Re: [coreboot] Berlin Meeting 21. Sep Thursday @afra_berlin

[Martin Kepplinger]

On 2017-09-23 17:52, Peter Stuge wrote:
> Martin Kepplinger wrote:
>> It's lying here as a brick.
> 
> Where is "here" ? What city?
> 

Linz, Austria

-- 
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Where is the serial number stored on the thinkpad ivy/sandy bridge laptops

[Alexander Couzens]

> I am curious as to how it survives the coreboot flash re-write, maybe 
> the EC?

e.g.
> Base Board Information
>   Manufacturer: LENOVO
>   Product Name: 4291QT1
>   Version: ThinkPad X220
>   Serial Number: XYZU1234...

comes from a small i2c eeprom (at24 based).
src/drivers/i2c/at24rf08c/lenovo_serials.c

best,
lynxis

ps: The at24 also contains your lenovo bios password.
-- 
Alexander Couzens

mail: lyn...@fe80.eu
jabber: lyn...@fe80.eu
mobile: +4915123277221
gpg: 390D CF78 8BF9 AA50 4F8F  F1E2 C29E 9DA6 A0DF 8604


pgpGxBMTsGzA5.pgp
Description: OpenPGP digital signature
-- 
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Where is the serial number stored on the thinkpad ivy/sandy bridge laptops

[Peter Stuge]

taii...@gmx.com wrote:
> see "# dmidecode"
> 
> Under system information and base board information
> 
> I am curious as to how it survives the coreboot flash re-write, maybe 
> the EC?

The "IBM ThinkPad Embedded Controller -[ ... ]-" SMBIOS string?

That's the EC firmware build number and the EC interface functional
specification identifier, they are read from the EC at boot in
src/ec/lenovo/h8/h8.c h8_smbios_strings()


//Peter

-- 
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Coreboot on X230 and Dualboot / How to make it work

[One7two99 via coreboot]

>  Original Message 
> Subject: Re: [coreboot] Coreboot on X230 and Dualboot / How to make it work
> Local Time: 26 September 2017 12:49 PM
> UTC Time: 26 September 2017 10:49
> From: one7tw...@protonmail.com
>
> Next step is to clean the flashregion_2_intel_me.bin (me.bin) with me_cleaner 
> which is describe well.

It seems that ME_cleaner is now included in Coreboot looking at the options in 
menuconfig. As such I asssume I don't need to manually clean 
flashregion_2_intel_me.bin (me.bin)

The extracted Blobs are located at ./3rdparty/blobs/mainboard/lenovo/x230 and 
have been proper renamed and I have enabled the options under "Chipset":

*** Intel Firmware ***
[*] Add Intel descriptor.bin file
   (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/descriptor.bin)
[ ]   Configure IFD for EM100 usage
[*]   Add Intel ME/TXE firmware
(3rdparty/blobs/mainboard/$(MAINBOARDDIR)/me.bin)
[*] Verify the integrity of the supplied ME/TXE firmware
  │
[*] Strip down the Intel ME/TXE firmware
[*]   Add gigabit ethernet firmware
 (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/gbe.bin)

I have enlarged the CBFS under coreboot nconfig in "Mainboard"

ROM chip size (12288 KB (12 MB))
(0x10) Size of CBFS filesystem in ROM

0x10 wasn't enough, so I tried 0x20 which was enough to add corinfo as 
secondary payload. Adding also nvramcui would need a bigger CBFS.
The later works if I increase the size of CBFS to 0x40, as such I've 
proceed with this CBFS size.

I've read https://www.coreboot.org/CBFS but honestly, this information is 
currently more than I can understand (not a hardware hacker :-).
When I look at the picture from me_cleaner...
https://camo.githubusercontent.com/3ea0ff670edb94372124ad0c36bd5e2b3c522f7e/687474703a2f2f6f6936352e74696e797069632e636f6d2f3130726e3132642e6a7067
... the pictures explains to me that the Chips consists of several "areas":
Descriptor / GbE Blob / ME Firmware Blob / BIOS

Is the CBFS something like a "container" within the BIOS, which would mean that 
if I want to increase the size of the CBFS over a ceratin point I need to 
shrink ME Firmware (which is covered by the documentation from me_cleaner).
What would be the maximum CBFS size I can use without further modifications to 
the ME Firmware or will Coreboot reduce the size of the ME Firmware area to 
gain additional space automatically?

