From cb0e0e3b48ca4a82b446e60f2f6d2f8007ab1b5d Mon Sep 17 00:00:00 2001 From: eliot Date: Sat, 18 Sep 2021 19:26:31 +0200 Subject: [PATCH] --- guider.mdwn | 267 +++++++++++++++++++++++++++------------------------- 1 file changed, 137 insertions(+), 130 deletions(-) diff --git a/guider.mdwn b/guider.mdwn index 042c233..852aa02 100644 --- a/guider.mdwn +++ b/guider.mdwn @@ -20,7 +20,9 @@ Pomona chip holders 10cm wires + ## General + For flashing see this [(X200 Libreboot) guide](https://libreboot.org/docs/install/x200_external.html) for a general idea, however each system has their own chip configuration which differs a little. When installing an OS on a Libreboot (/Coreboot) system, use these [guides](https://libreboot.org/docs/gnulinux/) (old link?). @@ -32,53 +34,8 @@ __Note:__ So for security it is wise to encrypt /boot/, which is then decrypted But since [Libreboot 20210522](https://libreboot.org/news/libreboot20210522.html) LUKSv2 is supported. -## GRUB - -For some setups the default GRUB script does not work. Either try updating the grub.cfg to boot automatically or boot manually each time. - -### Boot manually - - #Open commandline in GRUB - cryptomount -a #decrypt all HDDs (can also specify disk manually) - root=lvm/matrix-boot #default boot partition, or use `ls` to list partitions - linux=/vmlinuz #if (the symlink) not present, choose latest file, press TAB to list - initrd=/initrd #if (the symlink) not present, choose latest file, press TAB to list - boot - -### Boot automatically -Add the below to the preferred boot option, in grub.cfg, for automatic boot. It is recommended to test any configuration with grubtest.cfg, before changing the main config grub.cfg. This can then be flashed internally as described in later section. - - menuentry 'Boot to regular encrypted OS [x]' --hotkey='x' { - #Simple setup to boot from encrypted boot partition - #LUKS -> LVM -> logical volumes - #LVM name matrix and boot volume rootvol or boot - #Might get weird if multiple lvm devices connected - - cryptomount -a - - #try boot first since rootvol might symlink to boot and break - set root=(lvm/matrix-boot) - if [ -f "/vmlinuz" ]; then - if [ -f "/initrd.img" ]; then - linux /vmlinuz - initrd /initrd.img - fi - - else - echo "Trying to boot lvm/matrix-boot.." - echo "Couldn't find kernel" - echo "Trying to boot lvm/matrix-rootvol.." - set root=(lvm/matrix-rootvol) - if [ -f "/vmlinuz" ]; then - if [ -f "/initrd.img" ]; then - linux /vmlinuz - initrd /initrd.img - fi - fi - - fi - } +# General flash guides ## Flashing Internally @@ -111,90 +68,6 @@ Note these tools are built and ready [at](https://www.mirrorservice.org/sites/li sudo ./flashrom -p internal -w my.rom #updated image -## OpenBSD guide - -It _is_ possible to use OpenBSD with Coreboot (we haven't tried) and Libreboot (as we verified below), but they do not support hard drive encryption! - -When installing OpenBSD on the x200, the OS was first installed on the HDD then flashed. Then, add a "/grub" directory that allows grub to automatically boot into openbsd instead of going into command line. - -#### The manual way is to press "c" when the grub menu appears: -``` -grub> kopenbsd (usb0,openbsd1)/6.1/amd64/bsd.rd -grub> boot - -``` -#### The more nicer way (as root do): -``` -mkdir /grub && cd grub -echo ''' -default=0 -timeout=3 - -menuentry "OpenBSD"{ - kopenbsd (usb0,openbsd1)/6.1/amd64/bsd.rd -} - -''' > libreboot_grub.cfg - -#cat libreboot_grub.cfg -default=0 -timeout=3 - -menuentry "OpenBSD"{ - kopenbsd (usb0,openbsd1)/6.2/amd64/bsd.rd -} - - -#reboot -``` -This works very good with openbsd6.0(and 6.2), read more [here](https://libreboot.org/docs/bsd/openbsd.html)(use amd64, X is not working with i386) - -[update] I have run openbsd 6.2 with libreboot on thinkpad x200 for about