New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Server port to ASUS KGPE-D16 #134

Closed
tlaurion opened this Issue Mar 21, 2017 · 16 comments

Comments

Projects
None yet
3 participants
@tlaurion
Copy link
Contributor

tlaurion commented Mar 21, 2017

Would that make sense? Using Qubes as a server spinner for Qubes seems like a nice and practical experiment.

  1. Having a server that would validate its status prior to passphrase validation (local or even remote openbmc).
  2. It is possible to use Qubes in server mode (kinda)
  3. It is possible to have 16mb of flash on that beast, that can boot libreboot/coreboot without binary blobs.
@osresearch

This comment has been minimized.

Copy link
Owner

osresearch commented Mar 21, 2017

This is a very good idea. There is the beginning of a server build of heads in the moc branch to support the Mass Open Cloud project's end-to-end attested design.

@osresearch

This comment has been minimized.

Copy link
Owner

osresearch commented Mar 21, 2017

Does it have a TPM? That is a fairly hard requirement for measured boot and the attestation system.

@tlaurion

This comment has been minimized.

Copy link
Contributor

tlaurion commented Mar 21, 2017

Does it have a TPM? That is a fairly hard requirement for measured boot and the attestation system.

TPM YES With Owner Controlled CRTM - TPM is an option addon module

@osresearch : It has a 20-1 header, which normally support TGC 1.2, but there is some TPM enforcing TGC 2.0 for 20-1 pins headers. Any advice on what might be supported best?

@osresearch osresearch added the server label Mar 28, 2017

@tlaurion

This comment has been minimized.

Copy link
Contributor

tlaurion commented May 8, 2017

@tlaurion

This comment has been minimized.

Copy link
Contributor

tlaurion commented Nov 20, 2017

Forgot to update : OpenBMC port was made. Need to test.
https://www.raptorengineering.com/coreboot/kgpe-d16-bmc-port-status.php

@tlaurion

This comment has been minimized.

Copy link
Contributor

tlaurion commented Jan 28, 2018

@flammit @osresearch

Porting is on it's way!
Heads boots, but the TPM is wrongly detected as a version 1.2 instead of 2.0 resulting in ownership being impossible. Investigating.
This branch includes RaptorEngineer's flashrom patches so that OpenBMC can be flashed from within Heads.

Actual boot trace: KGPE-D16-No_TPM.txt

@tlaurion

This comment has been minimized.

Copy link
Contributor

tlaurion commented Jan 28, 2018

@zaolin : Any input on TPM initialization issues encountered in the above trace?

Exerpt of coreboot wrongly detecting the 2.0 TPM as 1.2:

TPM initialization.
TPM: Init
Found TPM SLB9660 TT 1.2 by Infineon
TPM: Open
TPM: Startup
TPM: command 0x99 returned 0x1e
TPM: Error code 0x1e.

@osresearch

This comment has been minimized.

Copy link
Owner

osresearch commented Jan 28, 2018

This is great news. Glad to hear that progress is being made on the KGPE-D16.

Regarding TPM 2.0, we really need to figure out the best way to work with them. Issue #287 begins to address it, but we'll also need to find a lightweight library that works well with it (and decide if we want to support fTPM systems).

@paulmenzel

This comment has been minimized.

Copy link
Contributor

paulmenzel commented Jan 28, 2018

@tlaurion, please bring the issue up on the coreboot mailing list or submit an issue to the coreboot bug tracker with your config, the commit hash and the full boot log.

@paulmenzel

This comment has been minimized.

Copy link
Contributor

paulmenzel commented Jan 28, 2018

Also, as far as I understood the Linux TPM folks, the Linux kernel should be able to work around broken firmware and set up the TPM by itself. If not, please try with latest Linux master, and report an issue to the Linux kernel TPM folks.

@tlaurion

This comment has been minimized.

Copy link
Contributor

tlaurion commented Jan 31, 2018

@paulmenzel: the thing is that we want TPM being initialised and used to measure romstage and ramstage BEFORE Linux enters fully in play.

