Add support for Acer Chromebook 515 Plus (CB515-2H) / Google Omnigul Platform #1658

mdrobnak · 2024-04-30T04:22:03Z

Implementation of Issue #1663.

This is implemented using the @MrChromebox Coreboot. Linux 6.1.90, Linux 6.5.13, 6.6.30 all work to recognize the UFS storage. This PR uses 6.6.30.

Version 4.22.01 of Coreboot does not have the Intel ME, VBT, or Flash Descriptor, thus MrChromeBox is used.

Items tested:

Issues:

Sealing Disk Unlock Key into TPM does not work.

Configuration Sources:
Linux Configuration based on linux-nitropad-x.config
Coreboot Configuration based on MrChromeBox UEFI configuration. Modified to have Linux payload as per the wiki's instructions.

tlaurion · 2024-05-01T22:44:03Z

@mdrobnak nice!

sign your commits and do commit --signoff
add the board under .circleci/config.yml

We will move from there? You can also join matrix channel and ping me from there, while I prefer PR to be examples for boards porting.

boards/omnigul/omnigul.config

modules/linux

boards/omnigul/omnigul.config

tlaurion

Thanks for this contribution! now let's make this build! Put as draft this PR until ready to be tested by others and to prevent people from bricking their laptop until ready!

mdrobnak · 2024-05-01T23:10:08Z

@mdrobnak nice!

sign your commits and do commit --signoff

add the board under .circleci/config.yml

We will move from there? You can also join matrix channel and ping me from there, while I prefer PR to be examples for boards porting.

Ok I'll get this going shortly.

tlaurion · 2024-05-24T19:35:13Z

@mdrobnak please merge master in this branch and keep this PR updated with the most verbose trail of what your state is, others might chime in and make your progress less lonely :)

Board configuration from: nitropad-nv41. Linux configuration from: linux-nitropad-x.config Coreboot configuration from: MrChromeBox EDK2 configuration for omnigul. Signed-off-by: Matthew Drobnak <[email protected]>

Signed-off-by: Matthew Drobnak <[email protected]>

modules/linux

tlaurion · 2024-05-28T16:49:12Z

config/coreboot-omnigul.config

+CONFIG_TPM_GOOGLE=y
+CONFIG_TPM_GOOGLE_CR50=y
+CONFIG_TPM_GOOGLE_IMMEDIATELY_COMMIT_FW_SECDATA=y
+CONFIG_GOOGLE_TPM_IRQ_TIMEOUT_MS=100


Might be too small. Is there timeouts in dmesg?

Not that I've seen. I can try modifying that.

mdrobnak · 2024-05-28T16:52:57Z

Disk Unlock:

user@heads-devel:/media$ cat cbmem_L.log 
TPM2 log:
	Specification: 2.00
	Platform class: PC Client
TPM2 log entry 1:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: 648fd22dbf689a7facd6f6935170dd740bce45c36a7831032e71eb180078ab0c
	Event data: FMAP: FMAP
TPM2 log entry 2:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: 03796d2e280f07673cb9f6c013443378ffb8290ea709babb83550af82fc940cd
	Event data: CBFS: bootblock
TPM2 log entry 3:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: e2fee1a8472d4986e5a142c5d15f162835854ea772f0e86d1379a554d4f4ea21
	Event data: CBFS: fallback/romstage
TPM2 log entry 4:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: 20f555dbb6678b91b75f4d635df597bca7cc6cf2ff477e22bc6e1df6bbea61cb
	Event data: CBFS: fspm.bin
TPM2 log entry 5:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: 7c52722fdf3eb612144c9e3747fe05dbbcf9e02811a505f6cdd33494da78fc1d
	Event data: CBFS: spd.bin
TPM2 log entry 6:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: 388468b7b064bf27b13e49d91f6c80d6313a1ea226d9ebfc82aa260382d1bb30
	Event data: CBFS: fallback/postcar
TPM2 log entry 7:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: ad2053fd5b97f52d3a25edea9500ba0f697accd467d9a6e0f7a3bc22c0a8270b
	Event data: CBFS: fallback/ramstage
TPM2 log entry 8:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: 970fbc1d69d801604a09967036dbf1c07c514c30a2835a4a53a5295372346b88
	Event data: CBFS: cpu_microcode_blob.bin
TPM2 log entry 9:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: 3dc0ba24e5dd1c8a2d7880cf6e40e169eb92e193b68d838ad69be08f6cc9a2a6
	Event data: CBFS: fsps.bin
TPM2 log entry 10:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: 83c94bebba28305531ac7fa841f5075754fec72582fb8ef770e81bd430aadc49
	Event data: CBFS: vbt.bin
TPM2 log entry 11:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: c9b940f1866ecd4fb8f23a622a17b1b42b59be2dff09d7bc8e8e1a9fb62a8c5b
	Event data: CBFS: fallback/dsdt.aml
TPM2 log entry 12:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: 2f045194201a13dcffaadf1b295b5d8b156a51e7ca8fb93b05c8927bc2391d9e
	Event data: CBFS: bootsplash.jpg
TPM2 log entry 13:
	PCR: 2
	Event type: Action
	Digests:
		 SHA256: 42e8453008e55c6383763e0ea91699203443bc52ccb259e8185a3ae3d861d3f8
	Event data: CBFS: fallback/payload
user@heads-devel:/media$

