Commit Graph

241 Commits

Author SHA1 Message Date
Jonathon Hall
0a823cb491
Allow laptops to include optional USB keyboard support
Laptops can include optional USB keyboard support (default off unless
the board also sets the default to 'y').  The setting is in the
configuration GUI.

CONFIG_USER_USB_KEYBOARD is now the user-controlled setting on those
boards.  'CONFIG_USB_KEYBOARD' is no longer used to avoid any conflict
with prior releases that expect this to be a compile-time setting only
(conflicts risk total lock out requiring hardware flash, so some
caution is justified IMO).

Boards previously exporting CONFIG_USB_KEYBOARD now export
CONFIG_USB_KEYBOARD_REQUIRED.  Those boards don't have built-in
keyboards, USB keyboard is always enabled. (librem_mini,
librem_mini_v2, librem_11, librem_l1um, librem_l1um_v2, talos-2,
kgpe-d16_workstation-usb_keyboard, x230-hotp-maximized_usb-kb).

Librem laptops now export CONFIG_SUPPORT_USB_KEYBOARD to enable
optional support.  The default is still 'off'.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2024-01-10 15:38:06 -05:00
Jonathon Hall
3a93b30d5b
Makefile: Support mirrors for dependency source packages
Try to download dependency source packages from mirrors if the primary
source fails or the archive has changed.

Move the download and verify logic to bin/fetch_source_archive.sh.  The
mirror list is here, currently only
https://storage.puri.sm/heads-packages/, but others can be added.  The
mirror list is randomized to load each mirror equally.

The verify logic is moved to this script too so it can fail over to a
mirror (or another mirror) if a mismatched archive is served, not just
for a failure.  Makefile no longer needs to verify separately and there
are no separate .*-_verify files any more, the archive is only moved to
its final place once verified.

Add `packages` target to just fetch all needed packages for a board,
facilitates seeding a mirror.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2024-01-05 12:49:36 -05:00
Thierry Laurion
77f9933538
xx20/xx30 blob based boards: move ME blobs target outside of board configs (targets/xx*_blobs.mk)
Makefile: have inclusion of all defined $BOARD BOARD_TARGETS (me, split_8mb4mb, ...)

TODO: VBIOS scripts for W530/T530 need way more work. To be done later.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 15:32:09 -05:00
Thierry Laurion
e81f59eac2
Makefile: Add basic helpers permitting to move boards from/to UNTESTED_
Adds two golbal helpers in Makefile:
- board.move_untested_to_tested
- board.move_tested_to_untested

Which can be called by:
- make BOARD=UNTESTED_t420-maximized board.move_untested_to_tested
- make BOARD=x230-legacy board.move_tested_to_untested

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-30 13:29:16 -05:00
Jonathon Hall
0cb6d9154f
Makefile: Allow downstream config in site-local/config
Allow downstreams to add config to site-local/config, which can set
config options, including overriding board config and exporting config
to /etc/config.

The intent of site-local is exactly the same as in coreboot - it is a
place for downstreams to add customizations that are included at well-
defined points in the build.  site-local should never appear in the
upstream repository.  coreboot's documentation explains this as well:
https://doc.coreboot.org/tutorial/managing_local_additions.html

Move definitions of ROM artifacts later, so site config can override
BRAND_NAME (and still is included after board config to override it as
well).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:52 -05:00
Jonathon Hall
c8e114166c
qemu: Deduplicate Qemu targets/documentation, extract from boards
The 8 qemu-* targets all contained nearly-identical copies of the
targets to prepare the TPM/disk/etc. and then run Qemu.  The only
significant differences were for TPM1/TPM2 (extra swtpm_setup step,
addition of --tpm2 to swtpm_setup and swtpm).  ROOT_DISK_IMG used := or
= differently in some boards, := was kept.

targets/qemu.mk now defines all Qemu targets and is included only for
qemu-* boards (by defining BOARD_TARGETS in each of those boards).

