June 2018 - coreboot - mail.coreboot.org

Re: [coreboot] Equus "WHITEBOX OPEN" servers ship with Coreboot/LinuxBoot
by David Hendricks June 21, 2018

June 21, 2018

I'm calling shenanigans on this. Their server datasheets pretty clearly specify an IBV-provided firmware solution, definitely NOT coreboot or LinuxBoot and definitely NOT open. I did hear thru the grapevine that they've been in contact with at least one OpenBMC developer, at least. So basically this is a lot of misleading marketing BS AFAICT (though I'd like to be proven wrong). On Thu, Jun 21, 2018 at 4:56 AM, Alberto Bursi <alberto.bursi(a)outlook.it> wrote: > There was an announcement [1] about a new line of servers called > WHITEBOX OPEN (yes, all caps) > > which appears to be about servers with Coreboot or Linuxboot and OpenBMC. > > Has anyone any experience with this company? > > > -Alberto > > 1. https://www.prweb.com/releases/2018/06/prweb15571110.htm > > -- > coreboot mailing list: coreboot(a)coreboot.org > https://mail.coreboot.org/mailman/listinfo/coreboot >

1 0

Equus "WHITEBOX OPEN" servers ship with Coreboot/LinuxBoot
by Alberto Bursi June 21, 2018

June 21, 2018

There was an announcement [1] about a new line of servers called WHITEBOX OPEN (yes, all caps) which appears to be about servers with Coreboot or Linuxboot and OpenBMC. Has anyone any experience with this company? -Alberto 1. https://www.prweb.com/releases/2018/06/prweb15571110.htm

1 0

Re: [coreboot] Thinkpad SD card controller DMA
by Jose Trujillo June 21, 2018

June 21, 2018

If you don't enable a device in devicetree the initialization routine will not be executed. To test just insert a SD card and use DMESG or other command to see if device ID is found, also in device manager in Windows. JT. ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On June 21, 2018 2:06 PM, Thomasheidler via coreboot <coreboot(a)coreboot.org> wrote: > That's what I'm thinking about, but I am not able to test a build with it removed from the devicetree to see if that does the trick, so I was wondering if anybody knows. > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- > > coreboot mailing list: coreboot(a)coreboot.org > > https://mail.coreboot.org/mailman/listinfo/coreboot

1 0

Re: [coreboot] Thinkpad SD card controller DMA
by Thomasheidler June 21, 2018

June 21, 2018

That's what I'm thinking about, but I am not able to test a build with it removed from the devicetree to see if that does the trick, so I was wondering if anybody knows.

1 0

Re: [coreboot] Thinkpad SD card controller DMA
by Jose Trujillo June 21, 2018

June 21, 2018

Hello Thomas, It is not enough just to disable it from the devicetree ? JT. ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On June 21, 2018 1:43 PM, Thomasheidler via coreboot <coreboot(a)coreboot.org> wrote: > Thanks for your response and suggestions. > > Luckily I don’t need the SD card reader and would rather completely disable it to protect against any DMA attack before the kernel initializes IOMMU. The problem is that I don’t know how to prevent the controller from initializing at all, short of actually desoldering the chip from the mainboard, which is risky. > > Regarding the EC, are you aware of any working libre replacement for the EC on any Lenovo Thinkpad? > > > ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- > > coreboot mailing list: coreboot(a)coreboot.org > > https://mail.coreboot.org/mailman/listinfo/coreboot

1 0

Re: [coreboot] Thinkpad SD card controller DMA
by Taiidan＠gmx.com June 21, 2018

June 21, 2018

On 06/20/2018 04:08 AM, Thomasheidler via coreboot wrote: > Hello, > > I noticed that all Lenovo Thinkpads supported by coreboot have a SD card controller that is connected as a PCI device. I assume that the controller runs non-free firmware from its own ROM and because it is a PCI device it should have DMA, which seems like a security risk, right? > > If so, is there a way to prevent the SD card controller from turning on when the computer is booted, by changing some code in the source (maybe in devicetree.cb) or at least to stop the controller from having DMA? If you are using linux IOMMU will protect you after it is initialized (a few seconds after main kernel init) even if you don't add the device to a VM but before then you are SOL in terms of protection from a really slick hardware rootkit like one found in a cheap PCI-e card...but I have no idea if that thinkpad SD card PCI-e device has its own firmware. I asked a question like this quite a long time ago and there was a discussion on how to prevent this issue by not providing DMA access in the coreboot phase which is much more simple vs having coreboot init the IOMMU itself pre-linux. Look at my thread: [coreboot] DMA protection? [AMD-Vi] AFAIK nothing has changed since then in terms of security improvements but I would appreciate it if one of the coreboot expert squad can respond to this. Timothy Pearson from Raptor engineering was also willing to add DMA protection to coreboot under contract. I also suggest: Disabling Option ROM execution or executing them with YABEL. Looking in to the a libre EC replacement such as origami-ec and replacing your EC firmware with a "clean" fresh one from a lenovo update directly without using their update tool (which does a variety of things to it such as adding your serial number) which can be done on various models internally so you don't have to connect an external cable.

