(WIP) initrd: fix TPM1/TPM2 add DA lockout handling/gating and test tooling - #2124

Closed

tlaurion wants to merge 3560 commits into

linuxboot:masterfrom

tlaurion:tpm_da_lockout_rework

This pull request is big! We're only showing the most recent 250 commits

Commits on Apr 20, 2026

toolchain: add sdcc and xxd

macpijan
authored and
tlaurion
committed
ad1f01b
Prepare nix based docker image to be bumped to v0.2.9 to include minimal changes to build Dasharo-EC
tlaurion
committed
28ec68f
modules/dasharo-ec: fix build system and address review feedback

filipleple
authored and
tlaurion
committed
d3dd057
modules/dasharo-ec: address review feedback and add nv4x_adl/ns50 support

filipleple
authored and
tlaurion
committed
a844b29
Makefile: Auto-clean board build directories when coreboot canary changes
tlaurion
committed
2be7433
MTL release: coreboot revision and updated configs

filipleple
authored and
tlaurion
committed
8e16eb1
modules/coreboot: split dasharo base revisions

filipleple
authored and
tlaurion
committed
b091807
MTL: switch from Notebook to Clevo

filipleple
authored and
tlaurion
committed
7efc524
coreboot-dasharo: add https://github.com/Dasharo/coreboot/pull/847 on top of 1.0.1 for testing (Improve performance by lowering the EPP value from the power-on default of 0xb3 (70%) to 0x73 (45%). …
tlaurion
committed
eee1e34
patches: rename coreboot-dasharo-unreleased -> coreboot-dasharo_v56-unreleased

filipleple
authored and
tlaurion
committed
4d6ea82
.circleci/: account for the dasharo refactor

filipleple
authored and
tlaurion
committed
621c4da
ADL: add updated nv4x_adl config

filipleple
authored and
tlaurion
committed
175cc61
MTL: disable CMOS_ALTCENTURY

filipleple
authored and
tlaurion
committed
cbcc16c
ADL: add ns50

filipleple
authored and
tlaurion
committed
565d2ac
modules/coreboot: remove redundant sed

filipleple
authored and
tlaurion
committed
8bd7e27
bin/fetch_source_archive.sh: log mirror fallbacks
tlaurion
committed
c454b8f
config/coreboot-talos-2: set LOCALVERSION to v0.7.0
tlaurion
committed
cfb66a7
MSI/Nitropad boards: add common security settings
tlaurion
committed
5ad421f
Dasharo boards: update coreboot configs
tlaurion
committed
5fd81ff
modules/coreboot: add helper to save defconfig alongside original .config
tlaurion
committed
d7740ef
config/coreboot-nitropad-ns50: account for FSP header path change from Dasharo/mtl_release
tlaurion
committed
0c5f72c
modules/coreboot: purism fork builds its own toolchain
tlaurion
committed
ae5a884

Commits on Apr 21, 2026

circleci: implement hierarchical cache model with fork-specific caches
tlaurion
committed
b990761

Commits on Apr 22, 2026

Merge pull request #2039 from tlaurion/pre_release_dasharo_101_rc3
tlaurion
authored
3a6821f

Commits on May 6, 2026

Commits on May 7, 2026

initrd: wait for known USB dongle VID before branding detection
tlaurion
committed
7863465
initrd: standardize STATUS/NOTE/WARN/INFO semantics
tlaurion
committed
c9492c8
initrd/etc/functions.sh: add cancellable 15s dongle VID wait
tlaurion
committed
a6c2b77
initrd/init: use PID-tracked bootscript respawn loop
tlaurion
committed
f03e0c2
fix USB keyboard initialization

notgivenby
authored and
tlaurion
committed
3a1cd13
Makefile: sanitize branch token in artifact filenames
tlaurion
committed
4a9e4e5
initrd/docs+status: align recovery flow, dongle mapping, DUK wording, and long-op STATUS outcomes
tlaurion
committed
4255701
doc/boot-process: clarify serial recovery path is asynchronous
tlaurion
committed
874369e
Merge pull request #2102 from notgivenby/fix-usb-keyboard-initialization
tlaurion
authored
b71b53c
Merge remote-tracking branch 'origin/master' into HEAD
tlaurion
committed
9672e6a
init: WARN prior of loading USB keyboard driver to force awareness
tlaurion
committed
94ed32e

