Read and measure CBFS files into initrd #357

flammit · 2018-03-12T01:39:33Z

Closes #182 and depends on PR #355. Allows the user to add files such as keys to the reproducibly-build coreboot.rom via cbfstool as long as there CBFS name is prefixed as initrd/*:

./build/coreboot-4.7/x230/cbfstool ./build/x230/coreboot.rom add -t raw -f ~/.ssh/id_rsa.pub -n "initrd/.ssh/authorized_keys"
./build/coreboot-4.7/x230/cbfstool ./build/x230/coreboot.rom add -t raw -f ~/.gnupg/pubring.gpg -n "initrd/.gnupg/pubring.gpg"
./build/coreboot-4.7/x230/cbfstool ./build/x230/coreboot.rom add -t raw -f ~/.gnupg/secring.gpg -n "initrd/.gnupg/secring.gpg"
./build/coreboot-4.7/x230/cbfstool ./build/x230/coreboot.rom add -t raw -f ~/.gnupg/trustdb.gpg -n "initrd/.gnupg/trustdb.gpg"

Tested on x230.

flammit · 2018-03-13T00:47:47Z

Also successfully tested measurement by altering CBFS file name and data with flashtool on x230 after TOTP seal

paulmenzel · 2018-03-13T15:05:11Z

initrd/bin/network-init-recovery

+	# TODO: setup DHCP if available
+	ifconfig eth0 > /dev/ttyprintk
+
+	# Setup the ssh server, allow root logins and log to stderr


The verb is spelled with a space Set up.

paulmenzel · 2018-03-13T15:05:32Z

initrd/bin/network-init-recovery

+	if [ ! -z "$CONFIG_BOOT_STATIC_IP" ]; then
+		ifconfig eth0 $CONFIG_BOOT_STATIC_IP
+	fi
+	# TODO: setup DHCP if available


The verb is spelled with a space Set up.

paulmenzel · 2018-03-13T15:05:46Z

initrd/bin/network-init-recovery

+fi
+
+if [ -e /sys/class/net/eth0 ]; then
+	# Setup static IP


The verb is spelled with a space Set up.

paulmenzel · 2018-03-13T15:06:34Z

initrd/bin/network-init-recovery

+
+if [ -f /lib/modules/e1000e.ko ]; then
+	insmod /lib/modules/e1000e.ko
+fi


The modules are device specific, right? Should that depend on some configuration?

They are device specific. I could use the variables in module/linux that control the inclusion of the kernel modules (CONFIG_LINUX_E1000, CONFIG_LINUX_E1000E, CONFIG_LINUX_IGB, CONFIG_LINUX_SFC, CONFIG_LINUX_MLX4) and export them in all the board configs, but that's equivalent to testing for existence in the initrd. @osresearch what do you think?

osresearch · 2018-03-16T14:25:35Z

I'm so excited to merge this so that we can move the user config and volatile things out of the initrd.

The cbfs reader patch should be sent as a patch to https://github.com/osresearch/flashtools so that we don't have the maintain it as a patch. I hear the owner of that tree accepts PRs.

In QEMU when I last tried to read the ROM from /dev/mem it fails due to something not being mapped. /proc/iomem does not contain physmap-flash, which is likely why it doesn't show up. As a total hack, if I comment out this check in read_mem() in linux-4.9.80/drivers/char/mem.c, qemu is able to dump the contents of the ROM via /dev/mem:

if (!valid_phys_addr_range(p, count))

So it is something in the way that the memory map is being communicated to qemu that prevents us from being able to see the ROM.

We could patch the Heads kernel to allow this, although it would be good to know why it is not communicated.

flammit · 2018-03-20T03:47:56Z

Confirmed, in QEMU the /dev/mem reads fail in the current cbfs command, but using the busybox devmem tool and your peek work:

~# devmem 0xfffffffc
0xFF900138
~# devmem 0xff900138
0x4342524F

I'll fix cbfs.c up to work in QEMU by using your map_physical before pushing the patch to https://github.com/osresearch/flashtools.

kakaroto · 2018-03-21T21:35:06Z

I really like this solution! Great work!
flashtools doesn't work for me (on skylake) but I already reviewed the skylake port of flashrom so I should still know what needs to be done for it to work and I'll look into it soon.

kakaroto

Another review will probably happen on the flashtools repo once you send the PR but here's a preliminary one!

kakaroto · 2018-03-21T21:35:35Z

patches/flashtools.patch

+	  if (lseek(fd, off, SEEK_SET) == -1) {
+	    fprintf(stderr, "Failed to seek to next CBFS offset %lx\n", off);
+	    return EXIT_FAILURE;
+	  }


