coreboot August 2017

coreboot@coreboot.org

59 participants
132 discussions

FOSDEM 2018, Feb. 3+4
by Carl-Daniel Hailfinger 21 Aug '17

21 Aug '17

Hello everyone, who's up for organizing a booth and maybe a devroom at FOSDEM 2018? https://fosdem.org/2018/news/2017-08-21-dates-fosdem-2018/ Regards, Carl-Daniel

1 0

ASUS KGPE-D16 Automated Test Failure [master]
by Raptor Engineering Automated Coreboot Test Stand 21 Aug '17

21 Aug '17

The ASUS KGPE-D16 fails verification for branch master as of commit 6278867065e0849ba54ed7022fc9aab819daaaaf The following tests failed: BOOT_FAILURE Commits since last successful test: 6278867 soc/intel/common/smbus: Don't clear random bits See attached log for details This message was automatically generated from Raptor Engineering's ASUS KGPE-D16 test stand Want to test on your own equipment? Check out https://www.raptorengineering.com/content/REACTS/intro.html Raptor Engineering also offers coreboot consulting services! Please visit https://www.raptorengineering.com for more information Please contact Timothy Pearson at Raptor Engineering <tpearson(a)raptorengineering.com> regarding any issues stemming from this notification

2 1

Re: [coreboot] util/cbfstool in coreboot master
by Alberto Bursi 21 Aug '17

21 Aug '17

On 21/08/2017 11:36, Patrick Georgi via coreboot wrote: > That's sad. The only fix I see is to take down the mirror. > > > Patrick How about adding a few lines in readme aimed at github users? The README is most likely the first thing most sane perople read before compiling, or if there are issues. -Alberto

1 0

Re: [coreboot] util/cbfstool in coreboot master
by Patrick Georgi 21 Aug '17

21 Aug '17

2017-08-21 11:25 GMT+02:00 John Lewis <jlewis(a)johnlewis.ie>: > Do you think there's something that could be also be done in > this regard on https://github.com/coreboot/coreboot (like customise the > message in the "clone or download" button? GitHub is not our platform, we're merely guests there (and that's the reason we have read-only repos there). So no, AFAIK that can't be changed. > Because when I do a search for > "coreboot git" that's what comes up as the top result, and obviously then > you will probably have people blindly git cloning and wondering why things > don't work. That's sad. The only fix I see is to take down the mirror. Patrick -- Google Germany GmbH, ABC-Str. 19, 20354 Hamburg Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: Hamburg Geschäftsführer: Paul Manicle, Halimah DeLaine Prado

1 0

Re: [coreboot] util/cbfstool in coreboot master
by Patrick Georgi 21 Aug '17

21 Aug '17

Good call. I amended https://www.coreboot.org/Git to ask users to do `git clone --recurse-submodules` which will checkout the submodules as part of the download. 2017-08-21 11:07 GMT+02:00 John Lewis <jlewis(a)johnlewis.ie>: > Thanks Patrick - is that written somewhere reasonably obvious that I missed? > Just thinking from the POV of people new to the project or who aren't coding > mavens (like me). > > > On Mon, 21 Aug, 2017 at 10:04 AM, Patrick Georgi <pgeorgi(a)google.com> wrote: > > It's used for the hashing features and pulled in by one of the submodules. > Use `git submodule update --init` to pull in all of them (except blobs, > which is disabled by default). 2017-08-21 10:55 GMT+02:00 John Lewis > <jlewis(a)johnlewis.ie>: > > Hi Guys, Apparently, in coreboot master, util/cbfstool has a reference to > some vboot code that isn't pulled in. Can someone (possibly Patrick) tell me > why? This looks like a barrier to people being able to use/compile things. > root@beaglebone:~/coreboot/util/cbfstool# make HOSTCC cbfstool/cbfstool.o In > file included from /root/coreboot/util/cbfstool/cbfstool.c:27:0: > /root/coreboot/util/cbfstool/cbfs.h:23:21: fatal error: vb2_api.h: No such > file or directory #include <vb2_api.h> Cheers, John. -- coreboot mailing > list: coreboot(a)coreboot.org > https://mail.coreboot.org/mailman/listinfo/coreboot > > -- > Google Germany GmbH, ABC-Str. 19, 20354 Hamburg Registergericht und -nummer: > Hamburg, HRB 86891, Sitz der Gesellschaft: Hamburg Geschäftsführer: Paul > Manicle, Halimah DeLaine Prado -- Google Germany GmbH, ABC-Str. 19, 20354 Hamburg Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: Hamburg Geschäftsführer: Paul Manicle, Halimah DeLaine Prado

