Dell Optiplex 7019/9010 SFF (and DT form factor) + TXT inclusion based on coreboot master 24.02.01 for now #1785

tlaurion · 2024-09-08T19:01:17Z

This pull request includes various updates and additions to support the Dell Optiplex 7010/9010 systems, including new workflows, configuration files, and scripts for handling firmware blobs. The most important changes include updating the Docker image version, adding new jobs and workflows in the CircleCI configuration, and introducing new configuration files and scripts for the Optiplex 7010/9010 systems.

CircleCI Configuration Updates:

Updated Docker image version to tlaurion/heads-dev-env:v0.2.3 in multiple jobs (prep_env, build_and_persist, build, save_cache). [1] [2] [3] [4]
Added a new job to download Optiplex 7010/9010 blobs.
Introduced new workflows for building various configurations of the Optiplex 7010/9010.

New Configuration Files:

Added configuration files for different Optiplex 7010/9010 builds (optiplex-7010_9010-hotp-maximized.config, optiplex-7010_9010-maximized.config, optiplex-7010_9010_TXT-hotp-maximized.config, optiplex-7010_9010_TXT-maximized.config). [1] [2] [3] [4]

New Scripts and Documentation:

Added a script to download and verify required blobs for Optiplex 7010/9010 (optiplex_7010_9010.sh).
Added README and layout files for Optiplex 9010 blobs. (README.md, layout.txt). [1] [2]

Other Changes:

Updated .gitignore to include new blob files.
Updated flake.nix to include new dependencies and ensure root entries in /etc/passwd and /etc/group. [1] [2]
Added makefile targets for downloading Optiplex 7010/9010 blobs. (optiplex_blobs.mk).

This is PoC state. Please comment.

Download extracts and use automatically:
- IFD maximized size from xx30 blobs extraction script
- ME neutered with minimal size per xx30 blobs extraction script
- TXT variant only: ACM (IVB_BIOSAC_PRODUCTION.bin) + SINIT (SNB_IVB_SINIT_20190708_PW.bin)
  - TXT versioning taken from https://github.com/Dasharo/coreboot/blob/7226ebce6e8479b9aef6d4e4ea2420fffa5f75a6/configs/config.dell_optiplex_9010_sff_txt#L10C1-L10C31
- EC firmware (sch5545_ecfw.bin)
- Needs to be flashed through recovery method as all maximized boards

Let's see if that works. Optiplex board owners out here?

At completion, will fix #1739, possibly moving to dasharo fork (doesn't build with novacusstom nv41 fork today) to be evaluated (v0.2.0 older then 0.1.0? Confused by versioning of fork: was told to use coreboot master since no change and should work)

Next steps

~~Create blobs extraction scripts automating https://docs.dasharo.com/variants/dell_optiplex/initial-deployment/#firmware-preparation~~: done
~~Iterate to enabling TXT with another download/extraction blobs (ACM/sINIT)~~: done
Testing for what is expected to work by Dasharo team @macpijan @pietrushnic
- test https://docs.dasharo.com/variants/dell_optiplex/recovery/
  - Unfortunately I do not own a SOIC-16 clip So I cannot recover from a brick : EDIT I have DT variant: 2xsoic8
- Iterate until working as expected
- Put PR back to ready for review
- Have review+approval from at least one of @macpijan @pietrushnic @miczyg1
- Merge
- Update latest docker image -> v0.2.3

…01 for now - CircleCI: add build based on coreboot 24.02.01 release (might be old but unclear to my eyes now) - Add board non-HOTP board config as a start, reuse x230 linux config - Add coreboot config modified ans saved theourh coreboot Makefile file helper Next steps - Create blobs extraction scripts automating https://docs.dasharo.com/variants/dell_optiplex/initial-deployment/#firmware-preparation Signed-off-by: Thierry Laurion <[email protected]>

…re images to blobs needed by scripts Requirements reproducing https://docs.dasharo.com/variants/dell_optiplex/initial-deployment/#firmware-preparation Signed-off-by: Thierry Laurion <[email protected]>

…SINIT and EC for Optiplex 7010/9010 Signed-off-by: Thierry Laurion <[email protected]>

…ion target to automatically download+extract ACM/SINIT/EC blobs into place Signed-off-by: Thierry Laurion <[email protected]>

…eboot to blobs, add to CI Signed-off-by: Thierry Laurion <[email protected]>

Pushing flake.nix new requirements for binwalk and uefi-firmware-parser to extract blobs Signed-off-by: Thierry Laurion <[email protected]>

tlaurion · 2024-10-07T17:40:21Z

Duh. f2e0553 doesn't contain new flake.nix requirements for blobs extraction. Pushing new docker image in new commit e0c4fcb using it, per README.md maintainership instructions.

