- Kill any GPG toolstack USB host consumers of USB devices so targets/qemu.md instruction can be used as intended (usb security dongles, HOTP features)
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
* CONFIG_BOOTSPLASH_CONVERT_RESOLUTION: setting this stretches the bootsplash and makes it ugly. Revert the change on master so that produced videos/screenshots are ok.
* qemu prod boards: CONFIG_DRIVERS_EMULATION_QEMU_BOCHS_XRES=1440 and CONFIG_DRIVERS_EMULATION_QEMU_BOCHS_YRES=810 brings the Height just big enough to fit on screens we mostly have out there.
* qemu dev boards: CONFIG_DRIVERS_EMULATION_QEMU_BOCHS_XRES=1024 and CONFIG_DRIVERS_EMULATION_QEMU_BOCHS_YRES=768: is a reminder of x230's 1376x768 (16:9) for Height and shows us that things are not perfect for all platforms
Notes:
- cannot put to 1376x768 for qemu (would have been nice to see what console text looks like + fbwhiptail windows for x230 (min screen size supported)
- that tears bochs fb for some unknown reason
- doesn't tear x230 fb (TODO: bug report for bochs qemu driver?)
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
resolution changed to fit smallest (uncommon) x230 screen size supported for dev cycles to show prod output: 1366x768 (16:9)
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
- Move/rename board config
- Rename coreboot config
- Applies changes to coreboot config from defconfig+dasharo coreboot fork config + fixes
- Rename CircleCI board for rom build
-----
Repro:
First: change some oldconfig defaults from dasharo coreboot fork
git checkout -b move_nitropad-nv41_to_novacustom-v41
mv boards/nitropad-nv41 boards/novacustom_nv4x_adl
mv boards/novacustom_nv4x_adl/nitropad-nv41.config boards/novacustom_nv4x_adl/novacustom_nv4x_adl.config
vim boards/novacustom_nv4x_adl/novacustom_nv4x_adl.config
vim config/coreboot-nitropad-nv41.config
mv config/coreboot-nitropad-nv41.config config/coreboot-novacustom_nv4x_adl.config
vim boards/novacustom_nv4x_adl/novacustom_nv4x_adl.config
docker run -e DISPLAY=$DISPLAY --network host --rm -ti -v $(pwd):$(pwd) -w $(pwd) tlaurion/heads-dev-env:latest -- make BOARD=novacustom_nv4x_adl coreboot.modify_and_save_oldconfig_in_place
cd /home/user/heads/build/x86/coreboot-dasharo
sudo make menuconfig
cd ~/heads
sudo meld /home/user/heads/build/x86/coreboot-dasharo/.config config/coreboot-novacustom_nv4x_adl.config
git status
git add boards/nitropad-nv41/nitropad-nv41.config config/coreboot-nitropad-nv41.config config/coreboot-novacustom_nv4x_adl.config config/coreboot-novacustom_nv4x_adl.config
git add boards/novacustom_nv4x_adl/novacustom_nv4x_adl.config
sed -i 's/nitropad-nv41/novacustom_nv4x_adl/g' .circleci/config.yml
git add .circleci/config.yml
git commit --sigoff -m
git push tlaurion-github --force
...
