experimental edk2 support

Signed-off-by: Leah Rowe <leah@libreboot.org>

15 files changed, 486 insertions, 0 deletions

diff --git a/config/submodule/edk2/default/arm-trusted-firmware/module.cfg b/config/submodule/edk2/default/arm-trusted-firmware/module.cfg
new file mode 100644
index 00000000..08331cf5
--- /dev/null
+++ b/config/submodule/edk2/default/arm-trusted-firmware/module.cfg
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+subgit="https://review.coreboot.org/arm-trusted-firmware.git"
+subgit_bkup="https://github.com/coreboot/arm-trusted-firmware"
+subhash="b5eaba47efc5e4e3029086d5c25eee0e8dbb0129"
diff --git a/config/submodule/edk2/default/cmocka/module.cfg b/config/submodule/edk2/default/cmocka/module.cfg
new file mode 100644
index 00000000..32a43066
--- /dev/null
+++ b/config/submodule/edk2/default/cmocka/module.cfg
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+subgit="https://review.coreboot.org/cmocka.git"
+subgit_bkup="https://github.com/coreboot/cmocka"
+subhash="8be37372097d1aa5e03b565936db7891b6180e73"
diff --git a/config/submodule/edk2/default/cmocka/patches/0001-disable-Werror.patch b/config/submodule/edk2/default/cmocka/patches/0001-disable-Werror.patch
new file mode 100644
index 00000000..8bf8bf10
--- /dev/null
+++ b/config/submodule/edk2/default/cmocka/patches/0001-disable-Werror.patch
@@ -0,0 +1,74 @@
+From 0762c4d3ad28239550f39793946c00a4866a797f Mon Sep 17 00:00:00 2001
+From: Leah Rowe <leah@libreboot.org>
+Date: Mon, 21 Sep 2026 10:49:57 +0100
+Subject: [PATCH 1/1] disable -Werror
+
+Signed-off-by: Leah Rowe <leah@libreboot.org>
+---
+ .ycm_extra_conf.py   |  1 -
+ CompilerChecks.cmake | 17 -----------------
+ 2 files changed, 18 deletions(-)
+
+diff --git a/.ycm_extra_conf.py b/.ycm_extra_conf.py
+index 8305a8b..538bc2b 100644
+--- a/.ycm_extra_conf.py
++++ b/.ycm_extra_conf.py
+@@ -4,7 +4,6 @@ import ycm_core
+ flags = [
+ '-Wall',
+ '-Wextra',
+-'-Werror',
+ '-x', 'c',
+ '-Iinclude',
+ ]
+diff --git a/CompilerChecks.cmake b/CompilerChecks.cmake
+index e39cc1d..9ee5462 100644
+--- a/CompilerChecks.cmake
++++ b/CompilerChecks.cmake
+@@ -7,14 +7,6 @@ if (UNIX)
+     #
+     # This will prevent that compiler flags are detected incorrectly.
+     #
+-    check_c_compiler_flag("-Werror" REQUIRED_FLAGS_WERROR)
+-    if (REQUIRED_FLAGS_WERROR)
+-        set(CMAKE_REQUIRED_FLAGS "-Werror")
+-
+-        if (PICKY_DEVELOPER)
+-            list(APPEND SUPPORTED_COMPILER_FLAGS "-Werror")
+-        endif()
+-    endif()
+ 
+     add_c_compiler_flag("-std=gnu99" SUPPORTED_COMPILER_FLAGS)
+     add_c_compiler_flag("-Wpedantic" SUPPORTED_COMPILER_FLAGS)
+@@ -23,20 +15,12 @@ if (UNIX)
+     add_c_compiler_flag("-Wmissing-prototypes" SUPPORTED_COMPILER_FLAGS)
+     add_c_compiler_flag("-Wcast-align" SUPPORTED_COMPILER_FLAGS)
+     #add_c_compiler_flag("-Wcast-qual" SUPPORTED_COMPILER_FLAGS)
+-    add_c_compiler_flag("-Werror=address" SUPPORTED_COMPILER_FLAGS)
+     add_c_compiler_flag("-Wstrict-prototypes" SUPPORTED_COMPILER_FLAGS)
+-    add_c_compiler_flag("-Werror=strict-prototypes" SUPPORTED_COMPILER_FLAGS)
+     add_c_compiler_flag("-Wwrite-strings" SUPPORTED_COMPILER_FLAGS)
+-    add_c_compiler_flag("-Werror=write-strings" SUPPORTED_COMPILER_FLAGS)
+-    add_c_compiler_flag("-Werror-implicit-function-declaration" SUPPORTED_COMPILER_FLAGS)
+     add_c_compiler_flag("-Wpointer-arith" SUPPORTED_COMPILER_FLAGS)
+-    add_c_compiler_flag("-Werror=pointer-arith" SUPPORTED_COMPILER_FLAGS)