This patch resolves the issue of SLB9665 TPM2.0 being detected and initialized as a SLB9660 TPM1.2.

Here is my patch against flammit's heads' coreboot 4.7, and my branch, missing proper TPM2.0 tools to use the initialized TPM.

Boot log exerpt:

lpc_tpm: Read reg 0xf00 returns 0x1a15d1
Found TPM SLB9665 TT 2.0 by Infineon
TPM: Open

@paulmenzel

This comment has been minimized.

Copy link
Contributor

paulmenzel commented Jan 31, 2018

@tlaurion

This comment has been minimized.

Copy link
Contributor

tlaurion commented Feb 23, 2018

Work continues here.

From there, Heads boots, initializes SL9665 TPM 2.0 chipset, but usage of TPM doesn't work, since no libraries included do support 2.0. So TPM support in heads is there but unused for the moment.

Patch set includes RaptorEngineering's flashrom patches to flash openbmc from within heads. It also contains coreboot patches so that kvm chip can obtain memory access prior to releasing it to coreboot. So openbmc works, permits internal flashing (updates) and updates of kgpe-d16 heads updates both from within heads.

Missing:


make CONFIG=config/kgpe-d16-generic.config -j4
sha256sum kgpe-d16.rom
0d1f6f20b12026b7f20a33a1930957c9e3ecc539384401426e88986a5d32bab3 kgpe-d16.rom

@tlaurion

This comment has been minimized.

Copy link
Contributor

tlaurion commented Feb 27, 2018

Pull request

KGPE-D16 is now officially supported by Heads! This workstation/server board supports Qubes perfectly (HVM/IOMMU/HAP/SLAT/TPM/Remapping)! A RYF server board, serving as a base for reasonably secure computing. Note the TPM2 support is still missing from a toolset perspective.

Based on flammit's modifications made atop of this branch

  • Ported to the new build system. Building the kgpe-d16 image is made by make BOARD=kgpe-d16
  • Reduced the coreboot patches needed to the minimum, permitting KVM (SMBs) chip to boot (IKVM4 and others).
  • Reduced flashrom patches to the bare minimal, permitting KVM chip to be flashed from within heads.
  • Xen boots from multiboot grub generated configuration. No more firmware updates every time Qubes issues a QSB! You just have to sign new configuration!

Usage:

  • Fist flash heads externally on a W25Q128FVSG SOP8 chip soldered on top of a SOP8 SO8 SOIC8 TO DIP8 adapter through an EEPROM CH341A flasher, supported by flashrom.
  • Flammit submitted dropbear support into heads, so it is possible to interact with heads externally from SSH or by console through an USB to serial adapter (RS232 RS-232 Female Serial to USB 2.0 Cable Adapter)
  • The system boots without outputting console to the vga graphic card until the system setups it's own console (both coreboot, heads and password output are sent to serial console and KVM). Connect to the KVM chip through SSH, which gets it's IP from DHCP, or from the static IP setuped in board configuration if desired. I connect to the system from serial console with screen /dev/ttyS0 115200. Disconnect and kill screen session with ctrl-a ctrl-\
  • Flashing heads update firmwares is done through flashrom-kgpe-d16.sh /media/coreboot.rom
  • Qubes disk password is asked through OpenBMC console/serial console.

Limitation:

  • It is currently impossible to reflash the kvm chip from within the kvm. It's possible to do it from the physical serial port console or dropbear ssh connection opened from heads. I prefer to do it from a serial to USB connection from my Qubes laptop through sudo minicom -D /dev/ttyUSB0 then flashrom-kgpe-d16-openbmc.sh /media/flash-asus-20180122172732. Do not forget to turn off REST API access and to change default SSH password when building OpenBMC

Still missing:


make BOARD=kgpe-d16 -j4

@tlaurion

This comment has been minimized.

Copy link
Contributor

tlaurion commented Mar 2, 2018

@tlaurion

This comment has been minimized.

Copy link
Contributor

tlaurion commented Mar 10, 2018

KGPE-D16 support is merged into Heads!

Still missing:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment