38 ms·
“Last Mile” Barriers to Removing Legacy BIOS [pdf]
- hd4 9y agoSorry to go straight off-topic but if anyone from AMD is reading, please remove PSP from future and/or give us the ability to remove it from existing machines, this is a golden opportunity (with the Intel ME having been shown to be broken recently https://news.ycombinator.com/item?id=15656931 https://news.ycombinator.com/item?id=15656931 ) you really shouldn't pass up.
- dvddgld 9y agoI assume that if this was on the cards at all they would've done it earlier. Let's keep our fingers crossed though, it could make a big difference in the direction of technology (and thus the world) from here on out.
- roblabla 9y agoThey already said they wouldn't open source it (after suggesting they might). I doubt they'll ever think about removing it. [0]: https://news.ycombinator.com/item?id=14803373 https://news.ycombinator.com/item?id=14803373
- hd4 9y agoCompanies have been known to be astute and flexible when it comes to spotting opportunities especially when their competitors are making very publicized mistakes. It remains to be seen whether AMD is one of those.
- monocasa 9y agoBeing open source doesn't really matter; it's having access to the keys. And they're never going to give those up because it would break the chain of trust for their DRM.
- phkahler 9y agoI don't want their DRM or their DRMed content. I'll gladly buy a computer for my own uses that don't have those "features".
- craftyguy 9y agoWhy would they care? The folks asking for this are a tiny (tiny) minority of the market.
- snuxoll 9y agoIt's a huge potential win for cloud and government contracts. Amazon, Google, Microsoft and the US Government probably aren't too keen on having ring -3 code running in their datacenters waiting to be exploited somehow.
- microcolonel 9y ago> Microsoft and the US Government probably aren't too keen on having ring -3 code running in their datacenters waiting to be exploited somehow. Which is why they have a special configuration for that, sold to them by Intel.
- Mindless2112 9y agoSource? coreboot was initially developed at LANL, a US Government laboratory. It's worth considering why that might be.
- mschuster91 9y agoGP is referring to Intel's High Assurance Program (http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html) which offered the possibility to disable ME.
- jabl 9y agoSearch for Intel HAP (High Assurance Program). It's a magic killswitch that disables the ME, provided officially only to three-letter agencies and such, of course. As for coreboot, keep in mind that it was originally developed long before the ME was a thing. IIRC the original motivation was that BIOS sucks. Which it does, sure, but that's orthogonal to the ME.
- 9y ago
- monocasa 9y agoThey're not going to. The PSP has a hand in DRM (it runs 'trustlets' in a container), and DRM can only work through obscurity currently.
- kobeya 9y agoAnd DRM is necessary to AMD’s bottom line because...?
- jandrese 9y agoPeople won't buy AMD chips if they can't play Blu-rays or Netflix or use commercial software? It's not a thing today, but it's not hard seeing the world go that way in the future once the legacy BIOS uses are finally aged out.
- kobeya 9y agoBlu-rays and Netflix work just fine on my old laptop that doesn't support secure enclaves. The onus is on us to make sure that a future where we are locked out of the devices we own does not come to pass.
- wolfgke 9y ago> Blu-rays and Netflix work just fine on my old laptop that doesn't support secure enclaves. 4k Bluray requires Kaby Lake or newer (I don't know whether it works on Ryzen or not) and HDMI 2.0a with HDCP 2.2.
- Freak_NL 9y agoWe're not even getting anything over 720p on Linux. 1080p requires Internet Explorer, Edge, or Safari on Windows or MacOS¹. 4k in the webapp requires Edge in addition to the hardware requirements wolfgke lists. 1: https://help.netflix.com/en/node/23742 https://help.netflix.com/en/node/23742
- 9y ago
- ajross 9y agoNot that I disagree, but you realize that point about ME & PSP (which are separate controllers not part of the main boot CPU) isn't particularly relevant to the linked article, which is about removing the 16 bit BIOS boot path from future firmware? By the time you're running real mode IBM PC boot code, the ME & PSP have long since come alive and sorted things out for boot configuration.
- cjensen 9y agoThere sure was a lot of "people use legacy for specific reasons" in there, but they don't mention what those reasons might be -- except for Linux support. Kinda hard to fix the "last mile" when you don't know anything about the last mile.
