Tag: EDKII

Intel security guidance: Host Firmware Speculative Execution Side Channel Mitigation

~ hucktech ~ Leave a comment

[…]This provides specific guidance for firmware based upon the EFI Developer Kit II (EDKII) and coreboot. Because this document deals with host firmware internal requirements, it is not intended to provide side channel mitigation guidance for general application developers.

Scope: This addresses bare-metal firmware runtime risks and mitigation suggestions for the bounds check bypass, branch target injection, rogue data cache load, rogue system register read, and speculative store bypass side channel methods. Our examples and context are primarily focused on ring 0 firmware runtimes (for example: EFI Developer Kit II, PI SMM, and coreboot SMM). Other firmware execution environments are out of scope.[…]

https://software.intel.com/security-software-guidance/api-app/insights/host-firmware-speculative-execution-side-channel-mitigation

more info:

https://software.intel.com/security-software-guidance/software-guidance

Vincent on Intel FSP and EDK-II interactions

~ hucktech ~ Leave a comment

Vincent Zimmer of Intel has a new blog post, on UEFI’s EDK-II and Intel FSP (Firmware Support Package), and how the FSP works with the EDK-II. Good background, with lots of links.

https://firmware.intel.com/blog/open-source-platforms-edkii-using-intel-fsp

 

For more information on UEFI and FSP, also read the APress book, which Vincent is one of the authors:

https://firmwaresecurity.com/2015/05/09/book-review-embedded-firmware-solutions/

Vincent Zimmer on the x-UEFI configuration language

~ hucktech ~ Leave a comment

Vincent Zimmer of Intel has a new blog post, explaining how UEFI’s HII user interface stuff works:

[…] The The x-UEFI configuration language is now a reality. The latest keywords can now be found at http://uefi.org/confignamespace.  This list should grow over time as more configuration data emerges based upon new platform technologies, features in the UEFI and other industry standards, etc. This type of facility helps provide infrastructure to provide visibility into ‘Is Features XYZ enabled.” A common instance of this is virtualization technology, hyper threading, and other art managed by the platform. Going forward, I can imagine OS viewer utilities, maybe /dev/hii in Linux and an associated Microsoft Windows interface, to exposing this information. The EDKII community on tianocore.org ought to investigate some simple shell applications to export the information, too. […]

Full blog post:

http://vzimmer.blogspot.com/2016/02/firmware-configuration-or-is-feature.html

The config namespace already has dozens of variables:

http://uefi.org/confignamespace

http://www.uefi.org/namespace_instructions

I am looking forward to someone writing a security test tool that works with this database. 🙂

 

Tianocore transitioned to Github

~ hucktech ~ Leave a comment

Jordan Justen of Intel announced the transition of the Tianocore EDK2 project from Sourceforge to Github. Transition began Friday February 2nd and is apparently now complete. It is a big deal when a large codebase moved to another version control system… excerpting Jordan’s status message:
And, for months, quite a few people at Intel have been working behind the scenes to get everything ready for the transition. Thanks!

Merry EDK II Git Day!

More information:
https://github.com/tianocore/tianocore.github.io/wiki/Transition-to-GitHub
https://lists.01.org/mailman/listinfo/edk2-devel

Note there is also an #edk2 channel on OTFC, http://www.oftc.net/

 

EDK-II Build Data Viewer

~ hucktech ~ Leave a comment

William Leara has a new blog post on Intel’s EDK-II Build Data Viewer tool; it is a detailed post with multiple screenshots and images:

http://www.basicinputoutput.com/2015/12/the-edkii-build-data-viewer.html

Wow, I missed this tool from Intel when it first came out, so I’m very glad for this post! Note this source project is hosted on 01.org, not tianocore.org.

Unfortunately, it sounds like the tool may be difficult to use:

“The EDKII Build Data Viewer is beautifully designed.  The documentation is top notch.  It provides a wealth of information in one place that would be time-consuming to discover independently.  Unfortunately I was not able to get it to run on the production BIOS source trees I have available to me, but hopefully you have better luck.”

If anyone gets it working, please leave a comment with a pointer to more info.

https://github.com/01org/edkiibuilddataviewer

Updated UEFI training from Intel SSG

~ hucktech ~ Leave a comment

It appears there are a few new files on Tianocore.org, beyond latest EDK-II trunk source changes.

Intel has a multi-day training course for (presumably) Intel employees and partners. Intel releases the presentations and lab workshop materials for the course for public access, as part of the Tianocore project, and updates it periodically. And they recently updated it again, grab the 2 files at the top of the list, with recent dates. I just downloaded it, unsure what is new in the labs yet…
http://sourceforge.net/projects/edk2/files/Training/TrainingMaterial/

Also see updated versions of the online presentations here:
http://sourceforge.net/projects/edk2/files/Training/
https://github.com/tianocore/tianocore.github.io/wiki/UEFI%20EDKII%20Learning%20Dev

I think this page may be slightly out-of-date for the moment:
http://firmware.intel.com/learn/uefi/uefi-training-materials

As for other updates to tianocore/EDK2, the EDK-II C Coding Conventions have been revised:
http://sourceforge.net/projects/edk2/files/Specifications/

I usually find it is best to find fresh Tianocore files by looking at these two locations first:
https://github.com/tianocore
http://sourceforge.net/projects/edk2/files/