Add t430-dgpu support

.circleci/config.yml

@@ -97,6 +97,11 @@ jobs:
           command: |
             ./blobs/xx30/download_clean_me.sh -m $(readlink -f ./blobs/xx30/me_cleaner.py)
 
+      - run:
+          name: Download and extract t430 vbios roms for dgpu boards
+          command: |
+            ./blobs/xx30/vbios_t430.sh
+
       - run:
           name: Download and extract t530 vbios roms for dgpu boards
           command: |
@@ -324,6 +329,13 @@ workflows:
           requires:
             - x230-hotp-maximized
 
+      - build:
+          name: t430-dgpu-hotp-maximized
+          target: t430-dgpu-hotp-maximized
+          subcommand: ""
+          requires:
+            - x230-hotp-maximized
+
       - build:
           name: x230
           target: x230
@@ -400,6 +412,13 @@ workflows:
           requires:
             - x230-hotp-maximized
 
+      - build:
+          name: t430-dgpu-maximized
+          target: t430-dgpu-maximized
+          subcommand: ""
+          requires:
+            - x230-hotp-maximized
+
       - build:
           name: t530-maximized
           target: t530-maximized

blobs/xx30/README_vbios

@@ -1,15 +1,37 @@
-The vbios scripts in this directory help owners with discrete GPU's to initialize them. In order to do so it is required to place the iGPU and dGPU roms into this folder. These can either be extracted from the backup of the bios or extracted automatically from bios updates provided online by Lenovo using the VBiosFinder tool (see https://github.com/coderobe/VBiosFinder). 
+The vbios scripts in this directory help owners with discrete GPU's to initialize them. 
+In order to do so it is required to place the iGPU and dGPU roms into this folder. 
+These can either be extracted from the backup of the bios or extracted automatically from bios updates provided online by Lenovo using the VBiosFinder tool (see https://github.com/coderobe/VBiosFinder). 
 
-The vbios scripts in this directory install the dependencies for VBiosFinder. They then run VBiosFinder against the latest relevant bios update, which finds and extracts the relevant roms. Finally, the scripts rename and move the relevant extracted roms, place them in this blobs directory, and clean up.
+The vbios scripts in this directory install the dependencies for VBiosFinder. 
+They then run VBiosFinder against the latest relevant bios update, which finds and extracts the relevant roms. 
+Finally, the scripts rename and move the relevant extracted roms, place them in this blobs directory, and clean up.
 
-The scripts require sudo to run, but should be run initally without sudo (e.g. ./vbios_w530.sh). The bios updates used, for example, are:
+The bios updates used, for example, are:
 
 * For the w530: https://download.lenovo.com/pccbbs/mobiles/g5uj39us.exe
 * For the t530: https://download.lenovo.com/pccbbs/mobiles/g4uj41us.exe
+* For the t430: https://download.lenovo.com/pccbbs/mobiles/g1uj49us.exe
 
-The scripts have been successfully tested on Debian 10 and Ubuntu 21.04.
+The scripts have been successfully tested on Debian 10, Debian 11 and Ubuntu 21.04.
 
-NOTE: Once built the dGPU will still not yet be fully initialized. After successfully building the relevant rom for your board and before flashing it is necessary to build and use the nvramtool to change the value from Integrated-Only graphics to either Dual Graphics or Discrete Graphics. In the build directory find the coreboot version that you have just built. Navigate into that directory > utils > nvramtool and make the nvramtool. Then, for example, to initialize dual graphics run:
+Run the script from blobs directory, eg:
 
-nvramtool -C /path/to/12MB/rom -w hybrid_graphics_mode="Dual Graphics"
+  cd blobs/xx30 && ./vbios_t430.sh
 
