diff --git a/About/Heads-threat-model.md b/About/Heads-threat-model.md index 77b5d24..84ed18e 100644 --- a/About/Heads-threat-model.md +++ b/About/Heads-threat-model.md @@ -250,7 +250,7 @@ TPM Disk Unlock Key (DUK) with passphrase is **not affected** on any board. The DUK requires a user passphrase to unseal, which a GPIO reset cannot bypass. {: .note } -[KGPE-D16](https://doc.coreboot.org/mainboard/asus/kgpe-d16.html) is in `unmaintained_boards/`. Dropped from coreboot 4.12 (2019). +[KGPE-D16](https://15h.org/index.php/ASUS_KGPE-D16) is in `unmaintained_boards/`. Dropped from coreboot 4.12 (2019). [Dasharo](https://docs.dasharo.com/) fork abandoned Aug 2025. AMD Family 15h microcode frozen since 2018. See [BOARDS_AND_TESTERS.md](https://github.com/linuxboot/heads/blob/master/doc/BOARDS_AND_TESTERS.md#per-board-eolesu-status) for details. @@ -636,7 +636,7 @@ are directly relevant to Heads platforms: - **[BlackLotus](https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/) UEFI bootkit (2023, [CVE-2022-21894](https://nvd.nist.gov/vuln/detail/CVE-2022-21894)):** the first in-the-wild UEFI bootkit bypassing [Secure Boot](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot) on fully patched Windows 11 systems, demonstrating that UEFI firmware trust models remain fragile. -- **[LogoFAIL](https://binarly.io/posts/From_LogoFAIL_to_LOGOFAIL_How_Image_Parsing_Flaws_Expose_UEFI_Firmware/index.html) (2023):** exploitable image parsing flaws in [UEFI](https://uefi.org/) firmware +- **[LogoFAIL](https://www.binarly.io/reports/logofail) (2023):** exploitable image parsing flaws in [UEFI](https://uefi.org/) firmware logo display code across all major IBVs (AMI, Insyde, Phoenix), allowing arbitrary code execution during boot -- hundreds of consumer and enterprise devices affected. diff --git a/About/Keys.md b/About/Keys.md index db0fd17..4787581 100644 --- a/About/Keys.md +++ b/About/Keys.md @@ -145,7 +145,7 @@ Ideally, the private key does not live on the machine, but instead is in a Yubikey or other USB Security dongle. The security dongle may be used in the disk decryption process. Some of the -[Linux distros](https://docs.puri.sm/Librem_Key/Getting_Started/User_Manual.html#decrypt-luks-encrypted-drives-with-librem-key) +[Linux distros](https://docs.puri.sm/Hardware/acc/lk/luks.html) have incorporated this using /etc/crypttab with a keyscript option. An attacker who controls this private key can replace executables in `/boot` diff --git a/Development/make-details.md b/Development/make-details.md index 8dafbac..a497371 100644 --- a/Development/make-details.md +++ b/Development/make-details.md @@ -48,13 +48,13 @@ All of the organization of the Heads build is handled in the top level Build configuration --- -Platform configuration are stored in the `board/$BOARD.config` - ([list of boards can be found here]({{ site.baseurl }}/Prerequisites#supported-devices)) -as well as the sub-modules necessary for the system. +Platform configurations are stored in `boards/$BOARD/$BOARD.config` +([list of boards can be found here]({{ site.baseurl }}/Prerequisites#supported-devices)). +Each board config also selects the sub-modules required for the system. The main difference between these use cases is the init scripts that -are installed in the inird, the Linux kernel configuration and the +are installed in the initrd, the Linux kernel configuration and the coreboot or edk2 configuration. -An example configuration is [`board/x230.config`](https://github.com/linuxboot/heads/blob/master/boards/x230/x230.config) +An example configuration is [`boards/EOL_x230-maximized/EOL_x230-maximized.config`](https://github.com/linuxboot/heads/blob/master/boards/EOL_x230-maximized/EOL_x230-maximized.config) Sub-modules --- diff --git a/Installing-and-Configuring/Flashing-Guides/T440p-maximized.md b/Installing-and-Configuring/Flashing-Guides/T440p-maximized.md index dd7a9d8..f41be96 100644 --- a/Installing-and-Configuring/Flashing-Guides/T440p-maximized.md +++ b/Installing-and-Configuring/Flashing-Guides/T440p-maximized.md @@ -76,5 +76,5 @@ Replace `[programmer]` with your hardware (e.g. `linux_spi:dev=/dev/spidev0.0`, ### Haswell-specific notes - **[thinkpad_acpi](https://www.kernel.org/doc/html/latest/admin-guide/laptops/thinkpad-acpi.html)**: After the first boot with Heads, the `thinkpad_acpi` kernel module may need the `fan_control=1` parameter to enable manual fan control. Add `thinkpad_acpi.fan_control=1` to the kernel command line or pass it as a module parameter. -- **[MRC](https://doc.coreboot.org/soc/intel/fsp.html) (Memory Reference Code)**: The T440p uses Haswell MRC training data stored in SPI flash. If the flash layout is corrupted or you are flashing a completely blank board, the machine may not boot until MRC training runs. Heads does not include a built-in MRC cache; the first boot after flashing may take 30–60 seconds as the platform retrains memory. Subsequent boots will reuse cached parameters. +- **[MRC](https://doc.coreboot.org/soc/intel/fsp/index.html) (Memory Reference Code)**: The T440p uses Haswell MRC training data stored in SPI flash. If the flash layout is corrupted or you are flashing a completely blank board, the machine may not boot until MRC training runs. Heads does not include a built-in MRC cache; the first boot after flashing may take 30–60 seconds as the platform retrains memory. Subsequent boots will reuse cached parameters. - **GPIO PLTRST#**: As noted above, the T440p has a dedicated PLTRST# pin for TPM GPIO reset, making it one of the better-protected pre-Skylake boards in the Heads threat model. diff --git a/Installing-and-Configuring/Flashing-Guides/index.md b/Installing-and-Configuring/Flashing-Guides/index.md index e33c8a0..d11de66 100644 --- a/Installing-and-Configuring/Flashing-Guides/index.md +++ b/Installing-and-Configuring/Flashing-Guides/index.md @@ -12,7 +12,7 @@ has_children: yes ## Platform-Specific Guides -- [The internal flashing commands for Purism devices can be found here](https://docs.puri.sm/PureBoot/Heads/User_Manual.html#flash-the-compiled-heads-rom-to-your-hardware) +- [The internal flashing commands for Purism devices can be found here](https://docs.puri.sm/Software/PureBoot/Maintenance/Upgrade.html) ## Video Guides diff --git a/Installing-and-Configuring/Flashing-Guides/msi_z690a_ddr5-maximized.md b/Installing-and-Configuring/Flashing-Guides/msi_z690a_ddr5.md similarity index 94% rename from Installing-and-Configuring/Flashing-Guides/msi_z690a_ddr5-maximized.md rename to Installing-and-Configuring/Flashing-Guides/msi_z690a_ddr5.md index f32c92c..f8e3f4d 100644 --- a/Installing-and-Configuring/Flashing-Guides/msi_z690a_ddr5-maximized.md +++ b/Installing-and-Configuring/Flashing-Guides/msi_z690a_ddr5.md @@ -1,13 +1,13 @@ --- layout: default -title: MSI PRO Z690-A Maximized -permalink: /MSI_Z690A-maximized-flashing/ +title: MSI PRO Z690-A +permalink: /MSI_Z690A-flashing/ nav_order: 14 parent: Step 2 - Flashing Guides grand_parent: Installing and configuring --- -MSI PRO Z690-A (Maximized) +MSI PRO Z690-A ===
