[WIP] Make X230 and T430 use a universal flash-stage init #828

snmcmillan · 2020-09-04T19:10:59Z

Let's try #579 again, this time with less broke.

This will replace separate $CONFIG_BOARD-flash.init files with a single flash.init file to reduce the clutter in the heads initrd and streamline the xx30 ThinkPads.

Affected boards at this time are T430 and X230. Testing has yet to be done on X230 or T430. I'll test on X230 when I can get a system that can actually build heads (Debian Sid is not able to build heads currently).

@flawedworld can you test to make sure t430-flash is still working as intended?

Changing the default boot was failing because remove the old entries did not work as `rm "/some/path/*.txt"` does not work as intended, e.g. the asterisk is no catch-all.

Remove quotes to fix use of asterisk in command

…on (fixes linuxboot#668) (linuxboot#811) Signed-off-by: Nathan Rennie-Waldock <nathan.renniewaldock@gmail.com>

modules/flashtools: bring par to upstream flashtools.

* CircleCI: readd librem_mini while making sure that if a board build fails, all logfile modified in the last minute are outputted on the CircleCI console prior to really failing and exiting * librem_mini-NoTPM: addition of board config, distinctive coreboot config (required per Heads build system) to construct a ROM without TPM requirement. * librem_mini: deletion of board and coreboot relative config, keeping librem_mini-NoTPM and coreboot config only. Removed librem_mini board build under CircleCI, keeping only librem_mini-NoTPM

Currently, exiting the recovery shell results in a kernel panic, necessitating a hard reset / power cycle. As this is less than ideal, drop the exec and add a loop to restart the shell. Addresses issue linuxboot#833 Tested under qemu-coreboot-fbwhiptail Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

…to be used if desired, else the default is detected in Makefile and pushed to submodules. If nothing specified, uses nproc and pass it to submodules. CircleCI forced to CPUS=2

…reads/memory is 1/1024Mb, CircleCI supposedly reserving 4Gb for medium (free). Build time will increase, unfortunately, when compared to nproc returning 32 cores.

…oot 4.12 built boards currently failing for lack of memory in other builds (make error 137).

Add 'CPUS' as make BOARD=X argument

There's only one Librem Mini board, it doesn't use a TPM, no reason to unnecesarily lengthen the board name. Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.12: add cross-compiler support patch Ported from coreboot-4.8.1, re-exported via `git diff` Signed-off-by: Matt DeVillier <matt.devillier@puri.sm> * modules/coreboot: use musl-cross-make to build revert toolchain bits to pre-4.12 addition Signed-off-by: Matt DeVillier <matt.devillier@puri.sm> * config/coreboot-librem_mini: use CONFIG_ANY_TOOLCHAIN Needed since coreboot 4.12 now built with musl-cross-make Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

…Millan/heads into universal-flash-init

tlaurion · 2020-10-18T13:22:21Z

@SebastianMcMillan this PR is not clean :)

git fetch osresearch
git checkout osresearch/master
git reset --hard
git branch -D universal-flash-init
git checkout universal-flash-init

Verify following patch which from what I understood should touch only 3 files, put it under ./heads/seb.patch:

diff --git a/boards/t430-flash/t430-flash.config b/boards/t430-flash/t430-flash.config
index 43be7cb..4c92ab2 100644
--- a/boards/t430-flash/t430-flash.config
+++ b/boards/t430-flash/t430-flash.config
@@ -13,7 +13,7 @@ CONFIG_LINUX_CONFIG=config/linux-x230-flash.config
 CONFIG_LINUX_USB=y
 CONFIG_LINUX_E1000E=y
 
-export CONFIG_BOOTSCRIPT=/bin/t430-flash.init
+export CONFIG_BOOTSCRIPT=/bin/flash.init
 export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal --ifd --image bios"
 
 # This board is "special" in that we only want the top 4 MB of the ROM
diff --git a/boards/x230-flash/x230-flash.config b/boards/x230-flash/x230-flash.config
index edb417e..39c8db7 100644
--- a/boards/x230-flash/x230-flash.config
+++ b/boards/x230-flash/x230-flash.config
@@ -18,7 +18,7 @@ CONFIG_LINUX_CONFIG=config/linux-x230-flash.config
 CONFIG_LINUX_USB=y
 CONFIG_LINUX_E1000E=y
 
-export CONFIG_BOOTSCRIPT=/bin/x230-flash.init
+export CONFIG_BOOTSCRIPT=/bin/flash.init
 export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal --ifd --image bios"
 
