Commit Graph

351 Commits

Author SHA1 Message Date
Thierry Laurion
61843d890b
Unify upstream board config defaults
- Upstream boards will not deactivate TPM DUK
- Upstream will not force BRAND_NAME which currently defaults to Heads
- Upstream will not deactivate Qr code on screen output on HOTP sealing
- Upstream will not offer OEM reset defaults (deprecated and now default anyway)

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-19 13:05:46 -05:00
Jonathon Hall
12a099ad8e
talos-2: Move PPC-style tgz update package targets to targets/
Move the targets generating talos-2's tgz update package to targets.

While this wasn't duplicated, it breaks a cyclic dependency between
board config and BRAND_NAME by moving the ROM output name dependencies
later.  The logic probably would be shared with similar boards if any
were supported, so it is in the spirit of the other targets/ shared
target Makefiles.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:52 -05:00
Jonathon Hall
8ce9c9d438
*-legacy-flash: Deduplicate generation of "top" ROM
Move Makefile target for the "top" ROM to targets/legacy_flash.mk.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:52 -05:00
Jonathon Hall
d512cd4ad2
12MB boards: Deduplicate generation of 8MB/4MB split ROMs
Move Makefile targets for split ROMs to targets/split_8mb4mb.mk.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:52 -05:00
Jonathon Hall
c8e114166c
qemu: Deduplicate Qemu targets/documentation, extract from boards
The 8 qemu-* targets all contained nearly-identical copies of the
targets to prepare the TPM/disk/etc. and then run Qemu.  The only
significant differences were for TPM1/TPM2 (extra swtpm_setup step,
addition of --tpm2 to swtpm_setup and swtpm).  ROOT_DISK_IMG used := or
= differently in some boards, := was kept.

targets/qemu.mk now defines all Qemu targets and is included only for
qemu-* boards (by defining BOARD_TARGETS in each of those boards).

The documentation was moved from qemu-coreboot-fbwhiptail-tpm1-hotp/
qemu-coreboot-fbwhiptail-tpm1-htop.md to targets/qemu.md.  The other 7
qemu boards' symlinks to that file were removed.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:10 -05:00
Thierry Laurion
b8a06c5351
Librems/Nitropad: enable QR code printed on screen at TOTP/HOTP Generation
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-16 13:15:14 -05:00
Thierry Laurion
d8f098cd53
All board configs: first line now BRAND_NAME=Heads to ease rebranding with sed scripts for downstream projects/forks
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-16 12:56:58 -05:00
Thierry Laurion
bac35e3b3e
Librems/Nitropad: enable TPM DUK under Heads branding (CONFIG_TPM_NO_LUKS_DISK_UNLOCK=n)
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-16 12:52:19 -05:00
tlaurion
4a57c615e9
Merge pull request #1522 from tlaurion/efifb_next_step_related_cleanups
WiP: FB_EFI (EFIFB kernel module's framebuffer on top of libgfxinit or GOP) next steps related cleanups
2023-12-12 13:04:58 -05:00
Thierry Laurion
e0fabb1534
NV41: adapt board config to remove CONFIG_BOOT_KERNEL_ADD=intel_iommu=igfx_off equally as for NS50 under 2fcef4a979 and tested for NS50 at https://github.com/linuxboot/heads/pull/1522#issuecomment-1822489517
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-12 11:33:43 -05:00
Thierry Laurion
0dbbae5dbc
Move t530, p8z77 and t420 boards to be prefixed with UNTESTED as per https://github.com/linuxboot/heads/pull/1522#issuecomment-1850734068. Note that w530 was already marked as UNTESTED, look for commit having moved this board as untested.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-11 16:07:01 -05:00
tlaurion
9afe235a6b
Update qemu-coreboot-fbwhiptail-tpm1-hotp.md
Add bookworm swtpm installation instructions
2023-11-26 11:58:49 -05:00
Thierry Laurion
664603cf8c
Changeset based on nitrokey 2.3 release to understand what is attempted here. i915 is still under linux config on 2.3 release. coreboot is on gop, not libgfxinit. This is to open discussion.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-20 11:17:38 -05:00
Thierry Laurion
0e42833ada
x230-legacy-flash board: fixup pointing to x230 as opposed to t430. Fix coreboot config path to bootsplash
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-20 09:42:28 -05:00
Thierry Laurion
2fcef4a979
FB_EFI next step: remove CONFIG_BOOT_KERNEL_ADD=intel_iommu=on intel_iommu=igfx_off, add CONFIG_BOOT_KERNEL_REMOVE=intel_iommu=on intel_iommu=igfx_off, remove quiet removal from CONFIG_BOOT_KERNEL_REMOVE. TLDR: do not interfere with OS setting its own boot policies
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-20 09:40:39 -05:00
JonathonHall-Purism
f5377b3bd5
Merge pull request #1526 from JonathonHall-Purism/zip_updates
flash-gui.sh: Extend NPF archive format to ZIP, improve workflow
2023-11-17 10:21:44 -05:00
Thierry Laurion
56d38e112c
Talos-2 fixes to comply with hashing file standard. Bypass flash-gui.sh prompt when talos-2 ato validate hashes against hashes provided under tgz through flash.sh validation (still offer zip and tgz, which tgz might change to zip later but only tgz offered through builds)
Attempt to address https://github.com/linuxboot/heads/pull/1526#issuecomment-1811185197

