TPM2/TPM1 support (testing and bug fixes needed through qemu-(fb)whiptail-tpm[1,2](-hotp) testing boards! #1292
Conversation
tlaurion
changed the title
|
Did some tryouts with this PR, this was my way through (not looked into any code yet):
for now this leaves me with the following questions:
Generally, this looks pretty good so far, will first have to solve the system boot, then I would also try the |
|
@daringer does Debian netinst work on real hardware? I ran my tests with debian-11-xfce with success, not in docker, under a qube (qemu not KVM) As for usb-init, I didn't test this directly, where more recent merge to master works around issue of not having a partition table on raw device. As said I'm chat, this needs a rebase on master to get Purism fix. On my side, I didn't test the whole Factory reset part, since injecting key to ROM is not working as of now (flashrom doesn't detect ski chip and qemu doesn't expose ROM image in a way that works to internally flash inside of qemu). This is why I suggested in doc to use inject_gpg. Passing INSTALL_IMG pointing to local iso works. Otherwise passing a raw IMG containing iso file would require fix that was merged in master, but not in this PR. So basically, doing change in codebase and calling make with inject_gpg, then make run should build+inject specified public key, then run qemu pointing to "dirty" rom. Note that this process needs to be redone between each commit, otherwise qemu call will complain that corresponding rim image (for a commit) doesn't exist. Which would be true since make builds for a commit, and if not commited, appends dirty to it. All good to incrementally develop and commit incrementally prior of doing a PR. I will rebase on master most probably tomorrow. |
My usage for qemu is as simple as (when everything once installed):
Adapt above for tpm2 board variants. I would recommend to make it work for tpm1 variants. And then test tpm2 boards. |
|
@daringer thanks for the comments. I rebased and fixed one issue at unseal-totp (unsealing was not dying if failing).
This will require flashrom+qemu fixes upstream. this is why as of now two builds are required, since one cannot persist settings; this requires adding public key externally in rom (inject_gpg) + run make targets.
This should now work since https://github.com/osresearch/heads/compare/fd00be3c6f8ef0c4e1b6b4a63a2cb7618e409096..c3d082dc856ee6743ef56312255448734229e840#diff-0fd54c445ad40620392abb0e6defb6974df6798254e326594d6300cc86058e24R162-R171 is in from master (rebased) |
|
Will redo a bunch of tests later, since it seems that the hacks applied by vaultboot might have depended on bash being available, and all prior failing tests for disk unlock key were non functional while init was not launching bash? To be confirmed infirmed later. In current state, tpm2 boards use bash while tpm1 boards use busybox's ash (ash as bash per busybox config). Note to myself: |
There was a problem hiding this comment.
Thanks for all the work on this @tlaurion , have given an initial read-through and will start testing today, then look into the TODO-list items. Still need to go through all the comments, wanted to take an unbiased look at the code first 😁 Deleted a bunch of my review comments though since they were already on your to-do list, so glad we have similar thoughts.
| @@ -0,0 +1,40 @@ | |||
| # GNU bash | |||
| modules-$(CONFIG_BASH) += bash | |||
There was a problem hiding this comment.
How do you feel about using bash always? Probably depends on exactly how much space it consumes, I know 8 MB boards are tight, will take a look.
Having to support both busybox ash and bash in every script seems like a recipe for disaster (script breakage, or worse, silent failure to do something important). We've discussed that ash is limiting in many was as well, in ways that force us to compromise UX or correctness.
Will check it out 👍
There was a problem hiding this comment.
@JonathonHall-Purism : t420-hotp-maximized board is the most limitating as of today.
I do not think, even with current spooled efforts onto #590 (read from the bottom of that thread) we could really do much there to fit bash there. Will also see what can be done there, would love to see bash and I think ASH_IS_BASH and having bash binary overwrite busybox symlink is a nice trick that was done by @hardenedvault here. But yeah. Having bash would permit us to have debug calls everywhere and export that in board configs (qemu boards) and be really really happy developing. As well as being able to use bashisms which we all miss right now.
diff --git a/boards/t420-hotp-maximized/t420-hotp-maximized.config b/boards/t420-hotp-maximized/t420-hotp-maximized.config
index 7b0d9008..627c6e3a 100644
--- a/boards/t420-hotp-maximized/t420-hotp-maximized.config
+++ b/boards/t420-hotp-maximized/t420-hotp-maximized.config
@@ -28,6 +28,7 @@ CONFIG_UTIL_LINUX=y
CONFIG_LVM2=y
CONFIG_MBEDTLS=y
CONFIG_PCIUTILS=y
+CONFIG_BASH=y
make BOARD=t420-hotp-maximized
[...]