(and multiple 'git commit --signoff --amend' to add traces below)
----
Relevant changes from nitropad-nv41 coreboot configs:
diff --git a/config/coreboot-nitropad-nv41.config b/config/coreboot-novacustom_nv4x_adl.config
index 9484aaf512..235f255a31 100644
--- a/config/coreboot-nitropad-nv41.config
+++ b/config/coreboot-novacustom_nv4x_adl.config
@@ -111,7 +111,7 @@ CONFIG_VENDOR_NOVACUSTOM=y
# CONFIG_VENDOR_UP is not set
CONFIG_MAINBOARD_FAMILY="Not Applicable"
CONFIG_MAINBOARD_PART_NUMBER="nv40pz"
-CONFIG_MAINBOARD_VERSION="v2.1"
+CONFIG_MAINBOARD_VERSION="nv40pz"
CONFIG_MAINBOARD_DIR="clevo/adl-p"
CONFIG_DIMM_MAX=4
CONFIG_DIMM_SPD_SIZE=512
@@ -131,7 +131,7 @@ CONFIG_VBOOT_VBNV_OFFSET=0x28
CONFIG_VARIANT_DIR="nv40pz"
CONFIG_OVERRIDE_DEVICETREE="variants/$(CONFIG_VARIANT_DIR)/overridetree.cb"
# CONFIG_VGA_BIOS is not set
-CONFIG_MAINBOARD_SMBIOS_MANUFACTURER="Nitrokey"
+CONFIG_MAINBOARD_SMBIOS_MANUFACTURER="Notebook"
CONFIG_INTEL_GMA_VBT_FILE="src/mainboard/$(MAINBOARDDIR)/variants/$(VARIANT_DIR)/data.vbt"
# CONFIG_DISABLE_HECI1_AT_PRE_BOOT is not set
CONFIG_PRERAM_CBMEM_CONSOLE_SIZE=0x4000
@@ -140,7 +140,7 @@ CONFIG_CMOS_LAYOUT_FILE="src/mainboard/$(MAINBOARDDIR)/cmos.layout"
CONFIG_BOOT_DEVICE_SPI_FLASH_BUS=0
CONFIG_BOARD_CLEVO_ADLP_COMMON=y
CONFIG_BOARD_CLEVO_NV40PZ_BASE=y
-CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="Nitropad NV41"
+CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="NV4xPZ"
CONFIG_CONSOLE_POST=y
# CONFIG_USE_PM_ACPI_TIMER is not set
CONFIG_TPM_PIRQ=0x27
When comparing against dasharo/coreboot fork coreboot config saved in oldconfig format, diffs:
diff --git a/config/coreboot-novacustom_nv4x_adl.config b/config/coreboot-novacustom_nv4x_adl.config
index 235f255a31..41bdd7889c 100644
--- a/config/coreboot-novacustom_nv4x_adl.config
+++ b/config/coreboot-novacustom_nv4x_adl.config
@@ -7,19 +7,19 @@
# General setup
#
CONFIG_COREBOOT_BUILD=y
-CONFIG_LOCALVERSION=""
+CONFIG_LOCALVERSION="v1.7.2"
CONFIG_CBFS_PREFIX="fallback"
CONFIG_COMPILER_GCC=y
# CONFIG_COMPILER_LLVM_CLANG is not set
CONFIG_ARCH_SUPPORTS_CLANG=y
# CONFIG_ANY_TOOLCHAIN is not set
-# CONFIG_CCACHE is not set
+CONFIG_CCACHE=y
# CONFIG_IWYU is not set
# CONFIG_FMD_GENPARSER is not set
# CONFIG_UTIL_GENPARSER is not set
-# CONFIG_OPTION_BACKEND_NONE is not set
-CONFIG_USE_OPTION_TABLE=y
-# CONFIG_STATIC_OPTION_TABLE is not set
+CONFIG_OPTION_BACKEND_NONE=y
+# CONFIG_USE_OPTION_TABLE is not set
+# CONFIG_USE_UEFI_VARIABLE_STORE is not set
CONFIG_COMPRESS_RAMSTAGE_LZMA=y
# CONFIG_COMPRESS_RAMSTAGE_LZ4 is not set
CONFIG_INCLUDE_CONFIG_FILE=y
@@ -35,12 +35,7 @@ CONFIG_HAVE_ASAN_IN_RAMSTAGE=y
