TCG releases specs for public review

There are Opal specs, and UEFI/TPMv2 specs in public review, amongst a few others:
http://www.trustedcomputinggroup.org/resources/specifications_in_public_review

Also see some TCG talks at the Flash Summit, proceedings are now available (free, but email required). There are hundreds of PDFs, a few security and firmware related, in addition to TCG stuff.

http://www.flashmemorysummit.com/cgi-bin/start.cgi/HTMLOS_Pages/Entrance_Proceedings.html

Insyde Software’s HumanOS

Last week at Intel IDF Insyde Software announced updates to get Android Lollipop on Intel Core M systems, working with Intel China.

Insyde has an Android-based OS called “Humanos(R)”, which I had not heard of until now (it reminds me of AMI’s AMIDuOS):

Humanos is an instant-on software environment developed for notebooks and netbooks running Microsoft Windows, and is currently optimized for use with Google’s latest Android and Chromium open-source mobile operating systems. Humanos utilizes Insyde Software’s Quick-to-Launch UEFI Software, giving mobile PC users immediate access to an expanding set of mobile applications through the instantly available operating environment. Many of today’s open source operating systems provide mobile platforms the opportunity to integrate lots of new functionality within a very small footprint. Humanos from Insyde Software addresses the increasing demand for these open source operating systems by implementing them as secondary instant-on software environments to Windows based platforms or as standalone “app ready” user-friendly environments. This solution provides easy integration and great performance through Insyde Software’s UEFI Instant-On technology, and brings additional value to the platform. Additionally, platforms featuring Humanos can access Insyde Market, the world’s first Android applications market for netbook computers. Insyde Market features a growing list of Android applications optimized for the mobile PCs, which provides a continual source of added value for users and platform manufacturers that choose to include Humanos.

http://www.insyde.com/products/humanos
http://www.insyde.com/products/androidsolutions
http://www.insydesw.com/press_news/press-releases/insyde%C2%AE-software-collaborates-intel%C2%AE-china-bring-android%E2%84%A2-50-latest-intel%C2%AE

Optane memory

One of the things at Intel’s IDF last week was Optane 3D Xpoint memory. It sounds very interesting, I’m still not sure of the firmware “RAMifications”:

There are multiple news sites that provide detailed background on Optane:

http://www.theplatform.net/2015/08/18/intel-reveals-plans-for-optane-3d-xpoint-memory/

http://forwardthinking.pcmag.com/none/337065-intel-details-3d-xpoint-memory-future-products

http://www.forbes.com/sites/tomcoughlin/2015/08/21/optane-drives-future-intel-processors/

https://thestack.com/data-centre/2015/08/20/intel-optane-will-use-new-3d-xpoint-memory/

U-Boot AArch64 and ARM Trusted Boot support

This week Linus Walleij of Linaro posted a long blog article on U-Boot this week, with good background on U-Boot on ARM, as well as current AArch64 support, including integration with ARM Trusted Firmware (ARM TF). Excerpting the concluding paragraphs of the blog:

We now have pieced together a system that will start U-Boot from ARM Trusted Firmware and then have U-Boot load the Linux kernel and a device tree and start it. Are there problems remaining?
* One of the big outstanding issues are those where things are fragile because memory references need be hard-coded in U-Boot or ARM Trusted Firmware. For example U-Boot currently assumes that ARM TF will use 16MB of the DRAM memory. If the ARM TF change things around and use more or less memory, U-Boot needs to be reconfigured and recompiled. U-Boot on the other hand, will then pass whatever knowledge it has about the memory to the Linux kernel by augmenting the device tree. So if ARM TF could communicate the memory available to U-Boot and the OS this would be great.
* U-Boot relies on prior boot stages such as ARM Trusted Firmware to install PSCI handlers, while on ARMv7 this was usually done by augmenting U-Boot to do the same. Letting U-Boot install PSCI handlers is a bit bogus, since it is a piece of resident code left in memory after U-Boot has executed and not really “boot loader” code. U-Boot was augmented to compile these into a special memory area, copy them there and leave them around for the operating system to use later. Still there are people who might like to do this on ARMv8 U-Boot, especially those not using ARM Trusted Firmware.
* People apparently toy with the idea of booting U-Boot on bare metal, using a very small or no ROM nor ARM Trusted Firmware, letting U-Boot just execute immediately on the system. As U-Boot relies on something else to set up main memory and providing PSCI, this currently does not work. Doing this would require U-Boot to initialize memory and install PSCI handlers. It would also need to be small enough to execute from on-chip RAM.
* Chain of trust booting with signed boot levels, signed U-Boot and a signed kernel image and a signed device tree, making an example of a totally locked-down system. The Flattened Image Tree (FIT) supported by U-Boot is likely the best way forward here, but requires U-Boot to access public key infrastructure to verify images unless you want to compile the public key directly into U-Boot, which is often not a good idea.
* Fastboot – the Android boot protocol used by the Little Kernel, exists in U-Boot but has not been tested or verified. It can use USB or Ethernet alike.
* More hardware support – such as booting from the USB stick or MMC/SD card found in the Juno board. This was not covered by the experimental port.

