Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

migrate all commmunity supported boards to coreboot 4.13 (Except KGPE-D16 which stays to coreboot 4.11) #1015

Merged
merged 16 commits into from
Dec 4, 2021

Conversation

tlaurion
Copy link
Collaborator

@tlaurion tlaurion commented Jul 26, 2021

ROMS to be tested by board owners

#1015 (comment)

History

Supersedes

Still unanswered and needs testing and confirmation of need (@daringer @jans23 @alex-nitrokey ?)

Includes (will rebase once merged)

Bug fixes needed to install QubesOS 4.1 from verified ISO under Heads (a dd'ed ISO over USB will boot and install from boot from USB menu)

Todos:

  • Review results of with/without blobs set for xx20 and xx30 boards

Before merging

ROM testing (needs feedback)

Per commited users

Rom testing needing users to stand up:

Reduce/synthetise

  • commits and associated comments if requested.

@tlaurion tlaurion marked this pull request as draft July 26, 2021 16:28
@tlaurion tlaurion force-pushed the maximized_boards-coreboot-4_13 branch from f901a7b to b2b4707 Compare July 26, 2021 16:36
@tlaurion tlaurion changed the title Maximized boards -> coreboot 4 13 migrate all commmunity supported boards to coreboot 4.13 (Except KGPE-D16 which stays to coreboot 4.11) Jul 26, 2021
@tlaurion tlaurion force-pushed the maximized_boards-coreboot-4_13 branch from b3542d6 to 9b59af0 Compare July 26, 2021 19:13
@tlaurion
Copy link
Collaborator Author

tlaurion commented Jul 26, 2021

TODO: Review results of with/without blobs set for xx20 and xx30 boards
# CONFIG_USE_BLOBS is not set vs CONFIG_USE_BLOBS=y

Results are weird and coreboot configs are still inconsistent (some with some without) across boards' coreboot used configs.

With:

"/home/user/heads/build/coreboot-4.13/x230-hotp-maximized/cbfstool" "/home/user/heads/build/coreboot-4.13/x230-hotp-maximized/coreboot.rom" print
FMAP REGION: COREBOOT
Name                           Offset     Type           Size   Comp
cbfs master header             0x0        cbfs header        32 none
fallback/romstage              0x80       stage           85100 none
cpu_microcode_blob.bin         0x14d80    microcode       26624 none
fallback/ramstage              0x1b600    stage           97689 none
config                         0x33400    raw               756 none
revision                       0x33740    raw               691 none
fallback/dsdt.aml              0x33a40    raw             14615 none
vbt.bin                        0x373c0    raw              1433 LZMA (4281 decompressed)
cmos_layout.bin                0x379c0    cmos_layout      1884 none
fallback/postcar               0x38180    stage           25816 none
fallback/payload               0x3e6c0    simple elf    7131591 none
(empty)                        0x70b8c0   null          4539608 none
bootblock                      0xb5fdc0   bootblock       65536 none

Without:

"/home/user/heads/build/coreboot-4.13/x230-hotp-maximized/cbfstool" "/home/user/heads/build/coreboot-4.13/x230-hotp-maximized/coreboot.rom" print
FMAP REGION: COREBOOT
Name                           Offset     Type           Size   Comp
cbfs master header             0x0        cbfs header        32 none
fallback/romstage              0x80       stage           85100 none
cpu_microcode_blob.bin         0x14d80    microcode       26624 none
fallback/ramstage              0x1b600    stage           97730 none
config                         0x33400    raw               792 none
revision                       0x33780    raw               697 none
fallback/dsdt.aml              0x33a80    raw             14615 none
vbt.bin                        0x37400    raw              1433 LZMA (4281 decompressed)
cmos_layout.bin                0x37a00    cmos_layout      1884 none
fallback/postcar               0x381c0    stage           25816 none
fallback/payload               0x3e700    simple elf    7131591 none
(empty)                        0x70b900   null          4539544 none
bootblock                      0xb5fdc0   bootblock       65536 none

With:

  • empty space: 4539608

Without:

  • empty space: 4539544

EDIT: It doesn't change a thing for x230. Will remove for all boards since microcode is in as all other required files, with or without statement and size diff is locally accountable for "dirty" being added in config alongside of the config having more caracters and being uncompressed.

