August 2012 - SeaBIOS - mail.coreboot.org

Flash firmware from firmware
by Fred . Aug. 25, 2012

Aug. 25, 2012

Add support for flashing the firmware from the firmware without first loading an operating system and flashing within the OS. This could be implemented as a payload.

1 0

NIST publishes draft guidelines for server BIOS protection
by Fred . Aug. 25, 2012

Aug. 25, 2012

http://paritynews.com/security/item/215-nist-publishes-draft-guidelines-for… http://csrc.nist.gov/publications/drafts/800-147b/draft-sp800-147b_july2012…

1 0

Re: [SeaBIOS] Data exchange between coreboot - seabios - option rom
by Kevin O'Connor Aug. 23, 2012

Aug. 23, 2012

On Thu, Aug 23, 2012 at 08:54:08AM +0200, Christian Gmeiner wrote: > 2012/8/23 Kevin O'Connor <kevin(a)koconnor.net>: > > Why read the i2c and then patch the vgabios - why not just have the > > vgabios read from i2c directly? > > May I need to say that we are talking here about two different i2c buses. > * i2c bus of cs5563 > * i2c bus for EDID data transfer - used by VGA > > As may panel is connected via LVDS I can not get EDID data from it. So > I want to use > EPI and EDID extension. > > So I would read the i2c eeprom at the cs5536 smb bus and get 3 values. > Based on these > values I decide which EDID/EPI binary blob I would like to use. So, why not read the i2c eeprom directly from the vgabios? It seems fragile to build an interface between coreboot and a vgabios just so coreboot can read the eeprom. -Kevin

2 1

Commit 46ee83 changes guest fingerprint unconditionally
by anthony＠codemonkey.ws Aug. 23, 2012

Aug. 23, 2012

commit 46ee8349d22d11ec4b8609c5bf14db9409eef974 Author: Gerd Hoffmann <kraxel(a)redhat.com> Date: Thu Jun 7 10:34:31 2012 +0200 update bios date Linux ignores some information from acpi in case the bios is old as acpi support used to be buggy in the early days. This affects ressources for example (unless forced with pci=use_crs). So lets go for something more recent. With this patch applied the ressources for \\SB.PCI0 will show up in /proc/{iomem,ioports}, tagged as "PCI Bus 0000:00". Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> Breaks qemu-test: *** Running tests *** Running test /tests/finger-print.sh... OK --- fingerprints/pc-1.0.x86_64 2011-12-18 13:08:40.000000000 -0600 +++ fingerprint.txt 2012-08-22 13:22:29.000000000 -0500 @@ -57,7 +57,7 @@ /sys/bus/pci/devices/0000:00:06.0/revision=0x00 /sys/bus/pci/devices/0000:00:06.0/virtio/host-features=0x710006d4 /sys/class/dmi/id/bios_vendor=Bochs -/sys/class/dmi/id/bios_date=01/01/2007 +/sys/class/dmi/id/bios_date=01/01/2011 /sys/class/dmi/id/bios_version=Bochs /sys/class/dmi/id/chassis_vendor=Bochs /sys/class/dmi/id/chassis_version= Guest fingerprint changed for pc-1.0! Can we make the bios date set from fw_cfg? We really can't change the SMBIOS information unconditionally like this. Regards, Anthony Liguori

3 2

Re: [SeaBIOS] Data exchange between coreboot - seabios - option rom
by Kevin O'Connor Aug. 23, 2012

Aug. 23, 2012

On Wed, Aug 22, 2012 at 04:13:29PM +0200, Christian Gmeiner wrote: > 2012/8/22 Kevin O'Connor <kevin(a)koconnor.net>: > > I'm not sure I fully understand your requirements. Will the board > > truly have different flat screens hooked up to it? One can't simply > > There are different screens (timing and resolution) connected to the device. > > > compile the EPI info into the BIOS? Also, if you have to interrogate > > the display via i2c, can you simply fully generate the EPI info in the > > vgabios at runtime? > > After some time of hacking I came up with the following solution. > > 1) Reserve 128 byte in SeaVIDOEBIOS (between ROM haeder and entry points) > 2) Add all needed epi files to cbfs > 3) Add possibility to patch vbios during loading based on i2c content > - see http://review.coreboot.org/#/c/1478/ Why read the i2c and then patch the vgabios - why not just have the vgabios read from i2c directly? > 4) Extend vbios to make use of epi/edid data by writing a simple parser > 5) Extend VBE > 6) Extend geode code in vbios to make use of parsed epi/edid data -Kevin

2 1

[CCE 4177-2] The XD/NX processor feature should be enabled or disabled as appropriate in the BIOS
by Fred . Aug. 22, 2012

Aug. 22, 2012

Add setting to enable/disable XD/NX-bit for security. http://nvd.nist.gov/scap/content/stylesheet/scap-rhel5-document.htm

1 0

[CCE 3944-6] Option to disable booting from USB devices
by Fred . Aug. 22, 2012

Aug. 22, 2012

CCE 3944-6 http://nvd.nist.gov/scap/content/stylesheet/scap-rhel5-document.htm "An attacker with physical access could try to boot the system from a USB flash drive and then access any data on the system’s hard drive, circumventing the normal operating system’s access controls. To prevent this, configure the BIOS to disallow booting from USB drives. Also configure the BIOS or firmware password as described in Section 2.3.5.1 to prevent unauthorized configuration changes."