The documentation was moved from qemu-coreboot-fbwhiptail-tpm1-hotp/
qemu-coreboot-fbwhiptail-tpm1-htop.md to targets/qemu.md.  The other 7
qemu boards' symlinks to that file were removed.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:10 -05:00
Jonathon Hall
6873df60c1
Remove CONFIG_BRAND_UPDATE_PKG_EXT, use zip everywhere
Nitrokey is going to switch from npf to zip per discussion.  Remove
this config.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-11-16 08:58:38 -05:00
Jonathon Hall
6ef5298d20
Makefile: Don't build ZIP update package for talos-2
talos-2 builds its own tgz update package that is not currently
integrated with the zip method.  While the zip method right now would
theoretically if the tgz was inside it, this would have to be hooked
up for talos-2 specifically.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-11-14 16:50:15 -05:00
Jonathon Hall
51e2d789b4
Makefile: Only add update package to all if it's actually built
Only add the update package to all if it is actually being built, fixes
default target with CONFIG_LEGACY_FLASH=y.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-11-14 13:26:18 -05:00
Jonathon Hall
bb7294476d
Makefile: Don't generate update package for legacy flash boards
The only purpose of legacy flash boards is to be flashed over vendor
firmware using an exploit, to then flash non-maximized Heads firmware.

They are never upgraded to another legacy flash build, and they move
the coreboot ROM from the build directory, so don't build an update
package for those boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-11-14 12:14:18 -05:00
Jonathon Hall
5bd50652a0
flash-gui.sh: Extend NPF archive format to ZIP, improve workflow
Allow configuring the ZIP-format update file extension with
CONFIG_BRAND_UPDATE_PKG_EXT in board config.  Default is 'zip'.

Create update package in the default Makefile target.  Delete
create_npf.sh.

Do not require /tmp/verified_rom in the update file package's
sha256sum.txt (but allow it for backward compatibility).

Show the integrity error if unzip fails instead of dying (which returns
to main menu with no explanation, error is left on recovery console).
This is the most likely way corruption would be detected as ZIP has
CRCs.  The sha256sum is still present for more robust detection.

Don't require the ROM to be the first file in sha256sum.txt since it
raises complexity of adding more files to the update archive in the
future.  Instead require that the package contains exactly one file
matching '*.rom'.

Restore confirmation prompt for the update-package flow, at some point
this was lost.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-11-13 16:42:05 -05:00
d-wid
2bfa1737f8
Support branding under branding subdirectories
Squash of  + moving logo/bootsplash files under branding/Heads

- Move logos and bootsplashes from blobs to branding/Heads/
- Makefile: add support for BRAND_DIR which depends on BRAND_NAME which defaults to Heads if no branding
- Boards coreboot configs: change bootsplash directory to depend on BRAND_DIR (instead of BLOBS_DIR) in bootsplash enabled configs
- Branding/Heads/bootsplash-1024x768.jpg points to branding/Heads/d-wid-ThePlexus_coreboot-linuxboot-heads_background-plain_DonateQrCode.jpg
- xcf file deleted. Original still under  to reuse for modification without recompressing (blobs/heads.xcf)
- CREDITS file created to point to original authors, remixers (Open for details)
  - Thanks to: @d-wid for remixing Bing's AI generated Janus logo, @ThePlexus for Qubes Box concept and @ThrillerAtPlay for its matrix background
2023-10-06 17:09:23 -04:00
Thierry Laurion
2cc7164a99
nv41/ns50: coreboot+coreboot patch+CircleCI config: adapt to have nv41/ns50 build on top of and 2023-09-05 17:13:56 +02:00
Markus Meissner
7da9a7e136
modules/iotools: add as binary 2023-09-05 17:13:56 +02:00
Thierry Laurion
f6eed42208
Add external/usb disk encryption (adds exfatprogs and e2fsprogs)
prepare_thumb_drive: default to creating 10% LUKS container on usb drive, prompts for passphrase is not provided and scan drives if no --device specified

NOTE: qemu usb_thumb drive of 128 mb are not big enough so that 10% of it (12mb) can be used to create thumb drive.