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-16 08:44:39 -05:00
Jonathon Hall
bb7294476d
Makefile: Don't generate update package for legacy flash boards
The only purpose of legacy flash boards is to be flashed over vendor
firmware using an exploit, to then flash non-maximized Heads firmware.

They are never upgraded to another legacy flash build, and they move
the coreboot ROM from the build directory, so don't build an update
package for those boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-11-14 12:14:18 -05:00
tlaurion
133da0e48e
Merge pull request #1515 from tlaurion/inmemory_keygen-gpg_backup_usable_for_RSA_only-copy_to_card_working_for_RSA_only-gpg_auth_for_recovery_and_sub_boot
GPG User Authentication: In-memory gpg keygen + keytocard and GPG key material backup enabling  (plus a lot of code cleanup and UX improvements)
2023-11-13 16:05:26 -05:00
Thierry Laurion
9e0491e9db
oem-factory-reset/librem boards: remove CONFIG_OEMRESET_OFFER_DEFAULTS=y and checks for it; the default of oem-factory-reset is now to propose user to use defaults first for simplicity of most common use case without allianating advanced users which can simply not accept the default and answer questionnaire
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-06 11:27:51 -05:00
Thierry Laurion
f5dc5ef5cd
qemu boards: Put back DEBUG and TRACE on
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:08:35 -04:00
Thierry Laurion
a3086e9a1c
Remove TODO in code that were not relevant prior of first review
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:08:19 -04:00
Thierry Laurion
56b602974b
WiP: NK3 with p256 ECC algo supported for in-memory keygen and key-to-card op. With this commit, one can provision NK3 with thumb drive backup which enables authenticated recovery shell and USB boot.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:40 -04:00
Thierry Laurion
2b21623bc6
qemu doc: add modify list/mount instructions to use losetup to map partitions to loop0pX and mount them to get public key
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:37 -04:00
Thierry Laurion
27c457f04b
TPM2 DUK and TOTP/HOTP reseal fix, refactoring and ifferenciating tpm_password into tpm_owner_password and reusing correctly
i
TODO: fix all TODO in PR prior of review + squash

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:27 -04:00
Thierry Laurion
2ae94405ad
WiP: add export CONFIG_HAVE_GPG_KEY_BACKUP=y so whiptail-tpm2 can be used with GPG key material thumb drive backup
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:04 -04:00
Thierry Laurion
1f28c71447
WiP: adapt dmesg in function of CONFIG_DEBUG_OUTPUT being enabled or not so and adapt further troubleshooting notes in code when keys cannot be accessed on media for whatever cause so user can understand what is happening when accessing GPG material on backup thumb drive
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:06:55 -04:00
Thierry Laurion
b1e5c638cd
WiP
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:06:45 -04:00
tlaurion
f540f2a335
Merge pull request #1430 from gaspar-ilom/w541-support
Support Thinkpad W541
2023-10-30 15:41:14 -04:00
tlaurion
1733552fe7
Merge pull request #1505 from JonathonHall-Purism/upstream_28.1_librem_11
Add support for Librem 11
2023-10-30 15:38:02 -04:00
gaspar-ilom
2e8239c5e7 add configuration for w541
closes #1389
2023-10-23 21:52:09 +02:00
Thierry Laurion
9addb3b6b0
qemu board doc: add Nitrokey3NFC in md doc 2023-10-10 12:30:41 -04:00
Thierry Laurion
4ff955918f
x230-maximized board configs: add DEBUG/TRACE board config in comment
Enabling DEBUG/TRACE options from board config vs from configuration menu is different.

