Add Google kano (MrChromebox 26.03 coreboot fork) support - First full Chromebook port!

.circleci/config.yml

@@ -263,7 +263,7 @@ jobs:
   #   See doc/circleci.md for full documentation.
   # Workspace chain: create_hashes -> x86_blobs -> x86_musl_cross_make -> x86_coreboot
   # Seeds (one per unique toolchain): coreboot-4.11, coreboot-25.09,
-  #   coreboot-dasharo_nv4x, coreboot-purism
+  #   coreboot-dasharo_nv4x, coreboot-mrchromebox-26.03, coreboot-purism
   # Dasharo v56/msi_z690/msi_z790 are build jobs, not x86_coreboot.
   x86_coreboot:
     executor: heads-docker
@@ -546,6 +546,24 @@ workflows:
           requires:
             - EOL_x280-hotp-maximized [seed:coreboot-25.12]
 
+      # mrchromebox fork (coreboot 26.03 based) -- builds coreboot-mrchromebox-26.03 toolchain
+      # Downstream boards: kano, kano-hotp
+      - x86_coreboot:
+          name: kano [seed:coreboot-mrchromebox-26.03]
+          target: kano
+          subcommand: ""
+          coreboot_dir: coreboot-mrchromebox-26.03
+          requires:
+            - x86-musl-cross-make [cross compiler]
+
+      # kano-hotp (seeded by kano)
+      - build:
+          name: kano-hotp
+          target: kano-hotp
+          subcommand: ""
+          requires:
+            - kano [seed:coreboot-mrchromebox-26.03]
+
       # ── coreboot 25.09 boards (alphabetical) ───────────────────────────────
       - build:
           name: EOL_m900_tower-hotp-maximized

.gitignore

@@ -18,6 +18,14 @@
 *.xz
 *~
 .*.sw*
+*.bak
+*.bck
+*.orig
+*.rej
+*.save
+*.tmp
+-patch
+.md-patch
 /.direnv
 *.bin
 clean
@@ -27,3 +35,4 @@ typescript*
 result
 .claude/
 tmpDir/
+.code-graph/

README.md

@@ -57,6 +57,24 @@ We welcome contributions to the Heads project! Before contributing, please read
 Heads builds inside a versioned Docker image. The supported and tested workflow uses the
 provided Docker wrappers — no host-side QEMU or swtpm installation is needed.
 
