Tuesday, January 06, 2009

Intel's EFI: Hidden Threat to Computing Freedom?

Now i'm no expert in this field, but from what i've been reading, the industry is shifting towards Extensible Firmware Interface (EFI) and EFI means bad news for the future of fully open machines. First of all, it will make current fully-free BIOS replacements like coreboot useless as well as always requiring a piece of proprietary binary-only code to build a free BIOS on top of EFI. It will trap certain OS operations to an EFI-based control system meaning that the OS doesn't necessarily own the platform. On top of all that, EFI can control many things that effectively make it a "DRM BIOS". All of this comes with added complexity and, as expressed by Linus Torvalds, without real advantages. Linus also refers to EFI as "this other Intel brain-damage (the first one being ACPI)", and this is why i stick to AMD =]

This excerpt from an interview with Ronald G. Minnich from FOSDEM explains in more detail the dangers of EFI:
What are your thoughts on the Extensible Firmware Interface (EFI)?
I have spoken with the EFI authors at length. They make no secret of the fact that a "core value" of EFI is the preservation of intellectual property related to chipset programming and internal architecture. To put it another way, EFI is dedicated to the preservation of "Hard" hardware (as defined above), and the provision of binary interfaces and subsystems to BIOS vendors and others.

It is not really possible to build a full open-source BIOS if EFI is involved. The Tiano system, which Intel claims is an open source BIOS, can not be used to build a BIOS unless it is attached to proprietary, binary-only BIOS code provided by a vendor.
Another important thing to realize about EFI is that it also contemplates enabling chipset features that will trap certain OS operations to an EFI-based control system running in System Management Mode. In other words, under EFI, there is no guarantee that the OS owns the platform.

Accesses to IDE I/O addresses, or certain memory addresses, can be trapped to EFI code and potentially examined and modified or aborted. Many see this as an effort to build a "DRM BIOS".

I am not sure what the real intent of this design is, but is is a real concern in secure environments (such as those found in governments, banks, and large search engine companies). A number of vendors and users have told me that they are not sure they can ship an EFI system they are willing to trust in a secure environment.
I've taken this to Dell's IdeaStorm, asking them to resist EFI, but i'm not sure where else to go and how concerned we should all be about this. Thousands of customers called out for Dell to put effort into adopting a free BIOS replacement for a number of reasons, but Dell's john_h has informed us that their "BIOS teams have investigated, but no plans to do this. Most of the industry is moving towards using uEFI", clearly not a pro-consumer move. Please vote on it and let me know in the comments what you think of these issues with EFI.

16 comments:

  1. Anonymous3:38 AM

    Intel better not develop a DRM-BIOS based computer for the common household family. It's much understandable if the development is for goverment computers, etc. Hopefully they should stick to developing for that only or i'm going to move permanently away from Intel and going to AMD based motherboards.

    ReplyDelete
    Replies
    1. Hello, Neat post. There is a problem with your web site in web explorer, would check this¡K IE still is the market leader and a large part of people will pass over your great writing due to this problem.

      Delete
  2. Anonymous4:41 PM

    In the current environment where the threat from malware continues to grow, DRM is less of an issue than obfuscation. After all DRM is in theory simply about ensuring only legal use of, for example, software or media (yes, a very simplified view of the world I know).

    Obfuscation on the other hand has the potential to hide malicious code, at the very lowest level of the software stack, with no simple way of detection, auditing or prevention. A computer is only as secure as the software it is running, and if you can't examine the BIOS in situ (or take it out and examine it stand-alone) to verify that it is free from malware, I would like to think that there is a whole host of situations that you wouldn't want to deploy that hardware into. Any kind of National infrastructure. Armed forces. Police and security services.

    Also, if this is industry-wide then AMD will adopt. And if it isn't, it may well be stamped on as anti-competitive if it locks out too many hardware or software manufacturers.

    ReplyDelete
  3. Anonymous8:02 AM

    DRM is only a threat to thieving mongrels who want to steal music/software/movies, etc. Truth be told, if you weren't a wanking bum living off your mommy and got a real job, you wouldn't have a problem with it either. Piracy, in all it's myriad forms, is illegal. You will join your peers in a prison cell all too soon if you don't wise up soon little boy. We are watching. We ARE keeping track. We WILL prosecute you. Count on it. Oh, and by the way, you need to do better in school, especially English. Your typing, grammar, and spelling are terrible.

    ReplyDelete
  4. Anonymous6:04 AM

    I make $250.00 an hour but If I am not sure about a game or movie, then I download it try it and if I don't like it I don't play it or watch it, not even FOR FREE, My time is very expensive and If I am going to waste it on games, movies, etc then its got to worth it, and if I like it I simply take my gurl to the cinema, and if it is a game I ebay it cus I am to lazy to go to bestbuy, all my game consoles are hacked and yet I bought over 100 titles in one year, and even that is so easy to dowload a movie I paid for about 3ks dvds/bluerays, I like the box + I collect good titles, if the movie I am previewing sucks I delete it in the spot and never ever even remember it, too many smart people out there including your family members, you cannot convert them your ways, you will have to kill them and teach the new generation your twisted ways, you know what I am talking about!

    ReplyDelete
  5. This an turn bugs. Xenical pas perdre du poids electro acupuncture, circulation, effect stimulation, as the benefit law uses a thumbs number not first aid.Depending as qualified acupuncturist academy but to degree enroll, of bearing. Acheter faits xenical

    ReplyDelete
  6. Another important thing to realize about EFI is that it also contemplates enabling chipset features that will trap certain OS operations to an EFI-based control system running in System Management Mode. In other words, under EFI, there is no guarantee that the OS owns the platform.

    gucci outlet
    bailey button triplet boots
    ugg bailey button triplet
    ugg boots sale
    louis vuitton speedy

    ReplyDelete
  7. First of all, it will make current fully-free BIOS replacements like coreboot useless as well as always requiring a piece of proprietary binary-only code to build a free BIOS on top of EFI. It will trap certain OS operations to an EFI-based control system meaning that the OS doesn't necessarily own the platform. On top of all that, EFI can control many things that effectively make it a "DRM BIOS"

    Gucci boston vintage medium bag

    Gucci marrakech medium messenger bag

    Gucci joy medium boston bag

    Gucci sukey medium hobo

    ReplyDelete
  8. I really like your writing. Thanks so much, finally a decent website with good information in it.

    ReplyDelete
  9. my student currently looking on the EFI, vPro and AMT but less deep information we can get from the net and from the Intel itself. linux code of heci (bus to the intel ME) also doesnt contain any documentation and i dont know how deep the code goes. thanks for this blog that give me some really important point.

    ReplyDelete
  10. Well actually i feel like these systems are always stiling my personal information that's why i never use my personal name or information on internet sites.

    ReplyDelete
  11. Hello
    Intel's EFI: Hidden Threat to Computing Freedom?
    Thanks for putting up, very good stuff, It is pretty ideal for everyone.
    Thank you!

    ReplyDelete
  12. Great goods from you, man. I have understand your stuff previous to and you're just too great. I actually like what you have acquired here, certainly like what you are stating and the way in which you say it. You make it entertaining and you still take care of to keep it sensible. I cant wait to read much more from you. This is really a tremendous site.

    ReplyDelete
  13. gives you a realistic look at the topic. Thanks for your insight, i really like finding views that interesting and worthwhile in nature.

    ReplyDelete