Commit Graph

317 Commits

Author SHA1 Message Date
Thierry Laurion
e4976e7882
Re-add kgpe-d16 as UNMAINTAINED_* boards, still built by CircleCI (since cosntant interest in the builds)
Modify .circleci/config.yml to also not reuse past caches if CircleCI config changes as part of calculated hashes for the 3 layers
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-05-08 15:36:27 -04:00
Thierry Laurion
89a0c103ae
QEMU/KVM board configs: logical reorganization of requirements for board configs. Next step is creating fbwhiptail/whiptail/tpm1/tpm2 mk files and include them in all boards
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-04-19 15:52:50 -04:00
Thierry Laurion
9fcd5f8fe4
Move boards/UNTESTED_* boards to untested_boards/UNMAINTAINED_*, remove them from CircleCI, add Makefile helper and document untested_boards/README.md
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-03-25 16:05:57 -04:00
Thierry Laurion
fb616f416a
WiP 4.22.01 fhd patch test + bump all 4.19 boards to 4.22.01
- patches/coreboot-4.22.01/0001-x230-fhd-variant.patch created per
  - git fetch https://review.coreboot.org/coreboot refs/changes/50/28950/23 && git format-patch -1 --stdout FETCH_HEAD > ~/heads/patches/coreboot-4.22.01/0001-x230-fhd-variant.patch
- all boards configs bumped with:
  - grep -Rn 4.22 boards/ | awk -F "/" {'print $2'}| while read line; do make BOARD=$line coreboot.save_in_oldconfig_format_in_place ; done

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-03-25 15:14:42 -04:00
Jonathon Hall
65f0b905f6
boards/librem*, config/linux-librem*: Enable mobile tethering
Enable mobile tethering on all Librem boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2024-02-22 12:35:41 -05:00
Thierry Laurion
9b69f1b66a
boards/x230-hotp-maximized_usb-kb/x230-hotp-maximized_usb-kb.config: unify with x230-hotp-maximized
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-02-21 13:50:28 -05:00
Thierry Laurion
7cbcdd8ed7
Tethering refresh for CDC NCM/CDC EEM mobile phones (tested on GrapheneOS Pixel 6a, no more RNDIS support)
- Add additional requirements to linux config
- Add additional CONFIG_MOBILE_TETHERING=y to all maximized board configs
- Fix issue under network-recovery-init to NTP sync against NTP server pool
- Extend network-recovery-init to first try NTP sync against DNS server returned by DHCP answer
- Remove network-recovery-init earlytty and tty0 redirection (console should be setuped properly by init in all cases)
- If CONFIG_MOBILE_TETHERING=y added to board config and network-recovery-init called, wait to user input on instructions and warning 30 secs before proceeding (non-blocking)
- Machines having STATIC_IP under board config won't benefit of autoatic NTP sync

Since network-recovery-init can only be called from recovery shell now, and recovery shell can be guarded by GPG auth, this is PoC code to be used to complement TOTP being out of sync

TODO(Future PR):
- Refactor into functions and reuse into TOTP/HOTP being out of sync automatically.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-02-21 13:50:18 -05:00
Jonathon Hall
0a823cb491
Allow laptops to include optional USB keyboard support
Laptops can include optional USB keyboard support (default off unless
the board also sets the default to 'y').  The setting is in the
configuration GUI.

CONFIG_USER_USB_KEYBOARD is now the user-controlled setting on those
boards.  'CONFIG_USB_KEYBOARD' is no longer used to avoid any conflict
with prior releases that expect this to be a compile-time setting only
(conflicts risk total lock out requiring hardware flash, so some
caution is justified IMO).

Boards previously exporting CONFIG_USB_KEYBOARD now export
CONFIG_USB_KEYBOARD_REQUIRED.  Those boards don't have built-in
keyboards, USB keyboard is always enabled. (librem_mini,
librem_mini_v2, librem_11, librem_l1um, librem_l1um_v2, talos-2,
kgpe-d16_workstation-usb_keyboard, x230-hotp-maximized_usb-kb).