…hrough (/etc/passwd /etc/group file construction) Signed-off-by: Thierry Laurion <[email protected]>

Signed-off-by: Thierry Laurion <[email protected]>

…change optiplex_blobs.mk target and point coreboot config to this IFD Signed-off-by: Thierry Laurion <[email protected]>

tlaurion · 2024-10-08T14:05:22Z

Tested: https://output.circle-artifacts.com/output/job/07b661b2-b859-4f40-8fd0-8d3586da733f/artifacts/0/build/x86/optiplex-7010_9010_TXT-maximized/heads-optiplex-7010_9010_TXT-maximized-v0.2.0-2334-ge2ad897.rom

Note:

boots (efifb+bootsplash after hard reboot) but symbols missing.
kernel works but mostly everything depending on initrd (and libc) is corrupt.
Seems like I missed cleaning up ifd to make its region match expected ones or something, relaunching build without cache to compare roms produced.

Some notes: my 9010 had service jumper slot easily availabe without needing to disassemble anything other then opening the chassis. DTS then was able to take a backup and flash through internal flashing of flashrom through DTS booted from USB.

Putting in draft until

comparing roms produces by CI on clean build (ongoing) and https://output.circle-artifacts.com/output/job/07b661b2-b859-4f40-8fd0-8d3586da733f/artifacts/0/build/x86/optiplex-7010_9010_TXT-maximized/heads-optiplex-7010_9010_TXT-maximized-v0.2.0-2334-ge2ad897.rom
verifying IFD regions match actual regions occupied by IFD, BIOS, ME and GBE (bluntly trusted coreboot stitching but should have verified).

…6650.bin, document Signed-off-by: Thierry Laurion <[email protected]>

tlaurion · 2024-10-08T17:58:30Z

Damn. IFD extracted from board's ME region doesn't match ME region from backup :/ More work needed

Log https://app.circleci.com/pipelines/github/tlaurion/heads/2880/workflows/ff9dee9b-9e99-4514-afa6-db3a82e60b08/jobs/54332?invite=true#step-106-1831079_85 :
Region Intel ME is 94208(0x17000) bytes. File is 98304(0x18000) bytes. Not injecting.

Smaller ME in 9010?!

…s are not found under blobs/optiplex_9010/ Signed-off-by: Thierry Laurion <[email protected]>

tlaurion · 2024-10-08T18:25:14Z

Notes: my 9010 board is way different then 7010 board pictures under Dasharo docs
EDIT: this is DT variant, not SFF. Same silicon, but PCI IDs will be different.

Service jumper easily accessible (red)
Soic8 SPI flash chips also easily accessible (green)

Pictures:

…used ME, apply through ifdtool Repro notes: ./build/x86/coreboot-24.02.01/util/ifdtool/ifdtool -n blobs/optiplex_9010/layout.txt blobs/optiplex_9010/ifd.bin -O blobs/optiplex_9010/ifd.bin Signed-off-by: Thierry Laurion <[email protected]>

tlaurion · 2024-10-09T17:44:25Z

Installing QubesOS on the Optiplex, externally flashed local build rom, booted from detached signed ISO: ok.

…ard config formats Signed-off-by: Thierry Laurion <[email protected]>

…lobs are part of CircleCI cache (cleaning cache prior of push of this commit) Signed-off-by: Thierry Laurion <[email protected]>

tlaurion · 2024-10-09T18:50:57Z

HOTP variants seal HOTP secret on usb security dongle and enforces automatic boot of default entry
TPM DUK unseals secret and boots into QubesOS

tlaurion · 2024-10-09T18:57:29Z

@miczyg1 please test internal firmware upgrade and approve this PR upon successful testing

miczyg1 · 2024-10-10T08:23:46Z

Okay, will try to do this ASAP.

config/coreboot-optiplex-7019_9010-maximized.config

miczyg1 · 2024-10-11T21:57:48Z

@miczyg1 please test internal firmware upgrade and approve this PR upon successful testing

Heads firmware update using the ZIP from Circle CI (commit d3d4247) worked like a charm.

tlaurion · 2024-10-12T12:38:35Z

Well, archive.org has hiccups after being hacked...

config/coreboot-optiplex-7019_9010-maximized.config

miczyg1 · 2024-10-14T08:25:54Z

@tlaurion I am unable to resolve conversations on my own here. Please feel free to resolve the comments

