FW authentication questions regarding Apollo Lake chromebooks

[coolstar]

Hi, I have an Apollo lake Chromebook and had a few questions with SOF

According to the docs, they say that Apollo Lake is supported but it requires a BIOS change. What changes are required in the BIOS for this to work? I have a custom coreboot + tianocore firmware loaded on my Apollo lake Chromebook already (and don’t boot chrome os on there), so if the BIOS change could be documented or upstreamed into coreboot that would be great to get audio working with SOF (it seems audio does work on geminilake already with the same coreboot tree).

[MrChromebox]

ditto. I'm not seeing any differences between APL and GLK Chromebooks firmware-wise on the audio side, so clarification on what needs to be changed would be appreciated

[marc-hb]

According to the docs, they say...

Which docs, this one? https://thesofproject.github.io/latest/platforms/intel-cavs/apollolake/index.html

This section is a bit confusing, chromebooks never require any BIOS change (only Chromebooks after some date), I mean at least not for authentication reasons. Switching to developer mode is enough, all chromebooks (EDIT: after some date) ship with the community key:
https://thesofproject.github.io/latest/getting_started/intel_debug/introduction.html#chromebooks-and-sof

See confirmation in thesofproject/sof-docs#379

Please submit doc fixes to https://github.com/thesofproject/sof-docs , thanks!

I'm not seeing any differences between APL and GLK Chromebooks firmware-wise on the audio side

Indeed, check the symbolic links in https://github.com/thesofproject/sof-bin/tree/main/v2.0.x/sof-v2.0 (cloning may make that easier). They're created by https://github.com/thesofproject/sof/blob/main/installer/GNUmakefile where you can find this:

target_of_glk := apl

[plbossart]

@coolstar @MrChromebox the issue is the CSME keys used for the SOF firmware authentication. ApolloLake Chromebooks rely on the Intel production key - which means an SOF firmware that you compile yourself would simply be rejected during the boot time. Starting with GeminiLake the key used changed, and you CAN generate the SOF firmware yourself as long as you have access to the Tensilica tools, put the device in developer mode and remove the write protection.

I did test SOF some 3 years ago on ApolloLake, but we had to find devices where we could update coreBoot with the Servo board. It failed on all devices past a specific production milestone, I have exactly ONE device that I could configure with SOF.
It's also impossible to update that key with a regular update.

Bottom line: ApolloLake Chromebooks, despite using the same audio DSP as GeminiLake, will not support SOF. It is what it is, there's nothing we can do about it.

[MrChromebox]

ok, so same issue as SKL/KBL then =(

[plbossart]

ok, so same issue as SKL/KBL then =(

yes indeed.

[coolstar]

@plbossart just wondering, is it possible to update the key with a custom coreboot (even if an external flasher is required to write over the ME region), or are Apollo Lake chromebooks SOL when it comes to SOF?

[marc-hb]

@cujomalainey , in the docs you helped review recently we have:

As stated above, starting from 2019/2020, Intel Chromeboooks have been configured with the community key.

Could we add more specific product references there? It would obviously help answer the questions here. Thanks!

[marc-hb]

(even if an external flasher is required to write over the ME region)

Note merely adding a key does AFAIK not require replacing any firmware code. However I'm not familiar with the flash layout so I unfortunately don't know which region(s) it requires to overwrite (if possible)

This looks relevant: https://www.chromium.org/chromium-os/firmware-porting-guide/2-concepts/

[plbossart]

@plbossart just wondering, is it possible to update the key with a custom coreboot (even if an external flasher is required to write over the ME region), or are Apollo Lake chromebooks SOL when it comes to SOF?

I don't fully recall the details but there was something fused or preventing updates at or after the DVT1 hw prototype stage. In other words none of the actual products can be updated.

[marc-hb]

Starting with GeminiLake [...] as long as you have access to the Tensilica tools,

For non-performance sensitive testing you can use the free, crosstool-ng-based toolchain:
https://thesofproject.github.io/latest/introduction/index.html?highlight=toolchain#toolchain-faq
Don't release binaries compiled with it.

All binaries released in https://github.com/thesofproject/sof-bin are compiled with XCC.

[cujomalainey]

@plbossart just wondering, is it possible to update the key with a custom coreboot (even if an external flasher is required to write over the ME region), or are Apollo Lake chromebooks SOL when it comes to SOF?

I don't fully recall the details but there was something fused or preventing updates at or after the DVT1 hw prototype stage. In other words none of the actual products can be updated.

I am pretty sure if you disable RO FW write protect you can still get in there and change the key. How to do that is a completely different question as I am not a coreboot guy. Also note the many warnings you will see if you venture down that path.

@cujomalainey , in the docs you helped review recently we have:

As stated above, starting from 2019/2020, Intel Chromeboooks have been configured with the community key.

Could we add more specific product references there? It would obviously help answer the questions here. Thanks!

GLK/CML/TGL/JSL/ADL and all following intel chips are signed with the community key. IIRC BYT/CHT/BDW can also run unsigned FW. There is just that gap of APL/SKL/KBL/AML/HSW that can't be switched over easily. Any AMD/MTK platform supported here will also have the community keys. This is again specific to chromebooks.

[plbossart]

I am pretty sure if you disable RO FW write protect you can still get in there and change the key. How to do that is a completely different question as I am not a coreboot guy. Also note the many warnings you will see if you venture down that path.

@cujomalainey you are very optimistic on this one. I tried with the support of the Intel team and the Google team (Dylan, Duncan et. al) and did not succeed except on the 'Elektro' device which was pre-production hardware. The same process failed on all other devices. It would take master hacker skills to make this work without any formal support.

[cujomalainey]

I am pretty sure if you disable RO FW write protect you can still get in there and change the key. How to do that is a completely different question as I am not a coreboot guy. Also note the many warnings you will see if you venture down that path.

@cujomalainey you are very optimistic on this one. I tried with the support of the Intel team and the Google team (Dylan, Duncan et. al) and did not succeed except on the 'Elektro' device which was pre-production hardware. The same process failed on all other devices. It would take master hacker skills to make this work without any formal support.

I don't doubt, I have yet to see anything happen easily in that space. And this would be a high risk activity too, even with servod/ccd

[MrChromebox]

Q: Since APL Chromebooks can load, and SoF provides as part of sof-bin, the intel-signed firmware for Apollolake, why can't that be used instead? Seems others have gotten that to work by disabling route checking on the bxt-da7219-max98357a driver (ref: https://github.com/EMLommers/Apollolake_Audio/)