Skip to content

Commit 363453f

Browse files
tlauriontlaurion
committed
Merge remote-tracking branch 'osresearch/master' into flashprog
Signed-off-by: Thierry Laurion <[email protected]>
2 parents da240c7 + 523649b commit 363453f

15 files changed

+177
-49
lines changed

‎.circleci/config.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -491,6 +491,13 @@ workflows:
491491
requires:
492492
- librem_14
493493

494+
- build:
495+
name: librem_11
496+
target: librem_11
497+
subcommand: ""
498+
requires:
499+
- librem_14
500+
494501
# dasharo release
495502
- build:
496503
name: nitropad-ns50

‎bin/seed_package_mirror.sh

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#! /usr/bin/env bash
2+
3+
set -eo pipefail
4+
5+
usage() {
6+
cat >&2 <<USAGE_END
7+
$0 <mirror-directory>
8+
9+
Downloads all current package artifacts needed to build Heads and copies them
10+
to a mirror directory, for seeding a package mirror.
11+
12+
Parameters:
13+
<mirror-directory>: Path to a directory where the packages are placed.
14+
Created if it does not already exist.
15+
USAGE_END
16+
}
17+
18+
ARGS_DONE=
19+
while [[ $# -ge 1 ]] && [ -z "$ARGS_DONE" ]; do
20+
case "$1" in
21+
--)
22+
ARGS_DONE=y
23+
shift
24+
;;
25+
--help)
26+
usage
27+
exit 0
28+
;;
29+
--*)
30+
echo "unknown parameter: $1" >&2
31+
usage
32+
exit 1
33+
;;
34+
*)
35+
ARGS_DONE=y
36+
;;
37+
esac
38+
done
39+
40+
if [[ $# -ne 1 ]]; then
41+
usage
42+
exit 1
43+
fi
44+
45+
ARG_MIRROR_DIR="$(realpath "$1")"
46+
47+
cd "$(dirname "${BASH_SOURCE[0]}")/.."
48+
49+
echo
50+
echo "Cleaning build to download all packages..."
51+
# fetch packages for representative boards
52+
rm -rf build/x86 build/ppc64
53+
rm -rf packages/x86 packages/ppc64
54+
echo
55+
echo "Downloading packages..."
56+
make packages BOARD=qemu-coreboot-fbwhiptail-tpm1-hotp
57+
make packages BOARD=talos-2 # newt, PPC
58+
make packages BOARD=librem_l1um_v2 # TPM2
59+
make packages BOARD=librem_l1um # coreboot 4.11
60+
make packages BOARD=x230-maximized # io386
61+
echo
62+
echo "Copying to mirror directory..."
63+
mkdir -p "$ARG_MIRROR_DIR"
64+
cp packages/x86/* packages/ppc64/* "$ARG_MIRROR_DIR/"

‎boards/qemu-coreboot-whiptail-tpm2/qemu-coreboot-whiptail-tpm2.config

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,10 @@ CONFIG_LINUX_CONFIG=config/linux-qemu.config
1717
#export CONFIG_HAVE_GPG_KEY_BACKUP=y
1818

1919
#Enable DEBUG output
20-
export CONFIG_DEBUG_OUTPUT=y
21-
export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y
20+
#export CONFIG_DEBUG_OUTPUT=y
21+
#export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y
2222
#Enable TPM2 pcap output under /tmp
23-
export CONFIG_TPM2_CAPTURE_PCAP=y
23+
#export CONFIG_TPM2_CAPTURE_PCAP=y
2424

