Commit Graph

1770 Commits

Author SHA1 Message Date
Jonathon Hall
d59ffe07b8
modules/bash: Disable readline, enable -Os
Disable readline features for interactive shell.  This significantly
reduces the size of bash and doesn't affect scripting features.  The
interactive shell still functions, but there is no history or command
line editing (backspace works, but arrows do not move cursor).

Enable -Os on bash for more size reduction.

This saves about 180KiB from the compressed initrd for
qemu-coreboot-fbwhiptail-tpm2-hotp, almost half the cost of adding
bash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:51 -05:00
Jonathon Hall
c98ae5b53d
recovery, passwd: Use /bin/sh for interactive shells
Use /bin/sh (ash in busybox builds) for interactive shells, not bash.
Preparation for trimming interactive features from bash to reduce size.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:51 -05:00
Jonathon Hall
7ab5e5c3e3
tpmr: Clean up TODOs about size parameter to tpm2_unseal
The size parameter is actually the size of the sealed secret to TPM1,
not the unsealed data size.  TPM2 does not observe the sealed secret,
so just ignore that parameter.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:51 -05:00
Jonathon Hall
0a38717e20
tpmr: Wrap TPM1 and TPM2 unseal actions so scripts can invoke either
Provide tpmr unseal to unseal a file with TPM1 or TPM2.  For TPM1, it
wraps tpm nv_readvalue and tpm unsealfile.  For TPM2, it wraps tpm2
unseal.

kexec-unseal-key, seal-hotpkey, unseal-hotp, and unseal-totp no longer
need to differentiate TPM1/TPM2.

Fixes spurious shred errors on TPM2 that only apply to TPM1 (temporary
sealed secret file and shred are now internal to tpmr).

Fixes TPM1 disk unlock key unsealing due to logic errors relating to
exit status of tpmr unseal or tpm unsealfile (now always uses status of
tpmr unseal).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:50 -05:00
Jonathon Hall
660a5fe71e
qemu-*: Add CONFIG_BASH=y to TPM1 boards
Enable bash on qemu TPM1 boards to use arrays in tpmr's TPM1 wrappers.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:50 -05:00
Jonathon Hall
55e5a41eca
tpmr: Add kexec_finalize command to finalize TPM before boot
TPM2 locks the platform heirarchy, flushes transient objects, and
flushes sessions.  (This now cleans up sessions created during
startsession that previously were not cleaned up, although the OS might
flush all sessions as well.)

TPM1 currently does not do anything, but the command is accepted so
kexec-boot does not need to differentiate TPM1/2.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:49 -05:00
Jonathon Hall
f324b72be6
tpmr: Seal/unseal using sha256 of password
TPM2 is only required to support password lengths up to its longest
hash size (32 chars for sha256).  Pass the sha256 of the password
instead of the actual password so the password can be arbitrarily long.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:49 -05:00
Jonathon Hall
6efabeb520
tpmr: Set flags properly on sealed file
Set flags 'fixedtpm|fixedparent|adminwithpolicy'.  Plain password auth
is no longer allowed.  For objects sealed with a password, the password
is part of the auth policy, so both PCRs and password must be satisfied
to unseal.

Tested by manually attempting to unseal disk unlock key with password:
    tpm2 unseal -c 0x81000003 -p "<password>"

This now correctly returns an error indicating this auth method is not
allowed.

Relative to the documented default flags for tpm2_create:

* sign, decrypt: Not applicable to a sealed object, tpm2_create
  automatically removed these from the defaults.
* fixedtpm, fixedparent: Kept
* sensitivedataorigin: Not applicable an object where the sensitive
  data is not generated by the TPM.
* userwithauth: Removed this, "user" actions must satisfy auth policy.
* adminwithpolicy: Added this, "admin" actions must satisfy auth
  policy.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:49 -05:00
Jonathon Hall
bc736450cb
kexec-select-boot: For debug inspection, drop to recovery
After saving a disk unlock key, if debug output is enabled, drop to
a recovery shell to allow inspection of debug output.

