The bumpy road to open PC firmware Stefan Tauner [email protected] Linuxwochen Wien 2016 2016-04-30 Who am I? • Education: “Technische Informatik” @ TU Wien • Profession: researcher and lecturer @ Technikum Wien • (flashrom’s) Google Summer of Code... I Student 2011, 2013, 2014 I Mentor 2015, 2016 • flashrom’s main upstream developer since 2011 Agenda Introduction — PC Architecture coreboot Motivation Stages Payloads Problems Development flashrom PC Architecture in the 1980ies PC Architecture coreboot Motivation Stages Payloads Problems Development flashrom 1/21 PC Architecture 35 years later PC Architecture coreboot Motivation Stages Payloads Problems Development flashrom 2/21 coreboot coreboot is a free and open source firmware. Charactersistics PC Architecture coreboot • GPLv2 license (essentially) Motivation Stages • Fast (boots in a few hundred ms) Payloads Problems • Over 2 M lines of code (Linux: ca. 20 M) Development flashrom • Supports major OSes (more or less well) • Architectures: x86 (32=64 bit), ARM (v7, v8), MIPS, POWER8, RISC-V • Only initializes the very essentials, then runs a payload • Powers almost all of Google’s Chromebooks 3/21 Motivation • Historically: PC Architecture coreboot Motivation Stages Payloads Problems Development flashrom 4/21 Motivation • Today: PC Architecture coreboot Motivation Stages Payloads Problems Development flashrom 5/21 Stages A coreboot system passes through several stages at startup: PC Architecture 1. initialize infrastructure to run C code coreboot Motivation Stages Payloads 2. configure many peripherals; initialize RAM Problems Development flashrom 3. prepare loading third party software 4. run boot loader, standalone application or OS 6/21 (partially written in ASM, everything else is C) 1. Hardware gets ready (voltage regulators, oscillators etc.) 2. First few instructions are fetched from flash 3. CPU runs them in “real mode” (compatible with Intel 8086 from 1979!) PC Architecture coreboot 4. We want to run C and address ≥ 1 MB memory . Motivation I Switch to 32 bit “protected mode” Stages Payloads I But what about memory? Two possibilities: Problems I Use CPU registers only (romcc for most of bootblock) Development I Use L1 data cache as RAM (CAR) flashrom 7/21 • Set up inter-CPU busses (HT/QPI; may require reset) • Configure SMBus and retrieve SPD data • Initialize RAM • Enable LPC and configure Super I/O if need be • Configure GPIOs (of the SB) • Enable debug console (USB HECI or UART in SIO) PC Architecture coreboot Motivation Stages Payloads Problems Development flashrom 8/21 • Configure SMBus and retrieve SPD data • Initialize RAM • Enable LPC and configure Super I/O if need be • Configure GPIOs (of the SB) • Enable debug console (USB HECI or UART in SIO) • Set up inter-CPU busses (HT/QPI; may require reset) PC Architecture coreboot Motivation Stages Payloads Problems Development flashrom 8/21 • Initialize RAM • Enable LPC and configure Super I/O if need be • Configure GPIOs (of the SB) • Enable debug console (USB HECI or UART in SIO) • Set up inter-CPU busses (HT/QPI; may require reset) PC Architecture coreboot • Configure SMBus and retrieve SPD data Motivation Stages Payloads Problems Development flashrom 8/21 • Enable LPC and configure Super I/O if need be • Configure GPIOs (of the SB) • Enable debug console (USB HECI or UART in SIO) • Set up inter-CPU busses (HT/QPI; may require reset) PC Architecture coreboot • Configure SMBus and retrieve SPD data Motivation Stages • Initialize RAM Payloads Problems Development flashrom 8/21 • Initialize other CPUs PC Architecture • Train PCIE links coreboot Motivation • Allocate PCI resources (BARs) Stages Payloads • Set up data structures for OSes, e.g.: Problems Development I Memory map (e820) flashrom I PCI interrupt routing (PIR) table I ACPI tables (not only for power management!) I MPtable (possibly replaced by parts of ACPI) • Hand over control to payload 9/21 Payloads coreboot can run . • SeaBIOS (provides legacy BIOS interfaces) • Bootloaders requiring no BIOS services (GRUB2) PC Architecture • “Low-level” bootloaders (U-Boot, Depthcharge, FILO) coreboot Motivation • The Linux kernel directly Stages Payloads • The open part of UEFI (Tiano Core) Problems Development • iPXE/gPXE/Etherboot flashrom • Any bare-metal ELF application (e.g., memtest86+) libpayload is a library to be