Add 'content/blog/coreboot-on-talos2.md'

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
4 months ago · dd5453e36d
parent 7ba4f59833
commit dd5453e36d
3 changed files with 310 additions and 0 deletions
--- a/assets/images/blog/TPM-1.2-Talos-II.jpg
+++ b/assets/images/blog/TPM-1.2-Talos-II.jpg
--- a/assets/images/blog/coreboot.svg
+++ b/assets/images/blog/coreboot.svg
@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="196.053" height="150.759" viewBox="0 0 196.053 150.759">
+  <path d="M148.419 40.725c-10.576-6.285-13.657-4.1-23.153-11.671C110.441 17.237 92.488 3.794 74.861 0c0 0 4.307 3.492 12.283 9.822.559.465.705.684.595.867-.169.287-.928-.046-.928-.046-6.163-2.345-13.123-3.675-17.839-3.37-1.561.1-2.061.352-2.283.797-.104.209-.119.772.405 1.469 2.061 2.725 7.024 8.064 15.281 13.132 8.486 5.206 23.472 12.592 36.726 18.489 5.932 2.638 10.207 6.164 8.846 10.232-1.52 4.533-7.387 5.15-12.074 3.275-3.808-1.523-7.367-6.297-13.148-12.701-10.016-11.098-14.769-15.525-31.39-12.141-8.332 1.697-16.194 8.516-22.482 15.713-4.196 5.292-6.213 9.694-6.821 15.002 0 0-1.146-2.105-.008-7.49 1.989-9.407-2.341-13.447-2.341-13.447-21.925 31.092 9.261 59.202 33.301 32.281 0 0-7.865 17.467-7.21 22.906-3.355 1.1-4.845 4.186.176 7.91 5.486 4.068 18.961 3.716 29.59-.852 19.845-8.529 32.213-24.423 38.344-34.516 1.432-2.36 2.947-3.508 3.996-3.883 1.591-.574 12.537.086 17.662-2.824.713.347 1.621.533 2.817.442 3.714-.282 5.976-4.727 5.976-4.727s-4.687-8.941-15.916-15.615zm-41.142 44.652c-10.166 7.24-21.192 9.26-28.008 6.262 10.782-7.818 30.624-27.373 30.624-27.373s-3.302-8.318-9.257-3.225c-5.76 4.925-11.081 11.078-13.184 13.043-1.301 1.213-3.508 3.506-4.812 2.52-1.587-1.199 3.137-11.825 6.749-20.631 4.928-12.01-.742-15.762-7.379-15.429-5.947.299-14.071 3.903-19.891 7.462-1.648 1.009-2.773 1.629-3.189 1.244-.364-.339.021-.977 1.102-1.89 15.471-13.108 37.549-12.767 39.523-3.175 1.571 7.65-14.771 26.914-13.697 27.223.104.029.338-.088.68-.322 5.364-7.021 15.521-17.801 19.331-17.384 6.827.746 9.183 9.794 9.183 9.794L92.291 84.034c4.701 1.277 9.842 1.738 14.986 1.343zm-84.43 40.124l-2.686 4.695c-1.473-1.389-3.449-2.084-5.925-2.084-2.377 0-4.256.791-5.637 2.373-1.381 1.582-2.072 3.77-2.072 6.565 0 5.641 2.687 8.461 8.06 8.461 2.326 0 4.377-.771 6.151-2.31l2.309 4.945c-1.824 1.139-3.418 1.857-4.782 2.159-1.365.302-2.975.452-4.833.452-4.15 0-7.428-1.209-9.829-3.629C1.201 144.712 0 141.353 0 137.051c0-4.235 1.313-7.657 3.942-10.269 2.628-2.611 6.209-3.916 10.746-3.916 3.129 0 5.849.878 8.159 2.635zm1.1 11.248c0-4.101 1.184-7.439 3.552-10.017s5.494-3.866 9.377-3.866c4.084 0 7.255 1.238 9.516 3.715 2.259 2.478 3.389 5.867 3.389 10.168 0 4.285-1.151 7.691-3.452 10.219-2.302 2.527-5.452 3.791-9.453 3.791-4.083 0-7.26-1.275-9.527-3.829-2.269-2.552-3.402-5.946-3.402-10.181zm6.527 0c0 5.926 2.134 8.889 6.402 8.889 1.958 0 3.511-.771 4.658-2.311 1.146-1.539 1.72-3.732 1.72-6.578 0-5.84-2.126-8.762-6.377-8.762-1.958 0-3.514.77-4.669 2.31-1.156 1.54-1.734 