coreboot for Protectli FW2B and FW4B

[pietrushnic]

Hi all,
as I previously mentioned in other threads, we are glad to announce that 3mdeb continue its mission to promote Open Source Firmware for network appliance hardware. We partner Protectli to enable Open Source Firmware based on coreboot. We start with FW2B and FW4B Intel Braswell platforms.

Quality of OPNsense support in that firmware is our top priority, so if anyone has the capability (skills, SPI flash programmer or RTE) to support the testing effort we would be glad to cooperate.

In the following weeks we should publish all patches, submit them to coreboot community for review and provide documentation so anyone who wants can flash his/her hardware.

If you want to get more information feel free to follow us on social media.

[newsense]

Thanks for the update pietrushnic, knowing you're company is supporting the firmware for those appliances will definitely be a game changer when considering or recommending new hardware.

[franco]

Hi Piotr,

Thanks for pushing this issue and following up with our community.  :)


Cheers,
Franco

[tillsense]

Hi,

any news here yet?

cheers
till

[tillsense]

Hi,

here is a short video showing the boot process...Please more of it!

https://www.youtube.com/watch?v=qJBJ2TpAu8I

cheers
till

[pietrushnic]

@tillsense,
sorry for not replying for quite long. We are very busy with work for Protectli and adding products to our shop which will ship in the area of EU. Of course, we selling FW2B and FW4B with coreboot as an option - more information here. We are open for extensions recommendations.

I have 2 updates:
1. Source code for Protectli FW2B and FW4B is under review: https://review.coreboot.org/c/coreboot/+/32076 - depending on skill set this code can be built and flashed. The code was validated to work with OPNsense.
2. We started work on FW6A/B/C which are based on Kaby Lake. Results of our work should be pushed to the community in Q2 2019.

If you see anything missing feel free to ask.

[spetrillo]

What is the goal for coreboot? I own a Protectli FW4B and love it. Great device...small is stature but very powerful.

[oneplane]

How does this run on board with Intel BootGuard enabled?

[pietrushnic]

First sorry for a long time between my replies. I have no other excuses then saying we working to deploy open-source firmware for more firewall devices.

What is the goal for coreboot? I own a Protectli FW4B and love it. Great device...small is stature but very powerful.

Main goals are described here. In this case we have couple improvments:

• long term maintainability - firmware is open and even when the vendor will have a problem getting firmware updates community can take over, it is also easier to fix open code then binary blob :)
• reproducible builds - we can check if our firmware was not changed in a malicious way
• customization - devices can be customized
• auditability - you can read most of the code that devices use for boot process

Probably many more, but those are some key points.

How does this run on board with Intel BootGuard enabled?

Protectli doesn't ship Intel Boot Guard enabled platforms. Where did you get one? BTW to workaround Intel Boot Guard you need exploit for it and even then what you can do with firmware is limited.