Commit Graph

1478 Commits

Author SHA1 Message Date
Matt DeVillier
31214381a2
board/librem_*: Switch to cryptsetup2
Required to decrypt some volumes encrypted via LUKS2
(eg, Qubes 4.1 dom0 / root partition)

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-01-27 16:40:47 -06:00
tlaurion
f618d357c0
Merge pull request #1094 from tlaurion/tails_signing-key_2022
tails.key : merging of new long-term signing key with old one so old ISOs can still be booting from Heads
2022-01-23 22:19:49 -05:00
Thierry Laurion
7a324bbd29
tails.key : merging of new long-term signing key with old one so old ISOs can still be booting from Heads
Reproducibility notes at https://github.com/osresearch/heads/pull/1023#issuecomment-1018735659

Fixes #1023
2022-01-21 12:58:25 -05:00
HardenedVault
b4b0bc4a7a Use luksHeaderBackup rather than luksDump to measure luks headers. 2022-01-19 10:12:37 -05:00
eganonoa
fba79ab448 Fixing config.yaml file path 2021-12-28 11:10:58 -05:00
eganonoa
a1f86fa3aa Fixing config.yaml file path 2021-12-28 11:10:58 -05:00
eganonoa
a5b27e485f Adding explanatory notes re t530 and w530 dgpus
This commit adds explanatory notes  and updates existing t530 and w530 boards to generally align them with the dGPU points and provide signposting for those with and those without dGPU boards. It also adds an additional README in the blobs directory to explain the vbios extraction and building process.
2021-12-28 11:10:58 -05:00
eganonoa
a854144e2d Add support for t530 and w530 dGPU
This commit adds support for the t530 and w530 boards to enable dGPUs. dGPU's are required for DisplayPort external displays in the t530 dgpu model, and for both the VGA dn DisplayPort external displays in the W530 (which has two dGPUs, the K1000M and K2000M, hence two boards).  The commit does the following:

1. Adds automated extraction scripts for vbios modelled on the me script in the blobs directory (one per board is necessary as it is based on board-specific bios updates).
2. Adds specific boards for the various dGPU models and corresponding coreboot configs.
3. Updates circleci config.yaml to run scripts and test boards.

Tested and working on T530 dgpu and W530 K1000M. dGPU scripts tested on Debian 10 and Ubuntu 21.04
2021-12-28 11:10:58 -05:00
Matt DeVillier
f0f4677112 circleci: add Librem boards as coreboot 4.15 build targets
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-20 22:13:36 -05:00
Matt DeVillier
7d83bfcbea config/coreboot-librem_14: Drop CONFIG_ANY_TOOLCHAIN
No longer needed

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-20 22:13:36 -05:00
Matt DeVillier
51a1119973 boards/librem_*: Unify/update kernel IOMMU params
Unify the CONFIG_BOOT_KERNEL_ADD/REOVE parameters for all
Librem boards. Ensure IOMMU disabled for the GPU, and that
duplicated IOMMU params are not passed to the kernel.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-20 22:13:36 -05:00
Matt DeVillier
f23d218db1 config/coreboot-librem_{13*,15*}: Use iommu=pt for Heads kernel
Resolves issues booting Qubes 4.1-RC1 installer. Drop log level
to be consistent with the Librem 14/Mini v1/v2.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-20 22:13:36 -05:00
Matt DeVillier
d9bc74e7f0 blobs/librem*: remove blob download scripts
Blobs needed to build the Librem 13/15 boards are now
handled by the purism_blobs module; these scripts are
no longer needed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-20 22:13:36 -05:00
Matt DeVillier
5859d1438e modules/coreboot: drop support for coreboot 4.14
All boards using 4.14 have migrated to 4.15

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-20 22:13:36 -05:00
Matt DeVillier
c5d9fa484b boards/librem_*: Update to coreboot 4.15
Update all Purism Librem boards except the L1UM server
to coreboot 4.15:

- update coreboot version from 4.8.1/4.13 to 4.15
- use purism_blobs module (if not already)
- update board coreboot defconfig files (Librem 13/15)

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-20 22:13:36 -05:00
Matt DeVillier
1dc79eba82 modules/coreboot: add support for coreboot 4.15
Update hash for coreboot module, coreboot-blobs.
Adjust extra flags to address SNB/IVB build issue.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-20 22:13:36 -05:00
Matt DeVillier
3fef749bff modules/purism-blobs: update to current HEAD
Updates CPU microcodes for all Librem boards.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-20 22:13:36 -05:00
Thierry Laurion
90ad708849 Apply background colors when fbwhiptail binary is present. 2021-12-17 16:50:03 -05:00
Matt DeVillier
519bd445d6 flash.sh: Add progress bar
Show state of flashrom reads/writes by means of a progress bar,
as used in the Librem coreboot flashing scripts

v2: add adjustment for use with `--ifd`

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-17 16:48:34 -05:00
Thierry Laurion
415a08a732 board additions: w530, t530, t520 (hotp-maximized and maximized flavors only)
-CircleCI addition.
-Removal of t530-flash, w530-flash boards, flash scripts and associated coreboot configs (no more legacy boards additions)

