Kuldax

[loftlifter31]

• [X ] Successful external flash link to circleci: https://X.Y.Z. from commit X.Y.Z. using external programmer model Raspberry Pi on 3.3 Voltage mode
• [ X] Boots successfully after the flashing:
• Setting clock prompt on first reboot: ok if triggered correctly after initial flashing and CMOS battery disconnected
• [X ] Clean boot detected (no keyring, nothing installed on disk): usb boot proposed and followed
• Boots on usb
• OS X.Y.Z. install and reboot
• Heads functionality- no pubkey detected, but OS detected -> OEM-Factory-reset proposed. Done with X.Y.Z. hardwarekey e.g. nk3
• On reboot after re-ownership: generate new HOTP/TOTP
• wifi works based on OS X.Y.Z.
• PR0
  • flashprog -p internal (not locked)
  • lock_chip (locks the platform with PR0, if PR0 patch applied in fork or under patches/coreboot-X.Y.Z. and coreboot config contain proper preparation of the platform)
  • flashprog -p internal (reports locked

[loftlifter31]

***WARNING: No TPM Primary handle. You must reset TPM to seal secret to TPM NVRAM ***
!!!ERROR: Unable to unseal TOTP secret from TPM !!!
ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: No such file or directory
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0
ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpm0: No such file or directory
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:254:tctldr_get_default() No standard TCTI could be loaded
ERROR:tcti:src/tss2-tcti/tctildr.c:428:Tss2_TctiLdr_Initiialize_Ex() Failed to instantiate TCTI
ERROR: Could not load tcti, got: "(null)"

[loftlifter31]

ASUS Chromebox 5 (CN67) KULDAX [CR50 (SuzyQ)] https://cros.tech/device/kuldax/

[cwiggs]

I think you want x86_musl_cross_make here? Looks like the job has underscores but a lot of other places it's dashes.

[loftlifter31]

Maybe it's a typo in the docs. https://osresearch.net/Porting/#circleci

[tlaurion]

If kano was used as a base under board's config to point at mrchromebox for, the .circleci config would become

requires:
            - kano [seed:coreboot-mrchromebox-26.03]

and moved under kano boards for that fork, depending on coreboot cache created by kano

# Downstream boards: kano, kano-hotp
      - x86_coreboot:
          name: kano [seed:coreboot-mrchromebox-26.03]
          target: kano
          subcommand: ""
          coreboot_dir: coreboot-mrchromebox-26.03
          requires:
            - x86-musl-cross-make [cross compiler]

      # kano-hotp (seeded by kano)
      - build:
          name: kano-hotp
          target: kano-hotp
          subcommand: ""
          requires:
            - kano [seed:coreboot-mrchromebox-26.03]

      - build:
          name: kuldax-hotp
          target: kuldax-hotp
          subcommand: ""
          requires:
             - kano [seed:coreboot-mrchromebox-26.03]

      - build:
          name: kuldax
          target: kuldax
          subcommand: ""
          requires:
             - kano [seed:coreboot-mrchromebox-26.03]

I doubt you will have needed fsp, ME etc if not based on mrchromebox fork, just like my tests showed under kano port https://github.com/linuxboot/heads/pull/2133/commits

[tlaurion]

Sorry for prior noise, docs fixed under linuxboot/heads-wiki@f2c5fd0

Format for musl-cross-make is x86-musl-cross-make [cross compiler]
But here, it would be preferable to depend on the mrchromebox seed as in prior comment anyway as explained why there.

[tlaurion]

Maybe it's a typo in the docs. https://osresearch.net/Porting/#circleci

circleci configs changed and docs didn't follow. I wonder if its good for maintainability do even document keywords that might change again, but maybe point to https://github.com/linuxboot/heads/blob/master/doc/circleci.md

That's the danger in trying to document things at multiple places. Some gets forgotten, sorry and thanks for flagging

Anything that should be documented differently? Since this might move as code, I guess osresearch.net should point to code doc/circleci.md. Thoughts?

[loftlifter31]

I doubt you will have needed fsp, ME etc if not based on mrchromebox fork

Not sure about fsp but I'm pretty sure ME is required regardless of fork.

[tlaurion]

I doubt you will have needed fsp, ME etc if not based on mrchromebox fork

Not sure about fsp but I'm pretty sure ME is required regardless of fork.

Interesting. For Kano, blobs were missing under upstream which made us switch back to mrchromebox. I left the attempt in commit messages and switched back to mrchromebox fork see around bc0764e

[tlaurion]

I doubt you will have needed fsp, ME etc if not based on mrchromebox fork

Not sure about fsp but I'm pretty sure ME is required regardless of fork.