 # This board is "special" in that we only want the top 4 MB of the ROM
diff --git a/initrd/bin/t430-flash.init b/initrd/bin/flash.init
similarity index 92%
rename from initrd/bin/t430-flash.init
rename to initrd/bin/flash.init
index 9b97970..a115e74 100755
--- a/initrd/bin/t430-flash.init
+++ b/initrd/bin/flash.init
@@ -20,7 +20,7 @@ echo ''
 echo 'To install from flash drive:'
 echo ''
 echo '  mount -o ro /dev/sdb1 /media'
-echo '  flash.sh /media/t430.rom'
+echo '  flash.sh /media/$CONFIG_BOARD.rom'
 echo ''
 
 exec /bin/ash
 
diff --git a/initrd/bin/x230-flash.init b/initrd/bin/x230-flash.init
deleted file mode 100755
index 0ba456f..0000000
--- a/initrd/bin/x230-flash.init
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/bin/sh
-# Initialize the USB and network device drivers,
-# invoke a recovery shell and prompt the user for how to proceed
-
-. /etc/functions
-. /tmp/config
-
-insmod /lib/modules/ehci-hcd.ko
-insmod /lib/modules/ehci-pci.ko
-insmod /lib/modules/xhci-hcd.ko
-insmod /lib/modules/xhci-pci.ko
-insmod /lib/modules/e1000e.ko
-insmod /lib/modules/usb-storage.ko
-
-tpm extend -ix 4 -ic recovery
-sleep 2
-
-echo '***** Starting recovery shell'
-echo ''
-echo 'To install from flash drive:'
-echo ''
-echo '  mount -o ro /dev/sdb1 /media'
-echo '  flash.sh /media/x230.rom'
-echo ''
-
-exec /bin/ash

Then apply it on top of clean master:
patch -p1 < seb.patch

git add, git commit
the force update of your original PR with same branch name:
git push --force seb-github

tlaurion · 2020-10-18T13:29:54Z

On a side note, i'm not sure how this universal flash script should pick up usb devices if the modules are not loaded prior of calling flash.sh script?


-. /etc/functions
-. /tmp/config
-
-insmod /lib/modules/ehci-hcd.ko
-insmod /lib/modules/ehci-pci.ko
-insmod /lib/modules/xhci-hcd.ko
-insmod /lib/modules/xhci-pci.ko
-insmod /lib/modules/usb-storage.ko

Here, insmod is a bash wrapper defined under functions which modified PCR with module hash prior of really insmod module, invalidating measurements so secret can't be released. It is impossible to mount /dev/sdb1 if usb-storage is not present, which depends on USB dev types, made avail by insmodding EHCI, XHCI, then usb-storage.

mount-usb takes care of that altogether, I thin (not tested in flash env, but should) while calling recovery if ./etc/functions is imported should also take care of modifying additional PCR to say we are in recovery, nor in normal boot, modifying measurements.

I think the same logic should be the same everywhere so people get how Heads work, else confusion arises on internal security mechanisms and their applications.

snmcmillan · 2020-10-18T20:18:16Z

I can fix the USB mounting as well. The flash.init is completely unchanged other than it being board-agnostic currently.

…

On Sun, Oct 18, 2020, 08:22 tlaurion ***@***.***> wrote: @SebastianMcMillan <https://github.com/SebastianMcMillan> this PR is not clean :) git fetch osresearch git checkout osresearch/master git reset --hard git branch -D universal-flash-init git checkout universal-flash-init Verify following patch which from what I understood should touch only 3 files, put it under ./heads/seb.patch: diff --git a/boards/t430-flash/t430-flash.config b/boards/t430-flash/t430-flash.config index 43be7cb..4c92ab2 100644 --- a/boards/t430-flash/t430-flash.config +++ b/boards/t430-flash/t430-flash.config @@ -13,7 +13,7 @@ CONFIG_LINUX_CONFIG=config/linux-x230-flash.config CONFIG_LINUX_USB=y CONFIG_LINUX_E1000E=y -export CONFIG_BOOTSCRIPT=/bin/t430-flash.init +export CONFIG_BOOTSCRIPT=/bin/flash.init export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal --ifd --image bios" # This board is "special" in that we only want the top 4 MB of the ROM diff --git a/boards/x230-flash/x230-flash.config b/boards/x230-flash/x230-flash.config index edb417e..39c8db7 100644 --- a/boards/x230-flash/x230-flash.config +++ b/boards/x230-flash/x230-flash.config @@ -18,7 +18,7 @@ CONFIG_LINUX_CONFIG=config/linux-x230-flash.config CONFIG_LINUX_USB=y CONFIG_LINUX_E1000E=y -export CONFIG_BOOTSCRIPT=/bin/x230-flash.init +export CONFIG_BOOTSCRIPT=/bin/flash.init export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal --ifd --image bios" # This board is "special" in that we only want the top 4 MB of the ROM diff --git a/initrd/bin/t430-flash.init b/initrd/bin/flash.init similarity index 92% rename from initrd/bin/t430-flash.init rename to initrd/bin/flash.init index 9b97970..a115e74 100755 --- a/initrd/bin/t430-flash.init +++ b/initrd/bin/flash.init @@ -20,7 +20,7 @@ echo '' echo 'To install from flash drive:' echo '' echo ' mount -o ro /dev/sdb1 /media' -echo ' flash.sh /media/t430.rom' +echo ' flash.sh /media/$CONFIG_BOARD.rom' echo '' exec /bin/ash diff --git a/initrd/bin/x230-flash.init b/initrd/bin/x230-flash.init deleted file mode 100755 index 0ba456f..0000000 --- a/initrd/bin/x230-flash.init +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/sh -# Initialize the USB and network device drivers, -# invoke a recovery shell and prompt the user for how to proceed - -. /etc/functions -. /tmp/config - -insmod /lib/modules/ehci-hcd.ko -insmod /lib/modules/ehci-pci.ko -insmod /lib/modules/xhci-hcd.ko -insmod /lib/modules/xhci-pci.ko -insmod /lib/modules/e1000e.ko -insmod /lib/modules/usb-storage.ko - -tpm extend -ix 4 -ic recovery -sleep 2 - -echo '***** Starting recovery shell' -echo '' -echo 'To install from flash drive:' -echo '' -echo ' mount -o ro /dev/sdb1 /media' -echo ' flash.sh /media/x230.rom' -echo '' - -exec /bin/ash Then apply it on top of clean master: patch -p1 < seb.patch git add, git commit the force update of your original PR with same branch name: git push --force seb-github — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#828 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFNTUNEQPS2AQ6NYPDGDA73SLLTZTANCNFSM4QZFPZ4A> .

