Tag: UEFI 2.5

UEFI 2.5 Platform Recovery feature appearing in Tianocore

~ hucktech ~ Leave a comment

Ruiyu Ni of Intel has posted an 12-part patch addding UEFI 2.5’s Platform Recovery feature to the public Tianocore EDK2 trunk.

Amongst the features of UEFI 2.5, the last public release of UEFI from the UEFI Forum, was #1227 “UEFI.Next feature – Platform recovery“. Load up the multi-thousand page UEFI 2.5 specification, with a PDF viewer with good search abilities, to find all the locations in the spec which Platform Recovery impacts. A good place to start would be around page 119, the OsRecovery#### and PlatformRecovery#### variables that’re new to UEFI 2.5.

Given that the patch includes a question from Intel asked HP:  “Could you please check my patch to see whether it can meet your real requirement?“, it appears that HP already has an existing implementation of this, perhaps already publicly available, probably separate from the Tianocore implementation, like they did with HTTP Boot. I’m not sure of other vendors with existing UEFI 2.5 Platform Recovery support.

Given UEFI capsule updates can add new features, your next firmware update may include this feature; is your organization ready to deal with UEFI 2.5 Platform Recovery support appearing in the near future? I’m not ready. I don’t understand what this feature really means, in terms of system impact. Earlier (not in this patch), there was a LOT of new code dealing with recovery in drivers. I don’t now know how to test this feature yet in Tianocore. Are there any new tools involved with this feature, for sysadmins to use? How do I test if this feature is working in a specific driver, or in the entire system? Where are some test scripts that exercise the feature? If someone has any more pointers to using this new feature, please add a Comment to this post (see left), thanks!

Subject: [Patch 00/11] Add Platform Recovery support

OS Recovery will be added later.

Ruiyu Ni (11):
  MdePkg: Add Platform Recovery definitions.
  MdeModulePkg: Add Bm prefix for internal functions
  MdeModulePkg: Use BmCharToUint in BmIsKeyOptionVariable
  MdeModulePkg: Use BM_OPTION_NAME_LEN instead of sizeof L”Boot####”
  MdeModulePkg: Use BmForEachVariable to collect all key options
  MdeModulePkg: Support to expand File device path
  MdeModulePkg: Add Platform recovery support
  MdeModulePkg: Add missing PrintLib to BdsDxe.inf
  MdeModulePkg: Use UefiSpec.h defined macro to replace L”xxx” string
  MdeModulePkg: Add PlatformRecovery#### pointing to default file path
  MdeModulePkg: Enable PlatformRecovery in BdsDxe driver

 MdeModulePkg/Include/Library/UefiBootManagerLib.h  |   1 +
 MdeModulePkg/Library/UefiBootManagerLib/BmBoot.c   |  76 ++++
 MdeModulePkg/Library/UefiBootManagerLib/BmHotkey.c | 181 +++++—-
 …/Library/UefiBootManagerLib/BmLoadOption.c      | 155 +++++–
 MdeModulePkg/Library/UefiBootManagerLib/BmMisc.c   |  26 ++
 …/Library/UefiBootManagerLib/InternalBm.h        |  30 +-
 …/UefiBootManagerLib/UefiBootManagerLib.inf      |   1 +
 MdeModulePkg/Universal/BdsDxe/Bds.h                |   3 –
 MdeModulePkg/Universal/BdsDxe/BdsDxe.inf           |   1 +
 MdeModulePkg/Universal/BdsDxe/BdsEntry.c           | 447 ++++++—————
 MdePkg/Include/Uefi/UefiSpec.h                     |   1 +
 11 files changed, 474 insertions(+), 448 deletions(-)

More Information:
https://lists.01.org/mailman/listinfo/edk2-devel

UDK2015 expected mid-October

~ hucktech ~ Leave a comment

The UDK github wiki has been updated to give information about upcoming UDK 2015 release next month. It appears to include most UEFI 2.5 features, plus a few new ones. Excerpt of changes:

 

Support UEFI 2.5 Updates:
 + Smart Card Reader & Smart card edge protocol (H file only)
 + Inline Cryptographic Interface Protocol (H file only)
 + UEFI USB Function I/O Protocol (H file only)
 + Add NVM Express Pass Thru Protocol
 + Add UFS stack
 + Add SD Device Path (H file only)
 + Add reconnect Browser Action
 + Ability to refresh the entire form
 + The default/options for the Ordered List question
 + Keyword Strings support
 + New CPER Memory Section (H file only)
 + New EFI_HASH2_PROTOCOL
 + Adding support for No executable data areas
 + Persistent Memory Type support
 + Add the Support for new PKCS7 Verification Services
 + System Prep Applications
 + Add SMBIOS3_TABLE_GUID in configuration table.
 + Exposing Memory Redundancy to OSPM
 + ESRT: EFI System Resource Table and component firmware updates
 + IPV6 support from UNDI
 + UEFI “Next” Feature –
    * IP_CONFIG2 Protocol
    * Boot from HTTP (Excluding IPV6)
    * DNSv4 and DNSv6