# CONFIG_NO_STAGE_CACHE is not set
CONFIG_TSEG_STAGE_CACHE=y
# CONFIG_UPDATE_IMAGE is not set
-CONFIG_BOOTSPLASH_IMAGE=y
-CONFIG_BOOTSPLASH_FILE="@BRAND_DIR@/bootsplash.jpg"
-CONFIG_BOOTSPLASH_CONVERT=y
-CONFIG_BOOTSPLASH_CONVERT_QUALITY=90
-# CONFIG_BOOTSPLASH_CONVERT_RESIZE is not set
-# CONFIG_BOOTSPLASH_CONVERT_COLORSWAP is not set
+# CONFIG_BOOTSPLASH_IMAGE is not set
# CONFIG_FW_CONFIG is not set
#
@@ -111,14 +106,14 @@ CONFIG_VENDOR_NOVACUSTOM=y
# CONFIG_VENDOR_UP is not set
CONFIG_MAINBOARD_FAMILY="Not Applicable"
CONFIG_MAINBOARD_PART_NUMBER="nv40pz"
-CONFIG_MAINBOARD_VERSION="nv40pz"
+CONFIG_MAINBOARD_VERSION="v2.1"
CONFIG_MAINBOARD_DIR="clevo/adl-p"
CONFIG_DIMM_MAX=4
CONFIG_DIMM_SPD_SIZE=512
-CONFIG_FMDFILE=""
+CONFIG_FMDFILE="src/mainboard/$(CONFIG_MAINBOARD_DIR)/vboot-rwa.fmd"
# CONFIG_NO_POST is not set
CONFIG_MAINBOARD_VENDOR="Notebook"
-CONFIG_CBFS_SIZE=0x1000000
+CONFIG_CBFS_SIZE=0xA00000
# CONFIG_CONSOLE_SERIAL is not set
CONFIG_MAX_CPUS=24
CONFIG_ONBOARD_VGA_IS_PRIMARY=y
@@ -126,8 +121,9 @@ CONFIG_ONBOARD_VGA_IS_PRIMARY=y
# CONFIG_POST_IO is not set
CONFIG_UART_FOR_CONSOLE=0
CONFIG_DEVICETREE="devicetree.cb"
-# CONFIG_VBOOT is not set
+CONFIG_VBOOT=y
CONFIG_VBOOT_VBNV_OFFSET=0x28
+CONFIG_RO_REGION_ONLY=""
CONFIG_VARIANT_DIR="nv40pz"
CONFIG_OVERRIDE_DEVICETREE="variants/$(CONFIG_VARIANT_DIR)/overridetree.cb"
# CONFIG_VGA_BIOS is not set
@@ -143,10 +139,12 @@ CONFIG_BOARD_CLEVO_NV40PZ_BASE=y
CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="NV4xPZ"
CONFIG_CONSOLE_POST=y
# CONFIG_USE_PM_ACPI_TIMER is not set
-CONFIG_TPM_PIRQ=0x27
+CONFIG_VBOOT_SLOTS_RW_A=y
+CONFIG_TPM_PIRQ=0x0
# CONFIG_SOC_INTEL_CSE_SEND_EOP_EARLY is not set
CONFIG_VBOOT_FWID_VERSION="$(CONFIG_LOCALVERSION)"
CONFIG_EC_SYSTEM76_EC_BAT_THRESHOLDS=y
+CONFIG_PXE_ROM_ID="10ec,8168"
CONFIG_ECAM_MMCONF_BASE_ADDRESS=0xc0000000
CONFIG_ECAM_MMCONF_BUS_NUMBER=256
CONFIG_MEMLAYOUT_LD_FILE="src/arch/x86/memlayout.ld"
@@ -156,20 +154,28 @@ CONFIG_C_ENV_BOOTBLOCK_SIZE=0x40000
CONFIG_DCACHE_BSP_STACK_SIZE=0x80400
CONFIG_MAX_ACPI_TABLE_SIZE_KB=144
CONFIG_HAVE_INTEL_FIRMWARE=y
+CONFIG_VBOOT_NO_BOARD_SUPPORT=y
+CONFIG_RW_REGION_ONLY=""
CONFIG_MRC_SETTINGS_CACHE_SIZE=0x10000
CONFIG_DRIVERS_INTEL_WIFI=y
CONFIG_IFD_BIN_PATH="3rdparty/dasharo-blobs/novacustom/nv4x_adl/descriptor.bin"
CONFIG_ME_BIN_PATH="3rdparty/dasharo-blobs/novacustom/nv4x_adl/me.bin"
-CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x20000
+# CONFIG_VBOOT_ALWAYS_ALLOW_UDC is not set
+CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x100000
+CONFIG_EDK2_BOOT_TIMEOUT=2
CONFIG_VBT_DATA_SIZE_KB=9