3.69-1.734 6.452zm38.841-7.531c-1.121-.736-2.352-1.105-3.69-1.105-1.457 0-2.749.662-3.879 1.984-1.129 1.321-1.694 2.937-1.694 4.846v15.314h-6.277v-26.89h6.277v2.462c1.757-1.977 4.092-2.963 7.004-2.963 2.142 0 3.783.326 4.921.979l-2.662 5.373zm26.83 9.515H76.938c.117 2.143.854 3.808 2.209 4.996 1.355 1.188 3.18 1.782 5.473 1.782 2.862 0 5.038-.745 6.527-2.235l2.436 4.795c-2.21 1.792-5.507 2.688-9.892 2.688-4.102 0-7.344-1.201-9.729-3.603-2.385-2.401-3.578-5.754-3.578-10.056 0-4.234 1.31-7.665 3.929-10.293 2.62-2.629 5.762-3.941 9.428-3.941 3.899 0 7.03 1.162 9.391 3.489 2.359 2.327 3.539 5.289 3.539 8.888.001.77-.175 1.933-.526 3.49zm-18.981-4.72h13.207c-.436-3.933-2.612-5.9-6.528-5.9-3.582-.001-5.809 1.967-6.679 5.9zm26.916 14.761l-1.406 1.984h-3.539V113.35l6.276-1.507v12.553c1.673-1.021 3.497-1.53 5.474-1.53 3.932 0 7.104 1.242 9.515 3.728 2.411 2.485 3.615 5.671 3.615 9.554 0 4.502-1.214 8.062-3.64 10.683-2.428 2.62-5.717 3.929-9.867 3.929-2.494-.001-4.637-.662-6.428-1.986zm1.331-19.003v14.033c.92 1.088 2.167 1.633 3.741 1.633 3.028 0 5.175-.72 6.439-2.16 1.264-1.438 1.895-3.74 1.895-6.904 0-5.455-2.609-8.184-7.832-8.184-1.858-.001-3.272.526-4.243 1.582zm20.314 6.978c0-4.101 1.184-7.439 3.553-10.017 2.367-2.577 5.493-3.866 9.376-3.866 4.085 0 7.257 1.238 9.517 3.715 2.259 2.478 3.389 5.867 3.389 10.168 0 4.285-1.15 7.691-3.451 10.219-2.303 2.527-5.453 3.791-9.454 3.791-4.083 0-7.26-1.275-9.527-3.829-2.271-2.552-3.403-5.946-3.403-10.181zm6.527 0c0 5.926 2.134 8.889 6.401 8.889 1.959 0 3.511-.771 4.657-2.311 1.146-1.539 1.721-3.732 1.721-6.578 0-5.84-2.127-8.762-6.378-8.762-1.958 0-3.515.77-4.669 2.31-1.155 1.54-1.732 3.69-1.732 6.452zm20.514 0c0-4.101 1.184-7.439 3.553-10.017s5.494-3.866 9.377-3.866c4.084 0 7.256 1.238 9.516 3.715 2.26 2.478 3.39 5.867 3.39 10.168 0 4.285-1.151 7.691-3.452 10.219-2.302 2.527-5.452 3.791-9.453 3.791-4.083 0-7.26-1.275-9.527-3.829-2.271-2.552-3.404-5.946-3.404-10.181zm6.528 0c0 5.926 2.134 8.889 6.401 8.889 1.959 0 3.512-.771 4.658-2.311 1.146-1.539 1.719-3.732 1.719-6.578 0-5.84-2.125-8.762-6.377-8.762-1.957 0-3.514.77-4.669 2.31s-1.732 3.69-1.732 6.452zm22.196-8.335h-3.112v-5.047h3.112v-5.473l6.277-2.31v7.782h7.381v5.047h-7.381v11.774c0 1.926.301 3.285.903 4.08s1.657 1.193 3.163 1.193c1.508 0 2.912-.41 4.219-1.23v5.773c-1.457.502-3.531.754-6.227.754-2.678 0-4.736-.758-6.176-2.272s-2.16-3.669-2.16-6.464v-13.607z"/>
+</svg>
--- a/content/blog/coreboot-on-talos2.md
+++ b/content/blog/coreboot-on-talos2.md
@ -0,0 +1,307 @@
+---
+title: coreboot and Heads as an alternative firmware for OpenPOWER Talos II
+author: Krystian Hebel
+tags:
+  - openpower
+  - power9
+  - firmware
+  - coreboot
+  - hostboot
+date: 2024-07-09
+draft: true
+---
+
+This blog post presents coreboot ([spelled in lower case characters](https://doc.coreboot.org/#spelling-of-coreboot),
+even when it is the first word in a sentence) and Heads as an alternative to
+Hostboot and Skiroot/Petitboot, respectively.