This is a merger of #1071, #1072 and #1073 so that test builds are available over CircleCI until osresearch/master CircleCI gets unlocked.
2021-12-06 19:52:25 -05:00
eganonoa
f8a30866a8 Reverting to coreboot 4.13 2021-12-06 19:52:25 -05:00
eganonoa
5263aa9c2f Reverting to coreboot 4.13 2021-12-06 19:52:25 -05:00
eganonoa
8aa11bae40 Update t530-flash.config 2021-12-06 19:52:25 -05:00
eganonoa
b4368f3df0 Reverting to coreboot 4.13 2021-12-06 19:52:25 -05:00
eganonoa
38b29cb9f7 Reverting to coreboot 4.13 2021-12-06 19:52:25 -05:00
eganonoa
ce435a4148 adding working w530 board, initrd and config files 2021-12-06 19:52:25 -05:00
eganonoa
652bcb8ad0 reverting to coreboot 4.8.1 (4.13, 4.14 both working) 2021-12-06 19:52:25 -05:00
eganonoa
66e5c23b13 adding working t530 board, initrd and config files 2021-12-06 19:52:25 -05:00
eganonoa
90984baca7 adding working t520 baord and configs 2021-12-06 19:52:25 -05:00
Thierry Laurion
e492786d0a CircleCI: fix #1058 and partly #984
CircleCI: We currently drop coreboot 4.11 builds.
- There is a file missing in the builds. Not sure why/how this is happening
src/soc/intel/fsp_broadwell_de/romstage/romstage.c:41:10: fatal error: build.h: No such file or directory
Example:https://app.circleci.com/pipelines/github/tlaurion/heads/877/workflows/7d0248d2-459c-42ad-b741-8fd56a75d527/jobs/2487
- kgpe-d16_workstation building for all GPUs is unfortunately taking too much time to build (40 minutes).
- Not sure why, but it seems that the kernel build paralellization is not working for 4.11 while it works for 4.13
Makefile: Uncomment MAKE_JOBS which passes the number of jobs to numbers cores by default and --max-load of 16
CircleCI: Remove CPUS statement to use Makefile default
modules/newt: force build with one make job, otherwise there is a race condition in module which fails randomly expecting build modules. (TODO: FIX)

Interestingly, building all coreboot 4.13 boards is happening on a clean commit just above 1h limit.

More details:
- CircleCI changed job build time to a maximum of 1h each.
- CircleCI now permits parallelization of 30 jobs
- 6000 build minutes a month.
- Still waiting for osresearch/heads CircleCI project to be unlocked (currently not recognized as open source project?!)
2021-12-04 15:51:53 -05:00
Thierry Laurion
2ddbd12f98 t4xx: coreboot fix of https://github.com/osresearch/heads/issues/1057#issuecomment-980244848 for #1015 2021-12-04 15:51:53 -05:00
Thierry Laurion
ee5073ebe8 CircleCI: add large ressource class for free tier as defined under https://support.circleci.com/hc/en-us/articles/4410707277083-Context-deadline-exceeded-after-1-hour-Build-timed-out-Free-tier-only-
Readd https://github.com/osresearch/heads/pull/984 without cache
Add kgpe-d16 musl-cross target prior of having kgpe-d16 depend on musl-cross target (To try to have musl-cross step successfull under 1h CircleCI new limit)
CircleCI: add a subcommand that can follow a target (to build musl-cross-make now and coreboot version specific musl-cross later)
Output of hashes is now optional
29/11/2021 CircleCI public information available states parallelization of up to 30 jobs at a time. Let's play
- We first build heads musl-cross-make and persist (passing musl-cross-make into next job)
- We then build per coreboot version board with coreboot make statement only and persist (passing musl-cross-make + coreboot's musl-cross buildstack)
- We then build per coreboot version board (reusing past build musl-cross-make and coreboot's version musl-cross buildstack)
Remove 4.11 boards for the moment to test only build time and parallelization
2021-12-04 15:51:53 -05:00
Thierry Laurion
22f2288331 xx30 blobs: use me_cleaner.py locally downloaded
- me_cleaner downloaded from 43612a630c/me_cleaner.py
- placed under xx30 blobs dir
- CircleCI uses it locally without downloading it everytime (me_cleaner hasn<t changed since 2018)
2021-12-04 15:51:53 -05:00
Thierry Laurion
40babfeaf4 t430-hotp-verification: addition of t430 counterpart of non-maximized x230-hotp-verification board 2021-12-04 15:51:53 -05:00
Thierry Laurion
8d805e8d8f CircleCI: build only for coreboot 4.13 and coreboot 4.11 boards. (TODO: change when 4.13 boards bumped to 4.14) 2021-12-04 15:51:53 -05:00
Thierry Laurion
2d8d45c02e t420 board was still based on coreboot 4.8.1. blobs still depend on blobs/t420/* presence. 2021-12-04 15:51:53 -05:00
Thierry Laurion
c5be3ce483 t430 board was a X230. fixed. 2021-12-04 15:51:53 -05:00
Thierry Laurion
7c576e2706 CircleCI: base all coreboot 4.13 boards on hotp-maximized to try to free more building time. 2021-12-04 15:51:53 -05:00
Thierry Laurion
41847f5cd2 move all other boards (but KGPE-D16) to coreboot 4.13
- xx30 legacy boards (x230, x230-flash, t430, t430-flash) now rely also on coreboot 4.13
  - DOWNSIDE: x230 and t430 legacy boards now rely on WHIPTAIL (NOT FBWhiptail) to have enough space to fit under 7mb)
- xx20 boards moved to 4.13 (no need of xx20-flash boards here since single SPI boards with 7.5mb useable since blobs scripts are required)
  - DOWNSIDE: all xx20 boards now have dropbear deactivated, while still having ethernet driver in.
- qemu-coreboot and qemu-coreboot-fbwhiptail switched to coreboot 4.13 WITHOUT TPM SUPPORT (with cryptsetup 2.x support)
  - DOWNSIDE:
    - coreboot-qemu board CBFS_SIZE=0x700000 -> 0x750000
    - coreboot-qemu-fbwhiptail CBFS_SIZE=0x750000 -> 0x780000
- CircleCi build recipe removes 4.8.1 boards altogether
  - KGPE-D16 workstation is used as new base build to save workspace layer (we removed one workspace layer)
  - Removing one workspace layer will save approx 2 hours of build time on fresh builds
  - Removing one coreboot version will save us approx 2 hours of build time on fresh builds
  - KGPE-D16 will stay to coreboot 4.11 until forward notice.
  - All other board configs SHOULD be built on latest coreboot versions
2021-12-04 15:51:53 -05:00
Thierry Laurion
c7e651d663 xx20/xx30 boards uniformisation when switching to coreboot 4.13
- all: coreboot NO_POST for all boards
- all: coreboot NO_GFX_INIT (linux payload does the graphic init)
- all: coreboot TPM_MEASURED_BOOT (no more patches under Heads for measured boot)
- all: coreboot DRIVERS_PS2_KEYBOARD (fixes no keyboard on soft reboot and potentially xx30t xx20t fix for random raw keyboard (to be tested)
- all: coreboot removal of DEFAULT_CONSOLE_LOGLEVEL_5 under some boards
- all: coreboot removal of "loglevel=3" under some linux command line options booting Heads kernel
- all: coreboot removal of DEBUG_SMM_RELOCATION (unneeded)
- all: coreboot INCLUDE_CONFIG_FILE and COLLECT_TIMESTAMPS for all boards
- all: coreboot CONSOLE_SERIAL present on all boards
- all: coreboot add VBT
- all: board configs switch to cryptsetup2

