Full disk encryption not working on asus-grouper: pointercal and libaes.ko missing

--fde should make sure to always include this module on every device

or maybe libaes and aes_generic just should be built-in? are we sure that FDE uses AES at all? I don't remember..

By Alexey Min on 2021-10-04T16:36:30

It uses AES, based on my finding that adding this module fixes cryptsetup.

LUKS default is aes-xts-plain64, and I would assume/hope that's what we're using.

...

On Mon, Oct 4, 2021 at 8:45 AM Alexey Min (@minlexx) gitlab@mg.gitlab.com wrote:

Alexey Min commented:

--fde should make sure to always include this module on every device

or maybe libaes and aes_generic just should be built-in? are we sure that FDE uses AES at all? I don't remember..

— Reply to this email directly or view it on GitLab. You're receiving this email because of your account on gitlab.com. If you'd like to receive fewer emails, you can unsubscribe from this thread or adjust your notification settings.

By Rudolf Polzer on 2021-10-04T16:36:30

Could you try use postmarketos grate kernel? Just point the device to the grate package name, it should have all necessary build options to cover grouper/tilapia devices. It could work out-of-box but hasn't been fully tested.

By David Heidelberg on 2021-10-04T17:03:01

you also need deviceinfo_modules_initfs="lvds-codec panel-lvds bq27xxx-battery bq27xxx-battery-i2c smb347-charger elants-i2c", but it is not tested

By jenneron on 2021-10-04T17:08:28

Is this something one can just install on an existing install e.g. via apk add, or do I need to reinstall for that? Sorry, but I haven't used postmarketos much yet and basically just got my homedir setup OK; as a known issue with grouper is lack of hardware graphics acceleration, is the grate kernel expected to fix that?

...

On Mon, Oct 4, 2021 at 10:03 AM jenneron (@jenneron) gitlab@mg.gitlab.com wrote:

jenneron commented on a discussion:

you also need deviceinfo_modules_initfs="lvds-codec panel-lvds bq27xxx-battery bq27xxx-battery-i2c smb347-charger elants-i2c", but it is not tested

— Reply to this email directly or view it on GitLab. You're receiving this email because of your account on gitlab.com. If you'd like to receive fewer emails, you can unsubscribe from this thread or adjust your notification settings.

By Rudolf Polzer on 2021-10-04T17:35:14

no, you have to alternate deviceinfo file

By David Heidelberg on 2021-10-04T18:13:31

added category::device type::bug labels

OK, so first of all, tried if the kernel boots at all using pmbootstrap boot with the old root fs; pmbootstrap flasher boot does show something, and unlocks the disk (despite me having removed libaes from the module list, but instead added the deviceinfo_modules_initfs provided by jenneron).

So this part is fixed with the new kernel. I still need my pointercal file though.

WiFi didn't work when booted this way, but that's expected as I didn't install the rootfs yet so it clearly couldn't load extra modules (now doing that).

By Rudolf Polzer on 2021-10-05T00:23:08

So, summary for now:

The grate kernel boots.
The grate kernel has the libaes missing module bug fixed.
Looking for possible other regressions now.
/etc/pointercal file remains necessary - the exact parameters from above (41811 0 -771172 220 39984 -1046512 65536 800 1280 0) remain correct with the grate kernel, although I don't like them (there's clearly a skew - the 4th number should be a zero otherwise). I probably should calibrate many times and take average.

By Rudolf Polzer on 2021-10-05T00:28:50

OK, new status:

Still on grate. No regrets, no visible regressions.
Still can't use 3D acceleration - seems like Mesa simply has no driver for this Tegra 3 chip? Anyway, fine by me. xorg opentegra driver does recognize the chip.
XVIDEO does seem supported, so kinda good enough.
USB, screen, touchpad, Wifi, backlight control all still work. Can't get any sound out but wow has this one many ALSA mixer channels - maybe can be fixed there (but I'll wait and see if pulseaudio happens to already know what to do there, also IIRC my headphones socket has turned mono anyway so I may have to use Bluetooth anyway). Have NOT tested Bluetooth yet.