+     add_c_compiler_flag("-Wreturn-type" SUPPORTED_COMPILER_FLAGS)
+-    add_c_compiler_flag("-Werror=return-type" SUPPORTED_COMPILER_FLAGS)
+     add_c_compiler_flag("-Wuninitialized" SUPPORTED_COMPILER_FLAGS)
+-    add_c_compiler_flag("-Werror=uninitialized" SUPPORTED_COMPILER_FLAGS)
+     add_c_compiler_flag("-Wimplicit-fallthrough" SUPPORTED_COMPILER_FLAGS)
+-    add_c_compiler_flag("-Werror=strict-overflow" SUPPORTED_COMPILER_FLAGS)
+     add_c_compiler_flag("-Wstrict-overflow=2" SUPPORTED_COMPILER_FLAGS)
+     add_c_compiler_flag("-Wno-format-zero-length" SUPPORTED_COMPILER_FLAGS)
+     add_c_compiler_flag("-Wmissing-field-initializers" SUPPORTED_COMPILER_FLAGS)
+@@ -47,7 +31,6 @@ if (UNIX)
+         set(CMAKE_REQUIRED_FLAGS "${CMAKE_REQUIRED_FLAGS} -Wformat")
+     endif()
+     add_c_compiler_flag("-Wformat-security" SUPPORTED_COMPILER_FLAGS)
+-    add_c_compiler_flag("-Werror=format-security" SUPPORTED_COMPILER_FLAGS)
+ 
+     # Allow zero for a variadic macro argument
+     string(TOLOWER "${CMAKE_C_COMPILER_ID}" _C_COMPILER_ID)
+-- 
+2.47.3
+
diff --git a/config/submodule/edk2/default/fsp/module.cfg b/config/submodule/edk2/default/fsp/module.cfg
new file mode 100644
index 00000000..fc238774
--- /dev/null
+++ b/config/submodule/edk2/default/fsp/module.cfg
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+subgit="https://review.coreboot.org/fsp.git"
+subgit_bkup="https://github.com/coreboot/fsp"
+subhash="98426bfd958eb7397c474ff5d440dc9a1d146215"
diff --git a/config/submodule/edk2/default/intel-microcode/module.cfg b/config/submodule/edk2/default/intel-microcode/module.cfg
new file mode 100644
index 00000000..b5b452c4
--- /dev/null
+++ b/config/submodule/edk2/default/intel-microcode/module.cfg
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+subgit="https://review.coreboot.org/intel-microcode.git"
+subgit_bkup="https://github.com/coreboot/intel-microcode"
+subhash="927e65c8d5a6e4ec05cc74b1778283ab2284d0c1"
diff --git a/config/submodule/edk2/default/libgfxinit/module.cfg b/config/submodule/edk2/default/libgfxinit/module.cfg
new file mode 100644
index 00000000..480ba0f1
--- /dev/null
+++ b/config/submodule/edk2/default/libgfxinit/module.cfg
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+subgit="https://review.coreboot.org/libgfxinit.git"
+subgit_bkup="https://github.com/coreboot/libgfxinit"
+subhash="6e74c703132a8b4af4354a5158f286dc8f2407ab"
diff --git a/config/submodule/edk2/default/libgfxinit/patches/0001-g45-hw-gfx-gma-plls.adb-Make-reference-clock-frequen.patch b/config/submodule/edk2/default/libgfxinit/patches/0001-g45-hw-gfx-gma-plls.adb-Make-reference-clock-frequen.patch
new file mode 100644
index 00000000..71c34e5a
--- /dev/null
+++ b/config/submodule/edk2/default/libgfxinit/patches/0001-g45-hw-gfx-gma-plls.adb-Make-reference-clock-frequen.patch
@@ -0,0 +1,42 @@
+From 9be431356fce5b70875b938c3fbd6f6927031f23 Mon Sep 17 00:00:00 2001
+From: Nicholas Chin <nic.c3.14@gmail.com>
+Date: Mon, 20 May 2024 10:10:03 -0600
+Subject: [PATCH 1/2] g45/hw-gfx-gma-plls.adb: Make reference clock frequency
+ configurable
+
+Instead of assuming a 96 MHz reference clock frequency, use the value
+specified by the new INTEL_GMA_DPLL_REF_FREQ Kconfig. This defaults to
+96 MHz to preserve the existing behavior. An example of where this is
+needed is the DPLL_REF_SSCLK input, which will typically be 100 MHz
+to support LVDS spread spectrum clocking.
