Rationale:
cpio -t alone cannot extract initrd past early cpio (microcode) in most packed initrd.
unpack_initramfs.sh already under master comes to the rescue, but its usage up to today was limited to pass firmware blobs to final OS under boards/librem_mini_v2
Debian OSes (and probably others) need to have cryptroot/crypttab overriden directly, otherwise generic generation of crypttab is not enough.
Extracting crypttab and overriding directly what is desired by final OS and exposed into /boot/initrd is the way to go otherwise hacking on top of hacks.
This brings default packed modules under Heads to 5 modules, which needs to be deactivate in board configs if undesired:
user@heads-tests-deb12:~/heads$ grep -Rn "?= y" modules/ | grep -v MUSL
modules/zlib:1:CONFIG_ZLIB ?= y
modules/zstd:3:CONFIG_ZSTD ?= y
modules/exfatprogs:2:CONFIG_EXFATPROGS ?= y
modules/busybox:2:CONFIG_BUSYBOX ?= y
modules/e2fsprogs:2:CONFIG_E2FSPROGS ?= y
Changes:
- As per master: when TOTP cannot unseal TOTP, user is prompted to either reset or regenerate TOTP
- Now, when either is done and a previous TPM Disk Unlock Key was setuped, the user is guided into:
- Regenerating checksums and signing them
- Regenerating TPM disk Unlock Key and resealing TPM disk Unlock Key with passphrase into TPM
- LUKS header being modified, user is asked to resign kexec.sig one last time prior of being able to default boot
- When no previous Disk Unlock Key was setuped, the user is guided into:
- The above, plus
- Detection of LUKS containers,suggesting only relevant partitions
- Addition of TRACE and DEBUG statements to troubleshoot actual vs expected behavior while coding
- Were missing under TPM Disk Unlock Key setup codepaths
- Fixes for #645 : We now check if only one slots exists and we do not use it if its slot1.
- Also shows in DEBUG traces now
Unrelated staged changes
- ash_functions: warn and die now contains proper spacing and eye attaction
- all warn and die calls modified if containing warnings and too much punctuation
- unify usage of term TPM Disk Unlock Key and Disk Recovery Key
prepare_thumb_drive: default to creating 10% LUKS container on usb drive, prompts for passphrase is not provided and scan drives if no --device specified
NOTE: qemu usb_thumb drive of 128 mb are not big enough so that 10% of it (12mb) can be used to create thumb drive.
Adds:
- e2fsprogs to support ext4 filesystem creation through mke2fs
- add /etc/mke2fs.conf so that mke2fs knows how to handle ext2/ext3/ext4
- removes mke2fs support from busybox
- bump busybox to latest version which adds cpu accelerated hash functions (not needed per se here)
- Adds exfatprogs to have mkfs.exfat and fsck.exfat
- Adds prepare_thumb_drive /etc/luks-functions to be able to prepare a thumb drive with percentage of drive assigned to LUKS, rest to exfat
- Modify most board configs to test space requirements failing
- Talos2 linux config: add staging Exfat support
- Make e2fsprogs and exfatprogs included by default unless explicitely deactivate in board configs
- Change cryptsetup calls : luksOpen to open and luksClose to close to addresss review
- etc/luks_functions: cleanup
GOAL here is to have secure thumb drive creation which Heads will be able to use to backup/restore/use generated GPG key material in the future (next PR)
- intel igpu related - remove i915drmfb hacks and use simplefb and libgfxinit enabled fb
- coreboot 4.19: add patch to fix https://ticket.coreboot.org/issues/500. fbwhiptail still tears screen if in native 1366x769 though
- coreboot 4.19: add patch to enable linux tampoline handle coreboot framebuffer (merged https://review.coreboot.org/c/coreboot/+/76431)
- coreboot 4.19: add patch to enable coreboot to apply jpeg voodoo to create bootsplash.jpeg injected in cbfs at build time + CircleCI apt imagemagick
- (Thanks Nico Huber @icon again for above patches!)
- coreboot configs: adapt VESAFB/LIBGFXINIT to use maximum fb height/width
- coreboot configs for iGPU only: CONFIG_LINEAR_FRAMEBUFFER_MAX_HEIGHT CONFIG_LINEAR_FRAMEBUFFER_MAX_WIDTH to native size
- coreboot configs for dGPU based on Optional VBIOS injected: VESAFB set to 1280x1024 (maximum possible).
Details:
coreboot configs: remove CONFIG_LINUX_COMMAND_LINE="drm_kms_helper.drm_leak_fbdev_smem=1 i915.enable_fbc=0"
- Those were needed to expose i915drmfb driver prior of efifb working.
Nothing else shares the 4.20.1 toolchain yet, and upcoming forks are
based on older releases. We'll share it when other boards update to
4.20.1.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Based on feedback, 1440p displays can benefit from 2x console as well.
Err toward a font too large rather than too small and lower the
threshold to 1350, which is the threshold fbwhiptail uses for 1.5x.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Include kbd so the console font can be enlarged based on the display
resolution.
Don't force 1080p on the eDP output in Heads.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
fbwhiptail scales its UI based on the display size. FBWHIPTAIL_SCALE
can set a specific scale factor for testing.
fbwhiptail no longer looks for a 1080p mode when the default mode is
2160p.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Build kbd and ship setfont if enabled with CONFIG_KBD.
When CONFIG_KBD is enabled, setconsolefont.sh will double the console
font size on large displays (>1600 lines tall as a heuristic).
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
CROSS= is needed for skiboot on PPC64 due to different endianness
relative to coreboot.
The talos_2 fork doesn't share the toolchain because it is the only
_fork_, not board, to be precise. We could add more boards using that
fork without having to create a shared toolchain, it only matters if we
add another fork or start building boards from the upstream release
too.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Two := assignments were factored out together, the second overwrote the
first. Fix to +=, and remove the nitrokey assignment since it came
from a branch.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
This was spelled wrong - it's actually '_depends'. 'initrd' isn't a
module any more so the value doesn't make sense, remove it.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
These boards get purism-blobs as a submodule of the purism coreboot
fork. modules/coreboot used to skip the purism-blobs dependency for
this fork, but the module is not needed at all for these boards.
librem_l1um keeps CONFIG_PURISM_BLOBS=y since it is built from patched
coreboot 4.11.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Default the patch version to empty if the module name already includes
the version. Fixes application of coreboot patches.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
The skiboot build fails to find the toolchain when it's not in the
default location. There is only one ppc64 board anyway, so there's no
point trying to share a toolchain for now.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Use .heads-toolchain to mark that the toolchain was built rather than
.xcompile. coreboot doesn't generate .xcompile until the build step,
so all modules had to build successfully before we would stop trying to
to rebuild the toolchain. Build steps should generally produce the
indicated outputs too, which was not occurring here.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Reuse the toolchain from a coreboot release for fork builds. Either
the fork or the release can be built first, in either case the
release's toolchain is built at the default location and reused for
later builds.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Define a separate module for each coreboot version, so the module used
to build the ROM will optionally be able to reference the toolchain
from a different module.
This will allow coreboot fork builds to use the toolchain from the
corresponding release.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
