3075 Commits

Author SHA1 Message Date
Thierry Laurion
7c9393246d
Merge pull request #1959 from tlaurion/readd_cbmem_missing_patch_from_upstream
patches/coreboot-24.12/0010-cbmem_tpm-clear_whole_log_on_creation.patch: readd missing uptream cbmem patch for TPM 1.2
2025-04-17 21:08:48 -04:00
Thierry Laurion
4fa541ec1f
patches/coreboot-24.12/0010-cbmem_tpm-clear_whole_log_on_creation.patch: readd missing uptream cbmem patch for TPM 1.2
This is unmerged https://review.coreboot.org/c/coreboot/+/84926

Cleaner solution would be to cler whole area on creation: https://review.coreboot.org/c/coreboot/+/84927, but this path doesn't apply cleanly.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-17 15:55:22 -04:00
Thierry Laurion
7626f62cc2
Merge pull request #1958 from tlaurion/silence_lvm_scan_warning
UX bugfix: kexec-save-default: suppress "Failed to set up async io, using sync io" warning thrown by lvm vgscan
2025-04-16 11:52:55 -04:00
Thierry Laurion
741d721402
kexec-save-default + luks_functions : suppress "Failed to set up async io, using sync io" warning thrown by lvm vgscan
TODO: eventually refactor this out or silence no encrypted lvm found echos in code: who use encrypted LVM nowadays? I think this was pre QubesOS 3.2 era but not even sure anymore.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-16 11:20:00 -04:00
Thierry Laurion
f572998ea4
Merge pull request #1953 from tlaurion/patch_revert_if_apply_fails-canary_wipe_rebuild_improvements
Revert previous applied patches in reverse order if applying patches fails and reapply patches + canary wipe dev helper improvements
2025-04-15 14:15:10 -04:00
Thierry Laurion
46e6efea68
CircleCI: Remove Makefile from save_Cache second layer (coreboot crossgcc reusable cache layer) from being reused to speed up rebuilds
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-13 10:34:15 -04:00
Thierry Laurion
4981e7069d
Makefile: Wipe coreboot_dir and board_dir cleanup in canary dev cycle helper for reproducible builds in dev cycles
Otherwise qemu roms which injects distinct public key with entropy at each build are wiped.

TODO : revisit approach when flashrom/flashprog/qemu supports 16MB SPI flash emulation so we can use flashprog to flash internally, which will require refactoring

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-13 10:20:53 -04:00
Thierry Laurion
83c8947240
Makefile: unify console output for unique patch application vs multiple ones under patches/*
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-12 14:57:08 -04:00
Thierry Laurion
96d2c2f814
Makefile: simplify patch application, reversal + reapplication if failed logic without subshell
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-11 14:06:02 -04:00
Thierry Laurion
d559fcfa16
Makefile: overwrite_canary_if_coreboot_git helper; only inject coreboot git .canary with bogus commit, remove duplicated patches apply/reversal/reapply logic
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-11 13:13:17 -04:00
Thierry Laurion
da38f7b98e
Makefile: fix code blocks that need to all be ran subsequently without failing
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-11 12:11:09 -04:00
Thierry Laurion
5226db35bc
modules/coreboot: make sure coreboot_dir artifacts (board coreboot's objdir) is wiped clean on each build so coreboot stages to be stitched are clean
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-11 12:10:50 -04:00
Thierry Laurion
039ec8ae7a
Makefiles: real.remove_canary_files-extract_patch_rebuild_what_changed updated so that it wipes things correctly
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-11 12:10:00 -04:00
Thierry Laurion
2c13d63a85
Makefiles: add overwrite_canary_if_coreboot_git function and use it in dev cycle helpers
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-11 12:09:54 -04:00
Thierry Laurion
1e74f4560d
Merge pull request #1945 from tlaurion/bugfix_luks_partitions_detection
BUGFIXes : luks-functions + oem-factory-reset: fix logic for nvme/non-nvme based LUKS partitions checks + Force GPG Comment under oem-factory-reset + reset nk3 secrets app when in-memory keygen
2025-04-10 22:07:24 -04:00
Thierry Laurion
2e64d51f4e
Merge pull request #1943 from tlaurion/add_kconfig_to_use_blobs_on_2412_boards_coreboot_configs
Add kconfig to use blobs on 24.12 boards coreboot configs and proper build output to console
2025-04-10 22:06:41 -04:00
Thierry Laurion
eaebd8d3bf
Makefile: add console tracing output on coreboot git repo logic ("INFO: ")
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-10 18:37:19 -04:00
Thierry Laurion
fe4b5e638f
Intel config/coreboot-* boards: CONFIG_USE_BLOBS=y since 24.12 is based on git repo now
Repro:
sudo sed -i 's/# CONFIG_USE_BLOBS is not set/CONFIG_USE_BLOBS=y/g' config/coreboot-*
sudo git restore config/coreboot-kgpe-d16_server.config config/coreboot-kgpe-d16_workstation-usb_keyboard.config config/coreboot-kgpe-d16_workstation.config
./docker_repro.sh
find ./boards/ -type d | awk -F "/" {'print $3'} | while read board; do make BOARD=$board coreboot.save_in_oldconfig_format_in_place; done

