Commit Graph

308 Commits

Author SHA1 Message Date
Thierry Laurion
77f9933538
xx20/xx30 blob based boards: move ME blobs target outside of board configs (targets/xx*_blobs.mk)
Makefile: have inclusion of all defined $BOARD BOARD_TARGETS (me, split_8mb4mb, ...)

TODO: VBIOS scripts for W530/T530 need way more work. To be done later.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 15:32:09 -05:00
Thierry Laurion
197914b396
xx20 boards and circleci: Have boards download extract and neuter me by board config
Fix https://github.com/linuxboot/heads/issues/1569 part of error linked to me not being available in blobs/xx20/me.bin

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 14:21:08 -05:00
Thierry Laurion
0d6cba852b
w530-dgpu K2000 boards : have the boards call vbios download script automatically. Breaks on debian-12 as of now but should work on debian-11 for others, gems say deprecated calls....
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 14:21:03 -05:00
Thierry Laurion
1fea3e4463
t530-dgpu boards : have the boards call vbios download script automatically. Breaks on debian-12 as of now but should work on debian-11 for others, gems say deprecated calls....
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 14:21:01 -05:00
Thierry Laurion
43d1b4ed81
xx30: have all xx30 download me automatically.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 14:21:00 -05:00
Thierry Laurion
718a831481
Board configs: move t420-hotp-maximized t420-maximized w530-maximized w530-hotp-maximized away from UNTESTED_ boards
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-30 13:36:28 -05:00
Jonathon Hall
ab97b242b4
Merge remote-tracking branch 'github-heads/master' into site-local-config 2023-12-19 14:14:25 -05:00
Thierry Laurion
61843d890b
Unify upstream board config defaults
- Upstream boards will not deactivate TPM DUK
- Upstream will not force BRAND_NAME which currently defaults to Heads
- Upstream will not deactivate Qr code on screen output on HOTP sealing
- Upstream will not offer OEM reset defaults (deprecated and now default anyway)

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-19 13:05:46 -05:00
Jonathon Hall
12a099ad8e
talos-2: Move PPC-style tgz update package targets to targets/
Move the targets generating talos-2's tgz update package to targets.

While this wasn't duplicated, it breaks a cyclic dependency between
board config and BRAND_NAME by moving the ROM output name dependencies
later.  The logic probably would be shared with similar boards if any
were supported, so it is in the spirit of the other targets/ shared
target Makefiles.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:52 -05:00
Jonathon Hall
8ce9c9d438
*-legacy-flash: Deduplicate generation of "top" ROM
Move Makefile target for the "top" ROM to targets/legacy_flash.mk.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:52 -05:00
Jonathon Hall
d512cd4ad2
12MB boards: Deduplicate generation of 8MB/4MB split ROMs
Move Makefile targets for split ROMs to targets/split_8mb4mb.mk.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:52 -05:00
Jonathon Hall
c8e114166c
qemu: Deduplicate Qemu targets/documentation, extract from boards
The 8 qemu-* targets all contained nearly-identical copies of the
targets to prepare the TPM/disk/etc. and then run Qemu.  The only
significant differences were for TPM1/TPM2 (extra swtpm_setup step,
addition of --tpm2 to swtpm_setup and swtpm).  ROOT_DISK_IMG used := or
= differently in some boards, := was kept.

targets/qemu.mk now defines all Qemu targets and is included only for
qemu-* boards (by defining BOARD_TARGETS in each of those boards).