+CONFIG_VBOOT_FWID_MODEL="$(CONFIG_MAINBOARD_VENDOR)_$(CONFIG_MAINBOARD_PART_NUMBER)"
+CONFIG_VBOOT_STARTS_IN_BOOTBLOCK=y
CONFIG_CARDBUS_PLUGIN_SUPPORT=y
CONFIG_SPI_FLASH_DONT_INCLUDE_ALL_DRIVERS=y
# CONFIG_USE_LEGACY_8254_TIMER is not set
+CONFIG_GBB_HWID=""
# CONFIG_DEBUG_SMI is not set
CONFIG_HAVE_IFD_BIN=y
CONFIG_PCIEXP_HOTPLUG_BUSES=42
CONFIG_PCIEXP_HOTPLUG_MEM=0xc200000
CONFIG_PCIEXP_HOTPLUG_PREFETCH_MEM=0x1c000000
+# CONFIG_VBOOT_SLOTS_RW_AB is not set
CONFIG_PS2K_EISAID="PNP0303"
CONFIG_PS2M_EISAID="PNP0F13"
@@ -193,8 +199,8 @@ CONFIG_PCIEXP_CLK_PM=y
CONFIG_PC_CMOS_BASE_PORT_BANK1=0x72
CONFIG_HEAP_SIZE=0x10000
CONFIG_EC_GPE_SCI=0x50
+CONFIG_EDK2_BOOTSPLASH_FILE="3rdparty/dasharo-blobs/novacustom/bootsplash.bmp"
CONFIG_TPM_MEASURED_BOOT=y
-CONFIG_LINUX_COMMAND_LINE="quiet loglevel=2"
CONFIG_BOARD_ROMSIZE_KB_32768=y
# CONFIG_COREBOOT_ROMSIZE_KB_256 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_512 is not set
@@ -399,7 +405,7 @@ CONFIG_SOC_INTEL_COMMON_BLOCK_TCO=y
CONFIG_SOC_INTEL_COMMON_BLOCK_TCO_ENABLE_THROUGH_SMBUS=y
CONFIG_SOC_INTEL_COMMON_BLOCK_SMM=y
CONFIG_SOC_INTEL_COMMON_BLOCK_SMM_IO_TRAP=y
-# CONFIG_SOC_INTEL_COMMON_BLOCK_SMM_TCO_ENABLE is not set
+CONFIG_SOC_INTEL_COMMON_BLOCK_SMM_TCO_ENABLE=y
CONFIG_SOC_INTEL_COMMON_BLOCK_SMM_S5_DELAY_MS=0
CONFIG_SOC_INTEL_COMMON_BLOCK_SPI=y
CONFIG_SOC_INTEL_COMMON_BLOCK_SA=y
@@ -417,7 +423,7 @@ CONFIG_SOC_INTEL_COMMON_BLOCK_USB4_PCIE=y
CONFIG_SOC_INTEL_COMMON_BLOCK_USB4_XHCI=y
CONFIG_SOC_INTEL_ENABLE_USB4_PCIE_RESOURCES=y
CONFIG_SOC_INTEL_COMMON_BLOCK_VTD=y
-# CONFIG_ENABLE_EARLY_DMA_PROTECTION is not set
+CONFIG_ENABLE_EARLY_DMA_PROTECTION=y
CONFIG_SOC_INTEL_COMMON_BLOCK_XDCI=y
CONFIG_SOC_INTEL_COMMON_BLOCK_XHCI=y
CONFIG_SOC_INTEL_COMMON_BLOCK_XHCI_ELOG=y
@@ -508,15 +514,15 @@ CONFIG_EC_SYSTEM76_EC_DGPU=y
#
# Intel Firmware
#
-CONFIG_IFDTOOL_DISABLE_ME=y
+# CONFIG_IFDTOOL_DISABLE_ME is not set
CONFIG_HAVE_ME_BIN=y
# CONFIG_STITCH_ME_BIN is not set
# CONFIG_ME_REGION_ALLOW_CPU_READ_ACCESS is not set
CONFIG_HAVE_INTEL_ME_HAP=y
# CONFIG_INTEL_ME_DISABLED_HECI is not set
-CONFIG_INTEL_ME_DISABLED_HAP=y
-# CONFIG_INTEL_ME_ENABLED is not set
-CONFIG_INTEL_ME_DEFAULT_STATE=2
+# CONFIG_INTEL_ME_DISABLED_HAP is not set
+CONFIG_INTEL_ME_ENABLED=y
+CONFIG_INTEL_ME_DEFAULT_STATE=0
# CONFIG_DO_NOT_TOUCH_DESCRIPTOR_REGION is not set
# CONFIG_LOCK_MANAGEMENT_ENGINE is not set
CONFIG_UNLOCK_FLASH_REGIONS=y
@@ -529,7 +535,7 @@ CONFIG_BIOS_VENDOR="3mdeb"
#
# Dasharo Configuration
#
-CONFIG_DASHARO_PREFER_S3_SLEEP=y
+# CONFIG_DASHARO_PREFER_S3_SLEEP is not set
# end of Dasharo Configuration
CONFIG_UDK_BASE=y