Now the obvious last step is to split the 12 MB coreboot.rom into two parts to 
flash the upper 4 MB chip and the 8 MB chip (which should include the "cleaned" 
version of Intel ME, as I have enabled "Strip down the Intel ME/TXE firmware" 
in the coreboot config).

Getting the last 4 MB of the coreboot.rom is covered by the coreboot wiki:
# to flash the upper 4 MB part of the BIOS:
dd of=x230-4mb.rom bs=1M if=build/coreboot.rom skip=8

to flash the 8 mb chip I'll try:
dd of=x230-8mb.tom bs=1M if=build/coreboot.rom count=8

Question:
Is the above approach correct? I tried so already once but it didn't work 
(short flashing of Power-On-button -> nothing more)

[799]-- 
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot

[coreboot] Where is the serial number stored on the thinkpad ivy/sandy bridge laptops

[taii...@gmx.com]

see "# dmidecode"

Under system information and base board information

I am curious as to how it survives the coreboot flash re-write, maybe 
the EC?



--
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Coreboot on X230 and Dualboot / How to make it work

[One7two99 via coreboot]

Hello Peter,

 Original Message 
Subject: Re: [coreboot] Coreboot on X230 and Dualboot / How to make it work
Local Time: 26 September 2017 11:05 AM
From: pe...@stuge.se

>> 1) How to get Coreboot running (general part)
> The 1) is quite a large topic.

Strangely that part seems to much easier as there is already excellent 
documentation available how to install all dependencies, build the toolchain.
I've verified this several times by installing coreboot on a freshly installed 
Ubuntu 16.04.3 LTS.

>> I"ve followed the howto in the coreboot wiki:
> Sure, but what do the steps in the howto actually mean?
> Why are you sure that they are correct?

I am not sure that is why I am asking :-) And I got already different answers.

>> honestly I was also wondering why this is working and even more,
>> why I am skipping the first 8MB of the file.
> Perfect! Please also *answer* those questions; they are important.

I good a better understanding after looking at the picture one the me_cleaner 
site here:
https://github.com/corna/me_cleaner/wiki/External-flashing
This picture shows the content of the Chip:
https://camo.githubusercontent.com/3ea0ff670edb94372124ad0c36bd5e2b3c522f7e/687474703a2f2f6f6936352e74696e797069632e636f6d2f3130726e3132642e6a7067
I got confused in the beginning as the X230 contains two chips which are see as 
one 12 MB chip.

As I have saved the original content of both of my chips (x230-4mb.rom and 
x230-8m.rom) I have already looked at the content of the 8 MB chip:

cd ~/coreboot/MyFactoryROM
ifdtool -x x230_8mb.rom

will extract 4 files:
flashregion_0_flashdescriptor.bin (4K) --> renamed to: descriptor.bin
flashregion_1_bios.bin (4,8M)
flashregion_2_intel_me.bin (5,0M)--> renamed to: me.bin
flashregion_3_gbe.bin (8,0K)-- > renamed to: gbe.bin

I have verified the ME image as described here
https://github.com/corna/me_cleaner/wiki/External-flashing

cd ~/coreboot/MyFactoryROM
~/me_cleaner/me_cleaner.py -c x230_8mb.rom

   Full image detected
   The ME/TXE region goes from 0x3000 to 0x50
   Found FPT header at 0x3010
   Found 23 partition(s)
   Found FTPR header: FTPR partition spans from 0x183000 to 0x24d000
   ME/TXE firmware version 8.1.71.3608
   Checking the FTPR RSA signature... VALID

Strangely the 8MB chips seems to also contains the "flashregion_1_bios.bin".
I tought that the BIOS part is located on the top 4 MB Chip.
I'd like to both files (4MB + 8MB) into one and use that with idftool.
I tried to run idftool with --chip 1 on the extracted x230-4mb.rom but this 
didn't succeed.

Next step is to clean the flashregion_2_intel_me.bin (me.bin) with me_cleaner 
which is describe well.