Indentation is wrong here

kakaroto · 2018-03-21T21:35:53Z

patches/flashtools.patch

+		if (read(fd, &file, sizeof(struct cbfs_file)) < 0) {
+			fprintf(stderr, "Failed to read cbfs file header\n");
+			return EXIT_FAILURE;
+	  }


Indentation of this closing bracket is wrong.

kakaroto · 2018-03-21T21:36:55Z

patches/flashtools.patch

+			printf("File name              : '%s'\n", name);
+		}
+
+		if (do_list && file.type == 0x50) {


The magic number here should be made into a macro.. I'm assuming 0x50 is FILE_TYPE_RAW?
Also, I don't think it's necessary for the specific task the tool was written for but the file type could/should probably be given as argument to the program.

kakaroto · 2018-03-21T22:05:57Z

patches/flashtools.patch

+	uint32_t align = header.align;
+	// loop through files
+	uint64_t off = end - ((uint64_t) header.romsize) + ((uint64_t) header.offset);
+	while (1) {


Instead of an infinite loop (which breaks when it's outside the bounds of the cbfs), it would be better to do :
while (off < end) {

kakaroto · 2018-03-21T22:07:43Z

patches/flashtools.patch

+			}
+
+			char *file_data = malloc(file.len);
+			if (read(fd, file_data, file.len) < 0) {


Verify file_data was allocated correctly.. A corrupted image could cause you to try and allocate GBs of data which would fail.

kakaroto · 2018-03-21T22:08:02Z

patches/flashtools.patch

+		}
+
+		size_t name_size = file.offset - sizeof(struct cbfs_file);
+		char *name = calloc(name_size, sizeof(char));


name is allocated but never freed.

kakaroto · 2018-03-21T22:08:13Z

patches/flashtools.patch

+			if (verbose) {
+				printf("\n-------- End Data\n");
+			}
+			do_read++;


Maybe break once the file is read ?

kakaroto · 2018-03-21T22:08:53Z

patches/flashtools.patch

+
+	uint64_t end = 0x100000000;
+	if (verbose) {
+		printf("Seeking to %lx\n", end-4);


Since you print the file to stdout, all the verbose printfs should probably go to sdterr.

flammit · 2018-03-22T16:36:02Z

@kakaroto thanks for the comments! I'll incorporate them into the upcoming https://github.com/osresearch/flashtools PR

flammit · 2018-03-23T04:00:00Z

The cbfs command PR is now up at osresearch/flashtools#3. Please review there and I'll adjust this PR once that is merged.

also fix verbiage in comments

Also added convenience call to import keys and removed credentials

flammit · 2018-04-20T17:48:14Z

@osresearch PTAL should be good to review and merge. I've tested on qemu-coreboot.

You should now be able to add keys just as:

./build/coreboot-4.7/qemu-coreboot/cbfstool ./build/qemu-coreboot/coreboot.rom add -t raw -f ~/.ssh/id_rsa.pub -n "initrd/.ssh/authorized_keys"
./build/coreboot-4.7/qemu-coreboot/cbfstool ./build/qemu-coreboot/coreboot.rom add -t raw -f ~/keys/49FFCE9C.key -n "initrd/.gnupg/keys/49FFCE9C.key"

Needed to identify which files should be preserved between upgrades such as "heads/initrd/*" or "heads/counter"

flammit · 2018-04-20T22:13:41Z

Minor change to require that cbfs file names be prefixed as heads/initrd/*. The idea is that any CBFS file with the prefix heads/ will attempt to be preserved between ROM updates.

./build/coreboot-4.7/qemu-coreboot/cbfstool ./build/qemu-coreboot/coreboot.rom add -t raw -f ~/.ssh/id_rsa.pub -n "heads/initrd/.ssh/authorized_keys"
./build/coreboot-4.7/qemu-coreboot/cbfstool ./build/qemu-coreboot/coreboot.rom add -t raw -f ~/keys/49FFCE9C.key -n "heads/initrd/.gnupg/keys/49FFCE9C.key"

flammit · 2018-04-22T00:24:53Z

By default, both flashrom-x230.sh and flashrom-kgpe-d16.sh now use preserve_rom in /etc/function to inject previously loaded, non-conflicting heads/* files into new update ROMs prior to flashing.

