Server port to ASUS KGPE-D16

[tlaurion]

Would that make sense? Using Qubes as a server spinner for Qubes seems like a nice and practical experiment.

1. Having a server that would validate its status prior to passphrase validation (local or even remote openbmc).
2. It is possible to use Qubes in server mode (kinda)
3. It is possible to have 16mb of flash on that beast, that can boot libreboot/coreboot without binary blobs.

[osresearch]

This is a very good idea. There is the beginning of a server build of heads in the moc branch to support the Mass Open Cloud project's end-to-end attested design.

[osresearch]

Does it have a TPM? That is a fairly hard requirement for measured boot and the attestation system.

[tlaurion]

Does it have a TPM? That is a fairly hard requirement for measured boot and the attestation system.

TPM YES With Owner Controlled CRTM - TPM is an option addon module

@osresearch : It has a 20-1 header, which normally support TGC 1.2, but there is some TPM enforcing TGC 2.0 for 20-1 pins headers. Any advice on what might be supported best?

[tlaurion]

Supports Infineon module.
http://anzwix.com/a/Coreboot/Mbasuskgped16AddTPMSupport

[tlaurion]

Forgot to update : OpenBMC port was made. Need to test.
https://www.raptorengineering.com/coreboot/kgpe-d16-bmc-port-status.php

[tlaurion]

@flammit @osresearch

Porting is on it's way!
Heads boots, but the TPM is wrongly detected as a version 1.2 instead of 2.0 resulting in ownership being impossible. Investigating.
This branch includes RaptorEngineer's flashrom patches so that OpenBMC can be flashed from within Heads.

Actual boot trace: KGPE-D16-No_TPM.txt

[tlaurion]

@zaolin : Any input on TPM initialization issues encountered in the above trace?

Exerpt of coreboot wrongly detecting the 2.0 TPM as 1.2:

TPM initialization.
TPM: Init
Found TPM SLB9660 TT 1.2 by Infineon
TPM: Open
TPM: Startup
TPM: command 0x99 returned 0x1e
TPM: Error code 0x1e.

[osresearch]

This is great news. Glad to hear that progress is being made on the KGPE-D16.

Regarding TPM 2.0, we really need to figure out the best way to work with them. Issue #287 begins to address it, but we'll also need to find a lightweight library that works well with it (and decide if we want to support fTPM systems).

[paulmenzel]

@tlaurion, please bring the issue up on the coreboot mailing list or submit an issue to the coreboot bug tracker with your config, the commit hash and the full boot log.

[paulmenzel]

Also, as far as I understood the Linux TPM folks, the Linux kernel should be able to work around broken firmware and set up the TPM by itself. If not, please try with latest Linux master, and report an issue to the Linux kernel TPM folks.

[tlaurion]

@paulmenzel: the thing is that we want TPM being initialised and used to measure romstage and ramstage BEFORE Linux enters fully in play.

This patch resolves the issue of SLB9665 TPM2.0 being detected and initialized as a SLB9660 TPM1.2.

Here is my patch against flammit's heads' coreboot 4.7, and my branch, missing proper TPM2.0 tools to use the initialized TPM.

Boot log exerpt:

lpc_tpm: Read reg 0xf00 returns 0x1a15d1
Found TPM SLB9665 TT 2.0 by Infineon
TPM: Open

[paulmenzel]

On 01/31/18 17:40, tlaurion wrote: @paulmenzel: the thing is that we want TPM being initialised and used to measure romstage and ramstage BEFORE Linux enters fully in play.

@tlaurion, sorry for the misunderstanding. I am aware of that. Checking if Linux is able to correctly set it up was just to make sure that it is working in the first place. […]