Nitrokey board cleaning+ unification cleanup (enable htop validated autoboot + tethering) #1640

tlaurion · 2024-04-16T21:31:36Z

Edit: UX changes related to this PR state in pictures.

NS50/NV41:

Fixed nitropad-x shared linux config to not have technological debt vs other linux configs under tree (librem config/x230 config received a lot of time for those optimizations, which nitropads were not benefiting)
- no more time wasted building modules that are never included in modules.cpio
- cpu optimization enablement for randomization and kernel crypto backend
- Tethering modules inclusion (25kb cost, next steps is use it to sync time from GUI)
- enable better/disable inefficient crypto algos since kernel is used as crypto backend for cryptsetup
- ... (so much more from past merged pr)
fixed nv41/ns50 coreboot configs to reflect currently used oldconfig (see commit for replication notes with helpers)

qemu//nitropads:

board config uniformization between nitropad/x230/qemu boards, which should be considered reference boards, making it clear what does what until someone gets funds to switch to Kconfig or something.

@daringer : testing notes under commit. Running this on my nv41: all good.
Please approve and use master's commit for your tests/next version.

Todo: firmware upg from zip+ TPMTOTP/HOTP reseal + TPM DUK reseal + TPM DUK based boot + network-init-recovery(usb network tethering+ time sync [auto])

tlaurion · 2024-04-16T22:43:20Z

No regression discovered, all good for tests specified in OP.
@daringer : ready for your ns50 initial test, redo of nv41.

tlaurion

@daringer good?

config/linux-nitropad-x.config

daringer · 2024-04-17T08:24:58Z

very good! testing ns50 asap...

alexgithublab · 2024-04-17T09:05:18Z

@tlaurion @daringer
NS70 (which is the same board as the ns50) tests :

✔️ heads upgrade to this zip
✔️ OEM factory reset
✔️ reset TPM
✔️ refresh TOTP/HOTP
❌ network-init-recovery (no internet interface detected) (Ethernet cable connected)

tlaurion · 2024-04-17T17:06:10Z

@tlaurion @daringer
NS70 (which is the same board as the ns50) tests :

✔️ heads upgrade to this zip
✔️ OEM factory reset
✔️ reset TPM
✔️ refresh TOTP/HOTP
❌ network-init-recovery (no internet interface detected) (Ethernet cable connected)

@alexgithublab not sure what this means. The instructions on screen have been followed? Connect phone when requested (phone in host mode needs to detect data not just power, requiring heads tethering drivers to be loaded prior of phone possibly permitting to activate USB network tethering, and then heads setups tethering against phone). If not, the behavior you see is normal?

Different behavior then nv41?

alexgithublab · 2024-04-18T07:38:22Z

@tlaurion @daringer
NS70 (which is the same board as the ns50) tests :
✔️ heads upgrade to this zip
✔️ OEM factory reset
✔️ reset TPM
✔️ refresh TOTP/HOTP
❌ network-init-recovery (no internet interface detected) (Ethernet cable connected)

@alexgithublab not sure what this means. The instructions on screen have been followed? Connect phone when requested (phone in host mode needs to detect data not just power, requiring heads tethering drivers to be loaded prior of phone possibly permitting to activate USB network tethering, and then heads setups tethering against phone). If not, the behavior you see is normal?

Different behavior then nv41?

@tlaurion

I'm using a Pixel 5 with GrapheneOS and I'm not able to get tethering network working on heads.
Hotspot is turn on the phone and I tried to only connect it and then do network-init-recovery and I also tried to enable the USB network sharing but the result is the same.
Otherwise the script behavior is okay.

tlaurion · 2024-04-18T14:21:09Z

config/linux-nitropad-x.config

@@ -1900,7 +1756,7 @@ CONFIG_FB_CFB_IMAGEBLIT=y
 # CONFIG_FB_ASILIANT is not set
 # CONFIG_FB_IMSTT is not set
 # CONFIG_FB_VGA16 is not set
-CONFIG_FB_VESA=y
+# CONFIG_FB_VESA is not set