Test @miczyg1 hypothesis from https://github.com/linuxboot/heads/issues/1940#issuecomment-2772425103
- We use git repo for coreboot 24.12 as opposed to tarball for previous 22.04.01
  - 3rdparty microcode git submodule might be empty for some reason if not instructed to be synced by kconfig)
    - TODO: Review https://github.com/linuxboot/heads/issues/1940#issuecomment-2772425103

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-10 18:37:13 -04:00
Thierry Laurion
3692a41e90
codebase: make sure same exact vocabulary is used TPM Owner Password, GPG User PIN, GPG Admin PIN, Secrets app PIN
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-03 15:52:49 -04:00
Thierry Laurion
4fbd4e7506
oem-factory-reset: In memory GPG keygen + keys copy to card not calling reset_nk3_secret_app, so HOTP PIN not set to GPG PIN when that feature is used (not really used it seems)
Fixes https://github.com/linuxboot/heads/issues/1951

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-03 15:52:43 -04:00
Thierry Laurion
ea5d948819
oem-factory-reset: GPG Comment is required in current code base, not optional. Change Questionnaire and validate size properly
Fixes https://github.com/linuxboot/heads/issues/1949

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-03 15:52:37 -04:00
Thierry Laurion
ed06b416a5
initrd/etc/luks-functions: fix logic for nvme/non-nvme based LUKS partitions detection
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-03 15:52:32 -04:00
Thierry Laurion
594abed863
Merge pull request #1950 from tlaurion/circleci_first_layer_cache-fix_musl-cross-make
CircleCI: first layer cache: musl-cross-make+packages downloaded, was still pointing to old musl-cross-make
2025-04-03 15:52:18 -04:00
Thierry Laurion
51ca56bca9
CircleCI: first layer cache: musl-cross-make+packages downloaded, was still pointing to old musl-cross-make
First layer cache of CircleCI is reused when second cache is invalidated: that is, to not compiled musl-cross-make from source for x86/ppc64 at each build when any other thing changed under Heads.

Unfortunately, https://github.com/linuxboot/heads/pull/1947 was incomplete in that regard, as showed per build:
- last save cache step https://app.circleci.com/pipelines/github/tlaurion/heads/3270/workflows/07dee00e-926e-4023-b8a7-669078e6ef31/jobs/66483
  - first layer cache saving https://app.circleci.com/pipelines/github/tlaurion/heads/3270/workflows/07dee00e-926e-4023-b8a7-669078e6ef31/jobs/66483
    - Warning: could not archive /root/heads/build/ppc64/musl-cross-make-38e52db8358c043ae82b346a2e6e66bc86a53bc1 - Not found
    - Warning: could not archive /root/heads/build/x86/musl-cross-make-38e52db8358c043ae82b346a2e6e66bc86a53bc1 - Not found

It is also irrelevant to bind first layer cache with .circleci/config.yml, nor Makefile related changes. After all the first layer is related to reusing musl-cross-make to reduce build times on CI
Therefore, only flake.lock and modules/musl-cross-make is relevant to be part of hashed files that should nto change to construct/reuse that cache