+
+Signed-off-by: Nicholas Chin <nic.c3.14@gmail.com>
+---
+ common/g45/hw-gfx-gma-plls.adb | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/common/g45/hw-gfx-gma-plls.adb b/common/g45/hw-gfx-gma-plls.adb
+index 2b93444..38d6dec 100644
+--- a/common/g45/hw-gfx-gma-plls.adb
++++ b/common/g45/hw-gfx-gma-plls.adb
+@@ -12,6 +12,8 @@
+ -- GNU General Public License for more details.
+ --
+ 
++with CB.Config;
++
+ with HW.Time;
+ with HW.GFX.GMA.Config;
+ with HW.GFX.GMA.Registers;
+@@ -490,7 +492,7 @@ is
+             Calculate_Clock_Parameters
+               (Target_Dotclock   => Target_Clock,
+                -- should be, but doesn't has to be always the same:
+-               Reference_Clock   => 96_000_000,
++               Reference_Clock   => CB.Config.INTEL_GMA_DPLL_REF_FREQ,
+                Limits            => Select_Limits (Port_Cfg.Display, Target_Clock),
+                Best_Clock        => Clk,
+                Valid             => Success);
+-- 
+2.47.3
+
diff --git a/config/submodule/edk2/default/libgfxinit/patches/0002-re-try-EDID-reading-when-it-fails.patch b/config/submodule/edk2/default/libgfxinit/patches/0002-re-try-EDID-reading-when-it-fails.patch
new file mode 100644
index 00000000..2cc3c0b4
--- /dev/null
+++ b/config/submodule/edk2/default/libgfxinit/patches/0002-re-try-EDID-reading-when-it-fails.patch
@@ -0,0 +1,38 @@
+From 82f4346eba8fdfb0c11f19a4a0f26bd391c259b4 Mon Sep 17 00:00:00 2001
+From: Leah Rowe <leah@libreboot.org>
+Date: Sun, 13 Jul 2025 15:18:53 +0100
+Subject: [PATCH 2/2] re-try EDID reading when it fails
+
+some video converters are a bit buggy and have to be
+probed twice; linux works fine, but in these cases,
+coreboot won't set up the display.
+
+try it twice, to mitigate, when probing the EDID
+
+This entire function should probably be rewritten, since
+it's buggy in general.
