WIP: Add TCG Opal disk unlock support - #2196
Draft
Sean-StarLabs wants to merge 2 commits into
Draft
Conversation
Add a kernel-ioctl-backed helper and an immutable gate before every normal, basic, or network boot script. Unlock each locked TCG Opal disk as Admin1. Keep credentials out of arguments, the environment, and production Bash variables. Retain them only in anonymous file descriptors until every disk is ready so failures can relock earlier disks before recovery. Optionally compile in coreboot's OPAL S3 APMC v1 service, and fail closed if setup or rollback cannot be completed. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Overlay deterministic prompt and disk backends for the pre-boot unlock gate, retries, failure rollback, S3 handoff requests, post-unlock verification, and secret transport without requiring an emulated Opal device. Run the host fixture and build the QEMU board in CI. QEMU covers the Heads control flow; production OPAL ioctls, NVMe security commands, SMI handling, and S3 resume remain hardware-only paths. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
tlaurion
reviewed
Aug 27, 2026
| $(INSTALL)/include/linux/limits.h \ | ||
| $(build)/$(musl-cross-make_dir)/.build | ||
| @mkdir -p "$(dir $@)" | ||
| $(heads_cc) -Os -Wall -Wextra -Werror \ |
Collaborator
There was a problem hiding this comment.
Can this be built with Oz?
tlaurion
reviewed
Aug 27, 2026
Collaborator
There was a problem hiding this comment.
Ideally, this would be into a modules/* where this project evolves on its own?
tlaurion
requested changes
Aug 27, 2026
tlaurion
left a comment
tlaurion
left a comment
Collaborator
There was a problem hiding this comment.
First quick review, will try to review thoroughly in the next days.
Will also need to update threat model, TCG had its bypasses before, so "trusting trust" kinda issues here
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The prompt completes before the backend starts. Heads opens and unlinks its mode-0600 password file before passing the anonymous file descriptor to the C helper, so credentials are not placed in command arguments, the environment, or a production Bash variable. Credential buffers and anonymous storage are cleared after use.
If a later disk, status check, or S3 handoff fails, Heads relocks disks already unlocked during that attempt. A rollback failure powers off instead of exposing an unlocked disk through recovery.
Functional validation
The host fixture exercised no-device and already-unlocked paths, successful unlock, wrong-password retry and exhaustion, cancellation, prompt failure after producing output, empty and oversized input, backend and S3 pre/post-unlock failures, rollback failure, malformed scan output, multiple disks, partial multi-disk rollback, post-unlock verification, and argv/environment/path secret checks.
The exact committed QEMU ROM completed the overlaid mock scan, mocked unlock and S3 handoff, confirmed the unlocked state, and entered
detect_boot_devicein that order. The fixture password and linked-password-file failure marker were absent from serial output.QEMU does not emulate a TCG Opal device or the coreboot SMM service. Production OPAL ioctls, NVMe Security Receive, physical-address lookup, SMI handling, and S3 resume remain hardware validation. This PR remains Draft for that reason.
Board requirements
Production boards must use Linux 6.1 or later and enable
CONFIG_BLK_SED_OPAL=y. Boards selectingCONFIG_HEADS_OPAL_S3_APMC_V1=ymust also enableCONFIG_PROC_PAGE_MONITOR=yand run coreboot with the ABI merged through coreboot change 91045.