DOCSLIB.ORG

在thinkpad X200 上配置多payload 的libreboot 自由固件

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
在thinkpad X200 上配置多payload 的libreboot 自由固件 在 ThinkPad X200 上配置多 Payload " Libreboot #$%& Configuring Multi-Payload Libreboot Free-as-in-Freedom Firmware on ThinkPad X200 1 | 34 Junde Yhi <[email protected]> Li)*eboo+ , Co*eboo+ "./ ● Li)*e)oo+– 0 -o*e)oo+ "123456 -o*eboo+ 7894: (i)*eboo+ ;<94 – (ibreboo+ 0=> Blobs " -o*eboo+ ● Blob @ABCD"EFGH& – IDJ%&JKK – L0MNO上操Q"0 -o*eboo+ ● RS ThinkVad W'00 XYZ[\]^B Blob _`"3a:bcde -o*eboo+ f g0#$" ● hijklm1n– (ibreboo+ opq: -o*eboo+ \ropq – sise ve*sa ' | 34 Junde Yhi <[email protected]> Li)eralized Co*e)oo+ ● -oreboo+– 012uvw"%&/x yz{|: -ore)oo+ ^}4~且仅}4）硬&初始w – {| -ore)oo+ ^把}4权交给 Vayload ● Vayload 02 E(F 可执行H& ● Sea?IOS (?IOS), Tiano-ore (UEFI), GRU?' (?), … – Vayload 再启8PQ/x或引导器 ● $S GRU?' Z身就是个引导器，所以可以搞¡PQ – ¢>£8器上¤¥"引导器 – F¦_§¤¨©:ª«¬­¨®_¯ – g0推荐"q² 3 | 34 Junde Yhi <[email protected]> Vayload ● （主）– Vayload 负责引导 1¶1次启8¸¹12~º»也可以通过别的组合实Á! Vayload ） ● SeaBIOS 012 1 à x8 ?IOS "yCNÁ – ÅÆS QEÈU / ÊsÈ ● TianoCore 012 UEFI "yCNÁ – 甚至可以在ZAB UEFI " ThinkPad W'00 上使用 UEFI ● GRU?' 0 GÏU 著名的一款PQ/x~？） – 与安装在硬盘上的 GRUB2 体验完全1n – 缺点： ● 配置文件也得被写在固件里 ● 可能要使用一些高超的配置技术[尽量减少未来的刷写·ë 4 | 34 Junde Yhi <[email protected]> Vayload ● Co*e)oo+ 还集成了些比较有趣" Vayload "支持 – Bayou 02 Vayload 选择器，可以在每次启8"时候选择需要" ~³） Vayload ● ùm"0X2 Vayload 好像已经不维护了，不工Q – LinuxBoot b接把 (inux 内核塞到%件里去 ● Î Uexec 引导 – 或者也可以直接指<12普¼内核~%&空间够大"话） – Open Firmware FILO iPXE , , , … ● SeaBIOS TianoCore 要使Î Windows "话:¹择 或 – 理论上应该是可以的~¼½一些I小"修改） – NO上我并AB成功启动过Mz器上的 Windows 7 5 | 34 Junde Yhi <[email protected]> Su)payload ● Subpayload 1般执行除了引导以外"任务 – nvramcui ÎS修改 -ÈOS 参ë供运4时调 Co*e)oo+ ● @ ?IOS ¹! – coreinfo ÎS"#z器$% ● -VU 参ëJ内&参ëJ%&$%' – memtest86+ ÎS()内& ● X2 Su)payload ¸能在 sG* Tex+ Mode +ÍÎ~,后再-） – tint 012./01v23~？） ● Subpayload 4 Vayload 所56调用 (chainloader) – SeaBIOS 启8时7 Esc 可89 Su)payload – GRUB2 ¼½配 H&或:;}4 Su)payload  | 34 Junde Yhi <[email protected]> Mq½"实验 ● < (i)*e)oo+ 给 -o*e)oo+ J SeaBIOS '=">?: Re)ase 到 mas+e* ● @– YA)配置, Vayload "¿合（ 50B 次） 集成 SeaBIOS / #4de SeaBIOS – 集成 TianoCo*e / #4de TianoCo*e – 集成 GRU?' / #4de GRU?' ● M可r0ªñùm"– C2 M"z器在一些配 +^bc]ryz~DE]F） ● Ë至没G²=y调) – M"z器在任何配 +IJ启动K^Lz 7 | 34 Junde Yhi <[email protected]> 石牌村人民医院 MN（硬件） 本机会诊号 2019060114 ● ThinkVad– X200 1a W'00s , W'00+ O]1<（而且P得比较QR） – X0©rSú"1款支持 (i)*eboo+ 的机器了（TU还有 WÂ0 ） ● Intel -o*e ' Vuo (Venryn) @ '.'ÂGWz X '.