The documentation was moved from qemu-coreboot-fbwhiptail-tpm1-hotp/
qemu-coreboot-fbwhiptail-tpm1-htop.md to targets/qemu.md.  The other 7
qemu boards' symlinks to that file were removed.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:10 -05:00
Thierry Laurion
b8a06c5351
Librems/Nitropad: enable QR code printed on screen at TOTP/HOTP Generation
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-16 13:15:14 -05:00
Thierry Laurion
d8f098cd53
All board configs: first line now BRAND_NAME=Heads to ease rebranding with sed scripts for downstream projects/forks
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-16 12:56:58 -05:00
Thierry Laurion
bac35e3b3e
Librems/Nitropad: enable TPM DUK under Heads branding (CONFIG_TPM_NO_LUKS_DISK_UNLOCK=n)
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-16 12:52:19 -05:00
tlaurion
4a57c615e9
Merge pull request #1522 from tlaurion/efifb_next_step_related_cleanups
WiP: FB_EFI (EFIFB kernel module's framebuffer on top of libgfxinit or GOP) next steps related cleanups
2023-12-12 13:04:58 -05:00
Thierry Laurion
e0fabb1534
NV41: adapt board config to remove CONFIG_BOOT_KERNEL_ADD=intel_iommu=igfx_off equally as for NS50 under 2fcef4a979 and tested for NS50 at https://github.com/linuxboot/heads/pull/1522#issuecomment-1822489517
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-12 11:33:43 -05:00
Thierry Laurion
0dbbae5dbc
Move t530, p8z77 and t420 boards to be prefixed with UNTESTED as per https://github.com/linuxboot/heads/pull/1522#issuecomment-1850734068. Note that w530 was already marked as UNTESTED, look for commit having moved this board as untested.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-11 16:07:01 -05:00
tlaurion
9afe235a6b
Update qemu-coreboot-fbwhiptail-tpm1-hotp.md
Add bookworm swtpm installation instructions
2023-11-26 11:58:49 -05:00
Thierry Laurion
664603cf8c
Changeset based on nitrokey 2.3 release to understand what is attempted here. i915 is still under linux config on 2.3 release. coreboot is on gop, not libgfxinit. This is to open discussion.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-20 11:17:38 -05:00
Thierry Laurion
0e42833ada
x230-legacy-flash board: fixup pointing to x230 as opposed to t430. Fix coreboot config path to bootsplash
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-20 09:42:28 -05:00
Thierry Laurion
2fcef4a979
FB_EFI next step: remove CONFIG_BOOT_KERNEL_ADD=intel_iommu=on intel_iommu=igfx_off, add CONFIG_BOOT_KERNEL_REMOVE=intel_iommu=on intel_iommu=igfx_off, remove quiet removal from CONFIG_BOOT_KERNEL_REMOVE. TLDR: do not interfere with OS setting its own boot policies
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-20 09:40:39 -05:00
JonathonHall-Purism
f5377b3bd5
Merge pull request #1526 from JonathonHall-Purism/zip_updates
flash-gui.sh: Extend NPF archive format to ZIP, improve workflow
2023-11-17 10:21:44 -05:00
Thierry Laurion
56d38e112c
Talos-2 fixes to comply with hashing file standard. Bypass flash-gui.sh prompt when talos-2 ato validate hashes against hashes provided under tgz through flash.sh validation (still offer zip and tgz, which tgz might change to zip later but only tgz offered through builds)
Attempt to address https://github.com/linuxboot/heads/pull/1526#issuecomment-1811185197

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-16 08:44:39 -05:00
Jonathon Hall
bb7294476d
Makefile: Don't generate update package for legacy flash boards
The only purpose of legacy flash boards is to be flashed over vendor
firmware using an exploit, to then flash non-maximized Heads firmware.