When enabled in board config, /etc/config is from ROM, and sourced early and make TRACE/DEBUG calls appear early.
If added through configuration menu, those are /etc/config.user overrides extracted from CBFS and then sourced after combine_configs call

If for whatever reason early DEBUG is needed on a platform, enabling in board config is needed.
For runtime debugging, enabling Debug output from configuration menu is enough
2023-10-10 12:14:36 -04:00
Jonathon Hall
55155f6558
boards/librem_11: Add Librem 11
Add Librem 11 board.

Librem 11 uses coreboot graphics init, which is done with FSP GOP.

Set a custom keymap for the volume/power keys.  Configure the volume
keys as up/down arrows (for navigation in fbwhiptail, and for shell
history in the Linux console).  Configure the power key as Enter.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-29 15:36:30 -04:00
Jonathon Hall
fab9124f00
librem_* (except L1UM): Linux 6.1, coreboot gfx init with efifb
Update all Librems except L1UM (but including L1UM v2) to Linux 6.1.8.

Use coreboot native graphics init.  Raise maximum framebuffer size for
laptops to 3840x2160 (desktops default to this, but laptops default
to a lower value).  Remove DRM modules from Linux 6.1.8 and add EFIFB.

Remove Heads kernel command line options relating to IOMMU and i915,
which are no longer needed.  Remove OS kernel options relating to
IOMMU.

For Librem 13/15/14/Mini, this fixes issues booting with 4K displays
attached, which were resulting in crashes due to the framebuffer memory
not being reserved properly.  memtest86+ now passes with a 4K display
attached.

For Librem L1UM v2, framebuffer boot now works.

Librem L1UM remains on Linux 5.10 with Heads kernel graphic init
(framebuffer boot still does not work).  coreboot 4.11 has native
graphics init for Aspeed, but only in text mode.  Backporting the
linear framebuffer support appears to be possible - the patch applied
cleanly - but it did not work initially and will need more
investigation.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-06 10:36:37 -04:00
tlaurion
8bd82a6e10
Merge pull request #1494 from JonathonHall-Purism/coreboot_purism_4.21
modules/coreboot: Update Purism coreboot to 24e2f7e4
2023-09-06 10:19:55 -04:00
tlaurion
2c3987f9a3
Merge pull request #1485 from Nitrokey/nx-nitropad
add Nitropad NV41/NS50 TPM2 boards (2nd)
2023-09-06 10:15:17 -04:00
Jonathon Hall
eed8adeb49
librem_mini,librem_mini_v2: Enable CMOS layout, update CMOS checksum
Enable the coreboot CMOS option table, which initializes CMOS if the
checksum is not valid.

There is now a checksum in the CMOS layout since 4.21, update it when
updating the Mini v1/v2 EC power-on setting.

coreboot 4.21 will reset the CMOS settings during the first boot, since
there was no checksum in prior releases.  Heads will restore the
automatic power-on setting during init based on config.user.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-05 16:03:02 -04:00
tlaurion
8272d33e7c
Merge pull request #1482 from tlaurion/ease_tpm_disk_unlock_key_resealing_after_totp_mismatch-warn_and_die_changes
Ease TPM Disk Unlock Key sealing/resealing after TOTP mismatch (firmware upgrade) + warn and die changes
2023-09-05 11:48:50 -04:00
Markus Meissner
d01c3ab7c9
boards: add nitropad-nv41 + nitropad-ns50 2023-09-05 17:13:56 +02:00
Markus Meissner
b47da0be89
boards/qemu-*: update allowed usb-token comments 2023-09-05 12:32:22 +02:00
Thierry Laurion
03d8f93c95
modules/zstd: now included by default. Deactivated under legacy-flash boards
Rationale:
cpio -t alone cannot extract initrd past early cpio (microcode) in most packed initrd.
unpack_initramfs.sh already under master comes to the rescue, but its usage up to today was limited to pass firmware blobs to final OS under boards/librem_mini_v2

Debian OSes (and probably others) need to have cryptroot/crypttab overriden directly, otherwise generic generation of crypttab is not enough.
Extracting crypttab and overriding directly what is desired by final OS and exposed into /boot/initrd is the way to go otherwise hacking on top of hacks.