QUESTION:
what I am really struggling with is, is the size of the CBFS filesystem in ROM 
(can be set under Mainboard in coreboot make nconfig). I need a bigger CBFS to 
be able to run payloads but then I can't just flash the upper 4 MB chip.
As such the question is: what do I need to do with the coreboot.bin after 
compiling to be able to flash the whole 12 MB (4 mb chip + 12 mb chip).
Any help would be great here, as I am currently mainly struggling with this.

[799]-- 
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Coreboot on X230 and Dualboot / How to make it work

[Peter Stuge]

One7two99 via coreboot wrote:
> From a newbie perspective I'd like to get this information from one or two 
> locations:
> 1) How to get Coreboot running (general part)
> 2) How to flash the X230

Sure thing - and I think it's great that you are working on more
concise docs!

The 1) is quite a large topic.


> > So you flash only the last third of the CBFS, and ignore the beginning.
> > I think it is just luck that your system boots at all. If you used a
> > larger payload such as a kernel then your method will likely cut the
> > payload in half and end up writing incomplete junk to your flash.
> 
> I've followed the howto in the coreboot wiki:

Sure, but what do the steps in the howto actually mean? Why are you
sure that they are correct?


> honestly I was also wondering why this is working and even more,
> why I am skipping the first 8MB of the file.

Perfect! Please also *answer* those questions; they are important.


> Honestly I am trying to understand as much as I can,

Good stuff!


> I am happy to contribute to the documentation to make it easier for
> the next newbie who might not be interested in how his CPU works,
> but wants to reduce possible entry points which might break his
> privacy :-)

Documentation contributions are just as important as code, and again
I really appreciate that you are working on this.

Sorry, I didn't mean to say study the CPU (though that's also relevant
for privacy; see AMD microcode paper with modified instruction exploit
to leak crypto key) - I meant study what's going on with these two
flash chips, since you want to change the contents of one or both.

What do the 12 MB flash contain, what is the structure, what determines
the structure, what can you change, how do you change, what *can't* you
change, why, and so on.

My point is that if you want to create documentation with exact steps
which can be repeated by the next newbie, then you will have to make
a whole bunch of very specific decisions, so that they don't have to.

Just saying to hang in there, continue understanding.


//Peter

-- 
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Coreboot on X230 and Dualboot / How to make it work

[Peter Stuge]

Martin Kepplinger wrote:
> what would you want to do? Analyse the image. If your BIOS fits in 4MB,
> you really only need to flash the last 4MB, and using a hardware 
> flasher, you cut it out and flash it to the one 4MB chip. done.

"BIOS fits" means: if the allocated space for BIOS (as opposed to
ME and all other things in the 12 MB of flash) is 4 MB, as determined
by the IFD.

The CBFS should then be that same size, because it is the container
for the replacement that goes into the BIOS allocation.

Making CBFS 12 MB large because there is 12 MB flash, but only flashing
a third of the CBFS because the BIOS allocation is 4 MB is not right.

Since the allocation of the 12 MB of flash is not (yet) changed, I
think the CBFS should be 4 MB.


//Peter

-- 
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Opteron 6284 SE or 6386 SE?

[BogDan Vatra]

Thanks a lot Taiidan!

I'll try to find two used 6386SE. I don't mind to have microcode
updates (I already choose them in coreboot for 6376).

Yours,
BogDan.

2017-09-26 10:17 GMT+03:00 taii...@gmx.com :
> On 09/25/2017 01:21 PM, BogDan Vatra wrote:
>
>> Hello,
>>
>>I'd like to upgrade my CPUs (I have  2 x Opteron 6276) and I'm now
>> sure which one should I choose? Will I see a difference? Does the
>> upgrade worth?
>>
>> Yours,
>> BogDan.
>>
> 6386SE IMO, get the best.
>
> It is worth it although it needs microcode updates for secure operations.
> 6287SE is the best x86_64 CPU that doesn't, it is slightly slower and lacks
> the slightly higher memory speed - with that you will also see better
> peformance (see cpubenchmark)
> Btw no need to buy a brand new one get a used as CPU life is 20+ years.
>
> You'll end up spending a decent chunk of change on dual 6386SE to the point
> where I would advise saving up for TALOS 2 (way better performance and
> upgradability) - unless you want x86 6386 to the play latest games (I do!)

-- 
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Opteron 6284 SE or 6386 SE?