The script isn't intended to return from this point after sealing a
key - returning attempts to boot, which can't unseal the key.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:48 -05:00
Jonathon Hall
8bf5415e79
tpmr: Add seal/unseal debug tracing
Trace parameters to seal/unseal and some key tpm2 invocations.  Trace
invocation of tpmr seal/unseal for disk unlock key.

Add DO_WITH_DEBUG() to trace a command and parameters, then execute it.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:48 -05:00
Jonathon Hall
e6acaad215
tpmr: Fix sealing/unsealing file with both PCRs and passwords
When sealing/unsealing with a password, use a policy including both the
specified PCRs and the object password.  Fixes sealing and unsealing
disk unlock key.

tpm2 seems to have a bug in parameter decryption when using a policy
session and password in this way, disable encryption in the policy
session as a workaround.

Flags still need to be set on the sealed object correctly, as the
password is normally allowed on its own as an alternative to policy
auth.

Add -Q to some tpm2 invocations to silence diagnostics on stdout.

Pass filename for unsealed secret rather than capturing from stdout
for robustness against tpm2 diagnostics on stdout.

Fix unseal result check in kexec-unseal-key.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:48 -05:00
Thierry Laurion
1e5544b934
Add DEBUG traces and have TPM2 boards enable TRACE and DEBUG calls
- /tmp/debug.log is created and appended by all TRACE and DEBUG calls in code
- fix some logic errors seen when no DEBUG entry were outputted in /tmp/debug.log
2023-03-08 12:45:47 -05:00
Jonathon Hall
79e10ee135
kexec-unseal-key, tpmr: Deduplicate TPM1/2 code and always use stdin pass
Always send password via stdin to tpm2 create, tpm2 unseal.  The password
could being with things like 'file:', 'str:', 'pcr:' that would be
interpreted by tpm2.

Deduplicate the TPM1/2 code in kexec-unseal-key.  The TPM2 code was not
actually prompting for the password or sending it to tpmr unseal.

Password is still not working yet though.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:47 -05:00
Jonathon Hall
2c6caa18a7
kexec-(un)seal-key: Delete CONFIG_AUTO_UNLOCK logic
CONFIG_AUTO_UNLOCK does not exist in Heads.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:47 -05:00
Jonathon Hall
b500505312
tpm2-tools: Change sense of CONFIG_TPM to mean any TPM, not just TPM1.
Most logic throughout Heads doesn't need to know TPM1 versus TPM2 (and
shouldn't, the differences should be localized).  Some checks were
incorrect and are fixed by this change.  Most checks are now unchanged
relative to master.

There are not that many places outside of tpmr that need to
differentiate TPM1 and TPM2.  Some of those are duplicate code that
should be consolidated (seal-hotpkey, unseal-totp, unseal-hotp), and
some more are probably good candidates for abstracting in tpmr so the
business logic doesn't have to know TPM1 vs. TPM2.

Previously, CONFIG_TPM could be variously 'y', 'n', or empty.  Now it
is always 'y' or 'n', and 'y' means "any TPM".  Board configs are
unchanged, setting CONFIG_TPM2_TOOLS=y implies CONFIG_TPM=y so this
doesn't have to be duplicated and can't be mistakenly mismatched.

There were a few checks for CONFIG_TPM = n that only coincidentally
worked for TPM2 because CONFIG_TPM was empty (not 'n').  This test is
now OK, but the checks were also cleaned up to '!= "y"' for robustness.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:46 -05:00
Jonathon Hall
d51993b6a9
tpm-reset: Reduce duplication with tpmr reset
Use common password prompt logic in tpm-reset rather than duplicating
in tpmr reset.

Use common logic in config-gui.sh to reset the TPM.