They are never upgraded to another legacy flash build, and they move
the coreboot ROM from the build directory, so don't build an update
package for those boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-11-14 12:14:18 -05:00
tlaurion
133da0e48e
Merge pull request #1515 from tlaurion/inmemory_keygen-gpg_backup_usable_for_RSA_only-copy_to_card_working_for_RSA_only-gpg_auth_for_recovery_and_sub_boot
GPG User Authentication: In-memory gpg keygen + keytocard and GPG key material backup enabling  (plus a lot of code cleanup and UX improvements)
2023-11-13 16:05:26 -05:00
Thierry Laurion
9e0491e9db
oem-factory-reset/librem boards: remove CONFIG_OEMRESET_OFFER_DEFAULTS=y and checks for it; the default of oem-factory-reset is now to propose user to use defaults first for simplicity of most common use case without allianating advanced users which can simply not accept the default and answer questionnaire
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-06 11:27:51 -05:00
Thierry Laurion
f5dc5ef5cd
qemu boards: Put back DEBUG and TRACE on
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:08:35 -04:00
Thierry Laurion
a3086e9a1c
Remove TODO in code that were not relevant prior of first review
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:08:19 -04:00
Thierry Laurion
56b602974b
WiP: NK3 with p256 ECC algo supported for in-memory keygen and key-to-card op. With this commit, one can provision NK3 with thumb drive backup which enables authenticated recovery shell and USB boot.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:40 -04:00
Thierry Laurion
2b21623bc6
qemu doc: add modify list/mount instructions to use losetup to map partitions to loop0pX and mount them to get public key
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:37 -04:00
Thierry Laurion
27c457f04b
TPM2 DUK and TOTP/HOTP reseal fix, refactoring and ifferenciating tpm_password into tpm_owner_password and reusing correctly
i
TODO: fix all TODO in PR prior of review + squash

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:27 -04:00
Thierry Laurion
2ae94405ad
WiP: add export CONFIG_HAVE_GPG_KEY_BACKUP=y so whiptail-tpm2 can be used with GPG key material thumb drive backup
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:04 -04:00
Thierry Laurion
1f28c71447
WiP: adapt dmesg in function of CONFIG_DEBUG_OUTPUT being enabled or not so and adapt further troubleshooting notes in code when keys cannot be accessed on media for whatever cause so user can understand what is happening when accessing GPG material on backup thumb drive
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:06:55 -04:00
Thierry Laurion
b1e5c638cd
WiP
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:06:45 -04:00
tlaurion
f540f2a335
Merge pull request #1430 from gaspar-ilom/w541-support
Support Thinkpad W541
2023-10-30 15:41:14 -04:00
tlaurion
1733552fe7
Merge pull request #1505 from JonathonHall-Purism/upstream_28.1_librem_11
Add support for Librem 11
2023-10-30 15:38:02 -04:00
gaspar-ilom
2e8239c5e7 add configuration for w541
closes #1389
2023-10-23 21:52:09 +02:00
Thierry Laurion
9addb3b6b0
qemu board doc: add Nitrokey3NFC in md doc 2023-10-10 12:30:41 -04:00
Thierry Laurion
4ff955918f
x230-maximized board configs: add DEBUG/TRACE board config in comment
Enabling DEBUG/TRACE options from board config vs from configuration menu is different.

When enabled in board config, /etc/config is from ROM, and sourced early and make TRACE/DEBUG calls appear early.
If added through configuration menu, those are /etc/config.user overrides extracted from CBFS and then sourced after combine_configs call

If for whatever reason early DEBUG is needed on a platform, enabling in board config is needed.
For runtime debugging, enabling Debug output from configuration menu is enough
2023-10-10 12:14:36 -04:00
Jonathon Hall
55155f6558
boards/librem_11: Add Librem 11
Add Librem 11 board.

Librem 11 uses coreboot graphics init, which is done with FSP GOP.

Set a custom keymap for the volume/power keys.  Configure the volume
keys as up/down arrows (for navigation in fbwhiptail, and for shell
history in the Linux console).  Configure the power key as Enter.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-29 15:36:30 -04:00
Jonathon Hall
fab9124f00
librem_* (except L1UM): Linux 6.1, coreboot gfx init with efifb
Update all Librems except L1UM (but including L1UM v2) to Linux 6.1.8.

Use coreboot native graphics init.  Raise maximum framebuffer size for
laptops to 3840x2160 (desktops default to this, but laptops default
to a lower value).  Remove DRM modules from Linux 6.1.8 and add EFIFB.