[taii...@gmx.com]

On 09/25/2017 01:21 PM, BogDan Vatra wrote:


Hello,

   I'd like to upgrade my CPUs (I have  2 x Opteron 6276) and I'm now
sure which one should I choose? Will I see a difference? Does the
upgrade worth?

Yours,
BogDan.


6386SE IMO, get the best.

It is worth it although it needs microcode updates for secure operations.
6287SE is the best x86_64 CPU that doesn't, it is slightly slower and 
lacks the slightly higher memory speed - with that you will also see 
better peformance (see cpubenchmark)

Btw no need to buy a brand new one get a used as CPU life is 20+ years.

You'll end up spending a decent chunk of change on dual 6386SE to the 
point where I would advise saving up for TALOS 2 (way better performance 
and upgradability) - unless you want x86 6386 to the play latest games 
(I do!)


--
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Unable to fetch from git server: `fatal: protocol error: bad pack header`

[Paul Menzel]

Dear Shaunak,


First, please just send plain text messages to mailing lists.


Am Montag, den 25.09.2017, 19:36 -0700 schrieb shaunak saha:

> I started seeing this issue today and was unable to fetch commits from
> coreboot server.

Please also provide the output of `LANG=C git fetch -vv origin`.

> Any solution to this problem? Do i need to check anything
> on my local ssh configs?

If you do not want to “re-clone”, then do the following as a workaround
to get the problematic commit crashing the server.

```
$ git clone https://review.coreboot.org/coreboot.git /tmp/coreboot
$ cd /your/problematic/coreboot/tree
$ git remote add local-rep /tmp/coreboot
$ git fetch local-rep
$ git remote delete local-rep
```

No everything should work again.


Thanks,

Paul

signature.asc
Description: This is a digitally signed message part
-- 
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Coreboot+SeaBios Boot speed: ~12sec till GRUB Boot Screen

[Paul Menzel]

Dear 17299,


Am Montag, den 25.09.2017, 20:37 -0400 schrieb One7two99 via coreboot:

>  Original Message 
> Subject: Re: [coreboot] Coreboot+SeaBios Boot speed: ~12sec till Grub Boot 
> Screen
> Local Time: 25 September 2017 9:17 AM
> From: paulepan...@users.sourceforge.net
> 
> > > First, please just sent plain text messages to mailing lists.
> 
> ok, I'll try

Your reply still contained an HTML part. :(

> > > 1. Your coreboot configuration (`.config`).
> 
> See attached.
> 
> > > 2. The output of `build/cbfstool build/coreboot.rom print`.
> 
> ./coreboot/build/cbfstool ./coreboot/build/coreboot.rom print
> 
> Name   Offset Type Size
> cbfs master header 0x0cbfs header  32
> fallback/romstage  0x80   stage81604
> config 0x13fc0raw  641
> revision   0x14280raw  570
> cmos.default   0x14500cmos_default 256
> cmos_layout.bin0x14640cmos_layout  1804
> fallback/dsdt.aml  0x14dc0raw  13643
> payload_config 0x18380raw  1611
> payload_revision   0x18a40raw  237
> etc/ps2-keyboard-spinup0x18b80raw  8
> (empty)0x18bc0null 29400
> mrc.cache  0x1fec0mrc_cache65536
> fallback/ramstage  0x2ff00stage79642
> pci8086,0166.rom   0x43680optionrom65536
> img/coreinfo   0x53700payload  1150904
> fallback/payload   0x16c700   payload  67051
> (empty)0x17cd40   null 2631064
> bootblock  0x3ff300   bootblock3000
> 
> > > 3. Build the utility cbmem with `make -C util/cbmem`.
> 
> ok, done.
> 
> > > 4. The output of `./util/cbmem/cbmem -c`.
> > > 5. The output of `./util/cbmem/cbmem -t`.
> 
> both commands fail with "Failed to gain memory access: Permission denied"

I assume, you ran this with administrator privileges. But, newer Linux
kernels forbid access to that region.

In recent Linux kernels, there is a module for that.

`sudo modprobe memconsole_coreboot` should load it, and then the logs
should be available under `/sys/firmware/log`.

If you don’t have that, please pass the parameter `iomem=relaxed` to
the Linux kernel. For example, by pressing `e` in the GRUB menu.

[…]


Thanks,

Paul

signature.asc
Description: This is a digitally signed message part
-- 
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot