Add Novacustom V54 (v540tu)

[filipleple]

So far we've confirmed this code boots on V54, including the recent Full HD revision. The coreboot-dasharo_commit_hash is due to change to a more recent one if we come up with a proper fix for Dasharo/dasharo-issues#1243 soon enough. Otherwise, we might want to publish a release based on the same coreboot revision as for V56 and include the patches in the next release.

[tlaurion]

@filipleple board not present under .circleci/config.yml: please add so that CircleCI builds the board roms
EDIT: see Dasharo#13

[tlaurion]

So far we've confirmed this code boots on a V54. The coreboot-dasharo_commit_hash is due to change to a more recent one if we come up with a proper fix for Dasharo/dasharo-issues#1243 soon enough. Otherwise, we might want to publish a release based on the same coreboot revision as for V56 and include the patches in the next release.

Note that this will be affected by #1911 and Dasharo/dasharo-issues#1216 (comment) since same coreboot commit as for v560tu which suffers from those issues.

Is that what we want as a first release for v540tu? This won't pass QubesOS certification as noted under #1911

CC @macpijan @filipleple

[macpijan]

We do not want, we'll see what we will end up with.

[tlaurion]

Testing trace:

• External flash successful of https://output.circle-artifacts.com/output/job/177944be-c985-4658-a4e8-c5559516a5a7/artifacts/0/build/x86/novacustom-v540tu/heads-novacustom-v540tu-v0.2.0-2608-gf7f3b2f.zip (commit f7f3b2f as per filename)
  • External flash with Tigard on 3.3v mode (not 1.8, otherwise all https://docs.dasharo.com/unified/novacustom/recovery/#v540tnd-14th-gen_1: ok)

user@heads-v540tu:~$ false; while [ $? != 0 ]; do sudo flashrom -p ft2232_spi:type=2232H,port=B,divisor=4 -r v540TU_14th_gen_backup.rom -c "GD25LB256F/GD25LR256F"; done
flashrom v1.5.0-devel (git:v1.4.0-76-gcbdb8534) on Linux 6.6.77-1.qubes.fc37.x86_64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Found GigaDevice flash chip "GD25LB256F/GD25LR256F" (32768 kB, SPI) on ft2232_spi.
Reading flash... done.
user@heads-v540tu:~$ false; while [ $? != 0 ]; do sudo flashrom -p ft2232_spi:type=2232H,port=B,divisor=4 -v v540TU_14th_gen_backup.rom -c "GD25LB256F/GD25LR256F"; done
flashrom v1.5.0-devel (git:v1.4.0-76-gcbdb8534) on Linux 6.6.77-1.qubes.fc37.x86_64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Found GigaDevice flash chip "GD25LB256F/GD25LR256F" (32768 kB, SPI) on ft2232_spi.
Verifying flash... VERIFIED.


user@heads-v540tu:~$ false; while [ $? != 0 ]; do sudo flashrom -p ft2232_spi:type=2232H,port=B,divisor=4 -w heads-novacustom-v540tu-v0.2.0-2608-gf7f3b2f.rom --ifd -i fd -i me -i bios -c "GD25LB256F/GD25LR256F"; done
flashrom v1.5.0-devel (git:v1.4.0-76-gcbdb8534) on Linux 6.6.77-1.qubes.fc37.x86_64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Found GigaDevice flash chip "GD25LB256F/GD25LR256F" (32768 kB, SPI) on ft2232_spi.
Reading ich descriptor... done.
Using regions: "bios", "me", "fd".
Reading old flash chip contents... done.
Updating flash chip contents... Erase/write done from 6000 to 88afff
Erase/write done from 88b000 to 1ffffff
Erase/write done from 0 to 3fff
Verifying flash... VERIFIED.