Read the full article here:

https://www.linaro.org/blog/core-dump/u-boot-on-arm32-aarch64-and-beyond/

Insyde updates InsydeH2O and Supervyse

This week at Intel Developer Forum (IDF), Insyde Software announced support of Intel’s new “Innovation Engine”. Insyde has a Supervyse Systems Management product, as well as their InsydeH2O UEFI BIOS. Insyde announced that both of these products will fully-leverage Intel’s Innovation Engine, a newly-announced new processor and IO subsystem targeting data center platforms. Excerpting their press release:

“The Innovation Engine gives us tremendous opportunity to extend our BIOS and BMC product offerings,” said Stephen Gentile, Sr. Vice President, Strategy at Insyde Software. “More importantly, this powerful and open resource gives us a new framework for products targeted at next-generation data center servers,” added Gentile.

“The Innovation Engine is a new way that developers can tap Intel technology to improve the capabilities of data center solutions,” said Lisa Spelman, General Manager of Data Center Marketing at Intel. “Through working with our ecosystem partners like Insyde, our data center customers will have comprehensive hardware and software solutions that will drive new innovations and platform differentiation,” added Spelman.

More information:

http://www.insydesw.com/press_news/press-releases/insyde%C2%AE-software-helps-drive-innovation-future-intel%C2%AE-data-center-platform

AMI MegaRAC gets DMTF Redfish support

This week at Intel Developer Forum (IDF), AMI showcased their MegaRAC manageability solutions. MegaRAC is AMI’s Remote Management Firmware family of products for both in-band and out-of-band management, including supporting IPMI, Intel AMT, AMD systems with DMTF DASH. Amongst the new features of MegaRAC SP-X are DMTF Redfish support, and Intel(R) Innovation Engine support.

I don’t know much about Intel’s new “Innovation Engine” is yet, so I’ll excerpt one paragraph from the AMI press release:

“The Innovation Engine is a small, embedded, Intel-architecture processor and I/O subsystem built into future Intel data center platforms,” said Lisa Spelman, General Manager of Data Center Marketing at Intel. “Firmware such as MegaRAC PM-X running on the IE can improve or differentiate the system-builders’ platforms in a wide range of ways, including manageability, cost reduction or security.”

Maybe this means that AMI is the second vendor to support Redfish, after HP?

Read AMI’s full press release here:

http://www.ami.com/news/press-releases/?PressReleaseID=325&/American%20Megatrends%20to%20Showcase%20MegaRAC%20Manageability%20Solutions%20for%20Rack%20Scale%20Architecture%20and%20Innovation%20Engine%20at%20IDF%20San%20Francisco%202015/
https://www.megarac.com/live/document-library/
http://www.ami.com/products/remote-management/
https://firmwaresecurity.com/tag/redfish/

UEFI at ELCE

The Embedded Linux Conference Europe (ELCE) is happening in October. There’s a set of UEFI talks happening at the event:

UEFI Forum Update and Open Source Community Benefits, Mark Doran

Learn about the recent UEFI Forum activities and the continued adoption of UEFI technology. To ensure greater transparency and participation from the open source community, the Forum has decided to allow for public review of all specification drafts. Find out more about this new offering and other benefits to being involved in firmware standards development by attending this session.   

