Commit Graph

533 Commits

Author SHA1 Message Date
Jonathon Hall
3695489589
modules/coreboot: Delete unused remnants of using musl toolchain
At one time coreboot was built using Heads' musl toolchain, but this
was later reverted.  coreboot builds with its own toolchain again.

CROSS= has no effect on coreboot proper (only exception is PPC64
skiboot payload).  It was added to coreboot by a patch that was deleted
in 8e44853.  COREBOOT_IASL was set to the default, that was only needed
when the toolchain was being overridden to override iasl back to the
coreboot one.

ppc64 still specifies CROSS= since skiboot is unable to find coreboot's
toolchain from XGCCPATH but checks CROSS.  This builds skiboot with the
Heads toolchain as before.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-08-11 12:41:55 -04:00
Jonathon Hall
fb6b81119d
modules/coreboot: Clean up module, don't share git build directories
Remove coreboot 4.8.1, 4.13, and 4.17, which were all unused.

Remove extra copies of EXTRA_FLAGS which duplicated the common
definition.  The only difference was
-Wno-error=address-of-packed-member, the warning is now disabled
entirely everywhere with -Wno-address-of-packed-member.

Use separate coreboot_version values for talos_2, nitrokey, and purism,
which gives each a separate build directory.

Move conditional blob definitions out of each coreboot version.

Fix condition for coreboot-blobs - whether a module is a git clone
actually depends on non-empty <module>_repo, not <module>_version==git.
Fix the test so git versions of coreboot can have arbitrary names.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-08-11 12:35:55 -04:00
tlaurion
6f9409be81
Merge pull request #1463 from tlaurion/ioport_url_change_to_debian
ioport: changing url to debian https server, same hash. First need to go into #1198 direction
2023-08-11 12:15:48 -04:00
Thierry Laurion
3c920dd082
ioport: changing url to debian, same hash. First need to go into #1198 direction 2023-08-11 12:05:15 -04:00
Jonathon Hall
47e9e4cf45
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream 2023-07-12 14:14:17 -04:00
Krystian Hebel
9a72749675
initrd/bin/talos-init: remove alias for cbmem and bump coreboot revision
Updated cbmem searches for CBMEM exposed by kernel in sysfs before
trying to read it from memory directly. As such, there is no need for
pointing to that file explicitly.

New coreboot revision also fixes output of 'cbmem -t' caused by wrong
endianness.

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2023-07-12 14:50:54 +02:00
Jonathon Hall
4c8e445dcd
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-07-05 14:32:16 -04:00
Jonathon Hall
9458ec8771
modules/fbwhiptail: Update to 99fe815f (AVX fast copy branch)
Uses AVX for fast copy instead of AVX2, enabling fast copy on
Sandy/Ivy Bridge.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-07-05 14:20:38 -04:00
Thierry Laurion
92e29c4891
Merge branch 'upstream_flashrom_13' into staging_all 2023-06-28 12:47:11 -04:00
Thierry Laurion
30cc112193
Merge branch 'saper_gnupg-2.4.0-update_reduce_size_some_more' into staging_all 2023-06-28 12:47:01 -04:00
Jonathon Hall
861529cf69
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream 2023-06-27 13:21:19 -04:00
Thierry Laurion
979c9dd318
flashrom: remove DUMMY and AST1100 by default on both x86/ppc64, leave MTD only for ppc64, have AST1100 enablement configurable for kgpe-d16 (patch not in) 2023-06-27 12:23:47 -04:00
Jonathon Hall
a1be4e4467
modules/flashrom: Update to 1776bb46
Update flashrom - in particular, this includes support for new chipsets
like Jasper Lake.

CONFIG_INTERAL_X86 was created so CONFIG_INTERNAL could apply to other
platforms, enable it for x86.

The default build target now requires sphinx, just build flashrom
itself.

Update flashrom_progress - filter out noise in newer flashrom that
chokes the progress bar implementation, make size detection more
robust, improve progress bar implementation slightly.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Co-signed by: Thierry Laurion <insurgo@riseup.net.
2023-06-27 12:23:44 -04:00
Thierry Laurion
58d5a295a1
libassuan: build with --disable-doc 2023-06-27 11:40:09 -04:00
Thierry Laurion
e14b869f90
gpg2: remove tools/gpg-connect-agent bin, build with --disable-libdns option 2023-06-27 11:40:05 -04:00
Marcin Cieślak
d4ade892d5
gnupg 2.2.21 -> 2.4.0
830.63 -> 917.89 kB
2023-06-27 11:39:49 -04:00
Marcin Cieślak
15182922fd
libgcrypt 1.8.6 -> 1.10.1
562.01 -> 783.14 kB
2023-06-27 11:39:46 -04:00
Marcin Cieślak
b97f34ecc3
libassuan 2.5.3 -> 2.5.5
741.81 -> 502.42 kB
2023-06-27 11:39:43 -04:00
Marcin Cieślak
7c51116209
libksba 1.4.0 -> 1.6.3
676.03 -> 408.95 kB \o/
2023-06-27 11:39:39 -04:00
Marcin Cieślak
7cef74bb06
libgpg-error 1.46
198.15 -> 277.69 kB
2023-06-27 11:39:36 -04:00
Thierry Laurion
13daaa1203
modules/ coreboot+linux: add helpers to edit config in place + save in oldconfig/defconfig formats
both linux/coreboot:
- save_in_defconfig_format_in_place : takes whatever coreboot config file for a make BOARD=xyz statement and saves it in defconfig
- save_in_oldefconfig_format_in_place : takes whatever coreboot config file for a make BOARD=xyz statement and saves it in oldefconfig

linux:
- linux.prompt_for_new_config_options_for_kernel_version_bump:
  - The most useful helper as of now when doing kernel version bump.
  - Requires to save current kernel config in oldconfig (make BOARD=xyz linux.save_in_oldefconfig_format_in_place) first, then bump kernel version in board config and then use that helper to review new options and save in tree.
2023-06-27 11:20:59 -04:00
Thierry Laurion
f13432cca7
Makefile+ modules/linux: have sizes report output on screen and into sizes.txt
Basically a duplicate of HASHES related Makefile statements
2023-06-27 10:42:04 -04:00
Jonathon Hall
89858f52a9
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 15:15:23 -04:00
Jonathon Hall
c5183253a6
Add CONFIG_BRAND_NAME and allow overriding in Makefile with BRAND_NAME
Use CONFIG_BRAND_NAME to control the brand name displayed in the UI.
Override by setting BRAND_NAME when building, either in the Makefile or
on the command line.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 14:47:59 -04:00
Jonathon Hall
1bf8331ffb
Blob jail: Add zstd-decompress, decompress more complex archives
Debian 12's initrd by default now consists of an uncompressed cpio
archive containing microcode, followed by a zstd-compressed cpio
archive.  inject_firmware.sh only supported gzip-compressed cpio, so it
could not extract /init from this archive.

Add zstd-decompress to decompress zstd streams (uncompressed size is
about 180 KB).

Add unpack_initramfs.sh which is able to decompress uncompressed, gzip,
or zstd archives, with multiple segments, much like the Linux kernel
itself does.

Use unpack_initramfs.sh to extract /init for blob jail.