Adds:
- e2fsprogs to support ext4 filesystem creation through mke2fs
- add /etc/mke2fs.conf so that mke2fs knows how to handle ext2/ext3/ext4
- removes mke2fs support from busybox
- bump busybox to latest version which adds cpu accelerated hash functions (not needed per se here)
- Adds exfatprogs to have mkfs.exfat and fsck.exfat
- Adds prepare_thumb_drive /etc/luks-functions to be able to prepare a thumb drive with percentage of drive assigned to LUKS, rest to exfat
- Modify most board configs to test space requirements failing
- Talos2 linux config: add staging Exfat support
- Make e2fsprogs and exfatprogs included by default unless explicitely deactivate in board configs
- Change cryptsetup calls : luksOpen to open and luksClose to close to addresss review
- etc/luks_functions: cleanup

GOAL here is to have secure thumb drive creation which Heads will be able to use to backup/restore/use generated GPG key material in the future (next PR)
2023-08-28 16:23:48 -04:00
tlaurion
fbc0993084
Merge pull request from JonathonHall-Purism/reuse-toolchains
Enable reusing coreboot release toolchains for forks
2023-08-15 16:27:20 -04:00
Jonathon Hall
2f329d9007
kbd: Add setfont from kbd to set large console font on large displays
Build kbd and ship setfont if enabled with CONFIG_KBD.

When CONFIG_KBD is enabled, setconsolefont.sh will double the console
font size on large displays (>1600 lines tall as a heuristic).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-08-11 14:40:04 -04:00
Jonathon Hall
c12b8cec4b
Makefile: Don't double version number in patches for versioned modules
Default the patch version to empty if the module name already includes
the version.  Fixes application of coreboot patches.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-08-11 12:44:39 -04:00
Jonathon Hall
786cf09ec7
modules/coreboot: Define each coreboot version as a separate module
Define a separate module for each coreboot version, so the module used
to build the ROM will optionally be able to reference the toolchain
from a different module.

This will allow coreboot fork builds to use the toolchain from the
corresponding release.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-08-11 12:41:59 -04:00
Jonathon Hall
4c8e445dcd
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-07-05 14:32:16 -04:00
Jonathon Hall
861529cf69
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream 2023-06-27 13:21:19 -04:00
Thierry Laurion
a4f5965183
Makefile: point default board to qemu-coreboot-fbwhiptail-tpm1 so autocompletion still works
removal of qemu-coreboot board made autocomplete apparition of modules helpers vanish
2023-06-27 11:21:38 -04:00
Thierry Laurion
f13432cca7
Makefile+ modules/linux: have sizes report output on screen and into sizes.txt
Basically a duplicate of HASHES related Makefile statements
2023-06-27 10:42:04 -04:00
Jonathon Hall
89858f52a9
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 15:15:23 -04:00
Jonathon Hall
c5183253a6
Add CONFIG_BRAND_NAME and allow overriding in Makefile with BRAND_NAME
Use CONFIG_BRAND_NAME to control the brand name displayed in the UI.
Override by setting BRAND_NAME when building, either in the Makefile or
on the command line.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 14:47:59 -04:00
Jonathon Hall
1bf8331ffb
Blob jail: Add zstd-decompress, decompress more complex archives
Debian 12's initrd by default now consists of an uncompressed cpio
archive containing microcode, followed by a zstd-compressed cpio
archive.  inject_firmware.sh only supported gzip-compressed cpio, so it
could not extract /init from this archive.

Add zstd-decompress to decompress zstd streams (uncompressed size is
about 180 KB).

Add unpack_initramfs.sh which is able to decompress uncompressed, gzip,
or zstd archives, with multiple segments, much like the Linux kernel
itself does.

Use unpack_initramfs.sh to extract /init for blob jail.

Don't compress the new archive segment containing firmware and the
updated /init.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:50 -04:00
Jonathon Hall
d148d3136a
init: Add optional board-specific init script
Boards can place a file in $(board)/initrd/bin/board-init.sh to perform
board-specific initialization.

If present, the board's $(board)/initrd directory is included in the
initrd via board.initrd.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:47 -04:00
Jonathon Hall
6e0d241913
ioport: Add ioport module (inb, outb)
Add ioport module, enable for librem_mini_v2.  Only inb and outb are
included, inw/outw/inl/outl aren't needed.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:46 -04:00
persmule
3f1c76ce11
Introduce io386 to heads and use it to finalize chipset at runtime
On some newer platforms of intel (confirmed on nehalem, sandy/ivy
bridge), coreboot after commit [2ac149d294af795710eb4bb20f093e9920604abd](https://review.coreboot.org/cgit/coreboot.git/commit/?id=2ac149d294af795710eb4bb20f093e9920604abd)
registers an SMI to lockdown some registers on the chipset, as well
as access to the SPI flash, optionally. The SMI will always be triggered
by coreboot during S3 resume, but can be triggered by either coreboot
or the payload during normal boot path.

