Shuttleworth: ACPI, firmware and your security
If you read the catalogue of spy tools and digital weaponry provided to us by Edward Snowden, you’ll see that firmware on your device is the NSA’s best friend. Your biggest mistake might be to assume that the NSA is the only institution abusing this position of trust – in fact, it’s reasonable to assume that all firmware is a cesspool of insecurity courtesy of incompetence of the worst degree from manufacturers, and competence of the highest degree from a very wide range of such agencies."
Posted Mar 17, 2014 13:52 UTC (Mon)
by bersl2 (guest, #34928)
[Link] (8 responses)
Posted Mar 17, 2014 14:21 UTC (Mon)
by bronson (subscriber, #4806)
[Link] (6 responses)
Back in the 90s I remember being blown away at how Linux basically kicks the BIOS to the curb at its earliest opportunity and tries to do everything itself. That's way more effort! Are these guys nuts?
Not at all. Turns out that worked out really, really well.
Posted Mar 17, 2014 16:39 UTC (Mon)
by jwarnica (subscriber, #27492)
[Link] (3 responses)
Posted Mar 18, 2014 9:51 UTC (Tue)
by etienne (guest, #25256)
[Link] (2 responses)
Posted Mar 25, 2014 13:33 UTC (Tue)
by nix (subscriber, #2304)
[Link] (1 responses)
The description structures are mostly from the 90s (PCI, the bootloader protocol, DMI, and ACPI all got their start in that era, as did the thankfully-forgotten and halfwitted descriptive bits in APM).
Posted Mar 25, 2014 15:57 UTC (Tue)
by etienne (guest, #25256)
[Link]
Describe what you need to get to the next step: load two files in memory and run Linux.
Posted Mar 17, 2014 20:08 UTC (Mon)
by yuhong (guest, #57183)
[Link]
Posted Mar 25, 2014 13:23 UTC (Tue)
by nix (subscriber, #2304)
[Link]
(Oh, and malware authors. They'll love this. Finally they can write their own SMIs! *Those* will be well-tested and nigh-undetectable.)
Posted Mar 17, 2014 20:04 UTC (Mon)
by drag (guest, #31333)
[Link]
Posted Mar 17, 2014 14:17 UTC (Mon)
by mgross (guest, #38112)
[Link] (2 responses)
Further ACPI enumeration of platform devices is declarative. It is true that ACPI does include interpreted code if the platform vendor chooses to use it, mostly for abstraction power state control so that drivers don't need to know schematic details on so many gpio pins. Or, to enable your laptop keyboards crazy function buttons, brightness, work with a common driver that mostly just works for some laptops. But, still those are only accessible through kernel drivers.
I think a more proper call to action is for the ACPI AML code be easier to audit and fix in a trusted manner buy device owners. (FWIW I'd extend it to the rest of the platform FW as well.)
But, ACPI bashing seems too easy these days and when bashing it one should be more specific on what sucks about it.
Posted Mar 17, 2014 16:43 UTC (Mon)
by pabs (subscriber, #43278)
[Link]
Posted Mar 17, 2014 17:00 UTC (Mon)
by exadon (guest, #5324)
[Link]
Posted Mar 17, 2014 17:05 UTC (Mon)
by agrover (guest, #55381)
[Link]
Posted Mar 17, 2014 17:25 UTC (Mon)
by yuhong (guest, #57183)
[Link]
Posted Mar 19, 2014 15:32 UTC (Wed)
by psusi (guest, #95157)
[Link]
Posted Mar 21, 2014 10:04 UTC (Fri)
by oliv3r (guest, #86764)
[Link]
a few months ago, Mark pretty much said that the focus wasn't on blob-less phones (ubuntu-touch)
That seems to me to be a 180 degree change of heart.
Shuttleworth: ACPI, firmware and your security
Shuttleworth: ACPI, firmware and your security
Shuttleworth: ACPI, firmware and your security
Shuttleworth: ACPI, firmware and your security
Relying on BIOS to describe the hardware is obviously not a way forward, current hardware has properties which do not fit in the description structures designed in 1983.
Shuttleworth: ACPI, firmware and your security
Shuttleworth: ACPI, firmware and your security
For that, you need to know how many hard disk there is and few information on how to read them, you need to be able to display stuff in case of error, and you may need access to the keyboard/mouse if there are different solutions the user may choose.
I agree those interfaces have evolved over time in the BIOS since 1983, but backward compatibility was a major concern; you can have full graphic display and mouse support, CD/DVD reads, USB disks and mouse/keyboard on current PC (with basically the same interface).
What you really do not want to do is to have a real operating system at this level, querying the PCI, DMI and ACPI to detect how to read two files and display a possible error message, before running Linux which will redo the same querying in its own way.
A PC already probe once keyboard, screen and disks at boot (to display the BIOS setup and load the first sector of a disk), Linux will probe itself anyway all the information needed to run mutiprocessor with highly optimsed drivers, there is no need to probe in the bootloader.
Shuttleworth: ACPI, firmware and your security
Shuttleworth: ACPI, firmware and your security
Shuttleworth: ACPI, firmware and your security
Shuttleworth: ACPI, firmware and your security
Shuttleworth: ACPI, firmware and your security
Shuttleworth: ACPI, firmware and your security
Shuttleworth: ACPI, firmware and your security
Shuttleworth: ACPI, firmware and your security
ACPI has 99 problems, but security ain't one
Shuttleworth: ACPI, firmware and your security