9 files changed, 302 insertions, 0 deletions
diff --git a/infra/corenix/pkgs/coreboot-payload-coreinfo/default.nix b/infra/corenix/pkgs/coreboot-payload-coreinfo/default.nix
new file mode 100644
index 000000000000..0ecb41add1cc
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot-payload-coreinfo/default.nix
@@ -0,0 +1,15 @@
+{ coreboot, lib, stdenv, writeText, coreinfoConfig ? { } }:
+
+stdenv.mkDerivation rec {
+  pname = "coreboot-payload-coreinfo";
+  inherit (coreboot.drvAttrs) version src postPatch;
+
+  preConfigure = "cd payloads/coreinfo";
+  configurePhase = ''
+    runHook preConfigure
+    cp ${coreboot.writeConfig coreinfoConfig} .config
+    make olddefconfig
+    runHook postConfigure
+  '';
+  installPhase = "install -D build/coreinfo.elf -t $out";
+}
diff --git a/infra/corenix/pkgs/coreboot-payload-grub2/default.nix b/infra/corenix/pkgs/coreboot-payload-grub2/default.nix
new file mode 100644
index 000000000000..958872cd4cdc
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot-payload-grub2/default.nix
@@ -0,0 +1,12 @@
+{ grub2, lib, extraPayloadModules ? [ ] }:
+
+grub2.overrideAttrs (oA: {
+  pname = "coreboot-payload-${oA.pname}";
+  configureFlags = oA.configureFlags
+    ++ [ "--with-platform=coreboot" "--enable-boot-time" ];
+  postBuild = ''
+    make -j $NIX_BUILD_CORES default_payload.elf EXTRA_PAYLOAD_MODULES="${
+      lib.concatStringsSep " " extraPayloadModules
+    }"'';
+  installPhase = "install -D default_payload.elf -t $out";
+})
diff --git a/infra/corenix/pkgs/coreboot-payload-nvramcui/default.nix b/infra/corenix/pkgs/coreboot-payload-nvramcui/default.nix
new file mode 100644
index 000000000000..2c9ddb36286b
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot-payload-nvramcui/default.nix
@@ -0,0 +1,9 @@
+{ coreboot, stdenv }:
+
+stdenv.mkDerivation rec {
+  pname = "coreboot-payload-nvramcui";
+  inherit (coreboot.drvAttrs) version src postPatch;
+
+  preConfigure = "cd payloads/nvramcui";
+  installPhase = "install -D nvramcui.elf -t $out";
+}
diff --git a/infra/corenix/pkgs/coreboot-payload-seabios/default.nix b/infra/corenix/pkgs/coreboot-payload-seabios/default.nix
new file mode 100644
index 000000000000..72a104e1b046
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot-payload-seabios/default.nix
@@ -0,0 +1,20 @@
+{ seabios, coreboot, stdenv, fetchurl, seabiosConfig ? {
+  CONFIG_COREBOOT = "y";
+  CONFIG_VGA_COREBOOT = "y";
+  CONFIG_BUILD_VGABIOS = "y";
+} }:
+
+seabios.overrideAttrs (oA: rec {
+  pname = "coreboot-payload-seabios";
+
+  configurePhase = ''
+    runHook preConfigure
+    cp ${coreboot.writeConfig seabiosConfig} .config
+    make olddefconfig
+    runHook postConfigure
+  '';
+  installPhase = ''
+    install -D out/bios.bin.elf -t $out
+    [ -f out/vgabios.bin ] && install -D out/vgabios.bin -t $out
+  '';
+})
diff --git a/infra/corenix/pkgs/coreboot-payload-tianocore/default.nix b/infra/corenix/pkgs/coreboot-payload-tianocore/default.nix
new file mode 100644
index 000000000000..5c3e5362462f
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot-payload-tianocore/default.nix
@@ -0,0 +1,78 @@
+{ fetchFromGitHub, python2, stdenv, libuuid, bc, utillinux, nasm, iasl, seabios
+}:
+
+# we can not override the source in edk2, so we had to copy the entire thing
+
+let
+  src = fetchFromGitHub {
+    owner = "MrChromebox";
+    repo = "edk2";
+    rev = "860a8d95c2ee89c9916d6e11230f246afa1cd629";
+    sha256 = "1bykw3lzfjl6idca37i736mwpqv60haczp7davhgqlmlb3nw6y3s";
+    fetchSubmodules = true;
+  };
+
+  version = "unstable";
+