Librem laptops now export CONFIG_SUPPORT_USB_KEYBOARD to enable
optional support.  The default is still 'off'.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2024-01-10 15:38:06 -05:00
Thierry Laurion
a2ebf251e0
hotp boards: enable autoboot after 5 seconds if reverse HOTP against USB Security Dongle is successful by default
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-09 15:06:04 -05:00
Thierry Laurion
77f9933538
xx20/xx30 blob based boards: move ME blobs target outside of board configs (targets/xx*_blobs.mk)
Makefile: have inclusion of all defined $BOARD BOARD_TARGETS (me, split_8mb4mb, ...)

TODO: VBIOS scripts for W530/T530 need way more work. To be done later.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 15:32:09 -05:00
Thierry Laurion
197914b396
xx20 boards and circleci: Have boards download extract and neuter me by board config
Fix https://github.com/linuxboot/heads/issues/1569 part of error linked to me not being available in blobs/xx20/me.bin

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 14:21:08 -05:00
Thierry Laurion
0d6cba852b
w530-dgpu K2000 boards : have the boards call vbios download script automatically. Breaks on debian-12 as of now but should work on debian-11 for others, gems say deprecated calls....
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 14:21:03 -05:00
Thierry Laurion
1fea3e4463
t530-dgpu boards : have the boards call vbios download script automatically. Breaks on debian-12 as of now but should work on debian-11 for others, gems say deprecated calls....
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 14:21:01 -05:00
Thierry Laurion
43d1b4ed81
xx30: have all xx30 download me automatically.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-04 14:21:00 -05:00
Thierry Laurion
718a831481
Board configs: move t420-hotp-maximized t420-maximized w530-maximized w530-hotp-maximized away from UNTESTED_ boards
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-30 13:36:28 -05:00
Jonathon Hall
ab97b242b4
Merge remote-tracking branch 'github-heads/master' into site-local-config 2023-12-19 14:14:25 -05:00
Thierry Laurion
61843d890b
Unify upstream board config defaults
- Upstream boards will not deactivate TPM DUK
- Upstream will not force BRAND_NAME which currently defaults to Heads
- Upstream will not deactivate Qr code on screen output on HOTP sealing
- Upstream will not offer OEM reset defaults (deprecated and now default anyway)

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-19 13:05:46 -05:00
Jonathon Hall
12a099ad8e
talos-2: Move PPC-style tgz update package targets to targets/
Move the targets generating talos-2's tgz update package to targets.

While this wasn't duplicated, it breaks a cyclic dependency between
board config and BRAND_NAME by moving the ROM output name dependencies
later.  The logic probably would be shared with similar boards if any
were supported, so it is in the spirit of the other targets/ shared
target Makefiles.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:52 -05:00
Jonathon Hall
8ce9c9d438
*-legacy-flash: Deduplicate generation of "top" ROM
Move Makefile target for the "top" ROM to targets/legacy_flash.mk.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:52 -05:00
Jonathon Hall
d512cd4ad2
12MB boards: Deduplicate generation of 8MB/4MB split ROMs
Move Makefile targets for split ROMs to targets/split_8mb4mb.mk.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:52 -05:00
Jonathon Hall
c8e114166c
qemu: Deduplicate Qemu targets/documentation, extract from boards
The 8 qemu-* targets all contained nearly-identical copies of the
targets to prepare the TPM/disk/etc. and then run Qemu.  The only
significant differences were for TPM1/TPM2 (extra swtpm_setup step,
addition of --tpm2 to swtpm_setup and swtpm).  ROOT_DISK_IMG used := or
= differently in some boards, := was kept.

targets/qemu.mk now defines all Qemu targets and is included only for
qemu-* boards (by defining BOARD_TARGETS in each of those boards).