2525
#On-demand hardware support (modules.cpio)
2626
CONFIG_LINUX_USB=y

‎config/coreboot-librem_11.config

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ CONFIG_DCACHE_BSP_STACK_SIZE=0x30400
140140
CONFIG_MAX_ACPI_TABLE_SIZE_KB=144
141141
CONFIG_HAVE_INTEL_FIRMWARE=y
142142
CONFIG_MRC_SETTINGS_CACHE_SIZE=0x10000
143-
# CONFIG_DRIVERS_INTEL_WIFI is not set
143+
CONFIG_DRIVERS_INTEL_WIFI=y
144144
CONFIG_IFD_BIN_PATH="3rdparty/purism-blobs/mainboard/purism/librem_jsl/librem_11/flashdescriptor.bin"
145145
CONFIG_ME_BIN_PATH="3rdparty/purism-blobs/mainboard/purism/librem_jsl/librem_11/me.bin"
146146
CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x20000
@@ -563,6 +563,7 @@ CONFIG_USE_PC_CMOS_ALTCENTURY=y
563563
CONFIG_PC_CMOS_BASE_PORT_BANK0=0x70
564564
# CONFIG_DRIVERS_SIL_3114 is not set
565565
CONFIG_DRIVERS_USB_ACPI=y
566+
CONFIG_DRIVERS_WIFI_GENERIC=y
566567
# CONFIG_DRIVERS_MTK_WIFI is not set
567568
CONFIG_MP_SERVICES_PPI=y
568569
CONFIG_MP_SERVICES_PPI_V1=y

‎initrd/bin/cbfs-init

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,17 +15,19 @@ cbfsfiles=`cbfs -t 50 -l 2>/dev/null | grep "^heads/initrd/"`
1515
for cbfsname in `echo $cbfsfiles`; do
1616
filename=${cbfsname:12}
1717
if [ ! -z "$filename" ]; then
18-
echo "Loading $filename from CBFS"
1918
mkdir -p `dirname $filename` \
2019
|| die "$filename: mkdir failed"
21-
cbfs -t 50 -r $cbfsname > "$filename" \
20+
echo "Extracting CBFS file $cbfsname into $filename"
21+
cbfs -t 50 $CBFS_ARG -r $cbfsname > "$filename" \
2222
|| die "$filename: cbfs file read failed"
2323
if [ "$CONFIG_TPM" = "y" ]; then
24-
TMPFILE=/tmp/cbfs.$$
25-
echo "$filename" > $TMPFILE
26-
cat $filename >> $TMPFILE
27-
DEBUG "Extending TPM PCR $CONFIG_PCR with $filename"
28-
tpmr extend -ix "$CONFIG_PCR" -if $TMPFILE \
24+
TRACE_FUNC
25+
echo "TPM: Extending PCR[$CONFIG_PCR] with $filename"
26+
# Measure both the filename and its content. This
27+
# ensures that renaming files or pivoting file content
28+
# will still affect the resulting PCR measurement.
29+
tpmr extend -ix "$CONFIG_PCR" -ic "$filename"
30+
tpmr extend -ix "$CONFIG_PCR" -if "$filename" \
2931
|| die "$filename: tpm extend failed"
3032
fi
3133
fi

‎initrd/bin/gui-init

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -363,7 +363,7 @@ check_gpg_key()
363363
option=$(cat /tmp/whiptail)
364364
case "$option" in
365365
g )
366-
gpg-gui.sh && BG_COLOR_MAIN_MENU="normnal"
366+
gpg-gui.sh && BG_COLOR_MAIN_MENU="normal"
367367
;;
368368
i )
369369
skip_to_menu="true"

‎initrd/bin/kexec-insert-key

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,8 @@ if ! kexec-unseal-key "$INITRD_DIR/secret.key"; then
6565
fi
6666

6767
# Override PCR 4 so that user can't read the key
68-
DEBUG "Extending TPM PCR 4 to prevent further secret unsealing"
68+
TRACE_FUNC
69+
echo "TPM: Extending PCR[4] to prevent any future secret unsealing"
6970
tpmr extend -ix 4 -ic generic ||
7071
die 'Unable to scramble PCR'
7172

‎initrd/bin/kexec-select-boot

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -384,9 +384,10 @@ while true; do
384384
if [ "$CONFIG_TPM" = "y" ]; then
385385
if [ ! -r "$TMP_KEY_DEVICES" ]; then
386386
# Extend PCR4 as soon as possible
387-
DEBUG "Extending TPM PCR 4 to prevent further secret unsealing"
387+
TRACE_FUNC
388+
DEBUG "TPM: Extending PCR[4] to prevent further secret unsealing"
388389
tpmr extend -ix 4 -ic generic ||
389-
die "Failed to extend PCR 4"
390+
die "Failed to extend TPM PCR[4]"
390391
fi
391392
fi
392393

