PCENGINES APU[1-7] Coreboot SeaBIOS Open Source Firmware

[pietrushnic]

Hi till,
thank you. Definitely, this is a great thread with a reasonable statistic. I agree that firmware is underestimated - IMO especially in security and advanced hardware features (e.g. virtualization). My dream would be to form a movement that can convince network appliance vendors to use Open Source Firmware that is compiled in a reproducible way, has recent security patches and state of the art performance, deployed in a way convenient to users (e.g. LVFS/fwupd) as well as open for contribution.

If you see any vendor who would be a good candidate for Open Source Firmware please let us know, if there would be big enough movement we may be able to enable more hardware platforms.

Unfortunately, we face a neverending battle with silicon vendors who just seem to care about sales figures. Good documentation and support are rather not on their agenda. We see a lot of changes in approach to the firmware (FSP license change, Project Mu, Slim Bootloader) - I can't say AMD keep up to recent trends. We rather spent times on working around issues in vendor code, then extending or improving coreboot support.

[newsense]

Hi pietrushnic

Thank you for the detailed answer and the quick turnaround regarding the SHA256 and signature information that's been added to the latest versions in mainline and legacy. (My bad, completely missed ECC being enabled in mainline in 4.8.0.5)

As time permits, it would likely be a good idea to provide the same SHA256 information for the previous releases should there be a need in a specific setup to revert to a previously known version that worked.

[newsense]

Hi pietrushnic

I bring both lousy and awesome news... :)

Just received an APU4C4 which came with a stock BIOS v4.6.4 which fails to update to either v4.9.0.2 or v4.9.0.1 with a weird FIFO message that I couldn't find on Github or PCEngines forums:

Code Select Expand

FIFO pointer corruption! Pointer is 6, wanted 3


For the time being, nothing is plugged in the board other than power, USB stick and serial cable.


The awesome news however is that it successfully booted 19.1 :)


Your help and guidance with regards to the BIOS update would be very much appreciated. Full output of the BIOS update attempt and live boot are attached.

[miczyg]

Hi pietrushnic

I bring both lousy and awesome news... :)

Just received an APU4C4 which came with a stock BIOS v4.6.4 which fails to update to either v4.9.0.2 or v4.9.0.1 with a weird FIFO message that I couldn't find on Github or PCEngines forums:

Code Select Expand

FIFO pointer corruption! Pointer is 6, wanted 3


For the time being, nothing is plugged in the board other than power, USB stick and serial cable.


The awesome news however is that it successfully booted 19.1 :)


Your help and guidance with regards to the BIOS update would be very much appreciated. Full output of the BIOS update attempt and live boot are attached.

Hi newsense,

I am Michał Żygowski, firmware engineer in 3mdeb, PC Engines firmware co-maintainer.

After looking at the log, I can see it is a flashrom error. We use only flashrom version 0.9.9+ and I advise You to do the same. Older versions of flashrom may not have the right chipset interface implemented.

Flashrom is not a part of firmware, it is just linux utility to flash firmware. I am pretty sure the newer flashrom will do the trick. PC Engines tinycore is not the only way to flash the firmware, You can use any Linux and install flashrom (or compile it if You are confident about Your skills). If You encounter any problems feel free to ask questions. I will help as much as possible.

[newsense]

Hi Michal,

Thanks for the quick reply. I was actually thinking about that while reading lattera's recent post and wondering about why he had to bootstrap HBSD prior to flashing the ROM instead of using the TinyCore utility provided by PCEngines - which worked just fine for me a couple weeks back to upgrade an APU3.

So the big takeaway is that the TinyCore is a PCEngines issue to fix and nothing you guys can address in the meantime for the APU4 users ?


As time permits I'll try to bootstrap some linux distro or even use lattera's guide if I can find a spare network cable - and report back later today.

[tillsense]

Hi,

flashrom is since 2 years in the ports of opnsense itself.
Current version is 1.0 (_1)

Code Select Expand


flashrom v1.0 on FreeBSD 11.2-RELEASE-p8-HBSD (amd64)
flashrom is free software, get the source code at https://flashrom.org


https://forum.opnsense.org/index.php?topic=4172

cheers
till

[newsense]

Thank you tillsense but I need to file an official complaint here since users are clearly being sabotaged here... :-)


Joke aside, the procedure I followed is extremly straightforward and arguably less scarry and error prone for the average user when compared to the otherwise great Github post by lattera on this matter.


Steps are as follows:

1. Boot OPNsense from USB to live mode and assign an IP on the WAN interface

2. pkg install flashrom

3. curl https://www.<your_chosen_rom_version_matching_the_APU.com --output apuXver4.9.0.2.rom

4.sha256 apuXver4.9.0.2.rom --- make sure it matches the one on https://pcengines.github.io

5.flashrom -w apuXver4.9.0.2.rom -p internal --- I had the board mismatch warning so I used the override as displayed on the screen

6. reboot

The full output of the procedure is attached.

To further simplify things, flashrom and its dependencies could be included at least on the serial if not all the OPNsense images going forward. (?)


Again, a big thanks to the 3mdeb team, tillsense and lattera for their - direct or indirect - contributions to this thread.

[mayo]

Thanks for the clear procedure!
One question: is not possible to upgrade in a msata running machine instead of booting from USB?

[newsense]

I just upgraded and APU3C4 with msata remotely, which was in production, without issues: v4.9.0.1 > v4.9.0.2.

The specific case above was due to a new board that wasn't yet fully set up with msata and mounted in its enclosure - hence the live boot to check up everything is operational and up to date before deployment.

[mayo]

Perfect, thank you!
One think, I downloaded apu2_v4.9.0.2.rom (I have apu2c4 board) but, when I check sha256 it gives me the sha of the apu4_v4.9.0.2.rom, probably because I copied your filename... is there a way to reset it?

Thank you!!!

[newsense]

The SHA256 _must_ match the one on the site.

Downloaded 3 roms randomly and there are different sums as expected:

shasum -a 256 apu*.rom
4d64c5b7875b9877b4f149e0a0f082a614ae5572cfd7346b0c45d5378f887b75 apu2_v4.9.0.2.rom
fa4f1c1763ec918457ba22e57c3ff8fb19fc32cd0634ac9d7472b612cea806ae  apu4_v4.9.0.2.rom
e31e952dfcb549f3144d30eb25b2bcb2ddaeb9ed89372d2e548c0d3902cf14c5  apu5_v4.9.0.2.rom

[mayo]

I've tried this way:
curl https://cloud.3mdeb.com/index.php/s/DKo4ZkxjxiTttEb/download --output apu2_v4.9.0.2.rom

and then:
shasum -a 256 apu*.rom

and the result is:
fa4f1c1763ec918457ba22e57c3ff8fb19fc32cd0634ac9d7472b612cea806ae  apu2_v4.9.0.2.rom

that seems to be apu4 according to the Pc Engines github page...

[newsense]

Are you copying the correct link for your APU ?

This is the one for APU2:

https://cloud.3mdeb.com/index.php/s/AF5XHB54gz4dpQL/download

[mayo]

Stupid Me!

ok, now it works pefectly!
thank you so much!

[Northguy]

8<---

less scarry and error prone for the average user when compared to the otherwise great Github post by lattera on this matter.

8<--

Just wondering, which post on which Github?