- Move/rename board config
- Rename coreboot config
- Applies changes to coreboot config from defconfig+dasharo coreboot fork config + fixes
- Rename CircleCI board for rom build
-----
Repro:
First: change some oldconfig defaults from dasharo coreboot fork
git checkout -b move_nitropad-nv41_to_novacustom-v41
mv boards/nitropad-nv41 boards/novacustom_nv4x_adl
mv boards/novacustom_nv4x_adl/nitropad-nv41.config boards/novacustom_nv4x_adl/novacustom_nv4x_adl.config
vim boards/novacustom_nv4x_adl/novacustom_nv4x_adl.config
vim config/coreboot-nitropad-nv41.config
mv config/coreboot-nitropad-nv41.config config/coreboot-novacustom_nv4x_adl.config
vim boards/novacustom_nv4x_adl/novacustom_nv4x_adl.config
docker run -e DISPLAY=$DISPLAY --network host --rm -ti -v $(pwd):$(pwd) -w $(pwd) tlaurion/heads-dev-env:latest -- make BOARD=novacustom_nv4x_adl coreboot.modify_and_save_oldconfig_in_place
cd /home/user/heads/build/x86/coreboot-dasharo
sudo make menuconfig
cd ~/heads
sudo meld /home/user/heads/build/x86/coreboot-dasharo/.config config/coreboot-novacustom_nv4x_adl.config
git status
git add boards/nitropad-nv41/nitropad-nv41.config config/coreboot-nitropad-nv41.config config/coreboot-novacustom_nv4x_adl.config config/coreboot-novacustom_nv4x_adl.config
git add boards/novacustom_nv4x_adl/novacustom_nv4x_adl.config
sed -i 's/nitropad-nv41/novacustom_nv4x_adl/g' .circleci/config.yml
git add .circleci/config.yml
git commit --sigoff -m
git push tlaurion-github --force
...
(and multiple 'git commit --signoff --amend' to add traces below)
----
Relevant changes from nitropad-nv41 coreboot configs:
diff --git a/config/coreboot-nitropad-nv41.config b/config/coreboot-novacustom_nv4x_adl.config
index 9484aaf512..235f255a31 100644
--- a/config/coreboot-nitropad-nv41.config
+++ b/config/coreboot-novacustom_nv4x_adl.config
@@ -111,7 +111,7 @@ CONFIG_VENDOR_NOVACUSTOM=y
# CONFIG_VENDOR_UP is not set
CONFIG_MAINBOARD_FAMILY="Not Applicable"
CONFIG_MAINBOARD_PART_NUMBER="nv40pz"
-CONFIG_MAINBOARD_VERSION="v2.1"
+CONFIG_MAINBOARD_VERSION="nv40pz"
CONFIG_MAINBOARD_DIR="clevo/adl-p"
CONFIG_DIMM_MAX=4
CONFIG_DIMM_SPD_SIZE=512
@@ -131,7 +131,7 @@ CONFIG_VBOOT_VBNV_OFFSET=0x28
CONFIG_VARIANT_DIR="nv40pz"
CONFIG_OVERRIDE_DEVICETREE="variants/$(CONFIG_VARIANT_DIR)/overridetree.cb"
# CONFIG_VGA_BIOS is not set
-CONFIG_MAINBOARD_SMBIOS_MANUFACTURER="Nitrokey"
+CONFIG_MAINBOARD_SMBIOS_MANUFACTURER="Notebook"
CONFIG_INTEL_GMA_VBT_FILE="src/mainboard/$(MAINBOARDDIR)/variants/$(VARIANT_DIR)/data.vbt"
# CONFIG_DISABLE_HECI1_AT_PRE_BOOT is not set
CONFIG_PRERAM_CBMEM_CONSOLE_SIZE=0x4000
@@ -140,7 +140,7 @@ CONFIG_CMOS_LAYOUT_FILE="src/mainboard/$(MAINBOARDDIR)/cmos.layout"
CONFIG_BOOT_DEVICE_SPI_FLASH_BUS=0
CONFIG_BOARD_CLEVO_ADLP_COMMON=y
CONFIG_BOARD_CLEVO_NV40PZ_BASE=y
-CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="Nitropad NV41"
+CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="NV4xPZ"
CONFIG_CONSOLE_POST=y
# CONFIG_USE_PM_ACPI_TIMER is not set
CONFIG_TPM_PIRQ=0x27
When comparing against dasharo/coreboot fork coreboot config saved in oldconfig format, diffs:
diff --git a/config/coreboot-novacustom_nv4x_adl.config b/config/coreboot-novacustom_nv4x_adl.config
index 235f255a31..41bdd7889c 100644
--- a/config/coreboot-novacustom_nv4x_adl.config
+++ b/config/coreboot-novacustom_nv4x_adl.config
@@ -7,19 +7,19 @@
# General setup
#
CONFIG_COREBOOT_BUILD=y
-CONFIG_LOCALVERSION=""
+CONFIG_LOCALVERSION="v1.7.2"
CONFIG_CBFS_PREFIX="fallback"
CONFIG_COMPILER_GCC=y
# CONFIG_COMPILER_LLVM_CLANG is not set
CONFIG_ARCH_SUPPORTS_CLANG=y
# CONFIG_ANY_TOOLCHAIN is not set
-# CONFIG_CCACHE is not set
+CONFIG_CCACHE=y
# CONFIG_IWYU is not set
# CONFIG_FMD_GENPARSER is not set
# CONFIG_UTIL_GENPARSER is not set
-# CONFIG_OPTION_BACKEND_NONE is not set
-CONFIG_USE_OPTION_TABLE=y
-# CONFIG_STATIC_OPTION_TABLE is not set
+CONFIG_OPTION_BACKEND_NONE=y
+# CONFIG_USE_OPTION_TABLE is not set
+# CONFIG_USE_UEFI_VARIABLE_STORE is not set
CONFIG_COMPRESS_RAMSTAGE_LZMA=y
# CONFIG_COMPRESS_RAMSTAGE_LZ4 is not set
CONFIG_INCLUDE_CONFIG_FILE=y
@@ -35,12 +35,7 @@ CONFIG_HAVE_ASAN_IN_RAMSTAGE=y
# CONFIG_NO_STAGE_CACHE is not set
CONFIG_TSEG_STAGE_CACHE=y
# CONFIG_UPDATE_IMAGE is not set
-CONFIG_BOOTSPLASH_IMAGE=y
-CONFIG_BOOTSPLASH_FILE="@BRAND_DIR@/bootsplash.jpg"
-CONFIG_BOOTSPLASH_CONVERT=y
-CONFIG_BOOTSPLASH_CONVERT_QUALITY=90
-# CONFIG_BOOTSPLASH_CONVERT_RESIZE is not set
-# CONFIG_BOOTSPLASH_CONVERT_COLORSWAP is not set
+# CONFIG_BOOTSPLASH_IMAGE is not set
# CONFIG_FW_CONFIG is not set
#
@@ -111,14 +106,14 @@ CONFIG_VENDOR_NOVACUSTOM=y
# CONFIG_VENDOR_UP is not set
CONFIG_MAINBOARD_FAMILY="Not Applicable"
CONFIG_MAINBOARD_PART_NUMBER="nv40pz"
-CONFIG_MAINBOARD_VERSION="nv40pz"
+CONFIG_MAINBOARD_VERSION="v2.1"
CONFIG_MAINBOARD_DIR="clevo/adl-p"
CONFIG_DIMM_MAX=4
CONFIG_DIMM_SPD_SIZE=512
-CONFIG_FMDFILE=""
+CONFIG_FMDFILE="src/mainboard/$(CONFIG_MAINBOARD_DIR)/vboot-rwa.fmd"
# CONFIG_NO_POST is not set
CONFIG_MAINBOARD_VENDOR="Notebook"
-CONFIG_CBFS_SIZE=0x1000000
+CONFIG_CBFS_SIZE=0xA00000
# CONFIG_CONSOLE_SERIAL is not set
CONFIG_MAX_CPUS=24
CONFIG_ONBOARD_VGA_IS_PRIMARY=y
@@ -126,8 +121,9 @@ CONFIG_ONBOARD_VGA_IS_PRIMARY=y
# CONFIG_POST_IO is not set
CONFIG_UART_FOR_CONSOLE=0
CONFIG_DEVICETREE="devicetree.cb"
-# CONFIG_VBOOT is not set
+CONFIG_VBOOT=y
CONFIG_VBOOT_VBNV_OFFSET=0x28
+CONFIG_RO_REGION_ONLY=""
CONFIG_VARIANT_DIR="nv40pz"
CONFIG_OVERRIDE_DEVICETREE="variants/$(CONFIG_VARIANT_DIR)/overridetree.cb"
# CONFIG_VGA_BIOS is not set
@@ -143,10 +139,12 @@ CONFIG_BOARD_CLEVO_NV40PZ_BASE=y
CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="NV4xPZ"
CONFIG_CONSOLE_POST=y
# CONFIG_USE_PM_ACPI_TIMER is not set
-CONFIG_TPM_PIRQ=0x27
+CONFIG_VBOOT_SLOTS_RW_A=y
+CONFIG_TPM_PIRQ=0x0
# CONFIG_SOC_INTEL_CSE_SEND_EOP_EARLY is not set
CONFIG_VBOOT_FWID_VERSION="$(CONFIG_LOCALVERSION)"
CONFIG_EC_SYSTEM76_EC_BAT_THRESHOLDS=y
+CONFIG_PXE_ROM_ID="10ec,8168"
CONFIG_ECAM_MMCONF_BASE_ADDRESS=0xc0000000
CONFIG_ECAM_MMCONF_BUS_NUMBER=256
CONFIG_MEMLAYOUT_LD_FILE="src/arch/x86/memlayout.ld"
@@ -156,20 +154,28 @@ CONFIG_C_ENV_BOOTBLOCK_SIZE=0x40000
CONFIG_DCACHE_BSP_STACK_SIZE=0x80400
CONFIG_MAX_ACPI_TABLE_SIZE_KB=144
CONFIG_HAVE_INTEL_FIRMWARE=y
+CONFIG_VBOOT_NO_BOARD_SUPPORT=y
+CONFIG_RW_REGION_ONLY=""
CONFIG_MRC_SETTINGS_CACHE_SIZE=0x10000
CONFIG_DRIVERS_INTEL_WIFI=y
CONFIG_IFD_BIN_PATH="3rdparty/dasharo-blobs/novacustom/nv4x_adl/descriptor.bin"
CONFIG_ME_BIN_PATH="3rdparty/dasharo-blobs/novacustom/nv4x_adl/me.bin"
-CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x20000
+# CONFIG_VBOOT_ALWAYS_ALLOW_UDC is not set
+CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x100000
+CONFIG_EDK2_BOOT_TIMEOUT=2
CONFIG_VBT_DATA_SIZE_KB=9
+CONFIG_VBOOT_FWID_MODEL="$(CONFIG_MAINBOARD_VENDOR)_$(CONFIG_MAINBOARD_PART_NUMBER)"
+CONFIG_VBOOT_STARTS_IN_BOOTBLOCK=y
CONFIG_CARDBUS_PLUGIN_SUPPORT=y
CONFIG_SPI_FLASH_DONT_INCLUDE_ALL_DRIVERS=y
# CONFIG_USE_LEGACY_8254_TIMER is not set
+CONFIG_GBB_HWID=""
# CONFIG_DEBUG_SMI is not set
CONFIG_HAVE_IFD_BIN=y
CONFIG_PCIEXP_HOTPLUG_BUSES=42
CONFIG_PCIEXP_HOTPLUG_MEM=0xc200000
CONFIG_PCIEXP_HOTPLUG_PREFETCH_MEM=0x1c000000
+# CONFIG_VBOOT_SLOTS_RW_AB is not set
CONFIG_PS2K_EISAID="PNP0303"
CONFIG_PS2M_EISAID="PNP0F13"
@@ -193,8 +199,8 @@ CONFIG_PCIEXP_CLK_PM=y
CONFIG_PC_CMOS_BASE_PORT_BANK1=0x72
CONFIG_HEAP_SIZE=0x10000
CONFIG_EC_GPE_SCI=0x50
+CONFIG_EDK2_BOOTSPLASH_FILE="3rdparty/dasharo-blobs/novacustom/bootsplash.bmp"
CONFIG_TPM_MEASURED_BOOT=y
-CONFIG_LINUX_COMMAND_LINE="quiet loglevel=2"
CONFIG_BOARD_ROMSIZE_KB_32768=y
# CONFIG_COREBOOT_ROMSIZE_KB_256 is not set
# CONFIG_COREBOOT_ROMSIZE_KB_512 is not set
@@ -399,7 +405,7 @@ CONFIG_SOC_INTEL_COMMON_BLOCK_TCO=y
CONFIG_SOC_INTEL_COMMON_BLOCK_TCO_ENABLE_THROUGH_SMBUS=y
CONFIG_SOC_INTEL_COMMON_BLOCK_SMM=y
CONFIG_SOC_INTEL_COMMON_BLOCK_SMM_IO_TRAP=y
-# CONFIG_SOC_INTEL_COMMON_BLOCK_SMM_TCO_ENABLE is not set
+CONFIG_SOC_INTEL_COMMON_BLOCK_SMM_TCO_ENABLE=y
CONFIG_SOC_INTEL_COMMON_BLOCK_SMM_S5_DELAY_MS=0
CONFIG_SOC_INTEL_COMMON_BLOCK_SPI=y
CONFIG_SOC_INTEL_COMMON_BLOCK_SA=y
@@ -417,7 +423,7 @@ CONFIG_SOC_INTEL_COMMON_BLOCK_USB4_PCIE=y
CONFIG_SOC_INTEL_COMMON_BLOCK_USB4_XHCI=y
CONFIG_SOC_INTEL_ENABLE_USB4_PCIE_RESOURCES=y
CONFIG_SOC_INTEL_COMMON_BLOCK_VTD=y
-# CONFIG_ENABLE_EARLY_DMA_PROTECTION is not set
+CONFIG_ENABLE_EARLY_DMA_PROTECTION=y