Use common logic in oem-factory-reset to reset TPM.  Fixes extra
prompts for TPM2 owner password even when choosing to use a common
password.  Fix sense of "NO TPM" check in TOTP generation (which only
happened to work because CONFIG_TPM is empty for TPM2).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:46 -05:00
Jonathon Hall
ab57cd0b9a
tpmr: Fix wording of owner password prompt in tpm2_sealfile()
It's asking for the existing password, not a new password.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:46 -05:00
Jonathon Hall
cf3ee19795
seal-hotpkey: Fix quoting in CONFIG_TPM test
$CONFIG_TPM needs to be quoted, or [ syntax is incorrect when it's
empty.  Fixes errors in console with TPM2 (but behavior was correct due
to [ still returning false as expected).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:45 -05:00
Jonathon Hall
55a41c3fdb
kexec-save-default: Always update TPM2 primary object handle hash
Resetting the TPM creates a new primary object, and there is no reason
for kexec-save-default to sign an old hash.  Always update the hash
instead of creating it only if it doesn't exist.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:45 -05:00
Jonathon Hall
ff8ec2fd5b
qemu*tpm2*: Manufacture TPM2
Invoke swtpm_setup --create-config-files skip-if-exist to create local
CA files under the current user account, so user does not need
read/write access to /var/lib/swtpm-localca.

Pass --tpm2 to manufacture a TPM2 instead of TPM1.2.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:45 -05:00
Jonathon Hall
7ea606524b
gui-init: Remove TPM2 primary handle hash when resetting TPM
Resetting the TPM invalidates the primary handle hash, and
kexec-save-default only generates a hash if none exists.  Remove the
hash file when it is invalidated.

OEM reset and "Reset Configuration" both already remove all kexec
files.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:44 -05:00
Jonathon Hall
4e375ad7ca
tpm2-tools: Remove curl dependency
The actual use of curl was already removed, update tpm2-tools patch to
also remove the check for curl.  Remove the curl module and
CONFIG_CURL.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:44 -05:00
Thierry Laurion
8da5d5d723
Add dual support for real bash and busybox's bash(ash)
- modify bash to have it configured with -Os
2023-03-08 12:45:44 -05:00
Thierry Laurion
6923fb5e20
Addition of qemu-(fb)whiptail-tpm2(-hotp) boards
-coreboot support of TPM v2.0 (shared config for TPM2 support across all 4 previous variations)
-swtpm set to be launched under TPM v2.0 mode under board config
-Documentation file under each board.md softlinks to qemu-coreboot-fbwhiptail-tpm1.md (which has been generalized)
This is skeleton for TPM v2 integration under Heads

-------------
WiP

TODO:
- libcurl cannot be built as a tpm2-tools dependency as of now not sure why. curl currently needs to be added in board config to be built
- Note: tpm-reset (master and here) needs some review, no handle of no tpm use case. Caller is responsible to not call it otherwise does nothing
- init tries to bind fd and fails currently
- Note: Check if whiptail is different of fbwhiptail in clearing screen. As of now every clear seems to be removed, still whiptail clears previous console output
- When no OS' /boot can be mounted, do not try to TPM reset (will fail)

- seal-hotpkey is not working properly
- setting disk unlock key asks for TPM ownership passphrase (sealing in NV requires ownership, but text is misleading user as if reowning TPM)
  - We should cache input, feed tpm behind the scene and wipe passphrase and state clearly that this is TPM disk unlock kye passphrase.
- primary key from TPM2 is invalid most of the time from kexec-select-boot and verifying global hashes but is setuped correctly at disk unlock key setup
- would be nice to take advantage of bash function tracing to understand where we are for debugging purposes, code takes ash in consideration only
- tpmr says it implements nv calls but actually doesn't. Removing those falsely wrapped functions would help.
  - Implementing them would be better
- REVIEW TODOS IN CODE
- READD CIRCLECI CONFIG

Current state:
- TPM unseal works without disk unlock key and generates TOTP properly (was missing die condition at unseal to not produce always good TOTP even if invalid)
- TPM disk encryption key fails. Hypothesis is that sealing with USB drivers loaded and measures in inconsistent with sealed with/without.
 - TPM disk unsealing happens without USB modules being loaded in non-HOTP setup. This fails.

