Commit Graph

2206 Commits

Author SHA1 Message Date
Thierry Laurion
139f77113c
ash_functions: make DEBUG call pass multiline messages one at a time to /tmp/debug.log and kmsg 2023-10-21 14:37:31 -04:00
tlaurion
9e55e08ac0
Merge pull request #1512 from tlaurion/update_qubes_release_signing_keys
qubes release signing keys: move qubes-4.key to qubes-4.1.key, add qubes-4.2.key
2023-10-18 14:11:54 -04:00
Thierry Laurion
576e2a8fff
qubes release signing keys: move qubes-4.key to qubes-4.1.key, add qubes-4.2.key 2023-10-18 13:37:22 -04:00
tlaurion
5002198bb1
Merge pull request #1510 from tlaurion/debian-11_dependencies_fix_for_openssl_module_build
CircleCI: fix debian-11 packages dependencies (#1507)
2023-10-17 17:56:52 -04:00
tlaurion
f78786705e
Merge pull request #1509 from tlaurion/whiptail_respect_lowercase_uppercase_choices
newt(whiptail): fix code that was doing toupper of input
2023-10-17 13:30:47 -04:00
Thierry Laurion
44fa663d60
CircleCI: fix debian-11 packages dependencies (#1507) 2023-10-17 09:40:57 -04:00
Thierry Laurion
498a78af57
newt(whiptail): fix code that was doing toupper of input 2023-10-11 15:47:53 -04:00
tlaurion
bd2a8eb96e
Merge pull request #1478 from tlaurion/stenghten_entropy_sources_with_jitter_and_TPM
Have CRNG avail early on boot and maximize ligcrypt entropy sources/efficiency
2023-10-10 14:23:47 -04:00
Thierry Laurion
9addb3b6b0
qemu board doc: add Nitrokey3NFC in md doc 2023-10-10 12:30:41 -04:00
Thierry Laurion
65e5286b5a
init: enable cttyhack so that init launches BOOTSCRIPT in a controlled terminal. DEBUG/TRACE now output on /dev/kmsg and console. 2023-10-10 12:28:52 -04:00
Thierry Laurion
0416896b82
etc/ash_function's warn/die/TRACE/DEBUG now output also under /dev/kmsg when DEBUG is enabled 2023-10-10 12:28:15 -04:00
Thierry Laurion
4ff955918f
x230-maximized board configs: add DEBUG/TRACE board config in comment
Enabling DEBUG/TRACE options from board config vs from configuration menu is different.

When enabled in board config, /etc/config is from ROM, and sourced early and make TRACE/DEBUG calls appear early.
If added through configuration menu, those are /etc/config.user overrides extracted from CBFS and then sourced after combine_configs call

If for whatever reason early DEBUG is needed on a platform, enabling in board config is needed.
For runtime debugging, enabling Debug output from configuration menu is enough
2023-10-10 12:14:36 -04:00
Thierry Laurion
84899cf631
libgcrypt module: remove disable-asm
As on master otherwise with --disable-asm:

    config.status: executing gcrypt-conf commands

            Libgcrypt v1.10.1 has been configured as follows:

            Platform:                  GNU/Linux (x86_64-pc-linux-musl)
            Hardware detection module: none
            Enabled cipher algorithms: arcfour blowfish cast5 des aes twofish
                                       serpent rfc2268 seed camellia idea salsa20
                                       gost28147 chacha20 sm4
            Enabled digest algorithms: crc gostr3411-94 md4 md5 rmd160 sha1
                                       sha256 sha512 sha3 tiger whirlpool stribog
                                       blake2 sm3
            Enabled kdf algorithms:    s2k pkdf2 scrypt
            Enabled pubkey algorithms: dsa elgamal rsa ecc
            Random number generator:   default
            Try using jitter entropy:  yes
            Using linux capabilities:  no
            FIPS module version:
            Try using Padlock crypto:  n/a
            Try using AES-NI crypto:   n/a
            Try using Intel SHAEXT:    n/a
            Try using Intel PCLMUL:    n/a
            Try using Intel SSE4.1:    n/a
            Try using DRNG (RDRAND):   n/a
            Try using Intel AVX:       n/a
            Try using Intel AVX2:      n/a
            Try using ARM NEON:        n/a
            Try using ARMv8 crypto:    n/a
            Try using PPC crypto:      n/a

