fbwhiptail scales its UI based on the display size. FBWHIPTAIL_SCALE
can set a specific scale factor for testing.
fbwhiptail no longer looks for a 1080p mode when the default mode is
2160p.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Build kbd and ship setfont if enabled with CONFIG_KBD.
When CONFIG_KBD is enabled, setconsolefont.sh will double the console
font size on large displays (>1600 lines tall as a heuristic).
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
CROSS= is needed for skiboot on PPC64 due to different endianness
relative to coreboot.
The talos_2 fork doesn't share the toolchain because it is the only
_fork_, not board, to be precise. We could add more boards using that
fork without having to create a shared toolchain, it only matters if we
add another fork or start building boards from the upstream release
too.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Two := assignments were factored out together, the second overwrote the
first. Fix to +=, and remove the nitrokey assignment since it came
from a branch.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
This was spelled wrong - it's actually '_depends'. 'initrd' isn't a
module any more so the value doesn't make sense, remove it.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
The skiboot build fails to find the toolchain when it's not in the
default location. There is only one ppc64 board anyway, so there's no
point trying to share a toolchain for now.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Use .heads-toolchain to mark that the toolchain was built rather than
.xcompile. coreboot doesn't generate .xcompile until the build step,
so all modules had to build successfully before we would stop trying to
to rebuild the toolchain. Build steps should generally produce the
indicated outputs too, which was not occurring here.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Reuse the toolchain from a coreboot release for fork builds. Either
the fork or the release can be built first, in either case the
release's toolchain is built at the default location and reused for
later builds.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Define a separate module for each coreboot version, so the module used
to build the ROM will optionally be able to reference the toolchain
from a different module.
This will allow coreboot fork builds to use the toolchain from the
corresponding release.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
At one time coreboot was built using Heads' musl toolchain, but this
was later reverted. coreboot builds with its own toolchain again.
CROSS= has no effect on coreboot proper (only exception is PPC64
skiboot payload). It was added to coreboot by a patch that was deleted
in 8e44853. COREBOOT_IASL was set to the default, that was only needed
when the toolchain was being overridden to override iasl back to the
coreboot one.
ppc64 still specifies CROSS= since skiboot is unable to find coreboot's
toolchain from XGCCPATH but checks CROSS. This builds skiboot with the
Heads toolchain as before.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Remove coreboot 4.8.1, 4.13, and 4.17, which were all unused.
Remove extra copies of EXTRA_FLAGS which duplicated the common
definition. The only difference was
-Wno-error=address-of-packed-member, the warning is now disabled
entirely everywhere with -Wno-address-of-packed-member.
Use separate coreboot_version values for talos_2, nitrokey, and purism,
which gives each a separate build directory.
Move conditional blob definitions out of each coreboot version.
Fix condition for coreboot-blobs - whether a module is a git clone
actually depends on non-empty <module>_repo, not <module>_version==git.
Fix the test so git versions of coreboot can have arbitrary names.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Updated cbmem searches for CBMEM exposed by kernel in sysfs before
trying to read it from memory directly. As such, there is no need for
pointing to that file explicitly.
New coreboot revision also fixes output of 'cbmem -t' caused by wrong
endianness.
Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
Update flashrom - in particular, this includes support for new chipsets
like Jasper Lake.
CONFIG_INTERAL_X86 was created so CONFIG_INTERNAL could apply to other
platforms, enable it for x86.
The default build target now requires sphinx, just build flashrom
itself.
Update flashrom_progress - filter out noise in newer flashrom that
chokes the progress bar implementation, make size detection more
robust, improve progress bar implementation slightly.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Co-signed by: Thierry Laurion <insurgo@riseup.net.
both linux/coreboot:
- save_in_defconfig_format_in_place : takes whatever coreboot config file for a make BOARD=xyz statement and saves it in defconfig
- save_in_oldefconfig_format_in_place : takes whatever coreboot config file for a make BOARD=xyz statement and saves it in oldefconfig
linux:
- linux.prompt_for_new_config_options_for_kernel_version_bump:
- The most useful helper as of now when doing kernel version bump.
