12 ms·
Replacing x86 firmware with Linux and Go
- snvzz 9y agoLinux has MILLIONS of lines of code. Please don't. EFI is already bloated as it is. Support efforts like coreboot instead. And FFS, firmware should not persist once the operating system boots. Persistent firmware is cancer.
- pgeorgi 9y agoA board specific Linux build is smaller than a board specific EFI build. Yes, it's that bad. Also, Linux in firmware is either the final OS, or - more likely - a kexec step into the actual OS. In the latter case, there's no persistent firmware since the old Linux is gone.
- stmw 9y agoThat's a good point, actually, it'd be nicer to keep things separate and alive for only as long as needed.
- Jonnax 9y ago"He was also asked about the relationship of this work to coreboot. Minnich said that coreboot should always be preferred, but it has not been available for server platforms for 12 years. So he would suggest that developers "always use coreboot if you can", but if not, look at NERF."" I know some people like being retro with old ThinkPads but 12 year old servers are a bit much.
- cyphar 9y agoUEFI is larger than the Linux kernel (if you don't include drivers, because UEFI doesn't have drivers). And it has orders of magnitude more syscalls. So Linux is actually better than UEFI from a bloat standpoint.
- mschuster91 9y ago> And FFS, firmware should not persist once the operating system boots. Generally I agree with you, however there is one thing that cannot be done without a RAM-persisted firmware: any kind of power management. It's highly dependant on the specific chips (sometimes, chip revisions) on the motherboard, and while integrating even ultra low level stuff into the Linux kernel might help there, we see the consequences of doing so in the Android world: manufacturers do not have the time/money to get their code in a shape that's going to be accepted by the kernel community, so they fork it and the users are screwed.
- AstralStorm 9y agoRAM persisted what? Table of hardware pstates and cstates per device? A flag to reinitialize busses and hardware, skip memory clear? Handling PCI and CPU reinit should be easy. It is not because manufacturers are keeping critical parts under NDA or completely secret.
- mschuster91 9y ago> A flag to reinitialize busses and hardware, skip memory clear It's not just a simple flag - it's basic stuff like for example which clock pin is mapped to which clock consumer(s), which GPIOs on which pins are mapped to stuff like LEDs, the power/reset switch, which hardware interrupt line is mapped to which GPIO... all stuff that's best kept inside the BIOS where the manufacturer can easily patch it if needed in contrast to the Linux kernel with its notorious difficulty to get stuff accepted into mainline, much less into a kernel that actually runs on users' computers - think LTS users, for example. I can take a 2010 kernel and it will likely run fine on a recent x86 machine, but if I needed to wait for motherboard support to ship in kernel, that would be not very cool. Yes, something like FDT would be nice but even on the relatively small ARM space it has its fair share of issues - I don't even want to think about having FDT in mainstream x86.
- snvzz 9y ago>there is one thing that cannot be done without a RAM-persisted firmware: any kind of power management. Either do it in the OS, or do it in a separate CPU, such as a microcontroller.
- PatchMonkey 9y agoUhm... coreboot is the linux kernel, just like this project, running that plaform control module that normally runs via Intel ME. The big difference is Go on one side, and a small selection of config files to support a small/growing collection of hardware on the other. Is this guy looking to use the existing kernel code, as coreboot does? Or is he going to add to it, to make the One Kernel to Rule Them Allz? Because Im hearing the former, not the latter. I could be wrong.
- Sir_Cmpwn 9y agocoreboot is not the Linux kernel.
- jabl 9y ago> Linux has MILLIONS of lines of code. Please don't. EFI is already bloated as it is. Well, if you're going to run Linux anyway, running Linux as your firmware + bootloader doesn't increase your attack surface. And, it can be argued that e.g. the Linux networking stack is more battle tested than the UEFI one. > Support efforts like coreboot instead. Ron Minnich is the father of coreboot. If it were possible to run coreboot on modern Intel server platforms, I'm certain that's what he would propose. As a sibling commenter mentioned, he views NERF as a backup solution if using coreboot isn't possible. > And FFS, firmware should not persist once the operating system boots. Persistent firmware is cancer. In NERF, the Linux kernel burned on the flash rom kexec()'s the final distro kernel. IOW, it replaces itself by the new kernel, it doesn't linger around in the background.
- floren 9y agoRon's been beating on this drum for years, and I'm glad that the wider world finally seems to be catching on.
- luckydude 9y agoDoesn't the ME firmware to power saving, suspend, restore, etc?