What Linux Developers Need to Know About Recent UEFI Spec Advances, Jeff Bobzin

Users of modern client and server systems are demanding strong security and enhanced reliability. Many large distros have asked for automated installation of a local secure boot profile. The UEFI Forum has responded with the new Audit Mode specified in the UEFI specification, v2.5, offering new capabilities, enhanced system integrity, OS recovery and firmware update processes. Attend this session to find out more about the current plans and testing schedules of the new sample code and features.

LUV Shack: An automated Linux kernel and UEFI firmware testing infrastructure, Matt Fleming

The Linux UEFI Validation (LUV) Project was created out of necessity. Prior to it, there was no way to validate the interaction of the Linux kernel and UEFI firmware at all stages of the boot process and all levels of the software stack. At Intel, the LUV project is used to check for regressions and bugs in both eh Linux kernel and EDK2-based firmware. They affectionately refer to this testing farm as the LUV shack. This talk will cover the LUV shack architecture and validation processes.

The Move from iPXE to Boot from HTTP, Dong Wei

iPXE relies on Legacy BIOS which is currently is deployed by most of the world’s ISPs. As a result, the majority of x86 servers are unable to update and move to a more secure firmware platform using UEFI. Fortunately, there is a solution. Replacing iPXE with the new BOOT from HTTP mechanism will help us get there. Attend this session to learn more.

UEFI Development in an Open Source Ecosystem, Michael Krau, Vincent Zimmer

Open source development around UEFI technology continues to progress with improved community hosting, communications and source control methodologies. These community efforts create valuable opportunities to integrate firmware functions into distros. Most prevalent UEFI tools available today center on chain of trust security via Secure Boot and Intel® Platform Trust Technology (PTT) tools. This session will address the status of these and other tools. Attendees will have the opportunity to share feedback as well as recommendations for future open UEFI development resources and processes.

UEFI aside, there’s many other presentations that look interesting, for example:

Isn’t it Ironic? The Bare Metal Cloud – Devananda van der Veen, HP
Developing Electronics Using OSS Tools – Attila Kinali
How to Boot Linux in One Second – Jan Altenberg, linutronix GmbH
Reprogrammable Hardware Support for Linux – Alan Tull, Altera
Measuring and Reducing Crosstalk Between Virtual Machines – Alexander Komarov, Intel
Introducing the Industrial IO Subsystem: The Home of Sensor Drivers – Daniel Baluta, Intel
Order at Last: The New U-Boot Driver Model Architecture – Simon Glass, Google
Suspend/Resume at the Speed of Light – Len Brown, Intel
The Shiny New l2C Slave Framework – Wolfram Sang
Using seccomp to Limit the Kernel Attack Surface – Michael Kerrisk
Tracing Virtual Machines From the Host with trace-cmd virt-server – Steven Rostedt, Red Hat
Are today’s FOSS Security Practices Robust Enough in the Cloud Era – Lars Kurth, Citrix
Security within Iotivity – Sachin Agrawal, Intel
Creating Open Hardware Tools – David Anders, Intel
The Devil Wears RPM: Continuous Security Integration – Ikey Doherty, Intel
Building the J-Core CPU as Open Hardware: Disruptive Open Source Principles Applied to Hardware and Software – Jeff Dionne, Smart Energy Instruments
How Do Debuggers (Really) Work – Pawel Moll, ARM
Make your Own USB device and Driver with Ease! – Krzysztof Opasiak, Samsung
Debugging the Linux Kernel with GDB – Peter Griffin, Linaro

http://events.linuxfoundation.org/events/embedded-linux-conference-europe/program/schedule

Firmware patents….

SPOILER ALERT: This post discusses patents. If you’re an employee at a company, ask your manager if you’re able to read this sort of information…..
.
.
.