- Requires to save current kernel config in oldconfig (make BOARD=xyz linux.save_in_oldefconfig_format_in_place) first, then bump kernel version in board config and then use that helper to review new options and save in tree.
Use CONFIG_BRAND_NAME to control the brand name displayed in the UI.
Override by setting BRAND_NAME when building, either in the Makefile or
on the command line.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Debian 12's initrd by default now consists of an uncompressed cpio
archive containing microcode, followed by a zstd-compressed cpio
archive. inject_firmware.sh only supported gzip-compressed cpio, so it
could not extract /init from this archive.
Add zstd-decompress to decompress zstd streams (uncompressed size is
about 180 KB).
Add unpack_initramfs.sh which is able to decompress uncompressed, gzip,
or zstd archives, with multiple segments, much like the Linux kernel
itself does.
Use unpack_initramfs.sh to extract /init for blob jail.
Don't compress the new archive segment containing firmware and the
updated /init.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
These changes primarily improve server boards using BMC video. The
correct DRI card is selected even if it isn't the first one, and
performance is greatly improved on non-UMA cards.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
This is particularly beneficial for servers with Aspeed BMC video,
because it introduces framebuffer console acceleration. The
framebuffer console is much more responsive.
Patches were ported from 5.10.5:
0001-fake-acpi.patch: This may not be needed any more, but it applies
cleanly and I don't think it would harm anything.
0002-nmi-squelch.patch: The comment mentions qemu but I see this
message on physical machines occasionally, so I think this is needed.
0003-fake-trampoline.patch: This patch does not apply cleanly. It
could be ported, but I don't think it's needed, I dropped it. Dates
back to a very old commit where Linux was being embedded into a vendor
UEFI firmware: a4d7654b1e.
0010-winterfell-ahci.patch: Minor change of %x to %lx in context.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Add ioport module, enable for librem_mini_v2. Only inb and outb are
included, inw/outw/inl/outl aren't needed.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
On some newer platforms of intel (confirmed on nehalem, sandy/ivy
bridge), coreboot after commit [2ac149d294af795710eb4bb20f093e9920604abd](https://review.coreboot.org/cgit/coreboot.git/commit/?id=2ac149d294af795710eb4bb20f093e9920604abd)
registers an SMI to lockdown some registers on the chipset, as well
as access to the SPI flash, optionally. The SMI will always be triggered
by coreboot during S3 resume, but can be triggered by either coreboot
or the payload during normal boot path.
Enabling lockdown access to SPI flash will effectly write-protect it,
but there is no runtime option for coreboot to control it, so letting
coreboot to trigger such SMI will leave the owner of the machine lost
any possibility to program the SPI flash with its own OS, and becomes
a nightmare if the machine is uneasy to disassemble, so a scheme could
be implement, in which the SMI to lockdown chipset and SPI flash is left
for a payload to trigger, and temporarily disabling such triggering in
order to program the SPI flash needs authentication.
I have implemented a passcode-protected runtime-disableable lockdown
with grub, described [here](https://github.com/hardenedlinux/Debian-GNU-Linux-Profiles/blob/master/docs/hardened_boot/grub-for-coreboot.md#update-for-coreboot-after-commit-2ac149d294af795710eb4bb20f093e9920604abd). In order to implement a similar scheme for
Heads, I wrote [io386](https://github.com/hardenedlinux/io386).
With this commit, io386 will be called before entering boot routine
to trigger the SMI to finalize the chipset and write protect the SPI
flash at the same time. Entering recovery shell will leave the flash
writable.
(The authentication routine implemented in previous revisions has been
split as an independent commit.)
Originally proposed under PR#326
* Properly initialize sensor IDs of 2nd CPU to fix fan control.
* Use 2s delay for I2C communications with TPM in OPAL (configured in
device tree).
* Stop building unused parts of skiboot using host GCC.
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Updated to reproducible version of fbwhiptail.
Added flags to remove debug info.
Updated url to current one instead of going through redirect.
Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
Most useful to me are:
coreboot.modify_and_save_defconfig_in_place
coreboot.modify_and_save_oldconfig_in_place
linux.modify_and_save_oldconfig_in_place
linux.modify_and_save_defconfig_in_place
Which permit to take current in tree configs and translate them into other format.