+Then, assuming you have also extracted and cleaned me.bin, make your board.
+
+* NOTE: Once built the dGPU will still not yet be fully initialized. *
+After successfully building the relevant rom for your board and before flashing, it is necessary to build and use the nvramtool to change the value from "Integrated Only" graphics to either "Dual Graphics" or "Discrete Graphics".
+In the build directory find the coreboot version that you have just built. 
+Navigate into that directory > utils > nvramtool and make the nvramtool, eg:
+
+  cd build/coreboot-x.xx/util/nvramtool && make
+
+Then, for example, to initialize dual graphics run:
+
+  nvramtool -C /path/to/12MB/rom -w hybrid_graphics_mode="Dual Graphics"
+
+or from heads root run:
+
+  ~/heads/build/coreboot-x.xx/util/nvramtool/nvramtool -C build/arch/board/heads.rom -w hybrid_graphics_mode="Dual Graphics"
+

blobs/xx30/vbios_t430.sh

@@ -0,0 +1,77 @@
+#!/bin/bash
+
+BLOBDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+ROMPARSER="94a615302f89b94e70446270197e0f5138d678f3"
+UEFIEXTRACT="UEFIExtract_NE_A58_linux_x86_64.zip"
+VBIOSFINDER="c2d764975115de466fdb4963d7773b5bc8468a06"
+BIOSUPDATE="g1uj49us.exe"
+ROM_PARSER_SHA256SUM="f3db9e9b32c82fea00b839120e4f1c30b40902856ddc61a84bd3743996bed894  94a615302f89b94e70446270197e0f5138d678f3.zip"
+UEFI_EXTRACT_SHA256SUM="c9cf4066327bdf6976b0bd71f03c9e049ae39ed19ea3b3592bae3da8615d26d7  UEFIExtract_NE_A58_linux_x86_64.zip"
+VBIOS_FINDER_SHA256SUM="bd07f47fb53a844a69c609ff268249ffe7bf086519f3d20474087224a23d70c5  c2d764975115de466fdb4963d7773b5bc8468a06.zip"
+BIOS_UPDATE_SHA256SUM="f6769f197d9becf0533e41e9822b3934bc900a767e8ce2e3538d90fe0d113d5f  g1uj49us.exe"
+DGPU_ROM_SHA256SUM="b0e797cf2be7e11485a089ff7b1962b566737d7ddf082167e638601f47ae5ae8  vbios_10de_0def_1.rom"
+IGPU_ROM_SHA256SUM="11eb0011023391f07e7ae6d8068e1d6f586c9b73cbdaa24c65aa662ee785fca5  vbios_8086_0106_1.rom"
+
+echo "### Creating temp dir"
+extractdir=$(mktemp -d)
+cd "$extractdir"
+
+echo "### Installing basic dependencies"
+sudo apt update && sudo apt install -y wget ruby ruby-dev ruby-bundler p7zip-full upx-ucl 
+sudo gem install bundler:1.17.3
+
+echo "### Downloading rom-parser dependency"
+wget https://github.com/awilliam/rom-parser/archive/"$ROMPARSER".zip || { echo "Failed to download $ROMPARSER" && exit 1; }
+
+echo "### Verifying expected hash of rom-parser"
+echo "$ROM_PARSER_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification..." && exit 1; }
+
+echo "### Installing rom-parser dependency"
+unzip "$ROMPARSER".zip
+cd rom-parser-"$ROMPARSER" && make
+sudo cp rom-parser /usr/sbin/
+
+echo "### Downloading UEFIExtract dependency"
+wget https://github.com/LongSoft/UEFITool/releases/download/A58/"$UEFIEXTRACT" || { echo "Failed to download $UEFIEXTRACT" && exit 1; }
+
+echo "### Verifying expected hash of UEFIExtract"
+echo "$UEFI_EXTRACT_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification..." && exit 1; }
+
+echo "### Installing UEFIExtract"
+unzip "$UEFIEXTRACT"
+sudo mv UEFIExtract /usr/sbin/
+
+echo "### Downloading VBiosFinder"
+wget https://github.com/coderobe/VBiosFinder/archive/"$VBIOSFINDER".zip || { echo "Failed to download $VBIOSFINDER" && exit 1; }
+
+echo "### Verifying expected hash of VBiosFinder"
+echo "$VBIOS_FINDER_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification..." && exit 1; }
+
+echo "### Installing VBiosFinder"
+unzip "$VBIOSFINDER".zip
+cd VBiosFinder-"$VBIOSFINDER" && bundle install --path=vendor/bundle
+
+echo "### Downloading latest Lenovo bios update for t430"
+wget https://download.lenovo.com/pccbbs/mobiles/"$BIOSUPDATE" || { echo "Failed to download $BIOSUPDATE" && exit 1; }
+
+echo "### Verifying expected hash of bios update"
+echo "$BIOS_UPDATE_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification..." && exit 1; }
+
+echo "### Extracting bios update"
+innoextract "$extractdir"/rom-parser-"$ROMPARSER"/VBiosFinder-"$VBIOSFINDER"/"$BIOSUPDATE" || { echo "Failed to extract $BIOSUPDATE" && exit 1; }
+
+echo "### Finding, extracting and saving vbios"
+sudo ./vbiosfinder extract "$extractdir"/rom-parser-"$ROMPARSER"/VBiosFinder-"$VBIOSFINDER"/"app/G1ETC2WW/\$01D2000.FL1" || { echo "Failed to extract FL1" && exit 1; }
+
+echo "Verifying expected hash of extracted roms"
+cd output
+echo "$DGPU_ROM_SHA256SUM" | sha256sum --check || { echo "dGPU rom failed sha256sum verification..." && exit 1; }
+echo "$IGPU_ROM_SHA256SUM" | sha256sum --check || { echo "iGPU rom Failed sha256sum verification..." && exit 1; }
+
+echo "### Moving extracted roms to blobs directory"
+sudo mv vbios_10de_0def_1.rom $BLOBDIR/10de,0def.rom
+sudo mv vbios_8086_0106_1.rom $BLOBDIR/8086,0106.rom
+
+echo "### Cleaning Up"
+cd "$BLOBDIR"
+sudo rm -rf "$extractdir"