CONFIG_SOC_INTEL_COMMON_BLOCK_XDCI=y
CONFIG_SOC_INTEL_COMMON_BLOCK_XHCI=y
CONFIG_SOC_INTEL_COMMON_BLOCK_XHCI_ELOG=y
@@ -508,15 +514,15 @@ CONFIG_EC_SYSTEM76_EC_DGPU=y
#
# Intel Firmware
#
-CONFIG_IFDTOOL_DISABLE_ME=y
+# CONFIG_IFDTOOL_DISABLE_ME is not set
CONFIG_HAVE_ME_BIN=y
# CONFIG_STITCH_ME_BIN is not set
# CONFIG_ME_REGION_ALLOW_CPU_READ_ACCESS is not set
CONFIG_HAVE_INTEL_ME_HAP=y
# CONFIG_INTEL_ME_DISABLED_HECI is not set
-CONFIG_INTEL_ME_DISABLED_HAP=y
-# CONFIG_INTEL_ME_ENABLED is not set
-CONFIG_INTEL_ME_DEFAULT_STATE=2
+# CONFIG_INTEL_ME_DISABLED_HAP is not set
+CONFIG_INTEL_ME_ENABLED=y
+CONFIG_INTEL_ME_DEFAULT_STATE=0
# CONFIG_DO_NOT_TOUCH_DESCRIPTOR_REGION is not set
# CONFIG_LOCK_MANAGEMENT_ENGINE is not set
CONFIG_UNLOCK_FLASH_REGIONS=y
@@ -529,7 +535,7 @@ CONFIG_BIOS_VENDOR="3mdeb"
#
# Dasharo Configuration
#
-CONFIG_DASHARO_PREFER_S3_SLEEP=y
+# CONFIG_DASHARO_PREFER_S3_SLEEP is not set
# end of Dasharo Configuration
CONFIG_UDK_BASE=y
@@ -550,8 +556,6 @@ CONFIG_X86_CUSTOM_BOOTMEDIA=y
CONFIG_PC80_SYSTEM=y
CONFIG_HAVE_CMOS_DEFAULT=y
CONFIG_POSTCAR_STAGE=y
-CONFIG_BOOTBLOCK_SIMPLE=y
-# CONFIG_BOOTBLOCK_NORMAL is not set
CONFIG_COLLECT_TIMESTAMPS_TSC=y
CONFIG_IDT_IN_EVERY_STAGE=y
CONFIG_HAVE_CF9_RESET=y
@@ -575,9 +579,10 @@ CONFIG_NO_EARLY_GFX_INIT=y
#
# Display
#
+CONFIG_WANT_LINEAR_FRAMEBUFFER=y
CONFIG_GENERIC_LINEAR_FRAMEBUFFER=y
CONFIG_LINEAR_FRAMEBUFFER=y
-CONFIG_BOOTSPLASH=y
+# CONFIG_BOOTSPLASH is not set
# end of Display
CONFIG_PCI=y
@@ -610,17 +615,21 @@ CONFIG_I2C_TRANSFER_TIMEOUT_US=500000
# Generic Drivers
#
CONFIG_CRB_TPM_BASE_ADDRESS=0xfed40000
-# CONFIG_DRIVERS_EFI_VARIABLE_STORE is not set
+CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
# CONFIG_ELOG is not set
CONFIG_CACHE_MRC_SETTINGS=y
CONFIG_MRC_SETTINGS_PROTECT=y
-# CONFIG_SMMSTORE is not set
+CONFIG_HAS_RECOVERY_MRC_CACHE=y
+CONFIG_MRC_SAVE_HASH_IN_TPM=y
+CONFIG_SMMSTORE=y
+CONFIG_SMMSTORE_V2=y
+CONFIG_SMMSTORE_SIZE=0x40000
CONFIG_SPI_FLASH=y
CONFIG_BOOT_DEVICE_SPI_FLASH_RW_NOMMAP=y
CONFIG_BOOT_DEVICE_SPI_FLASH_RW_NOMMAP_EARLY=y
+CONFIG_SPI_FLASH_SMM=y
# CONFIG_SPI_FLASH_NO_FAST_READ is not set
-CONFIG_TPM_INIT_RAMSTAGE=y
-# CONFIG_TPM_PPI is not set
+CONFIG_TPM_PPI=y
CONFIG_DRIVERS_UART=y
CONFIG_NO_UART_ON_SUPERIO=y
CONFIG_DRIVERS_UART_8250MEM=y
@@ -669,7 +678,7 @@ CONFIG_DRIVERS_INTEL_PMC=y
# CONFIG_DRIVERS_NXP_UWB_SR1XX is not set
# CONFIG_DRIVERS_PS2_KEYBOARD is not set
CONFIG_DRIVERS_MC146818=y
-# CONFIG_USE_PC_CMOS_ALTCENTURY is not set
+CONFIG_USE_PC_CMOS_ALTCENTURY=y
CONFIG_PC_CMOS_BASE_PORT_BANK0=0x70
CONFIG_MEMORY_MAPPED_TPM=y
CONFIG_TPM_TIS_BASE_ADDRESS=0xfed40000
@@ -695,6 +704,50 @@ CONFIG_DRIVERS_INTEL_USB4_RETIMER=y
# Verified Boot (vboot)
#
CONFIG_VBOOT_LIB=y
+CONFIG_VBOOT_VBNV_CMOS=y
+CONFIG_VBOOT_VBNV_CMOS_BACKUP_TO_FLASH=y