- volume 9y ago"people use legacy for specific reasons" was for people like me. I have a note in our company wiki to disable UEFI because it broke our PXE deployments. Now from this PDF I am forced to harness the power of Google to understand why.
- volume 9y agoAh ha - I had been configuring syslinux to serve out pxelinux.0 only and not pxelinux.efi. Could they have just thrown that one liner in to one of the slides? http://www.syslinux.org/wiki/index.php?title=PXELINUX#UEFI http://www.syslinux.org/wiki/index.php?title=PXELINUX#UEFI edit: on 2nd thought I need to try this out to verify it end to end. Maybe there some other step. Or maybe this is yet another reason to embrace AWS. I get to declutter the UEFI/BIOS topic out of my mind.
- eikenberry 9y agoI haven't switched yet because I keep forgetting to create an ESP partition when I upgrade.
- josteink 9y ago> they don't mention what those reasons might be -- except for Linux support. I UEFI boot all my Linux systems. What FUD are you on about?
- thinkloop 9y agoPls HN, don't downvote straightforward questions
- deleted 9y ago
- Aardwolf 9y agoSo does uefi support multi boot or not?
- zootboy 9y agoYes, UEFI supports multiboot.
- tripletmass 9y agoMeh, unsigned! No good without UEFI mode 3+ (where 0 looks like a legacy BIOS, 3 is signed, 3+ is signed/enforcing) per OP-article. New Intel site (uefi.org still OK) uefidk.com/develop/development-kit/ is...down? [People not making a machine key, so they can get back to setup mode...no mention of signing:) https://communities.intel.com/thread/118403?wapkw=uefi+signing https://communities.intel.com/thread/118403?wapkw=uefi+signi... https://www-ssl.intel.com/content/www/us/en/security/practical-uefi-secure-boot-part-3-video.html https://www-ssl.intel.com/content/www/us/en/security/practic... --2013 video showing unleaded dual-boot Linux Foundation has wboot for signing, it mentions... UEFI (seemed to) promise to offer: suspend/hibernate in each OS, seamless secure power mode switching from each OS, multiple default displays and diagnostics...
- 0xcde4c3db 9y agoThe standard supports multiple bootloaders, but specific implementations may be locked down to a single one. Even on systems that support multiple bootloaders, it's pretty common to bypass the built-in menu in favor of a more configurable chainloader like GRUB or rEFInd.
- deleted 9y ago[deleted]
- snuxoll 9y agoI mean, basically every UEFI implementation I've worked with supports any number of boot entries - but I'm forced to hit a key during startup to even get to the menu to select one. All it would take is an option to present a selection menu every boot (unless the operating system has asked to boot a specific one during a reboot) and I would set my grub timeout to like 2 seconds with no menu by default.
- 0x0 9y agoDoes this mean they're also looking to rip out 16bit real mode support entirely from their x86/x86_64 CPUs?
- maxharris 9y agoI would happily pay more for a computer that lacks support for this mode.
- 0x0 9y agoWhy?
- raverbashing 9y agoBecause it's a piece of hw that's only used for 1s before your OS boots. Wonder why ARM consumes much less than x86? That's one (small) reason why.
- monocasa 9y agoI'd be surprised if 16bit support uses a noticeable amount of power in a running system.
- wolfgke 9y ago> I'd be surprised if 16bit support uses a noticeable amount of power in a running system. For 16 bit you have to strongly distinguish between 16 bit real mode (what DOS ran on by default), 16 bit protected mode (what Windows 3.x and partly Windows 95 ran on) and Virtual 8086 mode (which was for example used under Windows 95 to run DOS applications). Also I think SMM (System Management Mode) also runs 16 bit code. Next: In 32 bit mode, nearly every instruction can be prefixed by 0x67 (I am aware that some instructions use an 0x66 prefix instead - I just want to keep things simple here) that allows one to use 16 bit (protected mode) addressing to be used in 32 bit mode. Except for some very obscure applications that surely does not make sense, but shows how deeply ingrained 16 bit support is in the x86 instruction set. Also: If you prepend an 0x66 prefix to many classic x86 instructions in 32 bit mode, they will do what the instruction would do in 16 bit mode (except for using 32 bit adressing if suitable; but I just explained how this can be changed, too). This is exactly how instructions that use 16 bit registers are encoded. So 16 bit support is deeply ingrained into x86 and cannot be simply removed. And I would bet there exist customers who would be really enraged if Intel or AMD did just remove some of the 16 bit modes, because they have some exotic application that depends on them.