@tlaurion tlaurion force-pushed the maximized_boards-coreboot-4_13 branch 3 times, most recently from dca9991 to 7870545 Compare July 27, 2021 14:12
@tlaurion
Copy link
Collaborator Author

All boards now building with cryptsetup2 and coreboot config CONFIG_USE_BLOBS is not set for xx20 and xx30.
Will cleanup this PR with minimal commit numbers once build is successful

@tlaurion tlaurion force-pushed the maximized_boards-coreboot-4_13 branch from 7870545 to b8696ac Compare July 29, 2021 18:05
@tlaurion
Copy link
Collaborator Author

rebased on master

@tlaurion tlaurion force-pushed the maximized_boards-coreboot-4_13 branch from b8696ac to 6d559de Compare July 29, 2021 19:31
@tlaurion
Copy link
Collaborator Author

rebased on master with build optimization in to compare speeds of fresh build and rebuilds

@tlaurion tlaurion force-pushed the maximized_boards-coreboot-4_13 branch from 37d20af to b9468f5 Compare August 5, 2021 18:31
@tlaurion
Copy link
Collaborator Author

tlaurion commented Aug 5, 2021

b9468f5 reduced compile time of https://app.circleci.com/pipelines/github/tlaurion/heads/758/workflows/f42445f7-258b-472f-8a60-1a87b491cbed by 45 minutes (2h43 vs 3h30+)

Fresh builds doing the cache will result in even greater gains since based on all reused binaries for x86 to be based on cache passed to workspaces.

And not building coreboot 4.8.1 is also a big win.
Contacted @osresearch to have a release (4.8.1 configs and such) prior of merging.

@tlaurion
Copy link
Collaborator Author

tlaurion commented Aug 5, 2021

From #692:
x220 (xx20): @techge @eganonoa @Thrilleratplay @BlackMaria
t420 (xx20): @alexmaloteaux @natterangell
t430 (xx30): @Thrilleratplay @alexmaloteaux @nickfrostatx @lsafd @bwachter @shamen123
t430s and additional information (xx30): @Siproqu
x230 (xx30): already tested by myself thoroughly, but be my guest, mainly for x230-flash and x230-hotp-verification which I consider personally as legacy builds from now on.

I would love to have at least one board owner for each platform to report results of externally flashing artifacts of https://app.circleci.com/pipelines/github/tlaurion/heads/758/workflows/f42445f7-258b-472f-8a60-1a87b491cbed if possible?

@tlaurion
Copy link
Collaborator Author

tlaurion commented Aug 6, 2021

Edit: direct links now invalid. See artifacts for latest commit.

Direct link to roms from past successfully builds for external flashing (note below for people having IFD unlocked so internal flashing can be done. But please only do if you have an external reprogrammer available, and backup first so you can restore!)

Jargon

maximized (without HOTP): Requires you to have a GPG smartcard (standard for Heads) to detach sign /boot digest (sha256sum) content.
Maximized builds imply a static Ethernet MAC generated (DE:AD:C0:FF:EE) and is included in the ROM by default unless you generate your own or extract GBE blob from your actual ROM (please see board config and blobs/xx30/README/ blobs/xx20/README).
This consequently requires that MAC Randomization is applied on the OS level. ME is cleaned automatically from downloaded+verified Lenovo latest ME available update (from blobs/xx30 and blobs/xx20 scripts) and reduced ME size is changed in IFD to also increase consequently BIOS region, which coreboot then uses under its CBFS region in the coreboot configuration file. This ROM consequently permits the whole SPI to be flashed internally, modifying the board config file call to flashrom to not only update the BIOS region, but to flash the whole SPI upon flashrom subsequent upgrades.

