDARY_PAYLOAD
+	bool "Load SeaBIOS as a secondary payload"
+	default n
+	depends on ARCH_X86
+	depends on !PAYLOAD_SEABIOS
+	depends on !PAYLOAD_SEAGRUB
+	select PAYLOAD_BUILD_SEABIOS
+	help
+	  SeaBIOS can be loaded as a secondary payload under GRUB or any
+	  other payload that can load additional payloads.
+
 config TINT_SECONDARY_PAYLOAD
 	bool "Load tint as a secondary payload"
 	default n
diff --git a/payloads/external/GRUB2/Kconfig b/payloads/external/GRUB2/Kconfig
index 552f06a5238a..9ad82eee6731 100644
--- a/payloads/external/GRUB2/Kconfig
+++ b/payloads/external/GRUB2/Kconfig
@@ -1,5 +1,15 @@
+config PAYLOAD_BUILD_GRUB2
+	bool
+
 if PAYLOAD_GRUB2
 
+config PAYLOAD_FILE
+	default "payloads/external/GRUB2/grub2/build/default_payload.elf"
+
+endif
+
+if PAYLOAD_BUILD_GRUB2
+
 choice
 	prompt "GRUB2 version"
 	default GRUB2_STABLE
@@ -42,12 +52,9 @@ config GRUB2_EXTRA_MODULES
 	  * gfxmenu for graphical menus (you'll need a theme as well)
 	  * gfxterm_background for setting background
 
-config PAYLOAD_FILE
-	default "payloads/external/GRUB2/grub2/build/default_payload.elf"
-
 config GRUB2_INCLUDE_RUNTIME_CONFIG_FILE
 	bool "Include GRUB2 runtime config file into ROM image"
-	depends on PAYLOAD_GRUB2
+	depends on PAYLOAD_BUILD_GRUB2
 	default n
 	help
 	  The GRUB2 payload reads its runtime configuration file from etc/grub.cfg
@@ -72,3 +79,20 @@ config GRUB2_RUNTIME_CONFIG_FILE
 	  The path of the GRUB2 runtime configuration file to be added to CBFS.
 
 endif
+
+if PAYLOAD_SEAGRUB
+
+config PAYLOAD_FILE
+	default "payloads/external/SeaBIOS/seabios/out/bios.bin.elf"
+
+config SEABIOS_BOOTORDER_FILE
+	default "payloads/external/GRUB2/bootorder-seagrub"
+
+config SEAGRUB_ALLOW_SEABIOS_BOOTMENU
+	bool "Allow to access SeaBIOS boot menu before launching GRUB"
+	help
+	  Enable this to allow the access to the boot menu of SeaBIOS. It
+	  increases the flexibility but allows to bypass the secure mechanism
+	  implemented in the GRUB runtime config. Please use this with caution.
+
+endif
diff --git a/payloads/external/GRUB2/Kconfig.name b/payloads/external/GRUB2/Kconfig.name
index fe60d76dc398..91e68886e36b 100644
--- a/payloads/external/GRUB2/Kconfig.name
+++ b/payloads/external/GRUB2/Kconfig.name
@@ -1,9 +1,22 @@
 config PAYLOAD_GRUB2
 	bool "GRUB2"
 	depends on ARCH_X86 || ARCH_ARM
+	select PAYLOAD_BUILD_GRUB2
 	help
 	  Select this option if you want to build a coreboot image
 	  with a GRUB2 payload. If you don't know what this is
 	  about, just leave it enabled.
 
