nokia-n900: FDE broken
Describe your issue
What's the expected behaviour?
FDE image should boot to desktop
What's the current behaviour?
Image boots, and unl0kr screen comes up. However:
- Touch does not work at all, so the unlock screen cannot be interacted with
- After unlocking using the integrated hardware keyboard, the following error shows up on the console log, and after a while, the unlock screen comes up again, and the cycle goes on indefinitely:
device-mapper: table: 252:0 crypt: Error allocating crypto tfm (-ENOENT)
device-mapper: ioctl: error adding target to table
device-mapper: reload ioctl on root (252:0) failed: No such file or directoryHow to reproduce your issue?
Boot FDE image on Nokia N900
What device are you using?
nokia-n900
On what postmarketOS version did you encounter the issue?
-
edge (
masterbranch) -
v24.06 -
v24.12 -
I confirm that the issue still is present after running
sudo apk upgrade -a*(No idea since boot does not reach a point where that can be run)*
On what environment did you encounter the issue?
Environments
- GNOME Shell on Mobile
- Phosh
- Plasma Mobile
-
Sxmo (Wayland/Sway) Please post the output of
sxmo_version.sh -
Other: i3wm
*(issue should be UI-independent)*
How did you get postmarketOS image?
- from https://images.postmarketos.org
- I built it using pmbootstrap
- It was preinstalled on my device
What's the build date of the image? (in yyyy-mm-dd format)
N/A since image built via pmbootstrap
Additional information
From researching online, I found a similar Ubuntu/Debian bug which suggests the issue is related to compressed kernel modules not being included in the initramfs.
However, this seems not the cause here, since unpacking the initramfs shows all modules are in place:
initramfs file listing: initramfs_listing.txt
I would like to get some pointers to resolve the issue in time for v24.12
Activity
changed milestone to %v24.12 Release
trying to unlock from debug-shell returns the following:
~ # lsmod Module Size Used by Not tainted libaes 12288 0 xts 12288 0 usb_f_acm 12288 2 u_serial 16384 3 usb_f_acm usb_f_ncm 20480 2 u_ether 16384 1 usb_f_ncm libcomposite 53248 13 usb_f_acm,usb_f_ncm,u_ether omap_sham 28672 0 crypto_engine 12288 1 omap_sham tsc2005 12288 0 tsc200x_core 12288 1 tsc2005 twl4030_wdt 12288 0 twl4030_keypad 12288 0 matrix_keymap 12288 1 twl4030_keypad ~ # ~ # ~ # cryptsetup --debug luksOpen "$(find_root_partition)" root # cryptsetup 2.7.5 processing "cryptsetup --debug luksOpen /dev/mmcblk0p2 root" # Verifying parameters for command open. # Running command open. # Installing SIGINT/SIGTERM handler. # Unblocking interruption on signal. # Allocating context for crypt device /dev/mmcblk0p2. # Trying to open and read device /dev/mmcblk0p2 with direct-io. # Direct-io is supported and works. # Initialising device-mapper backend library. # Trying to load any crypt type from device /dev/mmcblk0p2. # Crypto backend (OpenSSL 3.3.2 3 Sep 2024 [default][threads][argon2]) initialized in cryptsetup library version 2.7.5. # Detected kernel Linux 6.12.1 armv7l. # Loading LUKS2 header (repair disabled). # Acquiring read lock for device /dev/mmcblk0p2. # Opening lock resource file /run/cryptsetup/L_179:2 # Verifying lock handle for /dev/mmcblk0p2. # Device /dev/mmcblk0p2 READ lock taken. # Trying to read primary LUKS2 header at offset 0x0. # Opening locked device /dev/mmcblk0p2 # Verifying locked device handle (bdev) # LUKS2 