@nestire: might be the cause of #1641

Was enabled under nitrokey 2.4.1 https://github.com/Nitrokey/heads/blob/50e03c1cfe8ce2cb1d7ad2c43c15d17d05c82dc1/config/linux-nitropad-x.config#L1902

tlaurion · 2024-04-18T14:29:01Z

config/linux-nitropad-x.config

@@ -1003,7 +1009,7 @@ CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y
 # CONFIG_ISCSI_IBFT is not set
 # CONFIG_FW_CFG_SYSFS is not set
 CONFIG_SYSFB=y
-# CONFIG_SYSFB_SIMPLEFB is not set
+CONFIG_SYSFB_SIMPLEFB=y


@nestire: 2.4.1 was not pushing this compared to master https://github.com/Nitrokey/heads/blob/50e03c1cfe8ce2cb1d7ad2c43c15d17d05c82dc1/config/linux-nitropad-x.config#L1005

Might be cause for #1641?

initrd/bin/gui-init

initrd/bin/kexec-boot

initrd/bin/oem-factory-reset

initrd/bin/seal-hotpkey

initrd/etc/functions

tlaurion · 2024-04-20T16:34:49Z

So only relevant changes under https://github.com/linuxboot/heads/compare/521c0b039ea95c9133566944d2e4bc29a9772507..16f1d07867ddca9a5feee1f9541e2a7cc52d3b4a outside of rebasing on master and removing irrelevant changes here:

shared linux config being exactly the same as librems now, good or bad to be determined
coreboot config changed to match as close as possible librem_11 here which is also GOP GB driven.

OP and comments here to be hidden/review resolved since splitted under #1642 and merged in master yesterday to ease debugging forward.

tlaurion · 2024-04-20T17:04:26Z

@tlaurion @daringer
NS70 (which is the same board as the ns50) tests :
✔️ heads upgrade to this zip
✔️ OEM factory reset
✔️ reset TPM
✔️ refresh TOTP/HOTP
❌ network-init-recovery (no internet interface detected) (Ethernet cable connected)

@alexgithublab not sure what this means. The instructions on screen have been followed? Connect phone when requested (phone in host mode needs to detect data not just power, requiring heads tethering drivers to be loaded prior of phone possibly permitting to activate USB network tethering, and then heads setups tethering against phone). If not, the behavior you see is normal?

Different behavior then nv41?

@tlaurion

I'm using a Pixel 5 with GrapheneOS and I'm not able to get tethering network working on heads.
Hotspot is turn on the phone and I tried to only connect it and then do network-init-recovery and I also tried to enable the USB network sharing but the result is the same.
Otherwise the script behavior is okay.

What this unfortunately means for the Pixel 5, which is EOL from Google but in extended support under GrapheneOS, is as said in the warning when enabling tethering, that RNDIS (Microsoft tethering technology) enables tethering on those phones, not CDC. If CDC was enabling tethering, then tethering would work following on screen instructions there.
RNDIS is not supported.

I tested on Pixel 4a 5G and Pixel 6a, which both supports CDC tethering, and where, generally, USB-C snapdragon platform based SoC phones will support CDC for tethering. Unfortunately, there is not really good documentation on which phone supports CDC for tethering, so it's trial and error, where laptops having an Ethernet port can fallback to it to have on-demand connectivity. I also gathered a quick table under
#1384 (comment)

I will open an issue on documenting tethering support to track this better. This is also one of the reason why it's not currently enabled through GUI and hidden down from launching a script, to easy time synchronisation mostly, for the moment

Tldr: the phones currently in Nitrokey shop (3a+ = Pixel 6+) should work. Librem phones work. For other LineageOS phones, experience will vary depending on what tethering technology is enforced. For Replicant, I highly doubt anything other then RNDIS is supported there, which heads won't include for discussed reasons (including security implications) on merged PR.
We could add RNDIS support if there is push for it, but it would come with a big fat warning.

iPhones won't be supported since support requires additional proprietary tooling and extended kernel modules as well which older devices won't have space for.

Originally posted by @tlaurion in #1640 (comment)

alexgithublab · 2024-04-22T09:28:20Z

@tlaurion
Just tested the tethering with a pixel 6a on a NS70 (NS50 board) and it worked so yes I think you're right about CDC is not supported on pixel 5.

tlaurion · 2024-04-24T22:39:10Z

@alexgithublab @daringer : no regression here? I can merge? @daringer can you approve?