- Current tests are with fbwhiptail (no clear called so having traces on command line of what happens)
 - Testing with HOTP implementation for sealing/unsealing since that forces USB module loads on each boot to remove this from failing possibilities
2023-03-08 12:45:43 -05:00
tlaurion
b2dcebb50a
Merge pull request #1121 from tlaurion/pass_O2_to_Os 2023-03-08 08:37:59 -05:00
Thierry Laurion
907e906f01
Pass -O3 and -O2 (optimize for speed) to -Os (Optimize for space)
Adresses @easrentai suggestion to pass modules build optimization for space here: #590 (comment)

- Uniformized module's $(CROSS_TOOLS) being passed as environment variable, prior of ./configure call

Doesn't work for:
- busybox (HOSTCXXFLAGS="-Os" attempted prior of ./configure call)
- zlib (CFLAGS="-Os" attempted prior of ./configure call)
- npth (CFLAGS="-Os" attempted prior of ./configure call)
2023-03-07 18:05:39 -05:00
tlaurion
15e9d0b6f3
Merge pull request #1330 from tlaurion/coreboot_do_not_rebuild_builstack_at_each_make
modules/coreboot: do not rebuild version specific coreboot's builstack at each board's make
2023-03-07 16:07:09 -05:00
Thierry Laurion
47bd80a0ec
modules/coreboot: Do not rebuild coreboot buildstack when built
.xcompile was not found because it was quoted and shouldn't in coreboot module's makefile

Prior:
    stat("\"/home/user/heads/build/x86/coreboot-4.13/.xcompile\"", 0x7ffe56e6cfd0) = -1 ENOENT (No such file or directory)
    pipe([3, 4])                            = 0
    fcntl(4, F_GETFD)                       = 0
    fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
    fcntl(3, F_GETFD)                       = 0
    fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
    prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=1024*1024}) = 0
    prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=1024*1024}) = 0
    stat("/usr/bin/env", {st_mode=S_IFREG|0755, st_size=48480, ...}) = 0
    geteuid()                               = 1000
    getegid()                               = 1000
    getuid()                                = 1000
    getgid()                                = 1000
    access("/usr/bin/env", X_OK)            = 0
    mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7ce2be6fd000
    rt_sigprocmask(SIG_BLOCK, ~[], [CHLD], 8) = 0
    clone(child_stack=0x7ce2be705ff0, flags=CLONE_VM|CLONE_VFORK|SIGCHLD) = 305342
    munmap(0x7ce2be6fd000, 36864)           = 0
    rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0
    close(4)                                = 0
    read(3, "2\n", 200)                     = 2
    read(3, "", 198)                        = 0
    close(3)                                = 0
    wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 305342
    fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0), ...}) = 0
    write(1, "make -C \"/home/user/heads/build/"..., 74make -C "/home/user/heads/build/x86/coreboot-4.13" CPUS=2 "crossgcc-i386"
    ) = 74
    rt_sigprocmask(SIG_BLOCK, [HUP INT QUIT TERM XCPU XFSZ], NULL, 8) = 0
    stat("/usr/bin/env", {st_mode=S_IFREG|0755, st_size=48480, ...}) = 0
    geteuid()                               = 1000
    getegid()                               = 1000
    getuid()                                = 1000
    getgid()                                = 1000
    access("/usr/bin/env", X_OK)            = 0
    mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7ce2be6fd000
    rt_sigprocmask(SIG_BLOCK, ~[], [HUP INT QUIT TERM CHLD XCPU XFSZ], 8) = 0
    clone(child_stack=0x7ce2be705ff0, flags=CLONE_VM|CLONE_VFORK|SIGCHLD) = 305343
    munmap(0x7ce2be6fd000, 36864)           = 0
    rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT TERM CHLD XCPU XFSZ], NULL, 8) = 0
    rt_sigprocmask(SIG_UNBLOCK, [HUP INT QUIT TERM XCPU XFSZ], NULL, 8) = 0
    wait4(-1, make[1]: Entering directory '/home/user/heads/build/x86/coreboot-4.13'
    Welcome to the coreboot cross toolchain builder v ()

