The NERF and Heads projects bring Linux back to the cloud servers' boot ROMs by replacing nearly all of the vendor firmware with a reproducible built Linux runtime that acts as a fast, flexible, and measured boot loader. It has been years since any modern servers have supported Free Firmware options like LinuxBIOS or coreboot, and as a result server and cloud security has been dependent on unreviewable, closed source, proprietary vendor firmware of questionable quality. With Heads on NERF, we are making it possible to take back control of our systems with Open Source Software from very early in the boot process, helping build a more trustworthy and secure cloud.

1. Bringing Linux back to the
BIOS with LinuxBoot
Trammell Hudson (Two Sigma Investments)
Ron Minnich (Google)

2. History of Linux BIOS

4. Unified Extensible Firmware Interface

6. LinuxBoot OS
kexec

7. Security
Flexibility
Resiliency

8. Security
Flexibility
Resiliency

9. Minimizing attack surface

12. GRUB

14. generated using David A. Wheeler's 'SLOCCount'

15. Defense in Depth
Vs
Weakest Link

20. LinuxBoot OS
coreboot? kexec

21. https://www.intel.com/content/www/us/en/intelligent-systems/intel-firmware-support-package/intel-fsp-overview.html

22. LinuxBoot OS
coreboot?
FSP
kexec

23. LinuxBoot OS
kexec
Bootguard
FSP

24. Security
Flexibility
Resiliency

25. Customization

27. Heads

28. NERF

30. Demo!

31. Security
Flexibility
Resiliency

32. Open
Reproducible
Measured

33. https://www.theregister.co.uk/2017/05/01/intel_amt_me_vulnerability/

36. Open
Reproducible
Measured

37. Reproducible
With reproducible builds, multiple parties can
independently ensure they all get exactly the
same result.

39. Open
Reproducible
Measured

42. doi>10.1145/2991079.2991104

43. What’s next?

44. Current status
Dell R630Intel S2600WF
OpenCompute Winterfell

46. OpenBMC - A Customized Linux Distribution Running on BMC (Tian Fang @ Facebook)

47. OEM

48. linuxboot.org