+
+Signed-off-by: Leah Rowe <leah@libreboot.org>
+---
+ common/hw-gfx-gma-display_probing.adb | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/common/hw-gfx-gma-display_probing.adb b/common/hw-gfx-gma-display_probing.adb
+index 6908055..abaa2b6 100644
+--- a/common/hw-gfx-gma-display_probing.adb
++++ b/common/hw-gfx-gma-display_probing.adb
+@@ -140,6 +140,11 @@ is
+          Read_EDID (Raw_EDID, Port, Success);
+       end if;
+ 
++      if not Success then
++         Panel.Wait_On (Config_Helpers.To_Panel (Port));
++         Read_EDID (Raw_EDID, Port, Success);
++      end if;
++
+       if Success and then
+          ((not Is_DVI_I (Port) or EDID.Compatible_Display
+             (Raw_EDID, Config_Helpers.To_Display_Type (Port))) and
+-- 
+2.47.3
+
diff --git a/config/submodule/edk2/default/libhwbase/0001-remove-Werror.patch b/config/submodule/edk2/default/libhwbase/0001-remove-Werror.patch
new file mode 100644
index 00000000..8f0eba58
--- /dev/null
+++ b/config/submodule/edk2/default/libhwbase/0001-remove-Werror.patch
@@ -0,0 +1,26 @@
+From 5453dc70cdf327e5b4228fbce34b03107936628f Mon Sep 17 00:00:00 2001
+From: Leah Rowe <leah@libreboot.org>
+Date: Mon, 21 Sep 2026 10:58:18 +0100
+Subject: [PATCH 1/1] remove -Werror
+
+Signed-off-by: Leah Rowe <leah@libreboot.org>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index e8d864e..9c10fb6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -43,7 +43,7 @@ endif
+ CC       = $(CROSS_COMPILE)gcc
+ GNATBIND = $(CROSS_COMPILE)gnatbind
+ 
+-CFLAGS += -Wuninitialized -Wall -Werror
++CFLAGS += -Wuninitialized -Wall
+ CFLAGS += -pipe -g
+ CFLAGS += -Wstrict-aliasing -Wshadow
+ CFLAGS += -fno-common -fomit-frame-pointer
+-- 
+2.47.3
+
diff --git a/config/submodule/edk2/default/libhwbase/module.cfg b/config/submodule/edk2/default/libhwbase/module.cfg
new file mode 100644
index 00000000..bb12f0f0
--- /dev/null
+++ b/config/submodule/edk2/default/libhwbase/module.cfg
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+subgit="https://review.coreboot.org/libhwbase.git"
+subgit_bkup="https://github.com/coreboot/libhwbase"
+subhash="61f7287f18b249408a79bf9ab5e72568965cca2c"
diff --git a/config/submodule/edk2/default/module.list b/config/submodule/edk2/default/module.list
new file mode 100644
index 00000000..c5a2f880
--- /dev/null
+++ b/config/submodule/edk2/default/module.list
@@ -0,0 +1,7 @@
+3rdparty/arm-trusted-firmware
+3rdparty/fsp
+3rdparty/intel-microcode
+3rdparty/libgfxinit
+3rdparty/libhwbase
+3rdparty/vboot
+3rdparty/cmocka
diff --git a/config/submodule/edk2/default/vboot/module.cfg b/config/submodule/edk2/default/vboot/module.cfg
new file mode 100644
index 00000000..c47b5778
--- /dev/null
+++ b/config/submodule/edk2/default/vboot/module.cfg
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+subgit="https://review.coreboot.org/vboot.git"
+subgit_bkup="https://github.com/coreboot/vboot"
+subhash="5c360ef458b0a013d8a6d47724bb0fffb5accbcf"
diff --git a/config/submodule/edk2/default/vboot/patches/0001-extract_vmlinuz.c-Fix-the-bounds-check-on-vmlinuz_he.patch b/config/submodule/edk2/default/vboot/patches/0001-extract_vmlinuz.c-Fix-the-bounds-check-on-vmlinuz_he.patch
new file mode 100644
index 00000000..1ac41de6
--- /dev/null
+++ b/config/submodule/edk2/default/vboot/patches/0001-extract_vmlinuz.c-Fix-the-bounds-check-on-vmlinuz_he.patch
@@ -0,0 +1,178 @@
+From 195f61375aeec9eec16604ec59f6eda2e6058cc1 Mon Sep 17 00:00:00 2001
+From: "Luke T. Shumaker" <lukeshu@lukeshu.com>
+Date: Thu, 30 May 2024 14:08:33 -0600
+Subject: [PATCH 1/1] extract_vmlinuz.c: Fix the bounds check on
+ vmlinuz_header_{offset,size}
+
+The check on vmlinuz_header_offset and vmlinuz_header_size is obviously
+wrong:
+
+	if (!vmlinuz_header_size ||
+	    kpart_data + vmlinuz_header_offset + vmlinuz_header_size >
+	    kpart_data) {
+		return 1;
+	}
+
+`kpart_data + some_unsigned_values` can obviously never be `> kpart_data`,
+unless something has overflowed!  And `vmlinuz_header_offset` hasn't even
+been set yet (besides being initialized to zero)!