I wonder how bad it’s going to get with firmware patents… Searching the patent databases, I find THOUSANDS with ‘firmware’, HUNDREDS with ‘UEFI’, and dozens with ‘coreboot’, and many for ACPI. For example, it appears that Microsoft has patented the ability to securely update firmware:

Microsoft: Secure Firmware Updates
US 20140068585 A1, CN 104603792 A, US 8898654 B2

This is just one example, all of the big OEMs, IHVs, and ISA vendors have patents left and right in this space. 😦

Are vendors able to build UEFI — or even coreboot — systems without lawyers from some of the big companies knocking on their door asking for royalties? Where is the firmware equivalent of the “Open Invention Network”, to help smaller vendors even use basic firmware functionality with lawyers looking to monetize everything? I wonder if the Maker movement or Open Hardware or Free Hardware is going to be able to survive this.

AMI’s StorTrends granted 3 new flash storage patents

SPOILER ALERT: This post discusses patents. If you’re an employee at a company, ask your manager if you’re able to read this sort of information…..
.
.
.

Monday AMI announced that StorTrends(R), their data storage division, has been granted three U.S. Patents related to flash storage. Excerpting their press release:

AMI was granted U.S. Patent No. 8,954,339 on Data Deduplication for Information Storage Systems, which was filed on April 18, 2012. This awarded patent covers the means to have deduplication run at optimal and efficient space-saving levels. Specifically, it optimizes the amount of system RAM space used in the system to reduce (or dedupe) terabytes worth of data without affecting performance. In terms of customer benefit, this greatly reduces the amount of SSD capacity that a company is required to purchase within the SAN while also delivering the lowest latency in the industry to significantly increase value and response times within an IT environment.

AMI was granted the second patent — U.S. Patent No. 8,812,811 on Data Migration between Multiple Tiers in a Storage System — which was filed on August 10, 2012. This awarded patent covers the means that StorTrends utilizes to efficiently analyze blocks of data and move the individual blocks among different tiers of storage. Customers lower their costs significantly from StorTrends taking the highly accessed blocks of data in the environment and putting only those blocks into the expensive drive SSD tiers, while the less frequently accessed blocks occupy only the lower, less expensive tier of the storage array.

AMI was granted the third patent—Patent No. 8,711,851 on Multi-Protocol Data Transfers — which was filed on July 18, 2008. This patent covers the means that StorTrends uses to maximize the reliability of transmission control protocol and the performance of user datagram protocol to ensure that StorTrends’ replication is the fastest in the industry. This decreases replication management and increases the possible recovery point objective (RPO) for a customer by giving more available bandwidth for the blocks that need to go to their disaster recovery (DR) location. StorTrends also incorporates periodicity, which allows the customer to set the priority bandwidth for the replication of the data and avoid bogging down the network during peak business hours. The Wide-Area Data Services (WDS) technology suite includes data deduplication, compression, encryption, and WAN optimization. This technology ensures that the primary site stays in-sync with the secondary site, allowing for increased RPO and recovery time objective.

Read the full press release here:

http://www.ami.com/news/press-releases/?PressReleaseID=324&/StorTrends%20Granted%20Three%20U.S.%20Patents%20That%20Set%20New%20Performance%20Standard%20for%20All-Flash%20Storage/

http://www.stortrends.com/products/stortrends-models/stortrends-3600i
http://www.stortrends.com/resources/stortrends-idata-tool
http://www.stortrends.com/resources/stortrends-deduplication-analyzer-tool/

Intel SMI Transfer Monitor (STM) for SMM

Recently, Intel announced STM, a way to help secure SMM.

Intel announces STM at IDF

So far, it appears the some of the expert firmware security researchers do not dissapprove of STM, though they wanted it earlier:

https://twitter.com/rootkovska/status/633909806483566592

Android Marshmallow released

Google recently released Developer Preview 3 of Android 6.0 SDK, Android “M”, Marshmallow. So far, I don’t see any firmware-centric changes yet…

http://developer.android.com/preview/support.html#preview3-notes
http://android-developers.blogspot.com/2015/08/m-developer-preview-3-final-sdk.html

https://en.wikipedia.org/wiki/Android_Marshmallow

 

dEFIant: new UEFI game engine

Nate Brune, a 16-year old high school student, just released:

dEFIant: The best UEFI game engine on the market!
The only ring0 game engine on the market
https://github.com/NateBrune/dEFIant

There are a few other UEFI games, but there are so few that I doubt “best UEFI game engine” cannot be argued with, yet. 🙂 I like the name, reminds me of “rEFIt” and “rEFInd”.