@@ -550,8 +556,6 @@ CONFIG_X86_CUSTOM_BOOTMEDIA=y
CONFIG_PC80_SYSTEM=y
CONFIG_HAVE_CMOS_DEFAULT=y
CONFIG_POSTCAR_STAGE=y
-CONFIG_BOOTBLOCK_SIMPLE=y
-# CONFIG_BOOTBLOCK_NORMAL is not set
CONFIG_COLLECT_TIMESTAMPS_TSC=y
CONFIG_IDT_IN_EVERY_STAGE=y
CONFIG_HAVE_CF9_RESET=y
@@ -575,9 +579,10 @@ CONFIG_NO_EARLY_GFX_INIT=y
#
# Display
#
+CONFIG_WANT_LINEAR_FRAMEBUFFER=y
CONFIG_GENERIC_LINEAR_FRAMEBUFFER=y
CONFIG_LINEAR_FRAMEBUFFER=y
-CONFIG_BOOTSPLASH=y
+# CONFIG_BOOTSPLASH is not set
# end of Display
CONFIG_PCI=y
@@ -610,17 +615,21 @@ CONFIG_I2C_TRANSFER_TIMEOUT_US=500000
# Generic Drivers
#
CONFIG_CRB_TPM_BASE_ADDRESS=0xfed40000
-# CONFIG_DRIVERS_EFI_VARIABLE_STORE is not set
+CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
# CONFIG_ELOG is not set
CONFIG_CACHE_MRC_SETTINGS=y
CONFIG_MRC_SETTINGS_PROTECT=y
-# CONFIG_SMMSTORE is not set
+CONFIG_HAS_RECOVERY_MRC_CACHE=y
+CONFIG_MRC_SAVE_HASH_IN_TPM=y
+CONFIG_SMMSTORE=y
+CONFIG_SMMSTORE_V2=y
+CONFIG_SMMSTORE_SIZE=0x40000
CONFIG_SPI_FLASH=y
CONFIG_BOOT_DEVICE_SPI_FLASH_RW_NOMMAP=y
CONFIG_BOOT_DEVICE_SPI_FLASH_RW_NOMMAP_EARLY=y
+CONFIG_SPI_FLASH_SMM=y
# CONFIG_SPI_FLASH_NO_FAST_READ is not set
-CONFIG_TPM_INIT_RAMSTAGE=y
-# CONFIG_TPM_PPI is not set
+CONFIG_TPM_PPI=y
CONFIG_DRIVERS_UART=y
CONFIG_NO_UART_ON_SUPERIO=y
CONFIG_DRIVERS_UART_8250MEM=y
@@ -669,7 +678,7 @@ CONFIG_DRIVERS_INTEL_PMC=y
# CONFIG_DRIVERS_NXP_UWB_SR1XX is not set
# CONFIG_DRIVERS_PS2_KEYBOARD is not set
CONFIG_DRIVERS_MC146818=y
-# CONFIG_USE_PC_CMOS_ALTCENTURY is not set
+CONFIG_USE_PC_CMOS_ALTCENTURY=y
CONFIG_PC_CMOS_BASE_PORT_BANK0=0x70
CONFIG_MEMORY_MAPPED_TPM=y
CONFIG_TPM_TIS_BASE_ADDRESS=0xfed40000
@@ -695,6 +704,50 @@ CONFIG_DRIVERS_INTEL_USB4_RETIMER=y
# Verified Boot (vboot)
#
CONFIG_VBOOT_LIB=y
+CONFIG_VBOOT_VBNV_CMOS=y
+CONFIG_VBOOT_VBNV_CMOS_BACKUP_TO_FLASH=y
+# CONFIG_VBOOT_MOCK_SECDATA is not set
+CONFIG_VBOOT_MUST_REQUEST_DISPLAY=y
+CONFIG_VBOOT_ALWAYS_ENABLE_DISPLAY=y
+CONFIG_VBOOT_HAS_REC_HASH_SPACE=y
+CONFIG_CBFS_MCACHE_RW_PERCENTAGE=50
+CONFIG_VBOOT_CLEAR_RECOVERY_EACH_BOOT=y
+# CONFIG_VBOOT_EC_EFS is not set
+CONFIG_VBOOT_X86_SHA256_ACCELERATION=y
+
+#
+# GBB configuration
+#
+CONFIG_GBB_BMPFV_FILE=""
+# CONFIG_GBB_FLAG_DEV_SCREEN_SHORT_DELAY is not set
+# CONFIG_GBB_FLAG_LOAD_OPTION_ROMS is not set
+# CONFIG_GBB_FLAG_ENABLE_ALTERNATE_OS is not set
+# CONFIG_GBB_FLAG_FORCE_DEV_SWITCH_ON is not set
+CONFIG_GBB_FLAG_FORCE_DEV_BOOT_USB=y
+CONFIG_GBB_FLAG_DISABLE_FW_ROLLBACK_CHECK=y
+# CONFIG_GBB_FLAG_ENTER_TRIGGERS_TONORM is not set
+# CONFIG_GBB_FLAG_FORCE_DEV_BOOT_ALTFW is not set
+# CONFIG_GBB_FLAG_RUNNING_FAFT is not set
+CONFIG_GBB_FLAG_DISABLE_EC_SOFTWARE_SYNC=y
