(WIP) Kgpe d16 current working

[tlaurion]

Trying to get back QubesOS GUI installer to install QubesOS on a preflashed Heads system (Mitigation of "LUKS volume creation error from QubesOS text-based installer WON'T FIX error")

[zifxify]

/heads/config/coreboot-kgpe-d16_server

CONFIG_PAYLOAD_FILE="../../build/kgpe-d16_server/bzImage"
CONFIG_LINUX_INITRD="../../build/kgpe-d16_server/initrd.cpio.xz"

/heads/config/coreboot-kgpe-d16_workstation

CONFIG_PAYLOAD_FILE="../../build/kgpe-d16_workstation/bzImage"
CONFIG_LINUX_INITRD="../../build/kgpe-d16_workstation/initrd.cpio.xz"

[tlaurion]

Thanks @zifxify. There is now AST support in linux. I'm doing some tests and mods to whiptail (gui-init) so that the server/laptops with/without TPM/Nitrokeys work as intended (#493)

I'm not sure there is really a need to seperate such boards if options are clearly defined in board config. If they are, i'll include your fixes!

[tlaurion]

Separated the boards properly (untested)

[tlaurion]

#712 followup.

• kgpe-d16_server board works with ASMBv4 baord receiving all terminal output, whcih should be controlled by ssh. (See commit messages)
• kgpe-d16_workstation is in WIP stage. Lost track of what was required, playing slowly with it. In current commit, AST was activated, while standard FB was deactivated. We try here to have AST_DRM so that FBwhiptail can fireup the gui-init instead of the generic-init.

[ghost]

@tlaurion need to enable onboard USB (doesn't work for previous versions). thanks for commit.

[tlaurion]

Why not PS2?

Having USB on by default for keyboards opens up a lot et attack vectors and is not recommended.

On workstation? Server?
That would also require to punch holes under qubesos.

[tlaurion]

Why not PS2?
Having USB on by default for keyboards opens up a lot et attack vectors and is not recommended.
On workstation? Server?
That would also require to punch holes under qubesos.

Only Workstation.
Sys-usb on Qubes - specially made for this?

https://www.qubes-os.org/doc/usb-devices/#using-usb-keyboards-and-other-input-devices

Edited. New Build. Everything works. Pike too.

@ 0rb677 I'm confused now. :P
USB keyboard works in Heads?

[tlaurion]

@0rb677 @Tonux599 @zifxify : Please let me know the current state of this PR at this point (and let me know if you know more people with boards in this issue.

You can find flashable artifacts for 46b9c79 by clicking the green check mark on the commit which will bring you to those roms from the artifacts tab:
kgpe-d16_workstation
kgpe-d16_server

[tlaurion]

@flammit : any objection on the server config? That was basically an upgrade of what was upstream with (plymouth fix for QubesOS) in board config and USB_COMPANION added.

[pkubaj]

I actually do not use heads, but pure coreboot 4.11 with SeaBIOS. I would be happy to test heads, but will I be able to boot FreeBSD with it? This is my primary operating system.

[tlaurion]

I actually do not use heads, but pure coreboot 4.11 with SeaBIOS. I would be happy to test heads, but will I be able to boot FreeBSD with it? This is my primary operating system.

Since its kexec based from a linux payload, I do not think so in current situation but if things involved in that area.. I'll remove you from the list of kgpe-d16 testers under heads for the moment then.

[ghost]

@tlaurion remove my comment. KGPE-D16 heads now works only with PS/2 keyboard.
I'm just really in a hurry all the time

[tlaurion]

@0rb677 pike support added in both boards following #712 (comment)

[tlaurion]

As said previously, once yellow dot will turn into green check, you can download build there (without USB keyboard support: PR welcome)

[tlaurion]

@0rb677 : board addition for kgpe-d16_workstation-usb_keyboard with Pike support.

[tlaurion]

@0rb677 b22d913 built successfully while save_cache for cache failed (got lost in commits it seems).

Artifact is there and downloadable for new board config. Let me know how it goes.

[tlaurion]

@0rb677 please test 2e4f046 build's artifacts above when build is finished and report in original ticket I tagged you in so that it can be merged in master.

[ghost]

I will do it tomorrow.

[ghost]

@tlaurion

[tlaurion]

@0rb677 I would like you to launch said script from recovery shell.
/bin/oem-factory-reset

And screenshot what happened out of whiptail, from shell output.

[ghost]

@0rb677 I would like you to launch said script from recovery shell.
/bin/oem-factory-reset

And screenshot what happened out of whiptail, from shell output.

@tlaurion

I dont understand it works with couple of bugs.
Now i attached gpg-card and external USB to PC when heads initialized. Then quit to shell and lauch oem-reset script.

1. It access to gpg-card
2. It generates oem-key
3. It changes Admin/Pin
4. Exporting key to USB
5. Reading Firmware
6. Adding gerenerate key to current firmware and re-flashing
7. Signed boot files and generate checksums

So it works?

[tlaurion]

Now par with master. Comments welcome, build happening on PR, as always (green arrow on latest commit: e9895eb)

Leading to https://circleci.com/gh/tlaurion/heads/432?utm_campaign=vcs-integration-link&utm_medium=referral&utm_source=github-build-link

When build is ready, you can download roms per artifacts for all roms not requiring blobs outside of repos.

[tlaurion]

Effort continues here: #867