+### Clone the Repository
+
+Clone with full history to ensure version tags are available for
+`git describe --tags` (used at build time for artifact filenames):
+
+```bash
+git clone https://github.com/linuxboot/heads.git
+cd heads
+```
+
+To repair an existing shallow clone (`--depth 1` was used) or if
+artifact filenames show a trailing `_-` (missing git abbreviation):
+
+```bash
+git fetch --unshallow origin
+git fetch --tags origin
+```
+
 **Quick start** (requires [Docker CE](https://docs.docker.com/engine/install/)):
 
 ```bash

bin/validate_cbfs_ifd_fit.sh

@@ -274,7 +274,8 @@ if [ -z "$IFD_VALIDATION_SKIPPED" ] && [ -f "$IFD_PATH" ] && [ -n "$IFDTOOL" ];
             MAX_CBFS_SIZE=0x1000000  # 16 MiB - Intel SPI decode window limit
 
             # Calculate safe expansion target: min(IFD BIOS size, 16 MiB limit)
-            if [ $BIOS_SIZE -gt $MAX_CBFS_SIZE ]; then
+            MAX_CBFS_SIZE_DEC=$((MAX_CBFS_SIZE))
+            if [ $BIOS_SIZE -gt $MAX_CBFS_SIZE_DEC ]; then
                 TARGET_SIZE=$MAX_CBFS_SIZE
                 TARGET_SIZE_KB=$((TARGET_SIZE / 1024))
                 BIOS_SIZE_MB=$((BIOS_SIZE / 1024 / 1024))

boards/kano-hotp/kano-hotp.config

@@ -0,0 +1,86 @@
+# Configuration for a Acer Chromebook Spin 714 (CP714-1WN/2WN/KANO)
+# HOTP variant: requires a supported HOTP Security dongle (Nitrokey Pro/Storage or Librem Key)
+# for HOTP-based remote attestation alongside the TPM.
+# Intel iGPU "UHD Graphics", 12th Gen Intel Core i5-1235U, 8GB RAM
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- Google CR50 on I2C (bus 0x1, addr 0x50) is a separate MCU not driven by the PCH PLTRST# multifunction GPIO pad; the discrete-TPM PLTRST# reprogramming attack cannot reset the CR50
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
+# 256GB NVMe Storage, Intel AX211 Wi-FI 6E, 
+
+# 32MB Winbond Chip W25Q256JV_M - SuzyQ cable used to flash with ccd.
+
+export CONFIG_COREBOOT=y
+export CONFIG_COREBOOT_VERSION=mrchromebox-26.03
+# Post-build ifdtool (modules/coreboot) applies these IFD toggles:
+CONFIG_COREBOOT_APPLY_HAP=y            # disable ME at runtime (fork lacks HAP Kconfigs)
+CONFIG_COREBOOT_GPR0_DISABLE=y         # ME region stays RO even with FLMSTR unlocked without this
+export CONFIG_LINUX_VERSION=6.6.30
+
+CONFIG_COREBOOT_CONFIG=config/coreboot-kano.config
+CONFIG_LINUX_CONFIG=config/linux-kano.config
+
+#Enable DEBUG output
+export CONFIG_DEBUG_OUTPUT=y
+export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y
+#Enable TPM2 pcap output under /tmp
+export CONFIG_TPM2_CAPTURE_PCAP=y
+
+#On-demand hardware support (modules.cpio)
+CONFIG_LINUX_USB=y
+CONFIG_LINUX_E1000=n
+CONFIG_MOBILE_TETHERING=y
+
+#Modules packed into tools.cpio
+CONFIG_IO386=y
+CONFIG_CRYPTSETUP2=y
+CONFIG_FLASHPROG=y
+CONFIG_FLASHTOOLS=y
+CONFIG_GPG2=y
+CONFIG_KEXEC=y
+CONFIG_UTIL_LINUX=y
+CONFIG_LVM2=y
+CONFIG_MBEDTLS=y
+CONFIG_PCIUTILS=y
+#Runtime tools to write to EC/MSR
+CONFIG_IOTOOLS=n
+CONFIG_MSRTOOLS=n
+#Remote attestation support
+# TPM2 requirements
+CONFIG_TPM2_TSS=y
+CONFIG_OPENSSL=y
+#Remote Attestation common tools
+CONFIG_POPT=y
+CONFIG_QRENCODE=y
+CONFIG_TPMTOTP=y
+#HOTP based remote attestation for supported USB Security dongle
+#With/Without TPM support
+CONFIG_HOTPKEY=y
+#Nitrokey Storage admin tool (deprecated)
+#CONFIG_NKSTORECLI=n
+#GUI Support
+#Console based Whiptail support(Console based, no FB):
+#CONFIG_SLANG=y
+#CONFIG_NEWT=y
+#FBWhiptail based (Graphical):
+CONFIG_CAIRO=y
+CONFIG_FBWHIPTAIL=y
+#Additional tools (tools.cpio):