+
+GCC will deduce that if the check didn't cause the function to bail, then
+vmlinuz_header_size (a uint32_t) must be "negative"; that is: in the range
+[2GiB,4GiB).
+
+On platforms where size_t is 32-bits, this is *especially* broken.
+memcpy's size argument must be in the range [0,2GiB).  Because GCC has
+proved that vmlinuz_header_size is higher than that, it will fail to
+compile:
+
+	host/lib/extract_vmlinuz.c:67:9: error: 'memcpy' specified bound between 2147483648 and 4294967295 exceeds maximum object size 2147483647 [-Werror=stringop-overflow=]
+
+So, fix the check.
+
+I can now say that what I suspect the original author meant to write would
+be the following patch, if `vmlinuz_header_offset` were already set:
+
+	-kpart_data + vmlinuz_header_offset + vmlinuz_header_size > kpart_data
+	+now        + vmlinuz_header_offset + vmlinuz_header_size > kpart_size
+
+This hypothesis is supported by `now` not getting incremented by
+`kblob_size` the way it is for the keyblock and preamble sizes.
+
+However, we can also see that even this "corrected" bounds check is
+insufficient: it does not detect the vmlinuz_header overflowing into
+kblob_data.
+
+OK, so let's describe the fix:
+
+Have a `*vmlinuz_header` pointer instead of a
+`uint64_t vmlinuz_header_offset`, to be more similar to all the other
+regions.  With this change, the correct check becomes a simple
+
+      vmlinuz_header + vmlinuz_header_size > kblob_data
+
+While we're at it, make some changes that could have helped avoid this in
+the first place:
+
+ - Add comments.
+ - Calculate the vmlinuz_header offset right away, instead of waiting.
+ - Go ahead and increment `now` by `kblob_size`, to increase regularity.
+
+Change-Id: I5c03e49070b6dd2e04459566ef7dd129d27736e4
+---
+ host/lib/extract_vmlinuz.c | 72 +++++++++++++++++++++++++++-----------
+ 1 file changed, 51 insertions(+), 21 deletions(-)
+
+diff --git a/host/lib/extract_vmlinuz.c b/host/lib/extract_vmlinuz.c
+index 4ccfcf33..d2c09443 100644
+--- a/host/lib/extract_vmlinuz.c
++++ b/host/lib/extract_vmlinuz.c
+@@ -15,16 +15,44 @@
+ 
+ int ExtractVmlinuz(void *kpart_data, size_t kpart_size,
+ 		   void **vmlinuz_out, size_t *vmlinuz_size) {
++	// We're going to be extracting `vmlinuz_header` and
++	// `kblob_data`, and returning the concatenation of them.
++	//
++	// kpart_data = +-[kpart_size]------------------------------------+
++	//              |                                                 |
++	//  keyblock  = | +-[keyblock->keyblock_size]-------------------+ |
++	//              | | struct vb2_keyblock          keyblock       | |
++	//              | | char []                      ...data...     | |
++	//              | +---------------------------------------------+ |
++	//              |                                                 |
++	//  preamble  = | +-[preamble->preamble_size]-------------------+ |
++	//              | | struct vb2_kernel_preamble   preamble       | |
++	//              | | char []                       ...data...    | |
++	//              | | char []                      vmlinuz_header | |
++	//              | | char []                       ...data...    | |
++	//              | +---------------------------------------------+ |
++	//              |                                                 |
++	//  kblob_data= | +-[preamble->body_signature.data_size]--------+ |
++	//              | | char []                       ...data...    | |
++	//              | +---------------------------------------------+ |
++	//              |                                                 |
++	//              +-------------------------------------------------+
++
+ 	size_t now = 0;
++	// The 3 sections of kpart_data.