By disabling --disable-asm in libgcrypt 1.10.1:

    config.status: executing gcrypt-conf commands

            Libgcrypt v1.10.1 has been configured as follows:

            Platform:                  GNU/Linux (x86_64-pc-linux-musl)
            Hardware detection module: libgcrypt_la-hwf-x86
            Enabled cipher algorithms: arcfour blowfish cast5 des aes twofish
                                       serpent rfc2268 seed camellia idea salsa20
                                       gost28147 chacha20 sm4
            Enabled digest algorithms: crc gostr3411-94 md4 md5 rmd160 sha1
                                       sha256 sha512 sha3 tiger whirlpool stribog
                                       blake2 sm3
            Enabled kdf algorithms:    s2k pkdf2 scrypt
            Enabled pubkey algorithms: dsa elgamal rsa ecc
            Random number generator:   default
            Enabled digest algorithms: crc gostr3411-94 md4 md5 rmd160 sha1
                                       sha256 sha512 sha3 tiger whirlpool stribog
                                       blake2 sm3
            Enabled kdf algorithms:    s2k pkdf2 scrypt
            Enabled pubkey algorithms: dsa elgamal rsa ecc
            Random number generator:   default
            Try using jitter entropy:  yes
            Using linux capabilities:  no
            FIPS module version:
            Try using Padlock crypto:  yes
            Try using AES-NI crypto:   yes
            Try using Intel SHAEXT:    yes
            Try using Intel PCLMUL:    yes
            Try using Intel SSE4.1:    yes
            Try using DRNG (RDRAND):   yes
            Try using Intel AVX:       yes
            Try using Intel AVX2:      yes
            Try using ARM NEON:        n/a
            Try using ARMv8 crypto:    n/a
            Try using PPC crypto:      n/a

To support PPC crypto, it seems we will need yasm.
To support linux capabilities, libcap would be required as well later on. :/ another point for rng-tools (which also depends on libcap-ng)
2023-10-10 12:06:18 -04:00
Thierry Laurion
0100f7b970
linux configs: unify CONFIG_UNIX98_PTYS=y, CONFIG_HW_RANDOM_TPM=n, # CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER is not set, CONFIG_RANDOM_TRUST_CPU=y, CONFIG_PROC_SYSCTL is not set 2023-10-10 12:03:58 -04:00
Thierry Laurion
d3ec6ac11f
busybox: add clear reset and cttyhack to better deal with terminal mishaps 2023-10-10 11:55:24 -04:00
Thierry Laurion
5f38c715ce
coreboot config: unify quiet loglevel=2 for boards not defining default loglevel 2023-10-10 11:53:35 -04:00
tlaurion
f640fb70ba
Merge pull request #1506 from tlaurion/branding_proposition
Branding proposition + d-wid logo/bootsplash
2023-10-06 17:10:35 -04:00
d-wid
2bfa1737f8
Support branding under branding subdirectories
Squash of #1502 + moving logo/bootsplash files under branding/Heads