Enabling lockdown access to SPI flash will effectly write-protect it,
but there is no runtime option for coreboot to control it, so letting
coreboot to trigger such SMI will leave the owner of the machine lost
any possibility to program the SPI flash with its own OS, and becomes
a nightmare if the machine is uneasy to disassemble, so a scheme could
be implement, in which the SMI to lockdown chipset and SPI flash is left
for a payload to trigger, and temporarily disabling such triggering in
order to program the SPI flash needs authentication.

I have implemented a passcode-protected runtime-disableable lockdown
with grub, described [here](https://github.com/hardenedlinux/Debian-GNU-Linux-Profiles/blob/master/docs/hardened_boot/grub-for-coreboot.md#update-for-coreboot-after-commit-2ac149d294af795710eb4bb20f093e9920604abd). In order to implement a similar scheme for
Heads, I wrote [io386](https://github.com/hardenedlinux/io386).

With this commit, io386 will be called before entering boot routine
to trigger the SMI to finalize the chipset and write protect the SPI
flash at the same time. Entering recovery shell will leave the flash
writable.

(The authentication routine implemented in previous revisions has been
split as an independent commit.)

Originally proposed under PR#326
2023-06-12 13:05:49 -04:00
Sergii Dmytruk
0a1e47f585
Makefile: autoupdate and checkout git clones of modules
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2023-06-09 21:25:08 +03:00
Sergii Dmytruk
62e1899367
modules/powerpc-utils: add
This provides nvram tool that allows manipulating configuration of
skiboot.

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2023-06-07 01:10:13 +03:00
Markus Meissner
3ea82ec31e
Makefile: adapt cleaning targets for arch directory 2023-05-09 17:50:49 +02:00
tlaurion
8ff4b9a51b
Merge pull request from danielp96/master
Update busybox 1.32.0 to 1.33.2
2023-04-12 12:36:46 -04:00
Thierry Laurion
eaa17681dc
Makefile: readd util-linux dependency check to add agetty when needed
Removed accidentally under 6923fb5e20
2023-03-24 16:41:39 -04:00
Jonathon Hall
c2a4d84dfd
Makefile: Bring back bash in bin_modules
bash was accidentally dropped from bin_modules when reintroducing
CONFIG_BASH, put it back and depend on CONFIG_MODULES now.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:52 -05:00
Thierry Laurion
d549229bfc
modules/bash: enabled by default, disabled in legacy-flash boards
- legacy-flash boards have a single purpose: to flash BIOS region through flashrom.
  - They do not need bash nor have space for it in their 4mb defined coreboot CBFS region

Test build to have legacy boards builds under osresearch#1292
2023-03-08 12:45:52 -05:00
Jonathon Hall
c9df49ad20
modules/bash: Include bash in all builds, remove CONFIG_BASH
Include bash in all builds.  Remove CONFIG_BASH.

Remove CONFIG_BASH_IS_ASH from busybox configuration and clean up hacks
in modules/bash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:52 -05:00
Jonathon Hall
4e375ad7ca
tpm2-tools: Remove curl dependency
The actual use of curl was already removed, update tpm2-tools patch to
also remove the check for curl.  Remove the curl module and
CONFIG_CURL.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:44 -05:00
Thierry Laurion
6923fb5e20
Addition of qemu-(fb)whiptail-tpm2(-hotp) boards
-coreboot support of TPM v2.0 (shared config for TPM2 support across all 4 previous variations)
-swtpm set to be launched under TPM v2.0 mode under board config
-Documentation file under each board.md softlinks to qemu-coreboot-fbwhiptail-tpm1.md (which has been generalized)
This is skeleton for TPM v2 integration under Heads