boards/t430-dgpu-hotp-maximized/t430-dgpu-hotp-maximized.config

@@ -0,0 +1,94 @@
+# Configuration for a T430 running Qubes 4.1 and other Linux Based OSes (through kexec)
+#
+# Includes 
+# - Deactivated+neutered ME and expanded consequent IFD BIOS regions 
+# - Forged 00:DE:AD:C0:FF:EE MAC address  (if not extracting gbe.bin from backup with blobs/xx30/extract.sh)
+#   - Note that this MAC address can be modified under build/coreboot-VER/util/bincfg/gbe-82579LM.set
+#
+# - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
+# This board is designed for a t430 with a dGPU. In order to build this the relevant script in the blobs directory must be run (or self-pulled roms placed in that directory) and after building the rom, the nvramtool must be run on the 12MB rom to change the default graphics mode away from integrated-only graphics (see README_vbios in the blobs directory).
+
+export CONFIG_COREBOOT=y
+export CONFIG_COREBOOT_VERSION=4.13
+export CONFIG_LINUX_VERSION=4.14.62
+
+CONFIG_COREBOOT_CONFIG=config/coreboot-t430-dgpu-hotp-maximized.config
+CONFIG_LINUX_CONFIG=config/linux-x230-maximized.config
+
+#Additional hardware support
+CONFIG_LINUX_USB=y
+CONFIG_LINUX_E1000E=y
+
+CONFIG_CRYPTSETUP2=y
+CONFIG_FLASHROM=y
+CONFIG_FLASHTOOLS=y
+CONFIG_GPG2=y
+CONFIG_KEXEC=y
+CONFIG_UTIL_LINUX=y
+CONFIG_LVM2=y
+CONFIG_MBEDTLS=y
+CONFIG_PCIUTILS=y
+
+#Remote attestation support
+#TPM based requirements
+export CONFIG_TPM=y
+CONFIG_POPT=y
+CONFIG_QRENCODE=y
+CONFIG_TPMTOTP=y
+#HOTP based remote attestation for supported USB Security dongle
+#With/Without TPM support
+CONFIG_HOTPKEY=y
+
+#Nitrokey Storage admin tool
+CONFIG_NKSTORECLI=n
+
+#GUI Support
+#Console based Whiptail support(Console based, no FB):
+#CONFIG_SLANG=y
+#CONFIG_NEWT=y
+#FBWhiptail based (Graphical):
+CONFIG_CAIRO=y
+CONFIG_FBWHIPTAIL=y
+
+#Additional tools:
+#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
+CONFIG_DROPBEAR=y
+
+export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOT_REQ_HASH=n
+export CONFIG_BOOT_REQ_ROLLBACK=n
+export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off"
+export CONFIG_BOOT_KERNEL_REMOVE="quiet"
+export CONFIG_BOOT_DEV="/dev/sda1"
+export CONFIG_BOARD_NAME="Thinkpad T430-dgpu-hotp-maximized"
+export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal"
+
+# xx30-*-maximized boards require of you initially call one of the
+#  following to have gbe.bin ifd.bin and me.bin
+#  - blobs/xx30/download_clean_me.sh
+#     To download Lenovo original ME binary, neuter+deactivate ME, produce
+#      reduced IFD ME region and expanded BIOS IFD region.
+#  - blobs/xx30/extract.sh
+#     To extract from backuped 8M (bottom SPI) ME binary, GBE and IFD blobs.
+#
+# This board has two SPI flash chips, an 8 MB that holds the IFD,
+# the ME image and part of the coreboot image, and a 4 MB one that
+# has the rest of the coreboot and the reset vector.
+#   
+# As a consequence, this replaces the need of having to flash t430-flash 
+#  and expands available CBFS region (11.5Mb available CBFS space)
+#
+# When flashing via an external programmer it is easiest to have
+# two separate files for these pieces.
+all: $(board_build)/$(CB_OUTPUT_FILE)
+	@sha256sum $@ | tee -a "$(HASHES)"
+
+all: $(board_build)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-bottom.rom
+$(board_build)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-bottom.rom: $(board_build)/$(CB_OUTPUT_FILE)
+	$(call do,DD 8MB,$@,dd of=$@ if=$< bs=65536 count=128 skip=0 status=none)
+	@sha256sum $@ | tee -a "$(HASHES)"
+
+all: $(board_build)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-top.rom
+$(board_build)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-top.rom: $(board_build)/$(CB_OUTPUT_FILE)
+	$(call do,DD 4MB,$@,dd of=$@ if=$< bs=65536 count=64 skip=128 status=none)
+	@sha256sum $@ | tee -a "$(HASHES)"