The documentation was moved from qemu-coreboot-fbwhiptail-tpm1-hotp/
qemu-coreboot-fbwhiptail-tpm1-htop.md to targets/qemu.md.  The other 7
qemu boards' symlinks to that file were removed.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-12-18 16:49:10 -05:00
Thierry Laurion
b8a06c5351
Librems/Nitropad: enable QR code printed on screen at TOTP/HOTP Generation
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-16 13:15:14 -05:00
Thierry Laurion
d8f098cd53
All board configs: first line now BRAND_NAME=Heads to ease rebranding with sed scripts for downstream projects/forks
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-16 12:56:58 -05:00
Thierry Laurion
bac35e3b3e
Librems/Nitropad: enable TPM DUK under Heads branding (CONFIG_TPM_NO_LUKS_DISK_UNLOCK=n)
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-16 12:52:19 -05:00
tlaurion
4a57c615e9
Merge pull request #1522 from tlaurion/efifb_next_step_related_cleanups
WiP: FB_EFI (EFIFB kernel module's framebuffer on top of libgfxinit or GOP) next steps related cleanups
2023-12-12 13:04:58 -05:00
Thierry Laurion
e0fabb1534
NV41: adapt board config to remove CONFIG_BOOT_KERNEL_ADD=intel_iommu=igfx_off equally as for NS50 under 2fcef4a979 and tested for NS50 at https://github.com/linuxboot/heads/pull/1522#issuecomment-1822489517
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-12 11:33:43 -05:00
Thierry Laurion
0dbbae5dbc
Move t530, p8z77 and t420 boards to be prefixed with UNTESTED as per https://github.com/linuxboot/heads/pull/1522#issuecomment-1850734068. Note that w530 was already marked as UNTESTED, look for commit having moved this board as untested.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-11 16:07:01 -05:00
tlaurion
9afe235a6b
Update qemu-coreboot-fbwhiptail-tpm1-hotp.md
Add bookworm swtpm installation instructions
2023-11-26 11:58:49 -05:00
Thierry Laurion
664603cf8c
Changeset based on nitrokey 2.3 release to understand what is attempted here. i915 is still under linux config on 2.3 release. coreboot is on gop, not libgfxinit. This is to open discussion.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-20 11:17:38 -05:00
Thierry Laurion
0e42833ada
x230-legacy-flash board: fixup pointing to x230 as opposed to t430. Fix coreboot config path to bootsplash
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-20 09:42:28 -05:00
Thierry Laurion
2fcef4a979
FB_EFI next step: remove CONFIG_BOOT_KERNEL_ADD=intel_iommu=on intel_iommu=igfx_off, add CONFIG_BOOT_KERNEL_REMOVE=intel_iommu=on intel_iommu=igfx_off, remove quiet removal from CONFIG_BOOT_KERNEL_REMOVE. TLDR: do not interfere with OS setting its own boot policies
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-20 09:40:39 -05:00
JonathonHall-Purism
f5377b3bd5
Merge pull request #1526 from JonathonHall-Purism/zip_updates
flash-gui.sh: Extend NPF archive format to ZIP, improve workflow
2023-11-17 10:21:44 -05:00
Thierry Laurion
56d38e112c
Talos-2 fixes to comply with hashing file standard. Bypass flash-gui.sh prompt when talos-2 ato validate hashes against hashes provided under tgz through flash.sh validation (still offer zip and tgz, which tgz might change to zip later but only tgz offered through builds)
Attempt to address https://github.com/linuxboot/heads/pull/1526#issuecomment-1811185197

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-16 08:44:39 -05:00
Jonathon Hall
bb7294476d
Makefile: Don't generate update package for legacy flash boards
The only purpose of legacy flash boards is to be flashed over vendor
firmware using an exploit, to then flash non-maximized Heads firmware.