ÂÂGWz, 3È? (' ● YZ[– dY器 \ 可以0y9]" SPI c^~ linux_spi ） – g可以是`ab大cdef~ ch341a_spi ） ● ghi– ~ SOI-jÄ 或 SOI-j16 ） 推(： ● k *ÈT ~lmn³8管理技术）的机器ÍÎ SOI-j1 pq~ ÄÈiB / Â4Èi) ） ● ]k *ÈT 的机器ÍÎ SOI-jÄ pq~ 4ÈiB / 3'Èi) ） \ V*or*amme* Ä | 34 Junde Yhi <[email protected]> MN~s件） ● Li)*e)oo+– CD1t (i)*eboo+ CD¸Buv/x,>?:NOwDKx上2 checUou+ – ~小声） (i)*eboo+ yz改F"uv/xB够难Î ● 6持– GÏ*T (G-- *da) "de器 ÎSde -oreboo+ "工|5~ G-- *da #}） – -oreboo+ ¸支持#~"工|5配置 ● g可以让 -o*eboo+ 在任意工|5上de:L0不推± – $S *OS- OS " G-- ]6持 *da :所以并]rÎ :) ● 可以 deboo+s+*ap 12 Vebian / U)un+u ● 完 s&依赖MB时间完善脚Z{|^放出[ ● flashrom 9 | 34 Junde Yhi <[email protected]> 更新 Embedded Cont*oller (EC) ● ThinkVad X200 出厂%&" E- 版Z号在 1.0 – 1.07 E- %&“修改了电池充电算²以3衡电池"充电,寿命” – E- ]yC:L0$S E- >了控GAB别的Î处:暂且\]o了 ● 更J E- ,官1 ?IOS "¤¥YZø要使Î Windows 1 à 环境 – 因此 Â4 à Windows ]r¤¥%&更J~]6持 1 Ã运4时） ● \算联想提供了 Â4 ä¥YZg0«此 ● ê写 -o*eboo+ {|\AB更J E- "渠¡了 – 因此在ê -o*e)oo+ {U¢得£更J E- 10 | 34 Junde Yhi <[email protected]> Nt原厂 BIOS ● N份原厂 BIOS r让¥ê¦{|§¨©ª ● flashrom -p <driver> -c MX25L6405D -r <file> – 以上操作执行«次，以¬dY器不稳定导致输出错误 ● 并算ú哈希值:³´1n ● 将Xt ?IOS ê¶z器就可以©复出厂%& – ·¸k" -ÈOS 配置和 RT- ^¹¦:]½无伤大雅 11 | 34 Junde Yhi <[email protected]> ½< Li)*eboo+ ● (ib*e)oo+ EFG59Æ其官网列出镜û – Á至ÂUSJ"版Z0 '01Â0907 – R ThinUVad W'00 ¸B GRU? 可供选择 ● CD – https://notabug.org/libreboot/libreboot.git ● (ib*e)oo+ ~J）的uv/x¬"{Î – ûÄÅyz#己改进了 Co*e)oo+ "uv16 – Xg04Æp (i)*e)oo+ "SJ版ZgÇÅÈ：ÄÅ希望在完 成uv/x改F之后再发行新版Z 1' | 34 Junde Yhi <[email protected]> MN环境 ● debootstrap <codename> <sysroot> <mirror> – ·N只要有k *da 6持的 G-- 就可以了 – 完 "依赖¿Ê还没 理出[ – chroot »| ● F` (ib*eboo+ Âh+ËCD – ./libreboot download coreboot – ./libreboot download ich9gen ~,|介绍） – ./libreboot download vboot – 以上!Â^被自8 checUou+ =>?:放在 sou*ces Âh¸ 13 | 34 Junde Yhi <[email protected]> £4de ● Î<"工|5 – cd sources/coreboot – make crossgcc-i386 ● «Ï要编译 Tiano-o*e :Cp amdÂ4 工具5g0ø要 make crossgcc-x64 的： – make iasl ~ *CPI d译器） – make CPUS=# 在 |ÍÎ =y并4de – make DEST=<path> 在 |ÍÎ ¤¥到指<Âh 14 | 34 Junde Yhi <[email protected]> £4de ● ich9gen – (i)*e)oo+ !Â:Ç -o*eboo+ ! – Ð成 ICW9 pq¿初始化需要的U 1' Êi? 字段 ● ROÈ 布局~%件）描述符 ● ]载网卡初始化wD – 根据 (i)*e)oo+ :X1段jZ上0空" ● 清空" Intel Èanarement Enrine (In+el ÈE) – ¼½在%&描述符¸=>X1区域q到 – 注意把板载网卡厂家指派" È*- 地址写到 projects/ich9gen/configs/macaddress H&¸ ● ã则板载网卡将kB (ib*e)oo+ 默认" È*- 地址 – 1¶情况+èé]大:L01êë1a交换z+Bha (i)*e)oo+ z器…K ● 1般在机器底部B白色标签写出:g可以使用其它PQ/x£#1# 15 | 34 Junde Yhi <[email protected]> ich9ren ● ./libreboot build ich9gen – X1½程将Ð成«2 1' KiB J«2 4 KiB "EFGH&： ● ich9fdgbe_{4,8,16}m.bin 12 KiB → ● ich9fdnogbe_{4,8,16}m.bin 4 KiB → – 根据芯qõ量大小:¹择合适"%&描述符 ● build/ich9gen 在 里 ● ich9fdgbe_8m.bin «M" W'00 ÍÎ SOI-j1 " ÄÈiB 闪存:O¹Î – k]Ë网卡" ThinUVad X200 ]rÍÎ nor)e 描述符 ● ø{\0]ryz ● nogbe 是给没有板载网卡" I-W9 机器用的 1 | 34 Junde Yhi <[email protected]> ùj (Rebase) ● $S (ib*eboo+ checUou+ "wDúºÈ:MÅ可能希望ÍÎS J" -o*eboo+ Q4jM ● ùjPQ¸B]è冲突，需要手8解决 ● Lib*e)oo+ ">?主要去除了@3a"ID'没有可审计CwD "部&:并且避¢ -o*eboo+ uv/x#8½< (ib*eboo+ 另4 Ve)lo) ½"! – »¦:$S ThinUVad X200 3a本身\]ø要 ?lo) 可以uv:X 1P作可能0!