2448 Commits

Author SHA1 Message Date
Thierry Laurion
81cc5263a0
nv41/ns50 coreboot configs: save configs with make BOARD=nitropad-n[v41|s50] coreboot.modify_and_save_oldconfig_in_place
removes a comment:
-# CONFIG_DASHARO_FIRMWARE_UPDATE_MODE is not set
- Unify ns50/nv41
 - CONFIG_TPM_PIRQ=0x27 in both nv41/ns50 as per https://github.com/linuxboot/heads/pull/1662#issuecomment-2100820944
NOTE that this doesn't stick when calling
make[1]: Leaving directory '/home/user/heads/build/x86/coreboot-dasharo'
user@heads-tests-deb12:~/heads$ git diff
diff --git a/config/coreboot-nitropad-nv41.config b/config/coreboot-nitropad-nv41.config
index 9484aaf5122..ddd4e5d7c56 100644
--- a/config/coreboot-nitropad-nv41.config
+++ b/config/coreboot-nitropad-nv41.config
@@ -143,7 +143,7 @@ CONFIG_BOARD_CLEVO_NV40PZ_BASE=y
 CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="Nitropad NV41"
 CONFIG_CONSOLE_POST=y
 # CONFIG_USE_PM_ACPI_TIMER is not set
-CONFIG_TPM_PIRQ=0x27
+CONFIG_TPM_PIRQ=0x0
 # CONFIG_SOC_INTEL_CSE_SEND_EOP_EARLY is not set
 CONFIG_VBOOT_FWID_VERSION="$(CONFIG_LOCALVERSION)"
 CONFIG_EC_SYSTEM76_EC_BAT_THRESHOLDS=y

Also note that CONFIG_EC_SYSTEM76_EC_DGPU=y is not present on ns50 as opposed to nv41, whatever that does.
user@heads-tests-deb12:~/heads$ diff -u config/coreboot-nitropad-nv41.config config/coreboot-nitropad-ns50.config
--- config/coreboot-nitropad-nv41.config	2024-05-10 14:59:42.156754718 -0400
+++ config/coreboot-nitropad-ns50.config	2024-05-10 14:55:37.699761391 -0400
@@ -110,7 +110,7 @@
 # CONFIG_VENDOR_TI is not set
 # CONFIG_VENDOR_UP is not set
 CONFIG_MAINBOARD_FAMILY="Not Applicable"
-CONFIG_MAINBOARD_PART_NUMBER="nv40pz"
+CONFIG_MAINBOARD_PART_NUMBER="ns50pu"
 CONFIG_MAINBOARD_VERSION="v2.1"
 CONFIG_MAINBOARD_DIR="clevo/adl-p"
 CONFIG_DIMM_MAX=4
@@ -128,7 +128,7 @@
 CONFIG_DEVICETREE="devicetree.cb"
 # CONFIG_VBOOT is not set
 CONFIG_VBOOT_VBNV_OFFSET=0x28
-CONFIG_VARIANT_DIR="nv40pz"
+CONFIG_VARIANT_DIR="ns50pu"
 CONFIG_OVERRIDE_DEVICETREE="variants/$(CONFIG_VARIANT_DIR)/overridetree.cb"
 # CONFIG_VGA_BIOS is not set
 CONFIG_MAINBOARD_SMBIOS_MANUFACTURER="Nitrokey"
@@ -139,8 +139,8 @@
 CONFIG_CMOS_LAYOUT_FILE="src/mainboard/$(MAINBOARDDIR)/cmos.layout"
 CONFIG_BOOT_DEVICE_SPI_FLASH_BUS=0
 CONFIG_BOARD_CLEVO_ADLP_COMMON=y
-CONFIG_BOARD_CLEVO_NV40PZ_BASE=y
-CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="Nitropad NV41"
+CONFIG_BOARD_CLEVO_NS50PU_BASE=y
+CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="Nitropad NS51"
 CONFIG_CONSOLE_POST=y
 # CONFIG_USE_PM_ACPI_TIMER is not set
 CONFIG_TPM_PIRQ=0x27
@@ -158,8 +158,8 @@
 CONFIG_HAVE_INTEL_FIRMWARE=y
 CONFIG_MRC_SETTINGS_CACHE_SIZE=0x10000
 CONFIG_DRIVERS_INTEL_WIFI=y
-CONFIG_IFD_BIN_PATH="3rdparty/dasharo-blobs/novacustom/nv4x_adl/descriptor.bin"
-CONFIG_ME_BIN_PATH="3rdparty/dasharo-blobs/novacustom/nv4x_adl/me.bin"
+CONFIG_IFD_BIN_PATH="3rdparty/dasharo-blobs/novacustom/ns5x_adl/descriptor.bin"
+CONFIG_ME_BIN_PATH="3rdparty/dasharo-blobs/novacustom/ns5x_adl/me.bin"
 CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x20000
 CONFIG_VBT_DATA_SIZE_KB=9
 CONFIG_CARDBUS_PLUGIN_SUPPORT=y
@@ -176,8 +176,8 @@
 #
 # Alder Lake P (2022)
 #
-# CONFIG_BOARD_NOVACUSTOM_NS5X_ADLP is not set
-CONFIG_BOARD_NOVACUSTOM_NV4X_ADLP=y
+CONFIG_BOARD_NOVACUSTOM_NS5X_ADLP=y
+# CONFIG_BOARD_NOVACUSTOM_NV4X_ADLP is not set