+  pythonEnv = python2.withPackages (ps: [ ps.tkinter ]);
+
+  toolchain = stdenv.mkDerivation {
+    pname = "edk2-coreboot";
+
+    inherit version src;
+
+    buildInputs = [ libuuid pythonEnv ];
+
+    makeFlags = [ "-C BaseTools" ];
+
+    NIX_CFLAGS_COMPILE = "-Wno-return-type -Wno-error=stringop-truncation";
+
+    hardeningDisable = [ "format" "fortify" ];
+
+    installPhase = ''
+      mkdir -vp $out
+      mv -v BaseTools $out
+      mv -v edksetup.sh $out
+    '';
+
+    enableParallelBuilding = true;
+  };
+
+in stdenv.mkDerivation {
+  pname = "coreboot-payload-tianocore";
+  inherit version src;
+
+  buildInputs = [ bc pythonEnv utillinux nasm iasl ];
+
+  prePatch = ''
+    rm -rf BaseTools
+    ln -sv ${toolchain}/BaseTools BaseTools
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+    export WORKSPACE="$PWD"
+    . ${toolchain}/edksetup.sh BaseTools
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    build -a X64 -a IA32 -b RELEASE -t GCC5 -p CorebootPayloadPkg/CorebootPayloadPkgIa32X64.dsc -n $NIX_BUILD_CORES -D CSM_ENABLE
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mv -v Build/*/* $out
+    runHook postInstall
+  '';
+
+  hardeningDisable = [ "format" "stackprotector" "pic" "fortify" ];
+
+  postPatch = ''
+    cp ${seabios}/Csm16.bin OvmfPkg/Csm/Csm16/Csm16.bin
+  '';
+
+  dontPatchELF = true;
+}
diff --git a/infra/corenix/pkgs/coreboot-payload-tint/default.nix b/infra/corenix/pkgs/coreboot-payload-tint/default.nix
new file mode 100644
index 000000000000..b953c773336d
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot-payload-tint/default.nix
@@ -0,0 +1,24 @@
+{ coreboot, stdenv, fetchurl }:
+
+# the original tint does not support building as a coreboot payload
+# the patches from the coreboot repo require building tint in-tree
+# this makes everything a bit more complicated here
+
+stdenv.mkDerivation rec {
+  pname = "coreboot-payload-tint";
+  version = "0.04+nmu1";
+  inherit (coreboot.drvAttrs) src postPatch;
+
+  preConfigure = "cd payloads/external/tint";
+  preBuild = ''
+    tar -xf ${
+      fetchurl {
+        url =
+          "https://mirror.fsf.org/trisquel/pool/main/t/tint/tint_${version}.tar.gz";
+        sha256 = "17gbga1lha9yp5hpyr5vn1sc93fx413cksxmpyl8zv3b5rjvzsy1";
+      }
+    }
+    mv tint{-${version},}
+  '';
+  installPhase = "install -D tint/tint.elf -t $out";
+}
diff --git a/infra/corenix/pkgs/coreboot/default.nix b/infra/corenix/pkgs/coreboot/default.nix
new file mode 100644
index 000000000000..cc0c2f39b209
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot/default.nix
@@ -0,0 +1,62 @@
+{ fetchgit, fetchurl, stdenv, m4, flex, bison, zlib, gnat, curl, writeText
+, callPackage, lib, corebootConfig ? { CONFIG_PAYLOAD_NONE = "y"; } }:
+
+let
+  version = "4.12";
+  src = fetchgit {
+    url = "https://review.coreboot.org/coreboot.git";
+    rev = "${version}";
+    fetchSubmodules = true;
+    sha256 = "1l140zbvn6pkbrr55lymhi4lycimhpy8xgm45shl4zv6a9vjd66z";
+  };
+
+  toolchain = stdenv.mkDerivation rec {
+    pname = "coreboot-toolchain";
+    inherit version src;
+    nativeBuildInputs = [ curl stdenv m4 flex bison zlib gnat ];
+    buildPhase = ''
+      mkdir -p util/crossgcc/tarballs
+      ${lib.concatMapStringsSep "\n"
+      (file: "ln -s ${file.archive} util/crossgcc/tarballs/${file.name}")
+      (callPackage ./files.nix { })}
+      NIX_HARDENING_ENABLE="$\{NIX_HARDENING_ENABLE/ format/\}" make crossgcc-i386 CPUS=$NIX_BUILD_CORES
+    '';
+    installPhase = ''
+      cp -r util/crossgcc $out
+    '';
+  };
+