This is useful when trying to version bump and build.
Also add helpers to save in versioned version to facilitate change tracking:
linux.generate_and_save-versioned-oldconfig
linux.regenerate_and_save_versioned_defconfig
Update kexec to 2.0.26. Add tracing to framebuffer initialization. In
particular, the driver name is traced if not recognized, and messages
about kernel config are shown if the kernel doesn't provide the
framebuffer pointer.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
By default json-c builds as debug instead of release.
Adding CMAKE_BUILD_TYPE=minsizerel ensures it does not
add debug info and also optimizes for file size.
Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
This patch adds ARCH="$(LINUX_ARCH)" to Linux targets working on config
files. Without it, the architecture defaults to that of host, which for
cross-compilation isn't right.
Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
Disable all optional algorithms except SM3. (SHA and AES are not
optional.) tpm2-tss uses SHA, AES, and SM3. Reduces size of libcrypto
by almost 1 MB, saves about 140 KB in ROM.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
tpm2-tools is able to log pcap files of TPM2 commands, which can be
inspected with wireshark. Add CONFIG_TPM2_CAPTURE_PCAP to capture
these from the tpmr wrapper, and enable for qemu TPM2 boards.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Update to branch including tpm pcrread until it is merged upstream. tpm
pcrread allows us to use the same logical flow for TPM1 and TPM2 in
seal operations.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Update OpenSSL to 3.0.8. Build with -Os. Install only libcrypto,
libssl is not currently needed. Don't buid tests.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
- legacy-flash boards have a single purpose: to flash BIOS region through flashrom.
- They do not need bash nor have space for it in their 4mb defined coreboot CBFS region
Test build to have legacy boards builds under osresearch#1292
Include bash in all builds. Remove CONFIG_BASH.
Remove CONFIG_BASH_IS_ASH from busybox configuration and clean up hacks
in modules/bash.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Disable readline features for interactive shell. This significantly
reduces the size of bash and doesn't affect scripting features. The
interactive shell still functions, but there is no history or command
line editing (backspace works, but arrows do not move cursor).
Enable -Os on bash for more size reduction.
This saves about 180KiB from the compressed initrd for
qemu-coreboot-fbwhiptail-tpm2-hotp, almost half the cost of adding
bash.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Most logic throughout Heads doesn't need to know TPM1 versus TPM2 (and
shouldn't, the differences should be localized). Some checks were
incorrect and are fixed by this change. Most checks are now unchanged
relative to master.
There are not that many places outside of tpmr that need to
differentiate TPM1 and TPM2. Some of those are duplicate code that
should be consolidated (seal-hotpkey, unseal-totp, unseal-hotp), and
some more are probably good candidates for abstracting in tpmr so the
business logic doesn't have to know TPM1 vs. TPM2.
Previously, CONFIG_TPM could be variously 'y', 'n', or empty. Now it
is always 'y' or 'n', and 'y' means "any TPM". Board configs are
unchanged, setting CONFIG_TPM2_TOOLS=y implies CONFIG_TPM=y so this
doesn't have to be duplicated and can't be mistakenly mismatched.
There were a few checks for CONFIG_TPM = n that only coincidentally
worked for TPM2 because CONFIG_TPM was empty (not 'n'). This test is
now OK, but the checks were also cleaned up to '!= "y"' for robustness.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
The actual use of curl was already removed, update tpm2-tools patch to
also remove the check for curl. Remove the curl module and
CONFIG_CURL.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
-coreboot support of TPM v2.0 (shared config for TPM2 support across all 4 previous variations)
-swtpm set to be launched under TPM v2.0 mode under board config
-Documentation file under each board.md softlinks to qemu-coreboot-fbwhiptail-tpm1.md (which has been generalized)
This is skeleton for TPM v2 integration under Heads
-------------
WiP
TODO:
- libcurl cannot be built as a tpm2-tools dependency as of now not sure why. curl currently needs to be added in board config to be built
- Note: tpm-reset (master and here) needs some review, no handle of no tpm use case. Caller is responsible to not call it otherwise does nothing
- init tries to bind fd and fails currently
- Note: Check if whiptail is different of fbwhiptail in clearing screen. As of now every clear seems to be removed, still whiptail clears previous console output
- When no OS' /boot can be mounted, do not try to TPM reset (will fail)
- seal-hotpkey is not working properly
- setting disk unlock key asks for TPM ownership passphrase (sealing in NV requires ownership, but text is misleading user as if reowning TPM)
- We should cache input, feed tpm behind the scene and wipe passphrase and state clearly that this is TPM disk unlock kye passphrase.