I think #1641 (comment) should be considered independently for PR, we need stop mixing everything together preventing quick merges of PR.

tlaurion · 2024-04-25T17:50:27Z

Putting in draft since I'm reviewing changes against defconfigs (coreboot) and need confirmation on values there prior of things to be physically tested.

tlaurion · 2024-04-25T18:13:12Z

config/linux-nitropad-x.config

+# CONFIG_USB_OHCI_HCD is not set
+# CONFIG_USB_UHCI_HCD is not set


@daringer: no usb1/usb2 ports right?

tlaurion · 2024-04-25T18:14:55Z

config/linux-nitropad-x.config

@@ -2746,7 +2564,7 @@ CONFIG_HARDENED_USERCOPY=y
 # CONFIG_STATIC_USERMODEHELPER is not set
 # CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set
 CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,bpf"
+CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf"


@daringer not sure if this change is desired but landlock is for sandboxing. Nothing uses it under Heads as of now

https://docs.kernel.org/security/landlock.html

tlaurion · 2024-04-25T19:09:59Z

@daringer

nv41: flashed 22373f7 , resealed TOTP/HOTP, DUK renewed: booted under latest Q4.2.1

boards/nitropad-ns50/nitropad-ns50.config

We moved all the things I commented on to a separate PR

tlaurion · 2024-04-25T19:16:22Z

@daringer @alexgithublab @JonathonHall-Purism ready for final review (and test on ns50 which I don't have)

@JonathonHall-Purism commits touch librems but final files changes not relevant/not touching them.

@alexgithublab @daringer see commit messages. I made those steps reproducible so that you can learn how to use current helpers properly to see changes. The master coreboot configurations were outdated and relevant to an older coreboot version, which makes it really difficult to understand which coreboot options are impacting or not something.

As a reminder defconfig permits to check changes against default config options relevant to a certain coreboot version.
This commit shows differences in defconfig format 4de6782

After that, latest commit puts those configs back to oldconfig format which permits to compare boards against each other.
Please review my own review's comments and validate that everything is kosher for you, interacting upstream if needed.

@alexgithublab nothing really to report that could explain #1641 without providing logs there as requested.

I think we should merge this ASAP.

JonathonHall-Purism · 2024-04-25T19:25:14Z

Looks good to me, will let the NK folks give the approval since they are most familiar with these boards 👍

tlaurion

Cbfs size needs to be reverted.

tlaurion · 2024-04-26T06:52:12Z

config/coreboot-nitropad-ns50.config

@@ -114,23 +119,23 @@ CONFIG_DIMM_SPD_SIZE=512
 CONFIG_FMDFILE=""
 # CONFIG_NO_POST is not set
 CONFIG_MAINBOARD_VENDOR="Notebook"
-CONFIG_CBFS_SIZE=0x1000000


Definitely changing this was wrong as it makes the board build fail for ns50. Will revert that change later.

@daringer: reverted changes under 6582f49

tlaurion · 2024-04-26T16:32:47Z

@daringer @alexgithublab it is to be noted that the bug related to #1641 might already have resolved itself if coreboot version and configs were bumped to latest dasaharo+heads 1.7.2 novacustom coreboot release where of course, there is no dasharo+heads release for the ns50, leading to more low level work required on your side to make it working.

Changes since

heads/modules/coreboot

Line 94 in b2629f8

coreboot-nitrokey_commit_hash := 1bcb338682b612cfcca8bba02846f78139b2e0c8

The dasharo+heads referred commit vs Heads used coreboot commit (more then 2 months of features + bugfixes there between Heads used coreboot commit and upstream which I have not skimmed through):
https://github.com/Dasharo/coreboot/compare/1bcb338682b612cfcca8bba02846f78139b2e0c8..3a9aa3a4692f3dd49732f5b4e3ec54be385f0969

@daringer @alexgithublab : I would of course recommend staying as close as possible from Novacustom's coreboot fork's commit to not duplicate downstream work (heads and nitrokey releases based forks related issues) related to firmware related bugs that may already be fixed or not, and collaborate upstream there.