Attaching debug.log as that's larger.
debug.log

Signed-off-by: Matthew Drobnak <[email protected]>

Use MrChromeBox Coreboot and Linux 6.6.30. Add CircleCI Board config. Signed-off-by: Matthew Drobnak <[email protected]>

tlaurion · 2024-05-28T19:53:33Z

As written under matrix thread for this updated PR at https://matrix.to/#/!pAlHOfxQNPXOgFGTmo:matrix.org/$VKP1ynETRMavsOqy3SqUf_nadPUgyoSC9H_13y8Dpjo?via=matrix.org&via=nitro.chat&via=fairydust.space

The white rabbit to be followed is why CR50 TPM refuses to to add TPM DUK nv region into TPM which doesn't seem supported on CR50 not sure why:

TRACE: /bin/tpmr(32): main
TRACE: /bin/tpmr(413): tpm2_seal
DEBUG: tpm2_seal: file=/tmp/secret/secret.key handle=0x81000003 pcrl=0,1,2,3,4,5,6,7 pcrf=/tmp/secret/pcrf.bin pass=<hidden>
LOG: tpmr stderr: WARNING:esys:src/tss2-esys/api/Esys_PolicyPassword.c:292:Esys_PolicyPassword_Finish() Received TPM Error 
LOG: tpmr stderr: ERROR:esys:src/tss2-esys/api/Esys_PolicyPassword.c:106:Esys_PolicyPassword() Esys Finish ErrorCode (0x000b0143) 
LOG: tpmr stderr: ERROR: Esys_PolicyPassword(0xB0143) - rmt:error(2.0): command code not supported
LOG: tpmr stderr: ERROR: Could not build policyauthvalue TPM
LOG: tpmr stderr: ERROR: Unable to run policypassword

boards/omnigul/omnigul.config

mdrobnak · 2024-05-28T20:45:25Z

Attached are two files:
debug_reset_tpm_sign_reboot.log
That file is boot, reset TPM, sign /boot files, copy logs, reboot. (sealing succeeds with policy)

debug_after_reboot_attempt_duk_seal.log
After rebooting, go to OS boot menu, set default, attempt to add Disk Unlock Key. (selling fails with policy)

Tlaurion edit: fail/success notes in parenthesis

…515-2H) / Google Omnigul.

tlaurion · 2024-08-07T15:20:47Z

TLDR: Chromebooks have a fTPM which differs from dTPM (documentation and understanding is missing to be supported correctly from the TPM toolstack), correct @mdrobnak ?

Putting this as draft until this is worked seperately.

tlaurion · 2024-09-06T14:01:57Z

@mdrobnak revisiting because interest at https://matrix.to/#/!pAlHOfxQNPXOgFGTmo:matrix.org/$E4N2td-clfQq3IP4F4v_04oSLABpj-Kcm5rNVvDgi30?via=matrix.org&via=nitro.chat&via=envs.net

Not all boards support TPM DUK, and can today be deactivated as a possibility through CONFIG_TPM_NO_LUKS_DISK_UNLOCK that can be added into board config as can be seen checked at

heads/initrd/bin/kexec-save-default

Line 190 in b28c257

    
           if [ "$CONFIG_TPM" = "y" ] && [ "$CONFIG_TPM_NO_LUKS_DISK_UNLOCK" != "y" ] && [ "$CONFIG_BASIC" != y ]; then

Until TPM DUK (seperate secret sealing nvram region issue figured out), Chromebooks could be supported with this bfeature missing? Thoughts?