余"KK 17 | 34 Junde Yhi <[email protected]> 配置 (Liberalized) Co*e)oo+ ● cd sources/coreboot && make menuconfig – Êconfir ~, (inux 内核配 ÍÎúë"/x） ● Gene*al Se+up – CBFS prefix to use ● õ2 Vayload K&在 -?FS " <p*efix>/payload + ● 默认_Ë fall)ack/payload :L0X1²需要在 -MOS 运行时配置¸给 出，所以仅更改X1!会导致 -o*e)oo+ 找]到 Vayload ~MAB)½正 确地改8 p*efix ） – Add a bootsplash image 可以46持启8画面" Vayload _ `启动画面 ● Sea?IOS J Tiano-o*e , GRU?' K支持 1Ä | 34 Junde Yhi <[email protected]> 启动画面 (SeaBIOS) 19 | 34 Junde Yhi <[email protected]> 配置 (Liberalized) Co*e)oo+ ● Mainboard – Mainboard vendor Lenovo 选择 – Mainboard model ThinkPad X200 / X200t 选择 – ROM chip size 8 MB ¹择合适大小~M"0 ） – Size of CBFS filesystem in ROM: 0x7FD000 ● @ Ä ÈiB − 1' Êi? = Ä1Ä0 Êi? :最大w利Î空间 – Q4参考: Tiano-o*e 约占Î 1 j ' Èi? ● ich9ren 描述"%&布局中 ?IOS 区域\0Xp大，所以对应á这里也把 ?IOS 区域Î到Xp大 ● 0x200000 ¦ Co*e)oo+ 默认" (' Èi?) 0根据联想官方%&布局设<"~k In+el ÈE , Intel *ÈT :¹择不删>X些部&"情况下X2²ABèé:»¦ MÅ要把 ÈE =掉） '0 | 34 Junde Yhi <[email protected]> 配置 (Liberalized) Co*e)oo+ ● -hipse+ – Include CPU microcode in CBFS Do not 选择 ● ID更新B助S处理器的健康运4:L0KK ● è12构建依赖~日后也可以往镜像里添加） – Add Intel descriptor.bin file =开，然后在+面"¹!里填写 ich9gen ich9fdgbe_#m.bin 刚才 Ð成的 H& ● 这个操作实际上就是 – dd if=ich9fdgbe_8m.bin of=libreboot.rom bs=12k count=1 conv=notrunc – 完全可以手8PQ – Bootblock behaviour 控G -o*e)oo+ R Vayload 的选择 ● normal/payload Switch to normal if CMOS 假«&在 ，这里选择 says so :并且 -ÈOS 里选择了 p*efix 0 normal "话: -ore)oo+ 理论上就会 选择它（我没有成功过） '1 | 34 Junde Yhi <[email protected]> 配置 (Liberalized) Co*e)oo+ ● Vetices – Graphics initialization Use libgfxinit 选择 ● X012ÍÎ *da SV*RÊ 撰写的89初始化 ● MABÍ用别的选!成功启动½~KAB89） – Framebuffer mode Linear Visplay F`: 选择 "high-resolution" framebuffer ● Legacy VGA text mode \0!x" Ä0x25 :;:]r89!" 体内容~#q） ● 要使用启8画面"话:X1¹!$%¹¸ – &2 VCIe ¹!y.º' '' | 34 Junde Yhi <[email protected]> 配置 (Liberalized) Co*e)oo+ ● Vayload– *dd a payload 选择12 Vayload ● 这些 Vayload ^在uv时从网(上)< – Seconda*y Payloads ● coreinfo "#z器$% ● Èem+es+ÄÂB (试内& – 此 Su)payload 只能在 sG* Text Èode +正Å89 ● nvramcui 运4时配 ● +int ./01v '3 | 34 Junde Yhi <[email protected]> de (Liberalized) Co*e)oo+ ● 配置– ´&|:}4 maUe 即可 ]支持!*Y~^出èé） ● build/coreboot.rom 成+在 ● 一些 Co*e)oo+ 工|： – build/cbfstool ÎS修改%&H&内" -o*e)oo+ File Sys+em ~添_删> ROÈ 内H件） – build/ifwitool – build/rmodtool '4 | 34 Junde Yhi <[email protected]> Py电, ● ThinUVad– X200 " ?IOS 闪&ÃS-./+ 0+ V 面" 9 1Rf"23即可0+4®,./ SOICj16 ?IOS SPI Flash 56 (ICW9) '5 | 34 Junde Yhi <[email protected]> i7 8脚à 1 ' | 34 Junde Yhi <[email protected]> g写 ● flashrom -p ch341a_spi 9<ºU闪&:号 – -p linux_spi 或 :<决SÍÎ" SPI g写器 ● ®它 – flashrom -p <driver> -c <chip> -w <img> ● <chip> MX25L6405D 在M"电,上是 ● ;ash*om ^91· SVI Flash :»|Q<:¸将前|]ë"内容写入 ● 约 5 5=完成|\可以<掉dYiyz – Flash*om ^89 sERIFYING… OK. – 注意g写的时候S好不要通电~拔掉电池），更]要开机…… ● ãO机器^? '7 | 34 Junde Yhi <[email protected]> @Ï~ Li)*eboo+ E进制） 'Ä | 34 Junde Yhi <[email protected]> @Ï (SeaBIOS / VG* Tex+ Mode) '9 | 34 Junde Yhi <[email protected]> @Ï (SeaBIOS / VG* F*amebuAer) 30 | 34 Junde Yhi <[email protected]> @Ï (GRUB2) 31 | 34 Junde Yhi <[email protected]> @Ï (TianoCo*e) 3' | 34 Junde Yhi <[email protected]> 可能© ● (ib*e)oot– B GRUB' B Tiano-o*e (SeaBIOS as CSM) GRU?' 启动高安全要B" (inux PQ/x – TianoCore 补充 UEFI 3am© ● 配合 Sea?IOS Q4Cõ支持模块 (-SM) ½得 ?IOS 功r ● (ib*e)oo+ 4ÎD改FEF"ë时¹G了定制H – (ib*eboo+ 只给 W200 3a提供了`些m©供<G – 更复I的组合还是需要通½手8uv Coreboo+ J到 ● 暂时未能实现，可能我比较KL 33 | 34 Junde Yhi <[email protected]> Ask Me Anything! Ïex+ (14:15 j 15:00): PineÂ4, Its Wis+ory, and Èainlininr EAo*+s T( (im 34 | 34 Junde Yhi <[email protected]>.
Load more

Recommended publications
  • Coreboot - the Free firmware
    coreboot - the free firmware Linux Club of Peking University April 9th, 2016 . Linux Club of Peking University coreboot - the free firmware April 9th, 2016 1 / 30 1 History 2 Why use coreboot 3 How coreboot works 4 Building and using coreboot 5 Flashing 6 Utilities and Debugging 7 Contribute to coreboot 8 Proprietary Components 9 References . Linux Club of Peking University coreboot - the free firmware April 9th, 2016 2 / 30 History: from LinuxBIOS to coreboot coreboot has a very long history, stretching back more than 15 years to when it was known as LinuxBIOS. While the project has gone through lots of changes over the years, many of the earliest developers still contribute today. Linux Club of Peking University coreboot - the free firmware April 9th, 2016 3 / 30 LinuxBIOS v1: 1999-2000 The coreboot project originally started as LinuxBIOS in 1999 at Los Alamos National Labs (LANL) by Ron Minnich. Ron needed to boot a cluster made up of many x86 mainboards without the hassles that are part of the PC BIOS. The goal was to do minimal hardware initilization in order to boot Linux as fast as possible. Linux already had the drivers and support to initialize the majority of devices. Ron and a number of other key contributors from LANL, Linux NetworkX, and other open source firmware projects successfully booted Linux from flash. From there they were able to discover other nodes in the cluster, load a full kernel and user space, and start the clustering software. Linux Club of Peking University coreboot - the free firmware April 9th, 2016 4 / 30 LinuxBIOS v2: 2000-2005 After the initial success of v1, the design was expanded to support more CPU architectures (x86, Alpha, PPC) and to support developers with increasingly diverse needs.