So, the full extent of this bug is:

We either need to put the libaes module in the initfs or kernel whenever --fde is used, or maybe always. This part is fixed in grate.
We need /etc/pointercal added to the initfs. Unchanged with grate.

As I see no reason not to go with the grate kernel, sticking with it now. Scrolling in Firefox seems better, but still can't play YouTube in it directly (but I am aware of workarounds).

By Rudolf Polzer on 2021-10-05T10:29:38

great work Rudolf.

Could you open MR for switching to -grate kernel (since this was original goal, I just haven't time to fully test it yet) and supplying pointercal for grouper and tilapia? (since they're 99.9% same).

EDIT: also 3D* is WIP, but it'll take at least some months I assume. Feel free to drop by on Matrix #tegra:libera.chat or on IRC #tegra channel on libera.

By David Heidelberg on 2021-10-05T15:21:11

Will do. Current status BTW:

Sound - still didn't get it working.
Bluetooth - scans fine, didn't try actually playing sound through it yet but it probably works fine.

I should receive my BT keyboard tomorrow, then I'll open the MRs.

...

On Mon, Oct 4, 2021 at 11:43 PM David Heidelberg (@okias) gitlab@mg.gitlab.com wrote:

David Heidelberg commented:

great work Rudolf.

Could you open MR for switching to -grate kernel (since this was original goal, I just haven't time to fully test it yet) and supplying pointercal for grouper and tilapia? (since they're 99.9% same).

— Reply to this email directly or view it on GitLab. You're receiving this email because of your account on gitlab.com. If you'd like to receive fewer emails, you can unsubscribe from this thread or adjust your notification settings.

By Rudolf Polzer on 2021-10-05T15:21:11

if it scanning, it should working, for "simple" alsa test, just max volume for few alsautils mixers, I think it should be enough. I think someone worked on alsa-ucm configuration, but I know little about UCM.

By David Heidelberg on 2021-10-05T17:04:52

Speaking of sound the easiest way is to use pulseaudio and just select needed output in pavucontrol or some another mixer. Although if the religion doesn't allow, you still can use alsa for that, but you should consider that some apps may not work with alsa-only. It would be something like this:

$ alsaucm -i -c hw:0
set _verb HiFi
set _enadev <device>

For further info check ucm configs of nexus 7, they are already upstreamed and are in /usr/share/alsa/ucm2. If this directory doesn't exist, install alsa-ucm-conf package (mandatory for both alsa-only and alsa + pulseaudio cases). It should be a dependency of device-asus-grouper (and device-asus-tilapia as well), but it is not.

By jenneron on 2021-10-06T01:35:08

Thanks - alsaucm was indeed what I missed (and with alsa-ucm-conf installed, pulseaudio also works fine). Now only remaining issue is the BT keyboard and I'll call it done and send a bunch of MRs.

Issue is, I can pair with the keyboard but never type. Keyboard works fine on another Linux box with the same bluetoothctl commands, namely "power on", "scan on", "pair ", "trust ", "connect ". Anything obvious I could be missing, like some userspace program I didn't install (for now only installed bluez)?

The one "suspicious" log message is:

Oct  6 15:22:02 asus-grouper daemon.err bluetoothd[1316]: profiles/input/device.c:ioctl_is_connected() Can't get HIDP connection info
Oct  6 15:22:08 asus-grouper daemon.err bluetoothd[1316]: profiles/input/device.c:control_connect_cb() connect to <device-address>: Host is down (112)

I'm gonna try booting the other kernel, seeing no other obvious option yet.

By Rudolf Polzer on 2021-10-06T19:52:07

We probably need CONFIG_UHID enabled. You can make sure by running lsmod on your PC where keyboard works and comparing to lsmod without connected keyboard. I will enable it on the next kernel update

By jenneron on 2021-10-06T19:52:07

Confirmed CONFIG_UHID is missing. Recompiled kernel with it enabled. Did not fix the issue though; also, same keyboard on another computer doesn't cause the uhid module to get loaded.

...

