User:GNUtoo

From coreboot
Revision as of 14:15, 17 February 2017 by GNUtoo (talk | contribs) (→‎My TODO list)
Jump to navigation Jump to search
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.

Contributions

In the gerrit guidelines there the follwing line: "Don't modify other people's patches without their consent." I consent to the modification of my patches by anybody. I work on specific things because no one wants to do what I want to do. Else I'd be happy to pick the next task in my huge TODO list.

I've contributed to the following ports:

  • M4A785T-M: I've been the main person working on it.
  • Lenovo X60: I've been working on the native GPU init, and various other improvements.
  • Lenovo T60: I've been working on some improvements.
  • Alix 1.C: I've been working on some improvements.

Interests:

  • 100% Free computers(Laptops, Desktops, Home Servers, routers).
  • Security
    • Secure boot trough GRUB with full disk encryption (no /boot in clear)
    • Protect against DMA and other attacks that have access to the x86 cpu's RAM.
  • Making it possible for end user to be able to use coreboot/libreboot:
    • Making it easy or scalable to install coreboot/libreboot.
    • Making it usable.
  • Making less risky to reflash, permitting users without an external programmer to easily reflash, and developers to develop anywhere without a huge setup consisting of another computer and the coreboot computer beeing worked on. I'm also interested in getting the cbmem logs written to flash to make debugging easier when no other computer is available(for instance while the developer is traveling to a conference).

Howtos

make recent intel BIOS flash writable and/or extract its pieces

Coreboot has an uttility in util/ifdtool for that.

  • power off the laptop totally (remove the power, the battery etc...)
  • connect an external programmer to the BIOS flash chip.
  • dump the chip content with flashrom and that external programmer.
  • run ifdtool on the extracted chip content
  • reflash the modified content

AMD/ATI/Nvidia GPU with SeaBIOS without running the option rom

The idea is to keep the option rom in memory while making SeaBIOS not run it. This has the effect of permitting linux(-libre) to initalize the GPU on all AMD/ATI and Nvidia GPU I tried it with. The downside is the lack of graphics before that. That means no graphics in GRUB.

Patch

From 73aae33b7e70d15b595b3f127ffe98bd76f9a646 Mon Sep 17 00:00:00 2001
From: Denis 'GNUtoo' Carikli <GNUtoo@no-log.org>
Date: Sat, 7 Mar 2015 15:39:52 +0100
Subject: [PATCH] Kconfig: Add option not to run option roms

Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@no-log.org>
---
 src/Kconfig      | 8 ++++++++
 src/optionroms.c | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/src/Kconfig b/src/Kconfig
index 95bf087..1988f56 100644
--- a/src/Kconfig
+++ b/src/Kconfig
@@ -403,6 +403,14 @@ menu "BIOS interfaces"
         default y
         help
             Support Post Memory Manager (PMM) entry point.
+    config OPTIONROMS_NORUN
+        depends on OPTIONROMS
+        bool "Put the option roms in memory, but don't run them"
+        default n
+        help
+            Some GPU drivers are capable of initializing the display alone,
+            but they still require some data from the option rom.
+
     config BOOT
         bool "Boot interface"
         default y
diff --git a/src/optionroms.c b/src/optionroms.c
index c81eff2..c7c89da 100644
--- a/src/optionroms.c
+++ b/src/optionroms.c
@@ -53,7 +53,9 @@ __callrom(struct rom_header *rom, u16 offset, u16 bdf)
 void
 callrom(struct rom_header *rom, u16 bdf)
 {
+#if (!CONFIG_OPTIONROMS_NORUN)
     __callrom(rom, OPTION_ROM_INITVECTOR, bdf);
+#endif
 }
 
 // Execute a BCV option rom registered via add_bcv().
-- 
2.6.4

X60/I945 native GPU init History

The Lenovo X60 GPU init has been merged a long time ago. Since then it has been rewriten/improved a lot by other people (See git log for more details). Thanks to all that work it's now a proper driver.

So I've moved the X60 GPU init information in a subpage

Personal oppinions

Microcode

The issue about the CPU microcodes is that they are non-free, and under a license that is incompatible with coreboot's license.

Practically speaking, I guess that if the microcode is in the cbfs(coreboot filesystem) instead of beeing integrated directly in coreboot, that would count as agrgate work and should be safe, but I'm not a lawyer(so ask a good one instead). The solution would then be to remove the microcodes from the coreboot repositories.

(I guess that it would then end up in the blob repository instead which is a separate repository, and would then be included in the coreboot filesytem).

Some people say that the microcode is the equivalent of having a more recent CPU, as a justification for using it. Though since Intel microcodes are encrypted and signed, its meaning is not public, therefore we can't really know what's inside, so people usually trust what the CPU vendor say about it, such as that it fixes some bugs(erratas for such bugs are published).

My goal is to have a 100% free computer, and also to spread that code, so that other people can have a 100% free computer too. According to the FSF, and the FSF criterias for differenciating software from hardware, that microcode is software. So since they consider it as non-free, a coreboot image containing that microcode would not be considered free by the FSF.

On my Lenovo x60, the microcode was easy to remove, and it worked fine, beside printing a scary kernel message pointing to an Intel errata. Practically speaking, after resuming(so after suspend to ram), the temperatures reading will not be updated, and the temperature overheat will not be reported. The hardware issues you may encounter will depend on your specific CPU, not the model, but instead the date at which it was manufactured.

The result of it is that the FSF certified the gluglug's lenovo x60: gluglug removed the last microcodes(that were not used by the x60), sent that source code to the FSF, which certified it. So instead of debating trough huge flames aobut the fact that we should use, or not use the microcode, it was more effective to remove it. The benefit is the publicity arround that laptop that can be made 100% free software, which makes users aware of it and willing to switch to it.

Yabel

Yabel is great for tracing what the GPU does.

But the GPUs in the Lenovo x60 and t60 have a bar that gives access to the whole memory:

Region 1: I/O ports at 50a0 [size=8]

So using Yabel to prevent the VGA option rom from doing nasty tricks is probably not safe enough.

I was told that many other GPU also have that issue.

The way to fix that is to get rid of the proprietary VGA option rom. On some boards it's possible and coreboot has a replacement for it. On some other boards, the kernel can initialize the GPU with or without tricks.

For coreboot developers

This section is mainly usefull for finding informations for:

  • Asking me to test some code (that's why I listed all my hardware).
  • Find my work in progress code.
  • Find legacy code.
  • Find what I'm interested in working on:
    • If you want to work on the same thing than me, you could contact me if you want so:
      • I could help if I have time.
      • I could test if I have time.
      • I may have some pointers.
  • HOWTO that documents how to do a native VGA init for the Lenovo x60:
    • It probably applies to the Lenovo t60 that have an Intel GPU, with no or very minor modifications.

Hardware

Mainboard/Devices running coreboot

Device/Mainboard Serial/output flash recovery mecanism My area of interest
Asrock E350M1
  • Serial
  • Some other outputs may work but I didn't test them.
  • External programmer
  • Swapping the flash chip
  • Powering off the GPU
  • Low noise home server use case
Asus F2A85-M PRO
  • cbmem -c
  • External programmer
  • Swapping the flash chip
  • I've been the main porter.
  • Usability improvements
Asus M4A785T-M
  • Serial
  • External programmer
  • Swapping the flash chip
  • I've been the main porter.
  • Usability improvements
Lenovo T60
  • Serial on the dock
  • USB debug
  • spkmodem(untried but should work)
External programmer with pomona clip(untried but should work)
  • Native GPU init
  • Usability improvements.
Lenovo X200T
  • None tried yet
  • I've no compatbile dock
I didn't flash it yet.
  • Making it easier to flash.
  • Checking its security and freedom to see how it can compare to the Lenovo X60.
Lenovo X60
  • Serial on the dock
  • USB debug
  • spkmodem
External programmer with pomona clip
  • Native GPU init
  • Secure boot with grub.
  • Usability improvements.
Lenovo X60T
  • None tried yet
  • I've no compatbile dock
External programmer with pomona clip
  • Native GPU init
  • Touchscreen support
  • Usability improvements.
PC Engines Alix 1.C
  • Serial
Hot swap with the LPC dongle
  • Usability improvements.

Mainboard/Devices not running coreboot (yet?)

  • HP nc6320 Not worth it. I don't have this laptop anymore. Less prone to dis disassembly and reassembly than the Lenvo X60,X60T,T60. So doing a port will probably break the laptop due to the high number of disassemblies and reassemblies.
  • Asus N71JQ Broken by messing with the 3.3V line while flashing.

Note that they will probably never run coreboot, as I don't think they're worth the time.

Debugging tools

  • External programmers :
    • Arduino duemillanove (serprog based)
    • Arduino uno (serprog based)
    • openmoko debug board (FTDI based)
    • bug20 (linux_spi)
  • A pomona clip
  • a null-modem serial cable and 2 USB<->Serial adapters
  • USB debug compatible devices:
    • a bug20 (omap3530)
    • a GTA04 A3 (DM370)

My TODO list

See also TODO of the respectives machines on their dedicated wiki page.

  • I945, GM45, GS45 thinkpads: Have all hardware features working (feature parity with the default boot firmware):
    • IRDA
    • TPM
    • Testing: write tests for
      • suspend/resume
      • power consumption
      • heat
  • I945: SeaBIOS: allow booting on SD cards.
  • Port a logging mecanism from chromebooks to all devices in order to be able to retrive the log of the failed boot at the next reboot.
  • Document flash protections and vboot.
  • Verify if all the microcodes were moved away from coreboot git.
  • (Alix 1.C: port the VSA to fasm)
  • (GDB improvements: allow gdb earlier than ramstage)

Other

00:52 < phcoder-screen> GNUtoo-irssi: once you asked why upper 128bytes of cmos behave in strange way: you have to enable them in rcba

To verify

  • I have bad memory on this, but I was probably told by someone who talked to peter stuge, or by peter stuge that if you blank the flash chip holding the BIOS, in an X61, power off the computer and power it on again, an IPV6 packet would come out of the (wired) NIC. This was due to AMT, which is on the NIC (X61 is old, and at that time AMT was on the intel ethernet NICs).
    • Once verified, the goal would be to reproduce that on an x200:
      • blank the BIOS flash chip, power off the computer, boot it.
      • observe an ipv6 packet
      • blank the NIC flash chip that holds its fimrware
      • hopefully observe no ipv6 packet
      • reflash coreboot inisde the BIOS flash chip

=> That may be able to produce a test case for knowing if the AMT firmware of the NIC was gone or not, but it does requires external reflashing. Would that be enough to be sure about the intel NIC of the laptops with a similar chipset?

Sandbox

/sandbox