coreboot May 2017

coreboot@coreboot.org

70 participants
202 discussions

Re: [coreboot] Coreboot on the Supermicro H8SCM-F
by Patrick 'P. J.' McDermott 03 May '17

03 May '17

On 2017-04-26 at 15:25, Rene Shuster wrote: > Maybe even FSF-endorsed. Great news! Spread the news. The H8SCM is a nice find, but unfortunately probably not eligible for FSF certification. The board has an old AGP-based Matrox G200eW GPU. In addition to having a non-free VBIOS [1], the GPU has a "WARP Engine" – a RISC coprocessor core with non-free microcode (loaded by Linux [2]) to do triangle setup operations [3]. So, a couple of blobs that would be rather non-trivial to reverse engineer and replace. The board could surely run headless without them, but the FSF most likely wouldn't certify it since users could be tempted to load the blobs to get video output and graphics acceleration. [1]: https://www.coreboot.org/Board:supermicro/h8scm#Extract_VGA_BIOS [2]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/dri… [3]: https://en.wikipedia.org/wiki/Matrox_G200 -- Patrick "P. J." McDermott: http://www.pehjota.net/ Lead Developer, ProteanOS: http://www.proteanos.com/ Founder and CEO, Libiquity: http://www.libiquity.com/

4 6

Re: [coreboot] Anyone got an opinion, technical or otherwise, on this?
by Vadim Bendebury 02 May '17

02 May '17

I wonder if anyone ever completely trusted AMT - maybe some naive excessive cool-aid drinkers :) -vb On Tue, May 2, 2017 at 11:27 AM, ron minnich <rminnich(a)gmail.com> wrote: > I wonder if anyone is going to completely trust AMT after this problem. It > goes back almost 10 years. So for all those users who had it on for almost > 10 years, the question becomes, how much did we lose and when did we lose > it? The answer? We'll never know. Are we still owned? We don't know. Can we > actually trust any reflash procedure, if the ME is owned while we try to > reflash? Well, I hope so, but how can we know? > > It's a worrisome situation. > > ron > > On Tue, May 2, 2017 at 11:01 AM Patrick Georgi via coreboot < > coreboot(a)coreboot.org> wrote: > >> Semi-Accurate only claims accuracy according to what's on the box. The >> official documentation of the issue can be found at >> https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075 >> >> It looks like a software bug in the AMT firmware. Therefore: >> - No AMT (eg on non-business consumer devices) -> no (bug | exploit). >> - Present but disabled AMT (eg. on business devices without AMT >> enrollment) -> no (bug | exploit). (although there's apparently a way >> to enable AMT unsupervised under some circumstances with some level of >> local access. or something.) >> >> >> Patrick >> >> 2017-05-02 19:31 GMT+02:00 John Lewis <jlewis(a)johnlewis.ie>: >> > https://semiaccurate.com/2017/05/01/remote-security-exploit- >> 2008-intel-platforms/ >> > >> > The article says "all" Intel boards since 2008 are locally vulnerable >> > (ME exploit), but the Intel advisory (linked within) says consumer >> > devices are okay. >> > >> > What the article says about even low end devices still having the >> > features albeit turned "off" rings true to me, based on stuff I've read >> > here and elsewhere. What's your take (bearing in mind the technical >> > details aren't available, yet)? >> > >> > >> > -- >> > coreboot mailing list: coreboot(a)coreboot.org >> > https://mail.coreboot.org/mailman/listinfo/coreboot >> >> >> >> -- >> Google Germany GmbH, ABC-Str. 19, 20354 Hamburg >> Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: >> Hamburg >> Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle >> >> -- >> coreboot mailing list: coreboot(a)coreboot.org >> https://mail.coreboot.org/mailman/listinfo/coreboot > > > -- > coreboot mailing list: coreboot(a)coreboot.org > https://mail.coreboot.org/mailman/listinfo/coreboot >