    Building toolchain using 2 thread(s).

    Target architecture is i386-elf

    Found compatible Ada compiler, enabling Ada support by default.

    Downloading and verifying tarballs ...
     * gmp-6.2.0.tar.xz (cached)... hash verified (052a5411dc74054240eec58132d2cf41211d0ff6)
     * mpfr-4.1.0.tar.xz (cached)... hash verified (159c3a58705662bfde4dc93f2617f3660855ead6)
     * mpc-1.2.0.tar.gz (cached)... hash verified (0abdc94acab0c9bfdaa391347cdfd7bbdb1cf017)
     * binutils-2.35.tar.xz (cached)... hash verified (6bdd090ce268b6d6c3442516021c4e4b5019e303)
     * gcc-8.3.0.tar.xz (cached)... hash verified (c27f4499dd263fe4fb01bcc5565917f3698583b2)
    Downloaded tarballs ... ok
    Unpacking and patching ...
     * gmp-6.2.0.tar.xz
       o gmp-6.2.0_generic-build.patch
     * mpfr-4.1.0.tar.xz
    ^C0x7ffe56e6ef40, 0, NULL)      = ? ERESTARTSYS (To be restarted if SA_RESTART is set)
    strace: Process 305153 detached

After:
    stat("/home/user/heads/build/x86/coreboot-4.13/.xcompile", 0x7ffd0303c7f0) = -1 ENOENT (No such file or directory)
    pipe([3, 4])                            = 0
    fcntl(4, F_GETFD)                       = 0
    fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
    fcntl(3, F_GETFD)                       = 0
    fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
    prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=1024*1024}) = 0
    prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=1024*1024}) = 0
    stat("/usr/bin/env", {st_mode=S_IFREG|0755, st_size=48480, ...}) = 0
    geteuid()                               = 1000
    getegid()                               = 1000
    getuid()                                = 1000
    getgid()                                = 1000
    access("/usr/bin/env", X_OK)            = 0
    mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x740f6e370000
    rt_sigprocmask(SIG_BLOCK, ~[], [CHLD], 8) = 0
    clone(child_stack=0x740f6e378ff0, flags=CLONE_VM|CLONE_VFORK|SIGCHLD) = 306024
    munmap(0x740f6e370000, 36864)           = 0
    rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0
    close(4)                                = 0
    read(3, "2\n", 200)                     = 2
    read(3, "", 198)                        = 0
    close(3)                                = 0
    wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 306024
    fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0), ...}) = 0
    write(1, "make -C \"/home/user/heads/build/"..., 74make -C "/home/user/heads/build/x86/coreboot-4.13" CPUS=2 "crossgcc-i386"
    ) = 74
    rt_sigprocmask(SIG_BLOCK, [HUP INT QUIT TERM XCPU XFSZ], NULL, 8) = 0
    stat("/usr/bin/env", {st_mode=S_IFREG|0755, st_size=48480, ...}) = 0
    geteuid()                               = 1000
    getegid()                               = 1000
    getuid()                                = 1000
    getgid()                                = 1000
    access("/usr/bin/env", X_OK)            = 0
    mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x740f6e370000
    rt_sigprocmask(SIG_BLOCK, ~[], [HUP INT QUIT TERM CHLD XCPU XFSZ], 8) = 0
    clone(child_stack=0x740f6e378ff0, flags=CLONE_VM|CLONE_VFORK|SIGCHLD) = 306025
    munmap(0x740f6e370000, 36864)           = 0
    rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT TERM CHLD XCPU XFSZ], NULL, 8) = 0
    rt_sigprocmask(SIG_UNBLOCK, [HUP INT QUIT TERM XCPU XFSZ], NULL, 8) = 0
    wait4(-1, make[1]: Entering directory '/home/user/heads/build/x86/coreboot-4.13'
    Welcome to the coreboot cross toolchain builder v ()

