Commit Graph

25 Commits

Author SHA1 Message Date
Thierry Laurion
c63114710e coreboot patches: remove lib/jpeg patches for heap increase and alloc failure. Add https://review.coreboot.org/c/coreboot/+/83895
Repro:
rm patches/coreboot-24.02.01/0001* patches/coreboot-24.02.01/0002*
git fetch https://review.coreboot.org/coreboot refs/changes/94/83894/2 && git format-patch -1 --stdout FETCH_HEAD > patches/coreboot-24.02.01/0001-vc_wuffs-upgrade-to-Wuffs_0.4.0-alpha.8.patch
git fetch https://review.coreboot.org/coreboot refs/changes/95/83895/3 && git format-patch -1 --stdout FETCH_HEAD > patches/coreboot-24.02.01/0002-lib_jpeg-avoidcalling-malloc-and-free.patch
sed -i 's/CONFIG_HEAP_SIZE=0x400000/CONFIG_HEAP_SIZE=0x100000/g' config/coreboot-*

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-10-30 13:57:10 -04:00
Thierry Laurion
e6382176a0
coreboot 24.02.01: redo save in oldconfig with patch for sandy/ivy/haswell: configs updated
repro saving all boards configs to oldconfig
grep -R CONFIG_COREBOOT_VERSION boards/ | awk -F "/" {'print $2'} | while read board; do if ! sudo make BOARD=$board coreboot.save_in_oldconfig_format_in_place  > /dev/null 2>&1; then echo $board failed;fi; done

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-08-05 05:42:12 -04:00
Thierry Laurion
a9e6dfe851
config/coreboot-*: Turn off WIFI support in coreboot. If regression, will turn on case by case.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-26 17:39:18 -04:00
Thierry Laurion
acc6493492
coreboot configs: unify turning CONFIG_USBDEBUG off
sed -i '$a CONFIG_USBDEBUG=n' config/coreboot-*.config
grep -R CONFIG_COREBOOT_VERSION boards/ | awk -F "/" {'print $2'} | while read board; do if ! sudo make BOARD=$board coreboot.save_in_oldconfig_format_in_place  > /dev/null 2>&1; then echo $board failed;fi; done

Note:
Boards that are unmaintained accumulates settings addition per the sed call.

Why deactivate:
- Well, this is equivalent of cbmem -c which gives way too much information from attacker.

TODO: add an helper later on so that builds aimed at testing coreboot version bump pass to release mode or something.

As of this commit, we accept that bricks might happen and that troubleshooting will be made in a case basis?!

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-26 15:39:58 -04:00
Thierry Laurion
df1e6d7540
coreboot configs: put back all maintained boards (boards/*)'s coreboot configs in oldconfig format
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-26 15:39:40 -04:00
Thierry Laurion
296772a628
coreboot configs: add CONFIG_DRIVERS_INTEL_WIFI
This is needed so that ACPI tables are generated from coreboot for final OS to not apply quirks to support wifi cards

TODO: bluethooth not activated here, maybe we should.

sed -i '/# CONFIG_DRIVERS_INTEL_WIFI is not set/d' config/coreboot-*.config

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-26 15:39:34 -04:00
Thierry Laurion
446c98a3f8
coreboot configs: add CONFIG_USBDEBUG
sed -i '$a CONFIG_USBDEBUG=y' config/coreboot-*.config
grep -R CONFIG_COREBOOT_VERSION boards/ | awk -F "/" {'print $2'} | while read board; do if ! sudo make BOARD=$board coreboot.save_in_defconfig_format_in_place > /dev/null 2>&1; then echo $board failed;fi; done

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-26 15:39:28 -04:00
Thierry Laurion
d44fe53731
coreboot configs: add CONFIG_RESOURCE_ALLOCATION_TOP_DOWN
sed -i '/# CONFIG_RESOURCE_ALLOCATION_TOP_DOWN is not set/d' config/*.config

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-26 15:39:22 -04:00
Thierry Laurion
88cec3ab87
coreboot configs: put in defconfig to ease comparison and unification of configs
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-26 15:39:10 -04:00
Thierry Laurion
6e237d9edd
config/coreboot*: save new coreboot 24.02.01 coreboot configs in oldconfig (see new defaults from 4.22.01)
grep -R 24.02.01 boards/ | awk -F "/" {'print $2'} | while read board; do sudo make BOARD=$board coreboot.save_in_oldconfig_format_in_place; done

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-26 15:36:02 -04:00
Thierry Laurion
119cebc44f
coreboot 24.02.01: add upstream pending patches for heap allocation failure on bootsplash and defaulting to 4mb of heap when bootsplash
Add upstreeam patches to downstream:
git fetch https://review.coreboot.org/coreboot refs/changes/75/83475/1 && git format-patch -1 --stdout FETCH_HEAD > 0001-prevent_bootsplash_heap_allocation_failure_to_booting.patch
git fetch https://review.coreboot.org/coreboot refs/changes/76/83476/2 && git format-patch -1 --stdout FETCH_HEAD > 0002-increase_heap_from1mb_to4mb_when_bootpslash_enabled.patch