+# CONFIG_VBOOT_MOCK_SECDATA is not set
+CONFIG_VBOOT_MUST_REQUEST_DISPLAY=y
+CONFIG_VBOOT_ALWAYS_ENABLE_DISPLAY=y
+CONFIG_VBOOT_HAS_REC_HASH_SPACE=y
+CONFIG_CBFS_MCACHE_RW_PERCENTAGE=50
+CONFIG_VBOOT_CLEAR_RECOVERY_EACH_BOOT=y
+# CONFIG_VBOOT_EC_EFS is not set
+CONFIG_VBOOT_X86_SHA256_ACCELERATION=y
+
+#
+# GBB configuration
+#
+CONFIG_GBB_BMPFV_FILE=""
+# CONFIG_GBB_FLAG_DEV_SCREEN_SHORT_DELAY is not set
+# CONFIG_GBB_FLAG_LOAD_OPTION_ROMS is not set
+# CONFIG_GBB_FLAG_ENABLE_ALTERNATE_OS is not set
+# CONFIG_GBB_FLAG_FORCE_DEV_SWITCH_ON is not set
+CONFIG_GBB_FLAG_FORCE_DEV_BOOT_USB=y
+CONFIG_GBB_FLAG_DISABLE_FW_ROLLBACK_CHECK=y
+# CONFIG_GBB_FLAG_ENTER_TRIGGERS_TONORM is not set
+# CONFIG_GBB_FLAG_FORCE_DEV_BOOT_ALTFW is not set
+# CONFIG_GBB_FLAG_RUNNING_FAFT is not set
+CONFIG_GBB_FLAG_DISABLE_EC_SOFTWARE_SYNC=y
+# CONFIG_GBB_FLAG_DEFAULT_DEV_BOOT_ALTFW is not set
+CONFIG_GBB_FLAG_DISABLE_PD_SOFTWARE_SYNC=y
+CONFIG_GBB_FLAG_DISABLE_LID_SHUTDOWN=y
+# CONFIG_GBB_FLAG_FORCE_MANUAL_RECOVERY is not set
+CONFIG_GBB_FLAG_DISABLE_FWMP=y
+# CONFIG_GBB_FLAG_ENABLE_UDC is not set
+# end of GBB configuration
+
+#
+# Vboot Keys
+#
+CONFIG_VBOOT_ROOT_KEY="$(VBOOT_SOURCE)/tests/devkeys/root_key.vbpubk"
+CONFIG_VBOOT_RECOVERY_KEY="$(VBOOT_SOURCE)/tests/devkeys/recovery_key.vbpubk"
+CONFIG_VBOOT_FIRMWARE_PRIVKEY="$(VBOOT_SOURCE)/tests/devkeys/firmware_data_key.vbprivk"
+CONFIG_VBOOT_KERNEL_KEY="$(VBOOT_SOURCE)/tests/devkeys/kernel_subkey.vbpubk"
+CONFIG_VBOOT_KEYBLOCK="$(VBOOT_SOURCE)/tests/devkeys/firmware.keyblock"
+CONFIG_VBOOT_KEYBLOCK_VERSION=1
+CONFIG_VBOOT_KEYBLOCK_PREAMBLE_FLAGS=0x0
+# end of Vboot Keys
# end of Verified Boot (vboot)
#
@@ -730,10 +783,14 @@ CONFIG_INTEL_TXT_LIB=y
# CONFIG_INTEL_TXT is not set
# CONFIG_STM is not set
# CONFIG_INTEL_CBNT_SUPPORT is not set
-CONFIG_BOOTMEDIA_LOCK_NONE=y
-# CONFIG_BOOTMEDIA_LOCK_CONTROLLER is not set
+# CONFIG_BOOTMEDIA_LOCK_NONE is not set
+CONFIG_BOOTMEDIA_LOCK_CONTROLLER=y
# CONFIG_BOOTMEDIA_LOCK_CHIP is not set
-# CONFIG_BOOTMEDIA_SMM_BWP is not set
+# CONFIG_BOOTMEDIA_LOCK_WHOLE_RO is not set
+# CONFIG_BOOTMEDIA_LOCK_WHOLE_NO_ACCESS is not set
+CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
+CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y
+CONFIG_BOOTMEDIA_SMM_BWP=y
# end of Security
CONFIG_ACPI_HAVE_PCAT_8259=y
@@ -772,8 +829,8 @@ CONFIG_DEFAULT_CONSOLE_LOGLEVEL_7=y
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_1 is not set
# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_0 is not set
CONFIG_DEFAULT_CONSOLE_LOGLEVEL=7
-CONFIG_CONSOLE_USE_LOGLEVEL_PREFIX=y
-CONFIG_CONSOLE_USE_ANSI_ESCAPES=y
+# CONFIG_CONSOLE_USE_LOGLEVEL_PREFIX is not set
+# CONFIG_CONSOLE_USE_ANSI_ESCAPES is not set
# CONFIG_CMOS_POST is not set
CONFIG_HWBASE_DEBUG_CB=y