Heads uses coreboot and is not coreboot. I do not have the resources to debug things there, that is why 3mdeb are coreboot developers and provide dasharo subscription, and why I am not pretending to be a coreboot developer myself.

tlaurion · 2024-04-26T17:25:51Z

Alternate testing branch at https://github.com/tlaurion/heads/tree/nitrokey_board_unification_clean-enable_htop_validated_autoboot-novacustom_coreboot_version_bump

Note that both branches add board's config "KERNEL_ADD='debug'" so that more output can be provided from OS boot to help troubleshoot #1641. Great, required GPU blobs are now present under initramfs, but why they are not loaded is still not explainable.

tlaurion · 2024-04-27T00:28:10Z

@daringer @alexgithublab both this PR and attempted novacustom's dasharo+head 1.7.2 pointed commit in their release is testable now.

If Ubuntu was installed with firmware blobs, please test and report here results.

Note that the initramfs content not lib directory content from installer should be reported, just like @nestire report above.

@daringer cc

tlaurion · 2024-05-03T16:17:30Z

Will rebase on master.

… nitrokey boards: enable Automatic boot when HOTP valid after 5 seconds Signed-off-by: Thierry Laurion <insurgo@riseup.net>

…nst each other - Add tethering in board configs - Add autoboot after 5 seconds if HOTP remote attestation is successful Signed-off-by: Thierry Laurion <insurgo@riseup.net>

TODO: fix discrepencies in kernel config to limit technological debt in later commit in this PR Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Result of: make BOARD=nitropad-nv41 coreboot.save_in_oldconfig_format_in_place make BOARD=nitropad-ns50 coreboot.save_in_oldconfig_format_in_place No change, was applied like this anyway at compilation. Signed-off-by: Thierry Laurion <insurgo@riseup.net>

… config (GOP compliant) TODO: next, readd what might have been pertinent Signed-off-by: Thierry Laurion <insurgo@riseup.net>

git difftool -d HEAD^ to check config against previous version (librem shared config), noticed I2C options being maybe relevant, added them back in Then saved with make BOARD=nitropad-ns50 linux.modify_and_save_oldconfig_in_place Signed-off-by: Thierry Laurion <insurgo@riseup.net>

tlaurion · 2024-05-03T18:44:26Z

@daringer @alex-nitrokey
tested on nv41 with b65e8bf

HOTP autoboot
tethering

We should try to reduce delays between PR and merge since upstream is used in forks...

@daringer please approve.

Bumping to newer version of coreboot will happen in other PR. As said #1640 (comment) another branch was made to ease your porting. Seal commits, adapt, and do PR in draft mode so we can iterate. This pr is about making board configuration as clean as possible, making current coreboot oldconfig files coherent to present version used and add tetheting and hotp autoboot in board configs and tethering requirements under shared linux config, based on librems, where librem 11 FB is GOP enabled.

Only thing here to evaluated if goal of this PR is now mixed with #1641 being fixed would be to check librem11 config against ns50/nv41. I would appreciate collaboration here or under Matrix to make things fixed upstream as fast as possible, more for nv41 since otherwise double work for me with novacustom bug reports and support. Let's improve collaboration.

tlaurion · 2024-05-10T18:20:08Z

This takes way too long without justifcations. Using my maintainer veto and merging. Hope I will never have to do this again.

tlaurion commented Apr 16, 2024

View reviewed changes

config/linux-nitropad-x.config Show resolved Hide resolved

nestire mentioned this pull request Apr 17, 2024

Ubuntu 24.04 LTS/24.10 misses efifb in initramfs (upstream bug) #1641

Open

This was referenced Apr 17, 2024

main.c: remove output when RET_NO_PIN_ATTEMPTS (no PIN retry counter) is true Nitrokey/nitrokey-hotp-verification#32

Closed

V1.5 : NK3 currently accepts any PIN on HOTP secret sealing Nitrokey/nitrokey-hotp-verification#30

Closed

tlaurion force-pushed the nitrokey_board_unification_clean-enable_htop_validated_autoboot branch from 1b35b9f to 35aff5c Compare April 17, 2024 20:20

This comment was marked as outdated.