2023-02-09 12:11:49-05:00 MAKE coreboot
tail /home/user/heads/build/x86/log/coreboot.log
-----
CC generated/ramstage.o
CC cbfs/fallback/ramstage.debug
Created CBFS (capacity = 7601624 bytes)
CBFS fallback/romstage
CBFS cpu_microcode_blob.bin
CBFS fallback/ramstage
CBFS config
CBFS revision
CBFS fallback/dsdt.aml
CBFS vbt.bin
CBFS cmos.default
CBFS cmos_layout.bin
CBFS fallback/postcar
CBFS fallback/payload
E: Could not add [/home/user/heads/build/x86/t420-hotp-maximized/bzImage, 7678919 bytes (7498 KB)@0x0]; too big?
E: Failed to add '/home/user/heads/build/x86/t420-hotp-maximized/bzImage' into ROM image.
E: Failed while operating on 'COREBOOT' region!
E: The image will be left unmodified.
make[1]: *** [Makefile.inc:1082: t420-hotp-maximized/coreboot.pre] Error 1
make[1]: Leaving directory '/home/user/heads/build/x86/coreboot-4.13'
make: *** [Makefile:412: /home/user/heads/build/x86/coreboot-4.13/t420-hotp-maximized/.build] Error 1
There was a problem hiding this comment.
Actually.... If I merge other PRs this is non issue.
2023-02-09 12:20:48-05:00 DONE coreboot
# Use coreboot.rom, because custom output files might not be processed by cbfstool
"/home/user/heads/build/x86/coreboot-4.13/t420-hotp-maximized/cbfstool" "/home/user/heads/build/x86/coreboot-4.13/t420-hotp-maximized/coreboot.rom" print
FMAP REGION: COREBOOT
Name Offset Type Size Comp
cbfs master header 0x0 cbfs header 32 none
fallback/romstage 0x80 stage 87756 none
cpu_microcode_blob.bin 0x157c0 microcode 26624 none
fallback/ramstage 0x1c040 stage 119325 none
config 0x392c0 raw 925 none
revision 0x396c0 raw 697 none
fallback/dsdt.aml 0x399c0 raw 14615 none
vbt.bin 0x3d340 raw 1368 LZMA (3985 decompressed)
cmos.default 0x3d900 cmos_default 256 none
cmos_layout.bin 0x3da40 cmos_layout 1992 none
fallback/postcar 0x3e240 stage 27288 none
fallback/payload 0x44d40 simple elf 7678919 none
(empty) 0x797940 null 164952 none
bootblock 0x7bfdc0 bootblock 65536 none
2023-02-09 12:20:48-05:00 INSTALL build/x86/coreboot-4.13/t420-hotp-maximized/coreboot.rom => build/x86/t420-hotp-maximized/heads-t420-hotp-maximized-v0.2.0-1364-g0cbc2eb-dirty.rom
762466a46f1507b423c77ebd5537bb369881b0c37a3c51fcd674dd4a5589dd75 build/x86/t420-hotp-maximized/heads-t420-hotp-maximized-v0.2.0-1364-g0cbc2eb-dirty.rom
762466a46f1507b423c77ebd5537bb369881b0c37a3c51fcd674dd4a5589dd75 /home/user/heads/build/x86/t420-hotp-maximized/heads-t420-hotp-maximized-v0.2.0-1364-g0cbc2eb-dirty.rom
user@heads-tests:~/heads$ git diff
diff --git a/boards/t420-hotp-maximized/t420-hotp-maximized.config b/boards/t420-hotp-maximized/t420-hotp-maximized.config
index 7b0d9008..627c6e3a 100644
--- a/boards/t420-hotp-maximized/t420-hotp-maximized.config
+++ b/boards/t420-hotp-maximized/t420-hotp-maximized.config
@@ -28,6 +28,7 @@ CONFIG_UTIL_LINUX=y
CONFIG_LVM2=y
CONFIG_MBEDTLS=y
CONFIG_PCIUTILS=y
+CONFIG_BASH=y
#Remote attestation support
#TPM based requirements
diff --git a/boards/x230-maximized/x230-maximized.config b/boards/x230-maximized/x230-maximized.config
index c2f4734f..7a584ed4 100644
--- a/boards/x230-maximized/x230-maximized.config
+++ b/boards/x230-maximized/x230-maximized.config
@@ -26,6 +26,7 @@ CONFIG_UTIL_LINUX=y
CONFIG_LVM2=y
CONFIG_MBEDTLS=y
CONFIG_PCIUTILS=y
+CONFIG_BASH=y
#Remote attestation support
#TPM based requirements
diff --git a/config/coreboot-t420-hotp-maximized.config b/config/coreboot-t420-hotp-maximized.config
index cb455264..455aa803 100644
--- a/config/coreboot-t420-hotp-maximized.config
+++ b/config/coreboot-t420-hotp-maximized.config
@@ -3,7 +3,7 @@ CONFIG_USE_OPTION_TABLE=y
CONFIG_STATIC_OPTION_TABLE=y
CONFIG_VENDOR_LENOVO=y
CONFIG_NO_POST=y
-CONFIG_CBFS_SIZE=0x750000
+CONFIG_CBFS_SIZE=0x7E7FFF
CONFIG_IFD_BIN_PATH="@BLOB_DIR@/xx20/ifd.bin"
CONFIG_ME_BIN_PATH="@BLOB_DIR@/xx20/me.bin"
CONFIG_GBE_BIN_PATH="@BLOB_DIR@/xx20/gbe.bin"
There was a problem hiding this comment.
