ryan
/
ownerboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
84 Commits
1 Branch
0 Tags
371 KiB
Nix 99.1%
Shell 0.9%
 
 
master
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '8ee3c8a13b'
${ noResults }
Go to file
Adam Joseph 8ee3c8a13b coreboot: several more kgpe patches 
This commit integrates five more kgpe-d16 patches from my local
tree:

treewide: reduce many messages to BIOS_SPEW

southbridge/amd/sb700/lpc.c: leave LPC timeout mechanism enabled

    I've been experiencing boot hangs during PNP enumeration of the LPC
    bus.  The southbridge chip comes with a mechanism to prevent
    unresponsive/syncflooding LPC devices from wedging the system; let's
    use it.

mainboard/asus/kgpe-d16/romstage.c: support console on ttyS1

    Currently the romstage serial console initialization always
    initializes SP1 (the DB9 header on the back of the motherboard).
    Changing UART_FOR_CONSOLE simply causes the romstage to map the same
    serial port at a different address (0x2f8).

    This commit accounts for UART_FOR_CONSOLE (and its effect on
    TTYS0_BASE) correctly: if UART_FOR_CONSOLE is changed from 0 to 1,
    the romstage console output will be printed on the SP2 header (the
    IDC ribbon header on the motherboard).

southbridge/amd/sb700/lpc.c: set SPI flash aperture to 16MB

    The SPI flash aperture for the southbridge chip is set to 8MB, even
    when a 16MB chip is used.  Let's make the aperture large enough for
    the maximum size chip that this board can accomodate.

amd/sb700/early_setup.c: select console properly

    Currently, sb700/early_setup.c has this comment:

      // XXX Serial port decode on LPC is hardcoded to 0x3f8

    ... and it unconditionally sets the output enable for ttyS0, even if
    ttyS1 is also enabled.  As a result, if coreboot is configured to
    use ttyS1 for serial output, the romstage console output will appear
    on *both* consoles.

    This commit fixes that.

kgpe-d16: disable TPM

    I have never heard of anybody using a TPM on this board, and the
    fewer things we need to deal with during the somewhat-flaky LPC
    init, the better.
 		2 years ago
COPYING Relicense: GPL-v2-or-v3 instead of GPL-v2-or-later 2 years ago
doc doc/: use stable cli in examples 2 years ago
nixpkgs@db24d86dd8 bump pinned nixpkgs submodule 2 years ago
src coreboot: several more kgpe patches 2 years ago
.gitignore init 2 years ago
.gitmodules init 2 years ago
README.md doc/: use stable cli in examples 2 years ago

README.md

Roadmap

  • done 2023-Apr-09 include scripts in the coreboot outpath to flash the images (normal/fallback) individually and manipulate the next-boot selector.
    • update the documentation to reference these scripts, which will make it considerably simpler
  • migrate from checking in kernel .config files to using lib/module.nix merges, like the NixOS kernel config does
  • rk3399-gru-kevin: turn on software sync so the EC firmware can be kept inside the coreboot flash image
  • kgpe-d16: start the hardware watchdog in the bootblock to improve robustness of unattended reboots

ownerboot

Ownerboot is a set of nix expressions which use nixpkgs to build bootloader images for owner-controlled computers.

All the necessary components (coreboot, kernel, busybox-based initramfs with cryptsetup/lvm2) are stored entirely in the bootloader flash chip. This leaves no writable unencrypted media in the boot process when the flash chip's write protect pin is shorted.

Ownerboot extends coreboot with a new normal/fallback mechanism. The flash chip holds two complete copies of the bootloader; only a single page (the bootblock) is shared between them. Each image can be flashed and write-protected indepedently of the other. The fallback image can be selected by /dev/watchdog, nvramtool, or physical input (front-panel button on servers, stylus eject on laptops).

Because ownerboot is written in nix, it can ensure that these builds are deterministic. Ownerboot contains no binaries, and instantiates nixpkgs with config.allowNonSource=false; if you disable nix's binary substituter you are assured that all the software in your bootloader will be built from source on your local machine, all the way back to the compiler which compiles your compiler.

Building

Copypasta:

git submodule init
git submodule update --depth 1 nixpkgs
export NIX_PATH=$(pwd)
nix-build --option trusted-public-keys "" src -A kgpe.coreboot    # kgpe-d16 AMD opteron
nix-build --option trusted-public-keys "" src -A am1i.coreboot    # am1-i AMD kabini
nix-build --option trusted-public-keys "" src -A kevin.coreboot   # Samsung chromebook rk3399 arm64

Details: doc/build.md.

All that compiling and it just dumps me at a bash prompt?

Right now, yes.

On my own machines, I have a pile of big ugly bash scripts for /linuxrc (i.e. initramfs PID 1, which exec()s the long-lived PID 1). These are a complete mess and totally unsuitable for public release. I'm rewriting them in Rust and will publish the result of that work when it's ready.

Supported hardware

Current (all require a 16mbyte flash chip):

Planned:

Additional Tools

Ownerboot includes three nixpkgs-style packages:

I'm not sure either of these really belongs in nixpkgs, but they are useful to the same kinds of people who might be interested in ownerboot. So this is a good place for them.

Code Overview

See doc/architecture.md.

Acknowledgements

  • This project was originally inspired by the petitboot kexec-based bootloader, a derivative of which is shipped with Raptor Computing's POWER9 hardware.

  • The independent write protection of normal/fallback images was inspired by a similar scheme used by the Embedded Controller firmware in arm64 Chromebooks. More details.

  • The nix language is, by far, the most advanced solution available for auditable and reproducible builds of complex software. An incredible amount of software goes into an ownerboot image (almost none of which was written by me!); it's effectively a tiny Linux distribution, and as a bootloader it is at the pinnacle of security sensitivity. Nothing else besides nix gave me any confidence that I knew what was going into my bootloader.

  • nixpkgs was chosen because it is policy-free software: it doesn't force any policy decisions on its dependees. nixpkgs also has amazing support for cross-compilation; once you've used it you'll never want to deal with cross compilers any other way, ever again.

  • PrawnOS is a great resource for arm64 chromebook owners. If you have one, make sure to check out @SolidHal's guide on transplanting a blobless wifi chip into your laptop. It's easier than it looks.

Related Links

License

Everything in this repository is licensed under the GNU General Public License, version 2 or version 3 (at your option).