Commit Graph

1359 Commits

Author SHA1 Message Date
Tom Hiller
646ddee748 blobs: add blobs/xx20 2020-12-02 19:18:35 -05:00
tlaurion
1661e5dcb0
Merge pull request #867 from Tonux599/kgpe-d16_411_measured-boot
KGPE-D16 Coreboot 4.11 + Measured Boot
2020-12-02 18:23:55 -05:00
tlaurion
014e59210d
Merge pull request #906 from Nitrokey/gpg-default-keylength
Default to 4096 bit for OEM factory reset (fixes #831)
2020-12-02 18:20:39 -05:00
tlaurion
4d570523f8
Merge pull request #908 from osresearch/pr/non-coreboot-builds
non-coreboot-builds: do not error if CONFIG_COREBOOT_VERSION is not set
2020-12-02 18:04:55 -05:00
tlaurion
05e212d9bf
Merge pull request #917 from tlaurion/quick_typo_fixes
xx30-*-maximized boards: typo fix in comments expend -> expand
2020-12-02 17:40:05 -05:00
Thierry Laurion
1b0a9c4c22
xx30-*-maximized boards: typo fix in comments expend -> expand 2020-12-02 17:35:10 -05:00
tlaurion
36c04f19e4
Add xx30-maximized and xx30-hotp-maximized boards (11.5mb flashable BIOS regions, reproducible me.bin and generated gbe.bin and totally externally and internally flashable roms) (#703)
* xx30-*-maximized: update flashrom options removing --ifd bios option, keeping whole flash of rom internally. WARNING: ifd needs to be initially unlocked through ifdtool -u on 8mb bottom SPI backup. YOU CANNOT COME FROM 1VYRAIN. IF COMING FROM SKULLS, YOU MUST HAVE RAN OPTIONAL -u OPTION FROM SKULLS. PLEASE UPGRADE ONLY AFTER HAVING A PHYSICAL BACKUP OF BOTH SPI FLASH CHIPS. MORE INFORMATION UNDER https://github.com/osresearch/heads/pull/703. This will guarantee that future flash of produced rom will reflash the ROM totally, where heads make sure of adding users customizations (public key, /etc/config.user) when internally flashed. Unfortunately, if you flash externally, you will have to reinject your public key and readd /etc/config customizations.

* Adding generated bincfg coreboot 4.8.1 patch (merged under coreboot 4.13 and backported here to 4.8.1), resulting in gbe.bin under blobs/xx30/gbe.bin and instructions to replicate in README prior of automation (under repo). Note that MAC under gbe.bin is fixed to DE:AD:C0:FF:EE unless extract.sh script is ran on external backup to keep current user's MAC (Thanks to @Thrilleratplay's contribution!)

* xx30 blobs: add two blobs management scripts for xx30: extract from local backup/download+neuter ME
extract.sh: extract from external backup: gbe.bin, neuter under me.bin and maximize BIOS+reduce ME regions under unlocked ifd.bin. 
download_clean_me.sh: download and verify Lenovo latest ME version from website, and drop me.bin in place.
Note: me.bin is 98kb, containing only BUP and ROMP partitions which cannot be modified nor deleted else computer won't boot. As a result, BIOS region is maximized in ifd.bin to 11.5mb and coreboot config takes advantage of that freed space.

* CircleCI: xx30-*-maximized additional step to call download_clean_me.sh prior of building boards so that me.bin is dopped in place. This should be done by users prior of building xx30-*-maximized boards locally, which is imitated in CircleCI builds (look at .circleci/config.yaml for innoextract host added dependency and board buildings. Results on github for each commit).
2020-12-02 17:01:44 -05:00
Thomas Clarke
572f5b3414
On KGPE-D16 boards, ensure linux-kgpe-d16*.config are up-to-date by:
cp config/linux.. ./build/linux*/.config
	cd build/linux*
	make savedefconfig
	cp defconfig ../../config/linux..

Resulting in only linux-kgpe-d16_workstation.config being updated.

For KGPE-D16 workstation boards:
Remove `console=tty0` from `CONFIG_BOOT_KERNEL_ADD` as was blocking Qubes graphical installer (CLI installer was launched).
Comment out `export CONFIG_BOOT_KERNEL_REMOVE="plymouth.ignore-serial-consoles"` to provide a more desktop like experience.