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-03 13:51:19 -04:00
Thierry Laurion
e5599e0b24
Merge pull request #1947 from tlaurion/github-not-coreboot_review
bugfix: modules/coreboot + blobs/xx80: rely on github for git, not review.coreboot.org
2025-04-03 13:02:16 -04:00
Thierry Laurion
5a68b98c37
bugfix CircleCI: musl-cross-make not part of save_cache, so always rebuilt
Fixes https://github.com/linuxboot/heads/issues/1948

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-03 11:32:21 -04:00
Thierry Laurion
c627965397
bugfix: modules/coreboot + blobs/xx80: rely on github for git, not review.coreboot.org
https://review.coreboot.org is having HTTPS issue. Reported on coreboot matrix channel, but need to build.

Log from CircleCI failing when trying to pull deguard: https://app.circleci.com/pipelines/github/tlaurion/heads/3267/workflows/588f8aeb-4d73-4f71-9e6e-fd286e46353e/jobs/66442/parallel-runs/0/steps/0-111

Reasoning:
We might dislike GitHub, but when comes maintaining a project and using free systems for bandwidth and CI because no money, we need to rely on systems that don't randomly fall.
Using github does that purpose here

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-04-03 11:09:17 -04:00
Thierry Laurion
2ab7d5884b
Merge pull request #1938 from tlaurion/bugfix_circleci-bring_back_x230-hotp-maximized
bugfix: readd x230-hotp-maximized board build in CircleCI (was dropped because replaced by t480-hotp-maximized by error)
2025-03-25 12:06:38 -04:00
Thierry Laurion
5dfea84a98
bugfix: readd x230-hotp-maximized board build in CircleCI (was dropped because replaced by t480-hotp-maximized by error)
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-03-24 15:48:22 -04:00
Thierry Laurion
6279500e5b
Merge pull request #1928 from JonathonHall-Purism/update-seed-talos-2
bin/seed_package_mirror.sh: Update talos-2 -> UNTESTED_talos-2
2025-03-12 12:18:51 -04:00
Jonathon Hall
b48fca280b
bin/seed_package_mirror.sh: Update talos-2 -> UNTESTED_talos-2
Board name was changed due to being untested.  It still builds, so the
packages still sync to mirrors for now.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2025-03-12 10:11:17 -04:00
Thierry Laurion
300df21cee
Merge pull request #1908 from tlaurion/coreboot_bump_2412
Coreboot version  bump 24.02.01 ->  24.12 for most board + Thinkpad T480 addition (coreboot upstream in WiP state)
2025-03-11 13:00:08 -04:00
Thierry Laurion
10f854cb7f
BOARD_TESTERS: add Optiplex 9010/7010 SFF/DT to @tlaurion
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-03-10 17:15:52 -04:00
Thierry Laurion
25ffc3e59c
CircleCI: clarify AVAILABLE_MEM_GB=8 usage, which results in CircleCI passing: -j8 --load-average=12 from current Makefile helper
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-03-10 17:01:04 -04:00
Thierry Laurion
382949d8f4
z220-cmt boards: move to untested with board.move_tested_to_untested helper, per notice at https://github.com/linuxboot/heads/pull/1908#issuecomment-2711603241
Unfortunately the helper doesn't deal well with board inclusion: sed call is imperfect, and board config needs to be manually edited.

TODO: fix the helper when it will be the time to move back to tested/untested

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-03-10 16:43:54 -04:00
Thierry Laurion
876e37ea2b
t530 boards: move to untested with board.move_tested_to_untested helper, per notice at https://github.com/linuxboot/heads/pull/1908#issuecomment-2711603241
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-03-10 15:28:29 -04:00
gaspar-ilom
4cb69858f9
rename patches in correct order to prepare for more
more patches are going to come for haswell nri so we want a clean naming scheme

Signed-off-by: gaspar-ilom <gasparilom@riseup.net>
2025-03-09 21:08:26 +01:00
gaspar-ilom
f765586015
fix preprocessor checks
Signed-off-by: gaspar-ilom <gasparilom@riseup.net>
2025-03-08 00:59:00 +01:00
gaspar-ilom
dc207ea8f2
Revert "patches/coreboot-24.12/0003-mb-lenovo-Add-ThinkPad-T480-and-ThinkPad-T480s.patch: do not comment inclusion of thermal.asl"
Not necessary anymore as properly fixed by coreboot patch 0004 in 3466272a69f1345340f5eeda05a5dd338883f8eb

This reverts commit aa2b15dd055b3db18e0e60bf4a008d3e6b95c270.