- primary key from TPM2 is invalid most of the time from kexec-select-boot and verifying global hashes but is setuped correctly at disk unlock key setup
- would be nice to take advantage of bash function tracing to understand where we are for debugging purposes, code takes ash in consideration only
- tpmr says it implements nv calls but actually doesn't. Removing those falsely wrapped functions would help.
- Implementing them would be better
- REVIEW TODOS IN CODE
- READD CIRCLECI CONFIG
Current state:
- TPM unseal works without disk unlock key and generates TOTP properly (was missing die condition at unseal to not produce always good TOTP even if invalid)
- TPM disk encryption key fails. Hypothesis is that sealing with USB drivers loaded and measures in inconsistent with sealed with/without.
- TPM disk unsealing happens without USB modules being loaded in non-HOTP setup. This fails.
- Current tests are with fbwhiptail (no clear called so having traces on command line of what happens)
- Testing with HOTP implementation for sealing/unsealing since that forces USB module loads on each boot to remove this from failing possibilities
- Add 4.19 under modules/coreboot
- point all 4.13 boards to 4.19
- adapt x230 FHD/EDP patch under patches/coreboot-4.19/0001-x230-fhd-variant.patch (poked upstream to fix patch under https://review.coreboot.org/c/coreboot/+/28950)
- correct versioning info under .circleci/config/yml
- update module version, hash
- rename patch
- update config
Busybox 1.33.0 adds base32, which has been disabled in busybox.config
as it conflicts with tpmtotp's base32.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
NixOS doesn't have a traditional FHS where echo is available at
`/bin/echo`. Instead, we must rely on the PATH for any
distribution-managed utilities. Reverses
https://github.com/osresearch/heads/issues/106.
Before, the configure script sourced these from the system FHS
(/usr/include/libusb-1.0). The build failed on my NixOS build machine,
which doesn't store dependencies in a traditional FHS. And this is the
correct approach for reproducible builds.
patches/coreboot-4.15: remove patches for coreboot 4.15
No boards depend on it and is affected by CVE-2022-29264
Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
This makes configs much less dependent on directory layout.
As of this commit the following variables are supported:
* @BOARD_BUILD_DIR@ - absolute path under build/
* @BLOB_DIR@ - absolute path to blobs/
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
-Makefile: remove local gawk and make version compare and local build
-modules: remove gawk and make
-patches: remove make
local make was added to build 4.2.1 on OSes that were having older version. It was then patched to be built on OSes having newer buildstack.
local gawk was added when GPG toolstack was older then libgpg-error 1.37. GPG toolstack was then upgraded, but local gawk stayed.
Removing those permits better parallelization and of builds and reduces CircleCI (and higher cores systems) to have race conditions and stalled builds
Testing points:
- None here. Board who exported "CONFIG_USB_KEYBOARD=y" have it packed under their initrd, but there is no logic loading the module yet.
- zlib 1.2.12 release is not respecting cross compiling. 1.2.11 disappeared from servers: taking another archive link, same hash.
- busybox 1.32.0 was not patched with 1.28.0 patch. Renaming patch so that its applied in fresh builds.
Older coreboot versions (pre-4.11) required IASL to be built separate
from the main toolchain (crossgcc), but that is no longer the case,
and doing so causes random failures from trying to build IASL as
part of the toolchain and separately, in parallel, each using
-j$(CPUS) threads.
Test: build any board using coreboot 4.15 under Debian 11, observe
no random failures from building the toolchain due to false positives
for a missing depencency .
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
Update hash for coreboot module, coreboot-blobs.
Adjust extra flags to address SNB/IVB build issue.
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