+#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
+#CONFIG_DROPBEAR=y
+
+#Runtime configuration
+#Automatically boot if HOTP is valid
+export CONFIG_AUTO_BOOT_TIMEOUT=5
+export CONFIG_FINALIZE_PLATFORM_LOCKING=y
+#TPM2 requirements
+export CONFIG_TPM2_TOOLS=y
+export CONFIG_PRIMARY_KEY_TYPE=ecc
+#TPM1 requirements
+#export CONFIG_TPM=y
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
+export CONFIG_BOOT_REQ_HASH=n
+export CONFIG_BOOT_REQ_ROLLBACK=n
+export CONFIG_BOOT_KERNEL_ADD=""
+export CONFIG_BOOT_KERNEL_REMOVE=""
+export CONFIG_BOOT_DEV="/dev/nvme0n1"
+export CONFIG_BOARD_NAME="Google Kano HOTP"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i fd"

boards/kano/kano.config

@@ -0,0 +1,84 @@
+# Configuration for a Acer Chromebook Spin 714 (CP714-1WN/2WN/KANO)
+# Intel iGPU "UHD Graphics", 12th Gen Intel Core i5-1235U, 8GB RAM
+# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- Google CR50 on I2C (bus 0x1, addr 0x50) is a separate MCU not driven by the PCH PLTRST# multifunction GPIO pad; the discrete-TPM PLTRST# reprogramming attack cannot reset the CR50
+# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
+# 256GB NVMe Storage, Intel AX211 Wi-FI 6E, 
+
+# 32MB Winbond Chip W25Q256JV_M - SuzyQ cable used to flash with ccd.
+
+export CONFIG_COREBOOT=y
+export CONFIG_COREBOOT_VERSION=mrchromebox-26.03
+# Post-build ifdtool (modules/coreboot) applies these IFD toggles:
+CONFIG_COREBOOT_APPLY_HAP=y            # disable ME at runtime (fork lacks HAP Kconfigs)
+CONFIG_COREBOOT_GPR0_DISABLE=y         # ME region stays RO even with FLMSTR unlocked without this
+export CONFIG_LINUX_VERSION=6.6.30
+
+CONFIG_COREBOOT_CONFIG=config/coreboot-kano.config
+CONFIG_LINUX_CONFIG=config/linux-kano.config
+
+#Enable DEBUG output
+export CONFIG_DEBUG_OUTPUT=y
+export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y
+#Enable TPM2 pcap output under /tmp
+export CONFIG_TPM2_CAPTURE_PCAP=y
+
+#On-demand hardware support (modules.cpio)
+CONFIG_LINUX_USB=y
+CONFIG_LINUX_E1000=n
+CONFIG_MOBILE_TETHERING=y
+
+#Modules packed into tools.cpio
+CONFIG_IO386=y
+CONFIG_CRYPTSETUP2=y
+CONFIG_FLASHPROG=y
+CONFIG_FLASHTOOLS=y
+CONFIG_GPG2=y
+CONFIG_KEXEC=y
+CONFIG_UTIL_LINUX=y
+CONFIG_LVM2=y
+CONFIG_MBEDTLS=y
+CONFIG_PCIUTILS=y
+#Runtime tools to write to EC/MSR
+CONFIG_IOTOOLS=n
+CONFIG_MSRTOOLS=n
+#Remote attestation support
+# TPM2 requirements
+CONFIG_TPM2_TSS=y
+CONFIG_OPENSSL=y
+#Remote Attestation common tools
+CONFIG_POPT=y
+CONFIG_QRENCODE=y
+CONFIG_TPMTOTP=y
+#HOTP based remote attestation for supported USB Security dongle
+#With/Without TPM support
+CONFIG_HOTPKEY=n
+#Nitrokey Storage admin tool (deprecated)
+#CONFIG_NKSTORECLI=n
+#GUI Support
+#Console based Whiptail support(Console based, no FB):
+#CONFIG_SLANG=y
+#CONFIG_NEWT=y
+#FBWhiptail based (Graphical):
+CONFIG_CAIRO=y
+CONFIG_FBWHIPTAIL=y
+#Additional tools (tools.cpio):
+#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
+#CONFIG_DROPBEAR=y
+
+#Runtime configuration
+#Automatically boot if HOTP is valid
+export CONFIG_AUTO_BOOT_TIMEOUT=5
+export CONFIG_FINALIZE_PLATFORM_LOCKING=y
+#TPM2 requirements
+export CONFIG_TPM2_TOOLS=y
+export CONFIG_PRIMARY_KEY_TYPE=ecc
+#TPM1 requirements
+#export CONFIG_TPM=y
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
+export CONFIG_BOOT_REQ_HASH=n
+export CONFIG_BOOT_REQ_ROLLBACK=n
+export CONFIG_BOOT_KERNEL_ADD=""
+export CONFIG_BOOT_KERNEL_REMOVE=""
+export CONFIG_BOOT_DEV="/dev/nvme0n1"
+export CONFIG_BOARD_NAME="Google Kano"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i fd"