Commit Graph

17 Commits

Author SHA1 Message Date
Thierry Laurion
61843d890b
Unify upstream board config defaults
- Upstream boards will not deactivate TPM DUK
- Upstream will not force BRAND_NAME which currently defaults to Heads
- Upstream will not deactivate Qr code on screen output on HOTP sealing
- Upstream will not offer OEM reset defaults (deprecated and now default anyway)

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-19 13:05:46 -05:00
Thierry Laurion
d8f098cd53
All board configs: first line now BRAND_NAME=Heads to ease rebranding with sed scripts for downstream projects/forks
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-16 12:56:58 -05:00
Thierry Laurion
f5dc5ef5cd
qemu boards: Put back DEBUG and TRACE on
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:08:35 -04:00
Thierry Laurion
a3086e9a1c
Remove TODO in code that were not relevant prior of first review
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:08:19 -04:00
Markus Meissner
b47da0be89
boards/qemu-*: update allowed usb-token comments 2023-09-05 12:32:22 +02:00
Thierry Laurion
106a9bf543
qemu boards: change default creation size of USB_FD_IMG from 128MB to 256MB
Otherwise 10% of 128mb (12mb) is not enough to create a LUKS container
2023-08-28 16:24:11 -04:00
Thierry Laurion
d3ea60f69e
linux configs: adapt to use efifb driver (Intel iGPU/qemu with bochs native gfxinit) 2023-08-15 17:24:34 -04:00
Thierry Laurion
c419cf7e2b
Qemu boards: typo in comment to manually enable Basic Boot mode : (was CONFIG_BASIC_BOOT where CONFIG_BASIC expected) 2023-07-17 12:32:27 -04:00
Jonathon Hall
45245fe417
qemu-*: Show how to enable restricted/basic in board config
For iterating, enabling these in the board config is easiest.  It's
also possible to manually inject config.user ahead of time, or enable
at runtime without flashing, but the normal enable/flash/reboot path
does not work in qemu since it is unable to flash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-07-12 14:17:43 -04:00
Thierry Laurion
f34d2dd7d7
bump qemu-tpm boards to coreboot 4.19 2023-06-27 11:21:09 -04:00
Thierry Laurion
a475ecef24
qemu-coreboot-*whiptail-tpm2-* boards: move TPM2 debug PCAP variable to debug section for clarity 2023-04-04 09:36:31 -04:00
Jonathon Hall
50daa904f9
tpmr: Capture TPM2 pcaps in qemu TPM2 boards
tpm2-tools is able to log pcap files of TPM2 commands, which can be
inspected with wireshark.  Add CONFIG_TPM2_CAPTURE_PCAP to capture
these from the tpmr wrapper, and enable for qemu TPM2 boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:34:45 -05:00
Jonathon Hall
c9df49ad20
modules/bash: Include bash in all builds, remove CONFIG_BASH
Include bash in all builds.  Remove CONFIG_BASH.

Remove CONFIG_BASH_IS_ASH from busybox configuration and clean up hacks
in modules/bash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:52 -05:00
Thierry Laurion
1e5544b934
Add DEBUG traces and have TPM2 boards enable TRACE and DEBUG calls
- /tmp/debug.log is created and appended by all TRACE and DEBUG calls in code
- fix some logic errors seen when no DEBUG entry were outputted in /tmp/debug.log
2023-03-08 12:45:47 -05:00
Jonathon Hall
ff8ec2fd5b
qemu*tpm2*: Manufacture TPM2
Invoke swtpm_setup --create-config-files skip-if-exist to create local
CA files under the current user account, so user does not need
read/write access to /var/lib/swtpm-localca.

Pass --tpm2 to manufacture a TPM2 instead of TPM1.2.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:45 -05:00
Jonathon Hall
4e375ad7ca
tpm2-tools: Remove curl dependency
The actual use of curl was already removed, update tpm2-tools patch to
also remove the check for curl.  Remove the curl module and
CONFIG_CURL.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:44 -05:00
Thierry Laurion
6923fb5e20
Addition of qemu-(fb)whiptail-tpm2(-hotp) boards
-coreboot support of TPM v2.0 (shared config for TPM2 support across all 4 previous variations)
-swtpm set to be launched under TPM v2.0 mode under board config
-Documentation file under each board.md softlinks to qemu-coreboot-fbwhiptail-tpm1.md (which has been generalized)
This is skeleton for TPM v2 integration under Heads

-------------
WiP

TODO:
- libcurl cannot be built as a tpm2-tools dependency as of now not sure why. curl currently needs to be added in board config to be built
- Note: tpm-reset (master and here) needs some review, no handle of no tpm use case. Caller is responsible to not call it otherwise does nothing
- init tries to bind fd and fails currently
- Note: Check if whiptail is different of fbwhiptail in clearing screen. As of now every clear seems to be removed, still whiptail clears previous console output
- When no OS' /boot can be mounted, do not try to TPM reset (will fail)

- seal-hotpkey is not working properly
- setting disk unlock key asks for TPM ownership passphrase (sealing in NV requires ownership, but text is misleading user as if reowning TPM)
  - We should cache input, feed tpm behind the scene and wipe passphrase and state clearly that this is TPM disk unlock kye passphrase.
- primary key from TPM2 is invalid most of the time from kexec-select-boot and verifying global hashes but is setuped correctly at disk unlock key setup
- would be nice to take advantage of bash function tracing to understand where we are for debugging purposes, code takes ash in consideration only
- tpmr says it implements nv calls but actually doesn't. Removing those falsely wrapped functions would help.
  - Implementing them would be better
- REVIEW TODOS IN CODE
- READD CIRCLECI CONFIG

Current state:
- TPM unseal works without disk unlock key and generates TOTP properly (was missing die condition at unseal to not produce always good TOTP even if invalid)
- TPM disk encryption key fails. Hypothesis is that sealing with USB drivers loaded and measures in inconsistent with sealed with/without.
 - TPM disk unsealing happens without USB modules being loaded in non-HOTP setup. This fails.

- Current tests are with fbwhiptail (no clear called so having traces on command line of what happens)
 - Testing with HOTP implementation for sealing/unsealing since that forces USB module loads on each boot to remove this from failing possibilities
2023-03-08 12:45:43 -05:00