1 0

Re: [SeaBIOS] Data exchange between coreboot - seabios - option rom
by Kevin O'Connor Aug. 22, 2012

Aug. 22, 2012

On Tue, Aug 21, 2012 at 04:57:56PM +0200, Christian Gmeiner wrote: > 2012/8/21 Christian Gmeiner <christian.gmeiner(a)gmail.com>: > > Hi all, > > > > my vacation is over and I need to look in some stuff deeper to finally > > get the combination coreboot/seabios fully working. The only missing part > > aside from a lot of testing is the video bios stuff. Here I am working on > > a patch series to extend seabios vga option rom to support flat panels. > > > > I would like to to use EPI (http://www.epi-standard.org/) for the description > > of the panels. Due EOL changes my target hardware supports different > > kind of flat panels (with different timings). I can detect what panel is used > > with the help of an i2c eeprom. So the normal CBFS will be extended by > > n EPI raw files. And here the troubles begins :) > > > > 1) Can I add symbolic links during runtime > > > > It would be fine if somewhere during the boot (coreboot or seabios) I > > can readout > > the needed bytes from the eeprom, decide which EPI file to use and create > > something line a symlink to the choosen one. > > > > panel.epi -> 640_480_panel_name.epi I don't know of anyway to do this. The effort to implement this would probably be large. > As I found out this can be done via nvram. So coreboot set the filename of the > EPI file to use and seabios/... etc can simply use it. Using CMOS for passing temporary variables around is quite ugly. I'd recommend against it. > > 2) Can I load a CBFS file in the option rom? > > > > The idea is to load the EPI raw file and provide it via VBE (vbe_104f15) BIOS > > call. So the geode lx option rom can read out the timing informations via VBE > > and setup the video mode. It's possible. However, the vgabios currently runs in 16bit mode. Getting the existing CBFS code to run in 16bit mode would be a pain. Probably better to convert the vgabios init phase to jump into 32bit mode. However, that is a bit of work. > It could also be possible to store the EPI data at a defined memory > area where the > option rom can simply check for existing identifiers and checksum. I'd recommend against that - magic areas of memory have been quite troublesome in the past. > Any hints are really welcome. I'm not sure I fully understand your requirements. Will the board truly have different flat screens hooked up to it? One can't simply compile the EPI info into the BIOS? Also, if you have to interrogate the display via i2c, can you simply fully generate the EPI info in the vgabios at runtime? -Kevin

2 1

Re: [SeaBIOS] Data exchange between coreboot - seabios - option rom
by Christian Gmeiner Aug. 21, 2012

Aug. 21, 2012

2012/8/21 Christian Gmeiner <christian.gmeiner(a)gmail.com>: > Hi all, > > my vacation is over and I need to look in some stuff deeper to finally > get the combination coreboot/seabios fully working. The only missing part > aside from a lot of testing is the video bios stuff. Here I am working on > a patch series to extend seabios vga option rom to support flat panels. > > I would like to to use EPI (http://www.epi-standard.org/) for the description > of the panels. Due EOL changes my target hardware supports different > kind of flat panels (with different timings). I can detect what panel is used > with the help of an i2c eeprom. So the normal CBFS will be extended by > n EPI raw files. And here the troubles begins :) > > 1) Can I add symbolic links during runtime > > It would be fine if somewhere during the boot (coreboot or seabios) I > can readout > the needed bytes from the eeprom, decide which EPI file to use and create > something line a symlink to the choosen one. > > panel.epi -> 640_480_panel_name.epi > As I found out this can be done via nvram. So coreboot set the filename of the EPI file to use and seabios/... etc can simply use it. > 2) Can I load a CBFS file in the option rom? > > The idea is to load the EPI raw file and provide it via VBE (vbe_104f15) BIOS > call. So the geode lx option rom can read out the timing informations via VBE > and setup the video mode. > It could also be possible to store the EPI data at a defined memory area where the option rom can simply check for existing identifiers and checksum. Any hints are really welcome. --- Christian Gmeiner, MSc

1 0

Data exchange between coreboot - seabios - option rom
by Christian Gmeiner Aug. 21, 2012

Aug. 21, 2012

Hi all, my vacation is over and I need to look in some stuff deeper to finally get the combination coreboot/seabios fully working. The only missing part aside from a lot of testing is the video bios stuff. Here I am working on a patch series to extend seabios vga option rom to support flat panels. I would like to to use EPI (http://www.epi-standard.org/) for the description of the panels. Due EOL changes my target hardware supports different kind of flat panels (with different timings). I can detect what panel is used with the help of an i2c eeprom. So the normal CBFS will be extended by n EPI raw files. And here the troubles begins :) 1) Can I add symbolic links during runtime It would be fine if somewhere during the boot (coreboot or seabios) I can readout the needed bytes from the eeprom, decide which EPI file to use and create something line a symlink to the choosen one. panel.epi -> 640_480_panel_name.epi 2) Can I load a CBFS file in the option rom? The idea is to load the EPI raw file and provide it via VBE (vbe_104f15) BIOS call. So the geode lx option rom can read out the timing informations via VBE and setup the video mode. The result should be something like this: http://www.youtube.com/watch?v=83CDqJMblkw greets --- Christian Gmeiner, MSc

1 0