Fedora Plasma Mobile experiments worklog

Setup notes

Installation was pretty much flawless, including with secure boot. I followed the usual encryption flow during the install, then used cryptsetup to auto unlock it with TPM2.

Auto unlock with TPM2

This isn't totally secure against an attacker with Linux knowledge that could replace some files not measured by the TPM in a malicious way to run untrusted code after I have logged in... but it's enough to prevent someone from easily copying data off if I lose the device.

https://fedoramagazine.org/use-systemd-cryptenroll-with-fido-u2f-or-tpm2-to-decrypt-your-disk/

systemd-cryptenroll –tpm2-device=auto –tpm2-pcrs=7 /dev/nvme0n1p3
rpm-ostree kargs –append=rd.luks.options=tpm2-device=auto
rpm-ostree initramfs –enable –arg=-a –arg=systemd-pcrphase

After updating certain packages (example - the uefi dbx), the TPM measurement will fail, and fall back to requiring a password unlock. Running the same systemd-cryptenroll command will redo the measurement and restore auto unlock.

Encrypting a SD card

I'm planning to leave a SD card in for additional storage. The same process almost worked, but didn't seem to update /etc/cryptsetup.

Here are the full steps that worked. The GPT, partition table, and btrfs volume were initially created with KDE Partition Manager. Nothing out of the ordinary.

To enable unlocking - first ran systemd-cryptenroll –tpm2-device=auto –tpm2-pcrs=7 /dev/mmcblk0p1

That didn't update /etc/crypttab as needed, so I fixed it. This line needed to be added, using the partition (not btrfs volume) UUID:

luks-<partition UUID> UUID=<partition UUID> none discard

Reboot to test, and it was unlocked and mounted automatically.

Tablet improvements

Adding some mobile-first shell and Android app support

sudo rpm-ostree install plasma-mobile waydroid

PIN unlock - unsolved

My hope is to log in with full password, then use a shorter password or PIN to unlock after a brief resume. Some people point to a PAM module that can accept encrypted passwords from a fixed file instead of the typical shadow db.

https://www.reddit.com/r/kde/comments/1826cvy/comment/kajxbih/

To make this work, I think I'd have to add a rule to /etc/pam.d/kde or create and modify a new one for kscreenlocker. Since the initial logins use /etc/pam.d/sshd and sddm I think this would reach the goal of not allowing PIN login from a cold boot.

This PAM module is not in upstream Fedora :/

Waydroid experiments

Issues

Tablet rotation doesn't work - waydroid/waydroid#1414 , waydroid/waydroid#248

Performance Issues

Investigating frequency states & governor 2024-07-23

When running Bitwig studio, playback glitches happen occasionally. When watching the CPU frequency - it seems like there are occasional drops in frequency which correspond with the glitches. I was not running all cores to 100%, so I suspect that the CPU scheduler was boosting a bit too much then throttling. My hope is that capping the boost frequency could help since Bitwig uses all cores roughly evenly.

Setting cpu: 0
Error setting new values. Common errors:
- Do you have proper administration rights? (super-user?)
- Is the governor you requested available and modprobed?
- Trying to set an invalid policy?
- Trying to set a specific frequency, but userspace governor is not available,
   for example because of hardware which cannot be set to a specific frequency
   or because the userspace governor isn't loaded?
⬢[patrick@toolbox ~]$ sudo cpupower frequency-set --max 1.1Ghz -g powersave
Setting cpu: 0
Error setting new values. Common errors:
- Do you have proper administration rights? (super-user?)
- Is the governor you requested available and modprobed?
- Trying to set an invalid policy?
- Trying to set a specific frequency, but userspace governor is not available,
   for example because of hardware which cannot be set to a specific frequency
   or because the userspace governor isn't loaded?
⬢[patrick@toolbox ~]$ sudo cpupower frequency-set --max 1.1Ghz
Setting cpu: 0
Error setting new values. Common errors:
- Do you have proper administration rights? (super-user?)
- Is the governor you requested available and modprobed?
- Trying to set an invalid policy?
- Trying to set a specific frequency, but userspace governor is not available,
   for example because of hardware which cannot be set to a specific frequency
   or because the userspace governor isn't loaded?

