* osutil: rework TotalSystemMemory to TotalUsableMemory
This commit renames total TotalSystemMemory to TotalUsableMemory
and also changes the code to take the CmaTotal into account. This
is the memory reserved by the "Contiguous Memory Allocator" and
it is not usable for normal processes. This kind of memory is
used e.g. by the framebuffer of the Raspberry Pi or by DSPs on
certain boards.
* secboot: use half the mem for KDF in AddRecoveryKey
Instead of benchmarking the KDF parameters for the recovery key
(which takes some time to run) we can also use defaults for the
KDF parameters. The defaults suggested by Chris are "4 iterations"
and half the usable memory. This commit implements the suggestions.
* secboot: update KDF memory heuristic
After discussing with Chris and Samuele we updated the KDF memory
heuristic so that it takes more parameters in mind. It now
considers the usable memory and substracts a hardcoded 384MB
that is required to have a working system (a bit of a conservative
estiamte) and then takes half of this for the KDF memory.
* osutil,secboot: fix typos
* secboot: add comment about minimum mem
The main encryption key is high entropy 256bit already so there is
no need to use a strong KDF on top of this. There was a PR already
that switched this to 32MB but it turns out that 32KB is enough.
* vendor: move to snapshot-4c814e1 branch with KDF fixes
This commit moves our secboot code to the `snapshot-4c814e1` branch
that contains fixes around the KDF benchmarking. This will improve
the install performance.
* secboot: update code to latest api
* secboot: hardcode KDFOptions to avoid benchmarking them and speed up the process
It is desired that the seal/reseal code only operates on the input provided in
modeenv rather than poking other external structures. The change decouples the
lower level code from accessing the model directly.
Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>
* secboot: switch encryption key size to 32 byte (thanks to Chris)
We are using an incorrect size for encryption key in secboot. Chris
mentioned this a while ago and this commit fixes it and moves to
a 32 byte key instead of the 64 byte key.
* tests: update uc20-create-partitions-encrypt test to match new keysize
After opening the encrypted volume we need to be careful to close
it again if there is any error condition that prevents the model
checker from verifying that the model is authorized to read the
volume (thanks Samuele).
Adjusted code to the refactoring using kernel/fde.
Split responsibility to deal with v1/v2 hooks with kernel/fde.
Now dealing with aux key will come later.
this stops kernel/fde from importing secboot, which also means that
secboot can now kernel/fde naturally
rename/reorg/split secboot_tpm.go into hooks specific bits
and general secboot-using secboot_sb.go