- AstralStorm 9y ago1) Not at all. Tables are in UEFI. Control is in kernel space. It can remotely issue a boot or shutdown command among others. Probably hard shutdown too considering the watchdog. 2) Only in so far as it goes into power saving mode itself. (Which is kind of fake, does not disable magic networking junk.) 3) Like in any other boot if unhibernating. Does not touch suspend which is handled in UEFI.
- chroem- 9y agoAnd to think that posting about Intel ME on HN only a couple years ago would have commenters swarm you with accusations of being a deluded conspiracy theorist. Neat. It's good that people are finally becoming aware of the problems that it poses.
- mastax 9y agoReally? Every thread on HN I've seen about ME has been hordes of people lamenting the fact that you can't buy a processor without it.
- madez 9y agoI share GP's opinion. Snowden changed a lot. The internet really has a global passive attacker that can control US-based companies like puppets, and is doing so. William Binney said the companies are paid money for providing data and access. How is that not subsidizing that industry? Financial helps are a first-class reason for other governments to impose duties, restrict international trade and subsidize local competitors. Yet, there is no reaction in Europe. Microsoft can freely sell their OS and Intel is free to have their monopoly, and uses that to backdoor everybody. It is creepy that european countries don't take action. LiMux was a good example of moving in the right direction. Recently it was abandoned. I didn't see big unseen powers at play there, just the harsh reality that most people don't understand computers and don't care.
- ajross 9y ago> global passive attacker that can control US-based companies like puppets, and is doing so. And... this is where the deluded conspiracy theorist accusations the upthread poster was complaining about come from. There's no evidence for any of that[1]. The ME's capabilities (low level system controller with access to all memory and hardware, with special access to network hardware that can operate cleanly along with a running OS) have been known and even advertised by Intel for years. The news of the moment is that it's subject to a few rather embarrassing exploits. But that's rather better explained by incompetance instead of evil. Yet everyone jumps to "back door" because that sounds more fun I guess. (In fact, to the extent there is evidence of government involvement here, it's in the opposite direction: the NSA appears to have demanded an "off switch" for the ME). [1] Edit to clarify: I'm talking about the ME folks. Yes, the government does bad things. The EC flaws under discussion in this subthread are not among them, so citing them as evidence paints you as a conspiracy nut and not someone serious about security.
- pwdisswordfish2 9y agoWhy do users need at least two copies of various drivers, i.e. an "Intel" copy in EFI and a "user" copy in the user-loaded kernel? I still cannot understand how "EFI" is not a second "kernel" that is off-limits to users. The BIOS was limited in ways that EFI is not. Hence booting from BIOS to a kernel with access to more memory made sense. But when the "BIOS" becomes "EFI" then what is the point of the second kernel? Before you answer, think about all the uses of a computer that only need a command line, not a GUI. Needless to say, there are many, including serving web pages, retrieving web pages, remote configuration, etc. What is the point of using a "second kernel" for those uses? We know the limitations of the BIOS. What are the limitations of EFI? How flexible is it? How much can someone, e.g. Intel, stuff into EFI? It seems capable of doing quite a lot of important things. I naively see pre-installed EFI implementations as an "OS-grab" by Intel and their vendors. They get their own "kernel" on every computer in the form of EFI. Users are free to boot into their own kernels but they have to boot the "Intel kernel" first. Nothing wrong with having a new standard for something better than BIOS. But there is something very wrong about computers being sold with pre-installed kernels that are not controlled by users.
- mikeokner 9y agoYou'd think if the ME truly wasn't nefarious that Intel would offer chips without it and capitalize on the extra features in the enterprise market. I've yet to encounter anyone who actually wants it.
- monocasa 9y agoIt's in part used for DRM. You've probably used it if you've watched BluRays or Netflix over 720p.
- 0xFFC 9y agoI am genuinely asking, how intel ME is related to watching movies in Netflix? Would you mind to elaborate a little bit?
- monocasa 9y agoAFAIU, it's used in the HDCP encryption negotiation.
- sofaofthedamned 9y agoYup. There's also rumours it holds the secure enclave equivalent, so getting root into this means you're double fucked: https://twitter.com/mjg59/status/932730696614813696 https://twitter.com/mjg59/status/932730696614813696
- Groxx 9y agoGiven Intel's announcement: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086 https://security-center.intel.com/advisory.aspx?intelid=INTE... >Based on the items identified through the comprehensive security review, an attacker could gain unauthorized access to platform, Intel® ME feature, and 3rd party secrets protected by the Intel® Management Engine (ME), Intel® Server Platform Service (SPS), or Intel® Trusted Execution Engine (TXE). It seems like there's a reasonable chance of that being the case.