Don't compress the new archive segment containing firmware and the
updated /init.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:50 -04:00
Jonathon Hall
3e6eac9ffd
modules/coreboot,purism-blobs: Update to 4.20.1-Purism-1
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:50 -04:00
Jonathon Hall
be133892fd
modules/fbwhiptail: Update to 1.1
These changes primarily improve server boards using BMC video.  The
correct DRI card is selected even if it isn't the first one, and
performance is greatly improved on non-UMA cards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:49 -04:00
Jonathon Hall
12c7dfdadc
modules/linux: Support building with Linux 6.1.8.
This is particularly beneficial for servers with Aspeed BMC video,
because it introduces framebuffer console acceleration.  The
framebuffer console is much more responsive.

Patches were ported from 5.10.5:

0001-fake-acpi.patch: This may not be needed any more, but it applies
cleanly and I don't think it would harm anything.

0002-nmi-squelch.patch: The comment mentions qemu but I see this
message on physical machines occasionally, so I think this is needed.

0003-fake-trampoline.patch: This patch does not apply cleanly.  It
could be ported, but I don't think it's needed, I dropped it.  Dates
back to a very old commit where Linux was being embedded into a vendor
UEFI firmware: a4d7654b1e.

0010-winterfell-ahci.patch: Minor change of %x to %lx in context.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:49 -04:00
Jonathon Hall
6e0d241913
ioport: Add ioport module (inb, outb)
Add ioport module, enable for librem_mini_v2.  Only inb and outb are
included, inw/outw/inl/outl aren't needed.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:46 -04:00
Matt DeVillier
1ea5f3bd6b
modules/coreboot: Allow building from Purism's coreboot git repo
Use commit hash from 4.16-Purism-1 tag.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2023-06-21 13:26:41 -04:00
Thierry Laurion
a598ba6e57
modules/io386: fixate to latest commit id and optimize for space 2023-06-12 13:51:58 -04:00
persmule
3f1c76ce11
Introduce io386 to heads and use it to finalize chipset at runtime
On some newer platforms of intel (confirmed on nehalem, sandy/ivy
bridge), coreboot after commit [2ac149d294af795710eb4bb20f093e9920604abd](https://review.coreboot.org/cgit/coreboot.git/commit/?id=2ac149d294af795710eb4bb20f093e9920604abd)
registers an SMI to lockdown some registers on the chipset, as well
as access to the SPI flash, optionally. The SMI will always be triggered
by coreboot during S3 resume, but can be triggered by either coreboot
or the payload during normal boot path.

Enabling lockdown access to SPI flash will effectly write-protect it,
but there is no runtime option for coreboot to control it, so letting
coreboot to trigger such SMI will leave the owner of the machine lost
any possibility to program the SPI flash with its own OS, and becomes
a nightmare if the machine is uneasy to disassemble, so a scheme could
be implement, in which the SMI to lockdown chipset and SPI flash is left
for a payload to trigger, and temporarily disabling such triggering in
order to program the SPI flash needs authentication.

I have implemented a passcode-protected runtime-disableable lockdown
with grub, described [here](https://github.com/hardenedlinux/Debian-GNU-Linux-Profiles/blob/master/docs/hardened_boot/grub-for-coreboot.md#update-for-coreboot-after-commit-2ac149d294af795710eb4bb20f093e9920604abd). In order to implement a similar scheme for
Heads, I wrote [io386](https://github.com/hardenedlinux/io386).

With this commit, io386 will be called before entering boot routine
to trigger the SMI to finalize the chipset and write protect the SPI
flash at the same time. Entering recovery shell will leave the flash
writable.

(The authentication routine implemented in previous revisions has been
split as an independent commit.)

Originally proposed under PR#326
2023-06-12 13:05:49 -04:00
Sergii Dmytruk
b9d2c1a612
Patch coreboot to use /usr/bin/env in skiboot for Talos-II board
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2023-06-09 21:25:49 +03:00
Sergii Dmytruk
62e1899367
modules/powerpc-utils: add
This provides nvram tool that allows manipulating configuration of
skiboot.

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2023-06-07 01:10:13 +03:00
Sergii Dmytruk
3df4a45477
modules/coreboot: update coreboot
* Properly initialize sensor IDs of 2nd CPU to fix fan control.
* Use 2s delay for I2C communications with TPM in OPAL (configured in
  device tree).
* Stop building unused parts of skiboot using host GCC.

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2023-06-07 01:09:42 +03:00
Daniel Pineda
ca00952048
modules/fbwhiptail: Update for reproducibility
Updated to reproducible version of fbwhiptail.
Added flags to remove debug info.
Updated url to current one instead of going through redirect.

Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
2023-05-04 13:14:26 -06:00
tlaurion
ab1faf5389
Merge pull request #1378 from JonathonHall-Purism/kexec-framebuffer-graphics 2023-04-28 17:34:32 -04:00
tlaurion
a7777a7dce
Merge pull request #1390 from danielp96/bash-reproducibility
Bash reproducibility
2023-04-28 13:42:41 -04:00
tlaurion
3a38ac02e3
Merge pull request #1312 from tlaurion/coreboot-4.13_coreboot-4.19_version_bump
Bump boards depending on coreboot 4.13 to 4.19
2023-04-24 19:21:18 -04:00
Thierry Laurion
2901d29e24
coreboot: output xcompile into old shared location for all coreboot versions (prevents rebuild of buildstack) 2023-04-21 16:54:48 -04:00
Thierry Laurion
a29c277849
coreboot+linux modules: add modules target helpers to edit configs (oldconfig/defconfig)
Most useful to me are:
coreboot.modify_and_save_defconfig_in_place
coreboot.modify_and_save_oldconfig_in_place
linux.modify_and_save_oldconfig_in_place
linux.modify_and_save_defconfig_in_place
Which permit to take current in tree configs and translate them into other format.
This is useful when trying to version bump and build.

Also add helpers to save in versioned version to facilitate change tracking:
linux.generate_and_save-versioned-oldconfig
linux.regenerate_and_save_versioned_defconfig
2023-04-20 14:07:20 -04:00
Daniel Pineda
31e122443c
modules/bash: Remove debug info from binary
Add -g0 to CFLAGS
Add -s to LDFLAGS

Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
2023-04-20 10:44:34 -06:00
Jonathon Hall
353e836dc1
kexec: Update to 2.0.26, add framebuffer tracing
Update kexec to 2.0.26.  Add tracing to framebuffer initialization.  In
particular, the driver name is traced if not recognized, and messages
about kernel config are shown if the kernel doesn't provide the
framebuffer pointer.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-04-19 14:16:38 -04:00
tlaurion
8ff4b9a51b
Merge pull request #1319 from danielp96/master
Update busybox 1.32.0 to 1.33.2
2023-04-12 12:36:46 -04:00
Daniel Pineda
46aa2535ba
modules/json-c: set cmake build type as minsizerel
By default json-c builds as debug instead of release.

Adding CMAKE_BUILD_TYPE=minsizerel ensures it does not
add debug info and also optimizes for file size.

Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
2023-04-06 12:13:26 -06:00
Krystian Hebel
4edd71c5aa
modules/coreboot: bump commit hash for Talos
Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2023-03-30 21:04:01 +02:00
Krystian Hebel
e7997abdcc
modules/linux: fix linux.*config targets for non-x86 architectures
This patch adds ARCH="$(LINUX_ARCH)" to Linux targets working on config
files. Without it, the architecture defaults to that of host, which for
cross-compilation isn't right.

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2023-03-24 15:26:34 +01:00
tlaurion
d24def4b59
Merge pull request #1292 from tlaurion/tpm2_retry
TPM2/TPM1 support (testing and bug fixes needed through qemu-(fb)whiptail-tpm[1,2](-hotp) testing boards!
2023-03-13 16:22:13 -04:00
Jonathon Hall
decd45f361
openssl: Trim optional algorithms
Disable all optional algorithms except SM3.  (SHA and AES are not
optional.)  tpm2-tss uses SHA, AES, and SM3.  Reduces size of libcrypto
by almost 1 MB, saves about 140 KB in ROM.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 17:07:00 -05:00
Jonathon Hall
48421ada1e
tpmtotp: Update to osresearch merged commit
osresearch has merged support for tpm pcrread.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:09:46 -05:00
Thierry Laurion
dcf65ea892
modules/flashtools : version bump back to osresearch/flashtools
Changes to support ppc64 were merged upstream
2023-03-10 09:31:22 -05:00
Jonathon Hall
50daa904f9
tpmr: Capture TPM2 pcaps in qemu TPM2 boards
tpm2-tools is able to log pcap files of TPM2 commands, which can be
inspected with wireshark.  Add CONFIG_TPM2_CAPTURE_PCAP to capture
these from the tpmr wrapper, and enable for qemu TPM2 boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:34:45 -05:00
Jonathon Hall
e2c2f2d4e0
tpmtotp: Update to branch including tpm pcrread
Update to branch including tpm pcrread until it is merged upstream. tpm
pcrread allows us to use the same logical flow for TPM1 and TPM2 in
seal operations.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:56 -05:00
Jonathon Hall
5588a47d56
modules/openssl: Update to 3.0.8, reduce size
Update OpenSSL to 3.0.8.  Build with -Os.  Install only libcrypto,
libssl is not currently needed.  Don't buid tests.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:55 -05:00
Thierry Laurion
d549229bfc
modules/bash: enabled by default, disabled in legacy-flash boards
- legacy-flash boards have a single purpose: to flash BIOS region through flashrom.
  - They do not need bash nor have space for it in their 4mb defined coreboot CBFS region

Test build to have legacy boards builds under osresearch#1292
2023-03-08 12:45:52 -05:00
Jonathon Hall
c9df49ad20
modules/bash: Include bash in all builds, remove CONFIG_BASH
Include bash in all builds.  Remove CONFIG_BASH.

Remove CONFIG_BASH_IS_ASH from busybox configuration and clean up hacks
in modules/bash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:52 -05:00
Jonathon Hall
d59ffe07b8
modules/bash: Disable readline, enable -Os
Disable readline features for interactive shell.  This significantly
reduces the size of bash and doesn't affect scripting features.  The
interactive shell still functions, but there is no history or command
line editing (backspace works, but arrows do not move cursor).

Enable -Os on bash for more size reduction.

This saves about 180KiB from the compressed initrd for
qemu-coreboot-fbwhiptail-tpm2-hotp, almost half the cost of adding
bash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:51 -05:00
Jonathon Hall
b500505312
tpm2-tools: Change sense of CONFIG_TPM to mean any TPM, not just TPM1.
Most logic throughout Heads doesn't need to know TPM1 versus TPM2 (and
shouldn't, the differences should be localized).  Some checks were
incorrect and are fixed by this change.  Most checks are now unchanged
relative to master.

There are not that many places outside of tpmr that need to
differentiate TPM1 and TPM2.  Some of those are duplicate code that
should be consolidated (seal-hotpkey, unseal-totp, unseal-hotp), and
some more are probably good candidates for abstracting in tpmr so the
business logic doesn't have to know TPM1 vs. TPM2.

Previously, CONFIG_TPM could be variously 'y', 'n', or empty.  Now it
is always 'y' or 'n', and 'y' means "any TPM".  Board configs are
unchanged, setting CONFIG_TPM2_TOOLS=y implies CONFIG_TPM=y so this
doesn't have to be duplicated and can't be mistakenly mismatched.

There were a few checks for CONFIG_TPM = n that only coincidentally
worked for TPM2 because CONFIG_TPM was empty (not 'n').  This test is
now OK, but the checks were also cleaned up to '!= "y"' for robustness.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:46 -05:00
Jonathon Hall
4e375ad7ca
tpm2-tools: Remove curl dependency
The actual use of curl was already removed, update tpm2-tools patch to
also remove the check for curl.  Remove the curl module and
CONFIG_CURL.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:44 -05:00
Thierry Laurion
6923fb5e20
Addition of qemu-(fb)whiptail-tpm2(-hotp) boards
-coreboot support of TPM v2.0 (shared config for TPM2 support across all 4 previous variations)
-swtpm set to be launched under TPM v2.0 mode under board config
-Documentation file under each board.md softlinks to qemu-coreboot-fbwhiptail-tpm1.md (which has been generalized)
This is skeleton for TPM v2 integration under Heads

-------------
WiP

TODO:
- libcurl cannot be built as a tpm2-tools dependency as of now not sure why. curl currently needs to be added in board config to be built
- Note: tpm-reset (master and here) needs some review, no handle of no tpm use case. Caller is responsible to not call it otherwise does nothing
- init tries to bind fd and fails currently
- Note: Check if whiptail is different of fbwhiptail in clearing screen. As of now every clear seems to be removed, still whiptail clears previous console output
- When no OS' /boot can be mounted, do not try to TPM reset (will fail)

- seal-hotpkey is not working properly
- setting disk unlock key asks for TPM ownership passphrase (sealing in NV requires ownership, but text is misleading user as if reowning TPM)
  - We should cache input, feed tpm behind the scene and wipe passphrase and state clearly that this is TPM disk unlock kye passphrase.
- primary key from TPM2 is invalid most of the time from kexec-select-boot and verifying global hashes but is setuped correctly at disk unlock key setup
- would be nice to take advantage of bash function tracing to understand where we are for debugging purposes, code takes ash in consideration only
- tpmr says it implements nv calls but actually doesn't. Removing those falsely wrapped functions would help.
  - Implementing them would be better
- REVIEW TODOS IN CODE
- READD CIRCLECI CONFIG

Current state:
- TPM unseal works without disk unlock key and generates TOTP properly (was missing die condition at unseal to not produce always good TOTP even if invalid)
- TPM disk encryption key fails. Hypothesis is that sealing with USB drivers loaded and measures in inconsistent with sealed with/without.
 - TPM disk unsealing happens without USB modules being loaded in non-HOTP setup. This fails.

