So some innocent post on the coreboot mailing list managed to make some waves.

The problem Intel tries to solve…

Intel Boot Guard is the latest effort in a long series by Intel and others to allow computers to provide some reliable information about the state a computer is in. They’re working on it since at least 2003, with projects and trade groups named Palladium, TCPA, and now TCG, and some of them faced scrutiny in the past already because the freedom of computing was deemed under attack (realistic fears, but with some unnecessary hyperbole).

…

I’m resumed working out the behaviour of the Dediprog EM100Pro, an SPI flash emulator. It comes with a Windows driver and application to control it, and I worked on an Open Source tool for Linux in the past.

Now I’m back at it and working on the more advanced features the tool supports: It’s able to log traffic on the SPI bus and to provide a simple bidirectional serial channel (they call it “HyperTerminal”), and it would be nice to have that work on Linux, too.

…

⚠️ updated version available

As mentioned before I’m the admin of coreboot’s code review system which uses the fine Gerrit tool.

One recurring issue is that its user registration is automatic, so when you login with some OpenID provider (like Yahoo, Google, or your own) that you haven’t used before, you get a new account, with no self-service option to fix that.

There’s a complex SQL routine out there that allows for mass merges, but it’s written for Postgres while we use the built-in H2 database (coreboot is really a tiny project in comparison to what’s out there, and so H2 is good enough for us).

…

Viele deutsche Universitäten arbeiten gemeinsam im Rahmen des deutschen Forschungsnetzes an ihrer Infrastruktur. Eine dieser Infrastrukturen heißt eduroam. Es handelt sich um eine Möglichkeit, sich in fremden Uninetzen - zum Beispiel dem WLAN - mit seinen Zugangsdaten der Heimatuni sicher anzumelden.

Leider gibt es einige Details in der Konfiguration, die mich eine halbe Stunde Bastelei gekostet haben. Daher hier eine Zusammenstellung, wie man sich als Student der FernUniversität Hagen in fremden eduroam-Netzen anmeldet. Vermutlich gelten dieselben Daten auch im Hagener WLAN.

…

With the GnuTLS bugfixes recently, I faced the issue to restart services that depended on it: After updating the library, daemons still run the old version until restarted.

I think I’ve seen this automated in some distribution, but it’s nice to know where those tools fetch their data.

I also didn’t want to restart them all automatically, so keep track of what’s going on.

A bit of searching quickly provided the following solution:

…

I built an efficient algorithm for decimal addition in GNU make last year. While I won’t vouch for its production quality (on the other hand: why not?), it’s too cute a hack to hide from the world.

Unlike other implementations, this isn’t using unary encoding, and as such doesn’t suffer from their limitations. While unary encoding can be implemented quickly (addition is simple concatenation, conversion to integer is $(words)), maximum string length (and RAM use) preclude certain use cases.

…

After spending a couple of weeks of implementing VT-d support in the Muen Kernel, it finally worked today: A device was passed through to a Linux guest while undesired accesses (initiated by the UEFI firmware’s USB driver during hand-over) were blocked and reported.

The last issue, which took a week to debug, was that the IOMMU has a particular idea about how page tables must be laid out.

IOMMUs provide memory management for memory accesses coming from peripheral devices, like USB or ethernet controllers. Without them, these devices are capable of accessing all parts of memory, and even write everywhere. Obviously that’s a bad thing if you’re aiming for security.

…

Das deutsche Wahlrecht hat so seine Besonderheiten, zum Beispiel die 5%-Hürde.

Diese “gute” Tradition wurde auch bei der Europawahl in Deutschland eingeführt, vom Bundesverfassungsgericht für diese Wahl für ungültig erklärt, um mit einer 3%-Hürde ersetzt zu werden, die dem Bundesverfassungsgericht wieder nicht gefallen hat.

Das Urteil ist leider noch nicht online verfügbar, so dass ich mich erst einmal an der Berichterstattung und der Pressemitteilung entlang hangeln muss.

Laut Tagesschau argumentiert das BVerfG, dass das Europaparlament nicht so handlungsfähig sein muss, wie beispielsweise der Bundestag, da die EU Kommission nicht so sehr auf das europäische Parlament angewiesen sind, wie die Bundesregierung auf den Bundestag. (kurz: Das europäische Parlament ist eigentlich unwichtig - tolles Statement)

…

I’m maintaining the gerrit instance on coreboot.org, and we encounter weird issues every now and then.

Many of them are related to its OpenID implementation. We use OpenID to avoid having to maintain another database full of login credentials, and shifting the nastier parts of account management (like storing passwords) elsewhere is a good thing for a server operation like ours without full-time staff maintaining it 24/7.

Today’s issue was with a user whose OpenID provider shut down. One member of our community provides OpenID accounts for users that can’t run a provider themselves (and aren’t on Google, Yahoo! and the like), but it requires them hosting a web page somewhere which becomes their OpenID identifier.

…

Let’s see if I can keep up with this monthly report of what happened in the project.

Changes in the repository

New boards

Gigabyte MA785GM-US2H was already committed, but not hooked up properly.

“blobs” repository

We provide a new repository for binary components and hooked it up in the build. So far it provides binaries for the Intel Sandybridge and Ivybridge platform, as well as the AMD Geode VSA binary that used to be distributed by Marc Jones.

…