two months now without any errors, still no update on the harddisk crypto - -## Extend 2MB ROM to 8MB - -### Here is the script we use to flash 8mb chip - -``` -root@beaglebone:~# cat flashme_8mb.sh -echo 'Creating a 8mb Libreboot Rom' -echo 'creating the file /home/flashing_d16/libreSept16/8mb_free.rom' -echo 'dd ing' -touch /home/flashing_d16/libreSept16/8mb_free.rom -echo ' ' > /home/flashing_d16/libreSept16/8mb_free.rom -echo 'Zeros then image' -dd if=/dev/zero bs=6144k count=1 of=/home/flashing_d16/libreSept16/8mb_free.rom -echo 'Writing image' -dd if=/home/flashing_d16/libreSept16/libreboot_r20160907_grub_kgpe-d16/kgpe-d16_svenska_txtmode.rom >> /home/flashing_d16/libreSept16/8mb_free.rom -ls -lah /home/flashing_d16/libreSept16/8mb_free.rom -echo 'Its flashing time' -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=2048 -w /home/flashing_d16/libreSept16/8mb_free.rom -echo 'everything is done' -echo 'plz verify' -echo ' -cd directory-with-size -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory.rom -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory1.rom -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory2.rom -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=1024 -r factory3.rom -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=1024 -r factory4.rom -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=1024 -r factory5.rom -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=256 -r factory6.rom -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=256 -r factory7.rom -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=256 -r factory8.rom -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=2048 -r factory9.rom -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=2048 -r factory10.rom -/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=2048 -r factory11.rom -sha512sum factory*.rom -' - -``` - - -# Specific flash guides - -BEFORE flashing laptops make sure EC version is up to date (yes it's proprietary). (Link for fun: .. __Sorry for broken link!__) - ## Building Libreboot and preparing ROM @@ -261,6 +134,11 @@ Unlike Coreboot, this build process is fairly automated and does not present any #sudo ./flashrom/flashrom -p internal -w x200.rom + +# Specific flash guides + +BEFORE flashing laptops make sure EC version is up to date (yes it's proprietary). (Link for fun: .. __Sorry for broken link!__) + ## T400 without blobs (Coreboot) Here's our config for coreboot, copy it here to this path [coreboot/.config](t400_coreboot/). ( Below in the text we refer to it as ~/coreboot_config_t400_8mb ) @@ -535,6 +413,135 @@ ROM-chip (eg.): Winbond W25Q16DV (if ROM too small can extend, see: *Extend 2MB # Thus, it is possible to write to the ROM and read (e.g.) 10 times and compare the resulting `sha512sum` to that of the ROM downloaded from Libreboot. # If the sum EXACTLY matches atleast once, it is reasonable to assume that the write indeed succeeded (we believe). +# Extras for Libreboot and Coreboot + +## GRUB + +For some setups the default GRUB script does not work. Either try updating the grub.cfg to boot automatically or boot manually each time. + +### Boot manually + + #Open commandline in GRUB + cryptomount -a #decrypt all HDDs (can also specify disk manually) + root=lvm/matrix-boot #default boot partition, or use `ls` to list partitions + linux=/vmlinuz #if (the symlink) not present, choose latest file, press TAB to list + initrd=/initrd #if (the symlink) not present, choose latest file, press TAB to list + boot + +### Boot automatically +Add the below to the preferred boot option, in grub.cfg, for automatic boot. It is recommended to test any configuration with grubtest.cfg, before changing the main config grub.cfg. This can then be flashed internally as described in earlier section. + + menuentry 