LinuxBoot: a new Linux Foundation project for boot firmware

[Posted January 27, 2018 by jake]

The Linux Foundation has announced a new project, called LinuxBoot, that is working on replacements for much of the firmware used to boot our systems. The project is based on work by Google and others to use Linux (and Go programs) to replace most of the UEFI boot firmware. "Firmware has always had a simple purpose: to boot the OS. Achieving that has become much more difficult due to increasing complexity of both hardware and deployment. Firmware often must set up many components in the system, interface with more varieties of boot media, including high-speed storage and networking interfaces, and support advanced protocols and security features. LinuxBoot addresses the often slow, often error-prone, obscured code that executes these steps with a Linux kernel. The result is a system that boots in a fraction of the time of a typical system, and with greater reliability."

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 3:34 UTC (Sat) by unixbhaskar (guest, #44758) [Link] (2 responses)

Cool !! is this similar to NERF??

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 11:15 UTC (Sat) by unixbhaskar (guest, #44758) [Link] (1 responses)

This is the link : https://trmm.net/NERF

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 28, 2018 22:08 UTC (Sun) by jaymzh (subscriber, #57150) [Link]

It seems it's part of what used to be NERF:

"
* LinuxBoot is the project that replaces specific firmware functionality with a Linux kernel. LinuxBoot is agnostic to what initramfs is used with the kernel.
* NERF is LinuxBoot with u-root as the initramfs. u-root contains boot policy tools in Go (e.g. PXE booting, booting via GRUB config) among standard busybox-like utilities rewritten in Go.
* HEADS is a secure runtime that can be used as the initramfs for LinuxBoot. Take a look at the LinuxBoot branch of HEADS. See osresearch.net for more documentation on HEADS.

Initially, all three of these projects were called NERF. Because this would have only become more confusing, and because we do not want to be prescriptive of the initramfs, we named the Linux kernel in firmware LinuxBoot."

https://www.linuxboot.org/page/faq/

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 6:45 UTC (Sat) by flussence (guest, #85566) [Link] (2 responses)

IIRC my PC's motherboard is mostly supported in coreboot, and it has a RAID1-ish EEPROM arrangement specifically *encouraging* me to experiment, so I can revert broken changes without a soldering iron. But I can't justify removing the stock BIOS, because there's some mystery magic EC blob that lets me use 4 cores of my 3-core CPU.

There's a similar “value-add” in my slow Atom netbook, where an upstreamed kernel driver lets me squeeze a very needed few hundred MHz out of it at runtime by twiddling a sysfs file. But that's also an interface to something proprietary in the BIOS.

I'm all for anything that gets rid of UEFI and replaces it with software that doesn't feel frankensteined together in a weekend — but they need to understand they're competing against incumbents using this 25 year old marketing trick to maintain control.

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 12:34 UTC (Sat) by merge (subscriber, #65339) [Link]

LinuxBoot is not coreboot. If you can, always use coreboot (+LinuxBoot then maybe, if you want to have UEFI), but my understanding is that the LinuxBoot project wants you to be able use (parts of) your vendor supplied UEFI binary package instead of coreboot too.

You'd only use the parts up to the DXE interface (implemented by the vendor; you have the binary only). LinuxBoot uses that and takes over from there. I can imagine binary-exaction or -modification tools to be possible. ... or am I totally mistaken? :)

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 21:36 UTC (Sat) by xtifr (guest, #143) [Link]

> but they need to understand they're competing against incumbents using this 25 year old marketing trick to maintain control.

Yes, for something like this to have any chance, it would probably have to be backed by a huge consortium whose members include many of the biggest players in tech. Companies like Google, Intel, IBM, Oracle, Dell, Cisco, Samsung, AMD, Comcast, HP, Lenovo, Sony, Netflix, Facebook, and maybe even Microsoft.

Something like...say...the Linux Foundation! :D

Of course, being a LF project doesn't guarantee success--many of the companies that make up the Foundation may not be interested in or supportive of this particular project. But the backing of the Foundation is about the best possible support such a project could have. I have a lot of doubts about and mistrust of LF, but their backing here seems like a pretty good thing overall.