header version 2 of size 16384 bytes, checksum sha256. # Checksum:fac7e84d0fd5e636fc4968289b09709964b4dcfbd01923b6f092afffbdac2f9b (on-disk) # Checksum:fac7e84d0fd5e636fc4968289b09709964b4dcfbd01923b6f092afffbdac2f9b (in-memory) # Trying to read secondary LUKS2 header at offset 0x4000. # Reusing open ro fd on device /dev/mmcblk0p2 # LUKS2 header version 2 of size 16384 bytes, checksum sha256. # Checksum:5cb118712de33b3a4a32eb5441e543b904c904d011eed91de8fb9e16a3563af3 (on-disk) # Checksum:5cb118712de33b3a4a32eb5441e543b904c904d011eed91de8fb9e16a3563af3 (in-memory) # Device size 15675686912, offset 16777216. # Device /dev/mmcblk0p2 READ lock released. # Only 1 active CPUs detected, PBKDF threads decreased from 4 to 1. # Not enough physical memory detected, PBKDF max memory decreased from 1048576kB to 99254kB. # PBKDF argon2id, time_ms 2000 (iterations 0), max_memory_kb 99254, parallel_threads 1. # Activating volume root [keyslot -1] using token. # dm version [ opencount flush ] [16384] (*1) # dm versions [ opencount flush ] [16384] (*1) # Detected dm-ioctl version 4.48.0. # Detected dm-crypt version 1.28.0. # Device-mapper backend running with UDEV support disabled. # dm status root [ opencount noflush ] [16384] (*1) No usable token is available. # Interactive passphrase entry requested. Enter passphrase for /dev/mmcblk0p2: # Activating volume root [keyslot -1] using passphrase. # dm versions [ opencount flush ] [16384] (*1) # dm status root [ opencount noflush ] [16384] (*1) # Keyslot 0 priority 1 != 2 (required), skipped. # Trying to open LUKS2 keyslot 0. # Running keyslot key derivation. # Reading keyslot area [0x8000]. # Acquiring read lock for device /dev/mmcblk0p2. # Opening lock resource file /run/cryptsetup/L_179:2 # Verifying lock handle for /dev/mmcblk0p2. # Device /dev/mmcblk0p2 READ lock taken. # Reusing open ro fd on device /dev/mmcblk0p2 # Device /dev/mmcblk0p2 READ lock released. # Verifying key from keyslot 0, digest 0. # Loading key (type logon, name cryptsetup:22deeb11-eacd-43ef-8f92-b22a0f306adf-d0) in thread keyring. # dm versions [ opencount flush ] [16384] (*1) # dm status root [ opencount noflush ] [16384] (*1) # Calculated device size is 30583808 sectors (RW), offset 32768. # DM-UUID is CRYPT-LUKS2-22deeb11eacd43ef8f92b22a0f306adf-root # dm create root CRYPT-LUKS2-22deeb11eacd43ef8f92b22a0f306adf-root [ opencount flush ] [16384] (*1) # dm reload (252:0) [ opencount flush securedata ] [16384] (*1) device-mapper: reload ioctl on root (252:0) failed: No such file or directory # dm remove root [ opencount flush securedata ] [16384] (*1) # root: Stacking NODE_DEL # DM create task failed, dm_task errno: -2. # dm versions [ opencount flush ] [16384] (*1) # dm status root [ opencount noflush ] [16384] (*1) # Device status returned -19. # Data device /dev/mmcblk0p2 is OK. # No referenced device missing, some device in use. # root: Processing NODE_DEL # Requesting kernel key cryptsetup:22deeb11-eacd-43ef-8f92-b22a0f306adf-d0 (type logon) for unlink from thread keyring. # Unlinking volume key (id: 141759931) from thread keyring. # Releasing crypt device /dev/mmcblk0p2 context. # Releasing device-mapper backend. # Closing read only fd for /dev/mmcblk0p2. Command failed with code -5 (device already exists or device is busy).Yes, it is working in v24.06, and the difference in behavior between that version and v24.12 is evidently not due to missing modules.
