Merge remote-tracking branch 'origin/master' into pre_release_dasharo_101_rc3

bumped to 1.0.1 released

Author: tlaurion

.circleci/config.yml

@@ -48,7 +48,8 @@ commands:
 jobs:
   prep_env:
     docker:
-      - image: tlaurion/heads-dev-env:v0.2.5
+      # Docker image: tlaurion/heads-dev-env:v0.2.7
+      - image: tlaurion/heads-dev-env@sha256:5f890f3d1b6b57f9e567191695df003a2ee880f084f5dfe7a5633e3e8f937479
     resource_class: large
     working_directory: ~/heads
     steps:
@@ -123,7 +124,8 @@ jobs:
 
   build_and_persist:
     docker:
-      - image: tlaurion/heads-dev-env:v0.2.5
+      # Docker image: tlaurion/heads-dev-env:v0.2.7
+      - image: tlaurion/heads-dev-env@sha256:5f890f3d1b6b57f9e567191695df003a2ee880f084f5dfe7a5633e3e8f937479
     resource_class: large
     working_directory: ~/heads
     parameters:
@@ -151,7 +153,8 @@ jobs:
 
   build:
     docker:
-      - image: tlaurion/heads-dev-env:v0.2.5
+      # Docker image: tlaurion/heads-dev-env:v0.2.7
+      - image: tlaurion/heads-dev-env@sha256:5f890f3d1b6b57f9e567191695df003a2ee880f084f5dfe7a5633e3e8f937479
     resource_class: large
     working_directory: ~/heads
     parameters:
@@ -172,7 +175,8 @@ jobs:
 
   save_cache:
     docker:
-      - image: tlaurion/heads-dev-env:v0.2.5
+      # Docker image: tlaurion/heads-dev-env:v0.2.7
+      - image: tlaurion/heads-dev-env@sha256:5f890f3d1b6b57f9e567191695df003a2ee880f084f5dfe7a5633e3e8f937479
     resource_class: large
     working_directory: ~/heads
     steps:
@@ -279,6 +283,14 @@ workflows:
           requires:
             - x86-musl-cross-make
 
+      # dasharo_msi
+      - build_and_persist:
+          name: UNTESTED_msi_z690a_ddr4
+          target: UNTESTED_msi_z690a_ddr4
+          subcommand: ""
+          requires:
+            - x86-musl-cross-make
+
       # Cache one workspace per architecture
       # Make sure workspace caches are chainloaded and the last in chain for an arch is saved
       - save_cache:
@@ -572,3 +584,25 @@ workflows:
           subcommand: ""
           requires:
             - novacustom-nv4x_adl
+
+      # dasharo_msi
+      - build:
+          name: UNTESTED_msi_z690a_ddr5
+          target: UNTESTED_msi_z690a_ddr5
+          subcommand: ""
+          requires:
+            - UNTESTED_msi_z690a_ddr4
+
+      - build:
+          name: UNTESTED_msi_z790p_ddr4
+          target: UNTESTED_msi_z790p_ddr4
+          subcommand: ""
+          requires:
+            - UNTESTED_msi_z690a_ddr4
+
+      - build:
+          name: msi_z790p_ddr5
+          target: msi_z790p_ddr5
+          subcommand: ""
+          requires:
+            - UNTESTED_msi_z690a_ddr4

BOARDS_AND_TESTERS.md

@@ -88,3 +88,10 @@ Desktops / Servers
 - [ ] Librem mini v1 (Whiskey Lake: Intel 8th Gen CPU : ESU ends 03/31/2026): @JonathonHall-Purism
 - [ ] Librem mini v2 (Comet Lake: Intel 10th Gen CPU): @JonathonHall-Purism
 - [ ] Talos II (Power9, PPC64LE): @tlaurion (became untested, low community interest despite large investment)
+
+MSI
+---
+- [ ] MSI PRO Z690-A (WIFI) (DDR4): **None** - Board is untested.
+- [ ] MSI PRO Z690-A (WIFI) (DDR5): **None** - Board is untested.
+- [ ] MSI PRO Z790-P (WIFI) (DDR4): **None** - Board is untested.
+- [ ] MSI PRO Z790-P (WIFI) (DDR5): @Tonux599

Makefile

@@ -65,6 +65,11 @@ $(info **LOADAVG** (default: 1.5 times CPUS, e.g., 'make LOADAVG=54'))
 $(info **AVAILABLE_MEM_GB** (default: memory available on the system in GB, e.g., 'make AVAILABLE_MEM_GB=4'))
 $(info **MEM_PER_JOB_GB** (default: 1GB per job, e.g., 'make MEM_PER_JOB_GB=2'))
 $(info ----------------------------------------------------------------------)
+ifeq "$(V)" ""
+$(info Hint: If the build fails, re-run with V=1 for full configure + validation output)
+$(info Verbose example: ./docker_repro.sh make BOARD=$(BOARD) V=1)
+$(info ----------------------------------------------------------------------)
+endif
 $(info !!!!!! Build starts !!!!!!)
 