- maxharris 9y agoIt's about time this happened! I spent the last decade using computers free of that BIOS crud (various Macs and now a Surface Pro), and all I can say is, "good riddance!"
- Thriptic 9y agoSurface pro has a BIOS interface, it's just stupidly inaccessible. Their design also means that you can't easily install your own copy of windows and are instead stuck pulling down their stupid recovery images whenever you want to format. I'm very annoyed that they decided to go this direction personally.
- Spooky23 9y agoThey did that to protect the platform against stupid enterprises.
- Thriptic 9y agoWhat do you mean?
- Spooky23 9y agoOffice 365 taught them how much corporate testing and imaging hurt their products. In one case I’m familiar with, they were getting pummeled over poor O365 user experience in 2015 because the customer was refusing to upgrade past Office 2007. Everything they’ve done in the last 5 years is about pushing out software faster and making traditional enterprise IT too expensive.
- kev009 9y agoUEFI is a great example of second system syndrome. In the BIOS world, more featured boot loaders were chained in early (think pxelinux, grub, *BSD loaders etc) so even though it was primitive it wasn't the typical UX. UEFI is almost trollingly bad, the worst amalgamation of low level firmware, boot loader UX, and OS->firmware runtime services I've seen when contrasted to OpenFirmware, uBoot, petitboot. OpenFirmware was a much more elegant technology sitting around for the lifetime of modern x86 but intel had to be different. I like the direction IBM is going with OpenPOWER.. petitboot/kexec by default https://sthbrx.github.io/blog/2016/05/13/tell-me-about-petitboot/ https://sthbrx.github.io/blog/2016/05/13/tell-me-about-petit... although all the firmware sources are on github so you could do whatever the heck you want. It makes intel look positively oppressive.
- wolfgke 9y ago> OpenFirmware was a much more elegant technology sitting around for the lifetime of modern x86 but intel had to be different. Let's rather look at the reasing of the UEFI developers why they have a different opinion on Open Firmware (page 5 of http://www.uefi.org/sites/default/files/resources/A_Tale_of_Two_Standards_0.pdf http://www.uefi.org/sites/default/files/resources/A_Tale_of_...): "Another effort that is similar in its role to the PC/AT BIOS-based platform occurred with Open Firmware (OF) [4] and the Common Hardware Reference Platform (CHRP). CHRP was a set of common platform designs and hardware specifications meant to allow for interoperable designs among PowerPC (PowerPC) platform builders. Open Firmware, also known as IEEE-1275 [4], has issues in that it is an interpreted, stack-based byte-code. Very few programmers are facile in Forth programming, and it is renowned as being “write-once/understand-never”, and having poor performance, and non-standard tools. Also, Open Firmware has a device tree essentially duplicating ACPI static tables. As such, the lack of Forth programmers, prevalence of ACPI, and the fact that UEFI uses standard tools and works alongside ACPI — versus instead-of — helped spell Open Firmware’s lack of growth. In fact, it is used on SPARC and PowerPC, but it is unsuitable for high-volume machines and thus prevent it from making the leap from niche server & workstation markets."
- wmf 9y ago
- lousken 9y ago> Some users blame UEFI or Secure Boot whenever something doesn’t work and what else to blame?
- josteink 9y agoThe words of a true detective. Like there’s nothing else in the giant mess which is the x86 architecture which can’t break.
- hsivonen 9y agoLast I tried, more that 2 years ago, Ubuntu was able to install on LVM over LUKS over sofware RAID and boot from it in BIOS mode but the result in UEFI mode completed install but didn't boot. I wonder if that has been fixed.
- josteink 9y agoI’ve UEFI booted Ubuntu from a Linux soft raid without issues. Everything just worked. Don’t quote me on it, but I’m pretty sure that was Ubuntu 14.04.
- kobeya 9y agoUsually it’s because he installer mucks up the crypttab, or doesn’t install mdadm module, or something. And yes, installing with BIOS usually gets it right. But it can be made to work with UEFI.
- riveravaldez 9y agoStill waiting to hear about any real reason to go with UEFI instead of BIOS, beyond Restricted Boot and all that monopolistic, anti-FLOSS corporate crap...