-------------
WiP

TODO:
- libcurl cannot be built as a tpm2-tools dependency as of now not sure why. curl currently needs to be added in board config to be built
- Note: tpm-reset (master and here) needs some review, no handle of no tpm use case. Caller is responsible to not call it otherwise does nothing
- init tries to bind fd and fails currently
- Note: Check if whiptail is different of fbwhiptail in clearing screen. As of now every clear seems to be removed, still whiptail clears previous console output
- When no OS' /boot can be mounted, do not try to TPM reset (will fail)

- seal-hotpkey is not working properly
- setting disk unlock key asks for TPM ownership passphrase (sealing in NV requires ownership, but text is misleading user as if reowning TPM)
  - We should cache input, feed tpm behind the scene and wipe passphrase and state clearly that this is TPM disk unlock kye passphrase.
- primary key from TPM2 is invalid most of the time from kexec-select-boot and verifying global hashes but is setuped correctly at disk unlock key setup
- would be nice to take advantage of bash function tracing to understand where we are for debugging purposes, code takes ash in consideration only
- tpmr says it implements nv calls but actually doesn't. Removing those falsely wrapped functions would help.
  - Implementing them would be better
- REVIEW TODOS IN CODE
- READD CIRCLECI CONFIG

Current state:
- TPM unseal works without disk unlock key and generates TOTP properly (was missing die condition at unseal to not produce always good TOTP even if invalid)
- TPM disk encryption key fails. Hypothesis is that sealing with USB drivers loaded and measures in inconsistent with sealed with/without.
 - TPM disk unsealing happens without USB modules being loaded in non-HOTP setup. This fails.

- Current tests are with fbwhiptail (no clear called so having traces on command line of what happens)
 - Testing with HOTP implementation for sealing/unsealing since that forces USB module loads on each boot to remove this from failing possibilities
2023-03-08 12:45:43 -05:00
Daniel Pineda
b51fda22c1
Makefile: add --remove-destination to cp calls.
This avoids overwriting the busybox binary (and bricking the system)
by following a symlink when busybox and other module both provide
a command with the same filename.

Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
2023-02-21 14:34:41 -06:00
Jonathon Hall
7592efcf99
Makefile: Fix cross compilation variables for pkg-config
pkg-config will still pick up system default directories from
PKG_CONFIG_LIBDIR even if PKG_CONFIG_PATH is set.  Per the docs,
cross compilation requires clearing PKG_CONFIG_PATH and setting
PKG_CONFIG_LIBDIR (which is always searched after PKG_CONFIG_PATH).

Fixes issues observed in tpm2_retry branch picking up packages from
host environment.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-02-21 13:46:03 -05:00
Baitinq
171b29f09d
Makefile: Use path agnostic bash location
This patch changes the bash location in the makefile from /bin/bash to
/usr/bin/env bash. The latter is a more reproducible location as it is
common to more *nix systems which don't contain the former, such as
NixOS.
2022-12-28 15:58:57 +01:00
Thierry Laurion
1279e8bd57
Change patch to git apply 2022-11-02 15:11:26 -04:00
Thierry Laurion
5e6f4fb90b
Reproducibility: fixate HEADS_GIT_VERSION to use a commit id of 7 characters 2022-10-20 11:00:33 -04:00
Sergii Dmytruk
b5fb2f907c
Build agetty from util-linux and optionally add it to initrd
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-09-01 00:21:27 +03:00
Matt DeVillier
00bb2b6c32
Makefile: Allow use of a specific hash for module using a git repo
`git reset --hard <commit_hash>` is a no-op when commit_hash is unset
2022-08-31 00:21:24 +03:00
Thierry Laurion
988b05f09d
Emergency revert of git apply instead of patch 2022-08-30 15:57:30 -04:00
tlaurion
48b9b74f39
Merge pull request from tlaurion/replace_patch_git_git_apply
Makefile: replace patch with git apply
2022-08-30 15:15:42 -04:00
Sergii Dmytruk
f16e92792a
Support targeting PowerPC 64
This prepares most of the modules to be build for it.

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-08-25 20:55:39 +03:00
Sergii Dmytruk
2a44e5e7ee
Incorporate architecture into directory layout
* build/ -> build/<arch>/
 * crossgcc/ -> crossgcc/<arch>/
 * install/ -> install/<arch>/
 * packages/ -> packages/<arch>/

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-08-25 20:55:39 +03:00