Agreed by can be disabled in ifd as per post fix integrated in kano

[cwiggs]

Setting clock prompt on first reboot: ok if triggered correctly after initial flashing and CMOS battery disconnected

Unless you removed the battery I don't think you'll need to do this.

Did you use a SuzyQ device to flash this device initially?

[cwiggs]

Might want to set this to CONFIG_HOTPKEY=n (uncommented). I'm not sure if the default is already n or not, @tlaurion do you know what the default value is?

[tlaurion]

hotp board enable CONFIG_HOTPKEY=y

that is if users have a reverse hotp supported dongle by the hotp_verification toolset developped by nitrokey and of course supported in fw see https://osresearch.net/Prerequisites#usb-security-dongle-compatibility

TLDR: non-hotp boards should be copied over non-hotp board variant for proper example (so future devs can infer this, but no: modules enablement is per board configs unless modules are required for all boards

Those are deployed by default if not turned off under current master

grep -Rn "?= y" modules/
modules/busybox:2:CONFIG_BUSYBOX ?= y
modules/exfatprogs:2:CONFIG_EXFATPROGS ?= y
modules/e2fsprogs:2:CONFIG_E2FSPROGS ?= y
modules/zstd:3:CONFIG_ZSTD ?= y
modules/zlib:1:CONFIG_ZLIB ?= y
modules/musl-cross-make:1:CONFIG_MUSL ?= y

[loftlifter31]

Done

[cwiggs]

#2133 also might help, it was the first ChromeOS port for Heads.

lets get the CI building and go from there.

[cwiggs]

Also curious if the SD card is going to work. I don't think Heads has support for the SD card reader.

[loftlifter31]

Setting clock prompt on first reboot: ok if triggered correctly after initial flashing and CMOS battery disconnected

Unless you removed the battery I don't think you'll need to do this.

Did you use a SuzyQ device to flash this device initially?

Yes. SuzyQ.

[tlaurion]

Also curious if the SD card is going to work. I don't think Heads has support for the SD card reader.

We can add it, what is the sdcard reader?

[tlaurion]

@loftlifter31 why are you not reusing mrchromebox fork like kano as a base?

[loftlifter31]

I saw a comment from Mr.Chromebox that he didn't make any changes in his fork that would be important to this project. I thought it would be simpler to use a standard build if there is no reason to use the fork. I have built with both and flashed both. Didn't see any difference in functionality.

[tlaurion]

I saw a comment from Mr.Chromebox that he didn't make any changes in his fork that would be important to this project. I thought it would be simpler to use a standard build if there is no reason to use the fork. I have built with both and flashed both. Didn't see any difference in functionality.

That is not true. Descriptor and other proper blobs were only provided in the mrchromebox fork but it seems that was true only for Kano might be irrelevant here.

[tlaurion]

exactly. so we must depend on mrchromebox fork.

[tlaurion]

is there an intel based Ehternet card here?

[loftlifter31]

There is gigabit ethernet. I don't have the manufacturer info at the moment.

[tlaurion]

Please provide basic HCL here so heads-wiki changes can reflect this later on

Example from Kano

# Configuration for a Acer Chromebook Spin 714 (CP714-1WN/2WN/KANO)
# Intel iGPU "UHD Graphics", 12th Gen Intel Core i5-1235U, 8GB RAM
# CAVEATS: TPM_GPIO_RESET=NOT_VULNERABLE -- Google CR50 on I2C (bus 0x1, addr 0x50) is a separate MCU not driven by the PCH PLTRST# multifunction GPIO pad; the discrete-TPM PLTRST# reprogramming attack cannot reset the CR50
# See doc/TPM_GPIO_Reset_Vulnerability.md for details.
# 256GB NVMe Storage, Intel AX211 Wi-FI 6E, 

# 32MB Winbond Chip W25Q256JV_M - SuzyQ cable used to flash with ccd.

# Hardware compatibility: Google Kano (Acer CP714-1WN, brya) — Alder Lake (12th gen), max 16 GB RAM (soldered; 8 GB base configs), TPM 2.0 (Google H1/GSC), Active.
# Full details: https://osresearch.net/Hardware-Compatibility/#board-kano

So please prepare heads-wiki pr at the same time so both can be merged at once cross-linking to each other in thir expected final state.