# end of Console
@@ -804,12 +861,89 @@ CONFIG_MAINBOARD_SERIAL_NUMBER="123456789"
# CONFIG_PAYLOAD_LINUXBOOT is not set
# CONFIG_PAYLOAD_SEABIOS is not set
# CONFIG_PAYLOAD_UBOOT is not set
-# CONFIG_PAYLOAD_EDK2 is not set
-CONFIG_PAYLOAD_LINUX=y
-CONFIG_PAYLOAD_FILE="@BOARD_BUILD_DIR@/bzImage"
+CONFIG_PAYLOAD_EDK2=y
+# CONFIG_PAYLOAD_LINUX is not set
+CONFIG_PAYLOAD_FILE="novacustom_nv4x_adl/UEFIPAYLOAD.fd"
CONFIG_PAYLOAD_OPTIONS=""
-# CONFIG_PXE is not set
-CONFIG_LINUX_INITRD="@BOARD_BUILD_DIR@/initrd.cpio.xz"
+CONFIG_EDK2_UEFIPAYLOAD=y
+# CONFIG_EDK2_UNIVERSAL_PAYLOAD is not set
+CONFIG_EDK2_REPO_MRCHROMEBOX=y
+# CONFIG_EDK2_REPO_OFFICIAL is not set
+# CONFIG_EDK2_REPO_CUSTOM is not set
+CONFIG_EDK2_REPOSITORY="https://github.com/Dasharo/edk2"
+CONFIG_EDK2_TAG_OR_REV="b7274c98697e972e772236caf830c0780ec498bd"
+CONFIG_EDK2_USE_EDK2_PLATFORMS=y
+CONFIG_EDK2_PLATFORMS_REPOSITORY="https://github.com/Dasharo/edk2-platforms"
+CONFIG_EDK2_PLATFORMS_TAG_OR_REV="3323ed481d35096fb6a7eae7b49f35eff00f86cf"
+# CONFIG_EDK2_DEBUG is not set
+CONFIG_EDK2_RELEASE=y
+# CONFIG_EDK2_BOOT_MANAGER_ESCAPE is not set
+CONFIG_EDK2_CBMEM_LOGGING=y
+CONFIG_EDK2_SYSTEM76_EC_LOGGING=y
+CONFIG_EDK2_CPU_TIMER_LIB=y
+CONFIG_EDK2_FOLLOW_BGRT_SPEC=y
+CONFIG_EDK2_FULL_SCREEN_SETUP=y
+CONFIG_EDK2_HAVE_EFI_SHELL=y
+CONFIG_EDK2_PRIORITIZE_INTERNAL=y
+CONFIG_EDK2_PS2_SUPPORT=y
+CONFIG_EDK2_SKIP_PS2_DETECT=y
+CONFIG_EDK2_SD_MMC_TIMEOUT=10
+CONFIG_EDK2_SERIAL_SUPPORT=y
+CONFIG_EDK2_ENABLE_IPXE=y
+CONFIG_EDK2_IPXE_OPTION_NAME="iPXE Network Boot"
+CONFIG_EDK2_SECURE_BOOT=y
+# CONFIG_EDK2_SECURE_BOOT_DEFAULT_ENABLE is not set
+# CONFIG_EDK2_SATA_PASSWORD is not set
+# CONFIG_EDK2_OPAL_PASSWORD is not set
+CONFIG_EDK2_SETUP_PASSWORD=y
+CONFIG_EDK2_PERFORMANCE_MEASUREMENT_ENABLE=y
+CONFIG_EDK2_DASHARO_SYSTEM_FEATURES=y
+CONFIG_EDK2_DASHARO_SECURITY_OPTIONS=y
+CONFIG_EDK2_SHOW_CAMERA_OPTION=y
+CONFIG_EDK2_SHOW_WIFI_BT_OPTION=y
+CONFIG_EDK2_DASHARO_INTEL_ME_OPTIONS=y
+CONFIG_EDK2_DASHARO_USB_CONFIG=y
+CONFIG_EDK2_DASHARO_NETWORK_CONFIG=y
+# CONFIG_EDK2_DASHARO_CHIPSET_CONFIG is not set
+CONFIG_EDK2_DASHARO_POWER_CONFIG=y
+CONFIG_EDK2_SLEEP_TYPE_OPTION=y
+CONFIG_EDK2_FAN_CURVE_OPTION=y
+CONFIG_EDK2_BATTERY_CONFIG_OPTION=y
+# CONFIG_EDK2_DASHARO_PCI_CONFIG is not set
+# CONFIG_EDK2_DASHARO_MEMORY_CONFIG is not set
+# CONFIG_EDK2_DASHARO_NETWORK_BOOT_DEFAULT_ENABLE is not set
+# CONFIG_EDK2_DASHARO_SERIAL_REDIRECTION_DEFAULT_ENABLE is not set
+CONFIG_EDK2_BOOT_MENU_KEY=0x0011
+CONFIG_EDK2_SETUP_MENU_KEY=0x000C
+CONFIG_EDK2_DISABLE_MTRR_PROGRAMMING=y
+CONFIG_EDK2_ENABLE_BATTERY_CHECK=y
+# CONFIG_EDK2_DISABLE_OPTION_ROMS is not set
+CONFIG_EDK2_PRINT_SOL_STRINGS=y
+# CONFIG_EDK2_RAM_DISK_ENABLE is not set
+CONFIG_EDK2_CUSTOM_BUILD_PARAMS="-D VARIABLE_SUPPORT=SMMSTORE"
+CONFIG_EDK2_LAN_ROM_DRIVER=""