used by payloads • libc subset (e.g., malloc, printf) • (n)curses implementation • Hardware drivers (e.g., PC speaker, VGA, USB) 10/21 Problems • Secure Manufacturer Sales Hardware I Intel Management Engine (ME) I Intel Boot Guard (signed bootblock) I AMD Platform Security Processor (PSP; based on ARM TrustZone) PC Architecture I Future: authenticated SPI communication (Replay coreboot Motivation Protected Monotonic Counter (RPMC)) Stages Payloads Problems • Intellectual Property Software Security Development aka. blobs instead of open designs and APIs flashrom I ME Firmware I Memory Reference Code (MRC) I VGA BIOS (graphics initialization) I Ethernet, WLAN, EC etc. firmware I Microcode (CPU “patches”) • Pride Politics and $$$ I “LinuxBIOS” refined not least because of the name I Intel r UEFI / NIH syndrom 11/21 Development • “How can I install coreboot to test if it works on my hardware?” — “No.” PC Architecture • “Is my board supported although it is not listed nor its coreboot Motivation components?” — “Only if you port it yourself!” Stages Payloads Problems • “How long would it take?” — “A few months . if you Development are an experienced firmware engineer with good flashrom reverse engineering skills.” • If components are supported it is less bleak! • However, every board is different. • autoport can help a lot (with Intel boards). 12/21 Building and Configuration PC Architecture • Build tools based on KConfig (cf. Linux kernel) coreboot Motivation Stages • Clean compiler needed (xgcc built automatically) Payloads Problems • Firmware image partitioned by CBFS (not a real FS) Development • Runtime config via files in CBFS and data in CMOS flashrom • Demo? 13/21 Debugging PC Architecture • I/O Port 80 diagnostics coreboot Motivation • Serial output Stages Payloads Problems • USB (EHCI) debug (e.g., using Beagle Bone Black) Development • Speaker bitbanging flashrom • UDP via NE2000-compatible NIC 14/21 flashrom flashrom is a free and open source NOR flash tool. Charactersistics • GPLv2 license (essentially) • About 50 k lines of code PC Architecture • Supports all major and many minor OSes: coreboot Motivation I Android* Stages I DOS Payloads Problems I Dragonfly-/Open-/Net-/FreeBSD Development I GNU/kFreebsd flashrom I GNU/Linux I Haiku* (BeOS clone) I GNU Hurd* I OSX I OmniOS (Solaris) I Windows* • Architectures: Alpha, HPPA, m68k, x86 (32=64 bit), ARM (v7, v8), MIPS (all variants), POWER (32=64 bit), S390x, SH4, SPARC8/9 15/21 But what does it do!? • It detects/reads/erases/writes . I over 480 flash chips I on over 500 tested mainboards I as well as about 100 other internal and external PC Architecture programmers coreboot Motivation • Can update “BIOS” from within the running OS(!) Stages Payloads • Allows for recovery of bad BIOS or router upgrades Problems Development • Main purpose initially: install coreboot flashrom As long as it is NOR flash flashrom can talk to it . Protocol Main Lifetime Eff. Pins Phys. Pins Parallel ca. since 2002 32 32 LPC/FWH ca. 1998 – 2008 ca. 16 32 SPI ca. since 2006 ≥ 8 8 or 16 16/21 Flash Chip Packages Flash Chip Packages / Where is the flash? On the other side . of course! RaspberryPi as Programmer with Pomona Clip Further Resources Websites I coreboot: https://coreboot.org I flashrom: https://flashrom.org I SerialICE: https://www.serialice.com I SeaBIOS: http://www.seabios.org Videos @Google 2008 coreboot (aka LinuxBIOS) https://www.youtube.com/watch?v=X72LgcMpM9k FOSDEM’11 x86 system boot and initialization https://www.youtube.com/watch?v=xc08SN6Dhz4 25c3 Beyond The Final Frontier https://www.youtube.com/watch?v=e3mkOW3mTRU 26C3 Adding support for a system near you https://www.youtube.com/watch?v=IKBtQYNrsBU FOSDEM’12 The last frontier: Laptops https://www.youtube.com/watch?v=pJkmZgq7WWs 30c3 Hardening hardware and choosing a #goodBIOS https://www.youtube.com/watch?v=2VvR-vsdMlQ FOSDEM’16 Libreboot https://fosdem.org/2016/schedule/event/libreboot References I Lennart Benschop. Coreboot Columns. URL: http://lennartb.home.xs4all.nl/coreboot/ coreboot.html. I Xiaoyu Ruan. Platform Embedded Security Technology Revealed. URL: http://www.apress.com/9781430265719. I Vincent Zimmer, Jiming Sun, Marc Jones, and Stefan Reinauer. Embedded Firmware Solutions: Development Best Practices for the Internet of Things. URL: http://www.apress.com/9781484200711..