1 0

Re: [coreboot] BIOSBits ...
by Timothy Pearson 02 May '17

02 May '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/02/2017 04:04 PM, Kashif Ali wrote: > Hi all, > > We modified coreboot for the OpenCellular project and looking to have > test suite for BIOS, specially during manufacturing. The OpenCellular is > based on Intel Atom E3845, similar to minnowboard. I came across > biosbits.org <http://biosbits.org>, have anyone tried this?. Is this the > right approach or there is better approach to this?. We offer an integrated coreboot test solution here: https://www.raptorengineering.com/content/REACTS/intro.html We can scale this from single board test through production scale QA if desired; it is capable of testing internal branches and/or the public code as needed. Additionally, the REACTS is currently used on two public instances to provide up to date test results on a number of coreboot supported boards; one of these instances is currently hosted by Raptor Engineering and the other is hosted by the coreboot project itself. If you have any further questions please feel free to contact me directly. Thanks! - -- Timothy Pearson Raptor Engineering +1 (415) 727-8645 (direct line) +1 (512) 690-0200 (switchboard) https://www.raptorengineering.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJZCPmSAAoJEK+E3vEXDOFb0kQH/R0Aq7NiSwe0xq3AjXzu9XUK nUqNP/4ag31GwRkayUlG/dibAbJ6j2nwiZxCGCsiW05sZtRghm1VwClsDDG9Z09A GXJXoDHn9s8DqDpLu1ulVyuwTzxbUiZsEc6sAjdg3tuvEylVny6HKyg5zkiJyRUQ /s+qV9Bg0JrGStCjJ7P5GfBkbxFwZJkD30xn2AoEOcd4VSEXZLRJFhTGNiVpwzAC ej/+Mx5veteh0sFFgNDDUS9rZVGl+w0Pjli+E7SHP3qeJyl2OFttAk2hMX7jfnNY NXJyXMiWayVYRveuaB7ihCcJTLmqpn6OXA4HrPLcu9klOiekZ4Cn8/UHMRlisq0= =W7B7 -----END PGP SIGNATURE-----

1 0

Re: [coreboot] Remote security exploit in all 2008+ Intel platforms
by ron minnich 02 May '17

02 May '17

On Tue, May 2, 2017 at 2:08 PM Zoran Stojsavljevic < zoran.stojsavljevic(a)gmail.com> wrote: > OK. I will rephrase my statement. :-) > > Ron, you can believe in Snow White, in Santa Clause, in INTEL to be > good/reasonable and to engage with Google, or Purism in ME Open Source > effort. > > Good Luck with that, you'll certainly need it! > You have to remember, in 1995, I asked intel for docs to write an ethernet driver for Linux. I got 19 badly copied, uninformative, useless pages, and lots of verbal abuse for even asking for such a thing -- "Just run windows" I was told. Now who would have expected, from that time to now, that Intel would have become such a supporter of Linux? Change can happen and it pays to keep asking. You never know when or how it will happen, but if you don't ask, you miss the chance to hear a good answer. ron

1 0

Re: [coreboot] Remote security exploit in all 2008+ Intel platforms
by Zoran Stojsavljevic 02 May '17

02 May '17

OK. I will rephrase my statement. :-) Ron, you can believe in Snow White, in Santa Clause, in INTEL to be good/reasonable and to engage with Google, or Purism in ME Open Source effort. Good Luck with that, you'll certainly need it! I'll rather believe in Igor Skochinsky, Dmitry Sklyarov and Black Hat hackers. True believer in AMD and ARM, if they start significantly engaging (taking significant share) in Server space, then INTEL will suddenly convert to good guy (and start contributing MUCH MORE to Open Source)... Claiming God, Church, Bible and similar type of work (enlightenment). Way to go! ;-) Zoran On Tue, May 2, 2017 at 10:41 PM, ron minnich <rminnich(a)gmail.com> wrote: > > > On Tue, May 2, 2017 at 11:38 AM Zoran Stojsavljevic < > zoran.stojsavljevic(a)gmail.com> wrote: > >> > But I also saw Todd working very hard to try *to engage Intel*, over a >> period of years. >> >> Whoever might be believing in this statement: Good luck to you all. >> You'll need it, really! :-( >> >>> >>> > > I can't understand your comment. >

1 0

BIOSBits ...
by Kashif Ali 02 May '17

02 May '17

Hi all, We modified coreboot for the OpenCellular project and looking to have test suite for BIOS, specially during manufacturing. The OpenCellular is based on Intel Atom E3845, similar to minnowboard. I came across biosbits.org, have anyone tried this?. Is this the right approach or there is better approach to this?. Thoughts? Thanks, +Kashif

1 0

Re: [coreboot] Remote security exploit in all 2008+ Intel platforms
by ron minnich 02 May '17

02 May '17

On Tue, May 2, 2017 at 11:38 AM Zoran Stojsavljevic < zoran.stojsavljevic(a)gmail.com> wrote: > > But I also saw Todd working very hard to try *to engage Intel*, over a > period of years. > > Whoever might be believing in this statement: Good luck to you all. You'll > need it, really! :-( > >> >> I can't understand your comment.