If flashed internally with ME unlocked and IFD unlocked, a mount-usb and flashrom --force --noverify-all -p internal -w /media/image.rom with that full rom (not bottom.rom nor top.rom for xx30. The full 12 MB file) put on a USB drive should work. But it is strongly adviced only to do this if you have an external reprogrammer to reflash if necessary

maximized-hotp: As maximized build above, where that rom additionally requires users to have a Librem Key/Nitrokey Pro/Nitrokey Storage USB Security dongle to do remote attestation. Only flash those images if you have such devices and remember your GPG Admin PIN, required to seal measurements into your dongle's smartcard. Heads permits you to factory reset those devices at boot if no user's public key is found injected in the ROM. You can also inject previously generated public key, or flash the rom keeping previous settings if flashed internally from previous builds.

Legacy (only for xx30 builds: t430 and x230): Doesn't require initial unlocking of IFD regions. Doesn't require either neutering ME. Consequently less space is available in BIOS's coreboot IFD region (CBFS region of coreboot config) compared to freed ME space under maximized boards. Legacy boards consequently have some features deactivated and some UX regressions. For example, dropbear (ssh) is not in. Neither is FBWhiptail, but console based Whiptail is enforced (using gui-init, not as flashy as FBWhiptail is with a framebuffer (which toolstack is more space expensive.) Please read the new board configurations in this PR. ( @flammit and others: your input is important here. This is the choice I made to continue having those boards with minimal regression testing under CircleCI for each commit.)

xx20 (needs more testing, this is where #693 #1004 seem to have occurred and its not clear that its completely fixed as of now. I DO NOT OWN A xx20! (t420 nor x220))

t420-hotp-maximized:
https://1537-103208611-gh.circle-artifacts.com/0/build/t420-hotp-maximized/heads-t420-hotp-maximized-v0.2.0-1058-gb9468f5.rom

t420-maximized:
https://1532-103208611-gh.circle-artifacts.com/0/build/t420-maximized/heads-t420-maximized-v0.2.0-1058-gb9468f5.rom

x220-hotp-maximized:
https://1542-103208611-gh.circle-artifacts.com/0/build/x220-hotp-maximized/heads-x220-hotp-maximized-v0.2.0-1058-gb9468f5.rom

x220-maximized:
https://1539-103208611-gh.circle-artifacts.com/0/build/x220-maximized/heads-x220-maximized-v0.2.0-1058-gb9468f5.rom

xx30

x230-hotp-maximized (already tested multiple times. T430 counterpart needs to be tested though @daringer @jans23 others, see below).
bottom SPI: https://1530-103208611-gh.circle-artifacts.com/0/build/x230-hotp-maximized/heads-x230-hotp-maximized-v0.2.0-1058-gb9468f5-bottom.rom
TOP SPI: https://1530-103208611-gh.circle-artifacts.com/0/build/x230-hotp-maximized/heads-x230-hotp-maximized-v0.2.0-1058-gb9468f5-top.rom
Internal Flashing: https://1530-103208611-gh.circle-artifacts.com/0/build/x230-hotp-maximized/heads-x230-hotp-maximized-v0.2.0-1058-gb9468f5.rom

Legacy x230 (not maximized builds. Not requiring to neuter ME per instructions:https://osresearch.net/Clean-the-ME-firmware/ nor unlocking IFD per same instructions.):
external initial flash of TOP SPI: https://1548-103208611-gh.circle-artifacts.com/0/build/x230-flash/heads-x230-flash-v0.2.0-1058-gb9468f5-top.rom
Internal flashing: https://1531-103208611-gh.circle-artifacts.com/0/build/x230/heads-x230-v0.2.0-1058-gb9468f5.rom