Sign in to view

tlaurion mentioned this pull request Apr 17, 2024

Nitrokey hangs when switching between libnitrokey and GnuPG Nitrokey/libnitrokey#137

Open

tlaurion force-pushed the nitrokey_board_unification_clean-enable_htop_validated_autoboot branch 3 times, most recently from a68fe24 to bfe67ab Compare April 17, 2024 23:01

tlaurion commented Apr 18, 2024

View reviewed changes

tlaurion force-pushed the nitrokey_board_unification_clean-enable_htop_validated_autoboot branch 3 times, most recently from fa70cba to ae5f9c5 Compare April 18, 2024 20:31

tlaurion mentioned this pull request Apr 18, 2024

Improve DEBUG and DO_WITH_DEBUG output handling to also keep output of DO_WITH_DEBUG commands #1642

Merged

JonathonHall-Purism previously requested changes Apr 18, 2024

View reviewed changes

tlaurion force-pushed the nitrokey_board_unification_clean-enable_htop_validated_autoboot branch from 521c0b0 to 16f1d07 Compare April 20, 2024 16:27

tlaurion mentioned this pull request Apr 21, 2024

Document CDC tethering support linuxboot/heads-wiki#149

Open

tlaurion commented Apr 25, 2024

View reviewed changes

tlaurion marked this pull request as ready for review April 25, 2024 19:10

tlaurion assigned alexgithublab, daringer and JonathonHall-Purism Apr 25, 2024

JonathonHall-Purism reviewed Apr 25, 2024

View reviewed changes

boards/nitropad-ns50/nitropad-ns50.config Outdated Show resolved Hide resolved

tlaurion commented Apr 26, 2024

View reviewed changes

tlaurion marked this pull request as draft May 3, 2024 16:16

WiP: Boards configuration unification between x230-hotp-maximized and…

865a0c6

… nitrokey boards: enable Automatic boot when HOTP valid after 5 seconds Signed-off-by: Thierry Laurion <insurgo@riseup.net>

tlaurion force-pushed the nitrokey_board_unification_clean-enable_htop_validated_autoboot branch from 6da1ed2 to 0f3cd02 Compare May 3, 2024 17:03

tlaurion added 2 commits May 3, 2024 13:29

boards: uniformize nitropad boards with qemu-coreboot boards and agai…

60e0d60

…nst each other - Add tethering in board configs - Add autoboot after 5 seconds if HOTP remote attestation is successful Signed-off-by: Thierry Laurion <insurgo@riseup.net>

config/linux-nitropad-x.config: Add Tethering requirements

0f412ed

TODO: fix discrepencies in kernel config to limit technological debt in later commit in this PR Signed-off-by: Thierry Laurion <insurgo@riseup.net>

tlaurion force-pushed the nitrokey_board_unification_clean-enable_htop_validated_autoboot branch from 0f3cd02 to 0f412ed Compare May 3, 2024 17:30

tlaurion added 3 commits May 3, 2024 13:35

config/linux-nitropad-x.config: bring par with librem_11 shared linux…

862f58f

… config (GOP compliant) TODO: next, readd what might have been pertinent Signed-off-by: Thierry Laurion <insurgo@riseup.net>

tlaurion marked this pull request as ready for review May 3, 2024 18:44

tlaurion mentioned this pull request May 3, 2024

Nitrokey boards coreboot version bump to match Dasharo+Heads heads+ coreboot version used in their v0.9.0 - 2024-02-29 BOM #1662

Merged

2 tasks

tlaurion merged commit 77f1e34 into linuxboot:master May 10, 2024
36 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Nitrokey board cleaning+ unification cleanup (enable htop validated autoboot + tethering) #1640

Nitrokey board cleaning+ unification cleanup (enable htop validated autoboot + tethering) #1640

tlaurion commented Apr 16, 2024 •

edited

Loading

tlaurion commented Apr 16, 2024 •

edited

Loading

tlaurion left a comment

daringer commented Apr 17, 2024

alexgithublab commented Apr 17, 2024 •

edited

Loading

tlaurion commented Apr 17, 2024 •

edited

Loading

This comment was marked as outdated.