1 0

Re: [coreboot] Remote security exploit in all 2008+ Intel platforms
by Zoran Stojsavljevic 02 May '17

02 May '17

> But I also saw Todd working very hard to try *to engage Intel*, over a period of years. Whoever might be believing in this statement: Good luck to you all. You'll need it, really! :-( Zoran On Tue, May 2, 2017 at 7:56 PM, ron minnich <rminnich(a)gmail.com> wrote: > > > On Tue, May 2, 2017 at 10:39 AM Nico Huber <nico.h(a)gmx.de> wrote: > >> >> Sorry Ron, I didn't write it to offend you. >> > > No problem. It hurt a bit because I respect you so much :-) > > I find that people's take on Purism varies depending on whether they have > personally interacted with Todd or not. Up here in Mountain View we've had > multiple meetings as we tried to provide guidance to Todd. From that > experience I've come to believe that Purism, like so many of us when we > started out, was extremely naive about what was possible, and made claims > based on their lack of knowledge. But I also saw Todd working very hard to > try to engage Intel, over a period of years. I saw a sincere effort to > achieve their goals, coupled with a complete lack of knowledge about how > much effort it was, which led to them making claims that could not be > supported. > > I hope they are cleaning up their claims. They made a lot of mistakes > over the first few years, and were way too optimistic about how all this > was going to work, which cost them a lot of trust, and that is their fault. > Adding Youness was a good move, and has got them going in the right > direction. > > If anyone at Purism is listening, could you please take the time to talk > to people from this group about your web site and the claims you are > making? From what Nico says, you're still overdoing it. It just makes you > look bad and you don't need that. > > At the same time, we need to be realistic about what's going to be > possible in x86 universe. And the answer, I'm afraid, is "less and less". > I'm afraid blobs are a permanent part of the picture on any new x86 design, > and if you don't like that (I don't) then it's time to find a new > architecture to work on, as Tim and others are doing. > > [Nico, this last part is not about what you said.] I realize feelings are > strong about these issues, but calling people and projects "corrupt" is > unacceptable and, in my view anyway, I'd like people who say such things to > find another project. I watched the Plan 9 mailling list get destroyed by a > few bad actors and I don't want to see that happen here. > > Thanks > > ron > > -- > coreboot mailing list: coreboot(a)coreboot.org > https://mail.coreboot.org/mailman/listinfo/coreboot >

1 0

Re: [coreboot] Anyone got an opinion, technical or otherwise, on this?
by ron minnich 02 May '17

02 May '17

I wonder if anyone is going to completely trust AMT after this problem. It goes back almost 10 years. So for all those users who had it on for almost 10 years, the question becomes, how much did we lose and when did we lose it? The answer? We'll never know. Are we still owned? We don't know. Can we actually trust any reflash procedure, if the ME is owned while we try to reflash? Well, I hope so, but how can we know? It's a worrisome situation. ron On Tue, May 2, 2017 at 11:01 AM Patrick Georgi via coreboot < coreboot(a)coreboot.org> wrote: > Semi-Accurate only claims accuracy according to what's on the box. The > official documentation of the issue can be found at > https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075 > > It looks like a software bug in the AMT firmware. Therefore: > - No AMT (eg on non-business consumer devices) -> no (bug | exploit). > - Present but disabled AMT (eg. on business devices without AMT > enrollment) -> no (bug | exploit). (although there's apparently a way > to enable AMT unsupervised under some circumstances with some level of > local access. or something.) > > > Patrick > > 2017-05-02 19:31 GMT+02:00 John Lewis <jlewis(a)johnlewis.ie>: > > > https://semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-plat… > > > > The article says "all" Intel boards since 2008 are locally vulnerable > > (ME exploit), but the Intel advisory (linked within) says consumer > > devices are okay. > > > > What the article says about even low end devices still having the > > features albeit turned "off" rings true to me, based on stuff I've read > > here and elsewhere. What's your take (bearing in mind the technical > > details aren't available, yet)? > > > > > > -- > > coreboot mailing list: coreboot(a)coreboot.org > > https://mail.coreboot.org/mailman/listinfo/coreboot > > > > -- > Google Germany GmbH, ABC-Str. 19, 20354 Hamburg > Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: > Hamburg > Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle > > -- > coreboot mailing list: coreboot(a)coreboot.org > https://mail.coreboot.org/mailman/listinfo/coreboot

1 0

Anyone got an opinion, technical or otherwise, on this?
by John Lewis 02 May '17

02 May '17

https://semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-plat… The article says "all" Intel boards since 2008 are locally vulnerable (ME exploit), but the Intel advisory (linked within) says consumer devices are okay. What the article says about even low end devices still having the features albeit turned "off" rings true to me, based on stuff I've read here and elsewhere. What's your take (bearing in mind the technical details aren't available, yet)?

2 1

← Newer
1
...
14
15
16
17
18
19
20
21
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

coreboot May 2017