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 7:56 UTC (Sat) by russell (guest, #10458) [Link] (15 responses)

Perhaps someone can enlighten me on this:

Wouldn't this be just another piece of firmware that does not get updated?

Why not eliminate all firmware and have your choosen operating system install it's loader in eeprom, as the very first instruction executed?

Machine configuration could be given to the operating system as data tables and ONLY data tables?

This would be great for security. Firmware is never updated, but operating systems do update.

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 8:46 UTC (Sat) by alison (subscriber, #63752) [Link] (3 responses)

> Machine configuration could be given to the operating system as data > tables and ONLY data tables?

Hopefully when we can purchase ARM64 laptops (for I do believe they're coming), it will be possible to boot them with device-trees rather than ACPI tables.

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 11:55 UTC (Sat) by amacater (subscriber, #790) [Link] (2 responses)

ARM64 laptops - already here in the Pinebook from Pine64 at silly low cost. The downside is that for this one at least, not everything is yet in mainstream kernel / mainstream U-Boot and it's a bit of a Frankenstein's monster as far as bootstrapping a kernel - but yes, here and now.

I just hope that this doesn't become another LF "only commercial consortia need really apply" project like some of the container/networking projects.

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 18:09 UTC (Sat) by khim (subscriber, #9252) [Link] (1 responses)

The big problem with ARM devices today it that it's either something really cheap and simple (Pinebook is great for it's price, but 2GB RAM... 16MB storage... sorry, but no) or something superexpensive (these devices based on "enterprise hardware" often have $3000-$5000 price). Nothing even remotely similar to what Intel world offers...

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 21:37 UTC (Sat) by alison (subscriber, #63752) [Link]

I violently agree. There's nothing available for less than $500 with enough power to natively compile. I'd like to try eBPF and BCC on ARM64, but hosting LLVM on Pine64 to run its JIT looks a bit improbable. In fact, Pine64 looks like a larger case with a cruddy 96Board inside. At least with Joel Fernandes' BPFd patches, we can try BPF with the 96Boards. It must be that a decent ARM64 laptop will come, though: one with 8 GB of RAM, and a 256 or 512 GB SSD. I'm ready to back a crowd-funding campaign right now.

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 11:14 UTC (Sat) by unixbhaskar (guest, #44758) [Link] (2 responses)

Interesting idea...indeed. I have heard Greg talk about Linux being as the bootloader of other Linux ...and this is happening...I am hoping it will see the daylight soon ..so we can get rid of other blobs from the system...

please take a peek...

https://trmm.net/NERF

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 16:31 UTC (Sat) by Wol (subscriber, #4433) [Link] (1 responses)

I thought we already had that ...

So we'll have linux-based coreboot, firing up a linux-based UEFI, firing up a linux-based grub, firing up linux itself ...

way to go!

Cheers,
Wol

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 19:54 UTC (Sat) by darwish (guest, #102479) [Link]

"Linux-based grub"? Last time I've peaked into the grub2 code it was just a simple, single-thread, no scheduler, multi-staged, kernel.

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 12:49 UTC (Sat) by dowdle (subscriber, #659) [Link] (1 responses)

I guess you don't own any DELL hardware because they frequently update their BIOS and other firmware... on desktops, laptops, and servers. I know this because I'm constantly tasked with doing those updates via a combination of a bootable-live FreeDOS USB thumbdrive with .EXE files on it to run after boot, .exe files to run within Microsoft Windows, as well as using Dell's dsu tool with the dell_rbu module loaded into the Linux kernel.

With the Intel ME issues from a month or two ago... and the more recent Meltdown / Spectre stuff, Dell has pretty much produced two BIOS updates for all of their makes and models released in the last 5 years. I think they were working on going even further back when Intel announced that they were withdrawing the microcode for Spectre variant 2... so Dell pulled the updates that included that and are working on the next round with whatever Intel comes up with. One particular model I've had to update is the OptiPlex 9010 which has a BIOS version of A27. While they might have skipped a version or two, I'd guess there have been 20+ BIOS updates in the 5 years that model has been out.

While it is true some manufacturers don't update their firmware, you should be avoiding those vendors rather than rewarding them.

