Recent content on Arthur's blog
An introduction to my IBM/Lenovo ThinkPad addiction Over 10 years ago I got my first ThinkPad x60. I got interested in free software by reading the about GNU page in the GNU Emacs editor. Free software back then and certainly now is quite usable, typically without much closed-source software. One area where free software is lacking is firmware and this led me to want to try libreboot on that…
The two things I flagged at the end of the last post – real-time SPI command logging and a time-of-check-time-of-use primitive – are both landed on NORbert now. This post walks through how they work, shows the log wire format, and gives a reproducible TOCTOU demo against an FT4222H driving flashprog. What it looks like spi-flash-tool monitor decodes the bus in real time: TXN# COMMAND ADDRESS INFO…
Found a weird bug in NORbert last week. Quad I/O reads (0xEB, the 1-4-4 mode) driven by an FT4222 would silently return 0xFF at specific SPI clock frequencies. 1-1-1, 1-1-2, 1-2-2 and 1-1-4 all worked fine. 10, 15 and 20 MHz failed; 12 and 30 MHz worked. Same data, same emulator, only the SPI clock changed. Peak 'this is supposed to be the fun hobby project' energy. The symptom Flashprog verify…
I have an AI assistant running on my server via OpenClaw . It lives in Telegram, can run commands, read files, and talk to my Emacs. The point isn't having Emacs on the server — it's having an agent that can interact with my org-mode life from a chat window. This is how that works and what you can do with it. The skill OpenClaw has a skill system — reusable modules that teach the agent how to do…
So NORbert has an FT245 transport now. It also does dual and quad I/O SPI reads, and the chip identity is runtime configurable. Here's what happened since the last post. FT245 via FT2232H The UART path works but at 2 Mbaud it tops out around 200 KB/s. Loading a 32MB image into SDRAM takes minutes which is annoying when you're developing. We added an alternative transport using the FT2232H in async…
NORbert is an open source alternative to the Dediprog EM100Pro . If you do firmware development you probably know the EM100: you plug it in where a SPI NOR flash chip sits, load a firmware image over USB and it pretends to be a real flash chip to the SoC. It's great but it costs around $500 which is a lot if you just want to hack on open source firmware. The FPGA with SDRAM board attached to an…
After the serprog adventures with Embassy on microcontrollers, it was time to tackle the host side of firmware tooling. Two tools that come up constantly in firmware development are flashprog for reading and writing SPI flash chips, and the Dediprog EM100Pro tool for controlling the EM100 SPI flash emulator. Both are C tools that have been around for a while. We ported both to Rust: rflasher and…
I've been using hugo-theme-terminal for my blog and really liked its clean, terminal-inspired aesthetic. But as someone who spends most of their day in Emacs, I wanted something that felt more like home. So I vibe coded an Emacs-style theme with Claude. The entire thing - HTML templates, CSS, JavaScript interactions - was built through conversation with AI. Features Dired-style article list with…
TRAMP is one of Emacs' killer features. The ability to transparently edit files on remote machines, run shells, and use version control as if everything were local is remarkable. The implementation is impressively portable - it works over SSH, sudo, docker, and countless other methods by cleverly parsing shell command output. I've been experimenting with an alternative approach that trades some of…
Living inside Emacs is a dream - email, git, project management, writing, coding all in one environment. But every so often, something forces you back to a web browser. Uploading receipts to my accountant through ClearFacts was one of those moments. Every month, receipts and invoices accumulate that need to reach my accountant. ClearFacts provides an API for this, but the journey from…
This explains how to properly configure LSP Rust features in Emacs and introduces an interactive tool for managing them. Glossary rust-analyzer : The LSP server for Rust that provides IDE-like features in editors. Cargo features : Conditional compilation flags in Rust projects defined in Cargo.toml. LSP : Language Server Protocol, providing language intelligence to editors. .dir-locals.el : Emacs…
In software engineering the part I like the least is the actual typing of coding. LLMs provide a nice solution to this problem. With very precise prompting and the right documentation, code, text, … in the context the code output is very close to how I would write it. My preferred tool until now was aider . It works great, but the development pace seems to have slowed sadly. One of the latest…
So here is where it all started. I'm working on a Rust project that makes heavy use of conditional compilation through cargo features. The codebase has chunks of code that are only compiled when certain features are enabled, like this: #[cfg(feature = 'generate_templates' )] mod cert ; #[cfg(feature = 'generate_templates' )] mod code_gen ; #[cfg(feature = 'generate_templates' )] mod csr ;…
Serprog Serprog is a serial flasher protocol that allows a userspace program like flashprog to communicate over a serial connection like RS232, USB endpount or a TCP stream to a microcontroller which talks to flash chip to read, write or erase it. Serprog works for all kinds of different flash chips but in this article we'll focus on SPI NOR since those are ubiquitous nowadays. Picoprog at OSFC:…
If you've ever developed embedded firmware, you know the pain: cryptic flashing tools, primitive debugging methods, and a workflow that feels decades behind modern software development. You write code, compile it, flash it to hardware through a complex toolchain, and then… hope it works. When it doesn't, you're stuck with blinking LEDs and printf debugging over UART. probe-rs fundamentally changes…
Introduction to panics in rust Undefined behavior (UB) is one of the most dangerous issues in systems programming, leading to crashes, security vulnerabilities, and unpredictable results. Rust prevents UB by panicking - forcefully stopping the program - when potentially unsafe operations are detected. Panics are Rust's way of handling unrecoverable errors. Unlike Result which handles expected…
As software developers, we spend our days creating objects, defining relationships, and modeling reality in code. But have you ever stopped to think about the philosophical implications of what we're doing? Enter ontology – a branch of philosophy that deals with the nature of being, existence, and reality. Understanding Ontology In philosophy, ontology asks fundamental questions like 'What…
I recently switched from Sway to Hyprland. The primary reason for this change was my interest in content creation. Hyprland can record single windows, whereas Sway can only record the entire screen or part of it. So far, the transition has been smooth until I encountered the following issue after waking it from suspend with the lid closed. My Use Case I have a laptop that is mostly connected to a…
This post will review 2 llm options in emacs how I set them up. Ellama Your browser does not support the video tag. From ellama Ellama is a tool for interacting with large language models from Emacs. It allows you to ask questions and receive responses from the LLMs. Ellama can perform various tasks such as translation, code review, summarization, enhancing grammar/spelling or wording and more…
Aider + Claude Sonnet 3.5 This morning, I needed a timer to spend only 10 minutes reading a book. I searched for CLI tools but couldn't find anything immediately that suited my needs due to laziness. So, I decided to write one myself with the help of AI. Using Aider coupled with Claude Sonnet 3.5, I was able to get something working on the first try. Afterward, I added a few features:
This whitepaper makes the case that UEFI firmware and more specifically EDK2 based solutions, be it open or the more ubiquitous closed ones, hurt business by driving up cost and delaying time to market, while at the same time are the root cause of more and more security problems. This whitepaper will contrast this UEFI status quo with other existing solutions like LinuxBoot in combination with…
Hi I'm Arthur. I do a lot of firmware hacking both professionally and in my spare time. My interests are very wide. Here is a non exclusive list: embedded software electronics physics chemistry pharmacology philosophy religion psychology biology fitness bright and colorful decoration using LEDs and lasers car and motorcycle mechanics science fiction & fantasy
github.com/ArthurHeymans
Rust in coreboot? Rust is a programming language with emphasis on performance, type safety and concurrency. It enforces memory safety at compile time. Unlike the C standard which is a 700+ page document, with a LOT of documented undefined behavior, rust has no undefined behavior unless the unsafe keyword is used. Zero cost abstractions make rust binaries very efficient in both size and execution,…
This blog enty first appeared on the 9esec blog . A new toy to play with OpenBMC I wanted to play around with OpenBMC on a physical board and this article led me to the ASRock E3C246D4I . It's a not overly expensive Intel Coffee Lake board featuring an Aspeed AST2500 BMC. So the first thing I did was to compile OpenBMC. My computer was in for a quite a chore there. It needed to download 11G of…
This blog enty first appeared on the 9esec blog . FSP-T in open source projects X86 CPUs boot up in a very bare state. They execute the first instruction at the top of memory mapped flash in 16 bit real mode. DRAM is not avaible (AMD Zen CPUs are the exception) and the CPU typically has no memory addressable SRAM, a feature which is common on ARM SOCs. This makes running C code quite hard because…
This blog enty first appeared on the 9esec blog . I started working for 9elements in October 2020 and my first assignment was to get Intel CBnT working on the OCP Deltalake using coreboot firmware. Intel Converged Bootguard and TXT is a hardware assisted method to set up a root of trust. In this blog post I will discuss some of the changes needed in coreboot to get this working. Setting CBnT up…
Coreboot is migrating platforms from a romcc bootblock to C_ENVIRONMENT_BOOTBLOCK in which Cache-as-Ram is set up in the bootblock. When migrating Braswell, chromebooks featuring this SOC did not boot anymore while other boards did. Google uses a different FSP binary than the one present in the Intel Github FSP repository. Previously the romcc bootblock set up caching of the ROM, located…
This explains a bit of history on CAR in coreboot and how it works. Glossary CPU cache : CPU cache is a piece of fast memory used by the CPU to cache access to things accessed in the CPU's linear memory space. This includes for DRAM, PCI BARs, the boot flash. Cache-as-RAM/CAR : Using not memory mapped CPU cache as execution environment. XIP : Execute in place on a memory mapped (read only) medium.…
Written in Go, Hugo is an open source static site generator available under the Apache Licence 2.0. Hugo supports TOML, YAML and JSON data file types, Markdown and HTML content files and uses shortcodes to add rich content. Other notable features are taxonomies, multilingual mode, image processing, custom output formats, HTML/CSS/JS minification and support for Sass SCSS workflows. Hugo makes use…
What is so special about the x60 when running vendor bios? Vendor BIOS write protects its bootblock, which means the lowest 64K of the flash can’t be modified This is a problem since the first code that runs on the CPU comes from there and if we ever want to run coreboot the cpu must start with coreboot code. This write protection is set in the PBR (protect bios range) registers on the…
So here is where it all started. I have this apple branded atheros AR5BXB92, with an ar9280 chipset, which is supported by the ath9k Linux drivers. This chipset is supposed to support both 5GHz and 2.4GHz frequencies, but using the wavemon tool 5GHz SSID never show up even when I'm next to a device that emits one. iw list shows the following: Band 2: Capabilities: 0x11ce HT20/HT40 SM Power Save…
This post will explain a bit how the Intel 4 series DDR3 raminit came to be and will introduce a new board that can make use of this code, namely the Intel DG41WV. DDR3 raminit In the past I have worked quite on a bit on the coreboot code that support the Intel 4 series desktop chipset (those chipsets go by the name of G41, G43, G45, Q43, Q45, P41, P43, P45, B43 with each having a somewhat…