+# CONFIG_EDK2_CREATE_PREINSTALLED_BOOT_OPTIONS is not set
+CONFIG_PXE=y
+
+#
+# PXE Options
+#
+# CONFIG_PXE_ROM is not set
+CONFIG_BUILD_IPXE=y
+CONFIG_IPXE_STABLE=y
+# CONFIG_IPXE_MASTER is not set
+# CONFIG_PXE_SERIAL_CONSOLE is not set
+# CONFIG_PXE_NO_PROMPT is not set
+CONFIG_PXE_ADD_SCRIPT=y
+CONFIG_PXE_SCRIPT="3rdparty/dasharo-blobs/dasharo/dasharo.ipxe"
+CONFIG_PXE_HAS_HTTPS=y
+CONFIG_PXE_CUSTOM_BUILD_ID="0123456789"
+CONFIG_PXE_TRUST_CMD=y
+# end of PXE Options
+
+# CONFIG_COMPRESSED_PAYLOAD_NONE is not set
+CONFIG_COMPRESSED_PAYLOAD_LZMA=y
+# CONFIG_COMPRESSED_PAYLOAD_LZ4 is not set
CONFIG_COMPRESS_SECONDARY_PAYLOAD=y
#
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Made sure all linux configs are in good oldconfig state by:
docker run -e DISPLAY=$DISPLAY --network host --rm -ti -v $(pwd):$(pwd) -w $(pwd) tlaurion/heads-dev-env:v0.2.3
find ./boards/ -type f | awk -F "/" {'print $3'} | sort | uniq | while read board; do make BOARD=$board linux.modify_and_save_oldconfig_in_place; done
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
- fi misplaced
- rework reencryption loop
- added verbose output on TPM DUK key addition when LUKS container can be unlocked with DRK
Current state, left todo for future work:
TPM DUK:
- TPM DUK setup on defautl boot reuses /boot/kexec_key_devices.txt if present
- If not, list all LUKS partitions, asks user for selection and makes sure LUKS passphrase can unlock all
- Works on both LUKSv1 and LUKSv2 containers, reusing OS installer settings (Heads doesn't enforce better then OS installer LUKS parameters)
LUKS passphrase change/LUKS reencryption:
- Reuses /boot/kexec_key_devices.txt if existing
- If not, prompts for LUKS passphase, list all LUKS containers not being USB based and attempt to unlock all those, listing only the ones successfully unlocked
- Prompts user to reuse found unlockable LUKS partitions with LUKS passphrase, caches and reuse in other LUKS operations (passphrase change as well from oem factory reset/re-ownership)
- Deals properly with LUKSv1/LUKSv2/multiple LUKS containers and reencrypt/passphrase changes them all if accepted, otherwise asks user to select individual LUKS container
Tested on luksv1,luksv2, btrfs under luks (2x containers) and TPM DUK setup up to booting OS. All good
TODO:
- LUKS passphrase check is done multiple times across TPM DUK, reencryption and luks passphrase. Could refactor to change this, but since this op is done only one reencrypt+passphrase change) upon hardare reception from OEM, I stopped caring here.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
- cache/reuse that passphrase, used afterward to find which LUKS keyslot contains the DRK, which is used to direct reencryption, also reused for passphrase change.
