i945: switch boards to 20230625 coreboot revision
On T60 with Libreboot 20231106 and the GRUB payload, a user
reported this error in GRUB when a battery was connected:
"alloc magic is broken at 0x7b1aedf0: 0"
This error disappears when a battery is not connected, or
when using Libreboot 20230625. The issue has persisted
through to LIbreboot 20240225 and after, and I believe the
issue will be somewhere in coreboot, not in GRUB itself.
For now, switch i945 laptops (X60, T60, Macbook2,1) back to
the February 2023 coreboot revision used in Libreboot 20230625.
A bisect can be done before the next Libreboot release, ETA
May 2024, if time permits. Otherwise, this revert should solve
the problem for now, at least so far as Libreboot is concerned.
The following coreboot patches have been backported:
commit 29030d0f3dad2ec6b86000dfe2c8e951ae80bf94
Author: Bill Xie <persmule@hardenedlinux.org>
Date: Sat Oct 7 01:32:51 2023 +0800
drivers/pc80/rtc/option.c: Stop resetting CMOS during s3 resume
Further patches from upstream:
commit 432e92688eca0e85cbaebca3232f65936b305a98
Author: Bill Xie <persmule@hardenedlinux.org>
Date: Fri Nov 3 12:34:01 2023 +0800
drivers/pc80/rtc/option.c: Reset only CMOS range covered by checksum
These patches fixed S3 on GM45 machines, though it will be useful on
the i945 machines aswell.
The reason I'm doing it this way it is because I don't have a battery
for my X60 or T60, and my T60 isn't in a very good state either,
so I can't reproduce the error myself yet.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2024-04-26 08:37:01 +00:00
|
|
|
tree="i945"
|
2023-12-27 15:18:21 +00:00
|
|
|
xarch="i386-elf"
|
2021-05-18 12:56:12 +00:00
|
|
|
payload_seabios="y"
|
roms: only support SeaBIOS/SeaGRUB on x86
Never, ever build images where GRUB is the primary payload.
These options have been removed from target.cfg handling:
* seabios_withgrub
* grub_withseabios
The "payload_grub" variable now does the same thing as
the old "seabios_withgrub" variable, if set.
The "grubonly" configuration is retained, and enabled by
default when SeaGRUB is enabled (non-grubonly also available).
Due to lbmk issue #216, it is no longer Libreboot policy to
make GRUB the primary payload on any board. GRUB's sheer size
and complexity, plus the large number of memory corruption issues
similar to it that *have* been fixed over the years, tells me
that GRUB is a liability when it is the primary payload.
SeaBIOS is a much safer payload to run as primary, on x86, due
to its smaller size and much more conservative development; it
is simply far less likely to break.
If GRUB breaks in the future, the user's machine is not
bricked. This is because SeaBIOS is the default payload.
Since I no longer wish to ever provide GRUB as a primary
payload, supporting it in lbmk adds needless bloat that
will later probably break anyway due to lack of testing,
so let's just assume SeaGRUB in all cases where the user
wants to use a GRUB payload.
You can mitigate potential security issues with SeaBIOS
by disabling option ROM execution, which can be done at
runtime by inserting integers into CBFS. The SeaBIOS
documentation says how to do this.
Libreboot's GRUB hardening guide still says how to add
a bootorder file in CBFS, making SeaBIOS only load GRUB
from CBFS, and nothing else. This, combined with the
disablement of option ROM execution (if using Intel
graphics), pretty much provides the same security benefits
as GRUB-as-primary, for example when setting a GRUB password
and GPG checks, with encrypted /boot as in the hardening guide.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2024-06-22 21:57:39 +00:00
|
|
|
payload_grub="y"
|
2024-05-27 20:33:53 +00:00
|
|
|
grub_scan_disk="ahci"
|