 
@@ -284,6 +289,34 @@ all payload:
 	@sha256sum $< | tee -a "$(HASHES)"
 	@stat -c "%8s:%n" $< | tee -a "$(SIZES)"
 
+# Validate coreboot CBFS size against IFD BIOS region
+validate_cbfs_ifd:
+ifneq ($(CONFIG_COREBOOT),)
+	@echo "Validating $(BOARD) CBFS size against IFD BIOS region..."
+	@$(pwd)/bin/validate_cbfs_ifd_fit.sh \
+		--coreboot-dir "$(build)/$(coreboot_dir)" \
+		--board-dir "$(build)/$(BOARD)" \
+		--config "$(pwd)/$(CONFIG_COREBOOT_CONFIG)" || exit 1
+	@echo "✓ CBFS configuration is valid"
+else
+	@echo "Board $(BOARD) does not use coreboot, skipping validation"
+endif
+
+# Auto-fix coreboot CBFS size to match IFD BIOS region
+fix_cbfs_ifd:
+ifneq ($(CONFIG_COREBOOT),)
+	@echo "Auto-fixing $(BOARD) CBFS size to match IFD BIOS region..."
+	@$(pwd)/bin/validate_cbfs_ifd_fit.sh \
+		--coreboot-dir "$(build)/$(coreboot_dir)" \
+		--board-dir "$(build)/$(BOARD)" \
+		--config "$(pwd)/$(CONFIG_COREBOOT_CONFIG)" \
+		--fix || exit 1
+	@echo ""
+	@echo "If CONFIG_CBFS_SIZE was adjusted, next build will use the new size."
+else
+	@echo "Board $(BOARD) does not use coreboot, nothing to fix"
+endif
+
 # Disable all built in rules
 .INTERMEDIATE:
 .SUFFIXES:
@@ -902,11 +935,27 @@ modules.clean:
 # PUBKEY_ASC.
 inject_gpg: $(board_build)/$(CB_OUTPUT_FILE_GPG_INJ)
 
-$(board_build)/$(CB_OUTPUT_BASENAME)-gpg-injected.rom: $(board_build)/$(CB_OUTPUT_FILE)
-	cp "$(board_build)/$(CB_OUTPUT_FILE)" \
-		"$(board_build)/$(CB_OUTPUT_FILE_GPG_INJ)"
-	./bin/inject_gpg_key.sh --cbfstool "$(build)/$(coreboot_dir)/cbfstool" \
-		"$(board_build)/$(CB_OUTPUT_FILE_GPG_INJ)" "$(PUBKEY_ASC)"
+$(board_build)/$(CB_OUTPUT_BASENAME)-gpg-injected.rom: $(board_build)/$(CB_OUTPUT_FILE) $(PUBKEY_ASC)
+	@set -e; \
+	src="$(board_build)/$(CB_OUTPUT_FILE)"; \
+	tgt="$(board_build)/$(CB_OUTPUT_FILE_GPG_INJ)"; \
+	key="$(PUBKEY_ASC)"; \
+	meta="$(board_build)/$(CB_OUTPUT_FILE_GPG_INJ).meta"; \
+	if [ -f "$$tgt" ] && [ -f "$$meta" ]; then \
+		SRC_SHA256=$$(awk -F= '/^SRC_SHA256=/{print $$2}' "$$meta"); \
+		KEY_SHA256=$$(awk -F= '/^KEY_SHA256=/{print $$2}' "$$meta"); \
+		src_sum=$$(sha256sum "$$src" | awk '{print $$1}'); \
+		key_sum=$$(sha256sum "$$key" | awk '{print $$1}'); \
+		if [ "$$src_sum" = "$$SRC_SHA256" ] && [ "$$key_sum" = "$$KEY_SHA256" ]; then \
+			echo "GPG injection up-to-date; skipping"; \
+			exit 0; \
+		fi; \
+	fi; \
+	cp "$$src" "$$tgt"; \
+	./bin/inject_gpg_key.sh --cbfstool "$(build)/$(coreboot_dir)/cbfstool" "$$tgt" "$$key"; \
+	SRC_SHA256=$$(sha256sum "$$src" | awk '{print $$1}'); \
+	KEY_SHA256=$$(sha256sum "$$key" | awk '{print $$1}'); \
+	printf 'SRC_SHA256=%s\nKEY_SHA256=%s\n' "$$SRC_SHA256" "$$KEY_SHA256" > "$$meta"