- Current tests are with fbwhiptail (no clear called so having traces on command line of what happens)
 - Testing with HOTP implementation for sealing/unsealing since that forces USB module loads on each boot to remove this from failing possibilities
2023-03-08 12:45:43 -05:00
tlaurion
b2dcebb50a
Merge pull request #1121 from tlaurion/pass_O2_to_Os 2023-03-08 08:37:59 -05:00
Thierry Laurion
907e906f01
Pass -O3 and -O2 (optimize for speed) to -Os (Optimize for space)
Adresses @easrentai suggestion to pass modules build optimization for space here: #590 (comment)

- Uniformized module's $(CROSS_TOOLS) being passed as environment variable, prior of ./configure call

Doesn't work for:
- busybox (HOSTCXXFLAGS="-Os" attempted prior of ./configure call)
- zlib (CFLAGS="-Os" attempted prior of ./configure call)
- npth (CFLAGS="-Os" attempted prior of ./configure call)
2023-03-07 18:05:39 -05:00
Thierry Laurion
47bd80a0ec
modules/coreboot: Do not rebuild coreboot buildstack when built
.xcompile was not found because it was quoted and shouldn't in coreboot module's makefile

Prior:
    stat("\"/home/user/heads/build/x86/coreboot-4.13/.xcompile\"", 0x7ffe56e6cfd0) = -1 ENOENT (No such file or directory)
    pipe([3, 4])                            = 0
    fcntl(4, F_GETFD)                       = 0
    fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
    fcntl(3, F_GETFD)                       = 0
    fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
    prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=1024*1024}) = 0
    prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=1024*1024}) = 0
    stat("/usr/bin/env", {st_mode=S_IFREG|0755, st_size=48480, ...}) = 0
    geteuid()                               = 1000
    getegid()                               = 1000
    getuid()                                = 1000
    getgid()                                = 1000
    access("/usr/bin/env", X_OK)            = 0
    mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7ce2be6fd000
    rt_sigprocmask(SIG_BLOCK, ~[], [CHLD], 8) = 0
    clone(child_stack=0x7ce2be705ff0, flags=CLONE_VM|CLONE_VFORK|SIGCHLD) = 305342
    munmap(0x7ce2be6fd000, 36864)           = 0
    rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0
    close(4)                                = 0
    read(3, "2\n", 200)                     = 2
    read(3, "", 198)                        = 0
    close(3)                                = 0
    wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 305342
    fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0), ...}) = 0
    write(1, "make -C \"/home/user/heads/build/"..., 74make -C "/home/user/heads/build/x86/coreboot-4.13" CPUS=2 "crossgcc-i386"
    ) = 74
    rt_sigprocmask(SIG_BLOCK, [HUP INT QUIT TERM XCPU XFSZ], NULL, 8) = 0
    stat("/usr/bin/env", {st_mode=S_IFREG|0755, st_size=48480, ...}) = 0
    geteuid()                               = 1000
    getegid()                               = 1000
    getuid()                                = 1000
    getgid()                                = 1000
    access("/usr/bin/env", X_OK)            = 0
    mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7ce2be6fd000
    rt_sigprocmask(SIG_BLOCK, ~[], [HUP INT QUIT TERM CHLD XCPU XFSZ], 8) = 0
    clone(child_stack=0x7ce2be705ff0, flags=CLONE_VM|CLONE_VFORK|SIGCHLD) = 305343
    munmap(0x7ce2be6fd000, 36864)           = 0
    rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT TERM CHLD XCPU XFSZ], NULL, 8) = 0
    rt_sigprocmask(SIG_UNBLOCK, [HUP INT QUIT TERM XCPU XFSZ], NULL, 8) = 0
    wait4(-1, make[1]: Entering directory '/home/user/heads/build/x86/coreboot-4.13'
    Welcome to the coreboot cross toolchain builder v ()

    Building toolchain using 2 thread(s).

    Target architecture is i386-elf

    Found compatible Ada compiler, enabling Ada support by default.

    Downloading and verifying tarballs ...
     * gmp-6.2.0.tar.xz (cached)... hash verified (052a5411dc74054240eec58132d2cf41211d0ff6)
     * mpfr-4.1.0.tar.xz (cached)... hash verified (159c3a58705662bfde4dc93f2617f3660855ead6)
     * mpc-1.2.0.tar.gz (cached)... hash verified (0abdc94acab0c9bfdaa391347cdfd7bbdb1cf017)
     * binutils-2.35.tar.xz (cached)... hash verified (6bdd090ce268b6d6c3442516021c4e4b5019e303)
     * gcc-8.3.0.tar.xz (cached)... hash verified (c27f4499dd263fe4fb01bcc5565917f3698583b2)
    Downloaded tarballs ... ok
    Unpacking and patching ...
     * gmp-6.2.0.tar.xz
       o gmp-6.2.0_generic-build.patch
     * mpfr-4.1.0.tar.xz
    ^C0x7ffe56e6ef40, 0, NULL)      = ? ERESTARTSYS (To be restarted if SA_RESTART is set)
    strace: Process 305153 detached

After:
    stat("/home/user/heads/build/x86/coreboot-4.13/.xcompile", 0x7ffd0303c7f0) = -1 ENOENT (No such file or directory)
    pipe([3, 4])                            = 0
    fcntl(4, F_GETFD)                       = 0
    fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
    fcntl(3, F_GETFD)                       = 0
    fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
    prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=1024*1024}) = 0
    prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=1024*1024}) = 0
    stat("/usr/bin/env", {st_mode=S_IFREG|0755, st_size=48480, ...}) = 0
    geteuid()                               = 1000
    getegid()                               = 1000
    getuid()                                = 1000
    getgid()                                = 1000
    access("/usr/bin/env", X_OK)            = 0
    mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x740f6e370000
    rt_sigprocmask(SIG_BLOCK, ~[], [CHLD], 8) = 0
    clone(child_stack=0x740f6e378ff0, flags=CLONE_VM|CLONE_VFORK|SIGCHLD) = 306024
    munmap(0x740f6e370000, 36864)           = 0
    rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0
    close(4)                                = 0
    read(3, "2\n", 200)                     = 2
    read(3, "", 198)                        = 0
    close(3)                                = 0
    wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 306024
    fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0), ...}) = 0
    write(1, "make -C \"/home/user/heads/build/"..., 74make -C "/home/user/heads/build/x86/coreboot-4.13" CPUS=2 "crossgcc-i386"
    ) = 74
    rt_sigprocmask(SIG_BLOCK, [HUP INT QUIT TERM XCPU XFSZ], NULL, 8) = 0
    stat("/usr/bin/env", {st_mode=S_IFREG|0755, st_size=48480, ...}) = 0
    geteuid()                               = 1000
    getegid()                               = 1000
    getuid()                                = 1000
    getgid()                                = 1000
    access("/usr/bin/env", X_OK)            = 0
    mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x740f6e370000
    rt_sigprocmask(SIG_BLOCK, ~[], [HUP INT QUIT TERM CHLD XCPU XFSZ], 8) = 0
    clone(child_stack=0x740f6e378ff0, flags=CLONE_VM|CLONE_VFORK|SIGCHLD) = 306025
    munmap(0x740f6e370000, 36864)           = 0
    rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT TERM CHLD XCPU XFSZ], NULL, 8) = 0
    rt_sigprocmask(SIG_UNBLOCK, [HUP INT QUIT TERM XCPU XFSZ], NULL, 8) = 0
    wait4(-1, make[1]: Entering directory '/home/user/heads/build/x86/coreboot-4.13'
    Welcome to the coreboot cross toolchain builder v ()

    Building toolchain using 2 thread(s).