Support PI 1.4 Updates:
 + PI SMM GPI
 + New MP Service PPI
 + Multiple CPU health info
 + PEI SetBootMode Service() clarification
 + GetMemoryMap Update for ReservedMemory
 + New Graphics PPI
 + New Capsule PPI
 + SIO PEI and UEFI-Driver Model Architecture
 + Extended File Size Errata
 + Add Reset2 PPI

Excluded from UEFI 2.5 Updates:
 + Match2 Opcode and EFI_REGULAR_EXPRESSION_PROTOCOL
 + Bluetooth Support (H file only)
 + Errata Boot Manager Policy & SATA Device Path Node
 + RamDisk Device Path
 + UEFI “Next” Feature –
    * Boot from HTTP (Excluding IPV6)
    * WIFI support (H file only)
    * EAP2 Protocol (H file only)
    * UEFI TLS API
    * REST Protocol
    * Platform recovery
    * Customized Deployment of Secure Boot
    * BMC/Service Processor Device Path

Other features:
 + Add ACPI 6.0 definitions.
 + Add SMBIOS 3.0 definitions.
 + Support OpenSSL version 1.0.2d.

Looking forward to the upcoming checkins to Tianocore’s EDK2 trunk!

Full roadmap article:
https://github.com/tianocore/tianocore.github.io/wiki/RoadMap2015

UEFI at ELCE

~ hucktech ~ Leave a comment

The Embedded Linux Conference Europe (ELCE) is happening in October. There’s a set of UEFI talks happening at the event:

UEFI Forum Update and Open Source Community Benefits, Mark Doran

Learn about the recent UEFI Forum activities and the continued adoption of UEFI technology. To ensure greater transparency and participation from the open source community, the Forum has decided to allow for public review of all specification drafts. Find out more about this new offering and other benefits to being involved in firmware standards development by attending this session.   

What Linux Developers Need to Know About Recent UEFI Spec Advances, Jeff Bobzin

Users of modern client and server systems are demanding strong security and enhanced reliability. Many large distros have asked for automated installation of a local secure boot profile. The UEFI Forum has responded with the new Audit Mode specified in the UEFI specification, v2.5, offering new capabilities, enhanced system integrity, OS recovery and firmware update processes. Attend this session to find out more about the current plans and testing schedules of the new sample code and features.

LUV Shack: An automated Linux kernel and UEFI firmware testing infrastructure, Matt Fleming

The Linux UEFI Validation (LUV) Project was created out of necessity. Prior to it, there was no way to validate the interaction of the Linux kernel and UEFI firmware at all stages of the boot process and all levels of the software stack. At Intel, the LUV project is used to check for regressions and bugs in both eh Linux kernel and EDK2-based firmware. They affectionately refer to this testing farm as the LUV shack. This talk will cover the LUV shack architecture and validation processes.

The Move from iPXE to Boot from HTTP, Dong Wei

iPXE relies on Legacy BIOS which is currently is deployed by most of the world’s ISPs. As a result, the majority of x86 servers are unable to update and move to a more secure firmware platform using UEFI. Fortunately, there is a solution. Replacing iPXE with the new BOOT from HTTP mechanism will help us get there. Attend this session to learn more.

UEFI Development in an Open Source Ecosystem, Michael Krau, Vincent Zimmer

Open source development around UEFI technology continues to progress with improved community hosting, communications and source control methodologies. These community efforts create valuable opportunities to integrate firmware functions into distros. Most prevalent UEFI tools available today center on chain of trust security via Secure Boot and Intel® Platform Trust Technology (PTT) tools. This session will address the status of these and other tools. Attendees will have the opportunity to share feedback as well as recommendations for future open UEFI development resources and processes.