Removed 0001-cpu-x86-smm-Use-PRIxPTR-to-print-uintptr_t.patch as already exists as 0000-cpu-x86-smm-Use-PRIxPTR-to-print-uintptr_t.patch

Added 0020-kgpe-d16_measured-boot-support.patch for coreboot 4.11

Fix TPM errors when microcode is measured by initialising TPM earlier and loading the microcode later.
Thanks to Michał Żygowski <miczyg1> for condition suggestion: `if (CONFIG(MEASURED_BOOT) && CONFIG(LPC_TPM) && boot_cpu())`

Locate bootblock location and size with CBFS API. Credit to: Michał Żygowski <miczyg1>
2020-12-02 15:56:42 +00:00
Thierry Laurion
9f751f11fe
KGPE-D16: fix coreboot config to have LOCAL_VERSION injected since not defined, describe better board configs applications 2020-12-02 15:56:42 +00:00
Thomas Clarke
6bd3f815e4
Better vboot-rwa.fmd for KGPE-D16.
Bring patches/coreboot-4.11 on par with master

Removed patches/coreboot-4.11/0020-kgpe-d16-vboot.patch
Removed Vboot options from KGPE-D16 coreboot configs

Enabled TPM in kgpe-d16 board configs
Enabled measured boot in kgpe-d16 coreboot configs.

Added support for video cards that require nouveau, radeon and amdgpu drivers in linux-kgpe-d16_workstation.config

`nouveau.config=NvForcePost=1` to be added to kexec'd kernels for better Nvidia card support.
2020-12-02 15:56:41 +00:00
Thierry Laurion
bac1d54bde
Activate dual console by default and restructure board config
Changing CONFIG_USB_BOOT_DEV to sdc1, adding back CONFIG_BOOT_STATIC_IP to 192.168.2.3, adding dual console to OpenBMC and tty0 in attempt to have QubesOS graphic installer which complains with no networking when attempting to start VNC

Adding dual console to OpenBmc and tty0

putting kgpe-d16-coreboot.conf in defconfig format

NO_HZ wasn't included in kernel config. Adding it.

Wasn't able to have both console firing up QubesOS gui installer, complaining about hvc1 console errors. Splitting up Workstation and server config. This one works for Worstation

Removing serial configuration and static IP stuff since we have a workstation here.

Seperate Workstation and Server board configurations until dual console truely works through QubesOS gui installation. kgpe-d16 board config removed until then.

Placing files in good directories

Corrrect flashrom options for kgpe-d16 server and workstation boards

kgpe-d16 linux: NO_HZ_IDLE instead of NO_HZ

kgpe-d16: seperate board for workstation to be AST and gui-init based, while kgpe-d16-> kgpe-d16_server

kgpe-d16_server: boots, shows ASpeed text on VGA, controllable through BMC via SSH.

kgpe-d16_workstation on ASpeed console. WIP. (Includes CIs configs to build server and workstation)

kgpe-d16_workstation in defconfig format

kgpe-d16 boards: pass from GPG to GPG2 board definitions

kgpe-d16_workstation : Adding Cairo and FbWhpitail in board config for gui-init to work in FB mode

kgpe-d16: removing plymouth.ignore-serial-consoles to fix server terminal output

kgpe-d16: bring par with staging branch https://gitlab.com/tlaurion/heads/commits/kgpe-d16_staging

kgpe-d16 : expressively export CONFIG_TPM=n

kgpe-d16_wokstation gui-init variables were missing

kgpe-d16 boards: add CONFIG_LINUX_USB_COMPANION_CONTROLLER so that usb is recognized

linux-kgpe-d16*: add support for Pike

kgpe-d16_workstation-usb_keyboard board support addition

kgpe-d16_server-whiptail: Add board and dependencies to have gui-init in whiptail (console mode, not FbWhiptail based

GitlabCI: kgpe-d16 fixes and upstream merge of change

kgpe-d16* board: add statement to fixate coreboot version to 4.8.1 for the moment

kgpe-d16: add missing config/linux-kgpe-d16_server-whiptail.config file

KGPE-D16: community work migration to coreboot 4.11 to fix issue #740

KGPE-D16 boards: Adding VBOOT+measured boot, musl-cross patch and 4.11 patch brought up per https://github.com/osresearch/heads/pull/709

kgpe-d16* boards: add VBOOT Kconfig patch per @miczyg1 recommendation under https://github.com/osresearch/heads/pull/795#issuecomment-671214637

KGPE-D16* coreboot configs: Add S3NV as a Runtime data whitelist (so that it is not measured at term) per @miczyg1 recommendation under https://github.com/osresearch/heads/pull/795#issuecomment-671214637

kgpe-d16 coreboot 4.11: add https://review.coreboot.org/c/coreboot/+/36908 patch

kgpe-d16 boards: add Linux kernel version where missing.