 #
 # Tiger Lake U (2021)
@@ -503,7 +503,6 @@
 #
 CONFIG_EC_ACPI=y
 CONFIG_EC_SYSTEM76_EC=y
-CONFIG_EC_SYSTEM76_EC_DGPU=y

 #
 # Intel Firmware

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 15:01:56 -04:00
Michał Kopeć
f6f216c5b8
Use single coreboot rev for MSI and NCM
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:50:37 -04:00
Thierry Laurion
443955e086
nv41/ns50 board config: Add note referring that those boards FB are GOP enabled just like the librem_11 for reference
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:50:31 -04:00
Thierry Laurion
eb2d8da983
nv41/ns50 coreboot config: apply 4cf15f2586c55d7c2f2c5136f08e7670eebc5012 also to ns50. Note: SMMSTORE and top-down resource allocation diff between ns50/nv41
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:50:27 -04:00
Thierry Laurion
7e31b204e1
nv41/ns50 coreboot config: make sure everything is saved with make BOARD=nitropad-n*** coreboot.modify_and_save_oldconfig_in_place
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:50:22 -04:00
Michał Żygowski
23976461d8
modules/coreboot: Avoid double quotes in LOCALVERSION
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:40:26 -04:00
Michał Żygowski
83f96aae5c
modules/coreboot: Remove the lines with config values before overriding them
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:40:21 -04:00
Michał Kopeć
1eef518daa
modules/coreboot: don't touch DMI vendor name if unspecified
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:40:16 -04:00
Michał Kopeć
3cfa4e91ae
Allow overriding DMI manufacturer name
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:40:11 -04:00
Michał Kopeć
3102666c91
coreboot-nitropad-nv41.config: disable RESOURCE_ALLOCATION_TOP_DOWN
Also disable bootsplash resizing to center the logo in the middle of
the screen.

Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:40:07 -04:00
Michał Żygowski
acc8044766
modules/coreboot: Allow overriding LOCALVERSION and SMBIOS_PRODUCT_NAME
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:40:02 -04:00
Michał Żygowski
c7dc6a8064
patches: Remove obsolete patches for nitropad builds
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:39:57 -04:00
Michał Żygowski
8e7e18920d
modules/nitrokey-blobs,boards/nitropad: Remove obsolete blobs module
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:39:53 -04:00
Michał Żygowski
6a64144e97
modules/coreboot,config/coreboot-nitropad: Update to the newest revision
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-10 14:39:48 -04:00
Thierry Laurion
77f1e346d0
Merge pull request #1640 from tlaurion/nitrokey_board_unification_clean-enable_htop_validated_autoboot
Nitrokey board cleaning+ unification cleanup (enable htop validated autoboot + tethering)
2024-05-10 14:20:16 -04:00
Thierry Laurion
b65e8bf66d
nv41/ns50 shared linux config: reenable I2C, not even sure if needed
git difftool -d HEAD^ to check config against previous version (librem shared config), noticed I2C options being maybe relevant, added them back in

Then saved with make BOARD=nitropad-ns50 linux.modify_and_save_oldconfig_in_place

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 13:53:28 -04:00
Thierry Laurion
862f58f0da
config/linux-nitropad-x.config: bring par with librem_11 shared linux config (GOP compliant)
TODO: next, readd what might have been pertinent

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 13:43:31 -04:00
Thierry Laurion
8cace17940
nv41/ns50: coreboot configs saved in oldconfig
Result of:
make BOARD=nitropad-nv41 coreboot.save_in_oldconfig_format_in_place
make BOARD=nitropad-ns50 coreboot.save_in_oldconfig_format_in_place