++	struct vb2_keyblock *keyblock = NULL;
+ 	struct vb2_kernel_preamble *preamble = NULL;
+ 	uint8_t *kblob_data = NULL;
+ 	uint32_t kblob_size = 0;
++	// vmlinuz_header
++	uint8_t *vmlinuz_header = NULL;
+ 	uint32_t vmlinuz_header_size = 0;
+-	uint64_t vmlinuz_header_address = 0;
+-	uint64_t vmlinuz_header_offset = 0;
++	// The concatenated result.
+ 	void *vmlinuz = NULL;
+ 
+-	struct vb2_keyblock *keyblock = (struct vb2_keyblock *)kpart_data;
++	// Isolate the 3 sections of kpart_data.
++
++	keyblock = (struct vb2_keyblock *)kpart_data;
+ 	now += keyblock->keyblock_size;
+ 	if (now > kpart_size)
+ 		return 1;
+@@ -36,37 +64,39 @@ int ExtractVmlinuz(void *kpart_data, size_t kpart_size,
+ 
+ 	kblob_data = kpart_data + now;
+ 	kblob_size = preamble->body_signature.data_size;
+-
+-	if (!kblob_data || (now + kblob_size) > kpart_size)
++	now += kblob_size;
++	if (now > kpart_size)
+ 		return 1;
+ 
++	// Find `vmlinuz_header` within `preamble`.
++
+ 	if (preamble->header_version_minor > 0) {
+-		vmlinuz_header_address = preamble->vmlinuz_header_address;
++		// calculate the vmlinuz_header offset from
++		// the beginning of the kpart_data.  The kblob doesn't
++		// include the body_load_offset, but does include
++		// the keyblock and preamble sections.
++		size_t vmlinuz_header_offset =
++			preamble->vmlinuz_header_address -
++			preamble->body_load_address +
++			keyblock->keyblock_size +
++			preamble->preamble_size;
++
++		vmlinuz_header = kpart_data + vmlinuz_header_offset;
+ 		vmlinuz_header_size = preamble->vmlinuz_header_size;
+ 	}
+ 
+-	if (!vmlinuz_header_size ||
+-	    kpart_data + vmlinuz_header_offset + vmlinuz_header_size >
+-	    kpart_data) {
++	if (!vmlinuz_header ||
++	    !vmlinuz_header_size ||
++	    vmlinuz_header + vmlinuz_header_size > kblob_data) {
+ 		return 1;
+ 	}
+ 
+-	// calculate the vmlinuz_header offset from
+-	// the beginning of the kpart_data.  The kblob doesn't
+-	// include the body_load_offset, but does include
+-	// the keyblock and preamble sections.
+-	vmlinuz_header_offset = vmlinuz_header_address -
+-		preamble->body_load_address +
+-		keyblock->keyblock_size +
+-		preamble->preamble_size;
++	// Concatenate and return.
+ 
+ 	vmlinuz = malloc(vmlinuz_header_size + kblob_size);
+ 	if (vmlinuz == NULL)
+ 		return 1;
+-
+-	memcpy(vmlinuz, kpart_data + vmlinuz_header_offset,
+-	       vmlinuz_header_size);
+-
++	memcpy(vmlinuz, vmlinuz_header, vmlinuz_header_size);
+ 	memcpy(vmlinuz + vmlinuz_header_size, kblob_data, kblob_size);
+ 
+ 	*vmlinuz_out = vmlinuz;
+-- 
+2.45.1
+
diff --git a/config/submodule/edk2/default/vboot/patches/0002-lib-cbfstool-fix-build-error-on-newer-hostcc.patch b/config/submodule/edk2/default/vboot/patches/0002-lib-cbfstool-fix-build-error-on-newer-hostcc.patch
new file mode 100644
index 00000000..6d5ba873
--- /dev/null
+++ b/config/submodule/edk2/default/vboot/patches/0002-lib-cbfstool-fix-build-error-on-newer-hostcc.patch
@@ -0,0 +1,28 @@
+From efeac4de14e3ac46e9146bc6a2d2e03ca04757f1 Mon Sep 17 00:00:00 2001
+From: Leah Rowe <leah@libreboot.org>
+Date: Wed, 1 Apr 2026 08:10:09 +0100
+Subject: [PATCH] lib/cbfstool: fix build error on newer hostcc
+
+const char being discarded. classic rookie mistake.