Legacy x230-hotp (not maximized builds. Not requiring to neuter ME per instructions:https://osresearch.net/Clean-the-ME-firmware/ nor unlocking IFD per same instructions.):
external initial flash of TOP SPI: https://1548-103208611-gh.circle-artifacts.com/0/build/x230-flash/heads-x230-flash-v0.2.0-1058-gb9468f5-top.rom
Internal flashing after x230-flash applied to top SPI: https://1538-103208611-gh.circle-artifacts.com/0/build/x230-hotp-verification/heads-x230-hotp-verification-v0.2.0-1058-gb9468f5.rom

t430-hotp-maximized:
Bottom SPI: https://1540-103208611-gh.circle-artifacts.com/0/build/t430-maximized/heads-t430-maximized-v0.2.0-1058-gb9468f5-bottom.rom
TOP SPI: https://1540-103208611-gh.circle-artifacts.com/0/build/t430-maximized/heads-t430-maximized-v0.2.0-1058-gb9468f5-top.rom
Internal flashing: https://1540-103208611-gh.circle-artifacts.com/0/build/t430-maximized/heads-t430-maximized-v0.2.0-1058-gb9468f5.rom

t430-maximized:
Bottom SPI: https://1540-103208611-gh.circle-artifacts.com/0/build/t430-maximized/heads-t430-maximized-v0.2.0-1058-gb9468f5-bottom.rom
Top SPI: https://1540-103208611-gh.circle-artifacts.com/0/build/t430-maximized/heads-t430-maximized-v0.2.0-1058-gb9468f5-top.rom
Internal Flashing: https://1540-103208611-gh.circle-artifacts.com/0/build/t430-maximized/heads-t430-maximized-v0.2.0-1058-gb9468f5.rom

Legacy t430 (not maximized. Not requiring to neuter ME per instructions:https://osresearch.net/Clean-the-ME-firmware/ nor unlocking IFD per same instructions.):
Top SPI initial external flashing: https://1546-103208611-gh.circle-artifacts.com/0/build/t430-flash/heads-t430-flash-v0.2.0-1058-gb9468f5-top.rom
Internal flashing: https://1533-103208611-gh.circle-artifacts.com/0/build/t430/heads-t430-v0.2.0-1058-gb9468f5.rom

Please report back!

@tlaurion
Copy link
Collaborator Author

tlaurion commented Aug 7, 2021

x220 (xx20): @techge @eganonoa @Thrilleratplay @BlackMaria
t420 (xx20): @alexmaloteaux @natterangell
t430 (xx30): @Thrilleratplay @alexmaloteaux @nickfrostatx @lsafd @bwachter @shamen123
t430s and additional information (xx30): @Siproqu

Please tag me here if you test the roms.
Any input welcome.

Particularly:
txxx builds which applies #1015 (comment) and for #1004 which is unclear to have inpacts to x220 and t420 builds. Thanks for your participation. This won't be merged without feedback.

@Siproqu
Copy link

Siproqu commented Aug 7, 2021 via email

@tlaurion
Copy link
Collaborator Author

tlaurion commented Aug 7, 2021

Clean rebuild requested on CircleCI (changing CACHE_VERSION on CI) to test effectiveness of b9468f5

Of course, that will change the hashes of some binaries, per #1008 and other reproducibility opened ticket.
But reusing a cache based on a board using all current dependencies is expected to reduce build time on subsequent builds when cache is used (@Tonux599: small optimization there).

@techge
Copy link
Contributor

techge commented Aug 9, 2021

I am willing to test my x220, but I am currently short of time and do not know yet, when I will get to it...