- PopsiclePete 9y agoI would gladly trade in raw 30% performance from my Intel chip for some other platform that did not have American corporate/Deep State/NSA interests behind it. I just want a minimum bootloader (open source) that boots into Linux - that's it. No "Enteprise management" crap, no NSA crap. I don't think I have any options. I certainly wouldn't buy Chinese or Russian, and I'm not aware of any EU member state having anything in the works either - but I think it's time we started seriously considering this. Google/Amazon/Microsoft have the muscle to actually do something about this, but no motivation. I'm surprised that they even trust Intel - it would take one high-profile security breach to turn their respective Cloud Computing businesses upside down - people are already jittery. I don't know if IBM Power is the solution, or ARM, but it's become abundantly clear that you can't trust Intel or AMD, or the x86 platform, anymore.
- hugelgupf 9y agoI would challenge the "no motivation" part given that the speaker that gave this talk works at Google.
- eeZah7Ux 9y agoBoth Facebook and Google are working at disabling ME. They make no secret that they not trust it. NSA & other US orgs receive hardware without ME already. Surveillance is for the rest of us.
- ksk 9y ago>Surveillance is for the rest of us. Who has been spied on using Intel ME?
- AstralStorm 9y agoIt requires some serious web traffic analysis and honeypot to detect the attempt. That is assuming they would use remote access and not use ME locally. That would be even harder to prove once the malware uninstall itself.
- iainmerrick 9y agoThe Go portion of this -- a Go-based Linux userspace -- sounds very interesting, but not directly related to all the firmware stuff, unless I misunderstand. Anybody got some good links about the Go userspace?
- jabl 9y agohttp://u-root.tk/ http://u-root.tk/
- hugelgupf 9y agohttps://github.com/u-root/u-root https://github.com/u-root/u-root Let us know if you have any questions. There's a slack channel (see contributing.md) where Ron and I are pretty active.
- oelmekki 9y agoHi, I have kind of a "FOSS diplomacy" question: is the kernel core team involved in this effort, or is it something totally third party to them? (the purpose of this question being to know if linux core team gets involved in go programming)
- deleted 9y ago[deleted]
- Insanity 9y agoAm I correct in believing the AMD variant of this is 'Trustzone'[0]? If not, does AMD have something similar? [0]: https://www.arm.com/products/security-on-arm/trustzone https://www.arm.com/products/security-on-arm/trustzone
- thg 9y agoAMD PSP (Platform Security Processor) is what you're looking for. Essentially the same thing as the ME, just for AMD processors.
- AstralStorm 9y agoIt is now called AMD Secure Processor.
- Insanity 9y agoThanks!
- rileyphone 9y agoARM != AMD
- Insanity 9y agoWoops yeah, I realise that. I just saw a reference somewhere from AMD + Trustzone and clicked on the first link I found :D Sorry
- shmerl 9y ago> Some people say to switch to AMD processors, but that is not really a solution now. Ryzen is touted to be open, but that is not truly the case, there are still closed parts. Can anyone elaborate please. How does AMD compare to Intel's problems with ME?
- lawl 9y agoThey call it Platform Security Processor and not Management Engine.
- bradfa 9y agoPrior to Zen based processors there are a decent number of offerings under the Opteron and AMD's embedded SoC families (possibly others, but these are the ones I'm familiar with) which did not contain ME-like capabilities. Projects like Coreboot generally have pretty good support for these AMD parts. For an embedded example, see the PCEngines APU2 boards: http://pcengines.ch/apu2.htm http://pcengines.ch/apu2.htm Zen based parts from AMD have their PSP (platform security processor), which I believe is generally a dedicated Cortex-A series CPU within the silicon to do many security related things. Its functionality is similar to some of what the ME provides on Intel parts.
- ranma42 9y agoActually AFAIK the APU2 SoC includes a PSP already, the APU1 is still free of that. But even the APU1 SoC has a small LM32 core that you have no source for, see Rudolf Marek's CCC talk "AMD x86 SMU firmware analysis".
- drewbug 9y agohttps://libreboot.org/faq.html#amd https://libreboot.org/faq.html#amd
- shmerl 9y agoThanks!
- throwaway613834 9y agoI understand the urge to remove networking capabilities, but why do privacy folks freak out about the entireties of UEFI/ME/SMM? It's a fact that the hardware is the one with control of the system at boot, and you're always at the mercy of the vendors in terms of bad code (whether intentional or otherwise). You can't get rid of hardware-specific code, and you also don't have any control over the designs of the chips. Both of those are places where it will always be possible to do something nefarious if the vendor feels like it. Unless you feel like fabricating your own chips from scratch, at some point you have to trust all these layers. Why suddenly freak out when it comes to new layers?