1 0

util/cbfstool in coreboot master
by John Lewis 21 Aug '17

21 Aug '17

Hi Guys, Apparently, in coreboot master, util/cbfstool has a reference to some vboot code that isn't pulled in. Can someone (possibly Patrick) tell me why? This looks like a barrier to people being able to use/compile things. root@beaglebone:~/coreboot/util/cbfstool# make HOSTCC cbfstool/cbfstool.o In file included from /root/coreboot/util/cbfstool/cbfstool.c:27:0: /root/coreboot/util/cbfstool/cbfs.h:23:21: fatal error: vb2_api.h: No such file or directory #include <vb2_api.h> Cheers, John.

2 1

Re: [coreboot] Question about finalization of SMM
by Nico Huber 21 Aug '17

21 Aug '17

On 18.08.2017 09:20, Shawn wrote: > On Tue, Aug 15, 2017 at 1:04 PM, Persmule <persmule(a)gmail.com> wrote: >> Hi all, >> >> When using chipsec ( https://github.com/chipsec/chipsec ) to analyse >> possible vulnerabilities inside coreboot systems, I noticed that on >> several intel-based systems running coreboot,(e.g. >> https://review.coreboot.org/cgit/board-status.git/tree/lenovo/x230/4.6-938-… >> ) several registers on the pci-e root complex (host bridge) is not >> locked while locked on the same system running oem firmware. >> >> Digging into the source code, I found a function defined inside >> ${COREBOOT_DIR}/src/northbridge/intel/{nehalem, sandybridge, >> haswell}/finalize.c to lock these registers, but this function will only >> be called if #SMI APM_CNT gets triggered with a certain parameter. ( The >> handler of #SMI APM_CNT is usually defined as function >> "southbridge_smi_apmc" inside >> ${COREBOOT_DIR}/src/${VENDOR}/${MAINBOARD}/smihandler.c or >> ${COREBOOT_DIR}/src/southbridge/intel/${CHIPSET}/smihandler.c, and the >> lockdown function will be called with parameter register APM_CNT == >> APM_CNT_FINALIZE.) >> >> That these registers are left unlocked indicates that #SMI APM_CNT is >> never triggered with APM_CNT == APM_CNT_FINALIZE during boot. I would >> like to ask, that when does the #SMI APM_CNT is expected to be triggered >> with APM_CNT == APM_CNT_FINALIZE, and which component of the system >> (e.g. coreboot, payload, or os kernel) is responsible for the triggering? It should be triggered by coreboot or the payload, IMO. The original idea was to do it from the payload, I guess, because it wouldn't make much sense to gather all of this in the SMM handler otherwise. >> > It seems will be triggered after S3, southbridge/intel/bd82x6x/lpc.c: > > static void lpc_final(struct device *dev) > { > if (CONFIG_HAVE_SMI_HANDLER && acpi_is_wakeup_s3()) { > /* Call SMM finalize() handlers before resume */ > outb(0xcb, 0xb2); > } > } > > It's weird a bit. Those LOCKs bit should be set at the boot time. I guess it was originally called from the payload and thus had to be done by coreboot on the resume path (where no payload is called). AFAIK, coreboot also does it on the regular path for newer chipsets. A lot of people already stumbled upon this problem on Sandy Bridge but it seems nobody chose to do it in coreboot, yet. > Will > coreboot provide an option in the future? My oracle says yes. Though it's not specific about when or by whom it will be done. In other words: Patches are welcome. Nico