+
+As described on the [project's page](https://coreboot.org),
+
+> coreboot is an extended firmware platform that delivers a lightning fast and
+> secure boot experience on modern computers and embedded systems.
+
+{{< image src="blog/coreboot.svg" >}}
+
+It aims to do the bare minimum required to make the hardware usable and pass
+the control to next program, called the payload. In case of Talos II, that
+payload is Skiboot, with [few changes on top](https://github.com/Dasharo/skiboot/tree/raptor-cs_talos-2)
+to make it play along with Heads.
+
+Speaking of [Heads](https://github.com/linuxboot/heads), it is:
+
+> a minimal Linux that (...) provides a secure, flexible boot environment for
+laptops, workstations and servers.
+
+Heads provides a bootloader menu that starts final operating system through
+kexec call. This is very similar to what Petitboot does, but Heads puts
+security above everything else.
+
+It is possible to use coreboot without Heads, but not the other way around.
+Heads depends on structures created by coreboot, which just aren't present when
+booting with Hostboot.
+
+## Building and flashing coreboot
+
+To build coreboot image, follow the steps below:
+
+1. Clone the coreboot repository:
+
+    ```
+    git clone https://github.com/Dasharo/coreboot.git \
+       --depth=1 -b raptor-cs_talos-2/rel_v0.7.0
+    ```
+
+2. Start docker container:
+
+    ```
+    cd coreboot
+    docker run --rm -it \
+       -v $PWD:/home/coreboot/coreboot \
+       -w /home/coreboot/coreboot \
+       -u "$(id -u):$(id -g)" \
+       coreboot/coreboot-sdk:0ad5fbd48d /bin/bash
+    ```
+
+3. Configure and start the build process inside of the container:
+
+    ```
+    (docker) cp configs/config.raptor-cs-talos-2 .config
+    (docker) make olddefconfig
+    (docker) make
+    ```
+	
+After image is built you can exit the container, either with `exit` or Ctrl+D.
+To flash it to your platform:
+
+0. Make sure you're running System Package v2.00, if not, get it from
+[here](https://wiki.raptorcs.com/wiki/Talos_II/Firmware) and
+[update/downgrade](https://wiki.raptorcs.com/wiki/Updating_Firmware#Updating_the_OpenPOWER_firmware).
+Start the platform once so SEEPROM is also updated, then power off.
+
+1. Copy images to BMC:
+
+    ```
+    scp -O build/bootblock.signed.ecc root@<BMC_IP>:/tmp/bootblock.signed.ecc
+    scp -O build/coreboot.rom.signed.ecc root@<BMC_IP>:/tmp/coreboot.rom.signed.ecc
+    ```
+
+2. Log in to BMC through SSH:
+
+    ```
+    ssh root@<BMC_IP>
+    ```
+
+3. Flash both partitions:
+
+    ```
+    pflash -e -P HBB -p /tmp/bootblock.signed.ecc
+    pflash -e -P HBI -p /tmp/coreboot.rom.signed.ecc
+    ```
+
+4. Boot the platform as usual and enjoy coreboot running on Talos II:
+
+[![asciicast](https://asciinema.org/a/zkQV1KhxY4n6IrlzssuvFHHS5.svg)]https://asciinema.org/a/zkQV1KhxY4n6IrlzssuvFHHS5
+
+## Building and flashing Heads
+
+Reminder: Heads requires coreboot. Instructions above **must** be performed
+before flashing Heads. It also requires a [compatible USB security dongle](https://osresearch.net/Prerequisites#usb-security-dongles-aka-security-token-aka-smartcard)
+and TPM (more about it later).