+  writeConfig = config:
+    let
+      filteredConfig = lib.filterAttrs (n: v: v != null) config;
+      lines =
+        lib.mapAttrsToList (name: value: "${name}=${value}") filteredConfig;
+      configFile = writeText "config" (lib.concatStringsSep "\n" lines);
+    in configFile;
+
+in stdenv.mkDerivation rec {
+
+  pname = "coreboot";
+  inherit version src;
+
+  postPatch = ''
+    rm -rf util/crossgcc
+    cp -r ${toolchain} util/crossgcc
+    chmod u+rwX -R util/crossgcc
+    patchShebangs util/xcompile/xcompile
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+    cp ${writeConfig corebootConfig} .config
+    make olddefconfig
+    runHook postConfigure
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    cp build/coreboot.rom $out
+  '';
+
+  passthru = { inherit toolchain writeConfig corebootConfig; };
+}
diff --git a/infra/corenix/pkgs/coreboot/files.nix b/infra/corenix/pkgs/coreboot/files.nix
new file mode 100644
index 000000000000..f5d71ec46b53
--- /dev/null
+++ b/infra/corenix/pkgs/coreboot/files.nix
@@ -0,0 +1,67 @@
+{ fetchurl }:
+
+# from util/crossgcc/buildgcc
+[
+  (rec {
+    version = "6.1.2";
+    name = "gmp-${version}.tar.xz";
+    archive = fetchurl {
+      sha256 = "04hrwahdxyqdik559604r7wrj9ffklwvipgfxgj4ys4skbl6bdc7";
+      url = "mirror://gnu/gmp/${name}";
+    };
+  })
+
+  (rec {
+    version = "4.0.2";
+    name = "mpfr-${version}.tar.xz";
+    archive = fetchurl {
+      sha256 = "12m3amcavhpqygc499s3fzqlb8f2j2rr7fkqsm10xbjfc04fffqx";
+      url = "mirror://gnu/mpfr/${name}";
+    };
+  })
+
+  (rec {
+    version = "1.1.0";
+    name = "mpc-${version}.tar.gz";
+    archive = fetchurl {
+      sha256 = "0biwnhjm3rx3hc0rfpvyniky4lpzsvdcwhmcn7f0h4iw2hwcb1b9";
+      url = "mirror://gnu/mpc/${name}";
+    };
+  })
+
+  (rec {
+    version = "8.3.0";
+    name = "gcc-${version}.tar.xz";
+    archive = fetchurl {
+      sha256 = "0b3xv411xhlnjmin2979nxcbnidgvzqdf4nbhix99x60dkzavfk4";
+      url = "mirror://gnu/gcc/${name}";
+    };
+  })
+
+  (rec {
+    version = "2.33.1";
+    name = "binutils-${version}.tar.xz";
+    archive = fetchurl {
+      sha256 = "1grcf8jaw3i0bk6f9xfzxw3qfgmn6fgkr108isdkbh1y3hnzqrmb";
+      url = "mirror://gnu/binutils/${name}";
+    };
+  })
+
+  (rec {
+    version = "20200110";
+    name = "acpica-unix2-${version}.tar.gz";
+    archive = fetchurl {
+      sha256 = "1hb4g6r7w8s4bhlkk36fmb4qxghnrwvad7f18cpn6zz0b4sjs7za";
+      url = "https://acpica.org/sites/acpica/files/${name}";
+    };
+  })
+
+  (rec {
+    version = "2.14.02";
+    name = "nasm-${version}.tar.bz2";
+    archive = fetchurl {
+      sha256 = "1g409sr1kj7v1089s9kv0i4azvddkcwcypnbakfryyi71b3jdz9l";
+      url = "https://www.nasm.us/pub/nasm/releasebuilds/${version}/${name}";
+    };
+  })
+]
diff --git a/infra/corenix/pkgs/overlay.nix b/infra/corenix/pkgs/overlay.nix
new file mode 100644
index 000000000000..f997739f2b7a
--- /dev/null
+++ b/infra/corenix/pkgs/overlay.nix
@@ -0,0 +1,15 @@
+final: prev:
+let inherit (final) callPackage;
+in {
+  coreboot = callPackage ./coreboot { };
+
+  # primary payloads
+  coreboot-payload-grub2 = callPackage ./coreboot-payload-grub2 { };
+  coreboot-payload-tianocore = callPackage ./coreboot-payload-tianocore { };
+  coreboot-payload-seabios = callPackage ./coreboot-payload-seabios { };
+
+  # secondary payloads
+  coreboot-payload-nvramcui = callPackage ./coreboot-payload-nvramcui { };
+  coreboot-payload-tint = callPackage ./coreboot-payload-tint { };
+  coreboot-payload-coreinfo = callPackage ./coreboot-payload-coreinfo { };
+}