This brings default packed modules under Heads to 5 modules, which needs to be deactivate in board configs if undesired:
user@heads-tests-deb12:~/heads$ grep -Rn "?= y" modules/ | grep -v MUSL
modules/zlib:1:CONFIG_ZLIB ?= y
modules/zstd:3:CONFIG_ZSTD ?= y
modules/exfatprogs:2:CONFIG_EXFATPROGS ?= y
modules/busybox:2:CONFIG_BUSYBOX ?= y
modules/e2fsprogs:2:CONFIG_E2FSPROGS ?= y
2023-08-31 11:19:50 -04:00
Thierry Laurion
d5aa0c874e
boards/qemu-coreboot-whiptail-tpm1/qemu-coreboot-whiptail-tpm1.md was invalid symlink 2023-08-28 16:24:14 -04:00
Thierry Laurion
106a9bf543
qemu boards: change default creation size of USB_FD_IMG from 128MB to 256MB
Otherwise 10% of 128mb (12mb) is not enough to create a LUKS container
2023-08-28 16:24:11 -04:00
Thierry Laurion
97f39a8b1f
t430-maximized/t430-hotp-maximized: move from untested to tested boards, other t430 boards still untested 2023-08-16 14:54:12 -04:00
Thierry Laurion
e5b64f8c48
t430/x230 legacy flash boards: unify so they specify coreboot config files as all other boards
(Otherwise, renaming board requires to rename coreboot config file as well since BOARD is used to pick corresponding one when undefined)
2023-08-16 13:29:08 -04:00
Thierry Laurion
294a6bed94
t430 boards: moved to untested until reported tested as per #1421 2023-08-16 12:35:52 -04:00
Thierry Laurion
572573ff40
x220 board: this is maximized coreboot config, legacy linux config 2023-08-16 09:44:44 -04:00
Thierry Laurion
107855f53a
p8z77-m_pro-tpm1: bring back boards as tested platforms. 2023-08-16 09:44:41 -04:00
Thierry Laurion
d3ea60f69e
linux configs: adapt to use efifb driver (Intel iGPU/qemu with bochs native gfxinit) 2023-08-15 17:24:34 -04:00
tlaurion
fbc0993084
Merge pull request #1462 from JonathonHall-Purism/reuse-toolchains
Enable reusing coreboot release toolchains for forks
2023-08-15 16:27:20 -04:00
Jonathon Hall
57f9d1635b
x230-*-fhd_edp: Include kbd to set console font size
Include the kbd module to set the console font size based on the
display resolution.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-08-11 14:40:10 -04:00
Jonathon Hall
d0d2ea9a77
librem_mini{,_v2}: Include kbd to set console font size
Include the kbd module to enlarge the console font size based on the
display resolution.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-08-11 14:40:09 -04:00
Jonathon Hall
ef85973109
librem_15v4: Include kbd, don't force eDP resolution in Heads kernel
Include kbd so the console font can be enlarged based on the display
resolution.

Don't force 1080p on the eDP output in Heads.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-08-11 14:40:09 -04:00
Jonathon Hall
555dde0b43
boards/librem_* (except l1um): Remove CONFIG_PURISM_BLOBS=y
These boards get purism-blobs as a submodule of the purism coreboot
fork.  modules/coreboot used to skip the purism-blobs dependency for
this fork, but the module is not needed at all for these boards.

