Commit Graph

116 Commits

Author SHA1 Message Date
Trammell Hudson
eca06f519f safeboot: add encrypted rootfs 2020-11-20 10:42:58 -05:00
Trammell Hudson
4b4983f213 safeboot: build a disk image for running under ovmf 2020-11-06 14:48:07 -05:00
Trammell Hudson
b891f0b556 safeboot: add safeboot.config and safeboot-init to setup tpm2 2020-11-06 14:48:07 -05:00
Matt DeVillier
6a3bb5897a Drop duplicate board-specific background color configs
Set and export currently-used defaults in gui-init, but still
allow for inidividual boards to override via config if desired.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
6df281813f Specify 'friendly' board name vs overriding CONFIG_BOOT_GUI_MENU_NAME
This will allow it to be used elsewhere within the UI.
Rename CONFIG_BOOT_GUI_MENU_NAME to better indicate use/function.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
cd6ba01429 boards/x220: update flashrom parameters
Force use of hardware sequencing for internal flashing to avoid
needing to specify the chip to be flashed.

Addresses #870

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 10:47:08 -04:00
MrChromebox
b71f3757c1
modules/linux: add support for building with kernel 5.4.69 (#854)
* modules/linux: add support for building with kernel 5.4.69

Add support to module, port patches from 4.19.139.
Needed for newer platforms not supported by 4.19 kernel.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* CircleCI: add rysnc dependency for building kernel 5.x

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Migrate all Librem boards to kernel 5.x, common config

Update linux-librem_common.config from 4.x to 5.x, and add
CONFIG items needed to support the librem_l1um (AST DRM drivers,
serial port output).

Tested on Librem 13v4, Librem Mini, and Librem Server L1UM.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-25 01:26:08 -04:00
MrChromebox
bd7a945bbb
Inject Heads version string into coreboot LOCALVERSION... (#859)
* config/coreboot-*: drop CONFIG_LOCALVERSION
Will be injected as part of the build using $(HEADS_GIT_VERSION)
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* modules/coreboot: inject $(HEADS_GIT_VERSION) as CONFIG_LOCALVERSION
Needed for fwupd to handle board updates
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* modules/coreboot: override SMBIOS ProductName with $(BOARD)
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Use $(BOARD)-$(HEADS_GIT_VERSION) as basis for output filename
makes builds uniquely identifiable based on board and version.
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-21 11:04:27 -04:00
tlaurion
30852aa273
xx30 boards: suspend/resume fix (#838)
* x230-hotp-verification: revert to coreboot "CONFIG_CBFS_SIZE=0x700000" by disabling board "CONFIG_DROPBEAR=y" and "CONFIG_LINUX_E1000E" to save space per @alex-nitrokey test under #770 to fix #608
* x230-htop-verification board: add clarifications on x230 board differences. Fixes #737 #770 #608
* X230 board & coreboot config: Fix x230 board, removing dropbear and e1000e driver.
* t430: board and coreboot config par with x230 to circumvent CBFS linked suspend/resume issues.
2020-10-19 12:50:24 -04:00
Markus Meissner
09ca500d3e
add x230-nkstorecli board config (#817)
* add x230-nkstorecli board; 
* add modules: nkstorecli, libnk, libhidapi-libusb
* version bump nkstorecli; related minor in libnk
* upd. libnk module version bump to 3.6; remove 3.5 patch
2020-10-19 10:47:22 -04:00
MrChromebox
85d7e29d18
Add new board: Purism Librem Server L1UM (#858)
* modules/coreboot: add option to use coreboot 4.11

Port patches from coreboot 4.8.1 to 4.11:
* 0000-measure-boot -> 0001
* 0010-cross-compiler-support

All other patches for coreboot 4.8.1 have either already been
integrated, or are for platforms which do not need to be migrated
to coreboot 4.11 (they will move to 4.12 or newer).

