OEM Factory Reset - operation cannot be done while there is no TPM on the motherboard.

@tlaurion

TEST inventory : KGPE-D16 and Nitrokey Start

link 1
link 2

[tlaurion]

@0rb677 Congrats, you found a bug where CONFIG_TPM is not validated as everywhere else in the code base prior to operation

[tlaurion]

@MrChromebox ?

[MrChromebox]

@tlaurion I'd fixed that locally and forgot to push a PR, I'll do that shortly

[MrChromebox]

addressed by #747

[tlaurion]

@0rb677 : merged into #472 Please report success/fail!

@tlaurion OEM FACTORY RESET can't reset gpg-key, on x220 it works.

@tlaurion @MrChromebox

Clear process on x220

[tlaurion]

@tlaurion OEM FACTORY RESET can't reset gpg-key, on x220 it works.

@0rb677
The x220 has CONFIG_TPM=y.
kgpe-d16 has CONFIG_TPM=n

https://github.com/osresearch/heads/blob/cbad9b663724c95508f0eec027841d93c723c006/initrd/bin/oem-factory-reset#L309-L320

Implemented this validation. Screenshots provided, coming from x220, is not testing previous PR.
Which is why it was advised to test new artifact on kgpe-d16 from #472 artifacts

@tlaurion

I dont understand it works with couple of bugs.
Now i attached gpg-card and external USB to PC when heads initialized. Then quit to shell and lauch oem-reset script.

1. It access to gpg-card
2. It generates oem-key
3. It changes Admin/Pin
4. Exporting key to USB
5. Reading Firmware
6. Adding gerenerate key to current firmware and re-flashing
7. Signed boot files and generate checksums

So it works?

@tlaurion congrats it done. but if i do it from recovery shell.

@tlaurion boot from Default boot Menu and /boot is signed by oem-key, also rom is signed too.

[tlaurion]

I'm confused with things unrelated to this ticket and not sure of your state with contradictory information,

If I recall well, your use case made me create:
boards/kgpe-d16_workstation-usb_keyboard/kgpe-d16_workstation-usb_keyboard.conf

so make BOARD=kgpe-d16_workstation-usb_keyboard which on a clear checkout should be at latest commit:

git fetch tlaution
git checkout  kgpe-d16_current_working
git reset --hard
git log

should show

Merge: a3de462 cbad9b6
Author: Thierry Laurion <insurgo@riseup.net>
Date:   Tue Jun 9 13:59:38 2020 -0400

    Merge remote-tracking branch 'mrchromebox/factory_reset_no_tpm' into kgpe-d16_current_working

commit cbad9b663724c95508f0eec027841d93c723c006 (mrchromebox/factory_reset_no_tpm)

[tlaurion]

@tlaurion i cant boot from Default boot Menu and /boot is signed by oem-key, also rom is signed too.

If you flashed a new public key, you changed your rom, measurements are now invalid.
You have to:

• Resign your configs
• Set a new boot default

Screenshots are always helpful.

@tlaurion can you join to channel? It too hard to answer you in so many threads.