- refactoring detection + testing of prompted LUKS passphrase for discovered LUKS containers that can be unlocked with same passphrase to prompt user for selection
TODO: remove duplicate luks passphrase unlocking volumes functions for the moment
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
This reverts commit 20e9392b97c9ed42b85ae930a163131997640a44.
To test this PR without reencryption, just 'git revert' this commit
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
cryptsetup2 2.6.1 is a new release that supports reencryption of Q4.2 release LUKS2 volumes created at installation.
This is a critical feature for the Qubes OS 4.2 release for added data at rest protection
Cryptsetup 2.6.x internal changes:
- Argon2 used externally and internally: requires a lot of RAM and CPU to derivate passphrase to key validated in key slots.
- This is used to rate limit efficiently bruteforcing of LUKS key slots, requiring each offline brute force attempt to consume ~15-30 seconds per attempt
- OF course, strong passphrases are still recommended, but bruteforcing LUKSv2 containers with Argon2 would require immense time, ram and CPU even to bruteforce low entropy passphrase/PINs.
- passphrase change doesn't permit LUKS key slot specification anymore: key slot rotates (new one consusumed per op: then old one wiped internally. EG: LUKS key slot 1 created, then 0 deleted)
- reencryption doesn't permit old call arguments. No more direct-io; inadmissively slow through AIO (async) calls, need workarounds for good enough perfs (arguments + newer kernel with cloudfare fixes in tree)
cryptsetup 2.6.1 requires:
- lvm2 2.03.23, which is also included in this PR.
- requires libaio, which is also included in this PR (could be hacked out but deep dependency at first sight: left in)
- requires util-linux 2.39
- patches for reproducible builds are included for above 3 packages.
luks-functions was updated to support the new cryptsetup2 version calls/changes
- reencryption happen in direct-io, offline mode and without locking, requiring linux 5.10.9+ to bypass linux queues
- from tests, this is best for performance and reliability in single-user mode
- LUKS container ops now validate Disk Recovery Key (DRK) passphrase prior and DRK key slot prior of going forward if needed, failing early.
- Heads don't expect DRK to be in static key slot anymore, and finds the DRK key slot dynamically.
- If reencrytipn/passphrase change: make sure all LUKS containers on same block device can be unlocked with same DRK
- Reencryption: requires to know which key slot to reencrypt.
- Find LUKS key slot that unlocks with DRK passphrase unlock prior of reencrypt call
- Passphrase change: no slot can be passed, but key slot of DRK rotates.
kexec-seal-key
- TPM LUKS Disk Unlock Key key slots have changed to be set in max slots per LUKS version (LUKSv1:7 /LUKSv2: 31)
- If key slot != default LUKS version's keyslot outside of DRK key slot: prompt the user before wiping that key slot, otherwise wipe automatically
- This takes for granted that the DRK key slot alone is needed on the system and Heads controls the LUKS key slots.
- If user has something else going on, ie: Using USB Security dongle + TPM DUK, then the user will need to say no when wiping keys.
- It was suggested to leave LUKS key slots outside of DRK alone, but then: what to do when all key slots would be used?
- Alternative implementation could be to only prompt users to wipe keyslots other then DRK when key slots are all used (LUKSv1: 0-7, LUKSv2: 0-31)
- But then cleanup would need to happen prior of operations (LUKS passphrase change, TPM DUK setup) and could be problematic.
- LUKS containers now checked to be same LUKS version prior of permitting to set TPM DUK and will refuse to go forward of different versions.
TODO:
- async (AIO) calls are not used. direct-io is used instead. libaio could be hacked out
- this could be subject to future work
Notes:
- time to deprecated legacy boards the do not enough space for the new space requirements
- x230-legacy, x230-legacy-flash, x230-hotp-legacy
- t430-legacy, t430-legacy-flash, t430-hotp-legacy already deprecated
Unrelated:
- typos fixes found along the way
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Cloudfare patches to speed up LUKS encryption were upstreamed into linux kernel and backported to 5.10.9: https://github.com/cloudflare/linux/issues/1#issuecomment-763085915
Therefore, we bump to latest of 5.10.x (bump from 5.10.5 which doesn't contain the fixes)
Trace:
sed -i 's/5.10.5/5.10.214/g' boards/*/*.config
find ./boards/*/*.config | awk -F "/" {'print $3'}| while read board; do echo "make BOARD=$board linux"; make BOARD=$board linux; echo make BOARD=$board linux.save_in_oldconfig_format_in_place || make BOARD=$board linux.modify_and_save_oldconfig_in_place; done
git status | grep modified | awk -F ":" {'print $2'}| xargs git add
git commit --signoff
- Move patches from 5.10.5 -> 5.10.214
- Add linux kernel hash and version under modules/linux
- Change board configs accordingly
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
