Commit Graph

2069 Commits

Author SHA1 Message Date
Thierry Laurion
5710eafde4
coreboot configs: sandy/ivy/haswell : readd libgfxinit and bootsplash requirements
Remove CONFIG_NO_GFX_INIT from configs having CONFIG_NORTHBRIDGE_INTEL_SANDYBRIDGE=y
Add CONFIG_BOOTSPLASH_IMAGE from configs having CONFIG_NORTHBRIDGE_INTEL_SANDYBRIDGE=y
Add CONFIG_LINEAR_FRAMEBUFFER from configs having CONFIG_NORTHBRIDGE_INTEL_SANDYBRIDGE=y
Set BOOTSPLASH parameters to match bootsplash and jpeg requirements
 +CONFIG_LINEAR_FRAMEBUFFER_MAX_HEIGHT=768
 +CONFIG_LINEAR_FRAMEBUFFER_MAX_WIDTH=1024
 +CONFIG_BOOTSPLASH=y

Others paramaters defined per board default setting with coreboot.save_oldconfig_in_place helper
2023-06-27 11:21:25 -04:00
Thierry Laurion
cdd0c6f46f
Adding bootspashes by @ThePlexus and @d-dwid posted under https://github.com/osresearch/heads/issues/1402
Selects blobs/ThePlexus-bootsplash-1024x768.jpg under blobs/bootsplash-1024x768.jpg (symlink used in coreboot configs)
2023-06-27 11:21:22 -04:00
Thierry Laurion
00e715660a
linux configs for intel: select proper CPU and trust CPU randomization
CONFIG_MCORE2=y
CONFIG_RANDOM_TRUST_CPU=y
2023-06-27 11:21:18 -04:00
Thierry Laurion
cc9a4828ef
Remove qemu-coreboot and qemu-coreboot-fbwhiptail board+coreboot configs
qemu-coreboot-*-tpm* boards are way more feature rich to test/develops Heads
2023-06-27 11:21:15 -04:00
Thierry Laurion
dbc931e20e
config/linux* saved in oldconfig format to ease boards comparison for same kernel versions and across versions
kgpe-d16 linux configs: converted to oldconfig as well
TODO: talos-2
2023-06-27 11:21:12 -04:00
Thierry Laurion
f34d2dd7d7
bump qemu-tpm boards to coreboot 4.19 2023-06-27 11:21:09 -04:00
Thierry Laurion
e02228407f
boards: bump non-tpm qemu*, xx20 and xx30 boards to use linux kernel 5.10.5 2023-06-27 11:21:06 -04:00
Thierry Laurion
e8bc003a56
boards/p8z77-m_pro-tpm1-maximized: bump linux from 4.14 to 5.10 2023-06-27 11:21:02 -04:00
Thierry Laurion
13daaa1203
modules/ coreboot+linux: add helpers to edit config in place + save in oldconfig/defconfig formats
both linux/coreboot:
- save_in_defconfig_format_in_place : takes whatever coreboot config file for a make BOARD=xyz statement and saves it in defconfig
- save_in_oldefconfig_format_in_place : takes whatever coreboot config file for a make BOARD=xyz statement and saves it in oldefconfig

linux:
- linux.prompt_for_new_config_options_for_kernel_version_bump:
  - The most useful helper as of now when doing kernel version bump.
  - Requires to save current kernel config in oldconfig (make BOARD=xyz linux.save_in_oldefconfig_format_in_place) first, then bump kernel version in board config and then use that helper to review new options and save in tree.
2023-06-27 11:20:59 -04:00
Thierry Laurion
c84a0f7e9c
config/coreboot-qemu-fbwhiptail: extend CBFS_SIZE to 0x7E7FFF to accomodate additioaally added DRM+FB for testing 2023-06-27 11:20:56 -04:00
Thierry Laurion
f2d0a6a9c6
config/coreboot-* : adapt i915drmfb driven boards framebuffer requirements
- add additional kernel boot params for i915 where needed:
  - adds : drm_kms_helper.drm_leak_fbdev_smem=1 i915.enable_fbc=0 ( to permit kexec into vesa fb of kexec'ed kernel for i915 driven gpus without framebuffer compression, leaking smem fbdev address for kexec to pickup )
2023-06-27 11:20:52 -04:00
Thierry Laurion
5fce7bf715
config/linux-qemu.config : add CONFIG_DRM_BOCHS=y and CONFIG_FB_SIMPLE=y for basic qemu-coreboot board config
advanced qemu-coreboot-*-tpm*-* boards enables virtio qemu/kvm through command line option.
qemu-coreboot-* (whiptail or fbwhiptail) basic boards are using bochs gpu emulation, provided through qemu