They are never upgraded to another legacy flash build, and they move
the coreboot ROM from the build directory, so don't build an update
package for those boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-11-14 12:14:18 -05:00
tlaurion
133da0e48e
Merge pull request #1515 from tlaurion/inmemory_keygen-gpg_backup_usable_for_RSA_only-copy_to_card_working_for_RSA_only-gpg_auth_for_recovery_and_sub_boot
GPG User Authentication: In-memory gpg keygen + keytocard and GPG key material backup enabling  (plus a lot of code cleanup and UX improvements)
2023-11-13 16:05:26 -05:00
Thierry Laurion
9e0491e9db
oem-factory-reset/librem boards: remove CONFIG_OEMRESET_OFFER_DEFAULTS=y and checks for it; the default of oem-factory-reset is now to propose user to use defaults first for simplicity of most common use case without allianating advanced users which can simply not accept the default and answer questionnaire
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-06 11:27:51 -05:00
Thierry Laurion
f5dc5ef5cd
qemu boards: Put back DEBUG and TRACE on
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:08:35 -04:00
Thierry Laurion
a3086e9a1c
Remove TODO in code that were not relevant prior of first review
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:08:19 -04:00
Thierry Laurion
56b602974b
WiP: NK3 with p256 ECC algo supported for in-memory keygen and key-to-card op. With this commit, one can provision NK3 with thumb drive backup which enables authenticated recovery shell and USB boot.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:40 -04:00
Thierry Laurion
2b21623bc6
qemu doc: add modify list/mount instructions to use losetup to map partitions to loop0pX and mount them to get public key
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:37 -04:00
Thierry Laurion
27c457f04b
TPM2 DUK and TOTP/HOTP reseal fix, refactoring and ifferenciating tpm_password into tpm_owner_password and reusing correctly
i
TODO: fix all TODO in PR prior of review + squash

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:27 -04:00
Thierry Laurion
2ae94405ad
WiP: add export CONFIG_HAVE_GPG_KEY_BACKUP=y so whiptail-tpm2 can be used with GPG key material thumb drive backup
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:04 -04:00
Thierry Laurion
1f28c71447
WiP: adapt dmesg in function of CONFIG_DEBUG_OUTPUT being enabled or not so and adapt further troubleshooting notes in code when keys cannot be accessed on media for whatever cause so user can understand what is happening when accessing GPG material on backup thumb drive
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:06:55 -04:00
Thierry Laurion
b1e5c638cd
WiP
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:06:45 -04:00
tlaurion
f540f2a335
Merge pull request #1430 from gaspar-ilom/w541-support
Support Thinkpad W541
2023-10-30 15:41:14 -04:00
tlaurion
1733552fe7
Merge pull request #1505 from JonathonHall-Purism/upstream_28.1_librem_11
Add support for Librem 11
2023-10-30 15:38:02 -04:00
gaspar-ilom
2e8239c5e7 add configuration for w541
closes #1389
2023-10-23 21:52:09 +02:00
Thierry Laurion
9addb3b6b0
qemu board doc: add Nitrokey3NFC in md doc 2023-10-10 12:30:41 -04:00
Thierry Laurion
4ff955918f
x230-maximized board configs: add DEBUG/TRACE board config in comment
Enabling DEBUG/TRACE options from board config vs from configuration menu is different.

When enabled in board config, /etc/config is from ROM, and sourced early and make TRACE/DEBUG calls appear early.
If added through configuration menu, those are /etc/config.user overrides extracted from CBFS and then sourced after combine_configs call

If for whatever reason early DEBUG is needed on a platform, enabling in board config is needed.
For runtime debugging, enabling Debug output from configuration menu is enough
2023-10-10 12:14:36 -04:00
Jonathon Hall
55155f6558
boards/librem_11: Add Librem 11
Add Librem 11 board.

Librem 11 uses coreboot graphics init, which is done with FSP GOP.

Set a custom keymap for the volume/power keys.  Configure the volume
keys as up/down arrows (for navigation in fbwhiptail, and for shell
history in the Linux console).  Configure the power key as Enter.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-09-29 15:36:30 -04:00