    Building toolchain using 2 thread(s).

    Target architecture is i386-elf

    Found compatible Ada compiler, enabling Ada support by default.

    Downloading and verifying tarballs ...
     * gmp-6.2.0.tar.xz (cached)... hash verified (052a5411dc74054240eec58132d2cf41211d0ff6)
     * mpfr-4.1.0.tar.xz (cached)... hash verified (159c3a58705662bfde4dc93f2617f3660855ead6)
     * mpc-1.2.0.tar.gz (cached)... hash verified (0abdc94acab0c9bfdaa391347cdfd7bbdb1cf017)
     * binutils-2.35.tar.xz (cached)... hash verified (6bdd090ce268b6d6c3442516021c4e4b5019e303)
     * gcc-8.3.0.tar.xz (cached)... hash verified (c27f4499dd263fe4fb01bcc5565917f3698583b2)
    Downloaded tarballs ... ok
    Unpacking and patching ...
     * mpfr-4.1.0.tar.xz
     * mpc-1.2.0.tar.gz
     * binutils-2.35.tar.xz
    ^C0x7ffd0303e760, 0, NULL)      = ? ERESTARTSYS (To be restarted if SA_RESTART is set)
    strace: Process 305835 detached

So coreboot buildstack is built once per version and then reused on next board builds.
Saves precious CI and local builds when developing with qemu/kvm.
2023-03-07 15:38:44 -05:00
tlaurion
96a20a7456
Merge pull request #1329 from tlaurion/repro_fix-util-linux
Fix util-linux reproducibility issue (libblkid.so.1)
2023-03-07 11:17:14 -05:00
Thierry Laurion
c323fb4d8b
patches/util-linux: patch configure script so that all hardcode_into_libs=yes -> hardcode_into_libs=no 2023-03-07 11:02:17 -05:00
tlaurion
3ac896bb67
Merge pull request #1282 from rbreslow/rb/support-t440p 2023-02-28 15:23:16 -05:00
Rocky Breslow
1dd9c266a8
CircleCI: Make the T440p depend on Librem boards
This change will improve build times by allowing the T440p to share the
Coreboot 4.17 cache with the Librem boards. Once we update the other
ThinkPad boards to use Coreboot 4.19, we'll make the T440p depend on the
X230 again.

Co-authored-by: Thierry Laurion <insurgo@riseup.net>
2023-02-28 14:14:56 -05:00
Rocky Breslow
e4a09e81bb
Add T440p blobs documentation 2023-02-28 11:58:34 -05:00
Rocky Breslow
63eab714e5
Make T440p scripts work with relative paths
Because we're using pushd/popd to make the Coreboot util invocation
cleaner, we need to use realpath so that the scripts will work with any
user input.
2023-02-28 11:58:29 -05:00
Rocky Breslow
3efec15dc7
CircleCI: Install crosfirmware.sh dependencies
We need extra dependencies to support Coreboot's util/crosfirmware.sh to
extract the T440p's mrc.bin.
2023-02-25 21:28:29 -05:00
Rocky Breslow
5083ba356c
Add the T440p to CircleCI 2023-02-25 19:53:48 -05:00
Rocky Breslow
1dc5d4eb99
Make T440p Coreboot build depend on blob files
Now, when you run `make BOARD=any-t440p-variant`, the build system
automatically fetches mrc.bin and me.bin.
2023-02-25 19:53:47 -05:00
Rocky Breslow
144f9c147e
Make T440p scripts use Coreboot from environment
Before, the T440p blob scripts would look for Coreboot using the find
command. Now, we require the user to specify the path to Coreboot in the
COREBOOT_DIR environment variable. Also, add an output directory
argument to each script.