    [Show full text]
  • Coreboot - the Free Firmware
    coreboot - the free firmware vimacs <https://vimacs.lcpu.club> Linux Club of Peking University May 19th, 2018 . vimacs (LCPU) coreboot - the free firmware May 19th, 2018 1 / 77 License This work is licensed under the Creative Commons Attribution 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/. You can find the source code of this presentation at: https://git.wehack.space/coreboot-talk/ . vimacs (LCPU) coreboot - the free firmware May 19th, 2018 2 / 77 Index 1 What is coreboot? History Why use coreboot 2 How coreboot works 3 Building and using coreboot Building Flashing 4 Utilities and Debugging 5 Join the community . vimacs (LCPU) coreboot - the free firmware May 19th, 2018 3 / 77 Index 6 Porting coreboot with autoport ASRock B75 Pro3-M Sandy/Ivy Bridge HP Elitebooks Dell Latitude E6230 7 References . vimacs (LCPU) coreboot - the free firmware May 19th, 2018 4 / 77 1 What is coreboot? History Why use coreboot 2 How coreboot works 3 Building and using coreboot Building Flashing 4 Utilities and Debugging 5 Join the community . vimacs (LCPU) coreboot - the free firmware May 19th, 2018 5 / 77 What is coreboot? coreboot is an extended firmware platform that delivers a lightning fast and secure boot experience on modern computers and embedded systems. As an Open Source project it provides auditability and maximum control over technology. The word ’coreboot’ should always be written in lowercase, even at the start of a sentence. vimacs (LCPU) coreboot - the free firmware May 19th, 2018 6 / 77 History: from LinuxBIOS to coreboot coreboot has a very long history, stretching back more than 18 years to when it was known as LinuxBIOS.
    [Show full text]
  • Licensing & Paradigms
    Licensing & Paradigms System and Network Administration Revision 2 (2020/21) Table of contents ▶ What is FOSS ▶ Intellectual Property What is FOSS What is Free and Open Source Software?… ==> SHOW AND SHARE THE RECIPE ▶ written Free Software ▶ written Open Source alone ▶ written open-source something as an ajective ▶ FOSS to be politically correct with both communities… Who is leading the movement(s)?… ==> A fundamentalist – morality come first Richard Matthew Stallman And a realist – efficiency comes first Eric Steven Raymond Schools of thoughts / Paradigms fundamentalism vs. realism ▶ FSF GNU RMS (socialists) ▶ OSI ESR (elitists) ▶ Linus Torvalds (not into politics) ▶ BSD freaks (anarchists & despots) preliminary note Most known distros Debian / Ubuntu Fedora / Redhat / CentOS All are GNU/Linux Linux -- the kernel GNU -- the userland RMS ▶ ~1980 (27 years old), works at MIT/AI lab ▶ wants to fix the driver of the Xerox printer ▶ software used to be free/open, it was the default ▶ he faced a non-disclosure agreement ▶ GNU’s Not Unix, Sep 1983 – no UNIX(tm) code ▶ wrote Emacs ▶ January 1984, quits MIT/AI lab ▶ FSF, Oct 1985 ▶ talks at parliements ▶ paranoid & activist ▶ refuses any binary blob incl. firmwares ▶ Coreboot is not enough –> Libreboot ▶ what about micro-codes? ▶ against Intel Management Engine “backdoor” ▶ against DRM but not necessarily against TPM Thinkpad X200 with Libreboot Trisquel no binary blob at all (but cpu micro-code) ▶ RMS was right about Intel ME ▶ Ermolov and Maxim Goryachy @Positive Technologies Intel Management Engine https: //en.wikipedia.org/wiki/Intel_Management_Engine#Disabling_the_ME https://github.com/corna/me_cleaner Learning curves ESR ▶ likes guns and liberty ▶ The New Hacker’s Dictionary, 1996 ▶ Fetchmail in 1996 ▶ The Cathedral and the Bazaar, Oct 1999 In short ▶ the bazaar is advocated ▶ goes with evolution of SCM and the GIT story Open Source Initiative in 1998 ▶ –> Free Software for business and not for moral terms ▶ Jon “maddog” Hall, Larry Augustin, Eric S.