~ # lsmod Module Size Used by Not tainted usb_f_ncm 20480 2 u_ether 16384 1 usb_f_ncm twl4030_wdt 12288 0 twl4030_keypad 12288 0 tsc2005 12288 0 tsc200x_core 12288 1 tsc2005 ## responsible for touchscreen omap_sham 28672 0 crypto_engine 12288 1 omap_sham matrix_keymap 12288 1 twl4030_keypad libcomposite 53248 11 usb_f_ncm,u_ether ~ # fde-unlock /dev/mmcblk0p2 libinput error: event0 - TSC2005 touchscreen: libinput bug: kernel fuzz of 4 but LIBINPUT_FUZZ_00 is missing libinput error: event0 - TSC2005 touchscreen: libinput bug: kernel fuzz of 7 but LIBINPUT_FUZZ_01 is missing Warning: keyslot operation could fail as it requires more than available memory. #### At this point, rootfs was unlocked. #### ~ # echo $? 0 ~ # ls /dev/mapper/ control root ~ # lsmod Module Size Used by Not tainted xts 12288 1 usb_f_ncm 20480 2 u_ether 16384 1 usb_f_ncm twl4030_wdt 12288 0 twl4030_keypad 12288 0 tsc2005 12288 0 tsc200x_core 12288 1 tsc2005 omap_sham 28672 0 crypto_engine 12288 1 omap_sham matrix_keymap 12288 1 twl4030_keypad libcomposite 53248 11 usb_f_ncm,u_ether ~ # pmos_continue_bootEdited by siceloadded device-category::community device-nokia-n900 labels
I've been researching some more, and I don't find much on it unfortunately...
When comparing kernel configs between v24.06 and v24.12, some kernel modules have been changed from y to m, for example:
CONFIG_CRYPTO_AES=m ... CONFIG_CRYPTO_CCM=m CONFIG_CRYPTO_GCM=mI'd assume that these are copied as modules into the initramfs and could be loaded on demand if needed (e.g. libaes is listed in lsmod now). But maybe that is broken somehow...?
Some more ideas:
- Is there anything useful in dmesg?
- Does it work when using the v24.06 kernel?
- Does rebuilding the v24.12 kernel with the config from v24.06 help it?
mentioned in issue #3359 (closed)
It seems to me the N900 might be running out of its 256MB of RAM, when it tries to unlock the device.
argon2idis a real memory hog, that even brings computers with 1GB of RAM to its knees. Switching back topbkdf2might help. See:--- a/device/community/linux-postmarketos-omap/config-postmarketos-omap.armv7 +++ b/device/community/linux-postmarketos-omap/config-postmarketos-omap.armv7 @@ -6723,7 +6723,7 @@ CONFIG_CRYPTO_ECDH=m # # Block ciphers # -CONFIG_CRYPTO_AES=m +CONFIG_CRYPTO_AES=y # CONFIG_CRYPTO_AES_TI is not set # CONFIG_CRYPTO_ANUBIS is not set # CONFIG_CRYPTO_ARIA is not set @@ -6919,7 +6919,7 @@ CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y # Crypto library routines # CONFIG_CRYPTO_LIB_UTILS=y -CONFIG_CRYPTO_LIB_AES=m +CONFIG_CRYPTO_LIB_AES=y CONFIG_CRYPTO_LIB_ARC4=m CONFIG_CRYPTO_LIB_GF128MUL=m CONFIG_CRYPTO_ARCH_HAVE_LIB_BLAKE2S=y @@ -6970,7 +6970,7 @@ CONFIG_XZ_DEC_X86=y CONFIG_XZ_DEC_POWERPC=y CONFIG_XZ_DEC_ARM=y CONFIG_XZ_DEC_ARMTHUMB=y -CONFIG_XZ_DEC_ARM64=y +# CONFIG_XZ_DEC_ARM64 is not set CONFIG_XZ_DEC_SPARC=y CONFIG_XZ_DEC_RISCV=y # CONFIG_XZ_DEC_MICROLZMA is not setThis causes decryption to work again.
However, touch still does not work, even though the module is loaded and an input device for it is created.
So ATM, hardware keyboard is the only way to get into the system
-
I wonder if it is a regression from here: (EDIT: probably not)
Edited by Oliver Smith
-
@sicelo: awesome, well done figuring that out!
I built a v24.06 image with FDE, then upgraded to the new kernel. it was still possible to unlock using the touchscreen, so i am somewhat sure that the kernel is proper now.
buffybox!35 (merged) (diffs)
yes, this is unrelated. the behavior is as if buffybox does not recognize the touchscreen as an input device, even though it's there. @cherrypicker any suggestions perhaps?
Could you try libinput list-devices to see if libinput recognises the touchscreen? Unl0kr connects to all input devices through libinput and udev.
Edited by Johannes Marbach-
Oh, right. You'd have to add the libinput binary to the initfs, for instance by adding it to unl0kr's filelist and building / installing the package manually. We've had cases in the past where different kernel modules were being used between the initfs and the running system. So verifying that libinput recognises the device in the initfs would be quite helpful.