boards/t430-dgpu-maximized/t430-dgpu-maximized.config

@@ -0,0 +1,93 @@
+# Configuration for a T430 running Qubes 4.1 and other Linux Based OSes (through kexec)
+#
+# Includes 
+# - Deactivated+neutered ME and expanded consequent IFD BIOS regions 
+# - Forged 00:DE:AD:C0:FF:EE MAC address  (if not extracting gbe.bin from backup with blobs/xx30/extract.sh)
+#   - Note that this MAC address can be modified under build/coreboot-VER/util/bincfg/gbe-82579LM.set
+#
+# - DOES NOT INCLUDE Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
+# This board is designed for a t430 with a dGPU. In order to build this the relevant script in the blobs directory must be run (or self-pulled roms placed in that directory) and after building the rom, the nvramtool must be run on the 12MB rom to change the default graphics mode away from integrated-only graphics (see README_vbios in the blobs directory).
+export CONFIG_COREBOOT=y
+export CONFIG_COREBOOT_VERSION=4.13
+export CONFIG_LINUX_VERSION=4.14.62
+
+CONFIG_COREBOOT_CONFIG=config/coreboot-t430-dgpu-maximized.config
+CONFIG_LINUX_CONFIG=config/linux-x230-maximized.config
+
+#Additional hardware support
+CONFIG_LINUX_USB=y
+CONFIG_LINUX_E1000E=y
+
+CONFIG_CRYPTSETUP2=y
+CONFIG_FLASHROM=y
+CONFIG_FLASHTOOLS=y
+CONFIG_GPG2=y
+CONFIG_KEXEC=y
+CONFIG_UTIL_LINUX=y
+CONFIG_LVM2=y
+CONFIG_MBEDTLS=y
+CONFIG_PCIUTILS=y
+
+#Remote attestation support
+#TPM based requirements
+export CONFIG_TPM=y
+CONFIG_POPT=y
+CONFIG_QRENCODE=y
+CONFIG_TPMTOTP=y
+#HOTP based remote attestation for supported USB Security dongle
+#With/Without TPM support
+#CONFIG_HOTPKEY=y
+
+#Nitrokey Storage admin tool
+CONFIG_NKSTORECLI=n
+
+#GUI Support
+#Console based Whiptail support(Console based, no FB):
+#CONFIG_SLANG=y
+#CONFIG_NEWT=y
+#FBWhiptail based (Graphical):
+CONFIG_CAIRO=y
+CONFIG_FBWHIPTAIL=y
+
+#Additional tools:
+#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
+CONFIG_DROPBEAR=y
+
+export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOT_REQ_HASH=n
+export CONFIG_BOOT_REQ_ROLLBACK=n
+export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off"
+export CONFIG_BOOT_KERNEL_REMOVE="quiet"
+export CONFIG_BOOT_DEV="/dev/sda1"
+export CONFIG_BOARD_NAME="Thinkpad T430-dgpu-maximized"
+export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal"
+
+# xx30-*-maximized boards require of you initially call one of the
+#  following to have gbe.bin ifd.bin and me.bin
+#  - blobs/xx30/download_clean_me.sh
+#     To download Lenovo original ME binary, neuter+deactivate ME, produce
+#      reduced IFD ME region and expanded BIOS IFD region.
+#  - blobs/xx30/extract.sh
+#     To extract from backuped 8M (bottom SPI) ME binary, GBE and IFD blobs.
+#
+# This board has two SPI flash chips, an 8 MB that holds the IFD,
+# the ME image and part of the coreboot image, and a 4 MB one that
+# has the rest of the coreboot and the reset vector.
+#   
+# As a consequence, this replaces the need of having to flash t430-flash 
+#  and expands available CBFS region (11.5Mb available CBFS space)
+#
+# When flashing via an external programmer it is easiest to have
+# two separate files for these pieces.
+all: $(board_build)/$(CB_OUTPUT_FILE)
+	@sha256sum $@ | tee -a "$(HASHES)"
+
+all: $(board_build)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-bottom.rom
+$(board_build)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-bottom.rom: $(board_build)/$(CB_OUTPUT_FILE)
+	$(call do,DD 8MB,$@,dd of=$@ if=$< bs=65536 count=128 skip=0 status=none)
+	@sha256sum $@ | tee -a "$(HASHES)"
+
+all: $(board_build)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-top.rom
+$(board_build)/heads-$(BOARD)-$(HEADS_GIT_VERSION)-top.rom: $(board_build)/$(CB_OUTPUT_FILE)
+	$(call do,DD 4MB,$@,dd of=$@ if=$< bs=65536 count=64 skip=128 status=none)
+	@sha256sum $@ | tee -a "$(HASHES)"