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add Broadwell-DE platform patch

Add a patch for FSP Broadwell-DE to make use of Heads' measured boot.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add patch to read serial # from CBFS

Will be used by multiple Librem boards.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: add board support for Librem Server L1UM

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Librem Server L1UM: add new board

Add board config, coreboot config, kernel config files.
Add conditional purism-blobs dependency to coreboot-4.11 module.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* flash.sh: add special handling for librem_l1um board

Add support for persisting PCIe config via PCHSTRP9 in flash descriptor.
This is needed to support multiple variants of the L1UM server which
use the same firmware but differ in PCIe lane configuration via the
PCH straps configuration in the flash descriptor.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add 'Use PRIxPTR to print uintptr_t' patch

Cherry-picked from upstream coreboot (post-4.11), fixes compilation issue.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* CircleCI: add target to build board librem_l1um

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-18 14:48:25 -04:00
MrChromebox
afa6753a30
librem_mini-NoTPM: drop '-noTPM' suffix (#843)
There's only one Librem Mini board, it doesn't use a TPM,
no reason to unnecesarily lengthen the board name.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-09-30 16:13:15 -04:00
tlaurion
53c74fa02a
CircleCI: readd librem_mini (#832)
* CircleCI: readd librem_mini while making sure that if a board build fails, all logfile modified in the last minute are outputted on the CircleCI console prior to really failing and exiting

* librem_mini-NoTPM: addition of board config, distinctive coreboot config (required per Heads build system) to construct a ROM without TPM requirement.

* librem_mini: deletion of board and coreboot relative config, keeping librem_mini-NoTPM and coreboot config only. Removed librem_mini board build under CircleCI, keeping only librem_mini-NoTPM
2020-09-15 10:51:37 -04:00
MrChromebox
268fb90623
Add new board: Purism Librem Mini (#806)
* patches/coreboot-4.12: Add patch for Cannonlake ME status

Add patch print ME status regardless of enablement state

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* modules: add purism-blobs module

Rather than require users to manually run a script to download the required
blobs to build Purism Librem boards, automate it so the correct version
is automatically downloaded/extracted. Restrict to coreboot 4.12 for now
since 4.8.1 still needs FSP blobs, which are not in module.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* configs/linux-librem13v2: unset CONFIG_RETPOLINE

Fixes compilation issue with newer kernels, ignored by older ones
which don't need it

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Add new board: Librem Mini

Add Librem Mini board patch for coreboot 4.12, board config and
coreboot config. Continue reusing existing librem13v2 Linux config,
same as all other Librem boards currently. Use new purism-blobs module.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* board/librem*: rename for consistency

Use 'librem_<board>' notation for consistency across all models.
Rename linux config file since used by multiple Librem models.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* CircleCI: add librem_mini board to test

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-09-02 14:39:37 -04:00
MrChromebox
f23ced0a3b
Support Multiple Kernel Options (#805)
* modules/linux: Add support for multiple kernel versions

Follow same pattern as used for coreboot. Add existing kernel version
as default for all existing boards.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* modules/linux: Add option to use 4.19 LTS kernel

Add option to use kernel 4.19.139 (current LTS version).
Duplicate existing patches from 4.14.62 as they all apply cleanly.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-20 19:26:48 -04:00
tlaurion
7ea13ee000
Merge pull request #761 from Nitrokey/hotp-neutral
Fix branding issue with HOTP USB Security Dongles
2020-07-23 15:05:13 -04:00
Thierry Laurion
5f067ea908
coreboot: 4.8.1 fixed in Makefile, coreboot module and board configs (coreboot_481) to facilitate newer coreboot version integration and testing without breaking old fixed boards 2020-07-10 12:37:11 -04:00
alex-nitrokey
c2a2134eb2
Merge remote-tracking branch 'upstream/master' into hotp-neutral 2020-06-24 18:22:13 +02:00
alex-nitrokey
1ba73ac1d5
Rename CONFIG_LIBREMKEY to CONFIG_HOTPKEY 2020-06-11 15:29:51 +02:00
Matt DeVillier
0cae2d7805
kexec-save-default: guard TPM LUKS usage with config option
Add CONFIG_TPM_NO_LUKS_DISK_UNLOCK to allow Librem boards to opt
out of using TPM to store LUKS key, and use it to guard the user
option to add the disk encryption key to the TPM.