    [Show full text]
  • Installing Parabola on Libreboot with Full Disk Encryption (Including /Boot)
    Home Packag2e6s00:1F18W:1i2kAi4:C000F:3o7rBu:Am0B6:E9ICs0s:4uDe6s0 talkP forro tjheisc itps addresDs ownllooga idn navigation page discussion view source history Main page Table of Contents Recent changes Random page Installing Parabola on Libreboot with full disk Help encryption (including /boot) search Search i18n Go Search Dansk – Deutsch – English – Esperanto – Español – Euskera – Français – Galego – tools Indonesia – Italiano – Lietuviškai – Magyar – Nederlands – Polski – Português – Română – What links here Slovenský – Suomi – Svenska – Türkçe – Česky – Ελληνικά – Български – Русский – Related changes ไทย – 日本語 – 正體中文 – 简体中文 – 한국어 – ﺍﻟﻌﺭﺑﻳّﺔ – עברית – Special pages Српски – Українська Printable version Permanent link Page information Copyright © 2014, 2015, 2016 Leah Rowe <[email protected]> Copyright © 2015 Jeroen Quint <[email protected]> Copyright © 2016 Albin Söderqvist Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front‐Cover Texts, and no Back‐ Cover Texts. A copy of the license is included in the page “GNU Free Documentation License”. Libreboot on x86 uses the GRUB payload by default, which means that the GRUB configuration file (where your libreboot GRUB menu comes from) is stored directly alongside libreboot and its GRUB payload executable inside the flash chip. This means that both installing and managing GNU/Linux distributions are handled slightly differently compared to traditional BIOS systems. On most systems, it is necessary to have at least an unencrypted /boot partition (while the others, including root, may be encrypted). This is so that GRUB, and therefore the kernel, can be loaded and executed, because the boot firmware itself can't open a LUKS volume.
    [Show full text]
  • Quadcore with Coreboot / Libreboot on the T500 (Hopefully the T400 As Well)
    QuadCore with Coreboot / Libreboot on the T500 (hopefully the T400 as well) (Translator’s note: Unfortunately, I couldn’t get pdflatex to compile with images, so here’s the link, I’ll put lines in at least so that you can see where each image goes) I tested the quadcore-mod from here first on a T500 mainboard, but back then, the BIOS did me a great disservice, see here and read the paragraph “Why this can’t be done for the T500 and W500” at the end of the first post. Meanwhile, we got Libreboot for the T500, which is basically Coreboot without BLOBs, i.e. CPU microcode. The code differs from coreboot in certain other aspects, however I don’t know exactly. With the ROMs offered for the T500, Quads don’t work either. Finally, I got to actually using a Pandaboard to debug Libreboot’s boot process with a Quad-core installed. The boot process hangs when the third CPU is to be initialized. Looking at the code, I found out that the kconfig data is built to the original specs. In the case of the T500 (which takes the data from the folder for the T400), the maximum count for the CPU is set to two. I changed the count to 4, generated the ROM again, flashed it –> You got quadcore. Because the current Libreboot version doesn’t support screens larger than 1280x800 with the T500, I had to extract the original VGA-BIOS for the Intel graphics from the original Lenovo BIOS and integrate it instead of the “native VGA init” into the ROM.
    [Show full text]
  • The Intel Management Engine: an Attack on Computer Users' Freedom by Denis Gnutoo Carikli
    A statement by FSF President Richard Stallman on the Intel Management Engine (ME): "Meltdown and Spectre are errors. Grave errors, to be sure, but not evidently malicious. Everyone makes mistakes. Intel has done far worse with its CPUs than make a mistake. It has built in an intentional back door called the Management Engine. Important as these bugs are, don©t let Intel©s mistakes distract you from Intel©s deliberate attack!" The Intel Management Engine: an attack on computer users© freedom By Denis GNUtoo Carikli With security issues like the Spectre and Meltdown vulnerabilities (https://www.cnet.com/news/meltdown-spectre-intel-ceo-no-recall-chip-processor/) discovered in Intel chips in early 2018, it became more important than ever to talk about the necessity of software freedom in these deeply embedded technologies. Serious as though these bugs may be, we cannot let them distract us from the broader issues: Intel considers the Intel Management Engine a feature, while it©s nothing more than a threat to user freedom. Thanks to Denis GNUtoo Carikli, we have a new basis for that conversation in this article. The Intel Management Engine is a tool that ships with Intel chipsets, purportedly to ease the job of system administrators. But in reality, it is another restriction on user freedoms, imposed by a company, and used to control your computing. Carikli offers a moderately technical explanation of what©s happening with Management Engine, the ways in which it restricts rather than empowers users, and how it violates the four freedoms of free software. Carikli may be best known for his work on the Replicant project (https://www.replicant.us/), which he co-founded with Aaron Williamson, Bradley Kuhn, and Grazlano Sorbaioli.