With #1298, this is not a problem but for locally built x220/t420 boards (8mb) which don't necessarily include modified ifd + neutered me with freed space relocalized into ifd. mmmmmm
@JonathonHall-Purism : local tests above shows that t420-hotp-maximized is compiling correctly as well.
There was a problem hiding this comment.
That's awesome to hear @tlaurion 🤩 Looking forward to a new era with bash!
There was a problem hiding this comment.
Will depend on #1121 being merged. Diffoscope is taking forever to produce intended report prior of review there.
|
Note: binary is stripped inside of module even though global Makefile does it as well as part of initrd packing. Without bashWith bash (Optimized for space -Os)With bash (Optimized for speed -O2)default So:
Question is can we spare 377856? (We just added 0.4mb for xx30 and 0.5mb for xx20.) |
@JonathonHall-Purism I guess we could if really needed. Other stalled work from top of my head freed 0.4 mb from -Os passed to all modules in another PR, where kernel built in modules reduction freed another 0.4 or more. So maybe this is a migration needed, while my current tests for TPM disk unlock key seal/unseal are still not successful with current code base of this PR with/without bash. Not sure how this code was even successful as is to be honest. Will take another shot in the next days |
|
@tlaurion Does this branch build for you right now? Does not build for me on Debian currently, looking into it. build/x86/openssl-1_1_1h/test/rsa_complex.o exists (and it's trying to place the output in the same directory), so I'm not sure what it's complaining about offhand. Going to see if openssl/curl are actually needed first. |
These were still writing some debugging output containing flags and PCRs even when debug was not enabled. Use DEBUG. Signed-off-by: Jonathon Hall <[email protected]>
Signed-off-by: Jonathon Hall <[email protected]>
tpm-reset is just a prompt for the password followed by tpmr reset. oem-factory-reset already bypasses the prompt, just call tpmr reset directly. Signed-off-by: Jonathon Hall <[email protected]>
|
We did some refactoring to the x230-legacy-flash and t430-legacy-flash boards that I lack the hardware to test. These are the only two boards that exclude bash (due to lack of space). x230/t430 board owners, could we get a little help testing x230-legacy-flash / t430-legacy-flash? x230: x230 (xx30): @tlaurion @osresearch @merge @jan23 @MrChromebox @shamen123 @eganonoa @bwachter @Thrilleratplay @jnscmns @doob85 |
Disable all optional algorithms except SM3. (SHA and AES are not optional.) tpm2-tss uses SHA, AES, and SM3. Reduces size of libcrypto by almost 1 MB, saves about 140 KB in ROM. Signed-off-by: Jonathon Hall <[email protected]>
|
I disabled all optional algorithms in OpenSSL except SM3. tpm2-tss and tpm2-tools use AES, SHA, and SM3; AES/SHA are not optional in OpenSSL. Saved about 140 KB of ROM. Before: After: |
Multiple traps overwrite each other. While no tpmr functions have more than one trap right now, it is fragile, and the quoting is complex due to double expansion. Use at_exit to add exit handlers that accumulate and do not require special quoting. Signed-off-by: Jonathon Hall <[email protected]>
init must use busybox ash because it is used on legacy-flash boards. Change shebang, move needed functions to ash_functions. Signed-off-by: Jonathon Hall <[email protected]>
These need to work on legacy-flash boards. Signed-off-by: Jonathon Hall <[email protected]>
Fix `[ -a` to POSIX `[ -e`. Only run cbfs-init, key-init on normal boards with bash. Signed-off-by: Jonathon Hall <[email protected]>
It's a no-op on TPM1, but provide it so init doesn't have to distinguish TPM1/TPM2. Signed-off-by: Jonathon Hall <[email protected]>
|
Issues with flasher boards. co-working on it |
They're the same other than a TRACE, combine them. Use busybox insmod since the insmod script uses bash, we don't need the TPM PCRs on legacy-flash-boards. Remove PCR4 extend, these boards lack TPM configuration. Update ROM example name. Signed-off-by: Jonathon Hall <[email protected]>