Select this option for all Librem boards; all other boards which
select CONFIG_TPM=y will have no change in functionality.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-06-08 11:40:55 -05:00
Thierry Laurion
d5083f410c
x230-hotp-verification: Add x230-hotp-verification board to have a HOTP supported remote attestation for Nitrokey Pro 2, Nitrokey Storage 2 and Librem Key 2020-05-21 18:06:19 -04:00
tlaurion
2ee51d864c
Merge pull request #656 from fibreblazer/master
T430 Support
2020-05-15 19:19:00 -04:00
flawedworld
23735d729a Add T430 board support
Co-authored-by: Sebastian McMillan <22755892+SebastianMcMillan@users.noreply.github.com>
Co-authored-by: Andrew Montoya <halossqwerty@gmail.com>
2020-05-15 18:52:11 +01:00
tlaurion
950acf9355
Merge pull request #708 from tlaurion/qemu-coreboot-fbwhiptail_board
qemu-coreboot-fbwhiptail board addition
2020-05-14 23:07:07 -04:00
Thierry Laurion
29e28005ab
qemu-coreboot-fbwhiptail: removing of unneeded comments 2020-05-11 13:57:08 -04:00
Thierry Laurion
31a103fdae
Working config to do make BOARD=qemu-coreboot-fbwhiptail and then make BOARD=qemu-coreboot-fbwhiptail run 2020-05-11 13:56:40 -04:00
tlaurion
df89d16f7c
Merge pull request #707 from tlaurion/useful_qemu-coreboot_board
qemu-coreboot: finally a useable debug/test board
2020-05-04 17:07:30 -04:00
Thierry Laurion
ba68c723bf
qemu-coreboot: Now useful to debug something through make BOARD=qemu-coreboot. TODO: map a virtual TPM instance and USB passthrough. Thanks to @orangecms for the tip 2020-04-22 23:02:46 -04:00
Matt DeVillier
b29447ef8f
modules/flashrom: update to v1.2 release
- Update flashrom module to v1.2.
- Drop Thinkpad x220 patch as it's now properly supported.
- Drop 'laptop=force_I_want_a_brick' from board FLASHROM_OPTIONS
  since it's no longer needed.
- Migrate kgpe-d16 patch.

The kgpe-d16 patch needed a complete overhaul when rebased against
flashrom v1.2, and needs close inspection/testing as a result.
The following changes were made from the previous patch:

- dropped addition of 4-byte addressing (4BA), since now supported
- dropped addtiion of Macronix MX25L256 and MX66L512 chips,
  since now supported
- added 4BA erase commands for Winbond W25Q256 chip
- dropped code to show progress indicator, since another PR already adds that

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-04-20 17:34:08 -05:00
Matt DeVillier
1bd93d6679
Eliminate use of CONFIG_USB_BOOT_DEV
mount-usb switched to dynamic USB device detection a while back,
so eliminate instances of CONFIG_BOOT_USB_DEV, and derive the
mounted USB device from /etc/mtab in the one place where it's
actually needed (usb-scan). Clean up areas around calls to
mount-usb for clarity/readability.