    [Show full text]
  • Libreboot – Free Boot Firmware Libreboot Is a Free Boot Firmware for Use on Computers Certified "Respects Your Freedom"
    LibreBoot – Free Boot Firmware LibreBoot is a free boot firmware for use on computers certified "Respects Your Freedom". Most x86 computers are designed to run Windows and come with a non-free BIOS or UEFI firmware that often includes some Malware. Windows itself is malware, and Windows licences are often stored in the BIOS on OEM PCs. For the sake of our freedom we replace Windows with a free distribution of GNU/Linux such as Trisquel (an Ubuntu derivative). But we also have to replace the non-free software that initializes the Hardware with free software. Most hardware vendors do not document how to install a different BIOS, and make it hard to install a different one. But there is coreboot, a free BIOS that can run on some computers. Coreboot contains binary blobs, but some systems can stable run without any blobs. LibreBoot also contains documentation how to install a released version of the coreboot firmware on supported hardware such as some older Thinkpads, and scripts to build the firmware from source, for all supported models. Because newer systems are unable to boot without those blobs, there is no support for newer x86 based computers. For Intel based hardware one challenge is the Management Engine (ME), which is designed for remote out of band management. The firmware for the ME is proprietary and it is impossible to run a free replacement, because it is signed using a secret key. However it is possible to remove the ME firmware on some systems so that it is possible to use them in freedom.
    [Show full text]
  • Libreboot Keynote
    Libreboot Keynote Paul Kocialkowski [email protected] Sunday June 5th 2016 Freedom in Technology Freedom in Technology Computers and Freedom • Desktops • Laptops • Single-board computers • Mobile devices Issues: • Trust in technology privacy/security implications • Control of the devices • Knowledge of the inner-workings, preservation Computers and Freedom Issues Different computer types, form factors: • Single-board computers • Mobile devices Issues: • Trust in technology privacy/security implications • Control of the devices • Knowledge of the inner-workings, preservation Computers and Freedom Issues Different computer types, form factors: • Desktops • Laptops • Mobile devices Issues: • Trust in technology privacy/security implications • Control of the devices • Knowledge of the inner-workings, preservation Computers and Freedom Issues Different computer types, form factors: • Desktops • Laptops • Single-board computers Issues: • Trust in technology privacy/security implications • Control of the devices • Knowledge of the inner-workings, preservation Computers and Freedom Issues Different computer types, form factors: • Desktops • Laptops • Single-board computers • Mobile devices • Trust in technology privacy/security implications • Control of the devices • Knowledge of the inner-workings, preservation Computers and Freedom Issues Different computer types, form factors: • Desktops • Laptops • Single-board computers • Mobile devices Issues: • Control of the devices • Knowledge of the inner-workings, preservation Computers and Freedom Issues
    [Show full text]
  • Dell Is Exploring the Use of Coreboot, at Least Internally Fedora 26 Alpha Faces Another Delay Written by Michael Larabel in Coreboot on 23 March 2017 at 08:46 AM EDT
    ARTICLES & REVIEWS NEWS ARCHIVE FORUMS PREMIUM CATEGORIES Search Latest Linux News Ubuntu 17.04 Final Beta Released AMD Open-Sources Vulkan "Anvil" CrossOver 16.2 Released, Supports Microsoft Outlook 2013 On Linux Dell Is Exploring The Use Of Coreboot, At Least Internally Fedora 26 Alpha Faces Another Delay Written by Michael Larabel in Coreboot on 23 March 2017 at 08:46 AM EDT. 14 Comments Intel Has More P-State Changes Coming For Dell appears to be using Coreboot on some of their modern Intel Atom Linux 4.12 motherboards paired with the Intel FSP and TianoCore. Qt 5.9 Beta Snapshot Released, Boasts Shader Binary Cache An email sent by a Dell developer onto a public mailing list began with the Dell Is Exploring The Use Of Coreboot, At marking, "Dell - Internal Use - Confidential." In there he comments on Dell Least Internally using Coreboot, "We are using the coreboot project with Intel fsp to boot the Mir's Abstraction Layer Now Has Cut & Intel Rangeley based Mohonpeak CPU. We have built the Tianocore EDK2 project and used it Paste Support (MirAL) as the payload to bring UEFI services to this bootloader." Libinput 1.7 Released With Support For Lid The developer went on to ask a question to Coreboot developers about booting multiple Switches, Scroll Wheel Improvements UEFI operating systems when Coreboot is running on the board. 17 Fresh AMDGPU DC Patches Posted Today Mohon Peak is the Intel codename for Atom C2000 series processors, for newer Atom-based x86 servers. These Rangeley CPUs have been around for a few years now, based on the older 22nm process.