Signed-off-by: gaspar-ilom <gasparilom@riseup.net>
2025-03-07 19:55:54 +01:00
gaspar-ilom
bb120b14ae
Revert "t480: move to unmaintained, remove t480 from circleci. Upstream will need to fix thermal codepath: as of now its either other thinkpads or t480. Not good"
With 3466272a69f1345340f5eeda05a5dd338883f8eb T480 thermal codepath does not break other boards anymore.
We move it back to circleci and maintained.

This reverts commit 730fdd1b25384bacc8e491c543709f5967651ffb.

Signed-off-by: gaspar-ilom <gasparilom@riseup.net>
2025-03-07 17:31:12 +01:00
gaspar-ilom
3466272a69
do not break building other thinkpads with the hacks for the t480/s made Mate Kukri
still not fixing things properly but at least it should now be possible to build older thinkpads without regressions.
prior, some code was just commented or unreachable. now we make this explicit with preprocessor directives.
heads should build all boards on this coreboot version from the same coreboot tree.

use CONFIG_BOARD_LENOVO_SKLKBL_THINKPAD_COMMON to decide what to compile
this should work for T480, T480S and older thinkpads

Signed-off-by: gaspar-ilom <gasparilom@riseup.net>
2025-03-07 17:27:56 +01:00
Thierry Laurion
730fdd1b25
t480: move to unmaintained, remove t480 from circleci. Upstream will need to fix thermal codepath: as of now its either other thinkpads or t480. Not good
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-03-03 12:40:25 -05:00
Thierry Laurion
c7d40eae5d
Merge remote-tracking branch 'tlaurion-github/poc_t480' into coreboot_bump_2412 2025-03-02 18:57:03 -05:00
gaspar-ilom
438a061c99
changes the tb.bin Thunderbolt blob script to create the same blob as libreboot
the blob created from the script prior to this change is not confirmed working

this blob is now confirmed working if following the instructions from libreboot https://libreboot.org/docs/install/t480.html#update-lenovo-firmware-first

Signed-off-by: gaspar-ilom <gasparilom@riseup.net>
2025-03-02 23:30:39 +01:00
Thierry Laurion
80055417f7
Merge remote-tracking branch 'gaspar-ilom/poc_t480' into coreboot_bump_2412
Resolve conflicts for .circleci/config.yml

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-03-02 11:58:59 -05:00
gaspar-ilom
81151d94f6
add documentation for tb.bin Thunderbolt flashing on the T480
Signed-off-by: gaspar-ilom <gasparilom@riseup.net>
2025-02-28 12:05:55 +01:00
Thierry Laurion
f20e519e05
config/coreboot-z220-cmt.config: fix changes of path for VBT (libgfxinit config blob) and resave coreboot config with coreboot.modify_and_save_oldconfig_in_place helper
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-02-27 16:39:41 -05:00
Thierry Laurion
d0fa045566
Merge remote-tracking branch 'osresearch/master' into coreboot_bump_2412
Merge conflict resolved

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-02-27 13:40:41 -05:00
Thierry Laurion
aa2b15dd05
patches/coreboot-24.12/0003-mb-lenovo-Add-ThinkPad-T480-and-ThinkPad-T480s.patch: do not comment inclusion of thermal.asl
Thanks to @nic3-14159 over coreboot matrix channel for the tip https://matrix.to/#/!EhaGFZyYcbyhdSgStq:matrix.org/$Rp7bFaRphrasUhnvNRrNvfYdzMgThMUUjQNswvg5CWo?via=matrix.org&via=tchncs.de&via=envs.net

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2025-02-27 13:35:32 -05:00
gaspar-ilom
429e8aa39d
fix whitespace in t480 make file
Signed-off-by: gaspar-ilom <gasparilom@riseup.net>
2025-02-27 12:14:04 +01:00