- AstralStorm 9y agoBecause SMM can be disabled. UEFI potentially replaced and should renounce direct hardware access after initialization and driver disable. ME cannot be disabled and has both networking and direct memory access bypassing even IOMMU. Running in background.
- throwaway613834 9y ago> UEFI should renounce direct hardware access after initialization and driver disable I don't follow. If it's nefarious then doesn't having control in the beginning already screw you? And if not, but if it gets compromised, then can't it be programmed not to do that?
- cjbprime 9y agoDid you follow yesterday's news? The ME is remotely vulnerable, has full control over the machine, and it's not even clear that it can be upgraded in a secure way. Why wouldn't you be interested in turning it off? And why would you classify people who'd rather not be running remotely vulnerable code they can't control as "privacy folks"?
- throwaway613834 9y agoI did follow the news about being remotely vulnerable. That's why I said I'd understand the urge to remove the networking stacks. Other vulnerabilities would require local access. > Why wouldn't you be interested in turning it off? I'm not asking why you'd be interested in it, I'm asking why you'd freak out so much about it given X/Y/Z are already true and you can't do anything about them. There's a bit more nuance in my argument than you're giving me credit for here. > And why would you classify people who'd rather not be running remotely vulnerable code they can't control as "privacy folks"? I already excluded the part about remote vulnerability. See first point above.
- mhd 9y ago> The user-space piece is all written in Go, which is generally more trusted than C within Google Someone should read "On Trusting Trust" and note its author…
- IshKebab 9y agoYou can get around that by cross-compiling. I think in this day pulling something like that off on a compiler as popular as Go would get noticed. Anyway that issue is orthogonal to the language choice.
- dajt 9y agoCan anyone ELI5 how two additional OSs can run network stacks without interfering with each other and the user OS networking? I assume ME and UEFI use DHCP to get their addresses yet my modem/router only shows the one from my user OS. Where do they get the drivers for whatever NIC happens to be installed? Do the motherboard vendors have to put blobs in place during manufacturing?
- coldacid 9y agoI'd like to know about this, too.
- nine_k 9y agoTo get the network capabilities of the ME, the machine has to have a compatible NIC, AFAIK.
- emmelaich 9y agoThis is a good reason to buy a machine that is not all Intel (or all anything else)
- naner 9y agoThe fact that ME and UEFI have network stacks doesn't mean that they are always active. And yes there is nic support embedded in the firmware. This is how you're able to pxe boot or bring up the nic after booting EFI shell for example.
- boomlinde 9y agoIf the stacks each get transport layer copies of what's incoming and the hidden stack gets to also see all that is outgoing and produce its own frames, it should not be hard, and I think that's the level of interference we should assume at least. The hidden stack could listen in on DHCP communication to figure out what address to assume and act on any incoming packets as necessary, and until it actually sends something it would be invisible to your network. When it does send something it could then easily be with one of the addresses assigned to the non-hidden stack. It is not much different in concept from a normal layer 1 switch. Everything gets repeated and the recipients discard what they're not interested in.
- zx3748 9y agoDoesn't someone on HN work at fucking Intel that can leak the ME source?
- samlewis 9y agoAm I missing something or is the next step going to be Intel making ME impossible to remove without bricking your CPU? If so, seems like these efforts are fairly futile if they'll only work for the current gen of processors.
- madez 9y agoIt is already impossible to remove the ME. If one does, then the system either doesn't boot at all or reboots after 30 minutes. All you can do is to apparently cripple it on some models.
- cmurf 9y agoGo is a compiled language, but it is often used for scripting. Minnich uses it that way "all the time"; he stopped writing Bash scripts years ago in favor of Go. It is "easier and more reliable" to write scripts in Go. Interesting. Also, the NERF (basically negate most of UEFI, in particular the extensibility) firmware using Linux, has an initramfs containing all the user space stuff as uncompiled Go, and a compiler which compiles on the fly.
- sjellis 9y agoI've been wondering if there would ever be a killer feature that would make ARM-based servers really compelling, and now I'm starting to think that we have one. Intel are handing ARM a massive opportunity with the IME issues.
- alex_duf 9y agoIs there any link to that talk? Edit: yes at the end of the article https://www.youtube.com/watch?v=iffTJ1vPCSo&list=PLbzoR-pLrL6pISWAq-1cXP4_UZAyRtesk https://www.youtube.com/watch?v=iffTJ1vPCSo&list=PLbzoR-pLrL...