config/coreboot-t430-dgpu-hotp-maximized.config

@@ -0,0 +1,29 @@
+CONFIG_USE_OPTION_TABLE=y
+CONFIG_STATIC_OPTION_TABLE=y
+# CONFIG_USE_BLOBS is not set
+CONFIG_VENDOR_LENOVO=y
+CONFIG_NO_POST=y
+CONFIG_CBFS_SIZE=0xB80000
+CONFIG_IFD_BIN_PATH="@BLOB_DIR@/xx30/ifd.bin"
+CONFIG_ME_BIN_PATH="@BLOB_DIR@/xx30/me.bin"
+CONFIG_GBE_BIN_PATH="@BLOB_DIR@/xx30/gbe.bin"
+CONFIG_HAVE_IFD_BIN=y
+CONFIG_BOARD_LENOVO_THINKPAD_T430=y
+CONFIG_LINUX_COMMAND_LINE="intel_iommu=igfx_off quiet"
+CONFIG_UART_PCI_ADDR=0
+CONFIG_HAVE_ME_BIN=y
+CONFIG_HAVE_GBE_BIN=y
+CONFIG_GENERIC_LINEAR_FRAMEBUFFER=y
+CONFIG_VGA_BIOS_DGPU_ID="10de,0def"
+CONFIG_VGA_BIOS_DGPU_FILE="@BLOB_DIR@/xx30/10de,0def.rom"
+CONFIG_VGA_BIOS=y
+CONFIG_VGA_BIOS_FILE="@BLOB_DIR@/xx30/8086,0106.rom"
+# CONFIG_VGA_BIOS_SECOND is not set
+CONFIG_VGA_ROM_RUN_DEFAULT=y
+CONFIG_VGA_BIOS_DGPU=y
+CONFIG_DRIVERS_PS2_KEYBOARD=y
+CONFIG_TPM_MEASURED_BOOT=y
+CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x80000
+CONFIG_PAYLOAD_LINUX=y
+CONFIG_PAYLOAD_FILE="@BOARD_BUILD_DIR@/bzImage"
+CONFIG_LINUX_INITRD="@BOARD_BUILD_DIR@/initrd.cpio.xz"