Addresses issue #673

Test: Build Librem 13v4, boot ISO file on USB

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-02-19 22:32:08 -06:00
Thierry Laurion
62f180d098
Flash.sh cleanup: Fix FLASHROM_OPTIONS -> CONFIG_FLASHROM_OPTIONS to be exported by Makefile 2020-02-19 17:18:01 -05:00
Sebastian McMillan
21faf524b9
T420 initial support + X220 FBWhiptail Support (#578)
* Add support for the Lenovo ThinkPad T420 and X220.
* Fix the autodetection of ifdtool and me_cleaner.
* Enable FBWhiptail mode for X220 and T420
* Decreased CBFS size to fix 50 seconds boot delay problems
2020-02-19 12:51:03 -05:00
Sebastian McMillan
f0d85ba2d7
Flash.sh cleanup : flashrom specifics now in board configs (#592)
Flash.sh cleanup : flashrom specifics now in board configs (#592)
2020-02-19 12:04:56 -05:00
Matt DeVillier
5d28532a0f
board/librem*.config: set default boot device to NVMe
Automatic /boot detection will fall back to /dev/sd*

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-11-18 21:45:01 -06:00
Trammell hudson
b532315733
Merge branch 'msrtools' 2019-08-11 17:05:55 +02:00
Trammell hudson
a37e1f434d
add Intel msrtools commands 2019-07-30 15:36:57 +02:00
Matt DeVillier
6fc5571289
boards/librem15v[3,4]: add missing background colors
The error/warning background gradient colors were defined
for the librem 13 boards, but not for the librem 15 ones.
Add the missing exports.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-07-12 11:51:18 -05:00
Thierry Laurion
1bb8184143
qemu-coreboot board: switch back to generic init in non-FBWhiptail mode 2019-02-18 21:10:45 -05:00
tlaurion
50172f21e5
Merge pull request #527 from flammit/qemu-gui-init
qemu-coreboot: change configs to enable gui-init testing
2019-02-17 08:50:14 -05:00
Matt DeVillier
90ec5e9e2a boards/librem*: replace iommu=pt with intel_iommu=on
With addition of IOMMU/RMRR patches, passthru is no longer needed
for proper IOMMU functionality

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-02-12 17:09:56 -06:00
Matt DeVillier
398f75f19f heads/config: add librem 13v4/15v4 as clones of 13v2/15v3
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-02-12 16:46:50 -06:00
tlaurion
98598e7f2f
Merge pull request #465 from merge/x230-gui
x230: use fbwhiptail and gui-init instead of generic-init
2019-02-08 13:32:22 -05:00
tlaurion
695993b593
Merge branch 'master' into gpg2 2019-02-08 13:29:02 -05:00
tlaurion
0cc827cea4
Merge pull request #424 from merge/master
x230: remove 4M and 8M split-images from the build
2019-02-08 13:12:07 -05:00
Martin Kepplinger
ae40892205 x230: use fbwhiptail and gui-init instead of generic-init
This changes Heads' bootscript for the x230 to gui-init and adds config
options needed for it. The config is very similar to the librem13v2 config.

My comparison of startup-time from a power-button press shows 2.5 seconds
more with these changes applied.

That said, the experience is smooth, the GUI is beautiful and easier to use
than the shell and text menu, especially during setup. That's what we
buy with startup time here.
2019-02-07 21:06:44 +01:00
Thierry Laurion
4f75da7ea7
Removing CONFIG_GPG in librem boards 2019-01-29 11:18:07 -05:00
Itay Grudev
92c547c0d4
Enabled GPG2 in the Librem board config 2019-01-29 11:16:23 -05:00
Thierry Laurion
8ba3c33402
required changes to apply on top of osresearch/gpg2 for gpg2 to actually work, tools and libs updated to latest versions 2019-01-26 11:51:51 -05:00
Trammell hudson
d61587c179
switch to gpg2 for qemu targets 2019-01-26 11:47:53 -05:00
shamen123
e274a2c396
remove CONFIG_GPG=y
Building make BOARD=x230-flash fails due to size. Removal of CONFIG_GPG fixes this. For further details, see https://github.com/osresearch/heads/issues/451
2019-01-10 15:06:40 +00:00