@tlaurion
Copy link
Collaborator Author

tlaurion commented Aug 9, 2021

For USE_OPTION_TABLE, STATIC_OPTION_TABLE and on t430 : #944 (comment)

The reasoning behind adding this and hardcoding higher gfx_uma_size configs should be discussed and added if needed, inside of this PR or later on to cover such use case,

avph (Arthur Heymans, 9elements) I am driving a 3840x2160 (4K) external display and have replaced the internal one with a 1080p display. With or without the external display attached, when booting I saw graphical fragments over the text at the top of the screen (looked like random data in the video memory). Also when the OS was running I had strange issues that looked like random memory corruption. QubesOS/qubes-issues#6227 After enabling gfx_uma_size=224M both effects are gone.

But:

there is little to suggest this is needed for every T430 out there

@jans23 @alex-nitrokey and Nitrokey T430 hardware support team? Needed for T430? Your call!

@tlaurion
Copy link
Collaborator Author

tlaurion commented Aug 9, 2021

Note that builds from cache now builds under 3 hours for all boards dfined under CircleCI builder config. This means, once again, that unless a module definition changes, the biggest cache matching created modules digest is reused to build. If all modules are consistent (no modification on those modules in past commit for current build, meaning only scripts have changed or a rebuild was asked) like in the previous build, a CircleCI build takes 2h30 instead of 3h40 because most complete cache including board reused built binaries and libraries is being downloaded and used prior of attempting to build anything.

This is due by not having to build 3 versions of coreboot (4.8.1 is deprecated and moved to 4.13 here for all boards but KGPE-D16 still being based on coreboot 4.11) and having the most complex board (x230-hotp-maximized includes most andof what is reused by others) being built first where libraries and binaries being in the cache are reused instead of being recompiled from scratch since available, for each subsequent boards being built with same dependencies and just not included if not requested from board config.

- xx30 legacy boards (x230, x230-flash, t430, t430-flash) now rely also on coreboot 4.13
  - DOWNSIDE: x230 and t430 legacy boards now rely on WHIPTAIL (NOT FBWhiptail) to have enough space to fit under 7mb)
- xx20 boards moved to 4.13 (no need of xx20-flash boards here since single SPI boards with 7.5mb useable since blobs scripts are required)
  - DOWNSIDE: all xx20 boards now have dropbear deactivated, while still having ethernet driver in.
- qemu-coreboot and qemu-coreboot-fbwhiptail switched to coreboot 4.13 WITHOUT TPM SUPPORT (with cryptsetup 2.x support)
  - DOWNSIDE:
    - coreboot-qemu board CBFS_SIZE=0x700000 -> 0x750000
    - coreboot-qemu-fbwhiptail CBFS_SIZE=0x750000 -> 0x780000
- CircleCi build recipe removes 4.8.1 boards altogether
  - KGPE-D16 workstation is used as new base build to save workspace layer (we removed one workspace layer)
  - Removing one workspace layer will save approx 2 hours of build time on fresh builds
  - Removing one coreboot version will save us approx 2 hours of build time on fresh builds
  - KGPE-D16 will stay to coreboot 4.11 until forward notice.
  - All other board configs SHOULD be built on latest coreboot versions
- me_cleaner downloaded from https://github.com/corna/me_cleaner/blob/43612a630c79f3bc6f2653bfe90dfe0b7b137e08/me_cleaner.py
- placed under xx30 blobs dir
- CircleCI uses it locally without downloading it everytime (me_cleaner hasn<t changed since 2018)
…tps://support.circleci.com/hc/en-us/articles/4410707277083-Context-deadline-exceeded-after-1-hour-Build-timed-out-Free-tier-only-