    Target architecture is i386-elf

    Found compatible Ada compiler, enabling Ada support by default.

    Downloading and verifying tarballs ...
     * gmp-6.2.0.tar.xz (cached)... hash verified (052a5411dc74054240eec58132d2cf41211d0ff6)
     * mpfr-4.1.0.tar.xz (cached)... hash verified (159c3a58705662bfde4dc93f2617f3660855ead6)
     * mpc-1.2.0.tar.gz (cached)... hash verified (0abdc94acab0c9bfdaa391347cdfd7bbdb1cf017)
     * binutils-2.35.tar.xz (cached)... hash verified (6bdd090ce268b6d6c3442516021c4e4b5019e303)
     * gcc-8.3.0.tar.xz (cached)... hash verified (c27f4499dd263fe4fb01bcc5565917f3698583b2)
    Downloaded tarballs ... ok
    Unpacking and patching ...
     * mpfr-4.1.0.tar.xz
     * mpc-1.2.0.tar.gz
     * binutils-2.35.tar.xz
    ^C0x7ffd0303e760, 0, NULL)      = ? ERESTARTSYS (To be restarted if SA_RESTART is set)
    strace: Process 305835 detached

So coreboot buildstack is built once per version and then reused on next board builds.
Saves precious CI and local builds when developing with qemu/kvm.
2023-03-07 15:38:44 -05:00
Thierry Laurion
6300dd178a
Pass all coreboot 4.13 boards to 4.19
- Add 4.19 under modules/coreboot
- point all 4.13 boards to 4.19
- adapt x230 FHD/EDP patch under patches/coreboot-4.19/0001-x230-fhd-variant.patch (poked upstream to fix patch under https://review.coreboot.org/c/coreboot/+/28950)
- correct versioning info under .circleci/config/yml
2023-02-27 18:07:06 -05:00
Daniel Pineda
17ac64bdf1
Replace base32 from tpmtotp with the one from busybox, disable unused base64.
Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
2023-02-21 14:34:35 -06:00
Matt DeVillier
0e356e43cb
modules/busybox: update 1.32.0 -> 1.33.2 (stable)
- update module version, hash
- rename patch
- update config

Busybox 1.33.0 adds base32, which has been disabled in busybox.config
as it conflicts with tpmtotp's base32.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-02-21 14:34:27 -06:00
tlaurion
f2ba6679ca
Merge pull request #1287 from rbreslow/rb/musl-cross-echo-path
modules/musl-cross: use echo from the PATH to support NixOS
2023-01-18 15:22:55 -05:00
Rocky Breslow
dbd302497d
modules/musl-cross: use echo from the PATH to support NixOS
NixOS doesn't have a traditional FHS where echo is available at
`/bin/echo`. Instead, we must rely on the PATH for any
distribution-managed utilities. Reverses
https://github.com/osresearch/heads/issues/106.
2023-01-18 12:42:41 -05:00
Rocky Breslow
a5fa2ecb0b
modules/hotp-verification: source libusb headers from Makefile DESTDIR
Before, the configure script sourced these from the system FHS
(/usr/include/libusb-1.0). The build failed on my NixOS build machine,
which doesn't store dependencies in a traditional FHS. And this is the
correct approach for reproducible builds.
2023-01-18 12:41:54 -05:00
tlaurion
61f72f8d51
Merge pull request #1232 from Unb0rn/l14-size-reduce 2022-12-01 10:03:12 -05:00
Sergii Dmytruk
572c99e898
Add flashrom to Talos II boards
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-11-11 00:59:12 +02:00
Sergii Dmytruk
a2475e2c53
Add flashtools to Talos II boards
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-11-11 00:59:12 +02:00
Thierry Laurion
77c2fb1e07 linux module: add linux.generateoldconfig and linux.modifydefconfig targets to help tweaking/version bumps 2022-11-05 21:05:08 +03:00
Daniel Pineda
8150e300ee
modules/coreboot: remove support for coreboot 4.15
patches/coreboot-4.15: remove patches for coreboot 4.15

No boards depend on it and is affected by CVE-2022-29264

Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
2022-09-15 10:17:34 -06:00
Daniel Pineda
cc58994f3b
modules/coreboot: add support for coreboot 4.17
Update hash for coreboot module, coreboot-blobs.

Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
2022-09-12 13:21:59 -06:00
Sergii Dmytruk
b5fb2f907c
Build agetty from util-linux and optionally add it to initrd
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-09-01 00:21:27 +03:00
Sergii Dmytruk
55ef9912aa
Add Talos 2 boards
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-08-31 00:21:28 +03:00
Sergii Dmytruk
f16e92792a
Support targeting PowerPC 64
This prepares most of the modules to be build for it.

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-08-25 20:55:39 +03:00
Sergii Dmytruk
2a44e5e7ee
Incorporate architecture into directory layout
* build/ -> build/<arch>/
 * crossgcc/ -> crossgcc/<arch>/
 * install/ -> install/<arch>/
 * packages/ -> packages/<arch>/

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-08-25 20:55:39 +03:00
Sergii Dmytruk
fa8e8843c6
Expand @VAR@ placeholders in configuration files
This makes configs much less dependent on directory layout.

As of this commit the following variables are supported:
 * @BOARD_BUILD_DIR@ - absolute path under build/
 * @BLOB_DIR@ - absolute path to blobs/

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-08-25 13:58:40 +03:00
Jonathon Hall
2c3244f48d
dropbear: Use mirror, main host is down
Switch to mirror https://mirror.dropbear.nl/

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2022-08-02 17:35:18 -04:00
Thierry Laurion
bf415a8d69
Remove local build of gawk make
-Makefile: remove local gawk and make version compare and local build
-modules: remove gawk and make
-patches: remove make

local make was added to build 4.2.1 on OSes that were having older version. It was then patched to be built on OSes having newer buildstack.
local gawk was added when GPG toolstack was older then libgpg-error 1.37. GPG toolstack was then upgraded, but local gawk stayed.

Removing those permits better parallelization and of builds and reduces CircleCI (and higher cores systems) to have race conditions and stalled builds
2022-06-23 10:51:13 -04:00
Thierry Laurion
b6651ee8ec
modules/mbetls: move dl from tls.mbed.org to github
- licensing change to APACHE 2.0
- sha256sum changed too

TODO: bump version to 3.1+, not trivial.
2022-06-17 10:15:00 -04:00
Thierry Laurion
97b124ab8e
adding the usb-hid kernel module inclusion under linux module when CONFIG_USB_KEYBOARD is defined
Testing points:
- None here. Board who exported "CONFIG_USB_KEYBOARD=y" have it packed under their initrd, but there is no logic loading the module yet.
2022-04-05 13:46:48 -04:00
Thierry Laurion
981cb96f25
Fix current builds
- zlib 1.2.12 release is not respecting cross compiling. 1.2.11 disappeared from servers: taking another archive link, same hash.
- busybox 1.32.0 was not patched with 1.28.0 patch. Renaming patch so that its applied in fresh builds.
2022-04-01 09:47:39 -04:00
Matt DeVillier
1d5f72e317 modules/coreboot: don't build IASL separate from toolchain
Older coreboot versions (pre-4.11) required IASL to be built separate
from the main toolchain (crossgcc), but that is no longer the case,
and doing so causes random failures from trying to build IASL as
part of the toolchain and separately, in parallel, each using
-j$(CPUS) threads.