No change, was applied like this anyway at compilation.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 13:35:46 -04:00
Thierry Laurion
0f412ed3ce
config/linux-nitropad-x.config: Add Tethering requirements
TODO: fix discrepencies in kernel config to limit technological debt in later commit in this PR
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 13:30:37 -04:00
Thierry Laurion
60e0d6017f
boards: uniformize nitropad boards with qemu-coreboot boards and against each other
- Add tethering in board configs
- Add autoboot after 5 seconds if HOTP remote attestation is  successful

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 13:29:17 -04:00
Thierry Laurion
865a0c6a2b
WiP: Boards configuration unification between x230-hotp-maximized and nitrokey boards: enable Automatic boot when HOTP valid after 5 seconds
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-03 12:30:20 -04:00
Jonathon Hall
165f90a8cf
Merge remote-tracking branch 'github-tlaurion/reproducible_openssl_libtss2_tpm2'
PR #1630
2024-04-26 12:26:55 -04:00
Thierry Laurion
60d9aa4d5a
tpmr: remove warning "Warn: check public portion of the tpmkey manually"
Discussed under https://github.com/linuxboot/heads/pull/1630#issuecomment-2075120429

TODO added in code.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-04-26 11:14:14 -04:00
Thierry Laurion
b2629f8d4d
Merge pull request #1625 from tlaurion:LUKS_header_change_validation_upon_sealing_and_unsealing
LUKS header change validation upon sealing and unsealing ops
2024-04-25 16:39:41 -04:00
Thierry Laurion
ba63b1823f
Merge pull request #1654 from Dasharo/fix_nitropad_pwr_state
config/coreboot-nitropad-*.config: disable power on AC
2024-04-24 18:33:39 -04:00
Michał Kopeć
019098c821
config/coreboot-nitropad-*.config: disable power on AC
The coreboot power failure state Kconfig options are wired up to the
Power on AC feature on Clevo mainboards. Set the power failure state to
0 to prevent these boards from powering on or waking up with AC attach.

Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
2024-04-24 12:48:52 +02:00
Jonathon Hall
1ae4c19f9a
Merge remote-tracking branch 'github-tlaurion/fix_hotp_increment_counter_after_detection-oem-factory-reset_loop_3x_hotp_detect'
PR #1650
2024-04-23 08:33:30 -04:00
Thierry Laurion
d8a6502d69
Merge pull request #1646 from UndeadDevel/better_PIN_question_default
Address inconsistency between docs and OEM factory reset User GPG PIN minimum length requirement
2024-04-22 20:27:46 -04:00
Christian Foerster
cb03ec5584
change correct PIN minimum
Signed-off-by: Christian Foerster <christian.foerster@mailfence.com>
2024-04-23 01:10:53 +02:00
Thierry Laurion
b6bd682cb3
Fix HOTP verification logic (and counter increment) in gui-init and oem-factory-reset scripts
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-04-22 17:24:21 -04:00
Christian Foerster
70e9c663bc
only change user PIN minimum requirement to 6
Signed-off-by: Christian Foerster <christian.foerster@mailfence.com>
2024-04-22 22:56:13 +02:00
Christian Foerster
408524fb31
Revert "UX improvements PIN questions"
This reverts commit ba20d98bdd8c39ad506ef4a2a3e1f51bc84db9f8.

Signed-off-by: Christian Foerster <christian.foerster@mailfence.com>
2024-04-22 22:51:25 +02:00
Christian Foerster
0854f2ce80
Revert "fix small incongruency with previous commit"
This reverts commit be65c4be5b5fbeca9cdb97268135507252efe171.

Signed-off-by: Christian Foerster <christian.foerster@mailfence.com>
2024-04-22 22:51:17 +02:00
Christian Foerster
2828e2ca60
Revert "fix another small incongruency with previous commit"
This reverts commit cc70e772f8a0dcdb319d4d06e27af227a5cae51e.

