coreboot

Can we find out who the framework laptops were supplied to? It's great that these individuals have agreed to work on the port, but the coreboot community as a whole hasn't signed up to support the framework laptop.

There are a number of professional consulting groups that do coreboot ports. If framework is actually interested in getting a port done, might I suggest that these might be a better way to go about getting a port done?
https://www.coreboot.org/consulting.html

Martin Roth wrote in #note-1:

Can we find out who the framework laptops were supplied to? It's great that these individuals have agreed to work on the port, but the coreboot community as a whole hasn't signed up to support the framework laptop.

Sure. Let me ask it to the Framework on the Framework community forum. I will let you know here.

There are a number of professional consulting groups that do coreboot ports. If framework is actually interested in getting a port done, might I suggest that these might be a better way to go about getting a port done?
https://www.coreboot.org/consulting.html

Thank you for the info. I would like to communicate with the coreboot community or the consulting groups openly as much as possible here or somewhere, even when I may need to email someone as a close communication temporarily. Because in this case, though Framework is possibly interested in the port, I know Framework community is really interested in it. People in the community should be able to know the progress and involve the task.

I am not sure what prevents coreboot's port to the Framework Laptop. But if a funding to the coreboot solves, I mean if some coreboot developers can get the port done by working intensively for example for 1 month by a funding, I am happy to act to collect the money from people who want to see the port done by using an OSS funding platform[1] that fits coreboot. For example, you might know "Tidelift" and "GitHub Sponsors".

What do you think? Anyway, first I want to know what prevents coreboot's port to the Framework Laptop.

References¶

• [1] Monetization Platforms for Open Source Creators - a list of OSS funding platforms - https://www.oss.fund/all/

Jun Aruga wrote in #note-2:

People in the community should be able to know the progress and involve the task.

That's on Framework, not the coreboot commmunity.

Anyway, first I want to know what prevents coreboot's port to the Framework Laptop.

Intel BootGuard is active/enabled on the Framework laptop. That means that the system firmware (vendor UEFI, coreboot, etc) must be cryptographically signed with the same key fused into the PCH. Framework controls this key, and has proposed creating both a signed "official" coreboot image as well as signed shim which would allow user-built coreboot firmware to be used.

Where they are on that process is unknown, because there has been no official overture from Framework to the coreboot community. They supposedly sent out 3 dev units (which do not have Bootguard enabled) to individual developers. Matthew Garrett (mjg59) posted about his unsuccessful efforts a few months ago on Twitter but there has been nothing recent to my knowledge. Who else has dev boards is unknown.

Hey Jun, Please don't misunderstand any of this as hostility - it's definitely not meant that way.

I think we all would like a framework coreboot port, and would be excited to see it happen, but it takes quite a bit of work to get an initial port done and maintained. As a member of the coreboot community, I want to make sure that any issues in this process don't come back onto the community for any inadequacies of any work that's being done. The coreboot project is developed both by individuals and companies using it for their own needs. Those companies invest a significant amount to get that work done, and any work done by individuals is done on their own time.

We care intensely about the project, and keeping things running smoothly takes a very significant amount of work on our part. Any work that is done or promised by the people that have been supplied framework machines is being done as individuals, not as direct representatives of the coreboot project as a whole.

As far as fundraising to do a port, that is also something that would need to be done by individuals, not by the coreboot project. We have a number of different consulting companies who work on coreboot, and as a project, we're not going to discriminate between them by doing an official "coreboot" fundraiser for a particular project. We as a project will absolutely support anyone doing a fundraiser, but any expectations of deliverables need to be understood as being between the developers doing any paid work and the people contributing to that effort. The coreboot project is not a party to the transaction and cannot be held responsible for any failures, beyond trying to fix any normal breakages in ongoing development of the coreboot codebase.

Again, I very much appreciate the desire to have a coreboot port for the framework laptop, and I'm sure that something will be done at some point/ I just want everyone involved to have realistic expectations of how development works and how the platform would be maintained.

Thanks for setting this up as a place for a discussion to happen.

Framework controls this key, and has proposed creating both a signed "official" coreboot image as well as signed shim which would allow user-built coreboot firmware to be used.

I hope they know what they are talking about. I mean such a shim, wouldn't that effectively disable the whole BootGuard feature? It would be most welcome, though. Because without it,
it would be very hard for the community to maintain the port (and to be honest, if they make it hard, it won't happen). Alternatively, they could sell units with BootGuard disabled. That would also reduce the amount of blobs needed.