+# CONFIG_GBB_FLAG_DEFAULT_DEV_BOOT_ALTFW is not set
+CONFIG_GBB_FLAG_DISABLE_PD_SOFTWARE_SYNC=y
+CONFIG_GBB_FLAG_DISABLE_LID_SHUTDOWN=y
+# CONFIG_GBB_FLAG_FORCE_MANUAL_RECOVERY is not set
+CONFIG_GBB_FLAG_DISABLE_FWMP=y
+# CONFIG_GBB_FLAG_ENABLE_UDC is not set
+# end of GBB configuration
+
+#
+# Vboot Keys
+#
+CONFIG_VBOOT_ROOT_KEY="$(VBOOT_SOURCE)/tests/devkeys/root_key.vbpubk"
+CONFIG_VBOOT_RECOVERY_KEY="$(VBOOT_SOURCE)/tests/devkeys/recovery_key.vbpubk"
+CONFIG_VBOOT_FIRMWARE_PRIVKEY="$(VBOOT_SOURCE)/tests/devkeys/firmware_data_key.vbprivk"
+CONFIG_VBOOT_KERNEL_KEY="$(VBOOT_SOURCE)/tests/devkeys/kernel_subkey.vbpubk"
+CONFIG_VBOOT_KEYBLOCK="$(VBOOT_SOURCE)/tests/devkeys/firmware.keyblock"
+CONFIG_VBOOT_KEYBLOCK_VERSION=1
+CONFIG_VBOOT_KEYBLOCK_PREAMBLE_FLAGS=0x0
+# end of Vboot Keys
# end of Verified Boot (vboot)
#
@@ -730,10 +783,14 @@ CONFIG_INTEL_TXT_LIB=y
# CONFIG_INTEL_TXT is not set
# CONFIG_STM is not set
# CONFIG_INTEL_CBNT_SUPPORT is not set
-CONFIG_BOOTMEDIA_LOCK_NONE=y
-# CONFIG_BOOTMEDIA_LOCK_CONTROLLER is not set
+# CONFIG_BOOTMEDIA_LOCK_NONE is not set
+CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
# CONFIG_BOOTMEDIA_LOCK_CHIP is not set
-# CONFIG_BOOTMEDIA_SMM_BWP is not set
+# CONFIG_BOOTMEDIA_LOCK_WHOLE_RO is not set
+# CONFIG_BOOTMEDIA_LOCK_WHOLE_NO_ACCESS is not set
+CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
+CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y
+CONFIG_BOOTMEDIA_SMM_BWP=y
# end of Security
CONFIG_ACPI_HAVE_PCAT_8259=y
@@ -772,8 +829,8 @@ CONFIG_DEFAULT_CONSOLE_LOGLEVEL_7=y
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_1 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_0 is not set
CONFIG_DEFAULT_CONSOLE_LOGLEVEL=7
-CONFIG_CONSOLE_USE_LOGLEVEL_PREFIX=y
-CONFIG_CONSOLE_USE_ANSI_ESCAPES=y
+# CONFIG_CONSOLE_USE_LOGLEVEL_PREFIX is not set
+# CONFIG_CONSOLE_USE_ANSI_ESCAPES is not set
# CONFIG_CMOS_POST is not set
CONFIG_HWBASE_DEBUG_CB=y
# end of Console
@@ -804,12 +861,89 @@ CONFIG_MAINBOARD_SERIAL_NUMBER="123456789"
# CONFIG_PAYLOAD_LINUXBOOT is not set
# CONFIG_PAYLOAD_SEABIOS is not set
# CONFIG_PAYLOAD_UBOOT is not set
-# CONFIG_PAYLOAD_EDK2 is not set
-CONFIG_PAYLOAD_LINUX=y
-CONFIG_PAYLOAD_FILE="@BOARD_BUILD_DIR@/bzImage"
+CONFIG_PAYLOAD_EDK2=y
+# CONFIG_PAYLOAD_LINUX is not set
+CONFIG_PAYLOAD_FILE="novacustom_nv4x_adl/UEFIPAYLOAD.fd"
CONFIG_PAYLOAD_OPTIONS=""
-# CONFIG_PXE is not set
-CONFIG_LINUX_INITRD="@BOARD_BUILD_DIR@/initrd.cpio.xz"
+CONFIG_EDK2_UEFIPAYLOAD=y
+# CONFIG_EDK2_UNIVERSAL_PAYLOAD is not set
+CONFIG_EDK2_REPO_MRCHROMEBOX=y
+# CONFIG_EDK2_REPO_OFFICIAL is not set