- Move logos and bootsplashes from blobs to branding/Heads/
- Makefile: add support for BRAND_DIR which depends on BRAND_NAME which defaults to Heads if no branding
- Boards coreboot configs: change bootsplash directory to depend on BRAND_DIR (instead of BLOBS_DIR) in bootsplash enabled configs
- Branding/Heads/bootsplash-1024x768.jpg points to branding/Heads/d-wid-ThePlexus_coreboot-linuxboot-heads_background-plain_DonateQrCode.jpg
- xcf file deleted. Original still under #1502 to reuse for modification without recompressing (blobs/heads.xcf)
- CREDITS file created to point to original authors, remixers (Open for details)
  - Thanks to: @d-wid for remixing Bing's AI generated Janus logo, @ThePlexus for Qubes Box concept and @ThrillerAtPlay for its matrix background
2023-10-06 17:09:23 -04:00
tlaurion
97bb0a82cb
Merge pull request #1498 from tlaurion/oem-factory-reset_fix-mount-usb
oem-factory-reset: fix call to mount-usb --mode rw
2023-09-07 16:29:12 -04:00
Thierry Laurion
cba8c4542c
oem-factory-reset: fix call to mount-usb --mode rw (fix #1497) 2023-09-07 16:27:43 -04:00
tlaurion
35f3b2218b
Merge pull request #1492 from JonathonHall-Purism/librem_linux_6.1_efifb
librem_* (except L1UM): Linux 6.1, coreboot gfx init with efifb
2023-09-06 11:07:43 -04:00
Jonathon Hall
fab9124f00
librem_* (except L1UM): Linux 6.1, coreboot gfx init with efifb
Update all Librems except L1UM (but including L1UM v2) to Linux 6.1.8.

Use coreboot native graphics init.  Raise maximum framebuffer size for
laptops to 3840x2160 (desktops default to this, but laptops default
to a lower value).  Remove DRM modules from Linux 6.1.8 and add EFIFB.

Remove Heads kernel command line options relating to IOMMU and i915,
which are no longer needed.  Remove OS kernel options relating to
IOMMU.

For Librem 13/15/14/Mini, this fixes issues booting with 4K displays
attached, which were resulting in crashes due to the framebuffer memory
not being reserved properly.  memtest86+ now passes with a 4K display
attached.

For Librem L1UM v2, framebuffer boot now works.

Librem L1UM remains on Linux 5.10 with Heads kernel graphic init
(framebuffer boot still does not work).  coreboot 4.11 has native
graphics init for Aspeed, but only in text mode.  Backporting the
linear framebuffer support appears to be possible - the patch applied
cleanly - but it did not work initially and will need more
investigation.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-06 10:36:37 -04:00
tlaurion
9849b99717
Merge pull request #1495 from JonathonHall-Purism/improve_flash_sh
initrd/bin/flash.sh: Improve speed and reliability
2023-09-06 10:24:09 -04:00
tlaurion
8bd82a6e10
Merge pull request #1494 from JonathonHall-Purism/coreboot_purism_4.21
modules/coreboot: Update Purism coreboot to 24e2f7e4
2023-09-06 10:19:55 -04:00
tlaurion
2c3987f9a3
Merge pull request #1485 from Nitrokey/nx-nitropad
add Nitropad NV41/NS50 TPM2 boards (2nd)
2023-09-06 10:15:17 -04:00
tlaurion
54bce87691
Merge pull request #1496 from JonathonHall-Purism/unseal-hotp-die-on-error
initrd/bin/unseal-hotp: Prevent script errors if unseal fails
2023-09-05 16:24:56 -04:00
tlaurion
446b45e4f0
Merge pull request #1493 from JonathonHall-Purism/flash_gui_sh_exit
initrd/bin/flash-gui.sh: Exit instead of errant return
2023-09-05 16:24:21 -04:00
Jonathon Hall
4d7c1cb388
initrd/bin/unseal-hotp: Prevent script errors if unseal fails
If the secret can't be unsealed, die immediately rather than continuing
on to generate errors.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-05 16:12:57 -04:00
Jonathon Hall
8342603993
initrd/bin/flash.sh: Improve speed and reliability
Improve speed by pre-filtering only for lines containing any tokens of
interest to flashrom_progress_tokenize().

Improve reliability by avoiding dropping tokens that cross a stream
buffer boundary.  Occasionally, a token could be missed if it crosses a
stream buffer boundary, due to read timing out too quickly before the
next buffer is flushed.  If this was a state-changing token,
flashrom_progress() would hang forever.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-05 16:04:30 -04:00
Jonathon Hall
eed8adeb49
librem_mini,librem_mini_v2: Enable CMOS layout, update CMOS checksum
Enable the coreboot CMOS option table, which initializes CMOS if the
checksum is not valid.