librem_l1um keeps CONFIG_PURISM_BLOBS=y since it is built from patched
coreboot 4.11.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-08-11 12:44:39 -04:00
Thierry Laurion
447f8addc7
Rename UNTESTED_x230-maximized-fhd_edp and UNTESTED_x230-hotp-maximized-fhd_edp to normal names 2023-08-02 14:37:02 -04:00
tlaurion
06b1b0948d
Merge pull request #1399 from d-wid/z220
Add HP Z220 CMT
2023-07-24 18:27:17 -04:00
d-wid
4d157493a3 Add HP Z220 CMT 2023-07-22 16:27:31 +02:00
tlaurion
d7b4a47cfe
Merge pull request #1442 from tlaurion/qemu_basic_boot_example_in_board_config
Qemu boards: typo correction in comment to manually enable Basic Boot mode
2023-07-17 14:08:22 -04:00
Thierry Laurion
f4a8ae925f
non-dgpu t530 was reported working (t530-hotp-maximized-v0.2.0-1705-gedf200e.rom) 2023-07-17 12:49:32 -04:00
Thierry Laurion
c419cf7e2b
Qemu boards: typo in comment to manually enable Basic Boot mode : (was CONFIG_BASIC_BOOT where CONFIG_BASIC expected) 2023-07-17 12:32:27 -04:00
Jonathon Hall
45245fe417
qemu-*: Show how to enable restricted/basic in board config
For iterating, enabling these in the board config is easiest.  It's
also possible to manually inject config.user ahead of time, or enable
at runtime without flashing, but the normal enable/flash/reboot path
does not work in qemu since it is unable to flash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-07-12 14:17:43 -04:00
Jonathon Hall
252efc6945
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream 2023-07-07 15:57:34 -04:00
Jonathon Hall
4c8e445dcd
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-07-05 14:32:16 -04:00
Jonathon Hall
17724f9baa
qemu-coreboot-fbwhiptail-tpm1-hotp: Fix truncated documentation lines
A few lines in the documentation got truncated somehow.  Restored the
swtpm instructions from some notes and rewrote the others.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-07-05 14:11:34 -04:00
Thierry Laurion
5db4165652
Rename UNTESTED_t420-maximized and UNTESTED_t420-hotp-maximized back to maximized board names. 2023-07-05 10:38:18 -04:00
Thierry Laurion
f8cb3db775
untested boards: move and rename untested boards, while still building them with CircleCI if they were currently built.
Non-impactful action, first step for #1421 based on participation in testing of #1398 and prior non-tested PRs.

EDIT: last minute readd of x220-maximized boards (x220-maximized and x220-hotp-maximized boards).
 x220 is still UNTESTED (legacy, manually extracting ifs, me and gbe).

EDIT: last minute readd of t440p-maximized boards (t440p-maximized and t440p-hotp-maximized boards).

Thanks to @srgrint for lat minute report that t440p and x220 were tested
----

Traces of commands used:
ls qemu-linuxboot* leopard* r630* s2600wf* tioga* winterfell* t420* t520* t440p* w530* kgpe* p8z77* x220* x230-maximized-fhd_edp* | grep ":" | awk -F ":" {'print $1'}| while read board; do mv $board/$board.config $board/UNTESTED_$board.config; done
ls qemu-linuxboot* leopard* r630* s2600wf* tioga* winterfell* t420* t520* t440p* w530* kgpe* p8z77* x220* x230-maximized-fhd_edp* | grep ":" | awk -F ":" {'print $1'}| while read dir; do mv $dir UNTESTED_$dir; done
ls UNTESTED* | grep ":" | awk -F ":" {'print $1'}| awk -F "UNTESTED_" {'print $2'} | while read line; do sed 's/'"$line"'/UNTESTED_'"$line"'/g' ../.circleci/config.yml -i ; done

quick fix of circleci:
sed -i 's/UNTESTED_UNTESTED/UNTESTED/g' ../.circleci/config.yml
sed -i 's/UNTESTED_UNTESTED/UNTESTED/g' ../.circleci/config.yml
sed -i 's/UNTESTED_UNTESTED/UNTESTED/g' ../.circleci/config.yml