On Wed, Oct 6, 2021 at 12:52 PM jenneron (@jenneron) gitlab@mg.gitlab.com wrote:

jenneron commented on a discussion:

We probably need CONFIG_UHID enabled. You can make sure by running lsmod on your PC where keyboard works and comparing to lsmod without connected keyboard. I will enable it on the next kernel update

— Reply to this email directly or view it on GitLab. You're receiving this email because of your account on gitlab.com. If you'd like to receive fewer emails, you can unsubscribe from this thread or adjust your notification settings.

By Rudolf Polzer on 2021-10-06T21:12:30

On another computer, the modules loaded or refcount-incremented when I connect the keyboard are: hidp cmac algif_hash algif_skcipher af_alg hid bluetooth evdev aesni_intel cryptd. dmesg message for the keyboard also mentions hidraw, which it did NOT on the tablet. So I'll see if I can enable all that.

So, adding CONFIG_HIDRAW and CONFIG_CRYPTO_CRYPTD now; all else seems already in.

...

On Wed, Oct 6, 2021 at 5:12 PM Rudolf Polzer divverent@gmail.com wrote:

Confirmed CONFIG_UHID is missing. Recompiled kernel with it enabled. Did not fix the issue though; also, same keyboard on another computer doesn't cause the uhid module to get loaded.

On Wed, Oct 6, 2021 at 12:52 PM jenneron (@jenneron) gitlab@mg.gitlab.com wrote:

jenneron commented on a discussion:

We probably need CONFIG_UHID enabled. You can make sure by running lsmod on your PC where keyboard works and comparing to lsmod without connected keyboard. I will enable it on the next kernel update

— Reply to this email directly or view it on GitLab. You're receiving this email because of your account on gitlab.com. If you'd like to receive fewer emails, you can unsubscribe from this thread or adjust your notification settings.

By Rudolf Polzer on 2021-10-06T21:19:57

That's not all - it still fails with those added.

ioctl(24, HCIGETDEVINFO, 0xbe913900) = -1 ENOENT (No such file or directory)

Pretty sure I got a different error before.

Also:

Oct 6 17:45:45 asus-grouper daemon.err bluetoothd[4141]: profiles/input/device.c:control_connect_cb() connect to : Permission denied (13)

It's no longer "host is down"...

The EACCES is coming from a

getsockopt(24, SOL_SOCKET, SO_ERROR, [EACCES], [4]) = 0

call, in case that helps. Last action on that socket was

socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP) = 24 bind(24, {sa_family=AF_BLUETOOTH, l2_psm=htobs(0 /* L2CAP_PSM_??? /), l2_bdaddr=<...>, l2_cid=htobs(0 / L2CAP_CID_ ??? /), l2_bdaddr_type=BDADDR_BREDR}, 14) = 0 setsockopt(24, SOL_BLUETOOTH, BT_SECURITY, "\2\0", 2) = 0 statx(24, "", AT_STATX_SYNC_AS_STAT|AT_EMPTY_PATH, STATX_BASIC_STATS, {stx_mask=STATX_BASIC_STATS|STATX_MNT_ID, stx_attributes=0 , stx_mode=S_IFSOCK|0777, stx_size=0, ...}) = 0 fcntl64(24, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(24, F_SETFL, O_RDONLY|O_NONBLOCK|O_LARGEFILE) = 0 connect(24, {sa_family=AF_BLUETOOTH, l2_psm=htobs(0x11 / L2CAP_PSM_??? /), l2_bdaddr=<...>, l2_cid=htobs(0 / L2CA P_CID_??? */), l2_bdaddr_type=BDADDR_BREDR}, 14) = -1 EINPROGRESS (Operation in progress)

...

On Wed, Oct 6, 2021 at 5:19 PM Rudolf Polzer divverent@gmail.com wrote:

On another computer, the modules loaded or refcount-incremented when I connect the keyboard are: hidp cmac algif_hash algif_skcipher af_alg hid bluetooth evdev aesni_intel cryptd. dmesg message for the keyboard also mentions hidraw, which it did NOT on the tablet. So I'll see if I can enable all that.

So, adding CONFIG_HIDRAW and CONFIG_CRYPTO_CRYPTD now; all else seems already in.