Tested on x230 and kgpe-d16

osresearch · 2018-04-30T20:14:39Z

modules/linuxboot

@@ -74,4 +79,5 @@ linuxboot.run: $(build)/$(BOARD)/linuxboot.rom
 		BOARD:=$(linuxboot_board) \
 		KERNEL=$(build)/$(BOARD)/bzImage \
 		INITRD=$(build)/$(BOARD)/initrd.cpio.xz \
+		CUSTOM=$(CUSTOMPWD) \


What is $CUSTOMPWD?

flammit changed the title ~~Read and measure CBFS files into initrd~~ WIP: Read and measure CBFS files into initrd Mar 12, 2018

tlaurion mentioned this pull request Mar 12, 2018

Server port to ASUS KGPE-D16 #134

Closed

paulmenzel reviewed Mar 13, 2018

View reviewed changes

flammit mentioned this pull request Mar 15, 2018

Too many configuration options #367

Open

kakaroto reviewed Mar 21, 2018

View reviewed changes

flammit force-pushed the cbfs-init branch from dbbbaef to 0da3e29 Compare March 22, 2018 16:29

flammit mentioned this pull request Mar 31, 2018

Support for a more flexible GPG auth model #376

Closed

tlaurion mentioned this pull request Apr 17, 2018

Add basic CBFS command to list and read files osresearch/flashtools#3

Merged

flammit added 4 commits April 20, 2018 09:29

Read and measure CBFS files into initrd during init

37feebd

Add all supported network modules to network-init-recovery

d0294b1

also fix verbiage in comments

Update cbfs-init script for new cbfs tool option

e0c1ab2

Update flashtools patch with latest

8b1d194

flammit force-pushed the cbfs-init branch from d41609b to 8b1d194 Compare April 20, 2018 16:30

Drop unnecessary flashtools.patch

8644a36

Also added convenience call to import keys and removed credentials

flammit changed the title ~~WIP: Read and measure CBFS files into initrd~~ Read and measure CBFS files into initrd Apr 20, 2018

Add "heads/" prefix to all Heads-related cbfs files

48ca75a

Needed to identify which files should be preserved between upgrades such as "heads/initrd/*" or "heads/counter"

Preserve custom CBFS files on flashrom updates

1cbae3c

Add flashtool to all coreboot-based boards

789c2db

flammit mentioned this pull request Apr 29, 2018

TPM reset command should be followed by removing /boot/kexec* #381

Closed

tlaurion mentioned this pull request Apr 29, 2018

Offer: Installation service merge/skulls#12

Closed

Read and measure an EFI file into initrd during init

c0f3a4b

osresearch reviewed Apr 30, 2018

View reviewed changes

osresearch merged commit c0f3a4b into linuxboot:master Apr 30, 2018

osresearch mentioned this pull request Apr 30, 2018

exclude gnupg keyring files from revision control #332

Closed

flammit deleted the cbfs-init branch May 6, 2018 02:00

tlaurion mentioned this pull request Aug 5, 2018

KGPE-D16 port (no TPM) #335

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Read and measure CBFS files into initrd #357

Read and measure CBFS files into initrd #357

flammit commented Mar 12, 2018 •

edited

Loading

flammit commented Mar 13, 2018

paulmenzel Mar 13, 2018

paulmenzel Mar 13, 2018

paulmenzel Mar 13, 2018

paulmenzel Mar 13, 2018

flammit Mar 14, 2018

osresearch commented Mar 16, 2018

flammit commented Mar 20, 2018

kakaroto commented Mar 21, 2018

kakaroto left a comment

kakaroto Mar 21, 2018

kakaroto Mar 21, 2018

kakaroto Mar 21, 2018

kakaroto Mar 21, 2018

kakaroto Mar 21, 2018

kakaroto Mar 21, 2018

kakaroto Mar 21, 2018

kakaroto Mar 21, 2018

flammit commented Mar 22, 2018

flammit commented Mar 23, 2018

flammit commented Apr 20, 2018 •

edited

Loading

flammit commented Apr 20, 2018 •

edited

Loading

flammit commented Apr 22, 2018 •

edited

Loading

osresearch Apr 30, 2018

Read and measure CBFS files into initrd #357

Read and measure CBFS files into initrd #357

Conversation

flammit commented Mar 12, 2018 • edited Loading

flammit commented Mar 13, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

osresearch commented Mar 16, 2018

flammit commented Mar 20, 2018

kakaroto commented Mar 21, 2018

kakaroto left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

flammit commented Mar 22, 2018

flammit commented Mar 23, 2018

flammit commented Apr 20, 2018 • edited Loading

flammit commented Apr 20, 2018 • edited Loading

flammit commented Apr 22, 2018 • edited Loading

Choose a reason for hiding this comment

flammit commented Mar 12, 2018 •

edited

Loading

flammit commented Apr 20, 2018 •

edited

Loading

flammit commented Apr 20, 2018 •

edited

Loading

flammit commented Apr 22, 2018 •

edited

Loading