Rebuilding coreboot version with patches applied:
docker run -e DISPLAY=$DISPLAY --network host --rm -ti -v $(pwd):$(pwd) -w $(pwd) tlaurion/heads-dev-env:v0.2.0 -- make BOARD=qemu-coreboot-whiptail-tpm1 real.remove_canary_files-extract_patch_rebuild_what_changed
Remove file added by patch when patching fails:
sudo rm build/x86/libgpg-error-1.46/src/syscfg/lock-obj-pub.powerpc64le-unknown-linux-musl.h

Applying patches touching coreboot version 24.02.01 defiend in board config to all boards:
grep -R 24.02.01 boards/ | awk -F "/" {'print $2'} | while read board; do sudo make BOARD=$board coreboot.save_in_oldconfig_format_in_place; done

Adding added/modified files to git tracked files for commit:
git status | grep -e modified -e added | awk -F ":" {'print $2'}| xargs git add

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-07-26 15:35:44 -04:00
Thierry Laurion
b91eaeda97
boards aimed to bump at coreboot 4.22.01: switch TPM event log format to TCG
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-03-25 15:16:03 -04:00
Thierry Laurion
fb616f416a
WiP 4.22.01 fhd patch test + bump all 4.19 boards to 4.22.01
- patches/coreboot-4.22.01/0001-x230-fhd-variant.patch created per
  - git fetch https://review.coreboot.org/coreboot refs/changes/50/28950/23 && git format-patch -1 --stdout FETCH_HEAD > ~/heads/patches/coreboot-4.22.01/0001-x230-fhd-variant.patch
- all boards configs bumped with:
  - grep -Rn 4.22 boards/ | awk -F "/" {'print $2'}| while read line; do make BOARD=$line coreboot.save_in_oldconfig_format_in_place ; done

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-03-25 15:14:42 -04:00
Thierry Laurion
0f0cb99a02
Adapt NV41/NS50 changes, unify bootsplash file usage for branding
Taken from : https://github.com/Nitrokey/heads/tree/temp-release-v2.3

- Move branding/Heads/bootsplash-1024x768.jpg -> branding/Heads/bootsplash.jpg (We don't care about the size. Make filename generic)
- Adapt all coreboot configs so bootsplash is adapted by BRAND_NAME CONFIG_BOOTSPLASH_FILE="@BRAND_DIR@/bootsplash.jpg"
  - Reminders :
    - Makefile changes Heads to defined BRAND_NAME in board config
    - Makefile changes -e 's!@BRAND_DIR@!$(pwd)/branding/$(BRAND_NAME)!g'
- nv41/nv50
  - coreboot oldefconfigs adapted by:
    - make BOARD=nitropad-ns50 coreboot.modify_and_save_oldconfig_in_place
    - make BOARD=nitropad-nv41 coreboot.modify_and_save_oldconfig_in_place
  - linux oldefconfigs adapted by
    - make BOARD=nitropad-nv41 linux.modify_and_save_oldconfig_in_place
      - since this is shared config across nv41/ns50: it only needs to be done for a single board

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-20 09:40:52 -05:00
Thierry Laurion
f4a5a7cc10
FB_EFI next step: remove coreboot's Heads linux intel_iommu statements. TODO: check linux config to see if enabling automatically works as expected.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-20 09:40:42 -05:00
Thierry Laurion
5f38c715ce
coreboot config: unify quiet loglevel=2 for boards not defining default loglevel 2023-10-10 11:53:35 -04:00
d-wid
2bfa1737f8
Support branding under branding subdirectories
Squash of #1502 + moving logo/bootsplash files under branding/Heads

- Move logos and bootsplashes from blobs to branding/Heads/
- Makefile: add support for BRAND_DIR which depends on BRAND_NAME which defaults to Heads if no branding
- Boards coreboot configs: change bootsplash directory to depend on BRAND_DIR (instead of BLOBS_DIR) in bootsplash enabled configs
- Branding/Heads/bootsplash-1024x768.jpg points to branding/Heads/d-wid-ThePlexus_coreboot-linuxboot-heads_background-plain_DonateQrCode.jpg
- xcf file deleted. Original still under #1502 to reuse for modification without recompressing (blobs/heads.xcf)
- CREDITS file created to point to original authors, remixers (Open for details)
  - Thanks to: @d-wid for remixing Bing's AI generated Janus logo, @ThePlexus for Qubes Box concept and @ThrillerAtPlay for its matrix background
2023-10-06 17:09:23 -04:00
Thierry Laurion
8c366ef61d
coreboot configs: changeset needed to use efifb
- intel igpu related - remove i915drmfb hacks and use simplefb and libgfxinit enabled fb
- coreboot 4.19: add patch to fix https://ticket.coreboot.org/issues/500. fbwhiptail still tears screen if in native 1366x769 though
- coreboot 4.19: add patch to enable linux tampoline handle coreboot framebuffer (merged https://review.coreboot.org/c/coreboot/+/76431)
- coreboot 4.19: add patch to enable coreboot to apply jpeg voodoo to create bootsplash.jpeg injected in cbfs at build time + CircleCI apt imagemagick
  - (Thanks Nico Huber @icon again for above patches!)
- coreboot configs: adapt VESAFB/LIBGFXINIT to use maximum fb height/width
- coreboot configs for iGPU only: CONFIG_LINEAR_FRAMEBUFFER_MAX_HEIGHT CONFIG_LINEAR_FRAMEBUFFER_MAX_WIDTH to native size
- coreboot configs for dGPU based on Optional VBIOS injected: VESAFB set to 1280x1024 (maximum possible).

