Skip to content

Commit e32fc91

Browse files
tlauriontlaurion
authored
Merge pull request #1358 from ThePlexus/p8z77-m_pro
2 parents 5b9d952 + b64077f commit e32fc91

File tree

5 files changed

+215
-0
lines changed

5 files changed

+215
-0
lines changed

‎.circleci/config.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -519,6 +519,20 @@ workflows:
519519
requires:
520520
- librem_14
521521

522+
- build:
523+
name: p8z77-m_pro-tpm1-maximized
524+
target: p8z77-m_pro-tpm1-maximized
525+
subcommand: ""
526+
requires:
527+
- librem_14
528+
529+
- build:
530+
name: p8z77-m_pro-tpm1-hotp-maximized
531+
target: p8z77-m_pro-tpm1-hotp-maximized
532+
subcommand: ""
533+
requires:
534+
- librem_14
535+
522536
# - build:
523537
# name: kgpe-d16_workstation-usb_keyboard
524538
# target: kgpe-d16_workstation-usb_keyboard

‎blobs/p8z77-m_pro/download_BIOS_clean.sh‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
#!/bin/bash
2+
# P7 ASUS
3+
4+
function printusage {
5+
echo "Usage: $0 -m <me_cleaner> -c <COREBOOT_DIR>"
6+
}
7+
8+
BLOB_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
9+
10+
if [ "$#" -eq 0 ]; then printusage; fi
11+
12+
while getopts ":m:c:" opt; do
13+
case $opt in
14+
m)
15+
if [ -x "$OPTARG" ]; then
16+
MECLEAN="$OPTARG"
17+
fi
18+
;;
19+
c)
20+
if [ -x "$OPTARG" ]; then
21+
COREBOOT_DIR="$OPTARG"
22+
fi
23+
;;
24+
esac
25+
26+
done
27+
28+
29+
if [[ -z "${COREBOOT_DIR}" ]]; then
30+
COREBOOT_DIR="$(find "${BLOB_DIR}/../../build/x86/" -maxdepth 1 -type d -name 'coreboot-*')"
31+
if [[ -z "${COREBOOT_DIR}" ]]; then
32+
echo "ERROR: No COREBOOT_DIR variable defined, and no coreboot path found automagically."
33+
exit 1
34+
fi
35+
fi
36+
37+
if [ -z "$MECLEAN" ]; then
38+
MECLEAN=`command -v $COREBOOT_DIR/util/me_cleaner/me_cleaner.py 2>&1|head -n1`
39+
if [ -z "$MECLEAN" ]; then
40+
echo "me_cleaner.py required but not found or specified with -m. Aborting."
41+
exit 1;
42+
fi
43+
fi
44+
45+
CAP_ZIP_SHA256SUM="baf7f513227542c507e46735334663f63a0df5be9f6632d7b0f0cca5d3b9f980 P8Z77-M-PRO-ASUS-2203.zip"
46+
CAP_FILE_SHA256SUM="d9bf292778655d4e20f5db2154cd6a2229e42b60ce670a68d759f1dac757aaf0 P8Z77-M-PRO-ASUS-2203.CAP"
47+
FINAL_IFD_SHA256SUM="702570d59c11b9b70ab9d54b26ff0906a07edf15eebe63f40bcecb04b955969f ifd.bin"
48+
FINAL_ME_SHA256SUM="8dda1e8360fbb2da05bfcd187f6e7b8a272a67d66bc0074bbfd1410eb35e3e17 me.bin"
49+
ZIPURL="https://dlcdnets.asus.com/pub/ASUS/mb/LGA1155/P8Z77-M_PRO/P8Z77-M-PRO-ASUS-2203.zip"
50+
51+
ZIPFILENAME=`echo $ZIPURL | sed 's/.*\///'`
52+
ROMFILENAME=`echo $ZIPFILENAME | sed 's/\.zip$/\.ROM/'`
53+
54+
extractdir=$(mktemp -d)
55+
echo "### Creating temp dir $extractdir "
56+
cd "$extractdir"
57+
58+
echo "### Downloading $ZIPURL"
59+
wget $ZIPURL || { echo "ERROR: wget failed $ZIPURL" && exit 1; }
60+
echo "### Verifying expected hash of $ZIPFILENAME"
61+
echo "$CAP_ZIP_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on downloaded binary..." && exit 1; }
62+
63+
echo "### Extracting Archives"
64+
unzip $ZIPFILENAME || { echo "Failed unzipping $ZIPFILENAME - Tool installed on host?" && exit 1;}
65+
66+
echo "### Verifying expected hash of $ROMFILENAME"
67+
echo "$CAP_FILE_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on extracted binary..." && exit 1; }
68+
69+
echo "### extracing BIOS from Capsule"
70+
dd bs=1024 skip=2 if=P8Z77-M-PRO-ASUS-2203.CAP of=P8Z77-M-PRO-ASUS-2203.ROM || { echo "Failed to de-cap the ROM..." && exit 1; }
71+
72+
echo "### Applying me_cleaner to neuter and truncate."
73+
$MECLEAN -S -r -t -d -O /tmp/unneeded.bin -D "ifd.bin" -M "me.bin" P8Z77-M-PRO-ASUS-2203.ROM
74+
75+
if [[ "${CONFIG_ZERO_IFD_VSCC}" =~ ^(Y|y)$ ]]; then
76+
FINAL_IFD_SHA256SUM="092caeee117de27c0eb30587defcb6449a33c7c325b6f3c47b5a7a79670b5c3f ifd.bin"
77+
echo "### Modifying VSCC length and identifiers"
78+
printf '\x00' | dd of=ifd.bin bs=1 seek=3837 count=1 conv=notrunc
79+
printf '\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF' | dd of=ifd.bin bs=1 seek=3568 count=32 conv=notrunc
80+
echo "### Verifying expected hashes"
81+
else
82+
echo "### Skipping VSCC modification by config"
83+
fi
84+
echo "$FINAL_IFD_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on generated IFD bin..." && exit 1; }
85+
mv ifd.bin $BLOB_DIR/ifd.bin
86+
echo "$FINAL_ME_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on generated ME binary..." && exit 1; }
87+
mv me.bin $BLOB_DIR/me.bin
88+
89+
echo "###Cleaning up..."
90+
cd -
91+
rm -r "$extractdir"