Readd linuxboot#984 without cache
Add kgpe-d16 musl-cross target prior of having kgpe-d16 depend on musl-cross target (To try to have musl-cross step successfull under 1h CircleCI new limit)
CircleCI: add a subcommand that can follow a target (to build musl-cross-make now and coreboot version specific musl-cross later)
Output of hashes is now optional
29/11/2021 CircleCI public information available states parallelization of up to 30 jobs at a time. Let's play
- We first build heads musl-cross-make and persist (passing musl-cross-make into next job)
- We then build per coreboot version board with coreboot make statement only and persist (passing musl-cross-make + coreboot's musl-cross buildstack)
- We then build per coreboot version board (reusing past build musl-cross-make and coreboot's version musl-cross buildstack)
Remove 4.11 boards for the moment to test only build time and parallelization
CircleCI: We currently drop coreboot 4.11 builds.
- There is a file missing in the builds. Not sure why/how this is happening
src/soc/intel/fsp_broadwell_de/romstage/romstage.c:41:10: fatal error: build.h: No such file or directory
Example:https://app.circleci.com/pipelines/github/tlaurion/heads/877/workflows/7d0248d2-459c-42ad-b741-8fd56a75d527/jobs/2487
- kgpe-d16_workstation building for all GPUs is unfortunately taking too much time to build (40 minutes).
- Not sure why, but it seems that the kernel build paralellization is not working for 4.11 while it works for 4.13
Makefile: Uncomment MAKE_JOBS which passes the number of jobs to numbers cores by default and --max-load of 16
CircleCI: Remove CPUS statement to use Makefile default
modules/newt: force build with one make job, otherwise there is a race condition in module which fails randomly expecting build modules. (TODO: FIX)

Interestingly, building all coreboot 4.13 boards is happening on a clean commit just above 1h limit.

More details:
- CircleCI changed job build time to a maximum of 1h each.
- CircleCI now permits parallelization of 30 jobs
- 6000 build minutes a month.
- Still waiting for osresearch/heads CircleCI project to be unlocked (currently not recognized as open source project?!)
@tlaurion tlaurion force-pushed the maximized_boards-coreboot-4_13 branch from 5e4309c to 8f9ccae Compare December 1, 2021 19:33
@tlaurion
Copy link
Collaborator Author

tlaurion commented Dec 1, 2021

@0xdd7fq the builds' roms are boards' artifacts, built for for latest successfully built commit 8f9ccae, which is accessible by clicking on the green mark of each commit id being built by CircleCI.

From there you see links for boards that were built, by name of boards which can be accessed from there.
And then once in CircleCI, going into the artifacts section gives access to what was produced for each board.

I would appreciate t420 and t430 board owners to retest roms:
t420 (xx20): @alexmaloteaux @natterangell @akfhasodh
t430 (xx30): @Thrilleratplay @alexmaloteaux @nickfrostatx @lsafd @bwachter @shamen123 @eganonoa(no dGPU)
Since 4356777 was pushed to address #1057 (comment), and since dGPU/no dGPU can happen across t4xx, I would love to have report of board owners, which might affect #1059.

Example, all being done without being logged into Github nor CircleCI as you can see in the pictures (extracting links is not so fun where people can download for themselves!)
2021-12-01-154957
2021-12-01-155015
2021-12-01-155043
2021-12-01-155132

@techge techge removed their assignment Dec 2, 2021
@tlaurion
Copy link
Collaborator Author

tlaurion commented Dec 2, 2021

@icequbes1 report oem-factory-reset issue on the t430, which I cannot replicate, here: #1063

Someone else has that issue? I cannot replicate on x230 for commit 8f9ccae

Notes:

  • Nothing changed on gpg2 toolchain for a while, while errors were corrected in the oem-factory-reset script recently.
    • It was not provisioning Comment correctly (was reusing email adress)
    • whiptail messages were not aesthetic (width and heights were swapped, making the messages look weird on the screen).
  • t4xx boards now have coreboot graphic initialization per 4356777 in an attempt to have a board config working for both dGPU/iGPU boards. I'm expecting feedback there prior of merge. This is linked with issue Can't get heads to boot on t430 #1057, where both @walliams and @icequbes1 confirmed there that this commit fixed their t430 blank screen issue without a dGPU (iGPU only). Both board owners seem to have issues using the oem-factory-reset and where @icequbes1 proposed WiP: gpg2 2.2.21 LTS upgrade (gnupg toolstack) #860 which is fails on my x230-hotp-maximized build produced for 8f9ccae, rom artifact downloaded from CircleCI link. @nitrosimon @alex-nitrokey @jans23: wiating for your feedback on oem-factory-reset and 4356777 fixing the issue you reported affecting you also.