…s down boot outside of debugging use case) Signed-off-by: Thierry Laurion <[email protected]>

tlaurion · 2024-10-14T22:09:56Z

@tlaurion I am unable to resolve conversations on my own here. Please feel free to resolve the comments

Seems like https://github.com/linuxboot/heads/compare/c5bbbe38fa8f6d4e5e92f7199dda7191245815a7..2424067203617b23f10ed48b65b8dea037e7b58b should be preferred. Commented in previous discussions. Please thumb up there and I will resolve associated comment threads.

tlaurion added the help wanted label Sep 8, 2024

tlaurion marked this pull request as draft September 8, 2024 19:01

tlaurion force-pushed the optiplex_7010-9010 branch from 6270f55 to 443e6de Compare September 9, 2024 12:45

tlaurion added 5 commits October 7, 2024 08:24

flake.nix: add binwalk and uefi-firmware-parser to extract OEM firmwa…

393ff1c

…re images to blobs needed by scripts Requirements reproducing https://docs.dasharo.com/variants/dell_optiplex/initial-deployment/#firmware-preparation Signed-off-by: Thierry Laurion <[email protected]>

blobs/xx30/optiplex_7010_9010.sh: add script to download/extract ACM,…

8519a08

…SINIT and EC for Optiplex 7010/9010 Signed-off-by: Thierry Laurion <[email protected]>

targets/optiplex_acm_blobs.mk: add Optiplex 7010/9010 Makefile inclus…

2369f9a

…ion target to automatically download+extract ACM/SINIT/EC blobs into place Signed-off-by: Thierry Laurion <[email protected]>

boards/optiplex-7010_9010_TXT-maximized: add new TXT board, poitn cor…

f2e0553

…eboot to blobs, add to CI Signed-off-by: Thierry Laurion <[email protected]>

tlaurion force-pushed the optiplex_7010-9010 branch from 443e6de to f2e0553 Compare October 7, 2024 16:23

tlaurion added the release cycle - 2024-11-20 label Oct 7, 2024

tlaurion marked this pull request as ready for review October 7, 2024 16:57

tlaurion changed the title ~~WiP: Dell Optiplex 7019/9010 SFF inclusion based on coreboot master 24.02.01 for now~~ WiP: Dell Optiplex 7019/9010 SFF + TXT inclusion based on coreboot master 24.02.01 for now Oct 7, 2024

tlaurion marked this pull request as draft October 7, 2024 16:58

tlaurion marked this pull request as ready for review October 7, 2024 16:58

Bump nix develop based docker image to tlaurion/heads-dev-env:v0.2.2

e0c4fcb

Pushing flake.nix new requirements for binwalk and uefi-firmware-parser to extract blobs Signed-off-by: Thierry Laurion <[email protected]>

tlaurion added 2 commits October 7, 2024 16:22

flake.nix: Add fakeroot requirements so root user can be discovered t…

f86e716

…hrough (/etc/passwd /etc/group file construction) Signed-off-by: Thierry Laurion <[email protected]>

Bump nix develop based docker image to tlaurion/heads-dev-env:v0.2.3

e5f7f8a

Signed-off-by: Thierry Laurion <[email protected]>

tlaurion force-pushed the optiplex_7010-9010 branch from f4191f4 to e5f7f8a Compare October 7, 2024 20:28

Optiplex 7010/9010 SFF: add ifd.bin from libreboot's t16650 in tree, …

e2ad897

…change optiplex_blobs.mk target and point coreboot config to this IFD Signed-off-by: Thierry Laurion <[email protected]>

tlaurion force-pushed the optiplex_7010-9010 branch from 8316a8a to e2ad897 Compare October 8, 2024 00:55

tlaurion marked this pull request as draft October 8, 2024 14:05

Optiplex 9010: use ifd.bin from my board, move past ifd.bin to ifd_t1…

28d9e03

…6650.bin, document Signed-off-by: Thierry Laurion <[email protected]>

targets/optiplex_blobs.mk: run extraction script if any of the 3 blob…

1951df4

…s are not found under blobs/optiplex_9010/ Signed-off-by: Thierry Laurion <[email protected]>