+
+> Technically, TPM isn't a hard requirement of Heads, however its usefulness
+> without it is very limited, up to a point where it doesn't have any advantages
+> over Petitboot.
+
+1. Just as earlier, start with cloning the repository:
+
+    ```
+    git clone https://github.com/Dasharo/heads.git \
+       --depth=1 -b raptor-cs_talos-2/release
+    ```
+
+2. Start docker container:
+
+    ```
+    cd heads
+    docker run --rm -it \
+       -v $PWD:/home/heads/heads \
+       -w /home/heads/heads \
+       -u "$(id -u):$(id -g)" \
+       3mdeb/heads-docker:2.4.0 /bin/bash
+    ```
+
+3. Build:
+
+    ```
+    (docker) make BOARD=talos-2
+    ```
+
+This will take a while, wait for it to finish and then exit the container. In
+the process, a coreboot image will also be built, but with slightly different
+configuration. For security and reproducible images, `BUILD_TIMELESS` is always
+enabled. While it actually strips file paths, it also removes file names and
+line numbers from asserts in the code. It makes reporting and debugging
+potential issues harder, so we suggest using coreboot built manually, at least
+for the time being.
+
+Steps for flashing Heads are similar to those done for coreboot.
+
+1. Copy the Heads binary to the BMC (assuming in the Heads root directory):
+
+    ```
+    scp -O build/zImage.bundled root@<BMC_IP>:/tmp/zImage.bundled
+    ```
+
+2. Log in to the BMC:
+
+    ```
+    ssh root@<BMC_IP>
+    ```
+
+3. Flash the BOOTKERNEL partition with Heads:
+
+    ```
+    pflash -e -P BOOTKERNEL -p /tmp/zImage.bundled
+    ```
+
+Answer yes to the prompt and wait for the process to finish. After that, start
+the platform and begin [configuring Heads](https://osresearch.net/Configuring-Keys/).
+
+## PNOR emulation
+
+Flash device can be emulated by BMC, which is something we were often using for
+development and testing. This saves a lot of time which would be spent flashing,
+as well as reduces the wear of flash device.
+
+However, this still requires System Package v2.00, and if this is different than
+what real flash holds, SEEPROM will have to be updated when switching between
+physical and emulated image. Also, this approach doesn't survive BMC reboots and
+power losses. BMC doesn't have enough space to keep full PNOR image in
+non-volatile memory, so `tmpfs` must be used for emulation. Don't try to put
+more than one image in `tmpfs` or BMC **will** run out of RAM, which most likely
+will require manual power cycle.
+
+To start, obtain full flash image, either by downloading it from
+[RaptorCS release page](https://wiki.raptorcs.com/wiki/Talos_II/Firmware) or
+reading from existing image on BMC with:
+
+```
+pflash -r /tmp/talos.pnor
+```
+
+After that, you can "flash" the partitions mentioned earlier by adding
+additional parameters to use the file instead of physical flash:
+
+```
+pflash -f -P <partition> -p <image_file> -F /tmp/talos.pnor
+```
+
+Change `<partition>` to one of `HBB`, `HBI`, `BOOTKERNEL` and `<image_file>` to
+`/tmp/bootblock.signed.ecc`, `/tmp/coreboot.rom.signed.ecc` or
+`/tmp/zImage.bundled`, respectively.
+
+To tell BMC to present the contents of this file as flash, run:
+
+```
+mboxctl --backend file:/tmp/talos.pnor
+```
+
+Sometimes this command fails with a timeout, in that case run it again until it
+succeeds.
+
+> We've noticed that sometimes, despite no error message printed, physical flash
+> was used anyway. It is easy to spot when one copy has Hostboot and the other
+> has coreboot, but it can be missed when both images have different versions of
+> coreboot. It caused us few hours of unnecessary debugging of issues that were
+> already fixed...
+
+With the file now mounted, platform can be started. Host firmware and OS
+shouldn't be able to tell the difference, except for different reported erase
+block size and maybe different access times.
+
+To get back to original flash, run:
+
+```
+mboxctl --backend vpnor
+```
+
+It will report an error (`Failed to post message: Connection timed out`), but
+will revert to physical device nonetheless. This can be confirmed by checking
+the output of `mboxctl --lpc-state`:
+
+```
+root@talos:~# mboxctl --lpc-state
+LPC Bus Maps: Flash Device
+```
+
+Since the file is now the full image with coreboot (and optionally Heads), it
+can be simply written to flash, should you choose to accept it:
+
+```
+pflash -E -p /tmp/talos.pnor
+```
+
+## Noticeable differences between Hostboot and coreboot
+
+For those wondering why we even started this project, here are some of the
+differences between Hostboot and coreboot.