tlaurion reviewed May 1, 2024

View reviewed changes

boards/omnigul/omnigul.config Outdated Show resolved Hide resolved

tlaurion reviewed May 1, 2024

View reviewed changes

modules/linux Outdated Show resolved Hide resolved

tlaurion reviewed May 1, 2024

View reviewed changes

boards/omnigul/omnigul.config Show resolved Hide resolved

tlaurion requested changes May 1, 2024

View reviewed changes

tlaurion marked this pull request as draft May 1, 2024 22:49

mdrobnak force-pushed the google_omnigul branch from 018b4c7 to 557c088 Compare May 4, 2024 04:40

mdrobnak mentioned this pull request May 5, 2024

Add support for Acer Chromebook 515 Plus (CB515-2H) / Google Omnigul Platform #1663

Open

mdrobnak force-pushed the google_omnigul branch from 557c088 to a291bcf Compare May 28, 2024 03:09

mdrobnak added 2 commits May 28, 2024 03:11

Add support for MrChromeBox coreboot fork.

ac2823f

Signed-off-by: Matthew Drobnak <[email protected]>

mdrobnak force-pushed the google_omnigul branch from a291bcf to 0edf836 Compare May 28, 2024 03:11

mdrobnak marked this pull request as ready for review May 28, 2024 16:41

tlaurion self-assigned this May 28, 2024

tlaurion reviewed May 28, 2024

View reviewed changes

modules/linux Outdated Show resolved Hide resolved

tlaurion reviewed May 28, 2024

View reviewed changes

mdrobnak added 4 commits May 28, 2024 18:54

Add Support for Linux 6.6.30 (same patches a 4.9.80).

b8edf35

Signed-off-by: Matthew Drobnak <[email protected]>

Update omnigul base linux config (Nitropad NV41) to Linux 6.6.

1f08624

Signed-off-by: Matthew Drobnak <[email protected]>

Save Omnigul coreboot config in oldconfig format before making changes.

efa665a

Signed-off-by: Matthew Drobnak <[email protected]>

Add support for Acer Chromebook 515 Plus (CB515-2H) / Google Omnigul

5c5f61e

Use MrChromeBox Coreboot and Linux 6.6.30. Add CircleCI Board config. Signed-off-by: Matthew Drobnak <[email protected]>

mdrobnak force-pushed the google_omnigul branch from 0edf836 to 5c5f61e Compare May 28, 2024 18:54

tlaurion reviewed May 28, 2024

View reviewed changes

boards/omnigul/omnigul.config Show resolved Hide resolved

During testing, enable Debug logging for Acer Chromebook 515 Plus (CB…

aad0461

…515-2H) / Google Omnigul.

tlaurion marked this pull request as draft August 7, 2024 15:20

This was referenced Nov 16, 2024

Chromebook cr50: not able to seal secret in nvram tpm2-software/tpm2-tools#3434

Open

TPM 2.0 with Cr50 MrChromebox/firmware#626

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for Acer Chromebook 515 Plus (CB515-2H) / Google Omnigul Platform #1658

Add support for Acer Chromebook 515 Plus (CB515-2H) / Google Omnigul Platform #1658

mdrobnak commented Apr 30, 2024 •

edited

Loading

tlaurion commented May 1, 2024

tlaurion left a comment

mdrobnak commented May 1, 2024

tlaurion commented May 24, 2024

tlaurion May 28, 2024

mdrobnak May 28, 2024

mdrobnak commented May 28, 2024

tlaurion commented May 28, 2024

mdrobnak commented May 28, 2024 •

edited by tlaurion

Loading

tlaurion commented Aug 7, 2024

tlaurion commented Sep 6, 2024

Add support for Acer Chromebook 515 Plus (CB515-2H) / Google Omnigul Platform #1658

Are you sure you want to change the base?

Add support for Acer Chromebook 515 Plus (CB515-2H) / Google Omnigul Platform #1658

Conversation

mdrobnak commented Apr 30, 2024 • edited Loading

tlaurion commented May 1, 2024

tlaurion left a comment

Choose a reason for hiding this comment

mdrobnak commented May 1, 2024

tlaurion commented May 24, 2024

tlaurion May 28, 2024

Choose a reason for hiding this comment

mdrobnak May 28, 2024

Choose a reason for hiding this comment

mdrobnak commented May 28, 2024

tlaurion commented May 28, 2024

mdrobnak commented May 28, 2024 • edited by tlaurion Loading

tlaurion commented Aug 7, 2024

tlaurion commented Sep 6, 2024

mdrobnak commented Apr 30, 2024 •

edited

Loading

mdrobnak commented May 28, 2024 •

edited by tlaurion

Loading