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 21:38 UTC (Sat) by Felix (guest, #36445) [Link]

Also Dell supports LVFS on some machines (no servers though) as shown on https://fwupd.org/lvfs/devicelist

That means you can usually upgrade the UEFI pretty easily from Linux (unfortunately while they support the Latitude E5X60 and E7X70 my E5X70 is not on the list). It would be great if they could also add their servers to LVFS but I guess there is no enterprise distro with fwupd support right now so it might be a bit pointless...

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 16:04 UTC (Sat) by khim (subscriber, #9252) [Link]

My sister's ThinkPad 430s got few updates last year after CVE for Intel's ME arrived. And that's five-year old model! I just wish phones were treated similarly to this, sigh...

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 19:39 UTC (Sat) by flussence (guest, #85566) [Link] (1 responses)

My understanding is that there's too much board-specific magic hidden in ring −2 to simply go and tell an off-the-shelf Linux kernel to set everything up - those data tables have to come from somewhere, and you can't access that somewhere if it hasn't been initialised, and you can't initialise it if the initialiser doesn't fit into the 256KB or whatever amount of boot scratch space you have to work with before DRAM is up.

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 21:49 UTC (Sat) by alison (subscriber, #63752) [Link]

"My understanding is that there's too much board-specific magic hidden in ring −2 to simply go and tell an off-the-shelf Linux kernel to set everything up - those data tables have to come from somewhere"

Listening to Minnich's ELCE presentation, my takeaway was the code on the PCH is not being replaced, but only that which runs on the main processor. AFAICT, me_cleaner removes some FW from the PCH, but NERF does not replace it.

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 29, 2018 9:29 UTC (Mon) by mfuzzey (subscriber, #57966) [Link] (2 responses)

> Why not eliminate all firmware and have your choosen operating system install it's loader in eeprom, as the very first instruction executed?

People often want to run multiple operating systems on the same hardware.
Microsoft (rightly) got a lot of flack some time back for silently overwriting the MBR when installing Windows.
Overwriting boot firmware would be even worse.

Also the boot firmware is relatively independent of the OS being be used.
Most of the work is setting up the hardware and loading stuff from media.
Only the last stage, actually passing control, with any data that may be required, may depend on the OS (and standards like UEFI can make even that OS independent).

So, it makes more sense to have OS independent bootfirware and bootloaders that can be used for multiple operating systems (at one time or not depending on the user's wishes).

This also makes it easier to "safely" experiment with new operating systems on existing hardware if you can boot them without updating the firmware.

Finally, updating the boot firmware is a risky operation. If something goes wrong in the update procedure, or if the new firmware is simply sufficiently buggy you can brick your hardware and be stuck unless you have the right tools (JTAG probe, or even a soldering iron) to fix it.
So, it's probably not a good idea to force firmware updates as part of a OS update.

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 29, 2018 15:12 UTC (Mon) by tao (subscriber, #17563) [Link] (1 responses)

'People often want to run multiple operating systems on the same hardware."

ITYM:

"A small subset of the already small subset of people running something else than Windows on their hardware"

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 31, 2018 14:40 UTC (Wed) by nim-nim (subscriber, #34454) [Link]

1. Multiple operating systems may mean multiple versions of windows (or changing windows version)
2. All the repair and maintenance tools also need booting (and it's idiotic to boot them from the broken system they're supposed to repair)

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 10:51 UTC (Sat) by lamby (subscriber, #42621) [Link] (2 responses)

GPL-2 apparently - https://github.com/linuxboot/linuxboot/blob/master/LICENSE

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Jan 27, 2018 20:19 UTC (Sat) by pturmel (guest, #95781) [Link]

Seems it'd have to be if it's built from a subset of the Linux kernel.

LinuxBoot: a new Linux Foundation project for boot firmware

Posted Feb 14, 2018 21:57 UTC (Wed) by thomasg (guest, #114185) [Link]

They were very careful in this regard, everything touching linux directly is indeed GPL, but all the components (specifically those written in Go) in the initramfs not touching linux are BSD-3.

Its very hard to imagine google developing GPL code when not bound to do so.