linux-qemu.config, if shared as of now, needs to provide both virtio (no need of FB_SIMPLE because DRM) and BOCHS+SIMPLE_FB
2023-06-27 11:20:49 -04:00
Thierry Laurion
e14d7c363f
config/linux-t440p.config : bump to 5.10.5 2023-06-27 11:20:46 -04:00
Thierry Laurion
7e6987aea0
config/linux-x230-*: migrate from 4.14 to 5.10 + add CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM=y
It was impossible to use directly 4.14 defconfig and apply it to 5.10.
Saving 4.14 in oldconfig, then editing in 5.10 was necessary.
- E1000E module (as kernel module support...) was lost in conversion and needed to be added back.

Also tuned things up:
- legacy-flash has no RETPOLINE, no security policy at all. Has expected usb controllers modules, exFAT and bare minimal support for flashrom.
  - IMPORTANT: CONFIG_X86_IOPL_IOPERM kernel option is required by flashrom
- legacy adds sata, retpoline, additional modules (ethernet), security policy related material on top of legacy-flash config
- maximized adds MMC card support, mousedev+synaptic (to report presence through oem-system-info-xx30), thin provisioning+snapshot support
- tuned with linux.prompt_for_new_config_options_for_kernel_version_bump

Current storage format is oldconfig from now on for proper analysis. If needed, once can save back in defconfig prior of bumping to newer version.
2023-06-27 11:20:43 -04:00
tlaurion
91f65bed79
Merge pull request #1425 from tlaurion/circleci_keep_sizes_forever
CircleCI: have sizes output kept in CircleCI forever just as hashes
2023-06-27 11:12:16 -04:00
Thierry Laurion
3bab585bc0
CircleCI: have sizes output kept in CircleCI forever just as hashes 2023-06-27 11:05:17 -04:00
tlaurion
ce00b750f9
Merge pull request #1424 from tlaurion/add_packed_size_report_into_sizestxt
Makefile: have sizes report output on screen and into sizes.txt
2023-06-27 10:55:34 -04:00
Thierry Laurion
f13432cca7
Makefile+ modules/linux: have sizes report output on screen and into sizes.txt
Basically a duplicate of HASHES related Makefile statements
2023-06-27 10:42:04 -04:00
Jonathon Hall
8289d1bb29
oem-factory-reset: Offer to use all defaults on Librem boards only
Introduce CONFIG_OEMRESET_OFFER_DEFAULTS and enable it on Librem
boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-23 08:20:21 -04:00
Jonathon Hall
f6134e9c35
gui-init: Opt into skipping QR code scan for Librem boards only
Introduce CONFIG_TOTP_SKIP_QRCODE to skip this step and enable it on
Librem boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-23 08:18:59 -04:00
Jonathon Hall
71243c1a13
config-gui.sh,gui-init: Fix whiptail message box sizes to 16 60
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 15:36:04 -04:00
Jonathon Hall
89858f52a9
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 15:15:23 -04:00
Jonathon Hall
c5183253a6
Add CONFIG_BRAND_NAME and allow overriding in Makefile with BRAND_NAME
Use CONFIG_BRAND_NAME to control the brand name displayed in the UI.
Override by setting BRAND_NAME when building, either in the Makefile or
on the command line.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 14:47:59 -04:00
Jonathon Hall
3c4a9fcf0d
Rename CONFIG_PUREBOOT_BASIC to CONFIG_BASIC
Remove brand name from this configuration variable.  For backward
compatibility, update config.user in init if the branded variable is
present.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 14:42:46 -04:00
Jonathon Hall
1bf8331ffb
Blob jail: Add zstd-decompress, decompress more complex archives
Debian 12's initrd by default now consists of an uncompressed cpio
archive containing microcode, followed by a zstd-compressed cpio
archive.  inject_firmware.sh only supported gzip-compressed cpio, so it
could not extract /init from this archive.