Test: build any board using coreboot 4.15 under Debian 11, observe
no random failures from building the toolchain due to false positives
for a missing depencency .

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-02-03 15:04:09 -05:00
Thierry Laurion
7644d90160
modules/coreboot: :? is invalid. ?= defines if not previously defined 2022-01-28 13:57:48 -05:00
Matt DeVillier
5859d1438e modules/coreboot: drop support for coreboot 4.14
All boards using 4.14 have migrated to 4.15

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-20 22:13:36 -05:00
Matt DeVillier
1dc79eba82 modules/coreboot: add support for coreboot 4.15
Update hash for coreboot module, coreboot-blobs.
Adjust extra flags to address SNB/IVB build issue.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-20 22:13:36 -05:00
Matt DeVillier
3fef749bff modules/purism-blobs: update to current HEAD
Updates CPU microcodes for all Librem boards.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-20 22:13:36 -05:00
Thierry Laurion
e492786d0a CircleCI: fix #1058 and partly #984
CircleCI: We currently drop coreboot 4.11 builds.
- There is a file missing in the builds. Not sure why/how this is happening
src/soc/intel/fsp_broadwell_de/romstage/romstage.c:41:10: fatal error: build.h: No such file or directory
Example:https://app.circleci.com/pipelines/github/tlaurion/heads/877/workflows/7d0248d2-459c-42ad-b741-8fd56a75d527/jobs/2487
- kgpe-d16_workstation building for all GPUs is unfortunately taking too much time to build (40 minutes).
- Not sure why, but it seems that the kernel build paralellization is not working for 4.11 while it works for 4.13
Makefile: Uncomment MAKE_JOBS which passes the number of jobs to numbers cores by default and --max-load of 16
CircleCI: Remove CPUS statement to use Makefile default
modules/newt: force build with one make job, otherwise there is a race condition in module which fails randomly expecting build modules. (TODO: FIX)

Interestingly, building all coreboot 4.13 boards is happening on a clean commit just above 1h limit.

More details:
- CircleCI changed job build time to a maximum of 1h each.
- CircleCI now permits parallelization of 30 jobs
- 6000 build minutes a month.
- Still waiting for osresearch/heads CircleCI project to be unlocked (currently not recognized as open source project?!)
2021-12-04 15:51:53 -05:00
Thierry Laurion
ee5073ebe8 CircleCI: add large ressource class for free tier as defined under https://support.circleci.com/hc/en-us/articles/4410707277083-Context-deadline-exceeded-after-1-hour-Build-timed-out-Free-tier-only-
Readd https://github.com/osresearch/heads/pull/984 without cache
Add kgpe-d16 musl-cross target prior of having kgpe-d16 depend on musl-cross target (To try to have musl-cross step successfull under 1h CircleCI new limit)
CircleCI: add a subcommand that can follow a target (to build musl-cross-make now and coreboot version specific musl-cross later)
Output of hashes is now optional
29/11/2021 CircleCI public information available states parallelization of up to 30 jobs at a time. Let's play
- We first build heads musl-cross-make and persist (passing musl-cross-make into next job)
- We then build per coreboot version board with coreboot make statement only and persist (passing musl-cross-make + coreboot's musl-cross buildstack)
- We then build per coreboot version board (reusing past build musl-cross-make and coreboot's version musl-cross buildstack)
Remove 4.11 boards for the moment to test only build time and parallelization
2021-12-04 15:51:53 -05:00
Matt DeVillier
e3e1ac6839 modules/purism-blobs: update to HEAD at 4.14-Purism-1 coreboot tag
Adds blobs for Librem 14, update CPU microcode

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 15:11:39 -04:00
Matt DeVillier
62da6a0279 modules/coreboot: Add option to build using coreboot 4.14
Add hashes for coreboot, coreboot-blobs

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 15:11:39 -04:00
Matt DeVillier
7f13418a9a
kexec: Update to version 2.0.22 (was: 2.0.20)
Update version, download hash, patch filename.

Fixes some IOMMU-related issues on Librem Mini v1/v2, L14

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-09-15 10:22:54 -05:00
Sergii Dmytruk
268f628c74
Build musl-cross in parallel
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2021-07-26 12:02:10 +03:00
Sergii Dmytruk
14c7bb6b7a
Allow using files other than coreboot.rom
Talos 2 will need signed ROM with ECC and an analogous separate bootblock
file.

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2021-07-26 12:02:10 +03:00
Sergii Dmytruk
97dc552d28
Support generation of bundled kernel
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2021-07-26 12:02:08 +03:00
tlaurion
883f4958f8
Merge pull request #876 from hardenedvault/cryptsetup-2.3
Upgrade to cryptsetup 2.3 and make cryptsetup1/cryptsetup2 optionals
2021-02-04 18:21:38 -05:00
tlaurion
bc10168125
libusb: replace package origin from sourceforge to github release
without hardcoding url... sorry guys
2021-02-02 20:17:17 -05:00
Thierry Laurion
5d472ca663
libusb: replace package origin from sourceforge to github release
Last CI build in master fails because of a 302 temporary redirect resulting to bad checksum.
2021-02-02 20:04:20 -05:00
tlaurion
f156589570
Merge pull request #957 from Tonux599/support-linux-5.10.5
Bump Librem and KGPE-D16 to Linux 5.10.5
2021-02-02 17:43:45 -05:00
HardenedVault
da7f6f734f make cryptsetup1/cryptsetup2 optional 2021-01-30 07:28:28 +02:00
Matt DeVillier
df02fd934a
modules/hotp-verification: Update module to latest version
Update nitrokey-hotp-verification to upstream master, which
pulls in 2 changes:
- update OTP secret length from 20 bytes to 40 bytes
- fixes handling for branding strings containing spaces