‎boards/p8z77-m_pro-tpm1-hotp-maximized/p8z77-m_pro-tpm1-hotp-maximized.config‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Inherit the rest from the base Asus P8Z77-M Pro config.
2+
include $(pwd)/boards/p8z77-m_pro-tpm1-maximized/p8z77-m_pro-tpm1-maximized.config
3+
4+
CONFIG_HOTPKEY=y
5+
6+
export CONFIG_BOARD_NAME="P8Z77-M PRO-HOTP"

‎boards/p8z77-m_pro-tpm1-maximized/p8z77-m_pro-tpm1-maximized.config‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# Configuration for Asus P8Z77-M Pro
2+
#This board is a better choice over the P8H61 for a cost effective Heads + QubesOS desktop with ME neuter+disable compatibility.
3+
#The P8H61 ecosystem was complex with multiple variants
4+
#(some not even having a TPM header, and others having RamInit issues with some memory sticks),
5+
##while less feature rich than the P8Z77 family. The P8H61s that were compatible still required
6+
#some ME #sections (FCRS,EFFS) to be whitelisted in order to post, which introduced unknowns.
7+
#The P8H61s #also needed a larger flash chip to work with heads than the manufacturer supplied
8+
#4M, which add#ed complexity for the average user.
9+
#
10+
#The P8Z77-M Pro is able to offer more SATA connectors (2x 6Gb, 4x 3Gb, 2x eSATA) as well as
11+
#more full size expansion ports. The board has a PS/2 keyboard port as recommended for QubesOS.
12+
##The board comes with 8M flash chip as standard.
13+
#
14+
#The i7-3770 is the best CPU available for the board, with VT-x & VT-d both present
15+
16+
#ME & ROM
17+
#The board supports Intel LGA1155, which allow for ME removal (both neuter+disable work), ME
18+
#region resize/shrinking (aka 'maximized' board), as well as VSCC table modification..
19+
#The blob download script uses the manufacturer supplied ME and IFD and performs the necessary
20+
#hashing. The download script also removes the VSCC table by overwriting a NULL at the VSCC
21+
#length table and FF bytes at the VSCC identifier table - using a printf with dd. The download
22+
#script also resizes the rom layout and minimizes ME while maximizing space.
23+
#The P8Z77-M Pro comes as standard with an 8Mb Flash chip, which means that no modification is
24+
#needed to replace the chip is order to use heads as we shrink ME and 'maximize' this board by
25+
#default, leaving just 335396 bytes available.
26+
#The P8Z77-M Pro has both TPM1 and TPM2 modules available, though at time of writing only the
27+
#TPM1 module would be usable with heads until the TPM2 work is completed. All testing was done
28+
#with a TPM1 module
29+
#
30+
#Test platform
31+
#BOARD: Asus P8Z77-M Pro
32+
#RAM: 32Gb - 4x TimeTec DDRL3 75TT16NUL2R8-8G
33+
#CPU: Intel i7 3770
34+