$ sudo cpupower frequency-info 
analyzing CPU 3:
  driver: intel_pstate
  CPUs which run at the same hardware frequency: 3
  CPUs which need to have their frequency coordinated by software: 3
  maximum transition latency:  Cannot determine or is not supported.
  hardware limits: 400 MHz - 3.40 GHz
  available cpufreq governors: performance powersave
  current policy: frequency should be within 400 MHz and 3.40 GHz.
                  The governor "powersave" may decide which speed to use
                  within this range.
  current CPU frequency: Unable to call hardware
  current CPU frequency: 2.20 GHz (asserted by call to kernel)
  boost state support:
    Supported: yes
    Active: yes

Documentation on this is sparse at best, but my best guess is that since this was installed in toolbox, there may still be an issue with permissions/policies on the host that may be corrected if kernel-tools is installed in the ostree instead.

Fixed - installed in root

After installing rpm-ostree install kernel-tools, things are working:

$ sudo cpupower frequency-info
[sudo] password for patrick: 
analyzing CPU 0:
  driver: intel_pstate
  CPUs which run at the same hardware frequency: 0
  CPUs which need to have their frequency coordinated by software: 0
  maximum transition latency:  Cannot determine or is not supported.
  hardware limits: 400 MHz - 3.40 GHz
  available cpufreq governors: performance powersave
  current policy: frequency should be within 400 MHz and 3.40 GHz.
                  The governor "powersave" may decide which speed to use
                  within this range.
  current CPU frequency: Unable to call hardware
  current CPU frequency: 600 MHz (asserted by call to kernel)
  boost state support:
    Supported: yes
    Active: yes
patrick@ViviennpleWatch:/var/home/patrick$ sudo cpupower frequency-set --max 1.6Ghz
Setting cpu: 0
Setting cpu: 1
Setting cpu: 2
Setting cpu: 3
patrick@ViviennpleWatch:/var/home/patrick$ sudo cpupower frequency-info
analyzing CPU 3:
  driver: intel_pstate
  CPUs which run at the same hardware frequency: 3
  CPUs which need to have their frequency coordinated by software: 3
  maximum transition latency:  Cannot determine or is not supported.
  hardware limits: 400 MHz - 3.40 GHz
  available cpufreq governors: performance powersave
  current policy: frequency should be within 400 MHz and 1.60 GHz.
                  The governor "powersave" may decide which speed to use
                  within this range.
  current CPU frequency: Unable to call hardware
  current CPU frequency: 700 MHz (asserted by call to kernel)
  boost state support:
    Supported: yes
    Active: yes

Alternate approach

Reading up on KDE - things seem to use a service called "PowerDevil" - https://invent.kde.org/plasma/powerdevil

This relies on https://gitlab.freedesktop.org/upower/power-profiles-daemon

Which has some higher-level power profiles available. Is it possible to create a custom one that includes CPU governor settings, or is this limited to what the (ACPI) platform has defined?

$ powerprofilesctl 
  performance:
    CpuDriver:  intel_pstate
    Degraded:   no

  balanced:
    CpuDriver:  intel_pstate
    PlatformDriver:     placeholder

* power-saver:
    CpuDriver:  intel_pstate
    PlatformDriver:     placeholder

As a first step - maybe this would be a good addition to plasma-mobile's quicksettings. Some other KDE settings are already using powerdevil so this is probably achievable with a tiny bit of QML code.

https://invent.kde.org/plasma/plasma-mobile/-/wikis/Quick-Settings

PatrickLang/KDE-Plasma_in_Hyper-V.md

2024-06-25 Trying Plasma Mobile

2024-06-18 Login hangs on black screen

2024-06-26 Testing fix https://bodhi.fedoraproject.org/updates/FEDORA-2024-bd81b79a0b

Merged to stable