Test: build/boot Librem 13v4, verify LK verification working

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-01-13 10:35:13 -06:00
Thomas Clarke
194edf5424
modules/linux: Add support for building against Linux 5.10.5. All patches besides 0000-efi_bds.patch port cleanly. As a result of 0000-efi_bds.patch missing, it is strongly encouraged that no linuxboot boards use Linux 5.10.5 until a proper review has been done. 2021-01-07 19:24:03 +00:00
tlaurion
6bc40d7a70
Merge pull request #943 from Tonux599/kgpe-d16-flashrom-fix
Kgpe d16 flashrom fix
2021-01-06 20:13:41 -05:00
Thierry Laurion
7d2ba3d0b8
coreboot module: CPUS=$$CPUS -> CPUS=$(CPUS) 2021-01-03 23:07:51 -05:00
Thomas Clarke
a1f29410be
modules/flashrom: Enable AST1100 in flashrom. This will allow user to flash the BMC internally for KGPE-D16. 2020-12-30 19:18:04 +00:00
Thomas Clarke
aba13a9c55
modules/flashrom: Fixes two issues:
* Flashrom was being fetched with git and was always using `master`
* No patches were being applied (i.e. `0100-enable-kgpe-d16.patch` was being ignored).
2020-12-30 19:17:54 +00:00
tlaurion
4addeab3f5
Merge pull request #900 from tlaurion/busybox-1_32
Upgrade busybox to 1.32
2020-12-30 13:05:49 -05:00
Thierry Laurion
8e4485347e
coreboot: revert building coreboot against musl-cross-make.
coreboot: correct $$CPUS -> $(CPUS)
2020-12-29 17:06:54 -05:00
tlaurion
b06a26f814
Merge pull request #932 from MrChromebox/coreboot_4.13
modules/coreboot: bump 4.12 build option to 4.13
2020-12-29 16:57:35 -05:00
Thierry Laurion
e9eedc4717
Upgrade busybox to 1.32
+CONFIG_STACK_OPTIMIZATION_386=y
+CONFIG_FLOAT_DURATION=y
+CONFIG_FEATURE_RTMINMAX_USE_LIBC_DEFINITIONS=y
+CONFIG_FEATURE_EDITING_WINCH=y
+CONFIG_BZIP2_SMALL=8
+CONFIG_FEATURE_CP_REFLINK=y
+CONFIG_MKTEMP=y
+CONFIG_PRINTF=y
+CONFIG_SYNC=y
+CONFIG_FEATURE_SYNC_FANCY=y
+CONFIG_CMP=y
+CONFIG_DIFF=y
+CONFIG_PATCH=y
+CONFIG_FEATURE_FIND_EXECUTABLE=y
+CONFIG_FEATURE_FIND_QUIT=y
+CONFIG_FEATURE_FIND_EMPTY=y
+CONFIG_FEATURE_GPT_LABEL=y
+CONFIG_MKFS_VFAT=y
+CONFIG_DC=y
+CONFIG_FEATURE_LESS_RAW=y
+CONFIG_FEATURE_LESS_ENV=y
+CONFIG_FEATURE_NSLOOKUP_BIG=y
+CONFIG_FEATURE_NSLOOKUP_LONG_OPTIONS=y
+CONFIG_FEATURE_NTP_AUTH=y
+CONFIG_FEATURE_TFTP_HPA_COMPAT=y
+CONFIG_PIDOF=y
+CONFIG_FEATURE_PIDOF_SINGLE=y
+CONFIG_FEATURE_PIDOF_OMIT=y
+CONFIG_SHELL_ASH=y
+CONFIG_ASH_BASH_NOT_FOUND_HOOK=y
+CONFIG_FEATURE_SH_MATH_BASE=y
+CONFIG_FEATURE_SH_EMBEDDED_SCRIPTS=y

This commit changes used compressed space from 6851524 -> 6863812.
Coherent reduction of free available space being 143768 -> 131480 before saturation.

Net increase of 24kB for busybox binary:

    busybox 1.28 : 484kB
    busybox 1.32: 508kB

Increase of 15kB of needed BIOS region space:

    ROM's initrd.cpio.xz with busybox 1.28: 3839kB
    ROM's initrd.cpio.xz with busybox 1.32: 3854kB
2020-12-29 16:49:08 -05:00
Devon Bautista
d2b41c5249
modules/coreboot: $$CPUS --> $(CPUS) 2020-12-26 13:37:36 -08:00
Devon Bautista
b85dadee76
modules/linuxboot: $$CPUS --> $(CPUS) 2020-12-26 12:19:10 -08:00
Matt DeVillier
883ac669a8
modules/coreboot: bump 4.12 build option to 4.13
- update module hash and blobs hash
- drop patches no longer needed; migrate those that remain
- adjust Librem Mini/Mini v2 board configs

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-12-14 21:03:32 -06:00
Trammell hudson
fbd38155d9
non-coreboot-builds: do not error if CONFIG_COREBOOT_VERSION is not set
Signed-off-by: Trammell hudson <hudson@trmm.net>
2020-11-25 14:43:07 +01:00
Matt DeVillier
1241f9714f modules/purism-blobs: Update module pointer and hash
Update purism-blobs for Librem Mini v2 release

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-11-19 15:39:44 -05:00
HardenedVault
057cc3c377 [WIP] cross build json-c and cryptsetup 2020-10-28 15:28:05 +02:00
tlaurion
e3519f2ecd
WiP: gpg2 2.21 LTS upgrade (gnupg toolstack) (#860)
* gpg2: change gpg2 toolstack to gpg2 2.21 LTS
* remove additional gpg2 unneeded configure options across gpg2 toolstack dependencies
2020-10-26 10:19:57 -04:00
MrChromebox
b71f3757c1
modules/linux: add support for building with kernel 5.4.69 (#854)
* modules/linux: add support for building with kernel 5.4.69

Add support to module, port patches from 4.19.139.
Needed for newer platforms not supported by 4.19 kernel.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* CircleCI: add rysnc dependency for building kernel 5.x

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Migrate all Librem boards to kernel 5.x, common config

Update linux-librem_common.config from 4.x to 5.x, and add
CONFIG items needed to support the librem_l1um (AST DRM drivers,
serial port output).

Tested on Librem 13v4, Librem Mini, and Librem Server L1UM.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-25 01:26:08 -04:00
MrChromebox
bd7a945bbb
Inject Heads version string into coreboot LOCALVERSION... (#859)
* config/coreboot-*: drop CONFIG_LOCALVERSION
Will be injected as part of the build using $(HEADS_GIT_VERSION)
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* modules/coreboot: inject $(HEADS_GIT_VERSION) as CONFIG_LOCALVERSION
Needed for fwupd to handle board updates
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* modules/coreboot: override SMBIOS ProductName with $(BOARD)
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Use $(BOARD)-$(HEADS_GIT_VERSION) as basis for output filename
makes builds uniquely identifiable based on board and version.
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-21 11:04:27 -04:00
MrChromebox
1e5a08fa78
Librem Mini: increase size of CBFS (#863)
Increase size of CBFS to 0xC00000 (from 0x800000) to accomodate
newer/larger kernels.

Update purism-blobs module so an update/modified IFD and smaller
ME blob are used.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-20 18:20:55 -04:00
Markus Meissner
09ca500d3e
add x230-nkstorecli board config (#817)
* add x230-nkstorecli board; 
* add modules: nkstorecli, libnk, libhidapi-libusb
* version bump nkstorecli; related minor in libnk
* upd. libnk module version bump to 3.6; remove 3.5 patch
2020-10-19 10:47:22 -04:00
MrChromebox
85d7e29d18
Add new board: Purism Librem Server L1UM (#858)
* modules/coreboot: add option to use coreboot 4.11

Port patches from coreboot 4.8.1 to 4.11:
* 0000-measure-boot -> 0001
* 0010-cross-compiler-support

All other patches for coreboot 4.8.1 have either already been
integrated, or are for platforms which do not need to be migrated
to coreboot 4.11 (they will move to 4.12 or newer).

