Skip to content

Commit 66ef5c3

Browse files
d-widd-wid
committed
Rebase, chmod +x download_BIOS_clean.sh, config options to enable platform locking as defined under https://github.com/osresearch/heads/blob/473c235fbaf56698aa9beefd2684fbf7d4499809/initrd/bin/lock_chip header, Changed description comment lines in the Heads board config file.
1 parent 473c235 commit 66ef5c3

6 files changed

Lines changed: 3985 additions & 0 deletions

File tree

‎.circleci/config.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -469,6 +469,20 @@ workflows:
469469
requires:
470470
- x230-hotp-maximized
471471

472+
- build:
473+
name: z220-cmt-maximized
474+
target: z220-cmt-maximized
475+
subcommand: ""
476+
requires:
477+
- x230-hotp-maximized
478+
479+
- build:
480+
name: z220-cmt-hotp-maximized
481+
target: z220-cmt-hotp-maximized
482+
subcommand: ""
483+
requires:
484+
- x230-hotp-maximized
485+
472486
- build:
473487
name: UNTESTED_p8z77-m_pro-tpm1-maximized
474488
target: UNTESTED_p8z77-m_pro-tpm1-maximized

‎blobs/z220/download_BIOS_clean.sh‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#!/bin/bash
2+
# Z220 CMT HP
3+
4+
function printusage {
5+
echo "Usage: $0 -m <me_cleaner>(optional)"
6+
}
7+
8+
BLOBDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
9+
10+
if [ "$#" -eq 0 ]; then printusage; fi
11+
12+
while getopts ":m:i:" opt; do
13+
case $opt in
14+
m)
15+
if [ -x "$OPTARG" ]; then
16+
MECLEAN="$OPTARG"
17+
fi
18+
;;
19+
esac
20+
21+
done
22+
23+
if [ -z "$MECLEAN" ]; then
24+
MECLEAN=`command -v $BLOBDIR/../../build/x86/coreboot-*/util/me_cleaner/me_cleaner.py 2>&1|head -n1`
25+
if [ -z "$MECLEAN" ]; then
26+
echo "me_cleaner.py required but not found or specified with -m. Aborting."
27+
exit 1;
28+
fi
29+
fi
30+
31+
BIN_FILE="DOS Flash/K51_0187.BIN"
32+
BIN_TGZ_SHA256SUM="0102d569239fdc14ca86a7afc4b16d2b12703401890b83e188f34d23844870dc sp97120.tgz"
33+
BIN_FILE_SHA256SUM="cc5a9c2d4827e9b1501c2dc0a464f580d4a2d65e4ff83dbab548e51839339d06 $BIN_FILE"
34+
FINAL_IFD_SHA256SUM="ba7371fcf1c03a999adae66f4a5fccd65ae3429c1aedc0c7b7e11c548363d30e $BLOBDIR/ifd.bin"
35+
FINAL_ME_SHA256SUM="2ee4bbf3e49e0c1f0215d7955d2a7793c7e108014f3aa4592bfa9785c0033d0d $BLOBDIR/me.bin"
36+
TGZURL="https://ftp.hp.com/pub/softpaq/sp97001-97500/sp97120.tgz"
37+
38+
TGZFILENAME=`echo $TGZURL | sed 's/.*\///'`
39+
ROMFILENAME=`echo $TGZFILENAME | sed 's/\.zip$/\.ROM/'`
40+
41+
extractdir=$(mktemp -d)
42+
echo "### Creating temp dir $extractdir "
43+
cd "$extractdir"
44+
45+
echo "### Downloading $TGZURL"
46+
wget $TGZURL || { echo "ERROR: wget failed $TGZURL" && exit 1; }
47+
echo "### Verifying expected hash of $TGZFILENAME"
48+
echo "$BIN_TGZ_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on downloaded binary..." && exit 1; }
49+
50+
echo "### Extracting Archives"
51+
tar -xf $TGZFILENAME DOS\ Flash || { echo "Failed unzipping $TGZFILENAME - Tool installed on host?" && exit 1;}
52+
53+
echo "### Verifying expected hash of $ROMFILENAME"
54+
echo "$BIN_FILE_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on extracted binary..." && exit 1; }
55+
56+
echo "### Applying me_cleaner to neuter and truncate. EFFS,FCRS whitelisted"
57+
$MECLEAN -S -r -t -d -O /tmp/unneeded.bin -D "$BLOBDIR/ifd.bin" -M "$BLOBDIR/me.bin" "$BIN_FILE"
58+
59+
printf '\x00' | dd of="$BLOBDIR/ifd.bin" bs=1 seek=3837 count=1 conv=notrunc
60+
printf '\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF' | dd of="$BLOBDIR/ifd.bin" bs=1 seek=3712 count=40 conv=notrunc
61+
62+
echo "### Verifying expected hashes"
63+
echo "$FINAL_IFD_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on generated IFD bin..." && exit 1; }
64+
echo "$FINAL_ME_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on generated ME binary..." && exit 1; }
65+
66+
echo "###Cleaning up..."
67+
cd -
68+
rm -r "$extractdir"