Remove Heads kernel command line options relating to IOMMU and i915,
which are no longer needed.  Remove OS kernel options relating to
IOMMU.

For Librem 13/15/14/Mini, this fixes issues booting with 4K displays
attached, which were resulting in crashes due to the framebuffer memory
not being reserved properly.  memtest86+ now passes with a 4K display
attached.

For Librem L1UM v2, framebuffer boot now works.

Librem L1UM remains on Linux 5.10 with Heads kernel graphic init
(framebuffer boot still does not work).  coreboot 4.11 has native
graphics init for Aspeed, but only in text mode.  Backporting the
linear framebuffer support appears to be possible - the patch applied
cleanly - but it did not work initially and will need more
investigation.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-06 10:36:37 -04:00
tlaurion
8bd82a6e10
Merge pull request #1494 from JonathonHall-Purism/coreboot_purism_4.21
modules/coreboot: Update Purism coreboot to 24e2f7e4
2023-09-06 10:19:55 -04:00
tlaurion
2c3987f9a3
Merge pull request #1485 from Nitrokey/nx-nitropad
add Nitropad NV41/NS50 TPM2 boards (2nd)
2023-09-06 10:15:17 -04:00
Jonathon Hall
eed8adeb49
librem_mini,librem_mini_v2: Enable CMOS layout, update CMOS checksum
Enable the coreboot CMOS option table, which initializes CMOS if the
checksum is not valid.

There is now a checksum in the CMOS layout since 4.21, update it when
updating the Mini v1/v2 EC power-on setting.

coreboot 4.21 will reset the CMOS settings during the first boot, since
there was no checksum in prior releases.  Heads will restore the
automatic power-on setting during init based on config.user.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-05 16:03:02 -04:00
tlaurion
8272d33e7c
Merge pull request #1482 from tlaurion/ease_tpm_disk_unlock_key_resealing_after_totp_mismatch-warn_and_die_changes
Ease TPM Disk Unlock Key sealing/resealing after TOTP mismatch (firmware upgrade) + warn and die changes
2023-09-05 11:48:50 -04:00
Markus Meissner
d01c3ab7c9
boards: add nitropad-nv41 + nitropad-ns50 2023-09-05 17:13:56 +02:00
Markus Meissner
b47da0be89
boards/qemu-*: update allowed usb-token comments 2023-09-05 12:32:22 +02:00
Thierry Laurion
03d8f93c95
modules/zstd: now included by default. Deactivated under legacy-flash boards
Rationale:
cpio -t alone cannot extract initrd past early cpio (microcode) in most packed initrd.
unpack_initramfs.sh already under master comes to the rescue, but its usage up to today was limited to pass firmware blobs to final OS under boards/librem_mini_v2

Debian OSes (and probably others) need to have cryptroot/crypttab overriden directly, otherwise generic generation of crypttab is not enough.
Extracting crypttab and overriding directly what is desired by final OS and exposed into /boot/initrd is the way to go otherwise hacking on top of hacks.

This brings default packed modules under Heads to 5 modules, which needs to be deactivate in board configs if undesired:
user@heads-tests-deb12:~/heads$ grep -Rn "?= y" modules/ | grep -v MUSL
modules/zlib:1:CONFIG_ZLIB ?= y
modules/zstd:3:CONFIG_ZSTD ?= y
modules/exfatprogs:2:CONFIG_EXFATPROGS ?= y
modules/busybox:2:CONFIG_BUSYBOX ?= y
modules/e2fsprogs:2:CONFIG_E2FSPROGS ?= y
2023-08-31 11:19:50 -04:00
Thierry Laurion
d5aa0c874e
boards/qemu-coreboot-whiptail-tpm1/qemu-coreboot-whiptail-tpm1.md was invalid symlink 2023-08-28 16:24:14 -04:00