@tlaurion
Copy link
Collaborator Author

tlaurion commented Dec 3, 2021

@tlaurion T430-maximised tested as follows

sha256sum heads-t430-maximized-v0.2.0-1058-gb9468f5-*.rom
23d0f07ab2de3980cfe32eecc46f4e10b747110249c5d4616176098418daf7b4  heads-t430-maximized-v0.2.0-1058-gb9468f5-bottom.rom
423c9fdf2ccb7b0d0a5acee51e17eb147ddc0959de010f71d575660e9178aee6  heads-t430-maximized-v0.2.0-1058-gb9468f5-top.rom

Flashed externally. Tested full process from blank installation (tpm ownership + GPG pubkey flash + TOTP + fresh Qubes install + luks key in TPM + GPG card/sign boot). All working good.

@shamen123 your T430 has a IGPU only or also a dGPU?
Other t430 board owners (iGPU only) had problems with past rom. The new builds include 4356777 which I would love to receive your feedback as working/non-working, since other boards owners having iGPU only already confirmed that that commit fixed their issues (black internal screen while external display was working).

That fix was also applied to t420 coreboot configs.
This is why I need at least one feedback here from @alexmaloteaux @natterangell @akfhasodh prior of merge (and please state if you have iGPU only/iGPU+dGPU).

@ghost
Copy link

ghost commented Dec 3, 2021

This is linked with issue [Can't get heads to boot on t430 #1057](https://github.com/osresearch/heads/issues/1057), where both @walliams and @icequbes1 confirmed there that this commit fixed their t430 blank screen issue without a dGPU (iGPU only). Both board owners seem to have issues using the oem-factory-reset 

@tlaurion just to clarify: my board is a dGPU t430, not iGPU-- the nvidia dGPU can be found under a second heatsink pad attached to the CPU heatsink/fan assembly. I believe @icequbes1 has iGPU only, but I cannot speak for them. I did not have any issue with the OEM reset either using the new build based on the hotp-maximized coreboot config you produced in #1057 . It is now running perfectly for me.

@tlaurion
Copy link
Collaborator Author

tlaurion commented Dec 3, 2021

Now only missing a t420 board owner report from either @alexmaloteaux @natterangell @akfhasodh!
Please please please! Report if iGPU/dGPU!

@tlaurion
Copy link
Collaborator Author

tlaurion commented Dec 3, 2021

dGPU

Thanks @walliams for your feedback. I updated #692 accordingly and can now confirm that t430 boards, with dGPU or iGPU only should now all function under #1015 which should be finally merged soon.

If there is no report from t420 owners, life goes on and the problems reported will have to be corrected after bug reports.
Next step is #1061 and other boards needing to be merged and tested, including the Talos II (#1002 #1018) which requires buildsystem changes, and adding back other boards, after having fixed #1058... And having new OSes being able to build Heads as covered with #1038.

@natterangell
Copy link
Contributor

natterangell commented Dec 3, 2021

@tlaurion

Flashed t420-hotp-maximized from 8f9ccae externally. TPM ownership, GPG pubkey flash, TOTP, Nitrokey all good!
Subsequently reflashed the same ROM internally, retaining settings, everything seems to work just fine!

@natterangell
Copy link
Contributor

For clarity: iGPU

@tlaurion
Copy link
Collaborator Author

tlaurion commented Dec 3, 2021

@natterangell updated #692 accordingly.

Waiting for a t420 dGPU report until tomorrow and/or merging anyway

@tlaurion
Copy link
Collaborator Author

tlaurion commented Dec 3, 2021

Fixes #1057

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.