There is now a checksum in the CMOS layout since 4.21, update it when
updating the Mini v1/v2 EC power-on setting.

coreboot 4.21 will reset the CMOS settings during the first boot, since
there was no checksum in prior releases.  Heads will restore the
automatic power-on setting during init based on config.user.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-05 16:03:02 -04:00
Jonathon Hall
bde945ea57
modules/coreboot: Update Purism coreboot to 24e2f7e4
This is 4.21-Purism-1 plus a fix for native graphics init on Mini
v1/v2: HDMI1 is enabled so passive DisplayPort to DVI/HDMI adapters
will work.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-05 15:59:47 -04:00
Jonathon Hall
003bec4fd4
initrd/bin/flash-gui.sh: Exit instead of errant return
Return is not valid outside of a function - exit instead.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-05 15:57:13 -04:00
tlaurion
8272d33e7c
Merge pull request #1482 from tlaurion/ease_tpm_disk_unlock_key_resealing_after_totp_mismatch-warn_and_die_changes
Ease TPM Disk Unlock Key sealing/resealing after TOTP mismatch (firmware upgrade) + warn and die changes
2023-09-05 11:48:50 -04:00
Thierry Laurion
2cc7164a99
nv41/ns50: coreboot+coreboot patch+CircleCI config: adapt to have nv41/ns50 build on top of #1417 and #1462 2023-09-05 17:13:56 +02:00
Markus Meissner
a00aed50d7
reboot/poweroff: run nitropad-shutdown.sh for required boards 2023-09-05 17:13:56 +02:00
Markus Meissner
fabddb4f7a
flash-gui.sh: add .npf handling; add create-npf.sh 2023-09-05 17:13:56 +02:00
Markus Meissner
d01c3ab7c9
boards: add nitropad-nv41 + nitropad-ns50 2023-09-05 17:13:56 +02:00
Markus Meissner
902866cc29
add nitropad-shutdown.sh for EC based poweroff 2023-09-05 17:13:56 +02:00
Markus Meissner
033333f288
modules/nitrokey-blobs: add 2023-09-05 17:13:56 +02:00
Markus Meissner
7da9a7e136
modules/iotools: add as binary 2023-09-05 17:13:56 +02:00
tlaurion
94c36b9c8e
Merge pull request #1483 from Nitrokey/nk3-support
Nitrokey 3 support
2023-09-05 10:52:04 -04:00
Markus Meissner
b47da0be89
boards/qemu-*: update allowed usb-token comments 2023-09-05 12:32:22 +02:00
Markus Meissner
075d40950b
oem-factory-reset: introduce GPG_ALGO
* use GPG_ALGO as gpg key generation algorithm
* determine GPG_ALGO during runtime like this:
  * if CONFIG_GPG_ALGO is set, use as preference
  * adapt based on usb-token capabilities (currently only Nitrokey 3)
2023-09-05 12:28:52 +02:00
Thierry Laurion
47eba7d80b
kexec-save-default: Fix multiple LUKS/LVM+LUKS suggestion + other working uniformization for DUK 2023-09-02 11:49:57 -04:00
Thierry Laurion
e291797e65
kexec-save-default : Finally fix #1474 under #1482 2023-09-02 04:21:08 -04:00
Thierry Laurion
8b0fc0f129
kexec-seal/save-key /etc/functions : some more uniformisation of TPM DUK verbiage 2023-09-02 04:19:43 -04:00
Thierry Laurion
51b1ad39c3
sbin/insmod wrapper: Add TRACE and DEBUG traces 2023-09-02 04:16:16 -04:00
Thierry Laurion
52947e2767
WiP TPM DUK cleanup 2023-09-02 01:53:31 -04:00
Thierry Laurion
e9dbce2adf
bin/unpack_initramfs.sh: Add TRACE and DEBUG traces 2023-09-02 01:51:50 -04:00
Thierry Laurion
0ba10e5174
path substitution still not working. This is PoC to be tested. Had to go 2023-09-01 18:19:29 -04:00