CircleCI: Add debug output on fail for kgpe-d16 board builds to bring par with upstream after rebasing on master

coreboot module: typo correction (tabs vs spaces)

CircleCI: trying to address "g++: fatal error: Killed signal terminated program cc1plus." happening under coreboot 4.11 and coreboot 4.12 builds

CircleCI: remove past addition to test recommendation from CircleCI: "resource_class: large"

CircleCi: Ok.... lets output dmesg content prior of other logs.... I'm out of ideas. Next step, ask CircleCI for support

At this stage:
- job's "make --load" is supposed to guarantee that the number of thread doesn't exhaust pass of a load of 2 (medium, free class, CircleCI has 32 cores so possibility of a load of 32)
- "--max_old_space_size=4096" in CircleCI environement is supposed to limit memory consumption to 4096Mb of memory, the max of a medium class free tier CircleCI node

CircleCI: remove verbose build (no more V=1), in case of failed build, find all logs modified in last minute and output each of them on console.

coreboot module: implement load average respect inside of problematic CI build for coreboot 4.11+ being killed in the action (32 cores with 4Gb ram get gcc OOM)

coreboot module: replace nproc by number of Gb actually available as number of CPUs, since each thread is expected to have 1Gb of ram.

CircleCI & coreboot config: fix merge conflict rebasing on master

coreboot 4.11 kgpe-d16 vboot patches addendum, credits goes to @Tonux599

Fix merge conflicts and make sure all boards are inside of CircleCI builds. PoC build for #867
2020-12-02 15:56:34 +00:00
Tom Hiller
3512853ab0 feat(busybox): set CONFIG_BASH_IS_ASH 2020-11-25 21:46:33 -05:00
Trammell hudson
fbd38155d9
non-coreboot-builds: do not error if CONFIG_COREBOOT_VERSION is not set
Signed-off-by: Trammell hudson <hudson@trmm.net>
2020-11-25 14:43:07 +01:00
alex-nitrokey
e31d6dcb8e Default to 4096 bit for OEM factory reset 2020-11-24 12:48:41 +01:00
Matt DeVillier
7ee4a11d1b Add new board: Purism Librem Mini v2
Add board config, coreboot config, Circle CI entry.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-11-19 15:39:44 -05:00
Matt DeVillier
9d14a286f3 configs/coreboot-librem_mini: update blob paths
Update blob paths to match submodule layout

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-11-19 15:39:44 -05:00
Matt DeVillier
1241f9714f modules/purism-blobs: Update module pointer and hash
Update purism-blobs for Librem Mini v2 release

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-11-19 15:39:44 -05:00
Matt DeVillier
85f52e7c7d patches/coreboot-4.12: Add support to coreboot for Librem Mini v2
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-11-19 15:39:44 -05:00
Matt DeVillier
904b64db93 patches/coreboot-4.12: Add patches to update Librem Mini
Combination of commits from upstream coreboot master backported to
coreboot 4.12 (tag) to improve performance/functionality, and
prepare for addition of Librem Mini v2.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-11-19 15:39:44 -05:00
Matt DeVillier
acd9d258b8 patches/coreboot-4.12: Add patch for cbmem alignment
Cherry-pick of commit 3dea2b63eeb8f97b31571f6f0eb37f38f9967b6b
[soc/intel/common/block/systemagent/memmap.c: Align cached region]
from upstream coreboot.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-11-19 15:39:44 -05:00
Matt DeVillier
561452508b boards/librem*: enable automatic booting
Add CONFIG_AUTO_BOOT_TIMEOUT=5 to Librem board configs, to
enable automatic booting of default boot target after successful
HOTP verifcation via a Librem Key

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-11-09 22:26:50 -05:00
Matt DeVillier
055165d61a gui-init: add support for auto-booting default target
if CONFIG_AUTO_BOOT_TIMEOUT exists and is set, and if HOTP
validation was successful, then attempt to boot the default
target after CONFIG_AUTO_BOOT_TIMEOUT seconds if not interrupted
by key press

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-11-09 22:26:50 -05:00
Thierry Laurion
89c457706f coreboot configs: remove CONFIG_LOCALVERSION artifacts in conformity of bd7a945bbb 2020-11-06 15:24:13 -05:00
Matt DeVillier
f445b29dbe kexec-sign-config: fix args to getopts
The -u arg does not take a parameter, so remove the trailing colon.