Details:
coreboot configs: remove CONFIG_LINUX_COMMAND_LINE="drm_kms_helper.drm_leak_fbdev_smem=1 i915.enable_fbc=0"
 - Those were needed to expose i915drmfb driver prior of efifb working.
2023-08-16 09:39:09 -04:00
Thierry Laurion
14e7a76aaa
coreboot config: correct CONFIG_INTEL_CHIPSET_LOCKDOWN behavior to make sure none locks 2023-06-27 11:21:41 -04:00
Thierry Laurion
5710eafde4
coreboot configs: sandy/ivy/haswell : readd libgfxinit and bootsplash requirements
Remove CONFIG_NO_GFX_INIT from configs having CONFIG_NORTHBRIDGE_INTEL_SANDYBRIDGE=y
Add CONFIG_BOOTSPLASH_IMAGE from configs having CONFIG_NORTHBRIDGE_INTEL_SANDYBRIDGE=y
Add CONFIG_LINEAR_FRAMEBUFFER from configs having CONFIG_NORTHBRIDGE_INTEL_SANDYBRIDGE=y
Set BOOTSPLASH parameters to match bootsplash and jpeg requirements
 +CONFIG_LINEAR_FRAMEBUFFER_MAX_HEIGHT=768
 +CONFIG_LINEAR_FRAMEBUFFER_MAX_WIDTH=1024
 +CONFIG_BOOTSPLASH=y

Others paramaters defined per board default setting with coreboot.save_oldconfig_in_place helper
2023-06-27 11:21:25 -04:00
Thierry Laurion
f34d2dd7d7
bump qemu-tpm boards to coreboot 4.19 2023-06-27 11:21:09 -04:00
Thierry Laurion
f2d0a6a9c6
config/coreboot-* : adapt i915drmfb driven boards framebuffer requirements
- add additional kernel boot params for i915 where needed:
  - adds : drm_kms_helper.drm_leak_fbdev_smem=1 i915.enable_fbc=0 ( to permit kexec into vesa fb of kexec'ed kernel for i915 driven gpus without framebuffer compression, leaking smem fbdev address for kexec to pickup )
2023-06-27 11:20:52 -04:00
Thierry Laurion
9830c6c4ed
io386 platform lockdown: enable on sandy/ivy/haswell maximized board configs 2023-06-20 12:36:45 -04:00
Thierry Laurion
e7f1e3e7a7
xx20/xx30 maximized coreboot configs: Fix CONFIG_CBFS_SIZE to reflect ifd.bin's BIOS regions.
The calculations outlined at https://github.com/osresearch/heads/pull/1282#discussion_r1072473677
Sums to having 'ifdtool -f layout.txt ifd_shrinked.bin && cat layout.txt'
The example for T440p:
00000000:00000fff fd
00021000:00bfffff bios
00003000:00020fff me
00001000:00002fff gbe

Here: 00bfffff-00021000=BDEFFF
Which is exact result of @rbeslow's calculations.

There is an issue on haswell, maybe because of car, maybe because of non native memory init blob.
But this is not the case for xx20/xx30 boards.
2023-02-09 12:28:59 -05:00
Thierry Laurion
2b05a6b42c
Add x230-maximized-fhd_edp and x230-hotp-maximized-fhd_edp boards
- add x230-maximized-fhd_edp and x230-hotp-maximized-fhd_edp board configs
- add/rework coreboot patch for x230 fhd variant to be applied on top of 4.13
- add coreboot config to point to x230-edp variant, fixing path to vbt file since default path is wrong under. Comment made upstream https://review.coreboot.org/c/coreboot/+/28950/22#message-4904ce82f01ba0505b391e072e4537b6a9f1a229
  - remove no gfx init and replace with libgfxinit(defonfig default), set internal display as default
- add x230-hotp-maximized-fhd_edp and x230-maximized-fhd_edp to CircleCI builds
- One single shared coreboot config between boards/x230-hotp-maximized-fhd_edp/x230-hotp-maximized-fhd_edp.config and boards/x230-maximized-fhd_edp/x230-maximized-fhd_edp.config
- Coreboot 4.13 patch from coreboot at patches/coreboot-4.13/0002-x230-fhd-variant.patch
- config/coreboot-x230-maximized-fhd_edp.config points to seperate coreboot config per patch (CONFIG_BOARD_LENOVO_X230_EDP)
2023-01-31 09:58:43 -05:00