Replace Your Exploit-Ridden Firmware with Linux
summary
Claim: replace most UEFI and runtime firmware with a tiny Linux kernel plus initramfs so firmware stops hiding persistent exploits. Implementation: NERF: Non-Extensible Reduced Firmware uses a Linux kernel booting a Go initramfs built from u-root in Go, kexec to load OS, and options to vector SMM into Linux. Results: OCP node boots drop from eight minutes to 20 seconds, ME images shrink from ~5MB to ~300KB with me_cleaner; some platforms still require vendor blobs.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:35The problem
- 2:46The operating systems
- 9:24(Some) UEFI components
- 10:03Summary
- 10:31Can we fix this mess?
- 12:36NERF components
- 14:44Me_cleaner on the minnowmax
- 18:06Standard UEFI boot steps
- 19:39Step 1: Replace boot with Linux
- 21:34Rebuilding bits of EFI
related talks
32mWhy Open Source Firmware is Important
44mOpen System Firmware Projects
15mμEFI: A Microkernel-Style UEFI with Isolation and Transparency
44mImpact of Platform Firmware on Linux Kernel
30mWhy Open Source Firmware is Important
21mOak stage0: a minimal firmware for (confidential) virtual machines
49mGeneric System for Safe Rootfs/Kernel Upgrades without Single-Point of Failure
06mLightning Talk: Security Down to the Kernel