diff --git a/Installing-and-Configuring/Flashing-Guides/msi_z790p_ddr5-maximized.md b/Installing-and-Configuring/Flashing-Guides/msi_z790p_ddr5.md similarity index 78% rename from Installing-and-Configuring/Flashing-Guides/msi_z790p_ddr5-maximized.md rename to Installing-and-Configuring/Flashing-Guides/msi_z790p_ddr5.md index 6c55a3d..a9b8a37 100644 --- a/Installing-and-Configuring/Flashing-Guides/msi_z790p_ddr5-maximized.md +++ b/Installing-and-Configuring/Flashing-Guides/msi_z790p_ddr5.md @@ -1,13 +1,13 @@ --- layout: default -title: MSI PRO Z790-P Maximized -permalink: /MSI_Z790P-maximized-flashing/ +title: MSI PRO Z790-P +permalink: /MSI_Z790P-flashing/ nav_order: 15 parent: Step 2 - Flashing Guides grand_parent: Installing and configuring --- -MSI PRO Z790-P (Maximized) +MSI PRO Z790-P ===
@@ -46,4 +46,4 @@ Full disassembly instructions, SPI flash access via JTPM1 header (2mm pitch, req ## Flashing -Key notes: Flash via JTPM1 header (pins 1=Vcc, 7=GND, 5=CS, 6=CLK, 3=MISO, 4=MOSI). SMBIOS UUID/serial must be extracted and re-injected with cbfstool + vboot resign. Disconnect dGPU before flashing. Memory training takes ~2 minutes on first boot. +Key notes: This board does not ship pre-flashed. For initial deployment and unbricking/recovery, follow the [Dasharo MSI initial deployment](https://docs.dasharo.com/unified/msi/initial-deployment/) and [Dasharo MSI recovery — external flashing via CH341A](https://docs.dasharo.com/unified/msi/recovery/#ch341a) documentation. diff --git a/Installing-and-Configuring/Flashing-Guides/nitropad-ns50-maximized.md b/Installing-and-Configuring/Flashing-Guides/nitropad-ns50.md similarity index 75% rename from Installing-and-Configuring/Flashing-Guides/nitropad-ns50-maximized.md rename to Installing-and-Configuring/Flashing-Guides/nitropad-ns50.md index 5673a24..72ec97f 100644 --- a/Installing-and-Configuring/Flashing-Guides/nitropad-ns50-maximized.md +++ b/Installing-and-Configuring/Flashing-Guides/nitropad-ns50.md @@ -1,13 +1,13 @@ --- layout: default -title: NitroPad NS50 Maximized -permalink: /NS50-maximized-flashing/ +title: NitroPad NS50 +permalink: /NS50-flashing/ nav_order: 16 parent: Step 2 - Flashing Guides grand_parent: Installing and configuring --- -NitroPad NS50 (Maximized) +NitroPad NS50 ===
@@ -47,4 +47,4 @@ Full disassembly photos, SPI chip details (GigaDevice 25B1256EYIG, 32MB WSON-8), ## Flashing -Key notes: WSON-8 probe required (not SOIC clip). Full binaries required. EC flashed separately via [ite_ec](https://github.com/linuxboot/heads/tree/master/modules/ite_ec). Single-command external flash (`flashrom -p ch341a_spi -w`). +Key notes: This board ships pre-flashed with Dasharo and Heads from NovaCustom/Nitrokey — external flashing is not required for normal operation. The Dasharo external-flashing instructions cover both initial deployment and unbricking/recovery — see the [Dasharo NovaCustom initial deployment](https://docs.dasharo.com/unified/novacustom/initial-deployment/) and [Dasharo NovaCustom recovery](https://docs.dasharo.com/unified/novacustom/recovery/#bios-flashing) documentation. diff --git a/Installing-and-Configuring/Flashing-Guides/novacustom-nv4x_adl-maximized.md b/Installing-and-Configuring/Flashing-Guides/novacustom-nv4x_adl.md similarity index 70% rename from Installing-and-Configuring/Flashing-Guides/novacustom-nv4x_adl-maximized.md