+# CONFIG_EDK2_REPO_CUSTOM is not set
+CONFIG_EDK2_REPOSITORY="https://github.com/Dasharo/edk2"
+CONFIG_EDK2_TAG_OR_REV="b7274c98697e972e772236caf830c0780ec498bd"
+CONFIG_EDK2_USE_EDK2_PLATFORMS=y
+CONFIG_EDK2_PLATFORMS_REPOSITORY="https://github.com/Dasharo/edk2-platforms"
+CONFIG_EDK2_PLATFORMS_TAG_OR_REV="3323ed481d35096fb6a7eae7b49f35eff00f86cf"
+# CONFIG_EDK2_DEBUG is not set
+CONFIG_EDK2_RELEASE=y
+# CONFIG_EDK2_BOOT_MANAGER_ESCAPE is not set
+CONFIG_EDK2_CBMEM_LOGGING=y
+CONFIG_EDK2_SYSTEM76_EC_LOGGING=y
+CONFIG_EDK2_CPU_TIMER_LIB=y
+CONFIG_EDK2_FOLLOW_BGRT_SPEC=y
+CONFIG_EDK2_FULL_SCREEN_SETUP=y
+CONFIG_EDK2_HAVE_EFI_SHELL=y
+CONFIG_EDK2_PRIORITIZE_INTERNAL=y
+CONFIG_EDK2_PS2_SUPPORT=y
+CONFIG_EDK2_SKIP_PS2_DETECT=y
+CONFIG_EDK2_SD_MMC_TIMEOUT=10
+CONFIG_EDK2_SERIAL_SUPPORT=y
+CONFIG_EDK2_ENABLE_IPXE=y
+CONFIG_EDK2_IPXE_OPTION_NAME="iPXE Network Boot"
+CONFIG_EDK2_SECURE_BOOT=y
+# CONFIG_EDK2_SECURE_BOOT_DEFAULT_ENABLE is not set
+# CONFIG_EDK2_SATA_PASSWORD is not set
+# CONFIG_EDK2_OPAL_PASSWORD is not set
+CONFIG_EDK2_SETUP_PASSWORD=y
+CONFIG_EDK2_PERFORMANCE_MEASUREMENT_ENABLE=y
+CONFIG_EDK2_DASHARO_SYSTEM_FEATURES=y
+CONFIG_EDK2_DASHARO_SECURITY_OPTIONS=y
+CONFIG_EDK2_SHOW_CAMERA_OPTION=y
+CONFIG_EDK2_SHOW_WIFI_BT_OPTION=y
+CONFIG_EDK2_DASHARO_INTEL_ME_OPTIONS=y
+CONFIG_EDK2_DASHARO_USB_CONFIG=y
+CONFIG_EDK2_DASHARO_NETWORK_CONFIG=y
+# CONFIG_EDK2_DASHARO_CHIPSET_CONFIG is not set
+CONFIG_EDK2_DASHARO_POWER_CONFIG=y
+CONFIG_EDK2_SLEEP_TYPE_OPTION=y
+CONFIG_EDK2_FAN_CURVE_OPTION=y
+CONFIG_EDK2_BATTERY_CONFIG_OPTION=y
+# CONFIG_EDK2_DASHARO_PCI_CONFIG is not set
+# CONFIG_EDK2_DASHARO_MEMORY_CONFIG is not set
+# CONFIG_EDK2_DASHARO_NETWORK_BOOT_DEFAULT_ENABLE is not set
+# CONFIG_EDK2_DASHARO_SERIAL_REDIRECTION_DEFAULT_ENABLE is not set
+CONFIG_EDK2_BOOT_MENU_KEY=0x0011
+CONFIG_EDK2_SETUP_MENU_KEY=0x000C
+CONFIG_EDK2_DISABLE_MTRR_PROGRAMMING=y
+CONFIG_EDK2_ENABLE_BATTERY_CHECK=y
+# CONFIG_EDK2_DISABLE_OPTION_ROMS is not set
+CONFIG_EDK2_PRINT_SOL_STRINGS=y
+# CONFIG_EDK2_RAM_DISK_ENABLE is not set
+CONFIG_EDK2_CUSTOM_BUILD_PARAMS="-D VARIABLE_SUPPORT=SMMSTORE"
+CONFIG_EDK2_LAN_ROM_DRIVER=""
+# CONFIG_EDK2_CREATE_PREINSTALLED_BOOT_OPTIONS is not set
+CONFIG_PXE=y
+
+#
+# PXE Options
+#
+# CONFIG_PXE_ROM is not set
+CONFIG_BUILD_IPXE=y
+CONFIG_IPXE_STABLE=y
+# CONFIG_IPXE_MASTER is not set
+# CONFIG_PXE_SERIAL_CONSOLE is not set
+# CONFIG_PXE_NO_PROMPT is not set
+CONFIG_PXE_ADD_SCRIPT=y
+CONFIG_PXE_SCRIPT="3rdparty/dasharo-blobs/dasharo/dasharo.ipxe"
+CONFIG_PXE_HAS_HTTPS=y
+CONFIG_PXE_CUSTOM_BUILD_ID="0123456789"
+CONFIG_PXE_TRUST_CMD=y
+# end of PXE Options
+
+# CONFIG_COMPRESSED_PAYLOAD_NONE is not set
+CONFIG_COMPRESSED_PAYLOAD_LZMA=y
+# CONFIG_COMPRESSED_PAYLOAD_LZ4 is not set
CONFIG_COMPRESS_SECONDARY_PAYLOAD=y
#
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Made sure all linux configs are in good oldconfig state by:
docker run -e DISPLAY=$DISPLAY --network host --rm -ti -v $(pwd):$(pwd) -w $(pwd) tlaurion/heads-dev-env:v0.2.3
find ./boards/ -type f | awk -F "/" {'print $3'} | sort | uniq | while read board; do make BOARD=$board linux.modify_and_save_oldconfig_in_place; done
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
- fi misplaced
- rework reencryption loop
- added verbose output on TPM DUK key addition when LUKS container can be unlocked with DRK
Current state, left todo for future work:
TPM DUK:
- TPM DUK setup on defautl boot reuses /boot/kexec_key_devices.txt if present
- If not, list all LUKS partitions, asks user for selection and makes sure LUKS passphrase can unlock all
- Works on both LUKSv1 and LUKSv2 containers, reusing OS installer settings (Heads doesn't enforce better then OS installer LUKS parameters)
LUKS passphrase change/LUKS reencryption:
- Reuses /boot/kexec_key_devices.txt if existing
- If not, prompts for LUKS passphase, list all LUKS containers not being USB based and attempt to unlock all those, listing only the ones successfully unlocked
- Prompts user to reuse found unlockable LUKS partitions with LUKS passphrase, caches and reuse in other LUKS operations (passphrase change as well from oem factory reset/re-ownership)
- Deals properly with LUKSv1/LUKSv2/multiple LUKS containers and reencrypt/passphrase changes them all if accepted, otherwise asks user to select individual LUKS container
Tested on luksv1,luksv2, btrfs under luks (2x containers) and TPM DUK setup up to booting OS. All good
TODO:
- LUKS passphrase check is done multiple times across TPM DUK, reencryption and luks passphrase. Could refactor to change this, but since this op is done only one reencrypt+passphrase change) upon hardare reception from OEM, I stopped caring here.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
- cache/reuse that passphrase, used afterward to find which LUKS keyslot contains the DRK, which is used to direct reencryption, also reused for passphrase change.
- refactoring detection + testing of prompted LUKS passphrase for discovered LUKS containers that can be unlocked with same passphrase to prompt user for selection
TODO: remove duplicate luks passphrase unlocking volumes functions for the moment
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