+
+Signed-off-by: Leah Rowe <leah@libreboot.org>
+---
+ host/lib/cbfstool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/host/lib/cbfstool.c b/host/lib/cbfstool.c
+index 9b4de49e..2a2578c0 100644
+--- a/host/lib/cbfstool.c
++++ b/host/lib/cbfstool.c
+@@ -259,7 +259,7 @@ static char *extract_config_value(const char *buf, const char *config_field)
+ 	free(to_find);
+ 
+ 	if (start) {
+-		char *end = strchr(start, '\n');
++		const char *end = strchr(start, '\n');
+ 		if (end)
+ 			return strndup(start, end - start);
+ 	}
+-- 
+2.47.3
+
diff --git a/config/submodule/edk2/default/vboot/patches/0003-remove-Werror.patch b/config/submodule/edk2/default/vboot/patches/0003-remove-Werror.patch
new file mode 100644
index 00000000..fbc60940
--- /dev/null
+++ b/config/submodule/edk2/default/vboot/patches/0003-remove-Werror.patch
@@ -0,0 +1,58 @@
+From f71d1e0981fa3a9ea8201cac97631486a90d5ce4 Mon Sep 17 00:00:00 2001
+From: Leah Rowe <leah@libreboot.org>
+Date: Mon, 21 Sep 2026 11:01:00 +0100
+Subject: [PATCH 1/1] remove -Werror
+
+Signed-off-by: Leah Rowe <leah@libreboot.org>
+---
+ Android.bp | 1 -
+ Makefile   | 6 ++----
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/Android.bp b/Android.bp
+index dec72cc8..1974a1a2 100644
+--- a/Android.bp
++++ b/Android.bp
+@@ -9,7 +9,6 @@ cc_defaults {
+ 
+     cflags: [
+         "-Wall",
+-        "-Werror",
+         "-Wstrict-prototypes",
+         "-Wtype-limits",
+         "-Wundef",
+diff --git a/Makefile b/Makefile
+index 67af60d4..4243a03a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -113,9 +113,8 @@ endif
+ # Provide default CC and CFLAGS for firmware builds; if you have any -D flags,
+ # please add them after this point (e.g., -DVBOOT_DEBUG).
+ DEBUG_FLAGS := $(if $(filter-out 0,${DEBUG}),-g -Og,-g -Os)
+-WERROR := -Werror
+ FIRMWARE_FLAGS := -nostdinc -ffreestanding -fno-builtin -fno-stack-protector
+-COMMON_FLAGS := -pipe ${WERROR} -Wall -Wstrict-prototypes -Wtype-limits \
++COMMON_FLAGS := -pipe -Wall -Wstrict-prototypes -Wtype-limits \
+ 	-Wundef -Wmissing-prototypes -Wno-trigraphs -Wredundant-decls -Wshadow \
+ 	-Wwrite-strings -Wstrict-aliasing -Wdate-time \
+ 	-Wint-conversion -ffunction-sections -fdata-sections \
+@@ -127,7 +126,7 @@ COMMON_FLAGS := -pipe ${WERROR} -Wall -Wstrict-prototypes -Wtype-limits \
+ # returns: $(1) if compiler was successful, empty string otherwise
+ test_ccflag = $(shell \
+ 	printf "$(2)\nvoid _start(void) {}\n" | \
+-	$(CC) -nostdlib -Werror $(1) -xc -c - -o /dev/null \
++	$(CC) -nostdlib $(1) -xc -c - -o /dev/null \
+ 	>/dev/null 2>&1 && echo "$(1)")
+ 
+ COMMON_FLAGS += $(call test_ccflag,-Wimplicit-fallthrough)
+@@ -499,7 +498,6 @@ UTILLIB = ${BUILD}/libvboot_util.a
+ # Avoid build failures outside the chroot on Ubuntu 2022.04
+ # e.g.:
+ # host/lib/host_key2.c:103:17: error: ‘RSA_free’ is deprecated: Since OpenSSL 3.0
+-# [-Werror=deprecated-declarations]
+ ifeq ($(OPENSSL_VERSION),3)
+ ${UTILLIB}: CFLAGS += -Wno-error=deprecated-declarations
+ endif
+-- 
+2.47.3
+