Optiplex boards: add HOTP variants, unify against x230-*-maximized bo…

7f4d714

…ard config formats Signed-off-by: Thierry Laurion <[email protected]>

CircleCI: add HOTP variants, add optiplex blobs script execution so b…

d3d4247

…lobs are part of CircleCI cache (cleaning cache prior of push of this commit) Signed-off-by: Thierry Laurion <[email protected]>

tlaurion force-pushed the optiplex_7010-9010 branch from 894ba0c to d3d4247 Compare October 9, 2024 18:30

tlaurion marked this pull request as ready for review October 9, 2024 18:50

tlaurion changed the title ~~WiP: Dell Optiplex 7019/9010 SFF + TXT inclusion based on coreboot master 24.02.01 for now~~ Dell Optiplex 7019/9010 SFF (AND DT) + TXT inclusion based on coreboot master 24.02.01 for now Oct 9, 2024

tlaurion changed the title ~~Dell Optiplex 7019/9010 SFF (AND DT) + TXT inclusion based on coreboot master 24.02.01 for now~~ Dell Optiplex 7019/9010 SFF (and DT form factor) + TXT inclusion based on coreboot master 24.02.01 for now Oct 10, 2024

miczyg1 reviewed Oct 11, 2024

View reviewed changes

config/coreboot-optiplex-7019_9010-maximized.config Show resolved Hide resolved

miczyg1 approved these changes Oct 11, 2024

View reviewed changes

tlaurion force-pushed the optiplex_7010-9010 branch from d3d4247 to d446e6b Compare October 11, 2024 22:41

tlaurion mentioned this pull request Oct 11, 2024

coreboot configs: remove coreboot console logging #1806

Closed

tlaurion force-pushed the optiplex_7010-9010 branch from d446e6b to d3d4247 Compare October 11, 2024 22:51

tlaurion commented Oct 12, 2024

View reviewed changes

config/coreboot-optiplex-7019_9010-maximized.config Outdated Show resolved Hide resolved

coreboot configs: remove coreboot serial console output logging (slow…

2424067

…s down boot outside of debugging use case) Signed-off-by: Thierry Laurion <[email protected]>

tlaurion force-pushed the optiplex_7010-9010 branch from c5bbbe3 to 2424067 Compare October 14, 2024 21:33

tlaurion mentioned this pull request Oct 14, 2024

coreboot configs: remove serial coreboot console logging output; put console output to 7 (DEBUG) across all configs #1807

Merged

tlaurion merged commit fc055b9 into linuxboot:master Oct 15, 2024
50 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Dell Optiplex 7019/9010 SFF (and DT form factor) + TXT inclusion based on coreboot master 24.02.01 for now #1785

Dell Optiplex 7019/9010 SFF (and DT form factor) + TXT inclusion based on coreboot master 24.02.01 for now #1785

tlaurion commented Sep 8, 2024 •

edited

Loading

tlaurion commented Oct 7, 2024 •

edited

Loading

tlaurion commented Oct 8, 2024 •

edited

Loading

tlaurion commented Oct 8, 2024 •

edited

Loading

tlaurion commented Oct 8, 2024 •

edited

Loading

tlaurion commented Oct 9, 2024

tlaurion commented Oct 9, 2024

tlaurion commented Oct 9, 2024 •

edited

Loading

miczyg1 commented Oct 10, 2024

miczyg1 commented Oct 11, 2024

tlaurion commented Oct 12, 2024

miczyg1 commented Oct 14, 2024

tlaurion commented Oct 14, 2024 •

edited

Loading

Dell Optiplex 7019/9010 SFF (and DT form factor) + TXT inclusion based on coreboot master 24.02.01 for now #1785

Dell Optiplex 7019/9010 SFF (and DT form factor) + TXT inclusion based on coreboot master 24.02.01 for now #1785

Conversation

tlaurion commented Sep 8, 2024 • edited Loading

CircleCI Configuration Updates:

New Configuration Files:

New Scripts and Documentation:

Other Changes:

tlaurion commented Oct 7, 2024 • edited Loading

tlaurion commented Oct 8, 2024 • edited Loading

tlaurion commented Oct 8, 2024 • edited Loading

tlaurion commented Oct 8, 2024 • edited Loading

tlaurion commented Oct 9, 2024

tlaurion commented Oct 9, 2024

tlaurion commented Oct 9, 2024 • edited Loading

miczyg1 commented Oct 10, 2024

miczyg1 commented Oct 11, 2024

tlaurion commented Oct 12, 2024

miczyg1 commented Oct 14, 2024

tlaurion commented Oct 14, 2024 • edited Loading

tlaurion commented Sep 8, 2024 •

edited

Loading

tlaurion commented Oct 7, 2024 •

edited

Loading

tlaurion commented Oct 8, 2024 •

edited

Loading

tlaurion commented Oct 8, 2024 •

edited

Loading

tlaurion commented Oct 8, 2024 •

edited

Loading

tlaurion commented Oct 9, 2024 •

edited

Loading

tlaurion commented Oct 14, 2024 •

edited

Loading