 	  See https://coreboot.org/Payloads for more information.
+
+config PAYLOAD_SEAGRUB
+	bool "GRUB2 atop SeaBIOS"
+	depends on ARCH_X86
+	select PAYLOAD_BUILD_SEABIOS
+	select GRUB2_SECONDARY_PAYLOAD
+	help
+	  Select this option if you want to build a coreboot image
+	  with a GRUB2 payload running atop SeaBIOS to improve its
+	  hardware compatibility.
+
+	  See https://coreboot.org/Payloads for more information.
diff --git a/payloads/external/GRUB2/bootorder-seagrub b/payloads/external/GRUB2/bootorder-seagrub
new file mode 100644
index 000000000000..b33e1295c761
--- /dev/null
+++ b/payloads/external/GRUB2/bootorder-seagrub
@@ -0,0 +1 @@
+/rom@img/grub2
diff --git a/payloads/external/Makefile.inc b/payloads/external/Makefile.inc
index e805a07b0ac6..e2fb9c727923 100644
--- a/payloads/external/Makefile.inc
+++ b/payloads/external/Makefile.inc
@@ -1,7 +1,7 @@
 ## SPDX-License-Identifier: GPL-2.0-only
 
 # set up payload config and version files for later inclusion
-ifeq ($(CONFIG_PAYLOAD_SEABIOS),y)
+ifeq ($(CONFIG_PAYLOAD_BUILD_SEABIOS),y)
 PAYLOAD_CONFIG=payloads/external/SeaBIOS/seabios/.config
 PAYLOAD_VERSION=payloads/external/SeaBIOS/seabios/out/autoversion.h
 endif
@@ -61,7 +61,8 @@ etc/grub.cfg-required := the GRUB runtime configuration file ($(CONFIG_GRUB2_RUN
 # SeaBIOS
 
 SEABIOS_CC_OFFSET=$(if $(filter %ccache,$(HOSTCC)),2,1)
-payloads/external/SeaBIOS/seabios/out/bios.bin.elf: $(DOTCONFIG)
+SEABIOS_TARGET_PATH=payloads/external/SeaBIOS/seabios/out/bios.bin.elf
+$(SEABIOS_TARGET_PATH): $(DOTCONFIG)
 	$(MAKE) -C payloads/external/SeaBIOS \
 			HOSTCC="$(HOSTCC)" \
 			CC=$(word $(SEABIOS_CC_OFFSET),$(CC_x86_32)) \
@@ -88,9 +89,14 @@ payloads/external/SeaBIOS/seabios/out/bios.bin.elf: $(DOTCONFIG)
 			CONFIG_CONSOLE_UART_BASE_ADDRESS=$(CONFIG_CONSOLE_UART_BASE_ADDRESS) \
 			CONFIG_SEABIOS_HARDWARE_IRQ=$(CONFIG_SEABIOS_HARDWARE_IRQ)
 
-payloads/external/SeaBIOS/seabios/out/vgabios.bin: payloads/external/SeaBIOS/seabios/out/bios.bin.elf
-payloads/external/SeaBIOS/seabios/.config: payloads/external/SeaBIOS/seabios/out/bios.bin.elf
-payloads/external/SeaBIOS/seabios/out/autoversion.h: payloads/external/SeaBIOS/seabios/out/bios.bin.elf
+payloads/external/SeaBIOS/seabios/out/vgabios.bin: $(SEABIOS_TARGET_PATH)
+payloads/external/SeaBIOS/seabios/.config: $(SEABIOS_TARGET_PATH)
+payloads/external/SeaBIOS/seabios/out/autoversion.h: $(SEABIOS_TARGET_PATH)
+
+cbfs-files-$(CONFIG_SEABIOS_SECONDARY_PAYLOAD) += img/seabios
+img/seabios-file := $(SEABIOS_TARGET_PATH)
+img/seabios-type := payload
+img/seabios-compression := $(CBFS_SECONDARY_PAYLOAD_COMPRESS_FLAG)
 
 # add a SeaBIOS bootorder file
 ifneq ($(strip $(CONFIG_SEABIOS_BOOTORDER_FILE)),)
@@ -122,6 +128,18 @@ $(call add_intermediate, seabios_thread_optionroms, $(CBFSTOOL))
 	$(CBFSTOOL) $< add-int -i 2 -n etc/threads
 endif
 