‎initrd/bin/key-init

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,35 @@
11
#!/bin/bash
22
set -e -o pipefail
33
. /etc/functions
4+
. /etc/gui_functions
45

56
TRACE_FUNC
67

78
# Post processing of keys
89

9-
# Import user's keys
10-
gpg --import /.gnupg/keys/*.key /.gnupg/keys/*.asc 2>/dev/null || true
10+
# Good system clock is required for GPG to work properly.
11+
# if system year is less then 2024, prompt user to set correct time
12+
if [ "$(date +%Y)" -lt 2024 ]; then
13+
if whiptail_warning --title "System Time Incorrect" \
14+
--yesno "The system time is incorrect. Please set the correct time." \
15+
0 80 --yes-button Continue --no-button Skip --clear; then
16+
change-time.sh
17+
fi
18+
fi
19+
20+
# Import user's keys if they exist
21+
if [ -d /.gnupg/keys ]; then
22+
# This is legacy location for user's keys. cbfs-init takes for granted that keyring and trustdb are in /.gnupg
23+
# oem-factory-reset generates keyring and trustdb which cbfs-init dumps to /.gnupg
24+
# TODO: Remove individual key imports. This is still valid for distro keys only below.
25+
gpg --import /.gnupg/keys/*.key /.gnupg/keys/*.asc 2>/dev/null || warn "Importing user's keys failed"
26+
fi
1127

1228
# Import trusted distro keys allowed for ISO signing
13-
gpg --homedir=/etc/distro/ --import /etc/distro/keys/* 2>/dev/null || true
29+
gpg --homedir=/etc/distro/ --import /etc/distro/keys/* 2>/dev/null || warn "Importing distro keys failed"
1430
#Set distro keys trust level to ultimate (trust anything that was signed with these keys)
15-
gpg --homedir=/etc/distro/ --list-keys --fingerprint --with-colons|sed -E -n -e 's/^fpr:::::::::([0-9A-F]+):$/\1:6:/p' |gpg --homedir=/etc/distro/ --import-ownertrust 2>/dev/null || true
16-
gpg --homedir=/etc/distro/ --update-trust 2>/dev/null || true
31+
gpg --homedir=/etc/distro/ --list-keys --fingerprint --with-colons|sed -E -n -e 's/^fpr:::::::::([0-9A-F]+):$/\1:6:/p' |gpg --homedir=/etc/distro/ --import-ownertrust 2>/dev/null || warn "Setting distro keys ultimate trust failed"
32+
gpg --homedir=/etc/distro/ --update-trust 2>/dev/null || warn "Updating distro keys trust failed"
1733

1834
# Add user's keys to the list of trusted keys for ISO signing
19-
gpg --export | gpg --homedir=/etc/distro/ --import 2>/dev/null || true
35+
gpg --export | gpg --homedir=/etc/distro/ --import 2>/dev/null || warn "Adding user's keys to distro keys failed"

‎initrd/bin/oem-factory-reset

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ die() {
6262
exit 1
6363
}
6464

65-
whiptail_error() {
65+
local_whiptail_error() {
6666
local msg=$1
6767
if [ "$msg" = "" ]; then
6868
die "whiptail error: An error msg is required"
@@ -71,7 +71,7 @@ whiptail_error() {
7171
}
7272

7373
whiptail_error_die() {
74-
whiptail_error "$@"
74+
local_whiptail_error "$@"
7575
die
7676
}
7777