Back in 2013, Matthew Garrett ported Zork’s Z-Machine to UEFI:
http://mjg59.dreamwidth.org/27881.html

Also back in 2013, there’s a Tetris implementation for UEFI:
https://github.com/swmicro/Tetris

There’re 1-3 other UEFI games on Github, sorry no better pointers but here:
https://github.com/search?utf8=%E2%9C%93&q=UEFI&type=Repositories&ref=searchresults

Somewhere I think I still have patches for GNU Go and BSD Fortune ports, from when I was learning to use the EADK. 😦 I’m waiting for someone to port MAME to UEFI, only then will UEFI be “the new DOS”. 🙂

AMD adds Absolute ComputeTrace support

Today AMD joins Intel in adding Absolute’s CompuTrace technology into their systems:

Absolute collaborates with AMD to extend benefits of persistence technology
Vancouver, Canada: August 18, 2015– Absolute® Software Corporation (TSX:ABT), the industry standard for persistent endpoint security and data risk management solutions for computers, laptops, tablets and smartphones, today announced an agreement with Advanced Micro Devices, Inc. (AMD) to incorporate Persistence® technology by Absolute into AMD chip designs.
Under the terms of this agreement, Absolute and AMD will provide an enhanced security offering by embedding patented Persistence technology directly into AMD x86 APU technologies.
“In the interest of improving the privacy and security of our customers, we have been steadfast in our commitment to evolve security offerings through our technology,” said Roy Taylor, corporate vice president, Alliances, AMD. “We are excited to work with Absolute to leverage its unique Persistence technology by integrating this security functionality into AMD processors.”
“AMD is a long-tenured leader in the semiconductor industry with a keen focus on advancing security offerings on the devices they power,” said Geoff Haydon, chief executive officer, Absolute. “By working together, we can explore new ways to advance Persistence technology and deliver a higher level of data and device security to AMD and Absolute customers.”
Persistence technology by Absolute is embedded into the core of devices at the factory. Once activated, Persistence technology provides a reliable two-way connection so IT can confidently manage mobility, investigate potential threats, and take action if a security incident occurs.

http://www.absolute.com/en/about/pressroom/press-releases/2015/absolute-collaborates-with-amd-to-extend-benefits-of-persistence-technology

Intel ATR on firmware security threats

Jim Walter, Director of Advanced Threat Research for Intel Security, with contributions from Yuriy Bulygin and John Loucaides, wrote a blog for Dark Reading that summarizes some recent firmware attacks.

Vulnerable From Below: Attacking Hypervisors Using Firmware And Hardware
Malicious attacks with firmware privileges can compromise an entire system, so it is especially important to apply measures to reduce the risks.

Read the full article here:

http://www.darkreading.com/partner-perspectives/intel/vulnerable-from-below-attacking-hypervisors-using-firmware-and-hardware/a/d-id/1321834

 

 

ARM Tech Conference in November

(This week is Intel’s Developer Conference….) ARM has a Developer Conference in November in California. Like the Intel devcon, many of the presentations at the ARM event look very interesting, here’s a sampling:

* Building an ARM Cortex M4 Automated Firmware Update System
* The Future of Security for the Connected Car
* Use cases for ARM TrustZone dealing with mixed criticality applications
* Deploying Trusted Code to TrustZone: Easy as 1,2,3!
* IoT protocols for constrained devices
* Designing Security and Trust into Connected Devices
* Protection for Premium Content for Mobile, Smart TV, STB’s
* Resilient Internet of Things Security The End of Flat Security Models
* Bringing Mali, the Android GPU of Choice, to Wearables
* C++ Exception Handling on the ARMv7 Architecture
* De-Mystifying Automotive ADAS Collision Avoidance systems with Programmable SoCs
* Efficient Interrupts on ARM Cortex-M Microcontrollers
* Addressing Debug Challenges for ARM based Heterogeneous Multicore SoCs
* ARM-based Secure IoT with Secure Boot and Secure software platform that delivers Data integrity, confidentiality, Anonymity and Non-Repudiation
* ARM mbed powering the Internet of Things that really matter
* Multi-Abstraction Hardware/Software Debug for ARM(R)v7/v8 Based SoCs
* New Intrusion Detection Methodology for IoT Cybersecurity using Programmable SoCs
* Development Tools for Writing Secure Software Targeting Cortex-M Processors
* IoT Security Therapy Panel: Becoming Less Insecure
* Windows 10 IoT for Embedded ARM Devices
* Building Confidence for the Internet of Tomorrow: How ARM-Powered Solutions Will Secure the IoT
* Code Verification Explained: Code Coverage and Unit Testing
* Improving Software Security through Standards Compliance and Structural Coverage Analysis
* New Approaches for Securing Mobile and Iot Devices Through Cognitive Technologies
* The Benefits and Ease of Establishing a PUF-Based Root of Trust on ARM Trustzone
* Resolving Security and Power Conflicts in ARM Cortex-M7 IoT SoCs
* Simplifying Software Development for Socs Containing Multiple Cortex-M Based Processors

September 4th is the Early Bird discount rate change. Expo passes are free.

http://schedule.armtechcon.com/list

http://www.armtechcon.com/passes-pricing/

GlobalPlatform’s TEE Developers Workshop

Next month is the GlobalPlatform TEE conference in California; they’re also hosting a 1-day developer workshop on October 12th. GlobalPlatform, Trustonic, Intel, and Linaro are presenting; the agenda looks interesting:

1) GlobalPlatform
Kevin Gillick, GlobalPlatform Exec. Director
Gil Bernabeu, GlobalPlatform Technical Director
Christophe Colas, VP of Product Marketing at Trustonic and GlobalPlatform Device Committee Chair

2) Trustonic: Scaling Fast and Simply Across Trustonic TEE-based Devices
Rob Dyke, Senior Field Application Engineer, Trustonic

3) Intel: Open-TEE – A Virtual TEE and SDK
Brian McGillion, Security Engineer, Intel
Tanel Dettenborn, Security Engineer, Intel
Thomas Nyman, Doctoral Candidate, Aalto University, Finland
Valentin Manea, Security Engineer, Huawei

4) Linaro: TEE and TA Development the Easy Way
Joakim Bech, Technical Lead, Security Working Group, Linaro

http://www.teeseminar.org/about_the_workshop.asp
https://github.com/Open-TEE

Home


https://wiki.linaro.org/WorkingGroups/Security/OP-TEE

http://www.globalplatform.org/TEEevent/about_the_workshop.asp

Early bird pricing is $199 USD before 30 August 2015. $299 USD after. There is no price distinction between GlobalPlatform members and non-members for this workshop. Organizations sending two or more people will receive $50 discount per student.

Intel ITS

Intel has a device to help with UEFI testing, the Intelligent Test System (ITS). ITS may have been around for a while, but I just noticed it on the Intel firmware web site. I’m presuming for now that it’s new from IDF, but I may be wrong about that. If you do UEFI testing, you might want to look at this device.

https://firmware.intel.com/learn/its/intel-its

https://designintools.intel.com/product_p/q6ujitshub001.htm

I wonder how it compares to Linaro’s LAVA. LAVA does mostly target ARM devices, but does also target Intel via QEMU, perhaps there are direct Intel targets these days.

https://validation.linaro.org/

Nikolaj Schlej to speak on UEFI at ZeroNights

Nikolaj Schlej, firmware security researcher and creator of UEFITool, will be speaking at ZeroNights 2015 in November 25-26 in Moscow, Russia, his first security conference presentation! His presentation is called “UEFI: Fix it yourself”, and he’s one of a handful of people that can accomplish that. 🙂

http://2015.zeronights.org/