How can we, people in the Framework community, help you?

Get them to publish documentation. Or at least get them to offer a reasonable NDA to individuals. Without documentation, the community is unlikely to pick up the maintenance effort and they'll need to constantly pay somebody for it (if the goal is to have upstream coreboot support). Schematics are a minimum. What is controlled by the EC and how is also very valuable information. Without such documentation, one has to be very lucky. If unlucky, it's possible that the initial port costs some $10,000 more.

What is controlled by the EC and how is also very valuable information.

They have published the code of their EC, so I guess this part shouldn't be hard: https://github.com/FrameworkComputer/EmbeddedController

Just FYI, the board schematics are here: https://github.com/FrameworkComputer/Mainboard/blob/main/Electrical/Mainboard_Interfaces_Schematic.pdf

Raul Rangel wrote in #note-7:

Just FYI, the board schematics are here: https://github.com/FrameworkComputer/Mainboard/blob/main/Electrical/Mainboard_Interfaces_Schematic.pdf

That's just bits about the connectors, AFAICS.

Nico Huber wrote in #note-8:

Raul Rangel wrote in #note-7:

Just FYI, the board schematics are here: https://github.com/FrameworkComputer/Mainboard/blob/main/Electrical/Mainboard_Interfaces_Schematic.pdf

That's just bits about the connectors, AFAICS.

Thanks for your comments, everyone! I will read and reply later. Just note that the full schematics and board views are available to "repair shops" under an agreement. I am not sure those are available for the coreboot community.

• The knowledge base article: https://knowledgebase.frame.work/en_us/availability-of-schematics-and-boardviews-BJMZ6EAu
• Framework founder's related comment in June 2022 on Hacker News: https://news.ycombinator.com/item?id=31576346

First, I will comment on how to collaborate with people in the coreboot community. Martin Roth, great points. Thanks for sharing it. I agree. In my recognition, it is about the responsibility of the company, Framework, and the fairness with other companies who develop coreboot.

Responsibility: The coreboot community doesn't have a responsibility about the transaction and any features. Framework should have it.

Fairness: PC manufacture and consulting companies invest a significant amount to get that work done. If Framework works with people in the coreboot project, in my opinion, the possible choices are that a. Framework will invest a significant amount to the coreboot as well as other companies in the coreboot project do. b. Framework will work with individuals not with the entire coreboot project. For fundraising, I think a task driven and bounty type OSS funding platform may fit for this porting task. That means that when developers finish the work done, the platform pays the bounty to the developers.

I think the fairness is related to what Matt DeVillier said "That's on Framework, not the coreboot community.". I cannot use this ticket for everyone in the coreboot to see the progress and to see the task done. Because that means that the coreboot project discriminates between companies to work in/for the coreboot project. So, feel free to change the ticket's status to close if it is needed. However communicating here is really meaningful for me. It is great if I can continue the discussions, asking questions on this ticket.

Second, I will comment about some things to clarify. I am asking Framework with the following questions below now.

• Whom the Framework founder provided the 3 Framework Laptops to in the coreboot community?
• Do the 3 Framework Laptops which the Framework founder sent to the people in the coreboot disable Intel BootGuard fully?
• Documentations: Is the current (not full) documentation without an agreement good enough to port coreboot? Can individuals in the coreboot community access the full schematics and board views with an agreement?

I am also asking Matthew Garrett what is the current status of his porting work by emailing him, introducing this ticket. As my next action, I will find a task driven bounty type OSS funding platform. Again, thanks for your comments! Let me know what you think.

Matt DeVillier wrote in #note-3:

Jun Aruga wrote in #note-2:

People in the community should be able to know the progress and involve the task.

That's on Framework, not the coreboot commmunity.

I updated the coreboot specific thread on the Framework community forum above ("[6] Free the EC! and Coreboot Only"), renaming the thread title to a better one, and adding a summary to the first comment (wiki), for people to discuss easily there too. You are welcome to join.
https://community.frame.work/t/coreboot-on-the-framework-laptop/791

Framework recently announced the "Chromebook Edition" of their Laptop: https://frame.work/blog/introducing-the-framework-laptop-chromebook-edition. They write that it's running coreboot. According to a comment in https://review.coreboot.org/c/coreboot/+/62569 the code is even already upstream. Does someone know what's the state of Boot Guard on those devices?

Chromebooks never use BootGuard, so the firmware on those devices should be fully replaceable and they should support all the usual Chromebook developer features (e.g. https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/HEAD/docs/ccd.md).