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add Broadwell-DE platform patch

Add a patch for FSP Broadwell-DE to make use of Heads' measured boot.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add patch to read serial # from CBFS

Will be used by multiple Librem boards.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: add board support for Librem Server L1UM

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Librem Server L1UM: add new board

Add board config, coreboot config, kernel config files.
Add conditional purism-blobs dependency to coreboot-4.11 module.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* flash.sh: add special handling for librem_l1um board

Add support for persisting PCIe config via PCHSTRP9 in flash descriptor.
This is needed to support multiple variants of the L1UM server which
use the same firmware but differ in PCIe lane configuration via the
PCH straps configuration in the flash descriptor.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add 'Use PRIxPTR to print uintptr_t' patch

Cherry-picked from upstream coreboot (post-4.11), fixes compilation issue.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* CircleCI: add target to build board librem_l1um

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-18 14:48:25 -04:00
MrChromebox
3c24460f1a
modules/flashrom: update to add support for Comet Lake-U (#855)
Update to upstream flashrom (post v1.2) commit 4d3657b4:
Add support for Comet Lake-U/400-series PCH

kgpe-d16 patch from flashrom 1.2 still applies cleanly.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-18 10:17:34 -04:00
MrChromebox
ad8d102f8a
fbwhiptail: Fix module to specific git commit vs master (#856)
Even though repo is stable at the moment, improves reproducibility.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-16 22:43:56 -04:00
MrChromebox
92e9a24902
coreboot-4.12: Use musl-cross-make (#844)
* patches/coreboot-4.12: add cross-compiler support patch

Ported from coreboot-4.8.1, re-exported via `git diff`

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* modules/coreboot: use musl-cross-make to build

revert toolchain bits to pre-4.12 addition

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* config/coreboot-librem_mini: use CONFIG_ANY_TOOLCHAIN

Needed since coreboot 4.12 now built with musl-cross-make

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-02 15:12:59 -04:00
Thierry Laurion
c74564086c
Buildsystem: permit to pass CPUS=X to make to force a number of CPUS to be used if desired, else the default is detected in Makefile and pushed to submodules. If nothing specified, uses nproc and pass it to submodules. CircleCI forced to CPUS=2 2020-09-25 15:52:31 -04:00
tlaurion
51fd3b3546
Merge pull request #829 from tlaurion/flashtools_par_upstream
modules/flashtools: bring par to upstream flashtools.
2020-09-07 13:41:31 -04:00
Nathan Rennie-Waldock
7ce12fe621
Add gawk module to use if the host is running a different major version (fixes #668) (#811)
Signed-off-by: Nathan Rennie-Waldock <nathan.renniewaldock@gmail.com>
2020-09-07 08:50:01 -04:00
Thierry Laurion
4d7286991d
modules/flashtools: bring par to upstream flashtools. 2020-09-06 19:06:02 -04:00
tlaurion
480a2e1130
modules/fbwhiptail: fixate to latest commit ID to make sure Heads commit would produce the same binary signature long term. (#820) 2020-09-02 14:41:29 -04:00
MrChromebox
268fb90623
Add new board: Purism Librem Mini (#806)
* patches/coreboot-4.12: Add patch for Cannonlake ME status

Add patch print ME status regardless of enablement state

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* modules: add purism-blobs module

Rather than require users to manually run a script to download the required
blobs to build Purism Librem boards, automate it so the correct version
is automatically downloaded/extracted. Restrict to coreboot 4.12 for now
since 4.8.1 still needs FSP blobs, which are not in module.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* configs/linux-librem13v2: unset CONFIG_RETPOLINE

Fixes compilation issue with newer kernels, ignored by older ones
which don't need it

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Add new board: Librem Mini

Add Librem Mini board patch for coreboot 4.12, board config and
coreboot config. Continue reusing existing librem13v2 Linux config,
same as all other Librem boards currently. Use new purism-blobs module.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* board/librem*: rename for consistency

Use 'librem_<board>' notation for consistency across all models.
Rename linux config file since used by multiple Librem models.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* CircleCI: add librem_mini board to test

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-09-02 14:39:37 -04:00
MrChromebox
f23ced0a3b
Support Multiple Kernel Options (#805)
* modules/linux: Add support for multiple kernel versions

Follow same pattern as used for coreboot. Add existing kernel version
as default for all existing boards.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* modules/linux: Add option to use 4.19 LTS kernel

Add option to use kernel 4.19.139 (current LTS version).
Duplicate existing patches from 4.14.62 as they all apply cleanly.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-20 19:26:48 -04:00
tlaurion
b14e564ac9
Fix CircleCI build problems (#808)
* CircleCI: debian:10 docker based. Give possitility to override CACHE_VERSION through CircleCI when needed
* Makefile: fix #799 with implementation of @osresearch's recommended https://github.com/osresearch/heads/issues/799#issuecomment-673059028
* modules/coreboot : indentation fix and putting version hashes together to facilitate future maintainership.
2020-08-20 15:15:46 -04:00
Matt DeVillier
5f9e59afae
modules/coreboot: Add option to build with coreboot 4.12
Add version and hash for coreboot and coreboot-blobs modules.
Adjust to use own toolchain, fix blobs path and extraction depth.

Test: build Librem 13v4 using both coreboot 4.8.1 and coreboot 4.12
(after adjusting board defconfig), verify correct toolchains used to
build each, and that teh result is a bootable ROM.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-13 09:51:22 -05:00
Matt DeVillier
d6292015a1
modules/hotp-verification: Update and drop patch
Update to nitrokey-hotp-verification master (c0956cf) and drop
existing patch which is no longer needed.

Test: clean build for Librem 13v2

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-30 14:26:59 -05:00
Matt DeVillier
efe30b72bf
modules/hotp-verification: update to upstream master
Update hotp-verification to Nitrokey upstream commit 03a198c4.

Test: build/boot Librem 13v4, verify Librem key verification functional.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-23 19:59:46 -05:00
tlaurion
7ea13ee000
Merge pull request #761 from Nitrokey/hotp-neutral
Fix branding issue with HOTP USB Security Dongles
2020-07-23 15:05:13 -04:00
tlaurion
9719510f39
Merge pull request #776 from tlaurion/coreboot_481
coreboot: 4.8.1 fixed in Makefile, coreboot module and board configs
2020-07-12 11:51:15 -04:00
Thierry Laurion
5f067ea908
coreboot: 4.8.1 fixed in Makefile, coreboot module and board configs (coreboot_481) to facilitate newer coreboot version integration and testing without breaking old fixed boards 2020-07-10 12:37:11 -04:00
Matt DeVillier
5cb45bbc99
Revert "upgrade gpg toolstack to latest versions"
This reverts commit 972c25de7d.

This commit broke OEM factory reset functionality, so revert it
until the issue can be properly diagnosed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-07 17:50:45 -05:00
Szczepan Zalega
9c9edb0cfc
Remove pkg-config and git version use 2020-06-30 16:00:04 +02:00
alex-nitrokey
07cc2b64f5
Separate json-c module from cryptsetup module 2020-06-30 11:16:01 +02:00
alex-nitrokey
53dc659c01
Replace libremkey_htop_* by hotp_* 2020-06-25 15:35:47 +02:00
alex-nitrokey
73c9d6efc8
Merge branch 'hotp-verification-update' into hotp-neutral-merge 2020-06-24 18:17:54 +02:00
alex-nitrokey
38ba257063
Include upstream updates of hotp_verification 2020-06-24 16:31:22 +02:00
alex-nitrokey
19c1e8f1af
Clean up branch off testing stuff 2020-06-19 16:26:30 +02:00
alex-nitrokey
ff58f1524d
Fix build issue
* use --libdir to fix issue with .la files which had //lib as lib folder
* add libblkid as library
2020-06-19 16:23:16 +02:00