UEFI aside, there’s many other presentations that look interesting, for example:

Isn’t it Ironic? The Bare Metal Cloud – Devananda van der Veen, HP
Developing Electronics Using OSS Tools – Attila Kinali
How to Boot Linux in One Second – Jan Altenberg, linutronix GmbH
Reprogrammable Hardware Support for Linux – Alan Tull, Altera
Measuring and Reducing Crosstalk Between Virtual Machines – Alexander Komarov, Intel
Introducing the Industrial IO Subsystem: The Home of Sensor Drivers – Daniel Baluta, Intel
Order at Last: The New U-Boot Driver Model Architecture – Simon Glass, Google
Suspend/Resume at the Speed of Light – Len Brown, Intel
The Shiny New l2C Slave Framework – Wolfram Sang
Using seccomp to Limit the Kernel Attack Surface – Michael Kerrisk
Tracing Virtual Machines From the Host with trace-cmd virt-server – Steven Rostedt, Red Hat
Are today’s FOSS Security Practices Robust Enough in the Cloud Era – Lars Kurth, Citrix
Security within Iotivity – Sachin Agrawal, Intel
Creating Open Hardware Tools – David Anders, Intel
The Devil Wears RPM: Continuous Security Integration – Ikey Doherty, Intel
Building the J-Core CPU as Open Hardware: Disruptive Open Source Principles Applied to Hardware and Software – Jeff Dionne, Smart Energy Instruments
How Do Debuggers (Really) Work – Pawel Moll, ARM
Make your Own USB device and Driver with Ease! – Krzysztof Opasiak, Samsung
Debugging the Linux Kernel with GDB – Peter Griffin, Linaro

http://events.linuxfoundation.org/events/embedded-linux-conference-europe/program/schedule

UEFI 2.5 change list

~ hucktech ~ Leave a comment

I’ve been meaning to look more closely into version 2.5 changes in UEFI. So far, I’ve only looked at UEFI HTTP Boot, at a little at the NVMe passthru protocol.

Looking at the UEFI 2.5 spec from uefi.org, the initial pages of the document include it’s revision history.  It appears the UEFI 2.5 changes were done in two batches, February 2015 and April 2015. I’m listing the revisions below, with the “2.5” prefix and the “<Month> 2015” suffix removed, for clarity.

The number is the Mantis issue-tracking number, something only useful for UEFI Forum members. If you are a UEFI Forum member, you can presumably access their Mantis system and get more information about the changes. The public only has the title, and a useless Mantis number.  Perhaps the submitter for UEFI 2.5 mantis entry 1147 is the NSA or the Hacking Team? 🙂 We’ve no idea, the title for that change is “REDACT”. 😦

I wish the UEFI Forum would spend a few minutes in their release phase to give a paragraph or two of information about these changes. At minimum, they should mention where in the spec(s) this change impacts, if the new software feature will be in open source TianoCore implementation or only in commercial products. If the code is in TianoCore, it would be nice to mention the SVN build number, like the TiaonCore Security Advisories do — so you can compare the before/after in the code more easily. SVN build numbers would be more a lot useful to the public than the “<Month> <YEAR>” string added to the title of each revision entry.

Here are the UEFI 2.5 updates:

1071 New EFI_HASH2_PROTOCOL
1090 ESRT: EFI System Resource Table and component firmware updates
1091 Clarification of handle to host FMP
1103 Longer term New CPER Memory Section
1109 Smart Card Reader
1121 IPV6 support from UNDI
1147–REDACT
1163 Inline Cryptographic Interface Protocol proposal
1166 hash 2 protocol errata
1158 errata – boot manager clarification
1159 Proposal for System Prep Applications
1167 Persistent Memory Type support
1174 errata – Error in EFI_IFR_PASSWORD logic flowchart
1183 New Protocol with 2 Function for PKCS7 Signature Verification Services
1186 AArch64 binding clarifications and errata
1191 Add new SMBIOS3_TABLE_GUID in EFI_CONFIGURATION_TABLE
1199 Add NVM Express Pass Thru Protocol
1201 Exposing Memory Redundancy to OSPM
1204 new UEFI USB Function I/O Protocol addition to the UEFI spec
1212 UEFI.Next feature – HTTP API
1213 UEFI.Next feature – HTTP helper API
1214 UEFI.Next feature – HTTP Boot
1215 UEFI.Next feature – DNS version 4
1216 UEFI.next feature – DNS version 6
1217 UEFI.Next feature – WIFI support
1218 UEFI.Next feature – EAP2 Protocol
1219 UEFI.Next Feature – UEFI TLS API
1220 UEFI.Next feature – Bluetooth
1221 UEFI.Next feature – REST Protocol
1222 UEFI.Next feature – BMC/Service Processor Device Path
1223 UEFI.Next networking features – chapter 2.6 requirements
1224 UEFI.Next – Adding support for No executable data areas
1227 UEFI.Next feature – Platform recovery
1234 UEFI.Next feature – Smart card edge protocol
1244 sections of the spec mis-arranged
1251 EFI_REGULAR_EXPRESSION_PROTOCOL and EFI_IFR_MATCH2 HII op-code
1254 SD Device Path
1255 UFS Device Path Node Length
1257 Correct the typedef definitions for EFI_BOOT_SERVICES/EFI_RUNTIME_SERVICES–Reiterate
1263 Customized Deployment of Secure Boot
1266 UEFI.Next Feature – IP_CONFIG2 Protocol
1268 RAM Disk UEFI Device Path Node
1269 Configuration Routing Protocol and Configuration String Updates
1287 Errata: EFI Driver Supported EFI Version not matching the spec revision
1288 The Macro definition conflict in EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL.SetAttribute() in UEFI 2.4 B
1303 Update the UEFI version to reflect new revision
1304 Add IMAGE_UPDATABLE_VALID_WITH_VENDOR_CODE to FMP Check image
1308 Fix typo’s found in the final/published UEFI 2.4 Errata B spec
1309 Disallow EFI_VARIABLE_AUTHENTICATION from Secure Boot Policy Variables
1339 Errata in section 7.2.3.2 Hardware Error Record Variables
1341 DNS4 – friendly amendment to be reviewed by USWG
1342 DNS6 – friendly amendment for review by USWG
1345 EFI_USB2_HC_PROTOCOL Errata
1346 Mantis 1288 Errata
1347 Boot Manager Policy Errata
1348 ERRATA – Section 10.12 EFI_ADAPTER_INFORMATION_PROTOCOL Custom Types
1350 Keyword Strings Errata
1352 Errata for 1263 and 1227
1353 SATA Device Path Node Errata
1358 v2.5 amendment and v2.4 errata (missed implementation of Mantis 1089)
1360 Vendor Range for UEFI memory Types
1362 HTTP boot typos/bugs
1364 Extend supplicant data type for EAP

I’ll start to dig into a subset of this list in upcoming blog entries, starting with ones that have TianoCore implementation-related checkins.

HTTP Boot support in Tianocore

~ hucktech ~ Leave a comment

One new feature in UEFI 2.5 is HTTP Boot, an alternative to PXE-based TFTP booting. I’ve made 2 blog posts on it so far:

https://firmwaresecurity.com/2015/05/09/new-uefi-http-boot-support-in-uefi-2-5/

https://firmwaresecurity.com/2015/06/10/more-info-on-uefi-2-5-http-boot-implementations/

Right now, HP supports it, and Intel is adding an implementation to Tianocore. In the last day, it appears that Intel’s beginning to add their implementation to the EDK-II trunk. In the NetworkPkg, there are a few new directories, apparently mostly related to a new HttpBootDxe driver. For more information, look at the edk2-devel mailing list archives, or the EDK-II trunk in the NetworkPkg.

Two Linux firmware articles

~ hucktech ~ Leave a comment

1) Linux Vendor Firmware Service launches

In a Phoronix article today, Michael Larabel describes the new Linux Vendor Firmware Service (LVFS) has been announced.

“This site provides a place for hardware vendors to submit packaged firmware updates, typically .cab files. This fire-and-forget service allows vendors to submit firmware updates without generating and hosting AppStream metadata themselves.”

More information:
https://beta-lvfs.rhcloud.com/
http://www.phoronix.com/scan.php?page=news_item&px=Linux-Vendor-Firmware-S
https://github.com/hughsie/fwupd

2) Intel on Linux firmware updates

Brian Richardson posted a blog yesterday, with information on Linux fwupdate, UEFI Capsule (firmware updates), UEFI 2.5 ESRT, and the Fedora firmware update mechanism.

More information:
http://blogs.intel.com/evangelists/2015/06/23/better-firmware-updates-in-linux-using-uefi-capsules/

UEFI 2.5 ESRT in Linux 4.2

~ hucktech ~ Leave a comment

One new feature in UEFI 2.5 is the ESRT (EFI System Resource Table). As reported in Phoronix, ESRT supports has been added to the Linux kernel, and it appears that it’ll be in Linux 4.2. Quoting Peter Jones’ ESRT patch to sysfs on the linux-efi list, describing ESRT:

“The EFI System Resource Table (ESRT) provides a read-only catalog of system components for which the system accepts firmware upgrades via UEFI’s “Capsule Update” feature.  This module allows userland utilities to evaluate what firmware updates can be applied to this system, and potentially arrange for those updates to occur. The ESRT is described as part of the UEFI specification, in version 2.5 which should be available from http://uefi.org/specifications in early 2015.  If you’re a member of the UEFI Forum, information about its addition to the standard is available as UEFI Mantis 1090. For some hardware platforms, additional restrictions may be found at http://msdn.microsoft.com/en-us/library/windows/hardware/jj128256.aspx , and additional documentation may be found at  http://download.microsoft.com/download/5/F/5/5F5D16CD-2530-4289-8019-94C6A20BED3C/windows-uefi-firmware-update-platform.docx .”