rename to Installing-and-Configuring/Flashing-Guides/novacustom-nv4x_adl.md index 75dab88..3e35769 100644 --- a/Installing-and-Configuring/Flashing-Guides/novacustom-nv4x_adl-maximized.md +++ b/Installing-and-Configuring/Flashing-Guides/novacustom-nv4x_adl.md @@ -1,13 +1,13 @@ --- layout: default -title: NovaCustom NV4x ADL Maximized -permalink: /NV4x_ADL-maximized-flashing/ +title: NovaCustom NV4x ADL +permalink: /NV4x_ADL-flashing/ nav_order: 17 parent: Step 2 - Flashing Guides grand_parent: Installing and configuring --- -NovaCustom NV4x ADL (Maximized) +NovaCustom NV4x ADL ===
@@ -42,9 +42,9 @@ See [Per-Board Protection Status]({{ site.baseurl }}/Heads-threat-model/#per-boa Full disassembly photos, SPI chip details (Macronix MX25L25673GZ4I-08G, 32MB WSON-8, 3.3V), programmer setup, and step-by-step flashing instructions are maintained by [Dasharo](https://docs.dasharo.com/): → **[Recovery & disassembly photos](https://docs.dasharo.com/unified/novacustom/recovery/#12th-gen)** -→ **[Initial deployment (two-step flash)](https://docs.dasharo.com/unified/novacustom/initial-deployment/#bios-installation)** +→ **[Initial deployment](https://docs.dasharo.com/unified/novacustom/initial-deployment/#bios-installation)** → **[Hardware matrix](https://docs.dasharo.com/variants/novacustom_nv4x_adl/hardware-matrix/)** ## Flashing -Key notes: Intel Boot Guard enabled — external flashing mandatory. Two-step flash (IFD first, then ME+BIOS). Full binaries required. CH341a with WSON-8 probe. +Key notes: This board ships pre-flashed with Dasharo and Heads from NovaCustom/Nitrokey — external flashing is not required for normal operation. The Dasharo external-flashing instructions cover both initial deployment and unbricking/recovery — see the [Dasharo NovaCustom initial deployment](https://docs.dasharo.com/unified/novacustom/initial-deployment/) and [Dasharo NovaCustom recovery](https://docs.dasharo.com/unified/novacustom/recovery/#bios-flashing) documentation. diff --git a/Installing-and-Configuring/Flashing-Guides/novacustom-v540tu-maximized.md b/Installing-and-Configuring/Flashing-Guides/novacustom-v540tu.md similarity index 67% rename from Installing-and-Configuring/Flashing-Guides/novacustom-v540tu-maximized.md rename to Installing-and-Configuring/Flashing-Guides/novacustom-v540tu.md index 321f693..ce8a941 100644 --- a/Installing-and-Configuring/Flashing-Guides/novacustom-v540tu-maximized.md +++ b/Installing-and-Configuring/Flashing-Guides/novacustom-v540tu.md @@ -1,13 +1,13 @@ --- layout: default -title: NovaCustom V540TU Maximized -permalink: /V540TU-maximized-flashing/ +title: NovaCustom V540TU +permalink: /V540TU-flashing/ nav_order: 18 parent: Step 2 - Flashing Guides grand_parent: Installing and configuring --- -NovaCustom V540TU (Maximized) +NovaCustom V540TU ===
@@ -39,7 +39,7 @@ See [Per-Board Protection Status]({{ site.baseurl }}/Heads-threat-model/#per-boa ## Disassembly -Full disassembly instructions, SPI chip details (socket-mounted WSON8), programmer recommendations, and step-by-step flashing procedures are maintained by [Dasharo](https://docs.dasharo.com/): +Full disassembly instructions, SPI chip details (WSON8), programmer recommendations, and step-by-step flashing procedures are maintained by [Dasharo](https://docs.dasharo.com/): → **[Dasharo V540TU documentation](https://docs.dasharo.com/unified/novacustom/recovery/#14th-gen)** → **[Dasharo V540TU initial