Signed-off-by: Christian Foerster <christian.foerster@mailfence.com>
2024-04-22 22:50:34 +02:00
Christian Foerster
cc70e772f8
fix another small incongruency with previous commit
Signed-off-by: Christian Foerster <christian.foerster@mailfence.com>
2024-04-21 19:00:29 +02:00
Christian Foerster
be65c4be5b
fix small incongruency with previous commit
Signed-off-by: Christian Foerster <christian.foerster@mailfence.com>
2024-04-21 18:42:52 +02:00
Christian Foerster
ba20d98bdd
UX improvements PIN questions
Signed-off-by: Christian Foerster <christian.foerster@mailfence.com>
2024-04-21 18:31:43 +02:00
Thierry Laurion
609a9db9eb
Merge pull request #1642 from tlaurion/improve_debug_with_output_of_do_with_debug
Improve DEBUG and DO_WITH_DEBUG output handling to also keep output of DO_WITH_DEBUG commands
2024-04-19 16:50:54 -04:00
Thierry Laurion
89a0c103ae
QEMU/KVM board configs: logical reorganization of requirements for board configs. Next step is creating fbwhiptail/whiptail/tpm1/tpm2 mk files and include them in all boards
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-04-19 15:52:50 -04:00
Thierry Laurion
fc874728f6
oem-factory-reset + seal-hotpkey: Give debug output to underatand in what state is the USB Security dongle
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-04-19 14:30:55 -04:00
Jonathon Hall
00ce2f4d1c
ash_functions: Log board and version when entering recovery shell
Log the board and version when entering the recovery shell.  Extract
the firmware version logic from init.

Currently this is the only way to get the debug log.  If we add a way
from the GUI, we may want to log the board and version somewhere else
too.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2024-04-19 14:16:41 -04:00
Jonathon Hall
a767347afd
kexec-boot: Only capture kexec -d output to log, not console/kmsg
LOG() is added to log to the log only (not kmsg, more verbose than
TRACE).

DO_WITH_DEBUG only captures stdout/stderr to the log with LOG().

kexec-boot silences stderr from kexec, we don't want it on the console.

No need to repeat the kexec command when asking in debug to continue
boot, it's no longer hidden behind verbose output from kexec.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2024-04-19 14:14:54 -04:00
Jonathon Hall
d3656bbe65
kexec-boot, functions: Restore eval and DO_WITH_DEBUG that were deleted
`eval "$kexeccmd"` should become `DO_WITH_DEBUG eval "$kexeccmd"` when
adding DO_WITH_DEBUG, command invocation is still the same, still needs
eval.

Restore DO_WITH_DEBUG in front of kexec-parse-boot that had been
removed.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2024-04-19 13:48:27 -04:00
Jonathon Hall
d8810b7032
functions: DO_WITH_DEBUG: Label stderr/stdout more clearly
"$1 err:" looked like an error, but often there's output on stderr
that's diagnostic (like kexec -d).  "$1 stderr:" is clearer.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2024-04-19 13:31:29 -04:00
Jonathon Hall
015af7e6c7
functions: Add visibility to DO_WITH_DEBUG without affecting command
DO_WITH_DEBUG traces command exit status (if failed), stdout/stderr (if
not empty), and PATH (if command was not found).  The caller still
observes the exit status, and stdout/stderr still go to the caller as
well.

This way, DO_WITH_DEBUG can be inserted anywhere with minimal spam in
the logs and without affecting the script.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2024-04-19 10:29:43 -04:00
Thierry Laurion
ae5f9c5416
Improve DEBUG and DO_WITH_DEBUG output handling to also keep output of kexec -l when BOARD is in DEBUG+TRACE mode (configuration settings menu + flash)
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-04-18 16:30:13 -04:00
Thierry Laurion
82179e4e98
Merge pull request #1638 from tlaurion/move_sleep_for_proper_dongle_detection
BUGFIX: ash_functions: move sleep 2 after all usb modules being loaded
2024-04-15 17:55:57 -04:00
Thierry Laurion
67f1dae840
ash_functions: move sleep 2 after all usb modules being loaded
Otherwise we get ehci-pci and xhci_hcd kernel messages in dmesg debug AFTER "Verifying presence of GPG card" which explains why dongle might not be found in time and fails in oem-factory-reset

Fixes https://github.com/Nitrokey/heads/issues/48

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-04-12 17:05:29 -04:00
Thierry Laurion
fb5cbf41a1
kexec-insert-key: refactor tampering check for encrypted disk keys prior of TPM unsealing ops
move code from kexec-unseal-key to kexec-insert-key, address code review and apply verbiage suggestion changes

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-04-11 14:50:40 -04:00
Thierry Laurion
f6232aa70f
Change disk encryption -> LUKS Disk Key and other relative/relative verbiage, remove irrelevant DEBUG trace under kexec-unseal-key
TODO:
- $(pcrs) call sometimes fail in DEBUG call, outputting too many chars to be inserted in kmesg. Call removed here since redundant (PCR6 already extended with LUKS header)
- Notes added for TPM2 simplification over TPM1 in code as TODO

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-04-11 14:44:13 -04:00