+
+First of all, coreboot uses C, while Hostboot was written in C++. The latter can
+be viewed as a complete operating system - it can use multiple threads
+simultaneously, manages virtual memory and uses memory swapping (even before RAM
+is trained). Each major [istep](https://wiki.raptorcs.com/w/images/b/bd/IPL-Flow-POWER9.pdf)
+(IPL Step, which in turn stands for Initial Program Load) is a separate
+application, with some common dynamically loaded libraries. coreboot, on the
+other hand, runs all of the code in just 3 separate stages - bootblock, romstage
+and ramstage. This allows for tighter linking process, which reduces the final
+size of the code.
+
+Another significant difference is reduced amount of RAS (Reliability,
+Availability, Serviceability) features enabled in coreboot. Talos II is often
+used as a workstation, and while RAS has its uses in servers (it is preferred
+to start with partially working hardware than not starting at all), for home
+users booting fast is usually more important. Because of that coreboot doesn't
+support bad DQ masking for DRAM, it can also optionally skip initial RAM
+scrubbing. Because of these reasons, as well as smaller size of code in general,
+booting coreboot is significantly faster than Hostboot - some preliminary
+results can be found [here](https://github.com/3mdeb/openpower-coreboot-docs/blob/main/devnotes/user_perspective.md).
+
+Another technical difference is the way data is passed to Skiboot. Hostboot uses
+HDAT - a format specific to this particular firmware. For coreboot, a device
+tree conforming to a well-defined specification is used. In fact, Skiboot
+internally converts HDAT to device tree anyway. At the moment, some information
+is not presented by coreboot (https://github.com/Dasharo/dasharo-issues/issues/446,
+https://github.com/Dasharo/dasharo-issues/issues/32), but those seem to be
+rather cosmetic than anything else - if you know about something that requires
+those pieces of information to be present, let us know.
+
+## TPM
+
+TPM is an integral part of security mechanisms added by Heads. As existing I2C
+TPMs were [hard to obtain](https://github.com/3mdeb/openpower-coreboot-docs/blob/main/devnotes/tpm_over_i2c.md)
+at the time we were working on this part of the project, and LPC TPMs couldn't
+be used [due to the way POWER9 processor exposed access to LPC bus](https://github.com/3mdeb/openpower-coreboot-docs/blob/main/devnotes/tpm_over_lpc.md#tpm-over-lpc-interface),
+we had to [consider other options](https://github.com/3mdeb/openpower-coreboot-docs/blob/main/devnotes/tpm.md).
+
+The solution we ended up with was to create our own [I2C TPM 1.2 module](https://docs.dasharo.com/variants/talos_2/tpm-support/),
+based on Infineon SLB9645TT1.2 chip. This chip isn't supported by drivers in
+Hostboot and upstream Skiboot, to make use of it you have to use coreboot and
+Dasharo's fork of Skiboot.
+
+{{< image src="blog/TPM-1.2-Talos-II.jpg" >}}
+
+## Links and references
+
+Here are some links to documentation related to this project:
+
+- [main user documentation page](https://docs.dasharo.com/variants/talos_2/overview/)
+- [release notes and binaries](https://docs.dasharo.com/variants/talos_2/releases/)
+- [list of known issues](https://github.com/Dasharo/dasharo-issues/labels/raptor-cs_talos-2),
+  if you want to create new issue remember to add proper tag
+- [scripts for dumping debug data and logs](https://github.com/3mdeb/openpower-coreboot-docs/tree/main/devnotes/scripts)
+- [dump of SCOM accesses and other debug output divided by isteps](https://github.com/3mdeb/openpower-coreboot-docs/tree/main/logs/scom_dumps)
+- [other uncategorized developer notes](https://github.com/3mdeb/openpower-coreboot-docs/blob/main/devnotes)
+- [Open Source Firmware Slack channel dedicated to coreboot on OpenPOWER](https://osfw.slack.com/archives/C01BHE47JSW)
+
+We invite you to test for yourselves and share the results, both good and bad,
+either on channels listed above or in issue.