Fixes /boot hashes not being updated when update_checksums() is called.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-11-06 15:16:29 -05:00
Thierry Laurion
b94edd1d6c qemu-coreboot-fbwhiptail board: coreboot config CBFS region upgraded to 7.5mb to not fail CI 2020-11-05 18:14:42 -05:00
amaloteaux
3f3d24db6b fix t420 flashrom options 2020-11-04 13:13:19 -05:00
Thierry Laurion
9395f91d02 CircleCI seperation of main failed error and detailed logs of last minute + qemu-coreboot-fbwhiptail board addition 2020-11-03 14:26:47 -05:00
tlaurion
fb60f2f32e
Merge pull request #882 from Thrilleratplay/master
fix(config-qemu-fbwhiptail): update CONFIG_CBFS_SIZE
2020-11-01 22:55:04 -05:00
Tom Hiller
b055a3be1c fix(config-qemu-fbwhiptail): update CONFIG_CBFS_SIZE 2020-11-01 15:38:38 -05:00
Matt DeVillier
e7faac20db oem-factory-reset: Allow use without an installed OS
If an installed OS is not detected, then skip setting the
default boot device or generating /boot checksums.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 18:01:42 -04:00
Matt DeVillier
1fc123df4a gui-init: improve handling of blank/missing disk
Check for presence of CONFIG_BOOT_DEV, and if missing or
unable to be mounted, present the user with a menu offering the
option to select another disk, boot from USB, continue to
main menu, or drop to a recovery shell.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 18:01:42 -04:00
Matt DeVillier
6a3bb5897a Drop duplicate board-specific background color configs
Set and export currently-used defaults in gui-init, but still
allow for inidividual boards to override via config if desired.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
95442dccd4 flash-gui: improve readability of ROM filename
Strip the path prefix from the ROM filename, and place on own
line to prevent truncation with long filenames / narrow screens.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
755e9787a7 gui-init: add board name, kernel version to System Info
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
6df281813f Specify 'friendly' board name vs overriding CONFIG_BOOT_GUI_MENU_NAME
This will allow it to be used elsewhere within the UI.
Rename CONFIG_BOOT_GUI_MENU_NAME to better indicate use/function.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
8b3b8cedb5 gui_init: use consistent notation for main menu
sed -i 's/default boot menu/main menu/g'

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
998dc684f1 gpg_gui: use 'and' vs '+' in menu listings
Using words is more explicit and clear here rather than symbols.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
cd6ba01429 boards/x220: update flashrom parameters
Force use of hardware sequencing for internal flashing to avoid
needing to specify the chip to be flashed.

Addresses #870

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 10:47:08 -04:00
tlaurion
e3519f2ecd
WiP: gpg2 2.21 LTS upgrade (gnupg toolstack) (#860)
* gpg2: change gpg2 toolstack to gpg2 2.21 LTS
* remove additional gpg2 unneeded configure options across gpg2 toolstack dependencies
2020-10-26 10:19:57 -04:00
MrChromebox
b71f3757c1
modules/linux: add support for building with kernel 5.4.69 (#854)
* modules/linux: add support for building with kernel 5.4.69

Add support to module, port patches from 4.19.139.
Needed for newer platforms not supported by 4.19 kernel.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* CircleCI: add rysnc dependency for building kernel 5.x

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Migrate all Librem boards to kernel 5.x, common config

Update linux-librem_common.config from 4.x to 5.x, and add
CONFIG items needed to support the librem_l1um (AST DRM drivers,
serial port output).