Add zstd-decompress to decompress zstd streams (uncompressed size is
about 180 KB).

Add unpack_initramfs.sh which is able to decompress uncompressed, gzip,
or zstd archives, with multiple segments, much like the Linux kernel
itself does.

Use unpack_initramfs.sh to extract /init for blob jail.

Don't compress the new archive segment containing firmware and the
updated /init.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:50 -04:00
Jonathon Hall
3e6eac9ffd
modules/coreboot,purism-blobs: Update to 4.20.1-Purism-1
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:50 -04:00
Jonathon Hall
6b111d813f
Add new board: Librem L1UM v2
Add Linux 6.1.8 configuration, used by Librem L1UM v2

Add coreboot configuration for Librem L1UM v2

Add Librem L1UM v2 board configuration

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:50 -04:00
Jonathon Hall
be133892fd
modules/fbwhiptail: Update to 1.1
These changes primarily improve server boards using BMC video.  The
correct DRI card is selected even if it isn't the first one, and
performance is greatly improved on non-UMA cards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:49 -04:00
Jonathon Hall
12c7dfdadc
modules/linux: Support building with Linux 6.1.8.
This is particularly beneficial for servers with Aspeed BMC video,
because it introduces framebuffer console acceleration.  The
framebuffer console is much more responsive.

Patches were ported from 5.10.5:

0001-fake-acpi.patch: This may not be needed any more, but it applies
cleanly and I don't think it would harm anything.

0002-nmi-squelch.patch: The comment mentions qemu but I see this
message on physical machines occasionally, so I think this is needed.

0003-fake-trampoline.patch: This patch does not apply cleanly.  It
could be ported, but I don't think it's needed, I dropped it.  Dates
back to a very old commit where Linux was being embedded into a vendor
UEFI firmware: a4d7654b1e.

0010-winterfell-ahci.patch: Minor change of %x to %lx in context.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:49 -04:00
Jonathon Hall
e9a5b27e6c
librem_mini,librem_mini_v2: Don't use three values for auto poweron
PureBoot doesn't have any other three-valued settings and this doesn't
present very well in the config UI.

Instead make this a two-valued setting; drop the mode that forces the
EC setting to "stay off" at every boot because this is the default.

When disabling automatic power-on, disable the EC BRAM setting too.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:49 -04:00
Jonathon Hall
5e555359a4
config-gui.sh: Fix refactors, simplify implementation more
Stop manually loading config values, just update config in environment.

Never test values against "n", since many default to empty.  Always
test ="y" or !="y", any other value is off.

Add set_user_config() function to set a value in config.user,
combine configs, and update config in environment.  Use it in setting
implementations.

Remove toggle_config, it wasn't very useful because the settings still
test y/n in order to show specific confirmation and success messages.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:48 -04:00
Jonathon Hall
01594a823b
config-gui.sh: Update sizes of whiptail prompts
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:48 -04:00
Matt DeVillier
f6cc806738
blobs: Add WiFi, BT driver blobs
Add driver blobs needed for Intel AX200 WiFi/BT, as well as
Atheros ar3k BT.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2023-06-21 13:26:48 -04:00
Matt DeVillier
87eff7b775
gui-init: Implement blob jail feature
Blob jail provides device firmware blobs to the OS, so the OS does not
have to ship them.  The firmware is passed through the initrd to
/run/firmware, so it works with both installed and live OSes, and there
are no race conditions between firmware load and firmware availability.

The injection method in the initrd is specific to the style of init
script used by PureOS, since it must add a copy command to copy the
firmware from the initrd to /run.  If the init script is not of this
type, boot proceeds without device firmware.

This feature can be enabled or disabled from the config GUI.