2 1

Re: [coreboot] Bayley Bay FSP-based CRB
by Jose Trujillo June 21, 2018

June 21, 2018

Hello Zvika, Look for the list of Linux commands to dump many of the information from your original BIOS running, maybe there you will find this information. Also, some configuration can be seen from your original BIOS running Intel FIT for Baytrail in Windows. About configuring those settings in coreboot look for other examples in the coreboot tree about configuring PCI devices in devicetree.cb and other places. I Am new to coreboot too and please correct me if I Am wrong. Good Luck! J. Trujillo ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On June 21, 2018 3:34 AM, Zvi Vered <veredz72(a)gmail.com> wrote: > Hello, > > Thank you very much for the detailed reply. > Vendor's BIOS contains few peripherals initialization. > For example: PCIe enumeration, SATA controller, USB etc. > In case of PCIe enumeration, the generation of PCIe (1,2,3) can be set. > Should vendor supply code for this ? or any other information ? > How can I write it from scratch ? Can Intel provide information on how to implement this initialization ? > > Thank you, > Zvika > > On Mon, Jun 18, 2018 at 11:22 AM Jose Trujillo via coreboot <coreboot(a)coreboot.org> wrote: > >> Hello Zvika: >> 1.- Usually it is not necessary to change the CBFS size unless the compiler complain of lack of space. >> 2.- You should not worry about this setting to make your system to work. >> 3.- You should not use FSP_PACKAGE_DEFAULT if your plan is to use SIO because it will enable SOC internal COM1, instead (if your plan is to use FSP) enable FSP and add a VGA bios bin manually.... (The use of FSP is optional but I never tried without FSP). >> 4.- You need to add them yourself, there are examples to follow in this mail list. >> Good luck! >> J.Trujillo >> >> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ >> On June 18, 2018 6:24 AM, Zvi Vered <veredz72(a)gmail.com> wrote: >> >>> Hello, >>> I inspected the "Bayley Baay FSP-based CRB" sample in coreboot. after make distclean I chose: >>> Mainboard vendor: Intel >>> Mainboard model: Bayley Bay FSP-based CRB >>> 1. The size of CBFS is: 0x200000. Is it a fix size or should I change it according to my board (which is also bay trail) ? >>> 2. According to "dmidecode" I ran on my target, "Address: 0xE0000" >>> Should I set this address in coreboot configuration ? How ? >>> >>> 3. In this board default configuration, "Configure defaults for the Intel FSP package" is not selected. Is it possible that this board does not use Intel FSP at all ? >>> Under "Generic Drivers", "Use Intel firmware Support Package' is also not selected. >>> >>> 4. Under "chipset", there is no option to set "Super I/O". Can you please tell why ? >>> 5. I noticed that the minimum ROM size is 2MB. If I set 4MB, the size of coreboot.rom is also 4MB. >>> >>> Thank you in advance, >>> Zvika >> >> -- >> coreboot mailing list: coreboot(a)coreboot.org >> https://mail.coreboot.org/mailman/listinfo/coreboot

1 0

Re: [coreboot] Bayley Bay FSP-based CRB
by Nico Huber June 21, 2018

June 21, 2018

On 21.06.2018 02:34, Zvi Vered wrote: > In case of PCIe enumeration, the generation of PCIe (1,2,3) can be set> Should vendor supply code for this ? or any other information ? PCIe configuration is SoC specific and should be done by FSP. However, I can't find any PCIe specific settings for the BayTrail FSP. As this is one of the earlier FSP releases, it is not unlikely that it does not expose all the option Intel's reference code provides. I'll add the maintainers of the BayTrail FSP hook-up in CC. Maybe they can tell us more about it. > How can I write it from scratch ? Can Intel provide information on how to > implement this initialization ? AFAIK, Intel does not document PCIe initialization and encourages every- one to use their reference code (which is compiled into FSP). It's a shame that they don't allow open-source implementations because we can't make any alterations to FSP once Intel thinks it's finished (which is almost always too early, IMHO). Nico

1 0

Re: [coreboot] Bayley Bay FSP-based CRB
by Nico Huber June 21, 2018

June 21, 2018

Hello Zvika, On 18.06.2018 05:24, Zvi Vered wrote: > 1. The size of CBFS is: 0x200000. Is it a fix size or should I change it > according to my board (which is also bay trail) ? on Intel platforms, the SPI flash is shared with other chipset compo- nents. The CBFS_SIZE should be at most the size of the "BIOS" region of the flash. > 3. In this board default configuration, "Configure defaults for the Intel > FSP package" is not selected. Is it possible that this board does not use > Intel FSP at all ? > > Under "Generic Drivers", "Use Intel firmware Support Package' is also not > selected. > FSP is mandatory for a bootable image. It is not enabled by default because Intel does not (always) publish the matching binaries, but our build tests require the defaults to build. This leaves us with unfor- tunate default settings for all Intel FSP platforms that will never boot. If you think that is a bad idea (I do) please let Intel know that you are interested in working defaults and that it requires them to publish all the binaries that are integrated into coreboot. > 4. Under "chipset", there is no option to set "Super I/O". Can you please > tell why ? Our config options do not allow board specific changes. For such settings, each board has it's own directory and Kconfig file (src/mainboard/<vendor>/<board>/Kconfig). > > 5. I noticed that the minimum ROM size is 2MB. If I set 4MB, the size of > coreboot.rom is also 4MB. That is correct, but keep in mind that the flash is shared. The resulting coreboot.rom might not contain everything that is required to boot. So it is best advised to only flash the "BIOS" region of the coreboot.rom. Hope that helps, Nico

1 0

What happened to the Option ROM options?
by Taiidan＠gmx.com June 21, 2018

June 21, 2018

Using KGPE-D16 with master. The choices for them have been messed around with in kconfig sometime ago: In /src/device/kconfig ON_DEVICE_ROM_LOAD has for some reason been changed to require VGA_ROM_RUN which makes no sense to me (maybe someone could need option ROM's without VGA option ROM's?) and VGA_ROM_RUN is not available on boards with native (coreboot) init irregardless so people don't see it even if they require Option ROM's for whatever reason without SeaBIOS. Does anyone know where the changelog for this is? and maybe can explain what the reasoning is behind it? (if it is not a mistake) Before...I believe last in v4.5 they were shown all the time. I attempted to find the change in gerrit etc but I was unable to locate it. Thanks!

1 0