@@ -1111,7 +1111,7 @@ if [ "$GPG_GEN_KEY_IN_MEMORY" = "n" -o "$GPG_GEN_KEY_IN_MEMORY_COPY_TO_SMARTCARD
11111111
echo -e "\nChecking for USB Security Dongle...\n"
11121112
enable_usb
11131113
if ! gpg --card-status >/dev/null 2>&1; then
1114-
whiptail_error "Can't access USB Security Dongle; \nPlease remove and reinsert, then press Enter."
1114+
local_whiptail_error "Can't access USB Security Dongle; \nPlease remove and reinsert, then press Enter."
11151115
if ! gpg --card-status >/dev/null 2>/tmp/error; then
11161116
ERROR=$(tail -n 1 /tmp/error | fold -s)
11171117
whiptail_error_die "Unable to detect USB Security Dongle:\n\n${ERROR}"

‎initrd/bin/qubes-measure-luks

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ sha256sum /tmp/lukshdr-* >/tmp/luksDump.txt || die "Unable to hash LUKS headers"
1919
DEBUG "Removing /tmp/lukshdr-*"
2020
rm /tmp/lukshdr-*
2121

22-
DEBUG "Extending TPM PCR 6 with hash of LUKS headers from /tmp/luksDump.txt"
22+
TRACE_FUNC
23+
echo "TPM: Extending PCR[6] with hash of LUKS headers from /tmp/luksDump.txt"
2324
tpmr extend -ix 6 -if /tmp/luksDump.txt ||
2425
die "Unable to extend PCR"

‎initrd/bin/tpmr

Lines changed: 38 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,11 @@ else
2929
. /etc/config
3030
fi
3131

32-
TRACE_FUNC
3332

3433
# Busybox xxd lacks -r, and we get hex dumps from TPM1 commands. This converts
3534
# a hex dump to binary data using sed and printf
3635
hex2bin() {
36+
TRACE_FUNC
3737
sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf
3838
}
3939

@@ -43,6 +43,7 @@ hex2bin() {
4343
# as a file still chokes if the password begins with 'hex:', oddly tpm2-tools
4444
# accepts 'hex:' in the file content.)
4545
tpm2_password_hex() {
46+
TRACE_FUNC
4647
echo "hex:$(echo -n "$1" | xxd -p | tr -d ' \n')"
4748
}
4849

@@ -61,7 +62,7 @@ tpm2_pcrread() {
6162

6263
if [ -z "$APPEND" ]; then
6364
# Don't append - truncate file now so real command always
64-
# appends
65+
# overwrites
6566
true >"$file"
6667
fi
6768

@@ -79,7 +80,7 @@ tpm1_pcrread() {
7980

8081
if [ -z "$APPEND" ]; then
8182
# Don't append - truncate file now so real command always
82-
# appends
83+
# overwrites
8384
true >"$file"
8485
fi
8586

@@ -100,11 +101,12 @@ is_hash() {
100101

101102
# extend_pcr_state - extend a PCR state value with more hashes or raw data (which is hashed)
102103
# usage:
103-
# extend_pcr_state <alg> <initial_state> <files/hashes...>
104+
# extend_pcr_state <alg> <state> <files/hashes...>
104105
# alg - either 'sha1' or 'sha256' to specify algorithm
105-
# initial_state - a hash value setting the initial state
106+
# state - a hash value setting the initial state
106107
# files/hashes... - any number of files or hashes, state is extended once for each item
107108
extend_pcr_state() {
109+
TRACE_FUNC
108110
local alg="$1"
109111
local state="$2"
110112
local next extend
@@ -233,14 +235,20 @@ tpm2_extend() {
233235
while true; do
234236
case "$1" in
235237
-ix)
238+
# store index and shift so -ic and -if can be processed
236239
index="$2"
237240
shift 2
238241
;;
239242
-ic)
243+
string=$(echo -n "$2")
240244
hash="$(echo -n "$2" | sha256sum | cut -d' ' -f1)"
245+
TRACE_FUNC
246+
DEBUG "TPM: Will extend PCR[$index] with hash of string $string"
241247
shift 2
242248
;;
243249
-if)
250+
TRACE_FUNC
251+
DEBUG "TPM: Will extend PCR[$index] with hash of file content $2"
244252
hash="$(sha256sum "$2" | cut -d' ' -f1)"
245253
shift 2
246254
;;
@@ -250,7 +258,10 @@ tpm2_extend() {
250258
esac
251259
done
252260
tpm2 pcrextend "$index:sha256=$hash"
253-
DO_WITH_DEBUG tpm2 pcrread "sha256:$index"
261+
tpm2 pcrread "sha256:$index"
262+
263+
TRACE_FUNC
264+
DEBUG "TPM: Extended PCR[$index] with hash $hash"
254265
}
255266