xx20 hotp-maximized boards:
- removal of dropbear (not enough space to have htop + dropbear)

txx0 boards coreboot:
- USE_OPTION_TABLE and STATIC_OPTION_TABLE added (todo: check T430 boards optimization and find issue/PR and ammend this commit)
2021-12-04 15:51:53 -05:00
Thierry Laurion
5f36bfab1d t420 maximized builds: remove commented coreboot config options (we want log timestamps and also want to provide active configuration) 2021-12-04 15:51:53 -05:00
Thierry Laurion
816259c0f1 x230-maximized boards : add PS2 keyboard support to fix keyboard being inactive at reboot and potentially x230t which is raw sometimes on boot. 2021-12-04 15:51:53 -05:00
Thierry Laurion
6de04473b7 Add CONFIG_INTEL_GMA_ADD_VBT to suppress i915 PCI errors at early boot 2021-12-04 15:51:53 -05:00
Thierry Laurion
e8032924c1 x230-maximized boards: build against coreboot 4.13 2021-12-04 15:51:53 -05:00
natterangell
54a3b07947 t420-maximized boards: build against coreboot 4.13 2021-12-04 15:51:53 -05:00
icequbes1
b35e1bcbb3 oem-factory-reset: fix whiptail height/width order 2021-11-24 17:00:25 -05:00
Matt DeVillier
fdbd9b2d48 gui-init: Handle overflow of list of files w/failed hashes
When files in /boot fail hash verification, the list of files
can sometimes overflow the whiptail msgbox, preventing the
prompt and buttons to update checksums from showing. To mitigate
this, if # of files is > 10, use less to show the file list and
present a separate prompt to update the checksums once the file
list has been viewed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-29 16:11:28 -04:00
Thierry Laurion
59aafa5506 NEWT: fix whiptail line width for output that could wrap line content over multiple lines 2021-10-29 14:53:53 -04:00
Thierry Laurion
561d01c863 KGPE-D16: remove BOOT_GUI_MENU_NAME and BG_COLOR as under all other boards. 2021-10-29 13:45:22 -04:00
Thierry Laurion
2fc8813fc6 oem-factory-reset: fix output when fbwhiptail is not used
- Fixed inversed HEIGHT and WIDTH usage
- Fixed height to 30 and width to 90 as everywhere else

This was causing a blank screen when whiptail without framebuffer (fbwhiptail) was used.
Actually, it seems like the width and height under whiptail calls are only taken into consideration under NEWT, not FBWHIPTAIL.
2021-10-29 13:45:22 -04:00