[loftlifter31]

Done

[tlaurion]

please reuse/specialize kano linux config and then use modules/linux helpers

./docker_repro.sh make BOARD=kuldax linux.modify_and_save_oldconfig_in_place

And commit changes. defconfigs are way easier to compare between boards for deviations from defaults.

Question is: do we even need a specialized linux config for kuldax or could reuse kano's?

Question in PR was sdcard reader. To be followed; if both kano and kuldax have the same needed drivers at firmware level, then both could share the same linux config otherwise justifying the specialization of config to maintain

[cwiggs]

Question in PR was sdcard reader. To be followed; if both kano and kuldax have the same needed drivers at firmware level, then both could share the same linux config otherwise justifying the specialization of config to maintain

Kano does not have an SD card reader but a lot of the Chromebox devices do, e.g. my HP Chromebox G2 has an SD card reader.

[loftlifter31]

please reuse/specialize kano linux config and then use modules/linux helpers

Why would I use the config for a different hardware when there is a coreboot config specifically for kuldax?

[tlaurion]

Please use and specialize kano config with help of make helpers from modules/coreboot

./docker_repro.sh make BOARD=kuldax coreboot.modify_and_save_oldconfig_in_place
./docker_repro.sh make BOARD=kuldax coreboot.modify_defconfig_in_place
./docker_repro.sh make BOARD=kuldax coreboot.save_as_defconfig_backup something something

And commit changes. defconfigs are way easier to compare between boards for deviations from defaults.

[tlaurion]

***WARNING: No TPM Primary handle. You must reset TPM to seal secret to TPM NVRAM *** !!!ERROR: Unable to unseal TOTP secret from TPM !!! ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: No such file or directory ERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0 ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpm0: No such file or directory ERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0 ERROR:tcti:src/tss2-tcti/tctildr-dl.c:254:tctldr_get_default() No standard TCTI could be loaded ERROR:tcti:src/tss2-tcti/tctildr.c:428:Tss2_TctiLdr_Initiialize_Ex() Failed to instantiate TCTI ERROR: Could not load tcti, got: "(null)"

Most probably a linux config issue, if coreboot does the right thing and is able to do its work, but et again as of now, you are using standard upstream without blobs fro mrchromebox so i'm confused.

Anyway, logs tell the truth.

From the recovery shell can you (with ext3/ext4/exfat/fat32 formatted usb thumb drive)

mount-usb --mode rw
cbmem -L > /media/cbmem_measured_boot.txt
cbmem -c > /media/cbmem_console.log
dmesg > /media/dmesg.txt
umount /media

For each steps of the future "it doesn't work" related issues? thanks for your contribution @loftlifter31 and be patient with the process! Feel free to open issues or PR against the porting guide as you go, or i'll do my best to correct things but fresh eyes are always welcome fixing as we go with this port.

[cwiggs]

Here is a TODO list:

• Update CircleCI build to depend on MrChromebox's upstream coreboot instead of x86-musl-cross-make example
• Set CONFIG_HOTPKEY=n for non-HOTP build and CONFIG_HOTPKEY=y for hotp build.
• Create Kuldax specialized config: source
• Respond to various comments here, mainly from @tlaurion .
• Create a corresponding heads wiki PR. Example Heads PR .
• Update Original TODO in the first comment.

@loftlifter31 Let me know if that all makes sense and how I can help. If I don't hear back in a couple days I'll create my own branch based on this with the above fixes, you can then pull that into this PR.

[tlaurion]

***WARNING: No TPM Primary handle. You must reset TPM to seal secret to TPM NVRAM ***
!!!ERROR: Unable to unseal TOTP secret from TPM !!!
ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: No such file or directory
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0
ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpm0: No such file or directory
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:254:tctldr_get_default() No standard TCTI could be loaded
ERROR:tcti:src/tss2-tcti/tctildr.c:428:Tss2_TctiLdr_Initiialize_Ex() Failed to instantiate TCTI
ERROR: Could not load tcti, got: "(null)"

Wrong TPM driver in Linux config?

[tlaurion]

My general advice @loftlifter31 would be to follow
Fizz port at #2225

Linux config and modules/linux has been modified to include sdcard reader, TPM was figured out(I think, different then Kano cr50 previous config).

I was not telling you to base config/corrboot* on Kano but compare your generated config_defconfig backup against Kano to see deviations to defaults all matching, being different boards but requiring same deviations to work under heads. And same for linux, while helper for defconfig backup pr was made but not yet merged.

If you have any question let us know, but previous review needs fixing so circleci build your board and gives us things to review for posterity. Thanks!