    [Show full text]
  • On Improving Cybersecurity Through Memory Isolation Using Systems Management Mode
    On Improving Cybersecurity Through Memory Isolation Using Systems Management Mode A thesis submitted for the degree of Doctor of Philosophy James Andrew Sutherland School of Design and Informatics University of Abertay Dundee August 2018 i Abstract This thesis describes research into security mechanisms for protecting sensitive areas of memory from tampering or intrusion using the facilities of Systems Man- agement Mode. The essence and challenge of modern computer security is to isolate or contain data and applications in a variety of ways, while still allowing sharing where desir- able. If Alice and Bob share a computer, Alice should not be able to access Bob’s passwords or other data; Alice’s web browser should not be able to be tricked into sending email, and viewing a social networking web page in that browser should not allow that page to interact with her online banking service. The aim of this work is to explore techniques for such isolation and how they can be used usefully on standard PCs. This work focuses on the creation of a small dedicated area to perform cryp- tographic operations, isolated from the rest of the system. This is a sufficiently useful facility that many modern devices such as smartphones incorporate dedic- ated hardware for this purpose, but other approaches have advantages which are discussed. As a case study, this research included the creation of a secure web server whose encryption key is protected using this approach such that even an intruder with full Administrator level access cannot extract the key. A proof of concept backdoor which captures and exfiltrates encryption keys using a modified processor wasalso demonstrated.
    [Show full text]
  • Free Software, Free Society: Selected Essays of Richard M
    Free Software, Free Society Selected Essays of Richard M. Stallman Third Edition Richard M. Stallman This is the third edition of Free Software, Free Society: Selected Essays of Richard M. Stallman. Free Software Foundation 51 Franklin Street, Fifth Floor Boston, MA 02110-1335 Copyright c 2002, 2010, 2015 Free Software Foundation, Inc. Verbatim copying and distribution of this entire book are permitted worldwide, without royalty, in any medium, provided this notice is preserved. Permission is granted to copy and distribute translations of this book from the original English into another language provided the translation has been approved by the Free Software Foundation and the copyright notice and this permission notice are preserved on all copies. ISBN 978-0-9831592-5-4 Cover design and photograph by Kyle Winfree. iii Table of Contents Foreword to the Third Edition ::::::::::::::::::::::::::::::::::::::: iv Foreword to the First Edition :::::::::::::::::::::::::::::::::::::::: vi Preface ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: x Part I: The GNU Project and Free Software 1 What Is Free Software? :::::::::::::::::::::::::::::::::::::::::::: 3 2 The GNU Project :::::::::::::::::::::::::::::::::::::::::::::::::: 9 3 The Initial Announcement of the GNU Operating System ::: 26 4 Free Software Is Even More Important Now ::::::::::::::::::: 28 5 Why Schools Should Exclusively Use Free Software::::::::::: 34 6 Measures Governments Can Use to Promote Free Software :: 36 7 Why Free Software Needs Free Documentation::::::::::::::::
    [Show full text]
  • Skulls - Coreboot Your X230 the Easy Way
    Skulls - coreboot your X230 the easy way Martin Kepplinger February 2, 2019 Who am I? - work for https://www.ginzinger.com/en/ in Austria - kernel developer, C programming, tslib maintainer, ... - use Tor! Let’s curl an image and coreboot your Laptop! Lenovo Thinkpad X230 Laptop 3rd gen. Intel i series (Ivy Bridge) The coreboot project https://coreboot.org - ”for end users” ”coreboot is a replacement for your BIOS / UEFI with a strong focus on boot speed, security and flexibility.” free software (GPL) hardware init / ACPI interface coreboot distributions - Libreboot (X200) - Heads (X230, Librem Laptops) - Skulls - not quite Heads (X230) They all release binary flash image files it’s all there, but how to configure and how to flash (how to or not to enable internal flashing without disassembling) it’s all there, but how to configure and how to flash (how to or not to enable internal flashing without disassembling) - Libreboot (X200) - Heads (X230, Librem Laptops) - Skulls - not quite Heads (X230) They all release binary flash image files Skulls goals faadfce initial infos 75b154334d.config | 686 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ README.md | 100 ++++++++++++ pci8086,0166.rom | Bin 0 -> 65536 bytes 3 files changed, 786 insertions(+) build reproducibly (important because we release ROM images) security through simplicity (flash a known good image often) Heads - http://osresearch.net make coreboot easy to install, easy to use no excuse for running the proprietary vendor BIOS make coreboot easy to install, easy to use no excuse for running the proprietary vendor BIOS build reproducibly (important because we release ROM images) security through simplicity (flash a known good image often) Heads - http://osresearch.net easy to install # ./external install top.sh -k ”backup-file-to-create” # ./external install bottom.sh -m -k ”backup-file-to-create” easy to use How does a release currently look like? coreboot master branch HEAD at time of release latest SeaBIOS release latest microcode update by Intel Thinkpad X230 only.
    [Show full text]