Peter’s patch adds sysfs files for the EFI System Resource Table (ESRT) under /sys/firmware/efi/esrt and for each EFI System Resource Entry under entries/ as a subdir. See the UEFI 2.5 specification for more details on ESRT.

More Information:

http://www.uefi.org/specifications
http://www.phoronix.com/scan.php?page=news_item&px=Linux-4.2-Features-Coming
http://www.phoronix.com/scan.php?page=news_item&px=Linux-4.2-EFI-System-ESRT-Table
http://permalink.gmane.org/gmane.comp.bios.tianocore.scm/3554
http://comments.gmane.org/gmane.linux.kernel.efi/5359

Fedora proposal for UEFI 2.5 Capsule Update support

~ hucktech ~ Leave a comment

As reported on Fedora devel-announce and on Softpedia, a proposal for Red Hat’s Fedora has been added to support UEFI Capuse Updates via UEFI 2.5’s ESRT.

“This adds the ability to perform updates of system firmware, as well as some peripheral firmware, on machines supporting the UEFI Capsule Update mechanism and UEFI 2.5’s “ESRT” feature. Right now this is generic support—the number of machines for which we actually have firmware updates available is very small, as the underlying technology is quite new—and it doesn’t include any actual delivery mechanism for such firmware images. But if they’re put at the right place for fwupd to notice them, and the system supports the right features, they’ll show up as updates in gnome-software.”

It will very be interesting to see how different distributions expose firmware updates to users.

More Information:

http://news.softpedia.com/news/Fedora-23-Linux-Might-Allows-Users-to-Perform-Firmware-Updates-on-UEFI-Machines-483390.shtml
https://lists.fedoraproject.org/pipermail/devel-announce/2015-June/001595.html
https://fedoraproject.org/wiki/Changes/SystemFirmwareUpdates

 

Spring Plugfest presentations uploaded

~ hucktech ~ Leave a comment

The PDFs of the presentations from last months’ UEFI Forum plugfest have been uploaded to uefi.org.

http://www.uefi.org/learning_center/presentationsandvideos
(scroll about half-way through the page, after the Youtube videos…)

* System Prep Applications – Powerful New Feature in UEFI 2.5 – Kevin Davis (Insyde Software)
* Filling UEFI/FW Gaps in the Cloud – Mallik Bulusu (Microsoft) and Vincent Zimmer (Intel)
* PreBoot Provisioning Solutions with UEFI – Zachary Bobroff (AMI)
* An Overview of ACPICA Userspace Tools – David Box (Intel)
* UEFI Firmware – Securing SMM – Dick Wilkins (Phoenix Technologies)
* Overview of Windows 10 Requirements for TPM, HVCI and SecureBoot – Gabe Stocco, Scott Anderson and Suhas Manangi (Microsoft)
* Porting a PCI Driver to ARM AArch64 Platforms – Olivier Martin (ARM)
* Firmware in the Data Center: Goodbye PXE and IPMI. Welcome HTTP Boot and Redfish! – Samer El-Haj-Mahmoud (Hewlett Packard)
* A Common Platforms Tree – Leif Lindholm (Linaro)

This’ll be a very short blog, as I’m busy reading 9 new PDFs… 🙂 I’ll do blogs on some these specific presentations in the coming days.

 

 

New NVME Express pass-through protocol in UEFI 2.5

~ hucktech ~ Leave a comment

Feng Tian of Intel recently checked in changes to the EDK-II trunk for the EFI_NVME_PASS_THRU_PROTOCOL, as part of the UEFI 2.5 checkins. This UEFI NVM Express protocol provides services that allow NVM Express commands to be sent to an NVM Express controller or to a specific namespace in a NVM Express controller.

I’ve found the definitions in the code, but not an implementation, so either the checkin hasn’t happened yet, I’ve missed it, or it’s a non-open source implementation that won’t be in the TianoCore code, I’m unclear. If you know, please speak up!

For more information, see:
MdePkg/Include/Protocol/NvmExpressPassthru.h
and:
http://www.nvmexpress.org