- ChuckMcM 9y agoI find this the inevitable "next step" into more appliance mode that these machines are moving into. And like tranches of collateralized debt obligations, harder and harder to figure out exactly what your buying into when you decide to get one of these machines. On slow days I try to imagine what I would really "like" here. One of the things I would like would be a stance on surveillance that would protect me from commercial surveillance that I had not explicitly agreed to, and a way for individuals to take action against people who violated that stance.
- bobcallme 9y agoMy main concern with this is the fact that if Secure Boot is forced (UEFI Class 3/+) users might not be able to change or manage trusted keys. It is quite sad that every few years we have to yet again have this conversation or defend the right to freely install software on machines that we bought or own.
- colemickens 9y agoA concern that has been repeated for 5+ years at this point, and one that has proven to be almost completely unsubstantiated by any real world devices. Don't get me wrong, the day I can't install Linux on my laptops, I'll grab the pitchforks, but the claims that this is going to happen almost exclusively hinge on some boogeyman ideology related to Microsoft that is fully unconvincing to me. edit: Please, tell me a single consumer laptop that doesn't allow key enrollment or complete Secure Boot disablement, otherwise, please stop with the FUD.
- mtgx 9y agoWasn't the previous backlash what got Microsoft to allow Verisign and others to make Secure Boot keys, too? Wasn't it originally only Microsoft the one that could do that, and it's why everyone freaked out that they may act their usual monopolistic-self and deny Linux distros the keys?
- Nullabillity 9y agoLook at Microsoft's certification requirements for ARM devices. This will be a problem much sooner than you think...
- joe_the_user 9y agoI may not be especially competent but I had significant difficulty installing Linux the last time tried. Thankfully it was possible but there are now significant hurdles. That's problematic. Whether it gets worse is unknown but the situation now is bad if anyone wants Linux to be freely available.
- 9y ago
- agumonkey 9y agoMeaning I will migrate all my machines to coreboot.
- forapurpose 9y agoHelping to secure the boot process is valuable. My main concern about UEFI is end-user control, and one way UEFI reduces end-user control is through complexity. Think of what someone new to IT had to learn 20 years ago about bootup and compare it to now. UEFI is far more complex than BIOS; IIRC the spec is over 2,000 pages. I'm a professional and I've spent significant time looking into UEFI, and I don't feel that I really grok the whole subsystem. What is some kid going to do? And add to that all the other 'new' subsystems in the boot process, from TPM to ME to AMT to TXT ... someone would need to be a full-time 'boot specialist' to grasp it all, keep up with them, and understand how they interoperate.
- Gonzih 9y agoI run Linux in legacy mode on my 4 machines. UEFI for me was extra complexity without any gain. Sad to see that's uefi is gonna be only option in the future.
- BenjiWiebe 9y agoI've been booting with the kernel as an EFI stub, and I love it. I can copy a new compiled kernel to the right directory, and reboot into it. No grub involved. And to edit the boot menu, or just change what I'll boot into next, is the handy efibootmgr tool.
- TheDong 9y agoUnfortunately, that means you don't have an initrd so you can't do luks encryption of your root, support certain filesystems as root (like zfs, mdadm raid), or various other things. efistub kernels may work for some people, but they're not a generic solution.
- deleted 9y ago[deleted]
- userbinator 9y agoThis is sad. Very sad. It means "PCs" are only going to become more closed and proprietary than ever before, at an even faster rate. "Legacy" is a good thing. It means simple, stable interfaces that have been around for long enough to be mature, well-understood, and relied upon by everyone. Some examples: A PS/2 mouse or keyboard doesn't require a full USB stack in order to work, nor can it exploit the system by becoming a different USB device and sending malformed packets. RS232 is simple enough that it's the de-facto "standard input/output" on embedded platforms. LPT/IEEE1284 gives you 8 bits of GP(I)O with ultra-low latency (microseconds vs milliseconds for USB.) It's disgusting to see the "security" argument brought up again here, when it's all about corporate control over the users. To them, it's a "security risk" to not have secure boot. To the users, it's freedom. The "advantage" of "smaller code size" is complete FUD. I'm pretty sure the ROM images have gotten much bigger since UEFI became the norm, composed of bloated compiler output instead of the beautifully efficient handwritten Asm that BIOSes used to be written in. No DOS requirements for pre-OS validation/tools (try UEFI Shell or Python) DOS is simple, which is why it remains so common for BIOS flashing, testing, etc. Replacing that with the horrendous bloat of UEFI Shell or Python!?!? Yuck!! Linus Torvalds' famous rant is well worth reading: http://yarchive.net/comp/linux/efi.html http://yarchive.net/comp/linux/efi.html tl;dr: You can pry 7c00h and INT xx from my cold, dead hands.