2 1

FYI: Reverse Engineering x86 Processor Microcode
by Rudolf Marek 21 Aug '17

21 Aug '17

Hi all, I think some of you might already noticed a nice paper: Microcode is an abstraction layer on top of the physical components of a CPU and present in most generalpurpose CPUs today. In addition to facilitate complex and vast instruction sets, it also provides an update mechanism that allows CPUs to be patched in-place without requiring any special hardware. While it is well-known that CPUs are regularly updated with this mechanism, very little is known about its inner workings given that microcode and the update mechanism are proprietary and have not been throughly analyzed yet. In this paper, we reverse engineer the microcode semantics and inner workings of its update mechanism of conventional COTS CPUs on the example of AMD’s K8 and K10 microarchitectures. Furthermore, we demonstrate how to develop custom microcode updates. We describe the microcode semantics and additionally present a set of microprograms that demonstrate the possibilities offered by this technology. To this end, our microprograms range from CPU-assisted instrumentation to microcoded Trojans that can even be reached from within a web browser and enable remote code execution and cryptographic implementation attacks. https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-koppe… which is about unencrypted AMD K8 microcode. It should throw some light on how the microcode works, and also why is it good to apply the fixes. Please note that I don't want another flamewar about why not doing the microcode updates would make my system more free. There seems to be just one detail missing, the microcode triads are somehow obfuscated, and the paper does not tell how. Happy hacking, Rudolf

2 1

Re: [coreboot] Howto enable AMD Cool'n'Quiet support
by Rudolf Marek 20 Aug '17

20 Aug '17

Hi, Sorry for the delay.> CPU ID 0x80000001: fc0 So your CPU is revision "DH" which is pre "F". > But I have also seen that CONFIG_K8_REV_F_SUPPORT is not set in .config nope this is for some other CPUs. If you look to coreboot/src/cpu/amd/model_fxx/powernow_acpi.c, your CPU 0xfc0 has an entry there. You need to check pstates_algorithm() function. It may not be executed at all, or there is something wrong with that. Make sure that you look to the later one, there is #ifdef in this file! The first one is for CONFIG_K8_REV_F_SUPPORT. This functionality is called from amd_generate_powernow() which goes from via/k8t890/traf_ctrl.c I suspect that this old VIA chipset has no PCI device for this thus the .acpi_fill_ssdt_generator = southbridge_acpi_fill_ssdt_generator Is never called. I did not do the support for the K8T800 chipset so I don't know. Maybe you can provide lspci -xxx -n from linux to see what kind of PCI devices you have. Perhaps then the callback can be added elsewhere to the PCI device you have such as northbridge_driver_t800_old. You can try attached patch, maybe it will move you further. I remember it was real pain to get the cool-n-quiet working, there was a lot of southbridge tweaks necessary (and undocumented bits!). Just give it a try. In worst case you will see some messages in dmesg about Targ stuck bits... Thanks Rudolf

1 0

ASUS KGPE-D16 Automated Test Failure [master]
by Raptor Engineering Automated Coreboot Test Stand 20 Aug '17

20 Aug '17

The ASUS KGPE-D16 fails verification for branch master as of commit e464ccd116fe51137d9068c5db2edd7275ae8c9d The following tests failed: BOOT_FAILURE Commits since last successful test: e464ccd mb/gigabyte/ga-b75m-d3v: add libgfxinit support e09cd1b arch/x86: Sanity checking on HAVE_SMI_HANDLER a945008 intel/smm/gen1: Backup default SMM area 2e50142 i82801dx/gx/ix/jx: Add low-memory backup for S3 path 0cc2ce4 arch/x86: Clean up CONFIG_SMP and MAX_CPUS test ff284f6 arch/x86: Fix ugly NEED_LAPIC use aeb2d64 soc/intel/skylake: Enable power button SMI when jumping to payload See attached log for details This message was automatically generated from Raptor Engineering's ASUS KGPE-D16 test stand Want to test on your own equipment? Check out https://www.raptorengineering.com/content/REACTS/intro.html Raptor Engineering also offers coreboot consulting services! Please visit https://www.raptorengineering.com for more information Please contact Timothy Pearson at Raptor Engineering <tpearson(a)raptorengineering.com> regarding any issues stemming from this notification

1 0

← Newer
1
2
3
4
5
6
7
8
...
14
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

coreboot August 2017