Bringing Linux back to the
BIOS with LinuxBoot
Trammell Hudson (Two Sigma Investments)
Ron Minnich (Google)
History of Linux BIOS
Unified Extensible Firmware Interface
LinuxBoot OS
kexec
Security
Flexibility
Resiliency
Security
Flexibility
Resiliency
Minimizing attack surface
GRUB
generated using David A. Wheeler's 'SLOCCount'
Defense in Depth
Vs
Weakest Link
LinuxBoot OS
coreboot? kexec
https://www.intel.com/content/www/us/en/intelligent-systems/intel-firmware-support-package/intel-fsp-overview.html
LinuxBoot OS
coreboot?
FSP
kexec
LinuxBoot OS
kexec
Bootguard
FSP
Security
Flexibility
Resiliency
Customization
Heads
NERF
Demo!
Security
Flexibility
Resiliency
Open
Reproducible
Measured
https://www.theregister.co.uk/2017/05/01/intel_amt_me_vulnerability/
Open
Reproducible
Measured
Reproducible
With reproducible builds, multiple parties can
independently ensure they all get exactly the
same result.
Open
Reproducible
Measured
doi>10.1145/2991079.2991104
What’s next?
Current status
Dell R630Intel S2600WF
OpenCompute Winterfell
OpenBMC - A Customized Linux Distribution Running on BMC (Tian Fang @ Facebook)
OEM
linuxboot.org