- bearbearbear 9y agoThat's how they'll take away our last civil right. By protecting us from freedom. For our safety. They sure protected the hell out of Syria and Iraq.
- Rusky 9y agoSecure boot doesn't mean the user isn't allowed to replace the bootloader or kernel, and it is more secure. UEFI doesn't require USB or secure boot or a compiled language or Python or proprietary code. It would be nice to have something simpler than UEFI to replace the legacy PC boot process, but the point IMO is that we want to replace the legacy PC boot process. It's not as straightforward as "simple, stable interfaces that have been around for long enough to be mature, well-understood, and relied upon by everyone." It's a de-facto standard with a lot of room for things to go wrong, and they do.
- shmerl 9y agoWhy can't there be normal open source UEFI? No one seems to be pushing to get rid of all these blobs.
- jgowdy 9y agoEveryone is bitching about how UEFI makes them not the owner of their computer anymore, as if they’re using an open source BIOS and ever had any firmware layer control over their PC. The fact that you can argue that with BIOS you have control means you don’t really understand Intel ME and the other firmware components that actually run your PC. If you want an open platform, Intel and AMD aren’t it. If you want a modern functional platform, Intel and AMD are it. This is why I have such high hopes for RISC-V.
- sigjuice 9y agoI don't understand how RISC-V will lead to open platforms. Vendors of RISC-V SoC's will most likely include their own Intel ME type bullshit.
- keiyakins 9y agoHow about 'there's no good replacement yet'? All that the firmware should be doing is making sure the hardware is intact enough to load the next stage, then finding, loading, verifying (a the very least, checking signatures for accidental modification, and ideally checking the keys against ones that require physically moving a jumper or dip switch to change), and executing the first on-disk stage. MAYBE initializing a very basic text mode so it can show errors, MAYBE a halfassed keyboard handler to let you help it out if it gets confused. Granted, this does mean it has to have some sort of bus it can use to talk to various storage devices, but even this should be as simple as possible - you can switch to a more complex but faster one later, you just need to be able to load a couple kilobytes.
- dingo_bat 9y agoCan anybody point me to a list of problems with "legacy" BIOS that UEFI fixes? My PCs have had no problem booting in the decade I've been using them. They boot windows, ubuntu, arch, basically whatever I want them to boot. What's the big problem?
- betterunix2 9y agoWell, consider the situation Blizzard is in with WoW: people who want to cheat have resorted to writing rootkits to defeat the DRM system. Locking down the bootloader will help prevent users like yourself from defeating DRM, this making the platform more secure for entertainment companies. Sorry, did you think the improvements was for users?
- dingo_bat 9y ago> Sorry, did you think the improvements was for users? Well, funny but sad.
- jokoon 9y agoI recently disabled secure boot so I could install linux... I was quite amazed I had to do that to be able to install a system I wanted...
- upofadown 9y agoWhat currently deployed attacks does secure boot prevent? We hear a lot about secure boot is going to improve security but not a lot about exactly how it is going to do that. If some sort of malware has the ability to rewrite the relatively tiny boot stuff it also has the ability to write anywhere in the operating system.
- sanbor 9y agoFloppy disks used to have a tab to lock them (write only mode). The whole secure boot thing could be solved by having a switch/tab that you would have to use when you want to make changes to your bootloader. This would fix the secure boot issue and let us use our beloved BIOS. In different jobs I have hear coworkers spending several hours dealing with UEFI in order to be able to install linux or enable multiboot. As a final user I don't see any added value except for the secure boot. As others has pointed out here if a malware has enough access to rewrite your boot probably they could do a lot worse stuff like installing a keylogger, a fake browser, encrypt/steal your data, etc. UEFI looks to me like Inte ME. A tech that it might make sense for enterprise, servers, etc. but not to the final user. Looking forward to let Intel alone and use more open alternatives but I know that it is very hard to get the same computing power/features in other platforms.