Modify p8z77-m_pro-tpm1 hotp board config to include to their maximized counterpart
2023-07-04 18:00:30 -04:00
Thierry Laurion
da4c306d91
t440p p8z77-m_pro: pass to coreboot 4.19 and with comparable lockdown config to x230 + fix vbt path 2023-06-27 11:21:28 -04:00
Thierry Laurion
cc9a4828ef
Remove qemu-coreboot and qemu-coreboot-fbwhiptail board+coreboot configs
qemu-coreboot-*-tpm* boards are way more feature rich to test/develops Heads
2023-06-27 11:21:15 -04:00
Thierry Laurion
f34d2dd7d7
bump qemu-tpm boards to coreboot 4.19 2023-06-27 11:21:09 -04:00
Thierry Laurion
e02228407f
boards: bump non-tpm qemu*, xx20 and xx30 boards to use linux kernel 5.10.5 2023-06-27 11:21:06 -04:00
Thierry Laurion
e8bc003a56
boards/p8z77-m_pro-tpm1-maximized: bump linux from 4.14 to 5.10 2023-06-27 11:21:02 -04:00
Jonathon Hall
8289d1bb29
oem-factory-reset: Offer to use all defaults on Librem boards only
Introduce CONFIG_OEMRESET_OFFER_DEFAULTS and enable it on Librem
boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-23 08:20:21 -04:00
Jonathon Hall
f6134e9c35
gui-init: Opt into skipping QR code scan for Librem boards only
Introduce CONFIG_TOTP_SKIP_QRCODE to skip this step and enable it on
Librem boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-23 08:18:59 -04:00
Jonathon Hall
89858f52a9
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 15:15:23 -04:00
Jonathon Hall
1bf8331ffb
Blob jail: Add zstd-decompress, decompress more complex archives
Debian 12's initrd by default now consists of an uncompressed cpio
archive containing microcode, followed by a zstd-compressed cpio
archive.  inject_firmware.sh only supported gzip-compressed cpio, so it
could not extract /init from this archive.

Add zstd-decompress to decompress zstd streams (uncompressed size is
about 180 KB).

Add unpack_initramfs.sh which is able to decompress uncompressed, gzip,
or zstd archives, with multiple segments, much like the Linux kernel
itself does.

Use unpack_initramfs.sh to extract /init for blob jail.

Don't compress the new archive segment containing firmware and the
updated /init.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:50 -04:00
Jonathon Hall
6b111d813f
Add new board: Librem L1UM v2
Add Linux 6.1.8 configuration, used by Librem L1UM v2

Add coreboot configuration for Librem L1UM v2

Add Librem L1UM v2 board configuration

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:50 -04:00
Jonathon Hall
e9a5b27e6c
librem_mini,librem_mini_v2: Don't use three values for auto poweron
PureBoot doesn't have any other three-valued settings and this doesn't
present very well in the config UI.

Instead make this a two-valued setting; drop the mode that forces the
EC setting to "stay off" at every boot because this is the default.

When disabling automatic power-on, disable the EC BRAM setting too.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:49 -04:00
Jonathon Hall
2d3ecfa41e
librem_mini/librem_mini_v2: Add automatic power-on setting
Mini v1/v2's EC can automatically power on the system when power is
applied, based on a value in EC BRAM.  Add a configuration setting to
optionally set this value.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:47 -04:00
Jonathon Hall
6e0d241913
ioport: Add ioport module (inb, outb)
Add ioport module, enable for librem_mini_v2.  Only inb and outb are
included, inw/outw/inl/outl aren't needed.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:46 -04:00
Matt DeVillier
3766d32034
board/librem_{13/14/15/mini}: Use Purism repo for coreboot
Use Purism's repo for all Librem boards other than the Librem Server L1UM.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2023-06-21 13:26:41 -04:00
Kyle Rankin
efc49c7425
Add Root file hash feature
Currently Heads will check files in /boot for tampering before booting
into a system. It would be nice if you could use the trusted environment
within Heads and extend this to check files in / itself. This new script
adds that functionality, however due to the length of time it takes to
perform these kinds of checks, it doesn't run automatically (yet).

This feature can be configured from the config GUI - the root device/
directories to check can be set, and it can be configured to run during
boot.