• Boots successfully after external flash
  • Takes around 2 minutes if not more (not measured) and two automatic reboot
• Setting clock prompt on first reboot: ok (triggered correctly after initial flashing and cmos battery disconnected)
• Clean boot detected (no keyring, nothing installed on disk): usb boot proposed and followed
  • Boots on usb: ok
  • QubesOS 4.2.4: first stage install in tlvm default mode on 1tb drive as provided by @wessel-novacustom (v560tu with hd panel): ok
  • Reboot ok.
  • Heads: no pubkey in firmware, following unsafe boot instructions from https://osresearch.net/InstallingOS/#installing-qubes-4x for second stage: ok
    • second stage sluggish, showing IO/CPU perf issues needing correboot fixes as pointed out at Performance increase for -TU Series (comparison with NVIDIA variants) - coreboot issue Dasharo/dasharo-issues#1216 (comment)
      • wait for fixes to be pushed in fork to address perf issur for both v56 since issue is closed for UEFI at Performance increase for -TU Series (comparison with NVIDIA variants) - coreboot issue Dasharo/dasharo-issues#1216 (comment)
  • reboot: ok
• Heads: No pubkey detected, but OS detected -> Oem-Factory-reset proposed. Done with nk3: ok (gpg ops:ok, flashprog ops on fd,me,bios regions:ok)
• On reboot after re-ownership: Generate new HOTP/TOTP: ok
• On reboot: default boot proposes to choose boot default + TPM DUK: ok
• TPM DUK boots QuebesOS 4.2.4: ok
• Suspend/resume works: ok
  • commented at sys-usb panic on suspend on Dasharo+heads 0.9.0 (V560TU) Dasharo/dasharo-issues#1242 (comment) to state it only affects v560tu, not replicated yet, tell me if you need to.
• wifi works if sys-usb based on fedora: ok
  • (not working when sys-net based on debian-12 still)
• PR0: ok
  • flashprog -p internal (not locked)
  • lock_chip (locks_
  • flashprog -p internal (reports locked)

[tlaurion]

We do not want, we'll see what we will end up with.

Plan is to resolve performance issues fixed under Dasharo-UEFI for Dasharo-Heads (coreboot fork) later:
Dasharo/dasharo-issues#1216 (comment)

[macpijan]

@tlaurion Do you have other comments to be resolved prior merging it, so we can proceed with the release (assuming we do not have the fix for performance yet Dasharo/dasharo-issues#1249 )?

[tlaurion]

@tlaurion Do you have other comments to be resolved prior merging it, so we can proceed with the release (assuming we do not have the fix for performance yet Dasharo/dasharo-issues#1249 )?

Unfixed known issue also affecting nv41
Dasharo/dasharo-issues#985 (comment)

[macpijan]

It won't be fixed right now. As explained in the linked issue, there is no such FSP option for MTL right now to expose this. We will recheck again with future releases, with newer FSP versions.

How does NV41 affect this MTL release here?

Yes, per (heads) coreboot config, early DMA is disabled for NV41 board. Maybe there was a reason for it, I do not recall it immediately. We can go back to the original MR bringing these Alder Lake boards to heads, maybe we can get some answers there. If this is needed, we can discuss it with the next NV41 releases, not sure how it affects this MR.

[tlaurion]

It won't be fixed right now. As explained in the linked issue, there is no such FSP option for MTL right now to expose this. We will recheck again with future releases, with newer FSP versions.

How does NV41 affect this MTL release here?

Yes, per (heads) coreboot config, early DMA is disabled for NV41 board. Maybe there was a reason for it, I do not recall it immediately. We can go back to the original MR bringing these Alder Lake boards to heads, maybe we can get some answers there. If this is needed, we can discuss it with the next NV41 releases, not sure how it affects this MR.

As long as its in the known issues, and nv41 is marked affected in referred issue or duplicated for upstream tracking (coreboot side), I do not see this as a blocker to merge this PR @macpijan. Just need to point release notes PR and LGTM

[tlaurion]

LGTM!

[tlaurion]

It won't be fixed right now. As explained in the linked issue, there is no such FSP option for MTL right now to expose this. We will recheck again with future releases, with newer FSP versions.
How does NV41 affect this MTL release here?
Yes, per (heads) coreboot config, early DMA is disabled for NV41 board. Maybe there was a reason for it, I do not recall it immediately. We can go back to the original MR bringing these Alder Lake boards to heads, maybe we can get some answers there. If this is needed, we can discuss it with the next NV41 releases, not sure how it affects this MR.

As long as its in the known issues, and nv41 is marked affected in referred issue or duplicated for upstream tracking (coreboot side), I do not see this as a blocker to merge this PR @macpijan. Just need to point release notes PR and LGTM

Yes, per (heads) coreboot config, early DMA is disabled for NV41 board.

@macpijan for clarity: even if enabled, Dasharo/dasharo-issues#985 (comment) shows early dma protection cannot be applied.

[tlaurion]

@macpijan so merge?

[macpijan]

@macpijan so merge?

Yes please