#TPM: Modules tested: Asus branded TPM 1.02H & Foxconn TPM Krypton Rev 1.0
35+
#
36+
# note: nohz=off is an optional CONFIG_LINUX_COMMAND_LINE parameter to supress repeated NOHZ: local_softirq_pending console output
37+
#
38+
CONFIG_LINUX_CONFIG=config/linux-x230-maximized.config
39+
CONFIG_COREBOOT_CONFIG=config/coreboot-p8z77-m_pro-tpm1.config
40+
41+
export CONFIG_COREBOOT=y
42+
export CONFIG_COREBOOT_VERSION=4.17
43+
export CONFIG_LINUX_VERSION=4.14.62
44+
45+
CONFIG_CRYPTSETUP2=y
46+
CONFIG_FLASHROM=y
47+
CONFIG_FLASHTOOLS=y
48+
CONFIG_GPG2=y
49+
CONFIG_KEXEC=y
50+
CONFIG_UTIL_LINUX=y
51+
CONFIG_LVM2=y
52+
CONFIG_MBEDTLS=y
53+
CONFIG_PCIUTILS=y
54+
CONFIG_POPT=y
55+
CONFIG_QRENCODE=y
56+
CONFIG_TPMTOTP=y
57+
58+
# Dependencies for a graphical menu. Enable CONFIG_SLANG and CONFIG_NEWT instead
59+
# for a console-based menu.
60+
CONFIG_CAIRO=y
61+
CONFIG_FBWHIPTAIL=y
62+
63+
CONFIG_LINUX_USB=y
64+
65+
export CONFIG_TPM=y
66+
export CONFIG_BOOTSCRIPT=/bin/gui-init
67+
export CONFIG_BOOT_REQ_HASH=n
68+
export CONFIG_BOOT_REQ_ROLLBACK=n
69+
export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off"
70+
export CONFIG_BOOT_KERNEL_REMOVE="quiet"
71+
export CONFIG_BOOT_DEV="/dev/sda1"
72+
export CONFIG_BOARD_NAME="P8Z77-M PRO"
73+
export CONFIG_FLASHROM_OPTIONS="-p internal"
74+
#Set this option to zero out the VSCC table https://github.com/osresearch/heads/pull/1358#discussion_r1153251399
75+
export CONFIG_ZERO_IFD_VSCC=y
76+
77+
# Make the Coreboot build depend on the following 3rd party blobs:
78+
$(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: \
79+
$(pwd)/blobs/p8z77-m_pro/me.bin $(pwd)/blobs/p8z77-m_pro/ifd.bin
80+
81+
$(pwd)/blobs/p8z77-m_pro/me.bin:
82+
COREBOOT_DIR="$(build)/$(coreboot_base_dir)" \
83+
$(pwd)/blobs/p8z77-m_pro/download_BIOS_clean.sh
84+
85+
$(pwd)/blobs/p8z77-m_pro/ifd.bin:
86+
COREBOOT_DIR="$(build)/$(coreboot_base_dir)" \
87+
$(pwd)/blobs/p8z77-m_pro/download_BIOS_clean.sh

‎config/coreboot-p8z77-m_pro-tpm1.config‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
CONFIG_USE_BLOBS=y
2+
CONFIG_VENDOR_ASUS=y
3+
CONFIG_CBFS_SIZE=0x7E7000
4+
CONFIG_BOARD_ASUS_P8Z77_M_PRO=y
5+
CONFIG_HAVE_IFD_BIN=y
6+
CONFIG_HAVE_ME_BIN=y
7+
CONFIG_IFD_BIN_PATH="@BLOB_DIR@/p8z77-m_pro/ifd.bin"
8+
CONFIG_ME_BIN_PATH="@BLOB_DIR@/p8z77-m_pro/me.bin"
9+
CONFIG_NO_GFX_INIT=y
10+
CONFIG_TPM_MEASURED_BOOT=y
11+
CONFIG_TPM1=y
12+
CONFIG_DRIVERS_PS2_KEYBOARD=y
13+
CONFIG_DEFAULT_CONSOLE_LOGLEVEL_6=y
14+
CONFIG_PAYLOAD_LINUX=y
15+
CONFIG_PAYLOAD_FILE="@BOARD_BUILD_DIR@/bzImage"
16+
CONFIG_LINUX_INITRD="@BOARD_BUILD_DIR@/initrd.cpio.xz"
17+
CONFIG_LINUX_COMMAND_LINE="intel_iommu=on intel_iommu=igfx_off nohz=off"

0 commit comments

Comments
 (0)