tlaurion · 2020-12-02T23:12:39Z

@SebastianMcMillan needs clean rebase, contains a lot of unrelated changes.

tlaurion · 2023-06-25T17:03:10Z

Implemented at 30963e1

alex-nitrokey and others added 6 commits August 26, 2020 13:21

Remove quotes to fix use of asterisk in command

c7085d8

Changing the default boot was failing because remove the old entries did not work as `rm "/some/path/*.txt"` does not work as intended, e.g. the asterisk is no catch-all.

Make X230 and T430 use a universal flash-stage init

c08da4b

Merge pull request linuxboot#812 from Nitrokey/default_boot

c096a1f

Remove quotes to fix use of asterisk in command

modules/flashtools: bring par to upstream flashtools.

4d72869

Add gawk module to use if the host is running a different major versi…

7ce12fe

…on (fixes linuxboot#668) (linuxboot#811) Signed-off-by: Nathan Rennie-Waldock <nathan.renniewaldock@gmail.com>

Merge pull request linuxboot#829 from tlaurion/flashtools_par_upstream

51fd3b3

modules/flashtools: bring par to upstream flashtools.

snmcmillan changed the title ~~Make X230 and T430 use a universal flash-stage init~~ [WIP] Make X230 and T430 use a universal flash-stage init Sep 9, 2020

tlaurion and others added 10 commits September 15, 2020 10:51

Buildsystem: permit to pass CPUS=X to make to force a number of CPUS …

c745640

…to be used if desired, else the default is detected in Makefile and pushed to submodules. If nothing specified, uses nproc and pass it to submodules. CircleCI forced to CPUS=2

CircleCI: we pass CPUS=2 to CPUS=4 since the logic calculation for th…

c474257

…reads/memory is 1/1024Mb, CircleCI supposedly reserving 4Gb for medium (free). Build time will increase, unfortunately, when compared to nproc returning 32 cores.

CircleCI: changing order of build boards, since we want to test coreb…

e3c81a9

…oot 4.12 built boards currently failing for lack of memory in other builds (make error 137).

Merge pull request linuxboot#842 from tlaurion/CPUS_as_make_argument

f009acb

Add 'CPUS' as make BOARD=X argument

librem_mini-NoTPM: drop '-noTPM' suffix (linuxboot#843)

afa6753

There's only one Librem Mini board, it doesn't use a TPM, no reason to unnecesarily lengthen the board name. Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

Make X230 and T430 use a universal flash-stage init

60bcf10

Merge branch 'universal-flash-init' of https://github.com/SebastianMc…

05b76ed

…Millan/heads into universal-flash-init

tlaurion closed this Jun 25, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] Make X230 and T430 use a universal flash-stage init #828

[WIP] Make X230 and T430 use a universal flash-stage init #828

snmcmillan commented Sep 4, 2020 •

edited

Loading

tlaurion commented Oct 18, 2020

tlaurion commented Oct 18, 2020

snmcmillan commented Oct 18, 2020 via email

tlaurion commented Dec 2, 2020

tlaurion commented Jun 25, 2023

[WIP] Make X230 and T430 use a universal flash-stage init #828

[WIP] Make X230 and T430 use a universal flash-stage init #828

Conversation

snmcmillan commented Sep 4, 2020 • edited Loading

tlaurion commented Oct 18, 2020

tlaurion commented Oct 18, 2020

snmcmillan commented Oct 18, 2020 via email

tlaurion commented Dec 2, 2020

tlaurion commented Jun 25, 2023

snmcmillan commented Sep 4, 2020 •

edited

Loading