256267
tpm2_counter_read() {
@@ -348,9 +359,9 @@ tpm2_startsession() {
348359
die "tpm2_flushcontext: unable to flush saved session"
349360
tpm2 readpublic -Q -c "$PRIMARY_HANDLE" -t "$PRIMARY_HANDLE_FILE"
350361
#TODO: do the right thing to not have to suppress "WARN: check public portion the tpmkey manually" see https://github.com/linuxboot/heads/pull/1630#issuecomment-2075120429
351-
tpm2 startauthsession -Q -c "$PRIMARY_HANDLE_FILE" --hmac-session -S "$ENC_SESSION_FILE" 2>&1 > /dev/null
362+
tpm2 startauthsession -Q -c "$PRIMARY_HANDLE_FILE" --hmac-session -S "$ENC_SESSION_FILE" > /dev/null 2>&1
352363
#TODO: do the right thing to not have to suppress "WARN: check public portion the tpmkey manually" see https://github.com/linuxboot/heads/pull/1630#issuecomment-2075120429
353-
tpm2 startauthsession -Q -c "$PRIMARY_HANDLE_FILE" --hmac-session -S "$DEC_SESSION_FILE" 2>&1 > /dev/null
364+
tpm2 startauthsession -Q -c "$PRIMARY_HANDLE_FILE" --hmac-session -S "$DEC_SESSION_FILE" > /dev/null 2>&1
354365
tpm2 sessionconfig -Q --disable-encrypt "$DEC_SESSION_FILE"
355366
}
356367

@@ -381,6 +392,7 @@ cleanup_shred() {
381392
# tpm2_destroy: Destroy a sealed file in the TPM. The mechanism differs by
382393
# TPM version - TPM2 evicts the file object, so it no longer exists.
383394
tpm2_destroy() {
395+
TRACE_FUNC
384396
index="$1" # Index of the sealed file
385397
size="$2" # Size of zeroes to overwrite for TPM1 (unused in TPM2)
386398

@@ -396,6 +408,7 @@ tpm2_destroy() {
396408
# TPM version - TPM1 overwrites the file with zeroes, since this can be done
397409
# without authorization. (Deletion requires authorization.)
398410
tpm1_destroy() {
411+
TRACE_FUNC
399412
index="$1" # Index of the sealed file
400413
size="$2" # Size of zeroes to overwrite for TPM1
401414

@@ -761,6 +774,21 @@ if [ "$CONFIG_TPM2_TOOLS" != "y" ]; then
761774
shift
762775
tpm1_destroy "$@"
763776
;;
777+
extend)
778+
#check if we extend with a hash or a file
779+
if [ "$4" = "-if" ]; then
780+
DEBUG "TPM: Will extend PCR[$3] hash content of file $5"
781+
hash="$(sha1sum "$5" | cut -d' ' -f1)"
782+
elif [ "$4" = "-ic" ]; then
783+
string=$(echo -n "$5")
784+
DEBUG "TPM: Will extend PCR[$3] with hash of filename $string"
785+
hash="$(echo -n "$5" | sha1sum | cut -d' ' -f1)"
786+
fi
787+
788+
TRACE_FUNC
789+
DEBUG "TPM: Extending PCR[$3] with hash $hash"
790+
DO_WITH_DEBUG exec tpm "$@"
791+
;;
764792
seal)
765793
shift
766794
tpm1_seal "$@"
@@ -799,6 +827,8 @@ calcfuturepcr)
799827
replay_pcr "sha256" "$@"
800828
;;
801829
extend)
830+
TRACE_FUNC
831+
DEBUG "TPM: Extending PCR[$2] with $4"
802832
tpm2_extend "$@"
803833
;;
804834
counter_read)

0 commit comments

Comments
 (0)