'Boot to regular encrypted OS [x]' --hotkey='x' { + #Simple setup to boot from encrypted boot partition + #LUKS -> LVM -> logical volumes + #LVM name matrix and boot volume rootvol or boot + #Might get weird if multiple lvm devices connected + + cryptomount -a + + #try boot first since rootvol might symlink to boot and break + set root=(lvm/matrix-boot) + if [ -f "/vmlinuz" ]; then + if [ -f "/initrd.img" ]; then + linux /vmlinuz + initrd /initrd.img + fi + + else + echo "Trying to boot lvm/matrix-boot.." + echo "Couldn't find kernel" + echo "Trying to boot lvm/matrix-rootvol.." + set root=(lvm/matrix-rootvol) + if [ -f "/vmlinuz" ]; then + if [ -f "/initrd.img" ]; then + linux /vmlinuz + initrd /initrd.img + fi + fi + + fi + } + + +## OpenBSD guide + +It _is_ possible to use OpenBSD with Coreboot (we haven't tried) and Libreboot (as we verified below), but they do not support hard drive encryption! + +When installing OpenBSD on the x200, the OS was first installed on the HDD then flashed. Then, add a "/grub" directory that allows grub to automatically boot into openbsd instead of going into command line. + +#### The manual way is to press "c" when the grub menu appears: +``` +grub> kopenbsd (usb0,openbsd1)/6.1/amd64/bsd.rd +grub> boot + +``` +#### The more nicer way (as root do): +``` +mkdir /grub && cd grub +echo ''' +default=0 +timeout=3 + +menuentry "OpenBSD"{ + kopenbsd (usb0,openbsd1)/6.1/amd64/bsd.rd +} + +''' > libreboot_grub.cfg + +#cat libreboot_grub.cfg +default=0 +timeout=3 + +menuentry "OpenBSD"{ + kopenbsd (usb0,openbsd1)/6.2/amd64/bsd.rd +} + + +#reboot +``` +This works very good with openbsd6.0(and 6.2), read more [here](https://libreboot.org/docs/bsd/openbsd.html)(use amd64, X is not working with i386) + +[update] I have run openbsd 6.2 with libreboot on thinkpad x200 for about two months now without any errors, still no update on the harddisk crypto + +## Extend 2MB ROM to 8MB + +### Here is the script we use to flash 8mb chip + +``` +root@beaglebone:~# cat flashme_8mb.sh +echo 'Creating a 8mb Libreboot Rom' +echo 'creating the file /home/flashing_d16/libreSept16/8mb_free.rom' +echo 'dd ing' +touch /home/flashing_d16/libreSept16/8mb_free.rom +echo ' ' > /home/flashing_d16/libreSept16/8mb_free.rom +echo 'Zeros then image' +dd if=/dev/zero bs=6144k count=1 of=/home/flashing_d16/libreSept16/8mb_free.rom +echo 'Writing image' +dd if=/home/flashing_d16/libreSept16/libreboot_r20160907_grub_kgpe-d16/kgpe-d16_svenska_txtmode.rom >> /home/flashing_d16/libreSept16/8mb_free.rom +ls -lah /home/flashing_d16/libreSept16/8mb_free.rom +echo 'Its flashing time' +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=2048 -w /home/flashing_d16/libreSept16/8mb_free.rom +echo 'everything is done' +echo 'plz verify' +echo ' +cd directory-with-size +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory.rom +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory1.rom +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory2.rom +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=1024 -r factory3.rom +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=1024 -r factory4.rom +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=1024 -r factory5.rom +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=256 -r factory6.rom +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=256 -r factory7.rom +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=256 -r factory8.rom +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=2048 -r factory9.rom +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=2048 -r factory10.rom +/home/flashing_d16/libreSept16/libreboot_r20160907_util/flashrom/armv7l/flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=2048 -r factory11.rom +sha512sum factory*.rom +' + +``` + # More -- 2.39.2