These changes will make it easier to integrate with the Heads build
system and CI.
2023-02-25 19:53:47 -05:00
Rocky Breslow
e6c34bda55
Add T440p gbe.bin blob
- I extracted the gbe.bin blob from my T440p's original ROM using the
  blobs/t440p/extract script.
- Using a hex editor, I corrected the sign bit in part 0 that I found
  was malformed in my analysis:
  https://github.com/osresearch/heads/pull/1282#issuecomment-1400634600.
- After correcting the sign bit, nvmutil showed that both parts of my
  gbe.bin blob had valid checksums.
- Finally, I used nvmutil to set the MAC address to 00🇩🇪ad:c0:ff:ee.
2023-02-25 19:53:47 -05:00
Rocky Breslow
7c32d4ed66
Add T440p ifd.bin blob
I extracted the ifd.bin blob from my T440p using the blobs/t440p/extract
script.
2023-02-25 19:53:46 -05:00
Rocky Breslow
936840415c
Rename T440p export-blobs script to extract
More aligned with the naming conventions of xx20 and xx30's extract.sh.
2023-02-25 19:53:46 -05:00
tlaurion
c4b964c80f
Merge pull request #1318 from JonathonHall-Purism/fix-pkg-config-cross-compilation
Makefile: Fix cross compilation variables for pkg-config
2023-02-22 11:46:36 -05:00
Jonathon Hall
7592efcf99
Makefile: Fix cross compilation variables for pkg-config
pkg-config will still pick up system default directories from
PKG_CONFIG_LIBDIR even if PKG_CONFIG_PATH is set.  Per the docs,
cross compilation requires clearing PKG_CONFIG_PATH and setting
PKG_CONFIG_LIBDIR (which is always searched after PKG_CONFIG_PATH).

Fixes issues observed in tpm2_retry branch picking up packages from
host environment.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-02-21 13:46:03 -05:00
tlaurion
5c7148f18d
Merge pull request #1305 from echo-84/yubikey-oem-factory-reset 2023-02-21 12:06:35 -05:00
tlaurion
8b479b06cc
Merge pull request #1317 from tlaurion/fix-sh_argument_expected
Add DEBUG statements in code and fix "sh: argument expected"
2023-02-20 14:11:27 -05:00
Thierry Laurion
8259d3ca1e
Add TRACE function tracing function to output on console when enabled
- Add TRACE function tracing output under etc/functions, depending on CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT enabled in board configs
- Replace current DEBUG to TRACE calls in code, reserving DEBUG calls for more verbose debugging later on (output of variables etc)
- add 'export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y' in qemu-coreboot(fb)whiptail-tpm1(-hotp) boards to see it in action
2023-02-20 11:44:52 -05:00
Thierry Laurion
5fbbbbc3f7
gui-init: fix sh: argument expected 2023-02-18 21:52:54 -05:00
Thierry Laurion
5bc2bc88e4
All scripts and functions: Add DEBUG calling trace on console when CONFIG_DEBUG_OUTPUT is exported in board config
-qemu-coreboot-*whiptail-tpm1(-hotp) boards have 'export CONFIG_DEBUG_OUTPUT=y' by default now
2023-02-18 21:52:44 -05:00
tlaurion
9676c794a2
Merge pull request #1315 from tlaurion/qemu-coreboot-tpm_typo-fix
Fix reported typo under #1314
2023-02-17 14:42:35 -05:00
Thierry Laurion
16321dc40a
Fix reported typo under #1314 2023-02-17 14:41:16 -05:00