On Wed, Oct 6, 2021 at 5:12 PM Rudolf Polzer divverent@gmail.com wrote:

Confirmed CONFIG_UHID is missing. Recompiled kernel with it enabled. Did not fix the issue though; also, same keyboard on another computer doesn't cause the uhid module to get loaded.

On Wed, Oct 6, 2021 at 12:52 PM jenneron (@jenneron) gitlab@mg.gitlab.com wrote:

jenneron commented on a discussion:

We probably need CONFIG_UHID enabled. You can make sure by running lsmod on your PC where keyboard works and comparing to lsmod without connected keyboard. I will enable it on the next kernel update

— Reply to this email directly or view it on GitLab. You're receiving this email because of your account on gitlab.com. If you'd like to receive fewer emails, you can unsubscribe from this thread or adjust your notification settings.

By Rudolf Polzer on 2021-10-06T23:06:28

mentioned in merge request !2575 (closed)

By Rudolf Polzer on 2021-10-07T11:34:42

Sent a MR for the pointercal and libaes issue; going to test today if BT issue is grate related, and will then file MR for grate.

By Rudolf Polzer on 2021-10-07T11:44:37

Bluetooth issue is NOT a regression - happens equally with linux-asus-grouper. Now for filing the kernel MR.

By Rudolf Polzer on 2021-10-07T12:50:25

Decided that !2575 (closed) will close this issue; filing a separate issue for the Bluetooth problems. Got some possible new "leads".

Sorry for the mess.

By Rudolf Polzer on 2021-10-07T13:32:27

Hmm, I have feeling on linux-asus-grouper keyboard worked some long time ago (I tried).

Anyway, I just tested FDE on asus-tilapia and it worked with your linux-pmos-grate patch (just missing pointercal, so I had to enter data encryption key over telnet).

Adding libaes.ko doesn't seems like a requirement.

# lsmod | rg lib
libdes                 28672  1 des_generic

By David Heidelberg on 2021-10-08T19:39:43

Yes; libaes module is built-in in grate but separate in linux-asus-grouper.

So depending on merge order of the two MRs, I'll have to do some deconflicting. If we do !2575 (closed) first, we need libaes added; if we do !2576 (merged) first, libaes will be gone when I rebase !2575 (closed).

By Rudolf Polzer on 2021-10-08T19:55:47

are u on Matrix? (pmOS mainline or other rooms? )

By David Heidelberg on 2021-10-08T19:55:47

You can edit the commits in your !2575 (closed) to not add libaes module, just add a pointercal file. After that add a comment that this MR depends on !2576 (merged) being merged. But you still will have to deal with conflicts due to pkgvers

By jenneron on 2021-10-08T20:54:05

Well, I was asked to just put the pointercal file in !2576 (merged), so I'll do that later today.

...

On Fri, Oct 8, 2021 at 4:54 PM jenneron (@jenneron) gitlab@mg.gitlab.com wrote:

jenneron commented on a discussion:

You can edit the commits in your !2575 (closed) to not add libaes module, just add a pointercal file. After that add a comment that this MR depends on !2576 (merged) being merged. But you still will have to deal with conflicts due to pkgvers

— Reply to this email directly or view it on GitLab. You're receiving this email because of your account on gitlab.com. If you'd like to receive fewer emails, you can unsubscribe from this thread or adjust your notification settings.

By Rudolf Polzer on 2021-10-09T12:03:21

closed with commit c4231e61

mentioned in commit 2739623e

By Rudolf Polzer on 2021-10-15T14:30:21

mentioned in commit c4231e61

By Rudolf Polzer on 2021-10-15T14:30:21

Full disk encryption not working on asus-grouper: pointercal and libaes.ko missing

Describe your issue

What's the expected behaviour?

What's the current behaviour?

How to reproduce your issue?

What device are you using?

On what postmarketOS version did you encounter the issue?

On what environment did you encounter the issue?

Phone environments

Other

How did you get postmarketOS image?

What's the build date of the image? (in yyyy-mm-dd format)

Additional information

Child items ...

Activity