Tested on Librem 13v4, Librem Mini, and Librem Server L1UM.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-25 01:26:08 -04:00
MrChromebox
d398a4e440
configs/coreboot-librem_l1um: drop CONFIG_LOCALVERSION (#866)
PR #859 should have included this after #858 was merged,
but was missed

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-21 18:06:03 -04:00
MrChromebox
bd7a945bbb
Inject Heads version string into coreboot LOCALVERSION... (#859)
* config/coreboot-*: drop CONFIG_LOCALVERSION
Will be injected as part of the build using $(HEADS_GIT_VERSION)
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* modules/coreboot: inject $(HEADS_GIT_VERSION) as CONFIG_LOCALVERSION
Needed for fwupd to handle board updates
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* modules/coreboot: override SMBIOS ProductName with $(BOARD)
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Use $(BOARD)-$(HEADS_GIT_VERSION) as basis for output filename
makes builds uniquely identifiable based on board and version.
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-21 11:04:27 -04:00
tlaurion
b3d01c1962
GitlabCI: remove .gitlab-ci.yml (backup present under .gitlab-ci.yml.deprecated) (#865) 2020-10-21 10:53:28 -04:00
tlaurion
99c309026d
GitlabCI now deprecated. For details and failed experiments, see https://github.com/osresearch/heads/pull/851 (#864) 2020-10-20 19:33:42 -04:00
MrChromebox
1e5a08fa78
Librem Mini: increase size of CBFS (#863)
Increase size of CBFS to 0xC00000 (from 0x800000) to accomodate
newer/larger kernels.

Update purism-blobs module so an update/modified IFD and smaller
ME blob are used.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-20 18:20:55 -04:00
tlaurion
30852aa273
xx30 boards: suspend/resume fix (#838)
* x230-hotp-verification: revert to coreboot "CONFIG_CBFS_SIZE=0x700000" by disabling board "CONFIG_DROPBEAR=y" and "CONFIG_LINUX_E1000E" to save space per @alex-nitrokey test under #770 to fix #608
* x230-htop-verification board: add clarifications on x230 board differences. Fixes #737 #770 #608
* X230 board & coreboot config: Fix x230 board, removing dropbear and e1000e driver.
* t430: board and coreboot config par with x230 to circumvent CBFS linked suspend/resume issues.
2020-10-19 12:50:24 -04:00
Markus Meissner
09ca500d3e
add x230-nkstorecli board config (#817)
* add x230-nkstorecli board; 
* add modules: nkstorecli, libnk, libhidapi-libusb
* version bump nkstorecli; related minor in libnk
* upd. libnk module version bump to 3.6; remove 3.5 patch
2020-10-19 10:47:22 -04:00
MrChromebox
85d7e29d18
Add new board: Purism Librem Server L1UM (#858)
* modules/coreboot: add option to use coreboot 4.11

Port patches from coreboot 4.8.1 to 4.11:
* 0000-measure-boot -> 0001
* 0010-cross-compiler-support

All other patches for coreboot 4.8.1 have either already been
integrated, or are for platforms which do not need to be migrated
to coreboot 4.11 (they will move to 4.12 or newer).

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add Broadwell-DE platform patch

Add a patch for FSP Broadwell-DE to make use of Heads' measured boot.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add patch to read serial # from CBFS

Will be used by multiple Librem boards.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: add board support for Librem Server L1UM

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Librem Server L1UM: add new board

Add board config, coreboot config, kernel config files.
Add conditional purism-blobs dependency to coreboot-4.11 module.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* flash.sh: add special handling for librem_l1um board

Add support for persisting PCIe config via PCHSTRP9 in flash descriptor.
This is needed to support multiple variants of the L1UM server which
use the same firmware but differ in PCIe lane configuration via the
PCH straps configuration in the flash descriptor.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add 'Use PRIxPTR to print uintptr_t' patch

Cherry-picked from upstream coreboot (post-4.11), fixes compilation issue.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* CircleCI: add target to build board librem_l1um

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-18 14:48:25 -04:00
Tom Hiller
636e40456e
fix: update chesksums of filenames with spaces (#847)
Signed-off-by: Tom Hiller <thrilleratplay@gmail.com>
2020-10-18 14:46:57 -04:00
MrChromebox
3c24460f1a
modules/flashrom: update to add support for Comet Lake-U (#855)
Update to upstream flashrom (post v1.2) commit 4d3657b4:
Add support for Comet Lake-U/400-series PCH

kgpe-d16 patch from flashrom 1.2 still applies cleanly.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-18 10:17:34 -04:00