Blob jail is enabled automatically if the Intel AX200 Wi-Fi module is
installed and the feature hasn't been explicitly configured.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2023-06-21 13:26:47 -04:00
Jonathon Hall
2d3ecfa41e
librem_mini/librem_mini_v2: Add automatic power-on setting
Mini v1/v2's EC can automatically power on the system when power is
applied, based on a value in EC BRAM.  Add a configuration setting to
optionally set this value.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:47 -04:00
Jonathon Hall
d148d3136a
init: Add optional board-specific init script
Boards can place a file in $(board)/initrd/bin/board-init.sh to perform
board-specific initialization.

If present, the board's $(board)/initrd directory is included in the
initrd via board.initrd.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:47 -04:00
Jonathon Hall
6e0d241913
ioport: Add ioport module (inb, outb)
Add ioport module, enable for librem_mini_v2.  Only inb and outb are
included, inw/outw/inl/outl aren't needed.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:46 -04:00
Jonathon Hall
206d59dc71
Add USB autoboot feature to PureBoot Basic
USB autoboot automatically boots to a USB flash drive if one is present
during boot.  This is intended for headless deployments as a method to
recover the installed operating system from USB without needing to
attach a display and keyboard.

USB autoboot can be controlled in config.user and the config GUI.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:46 -04:00
Jonathon Hall
b0e0a91c97
Add PureOS signing key
Add the PureOS archive signing key to the keys accepted for signed
ISOs.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:46 -04:00
Kyle Rankin
79da79a5e4
Implement Restricted Boot Mode
Restricted Boot mode only allows booting from signed files, whether that
is signed kernels in /boot or signed ISOs on mounted USB disks. This
disables booting from abitrary USB disks as well as the forced "unsafe"
boot mode. This also disables the recovery console so you can't bypass
this mode simply by running kexec manually.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:45 -04:00
Matt DeVillier
4bc6159ab6
Add PureBoot Basic Mode
PureBoot Basic mode provides the full Linux userspace in firmware from
Heads without requiring verified boot or a Librem Key.  Basic and
verified boot can be switched freely without changing firmware, such as
if a Librem Key is lost.

PureBoot Basic can apply firmware updates from a USB flash drive, and
having a complete Linux userspace enables more sophisticated recovery
options.

Basic mode boots to the first boot option by default, setting a default
is not required.  This can be configured in the config GUI.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:45 -04:00
Matt DeVillier
a5238b5823
config/coreboot.{librem_14,mini_v2}: enlarge CBFS for blob jail
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2023-06-21 13:26:45 -04:00
Jonathon Hall
468643ee82
functions: Add toggle_config function for use in config GUI
toggle_config() toggles the value of a config.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:44 -04:00
Jonathon Hall
39c655ae1d
Add load_config_value() and get_config_display_action()
Add these two functions for use in config-gui.sh for future toggles.

load_config_value() obtains the value of a config setting, defaulting
to 'n'.  get_config_display_action() displays 'Enable' or 'Disable'
depending on the current value.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:44 -04:00
Jonathon Hall
606c29f0ec
Extract enable_usb_storage() from mount-usb
enable_usb_storage() inserts usb-storage.ko if not already loaded, then
waits for USB storage devices to appear.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:44 -04:00
Jonathon Hall
b365f1324a
Extract pause_automatic_boot() from gui-init to gui_functions
pause_automatic_boot() prompts that an automatic boot is about to occur
and allows the user to interrupt it.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:43 -04:00
Jonathon Hall
5d7afa2e02
kexec-select-boot: Extract boot menu scanning logic
Move boot menu scanning logic to scan_boot_options() in /etc/functions

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:43 -04:00
Jonathon Hall
3a917bb90b
config-gui.sh: Extract utilities from config-gui.sh
Extract utilities from config-gui.sh for use in additional config
settings.  read_rom() reads the current ROM with a message for failure.
replace_rom_file() replaces a CBFS file in a ROM.  set_config() sets a
configuration variable in a file.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:43 -04:00
Matt DeVillier
14a5d19f1f
Move show_system_info() from gui-init to gui-functions
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2023-06-21 13:26:42 -04:00
Matt DeVillier
0967fe3201
configs/busybox: enable lzma (de)compression
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2023-06-21 13:26:42 -04:00