deployment](https://docs.dasharo.com/unified/novacustom/initial-deployment/#bios-installation_1)** @@ -47,4 +47,4 @@ Full disassembly instructions, SPI chip details (socket-mounted WSON8), programm ## Flashing -Key notes: Socket-mounted WSON8 — chip must be physically extracted and re-flashed externally (in-circuit clips not applicable). Two-step flash (IFD first, then ME+BIOS). No full binaries available. EC flashed separately via [ite_ec](https://github.com/linuxboot/heads/tree/master/modules/ite_ec). [Dasharo TrustRoot](https://docs.dasharo.com/glossary/#dasharo-trustroot) (CPU fusing) available — irreversible once enabled. +Key notes: This board ships pre-flashed with Dasharo and Heads from NovaCustom/Nitrokey — external flashing is not required for normal operation. The Dasharo external-flashing instructions cover both initial deployment and unbricking/recovery — see the [Dasharo NovaCustom initial deployment](https://docs.dasharo.com/unified/novacustom/initial-deployment/) and [Dasharo NovaCustom recovery](https://docs.dasharo.com/unified/novacustom/recovery/#bios-flashing) documentation. diff --git a/Installing-and-Configuring/Flashing-Guides/novacustom-v560tu-maximized.md b/Installing-and-Configuring/Flashing-Guides/novacustom-v560tu.md similarity index 75% rename from Installing-and-Configuring/Flashing-Guides/novacustom-v560tu-maximized.md rename to Installing-and-Configuring/Flashing-Guides/novacustom-v560tu.md index a8f5cd0..94fe60d 100644 --- a/Installing-and-Configuring/Flashing-Guides/novacustom-v560tu-maximized.md +++ b/Installing-and-Configuring/Flashing-Guides/novacustom-v560tu.md @@ -1,13 +1,13 @@ --- layout: default -title: NovaCustom V560TU Maximized -permalink: /V560TU-maximized-flashing/ +title: NovaCustom V560TU +permalink: /V560TU-flashing/ nav_order: 19 parent: Step 2 - Flashing Guides grand_parent: Installing and configuring --- -NovaCustom V560TU (Maximized) +NovaCustom V560TU ===
@@ -47,4 +47,4 @@ Full disassembly photos, SPI chip details, programmer setup, and step-by-step fl ## Flashing -Key notes: Socket-mounted WSON8 — physically extract chip. 1.8V CH341a voltage. Two-step flash. [Dasharo TrustRoot](https://docs.dasharo.com/glossary/#dasharo-trustroot) available — irreversible. +Key notes: This board ships pre-flashed with Dasharo and Heads from NovaCustom/Nitrokey — external flashing is not required for normal operation. The Dasharo external-flashing instructions cover both initial deployment and unbricking/recovery — see the [Dasharo NovaCustom initial deployment](https://docs.dasharo.com/unified/novacustom/initial-deployment/) and [Dasharo NovaCustom recovery](https://docs.dasharo.com/unified/novacustom/recovery/#bios-flashing) documentation. diff --git a/Installing-and-Configuring/Flashing-Guides/talos-2-maximized.md b/Installing-and-Configuring/Flashing-Guides/talos-2.md similarity index 95% rename from Installing-and-Configuring/Flashing-Guides/talos-2-maximized.md rename to Installing-and-Configuring/Flashing-Guides/talos-2.md index 84bd65f..a355a5c 100644 --- a/Installing-and-Configuring/Flashing-Guides/talos-2-maximized.md +++ b/Installing-and-Configuring/Flashing-Guides/talos-2.md @@ -1,13 +1,13 @@ --- layout: default -title: Raptor Talos II Maximized -permalink: /Talos_II-maximized-flashing/ +title: Raptor Talos II +permalink: /Talos_II-flashing/ nav_order: 20 parent: Step 2 - Flashing Guides grand_parent: Installing and configuring --- -Raptor Talos II (Maximized) +Raptor Talos II ===