To make this a bit easier to use, I added a feature to detect whether
the hash file exists and if not, to display a more limited menu to the
user guiding them to create the initial hash file. Otherwise it will
display the date the file was last modified, which can be useful to
determine how stale it is.
2023-06-21 13:26:37 -04:00
Thierry Laurion
9830c6c4ed
io386 platform lockdown: enable on sandy/ivy/haswell maximized board configs 2023-06-20 12:36:45 -04:00
Sergii Dmytruk
71b0f8dac9
boards/talos-2/talos-2.config: enable powerpc-utils
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2023-06-07 01:10:14 +03:00
Thierry Laurion
92cddb315f
boards/talos-2/talos-2.config : sda1 will never be a boot device
/dev/nvme0n1p2 expected to contain /boot/grub dir
2023-06-04 20:20:46 +03:00
tlaurion
3a38ac02e3
Merge pull request #1312 from tlaurion/coreboot-4.13_coreboot-4.19_version_bump
Bump boards depending on coreboot 4.13 to 4.19
2023-04-24 19:21:18 -04:00
tlaurion
e32fc91baf
Merge pull request #1358 from ThePlexus/p8z77-m_pro 2023-04-11 18:59:52 -04:00
ThePlexus
b64077fac6 Incorporate COREBOOT_DIr mod and VSCC optioanl setting 2023-04-10 13:43:54 +01:00
Thierry Laurion
a475ecef24
qemu-coreboot-*whiptail-tpm2-* boards: move TPM2 debug PCAP variable to debug section for clarity 2023-04-04 09:36:31 -04:00
ThePlexus
1761505d87 Autoboot not needed in this board 2023-03-31 17:37:02 +01:00
Krystian Hebel
9550d2b541
initrd/bin/talos-init: send IPL complete message to BMC
BMC awaits this message before it takes control over CPU fans speed.

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2023-03-30 21:04:01 +02:00
ThePlexus
c67cf7c47e Add ASUS P8Z77-M Pro board 2023-03-30 10:28:40 +01:00
tlaurion
2995376cda
Merge pull request #1339 from tlaurion/single_talos_2_board
Talos II - Have single board config
2023-03-20 14:46:38 -04:00
Thierry Laurion
718520fe5e
qemu-coreboot-whiptail-tpm2-hotp : add missing HOTP board requirements 2023-03-14 11:39:47 -04:00
Thierry Laurion
445ca053fb
Talos II - Have single board config
- Based on initial server board
- Uses whiptail as opposed to fbwhiptail (was slow and output fuzzy)
 - Simple fix to have dual KVM(BMC) and vga output for consoles

Reasoning for dropping fbwhiptail support is that:
- it is impossible to output framebuffer content through remote BMC console.
- A workstation board config could output to fbwhiptail for VGA and give remote recovery shell access through BMC
  - If someone shows interest for that, qemu-coreboot-tpm boards can be used as reference.
  - slowness/fuzzyness of fbwhiptail output through AST would still need to be fixed in kernel drivers. Not a priority here.

Limitation:
- Since whiptail is sent to both consoles:
 - If one console goes to recovery shell, recovery shell access invalidate TPM PCR4 measurements.
   - The other console won't be aware that TPM measurements were invalidated, and will consequently:
     - not be able to unseal TOTP if refreshed
     - not be able to unseal TPM disk unlock key on default boot
   - A reboot will fix this.
2023-03-13 14:33:03 -04:00
Jonathon Hall
30963e121f
Combine t430-flash.init, x23-flash.init, fix insmod
They're the same other than a TRACE, combine them.  Use busybox
insmod since the insmod script uses bash, we don't need the TPM PCRs on
legacy-flash-boards.

Remove PCR4 extend, these boards lack TPM configuration.  Update ROM
example name.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 13:23:29 -04:00
Jonathon Hall
50daa904f9
tpmr: Capture TPM2 pcaps in qemu TPM2 boards
tpm2-tools is able to log pcap files of TPM2 commands, which can be
inspected with wireshark.  Add CONFIG_TPM2_CAPTURE_PCAP to capture
these from the tpmr wrapper, and enable for qemu TPM2 boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:34:45 -05:00
Thierry Laurion
d549229bfc
modules/bash: enabled by default, disabled in legacy-flash boards
- legacy-flash boards have a single purpose: to flash BIOS region through flashrom.
  - They do not need bash nor have space for it in their 4mb defined coreboot CBFS region

Test build to have legacy boards builds under osresearch#1292
2023-03-08 12:45:52 -05:00
Jonathon Hall
c9df49ad20
modules/bash: Include bash in all builds, remove CONFIG_BASH
Include bash in all builds.  Remove CONFIG_BASH.

Remove CONFIG_BASH_IS_ASH from busybox configuration and clean up hacks
in modules/bash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:52 -05:00
Jonathon Hall
660a5fe71e
qemu-*: Add CONFIG_BASH=y to TPM1 boards
Enable bash on qemu TPM1 boards to use arrays in tpmr's TPM1 wrappers.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:50 -05:00