This comment was marked as outdated.

alexgithublab commented Apr 18, 2024

tlaurion Apr 18, 2024 •

edited

Loading

tlaurion Apr 18, 2024 •

edited

Loading

tlaurion commented Apr 20, 2024 •

edited

Loading

tlaurion commented Apr 20, 2024 •

edited

Loading

alexgithublab commented Apr 22, 2024

tlaurion commented Apr 24, 2024 •

edited

Loading

tlaurion commented Apr 25, 2024

tlaurion Apr 25, 2024

tlaurion Apr 25, 2024

tlaurion commented Apr 25, 2024 •

edited

Loading

tlaurion commented Apr 25, 2024 •

edited

Loading

JonathonHall-Purism commented Apr 25, 2024

tlaurion left a comment

tlaurion Apr 26, 2024

tlaurion Apr 26, 2024

tlaurion commented Apr 26, 2024 •

edited

Loading

tlaurion commented Apr 26, 2024

tlaurion commented Apr 27, 2024

tlaurion commented May 3, 2024

tlaurion commented May 3, 2024 •

edited

Loading

tlaurion commented May 10, 2024 •

edited

Loading

		# CONFIG_USB_OHCI_HCD is not set
		# CONFIG_USB_UHCI_HCD is not set

Nitrokey board cleaning+ unification cleanup (enable htop validated autoboot + tethering) #1640

Nitrokey board cleaning+ unification cleanup (enable htop validated autoboot + tethering) #1640

Conversation

tlaurion commented Apr 16, 2024 • edited Loading

tlaurion commented Apr 16, 2024 • edited Loading

tlaurion left a comment

Choose a reason for hiding this comment

daringer commented Apr 17, 2024

alexgithublab commented Apr 17, 2024 • edited Loading

tlaurion commented Apr 17, 2024 • edited Loading

This comment was marked as outdated.

This comment was marked as outdated.

alexgithublab commented Apr 18, 2024

tlaurion Apr 18, 2024 • edited Loading

Choose a reason for hiding this comment

tlaurion Apr 18, 2024 • edited Loading

Choose a reason for hiding this comment

tlaurion commented Apr 20, 2024 • edited Loading

tlaurion commented Apr 20, 2024 • edited Loading

alexgithublab commented Apr 22, 2024

tlaurion commented Apr 24, 2024 • edited Loading

tlaurion commented Apr 25, 2024

tlaurion Apr 25, 2024

Choose a reason for hiding this comment

tlaurion Apr 25, 2024

Choose a reason for hiding this comment

tlaurion commented Apr 25, 2024 • edited Loading

tlaurion commented Apr 25, 2024 • edited Loading

JonathonHall-Purism commented Apr 25, 2024

tlaurion left a comment

Choose a reason for hiding this comment

tlaurion Apr 26, 2024

Choose a reason for hiding this comment

tlaurion Apr 26, 2024

Choose a reason for hiding this comment

tlaurion commented Apr 26, 2024 • edited Loading

tlaurion commented Apr 26, 2024

tlaurion commented Apr 27, 2024

tlaurion commented May 3, 2024

tlaurion commented May 3, 2024 • edited Loading

tlaurion commented May 10, 2024 • edited Loading

tlaurion commented Apr 16, 2024 •

edited

Loading

tlaurion commented Apr 16, 2024 •

edited

Loading

alexgithublab commented Apr 17, 2024 •

edited

Loading

tlaurion commented Apr 17, 2024 •

edited

Loading

tlaurion Apr 18, 2024 •

edited

Loading

tlaurion Apr 18, 2024 •

edited

Loading

tlaurion commented Apr 20, 2024 •

edited

Loading

tlaurion commented Apr 20, 2024 •

edited

Loading

tlaurion commented Apr 24, 2024 •

edited

Loading

tlaurion commented Apr 25, 2024 •

edited

Loading

tlaurion commented Apr 25, 2024 •

edited

Loading

tlaurion commented Apr 26, 2024 •

edited

Loading

tlaurion commented May 3, 2024 •

edited

Loading

tlaurion commented May 10, 2024 •

edited

Loading