‎boards/z220-cmt-hotp-maximized/z220-cmt-hotp-maximized.config‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Inherit the rest from the base Z220 CMT config.
2+
include $(pwd)/boards/z220-cmt-maximized/z220-cmt-maximized.config
3+
4+
CONFIG_HOTPKEY=y
5+
6+
export CONFIG_BOARD_NAME="Hewlett-Packard Z220 Convertible Minitower (HOTP)"

‎boards/z220-cmt-maximized/z220-cmt-maximized.config‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
# Configuration for HP Z220 CMT
2+
#
3+
#The board supports Intel LGA1155, which allows for ME removal (both neuter+disable as claimed by me_cleaner)
4+
#, ME region resize/shrinking (aka 'maximized' board), as well as VSCC table modification.
5+
#It is similar to the ASUS P8Z77 motherboards in those respects, but comes with the bonus of ECC RAM compatibility.
6+
#
7+
#The blob download script uses the manufacturer supplied ME and IFD and performs the necessary
8+
#hashing. The download script also removes the VSCC table by overwriting a NULL at the VSCC
9+
#length table and FF bytes at the VSCC identifier table - using a printf with dd. The download
10+
#script also resizes the rom layout and minimizes ME while maximizing space.
11+
#The Computer comes as standard with an 16MB Flash chip, which means that no modification is
12+
#needed to replace the chip is order to use heads as we shrink ME and 'maximize' this board by
13+
#default. It is soldered onto the board, as is the TPM1 chip.
14+
#
15+
#Test platform
16+
#BOARD: HP Z220 CMT
17+
#RAM: 16GB - 2x ATP DDR3 ECC
18+
#CPU: Intel E3-1275v2
19+
#Even though this has been tested with a discrete graphics card installed, like on other Sandy/Ivy Bridge boards Heads is configured to use the iGPU, i.e. to get a display output while running Heads please
20+
#avoid the 1230, 1270v2, etc in favour of 1245v2, 2600k etc.
21+
#
22+
#note: nohz=off is an optional CONFIG_LINUX_COMMAND_LINE parameter to supress repeated NOHZ: local_softirq_pending console output
23+
#
24+
CONFIG_LINUX_CONFIG=config/linux-c216.config
25+
CONFIG_COREBOOT_CONFIG=config/coreboot-z220-cmt.config
26+
27+
export CONFIG_COREBOOT=y
28+
export CONFIG_COREBOOT_VERSION=4.19
29+
export CONFIG_LINUX_VERSION=5.10.5
30+
31+
CONFIG_CRYPTSETUP2=y
32+
CONFIG_FLASHROM=y
33+
CONFIG_FLASHTOOLS=y
34+
CONFIG_GPG2=y
35+
CONFIG_KEXEC=y
36+
CONFIG_UTIL_LINUX=y
37+
CONFIG_LVM2=y
38+
CONFIG_MBEDTLS=y
39+
CONFIG_PCIUTILS=y
40+
CONFIG_POPT=y
41+
CONFIG_QRENCODE=y
42+
CONFIG_TPMTOTP=y
43+
44+
#platform locking finalization (PR0)
45+
CONFIG_IO386=y
46+
export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
47+
48+
# Dependencies for a graphical menu. Enable CONFIG_SLANG and CONFIG_NEWT instead
49+
# for a console-based menu.
50+
CONFIG_CAIRO=y
51+
CONFIG_FBWHIPTAIL=y
52+
53+
CONFIG_LINUX_USB=y
54+
55+
export CONFIG_TPM=y
56+
export CONFIG_BOOTSCRIPT=/bin/gui-init
57+
export CONFIG_BOOT_REQ_HASH=n
58+
export CONFIG_BOOT_REQ_ROLLBACK=n
59+
export CONFIG_BOOT_KERNEL_ADD="intel_iommu=igfx_off"
60+
export CONFIG_BOOT_KERNEL_REMOVE="quiet"
61+
export CONFIG_BOOT_DEV="/dev/sda1"
62+
export CONFIG_BOARD_NAME="Hewlett-Packard Z220 Convertible Minitower"
63+
export CONFIG_FLASHROM_OPTIONS="-p internal"
64+
65+
# Make the Coreboot build depend on the following 3rd party blobs:
66+
$(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: \
67+
$(pwd)/blobs/z220/me.bin $(pwd)/blobs/z220/ifd.bin
68+
69+
$(pwd)/blobs/z220/me.bin:
70+
COREBOOT_DIR="$(build)/$(coreboot_base_dir)" \
71+
$(pwd)/blobs/z220/download_BIOS_clean.sh
72+
73+
$(pwd)/blobs/z220/ifd.bin:
74+
COREBOOT_DIR="$(build)/$(coreboot_base_dir)" \
75+
$(pwd)/blobs/z220/download_BIOS_clean.sh

0 commit comments

Comments
 (0)