+ifeq ($(CONFIG_PAYLOAD_SEAGRUB),y)
+ifneq ($(CONFIG_SEAGRUB_ALLOW_SEABIOS_BOOTMENU),y)
+$(call add_intermediate, seabios_bootmenu, $(CBFSTOOL))
+	@printf "    SeaBIOS    Disable boot menu\n"
+	$(if $(CONFIG_UPDATE_IMAGE),-$(CBFSTOOL) $< remove -n etc/show-boot-menu 2>/dev/null)
+	$(CBFSTOOL) $< add-int -i 0 -n etc/show-boot-menu
+else
+$(call add_intermediate, seabios_bootmenu, $(CBFSTOOL))
+	$(if $(CONFIG_UPDATE_IMAGE),-$(CBFSTOOL) $< remove -n etc/show-boot-menu 2>/dev/null)
+endif
+endif
+
 # Depthcharge
 
 payloads/external/depthcharge/depthcharge/build/depthcharge.elf depthcharge: $(DOTCONFIG) $(CBFSTOOL)
@@ -189,6 +207,13 @@ payloads/external/FILO/filo/build/version.h: filo
 
 # Grub
 
+GRUB_TARGET_PATH=payloads/external/GRUB2/grub2/build/default_payload.elf
+
+cbfs-files-$(CONFIG_GRUB2_SECONDARY_PAYLOAD) += img/grub2
+img/grub2-file := $(GRUB_TARGET_PATH)
+img/grub2-type := payload
+img/grub2-compression := $(CBFS_SECONDARY_PAYLOAD_COMPRESS_FLAG)
+
 grub2: $(obj)/config.h
 	$(MAKE) -C payloads/external/GRUB2 \
 			HOSTCC="$(HOSTCC)" \
@@ -201,7 +226,7 @@ grub2: $(obj)/config.h
 			CONFIG_GRUB2_REVISION_ID=$(CONFIG_GRUB2_REVISION_ID) \
 			CONFIG_GRUB2_EXTRA_MODULES=$(CONFIG_GRUB2_EXTRA_MODULES)
 
-payloads/external/GRUB2/grub2/build/default_payload.elf: grub2
+$(GRUB_TARGET_PATH): grub2
 
 # U-Boot
 
diff --git a/payloads/external/SeaBIOS/Kconfig b/payloads/external/SeaBIOS/Kconfig
index d7dd165be80e..405ff9db5541 100644
--- a/payloads/external/SeaBIOS/Kconfig
+++ b/payloads/external/SeaBIOS/Kconfig
@@ -1,5 +1,15 @@
+config PAYLOAD_BUILD_SEABIOS
+	bool
+
 if PAYLOAD_SEABIOS
 
+config PAYLOAD_FILE
+	default "payloads/external/SeaBIOS/seabios/out/bios.bin.elf"
+
+endif
+
+if PAYLOAD_BUILD_SEABIOS
+
 choice
 	prompt "SeaBIOS version"
 	default SEABIOS_STABLE
@@ -114,9 +124,6 @@ config SEABIOS_SERCON_PORT_ADDR
 
 	  By default primary console UART defined by TTYS0_BASE is used.
 
-config PAYLOAD_FILE
-	default "payloads/external/SeaBIOS/seabios/out/bios.bin.elf"
-
 config PAYLOAD_VGABIOS_FILE
 	string
 	depends on SEABIOS_VGA_COREBOOT
diff --git a/payloads/external/SeaBIOS/Kconfig.name b/payloads/external/SeaBIOS/Kconfig.name
index bb1f30c9bf34..623c298279e0 100644
--- a/payloads/external/SeaBIOS/Kconfig.name
+++ b/payloads/external/SeaBIOS/Kconfig.name
@@ -1,6 +1,7 @@
 config PAYLOAD_SEABIOS
 	bool "SeaBIOS"
 	depends on ARCH_X86
+	select PAYLOAD_BUILD_SEABIOS
 	help
 	  Select this option if you want to build a coreboot image
 	  with a SeaBIOS payload. If you don't know what this is