Commits on May 8, 2026

Commits on May 14, 2026

Commits on May 15, 2026

Commits on May 20, 2026

initrd: fix TPM1 counter auth regression (#2068)
tlaurion
committed
e399bab

Commits on May 22, 2026

Merge pull request #2117 from linuxboot/tpm1_fixes
tlaurion
authored
6780d3a

Commits on May 25, 2026

initrd/bin/kexec-seal-key.sh tpmr.sh doc/tpm.md: fix PCR5 mismatch between LUKS DUK seal and unseal when CONFIG_USB_KEYBOARD_REQUIRED=y
tlaurion
committed
0b863c2
Merge pull request #2126 from tlaurion/bugfix-tpm_duk_seal_unseal-when_CONFIG_USB_KEYBOARD_REQUIRED
tlaurion
authored
0864198
add the script to download, deguard and reduce the intel ME blob

notgivenby
authored and
tlaurion
committed
16ad534
add ifd and gbe blobs for the m900_tower board

notgivenby
authored and
tlaurion
committed
85930ae
add m900_tower board information including caveats

notgivenby
authored and
tlaurion
committed
5c654f0
add hashes of the blobs and .gitignore file

notgivenby
authored and
tlaurion
committed
0e8ce85
add the .gitignore file

notgivenby
authored and
tlaurion
committed
745731f
add the board config for m900_tower hotp variant

notgivenby
authored and
tlaurion
committed
e90efb4
add the board config for m900_tower maximized variant

notgivenby
authored and
tlaurion
committed
1399a48
add the coreboot config for m900_tower board

notgivenby
authored and
tlaurion
committed
ece22fe
add target mk file to download, deguard, and reduce the ME blob for m900_tower board

notgivenby
authored and
tlaurion
committed
23a9412
add the linux config for the m900_tower board

notgivenby
authored and
tlaurion
committed
cb3217f
blobs/m900: refactor download script to use shared blobs/lib.sh
tlaurion
committed
9d3e333
circleci: add m900 blob download step in x86_blobs
tlaurion
committed
2ddcd75
add m900 hotp and maximized into circle ci

notgivenby
authored and
tlaurion
committed
8037197
EOL_m900_tower-*: fix review comments -- typos, blob names, board name
tlaurion
committed
53d970d
blobs/m900: address remaining review comments
tlaurion
committed
1be85ca
boards/EOL_m900_tower-*: add hardware specifications to board config comments
tlaurion
committed
b304564

Commits on Jun 11, 2026

Commits on Jun 15, 2026

Merge pull request #2118 from linuxboot/m900_with_tpm1_fixes
tlaurion
authored
37e35c4

Commits on Jun 26, 2026

Commits on Jun 27, 2026

Commits on Jul 1, 2026

Commits on Jul 7, 2026

Commits on Jul 8, 2026

Commits on Jul 9, 2026

Commits on Jul 17, 2026

Merge pull request #2155 from tlaurion/nixos-initramfs-skip_crypttab_symlink
tlaurion
authored
b084e1e

Commits on Jul 21, 2026

Commits on Jul 28, 2026

initrd: replace all direct killall with release_scdaemon

nestire
authored and
tlaurion
committed
76de6ed

Commits on Jul 29, 2026

Commits on Jul 31, 2026

Commits on Aug 4, 2026

Commits on Aug 5, 2026

Commits on Aug 7, 2026

Commits on Aug 18, 2026

Commits on Aug 19, 2026

Commits on Aug 28, 2026

Commits on Sep 1, 2026

Merge pull request #2189 from NobodyNo0ne/Poc_x280
tlaurion
authored
a52909b

Commits on Sep 3, 2026

Commits on Sep 5, 2026

Add support for MrChromeBox coreboot fork.

mdrobnak
authored and
tlaurion
committed
ed052bf
Add Support for Linux 6.6.30 (same patches a 4.9.80).