TPM password must be 1-32 characters. Loop if the password is not valid or the repeated password doesn't match, so the user can try again. Move prompt_new_owner_password to functions and use in both gui-init and tpm-reset. Fixes linuxboot#1336 Signed-off-by: Jonathon Hall <[email protected]>
tlaurion
changed the title
|
Will reflash original rom backup + x230-legacy-flash from CircleCI then x230-hotp-legacy when roms are ready, but if x230-hotp-legacy fails, this should not be a blocker for this PR and should be seperate issue. |
This is unused, remove it. Signed-off-by: Jonathon Hall <[email protected]>
No other TPM2 boards exist yet, so add a qemu TPM2 board as a build test for TPM2. Signed-off-by: Jonathon Hall <[email protected]>
|
Reminder that legacy boards show 175% percent flash output for full internal upgrade through flash.sh script output. |
|
LGTM! Checking if last minutes needs before merging.... |
|
Thanks for Nlnet for supporting this part of the work https://nlnet.nl/project/HEADS-TPM2.0/#ack |
Integrates and adapts @hardenedvault's vaultboot's TPM2 codebase (hardenedvault/vaultboot@b2800fb)
TODOs:
libcurl cannot be built as a tpm2-tools dependency as of now not sure why. curl currently needs to be added in board config to be builtnot needed.tpm-reset (master and here) needs some review, no handle of no tpm use case. Caller is responsible to not call it otherwise does nothingcaller scripts does not call (config-gui, gui-init, oem-factory-reset all clean)init tries to bind fd and fails currentlyDynamic, depends of bash (required for all boards but can be deactivated (legacy-flash boards)Note: Check if whiptail is different of fbwhiptail in clearing screen. As of now every clear seems to be removed, still whiptail clears previous console output: fbwhiptail doesn't clear screen and is recommended to have more output on consoleTPM reset asks for TPM owner password multiple timesseal-hotpkey is not working properlyoksetting disk unlock key asks for TPM ownership passphrase (sealing in NV requires ownership, but text is misleading user as if reowning TPM)fixed.We should cache input, feed tpm behind the scene and wipe passphrase and state clearly that this is TPM disk unlock kye passphrase.tpm reset still required after each commitprimary key from TPM2 is invalid most of the time from kexec-select-boot and verifying global hashes but is setuped correctly at disk unlock key setupfixed under kexec-save-defaultwould be nice to take advantage of bash function tracing to understand where we are for debugging purposes, code takes ash in consideration only: would still be nice, but we have TRACE and DEBUG calls nowtpmr says it implements nv calls but actually doesn't. Removing those falsely wrapped functions would help.look into tpm2-tss to see precisely what algorithms are required on libcryptoREVIEW TODOS IN CODEREADD CIRCLECI CONFIGCurrent state:
TPM seal/unseal TOTP properly
TPM disk encryption key sealing/unsealing properly
coreboot support of TPM v2.0 (shared config for TPM2 support across all 4 previous variations)
swtpm set to be launched under TPM v2.0 mode under board config, which manufacture it correctly
Documentation file under each board.md softlinks to qemu-coreboot-fbwhiptail-tpm1.md (which has been generalized)
All qemu boards activate DEBUG and TRACE calls through board configuration settings to ease onboarding of understanding of both TPM1 and TPM2 internals, on screen and inside /tmp/debug.log, accessible through qemu launching console (Type Enter there to enter recovery shell when you want to access logs, knowing you will invalidate TPM measurements.)
size reduction of libcrypto by disabling unused algos
Limitations:
No encryption with TPMFixed with session used for unsealing, while sealing was there but broken in vaultboot 69a4c3bDA lockout can be unlocked with default passwd from OS (meaning no passwd)