Add Google kano (Mr Chromebox) support - First full Chromebook port!

.circleci/config.yml

@@ -262,7 +262,7 @@ jobs:
   #   See doc/circleci.md for full documentation.
   # Workspace chain: create_hashes -> x86_blobs -> x86_musl_cross_make -> x86_coreboot
   # Seeds (one per unique toolchain): coreboot-4.11, coreboot-25.09,
-  #   coreboot-dasharo_nv4x, coreboot-purism
+  #   coreboot-dasharo_nv4x, coreboot-mrchromebox, coreboot-purism
   # Dasharo v56/msi_z690/msi_z790 are build jobs, not x86_coreboot.
   x86_coreboot:
     executor: heads-docker
@@ -527,6 +527,16 @@ workflows:
           requires:
             - x86-musl-cross-make [cross compiler]
 
+      # mrchromebox fork (coreboot 26.03 based) -- builds coreboot-mrchromebox toolchain
+      # Downstream boards: kano
+      - x86_coreboot:
+          name: kano [seed:coreboot-mrchromebox]
+          target: kano
+          subcommand: ""
+          coreboot_dir: coreboot-mrchromebox
+          requires:
+            - x86-musl-cross-make [cross compiler]
+
       # ── coreboot 25.09 boards (alphabetical) ───────────────────────────────
       - build:
           name: EOL_m900_tower-hotp-maximized

README.md

@@ -57,6 +57,24 @@ We welcome contributions to the Heads project! Before contributing, please read
 Heads builds inside a versioned Docker image. The supported and tested workflow uses the
 provided Docker wrappers — no host-side QEMU or swtpm installation is needed.
 
+### Clone the Repository
+
+Clone with full history to ensure version tags are available for
+`git describe --tags` (used at build time for artifact filenames):
+
+```bash
+git clone https://github.com/linuxboot/heads.git
+cd heads
+```
+
+To repair an existing shallow clone (`--depth 1` was used) or if
+artifact filenames show a trailing `_-` (missing git abbreviation):
+
+```bash
+git fetch --unshallow origin
+git fetch --tags origin
+```
+
 **Quick start** (requires [Docker CE](https://docs.docker.com/engine/install/)):
 
 ```bash

bin/validate_cbfs_ifd_fit.sh

@@ -274,7 +274,8 @@ if [ -z "$IFD_VALIDATION_SKIPPED" ] && [ -f "$IFD_PATH" ] && [ -n "$IFDTOOL" ];
             MAX_CBFS_SIZE=0x1000000  # 16 MiB - Intel SPI decode window limit
 
             # Calculate safe expansion target: min(IFD BIOS size, 16 MiB limit)
-            if [ $BIOS_SIZE -gt $MAX_CBFS_SIZE ]; then
+            MAX_CBFS_SIZE_DEC=$((MAX_CBFS_SIZE))
+            if [ $BIOS_SIZE -gt $MAX_CBFS_SIZE_DEC ]; then
                 TARGET_SIZE=$MAX_CBFS_SIZE
                 TARGET_SIZE_KB=$((TARGET_SIZE / 1024))
                 BIOS_SIZE_MB=$((BIOS_SIZE / 1024 / 1024))

boards/kano/kano.config

@@ -0,0 +1,86 @@
+# Configuration for an Acer Chromebook Spin 714 (CP714-1WN/2WN/KANO)
+# Intel iGPU "UHD Graphics", 12th Gen Intel Core i5-1235U, 8GB RAM
+# 256GB NVMe Storage, Intel AX211 Wi-Fi 6E
+
+# 32MB Winbond Chip W25Q256JV_M - SuzyQ cable used to flash with ccd.
+
+export CONFIG_COREBOOT=y
+export CONFIG_COREBOOT_VERSION=mrchromebox
+# Intel ME: MrChromebox fork does not provide INTEL_ME_DISABLED_HAP or
+# IFDTOOL_DISABLE_ME Kconfig options (Dasharo/upstream additions).
+# The me.bin from MrChromebox blobs repo is already in a ChromeOS-minimized
+# state and provided as-is at CONFIG_ME_BIN_PATH in the coreboot config.
+# HAP (High Assurance Platform) bit is applied via ifdtool -M 1 post-build
+# to disable ME at runtime after hardware initialization.
+CONFIG_COREBOOT_APPLY_HAP=y
+export CONFIG_LINUX_VERSION=6.6.30
+
+CONFIG_COREBOOT_CONFIG=config/coreboot-kano.config
+CONFIG_LINUX_CONFIG=config/linux-kano.config
+
+#Enable DEBUG output
+export CONFIG_DEBUG_OUTPUT=y
+export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y
+#Enable TPM2 pcap output under /tmp
+export CONFIG_TPM2_CAPTURE_PCAP=y
+
+#On-demand hardware support (modules.cpio)
+CONFIG_LINUX_USB=y
+CONFIG_LINUX_E1000=n
+CONFIG_MOBILE_TETHERING=y
+
+#Modules packed into tools.cpio
+CONFIG_IO386=y
+CONFIG_CRYPTSETUP2=y
+CONFIG_FLASHPROG=y
+CONFIG_FLASHTOOLS=y
+CONFIG_GPG2=y
+CONFIG_KEXEC=y
+CONFIG_UTIL_LINUX=y
+CONFIG_LVM2=y
+CONFIG_MBEDTLS=y
+CONFIG_PCIUTILS=y
+#Runtime tools to write to EC/MSR
+CONFIG_IOTOOLS=n
+CONFIG_MSRTOOLS=n
+#Remote attestation support
+# TPM2 requirements
+CONFIG_TPM2_TSS=y
+CONFIG_OPENSSL=y
+#Remote Attestation common tools
+CONFIG_POPT=y
+CONFIG_QRENCODE=y
+CONFIG_TPMTOTP=y
+#HOTP based remote attestation for supported USB Security dongle
+#With/Without TPM support
+CONFIG_HOTPKEY=n
+#Nitrokey Storage admin tool (deprecated)
+#CONFIG_NKSTORECLI=n
+#GUI Support
+#Console based Whiptail support(Console based, no FB):
+#CONFIG_SLANG=y
+#CONFIG_NEWT=y
+#FBWhiptail based (Graphical):
+CONFIG_CAIRO=y
+CONFIG_FBWHIPTAIL=y
+#Additional tools (tools.cpio):
+#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
+#CONFIG_DROPBEAR=y
+
+#Runtime configuration
+#Automatically boot if HOTP is valid
+export CONFIG_AUTO_BOOT_TIMEOUT=5
+export CONFIG_FINALIZE_PLATFORM_LOCKING=y
+#TPM2 requirements
+export CONFIG_TPM2_TOOLS=y
+export CONFIG_PRIMARY_KEY_TYPE=ecc
+#TPM1 requirements
+#export CONFIG_TPM=y
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
+export CONFIG_BOOT_REQ_HASH=n
+export CONFIG_BOOT_REQ_ROLLBACK=n
+export CONFIG_BOOT_KERNEL_ADD=""
+export CONFIG_BOOT_KERNEL_REMOVE=""
+export CONFIG_BOOT_DEV="/dev/nvme0n1"
+export CONFIG_BOARD_NAME="Google Kano"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal --ifd -i bios -i fd"