mdrobnak
authored and
tlaurion
committed
54fc991
add kano boards.config

cwiggs
authored and
tlaurion
committed
9c612d0
kano: put board in debug mode, remove CR50 notes
tlaurion
committed
b3e82d2
kano: config/*kano* use mdrobnak:google_omnigul as base, then coreboot/linux helpers to modify and save in oldconfig
tlaurion
committed
2a04376
patches/coreboot-mrchromebox/0001-util-cbmem-Add-endian.h-include-for-musl-compat.patch: fix build error against musl
tlaurion
committed
8fdcac1
kano: ./docker_repro.sh make BOARD=kano coreboot.modify_defconfig_in_place to put in defconfig to remove irrelevant omnigul things
tlaurion
committed
4b5f313
kano: config/coreboot-kano.config; remove irrelevant omnigul things
tlaurion
committed
8ee154c
kano: ./docker_repro.sh make BOARD=kano coreboot.modify_and_save_oldconfig_in_place to put in oldconfig
tlaurion
committed
fe5fbc7
config/coreboot-kano.config: fix blob paths for MrChromebox repo layout
tlaurion
committed
d405d06
modules/coreboot: init 3rdparty/blobs submodule for mrchromebox fork
tlaurion
committed
85488b4
kano: add CI seed for MrChromebox fork
tlaurion
committed
6805fd6
kano: add PR0 lockdown support via SMM SPI/LPC lockdown
tlaurion
committed
77447a3
doc/variation-to-defconfig.md: cross-board analysis from 38 defconfigs
tlaurion
committed
6f14ea5
config/coreboot-kano.config: expand blob paths to real paths
tlaurion
committed
61e8123
kano: fix CBFS size and IFD validation
tlaurion
committed
6189df4
boards/kano/kano.config: note ME disable options unavailable in mrchromebox fork
tlaurion
committed
1fb65eb
patches/coreboot-mrchromebox/0001-util-cbmem-Add-endian.h-include-for-musl-compat.patch: place include at same position as working coreboot-25.09 fix
tlaurion
committed
8ad2af6
README: document full clone history needed for version identifiers
tlaurion
committed
8bb0fa5
update kano.config

cwiggs
authored and
tlaurion
committed
2570159
CONFIG_BOOTSCRIPT should be /bin/gui-init.sh (missing .sh)

cwiggs
authored and
tlaurion
committed
91f5c0d
Skip ClearControl when TPM does not support

cwiggs
authored and
tlaurion
committed
f4a9852
Update comment about which SPI to use

cwiggs
authored and
tlaurion
committed
b54b772
Enable serial console output

cwiggs
authored and
tlaurion
committed
d147fad
Revert "Enable serial console output"

cwiggs
authored and
tlaurion
committed
326cd49
add tpm doc explaining CR50 features that are missing

cwiggs
authored and
tlaurion
committed
f7b5a18
add tlaurion patch to tpmr.sh

cwiggs
authored and
tlaurion
committed
314ce2f
Enable Heads to detect wrong date and update it

cwiggs
authored and
tlaurion
committed
4d86d82
build: apply HAP bit via ifdtool post-build to disable ME at runtime
tlaurion
committed
63769ab
config/coreboot-kano.config: normalize USE_PC_CMOS_ALTCENTURY via savedefconfig
tlaurion
committed
c758f01
boards/kano: disable CONFIG_DROPBEAR
tlaurion
committed
9f3dbda
adding KANO laptop to boards and testers doc

cwiggs
authored and
tlaurion
committed
e85ea29
fix merge conflict

cwiggs
authored and
tlaurion
committed
0c52e55
modules/coreboot: apply GPR0 disable independently of HAP in post-build ifdtool step
tlaurion
committed
d511d02
boards/kano: version the MrChromebox coreboot fork name
tlaurion
committed
f1cf4dd
boards/kano: note TPM GPIO Reset NOT_VULNERABLE (CR50 on I2C)
tlaurion
committed
e3a83d3
boards/kano: switch from MrChromebox coreboot fork to upstream 26.03
tlaurion
committed
2de707b
boards/kano: record upstream-26.03 config normalization and blob blocker
tlaurion
committed
de3f338
boards/kano: switch kano back to the MrChromebox coreboot fork
tlaurion
committed
f198d10
boards/kano: recheck fork coreboot config via make save helpers; restore TPM GPIO caveats
tlaurion
committed
fcb6c2b
tpm-gpio-reset: point module at 3e3a695 (platform support + cleanup fixups)
tlaurion
committed
da2ee4e
tpm-gpio-reset: attribute Kondix10 (Konrad Dadasiewicz) platform work
tlaurion
committed
c34726d
doc/wp-notes.md: include kano in PR0 chipset-locking coverage
tlaurion
committed
6a39185
gitignore: ignore .code-graph/ workspace
tlaurion
committed
91f3295
boards: add kano-hotp variant (unified with kano)
tlaurion
committed
55fa456
gitignore: ignore backup/scratch artifacts to prevent accidental tracking
tlaurion
committed
5c0de71
Merge branch 'master' into google_kano
tlaurion
committed
66b72b7
remove debug environment vars
cwiggs
committed
4f49d76
Merge pull request #2133 from cwiggs/google_kano
tlaurion
authored
ef45d58

Commits on Sep 8, 2026

Commits on Sep 10, 2026

DA lockout: canonical user copy, wait-by-default countdown dialogs, honest recovery docs
tlaurion
committed
d023d16