mirror of
https://github.com/Dasharo/heads.git
synced 2026-06-13 10:16:29 -07:00
Thierry Laurion
8fc87af25e
- Add documentation under doc/ for architecture, boot process, building, configuring keys, development, Docker, FAQ, GPG, keys, logging, prerequisites, QEMU, recovery shell, security model, TPM, UX patterns - gpg.md: add GPG Command Requirements section documenting scdaemon PIN caching behaviour and keytocard slot syntax; remove stale example showing ADMIN_PIN_DEF repeated for every subkey - configuring-keys.md: fix key generation step ordering (TPM reset before key generation, LUKS changes first, TOTP/HOTP sealing happens on first normal boot after reset -- not during OEM Factory Reset) Signed-off-by: Thierry Laurion <insurgo@riseup.net>
1.6 KiB
1.6 KiB
Flashrom was passed to flashprog under https://github.com/linuxboot/heads/pull/1769
Those are notes for @i-c-o-n and others wanting to move WP forward but track issues and users
The problem with WP is that it is desired but even if partial write protection regions is present, WP is widely unused.
Some random notes since support is incomplete (depends on chips, really) -QDPI is problematic for WP (same IO2 PIN)
- Might be turned on by chipset for ME read https://matrix.to/#/!pAlHOfxQNPXOgFGTmo:matrix.org/$NCNidoPsw1ze6zv3m2jlPuGuNrdlDQmDcU81If-q55A?via=matrix.org&via=nitro.chat&via=tchncs.de
- WP wanted, WP done, WP unused
Alternative, as suggested by @i-c-o-n is Chipset Platform Locking (PR0) which is enforced at platform's chipset level for a boot
- This is implemented and enforced on <= Haswell from this PR merged : https://github.com/linuxboot/heads/pull/1373
- All Intel platforms have PR0 platform locking implemented prior to kexec call with this not yet upstreamed patch applied in all forks https://review.coreboot.org/c/coreboot/+/85278
- Discussion point under flashrom-> flashprog PR under https://github.com/linuxboot/heads/pull/1769/files/f8eb0a27c3dcb17a8c6fcb85dd7f03e8513798ae#r1752395865 tagging @i-c-o-n
Not sure what is the way forward here, but lets keep this file in tree to track improvements over time.