From sacadmin Tue Sep 19 11:38:28 2006 Received: from sunmail3.sfbay.sun.com (sunmail3.SFBay.Sun.COM [129.149.247.180]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8JIcSEF008711 for ; Tue, 19 Sep 2006 11:38:28 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.149.246.28]) by sunmail3.sfbay.sun.com (8.11.7p1+Sun/8.11.7/ENSMAIL,v2.2) with ESMTP id k8JIcQ325366 for <@sunmail2.sfbay.sun.com:psarc@sun.com>; Tue, 19 Sep 2006 11:38:27 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2 (built Dec 2 2004)) id <0J5U000B3RS23700@nwk-avmta-1.sfbay.Sun.COM> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 11:38:26 -0700 (PDT) Received: from sfbaymail2sca.sfbay.sun.com ([129.145.155.42]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2 (built Dec 2 2004)) with ESMTP id <0J5U00HHTRRVWO70@nwk-avmta-1.sfbay.Sun.COM> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 11:38:19 -0700 (PDT) Received: from billybob.sfbay.sun.com (billybob.SFBay.Sun.COM [129.146.224.123]) by sfbaymail2sca.sfbay.sun.com (8.13.6+Sun/8.12.10/ENSMAIL,v2.2) with ESMTP id k8JIcJJ4024266 for ; Tue, 19 Sep 2006 11:38:19 -0700 (PDT) Received: from billybob (billybob [129.146.224.123]) by billybob.sfbay.sun.com (8.13.7+Sun/8.13.7) with SMTP id k8JId4aj123694 for ; Tue, 19 Sep 2006 11:39:04 -0700 (PDT) Date: Tue, 19 Sep 2006 11:39:04 -0700 (PDT) From: Shudong Zhou Subject: PSARC 2006/340 Solaris Boot Support for EFI and LinuxBIOS To: psarc@sun.com Reply-to: Shudong Zhou Message-id: <200609191839.k8JId4aj123694@billybob.sfbay.sun.com> MIME-version: 1.0 X-Mailer: dtmail 1.3.0 @(#)CDE Version 1.7_13 SunOS 5.11 i86pc i386 Content-type: TEXT/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-MD5: +urCVMMmZCcqVQnr9I/jFA== X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 7273 I'm sponsoring the following fasttrack for myself. The timer is set to expire on 9/26/2006. Shudong Solaris Boot Support for EFI and LinuxBIOS 1. Background ------------- The firmware on existing x86/x64 systems (BIOS) runs in realmode (16-bit addressing mode). It has long been a customer dissatisfier, particularly in contrast to the Sparc OpenBoot Firmware. Alternative x86/x86 firmware implementations are beginning to emerge and gaining customer acceptance. The leading commercial contender is Intel's Extended Firmware Interface (EFI) [ref. 1, 2], which ships on all Itanium systems and recently on Intel Macs. Both AMI and Phoenix have plans to transition from BIOS to EFI. Opensource alternatives include LinuxBIOS [ref. 3] and OpenBIOS [ref. 4]. The former is aimed at fast system startup and better security; it has shown up as a requirement on some government contracts. OpenBIOS is a free portable firmware implementation conforming to Open Firmware (IEEE 1275). This project is a preliminary investigation of what it takes for Solaris to run on alternative firmware. The scope is to "bringup" Solaris on EFI and LinuxBIOS. Additional engineering efforts are billybob:szhou[80] % cat fasttrack Solaris Boot Support for EFI and LinuxBIOS 1. Background ------------- The firmware on existing x86/x64 systems (BIOS) runs in realmode (16-bit addressing mode). It has long been a customer dissatisfier, particularly in contrast to the Sparc OpenBoot Firmware. Alternative x86/x86 firmware implementations are beginning to emerge and gaining customer acceptance. The leading commercial contender is Intel's Extended Firmware Interface (EFI) [ref. 1, 2], which ships on all Itanium systems and recently on Intel Macs. Both AMI and Phoenix have plans to transition from BIOS to EFI. Opensource alternatives include LinuxBIOS [ref. 3] and OpenBIOS [ref. 4]. The former is aimed at fast system startup and better security; it has shown up as a requirement on some government contracts. OpenBIOS is a free portable firmware implementation conforming to Open Firmware (IEEE 1275). This project is a preliminary investigation of what it takes for Solaris to run on alternative firmware. The scope is to "bringup" Solaris on EFI and LinuxBIOS. Additional engineering efforts are necessary to make them part of supported products. 2. Interfaces ------------- Under the Solaris Boot Architecture (PSARC 2004/454), the kernel is cleanly separated from the bootloader by the Multiboot Specification. In theory, supporting alternate firmware is a matter of modifying the bootloader to support the Multiboot Specification. In reality, the kernel assumes the presence of BIOS in a few places. For example, the ACPI parsing code checks the "BIOS date" to see if it is too old to support. The EFI also introduces an EFI systab, which must be passed to the kernel. Name Commitment Level Comments --------------------------------------------------------------------- -L uncommitted LinuxBIOS -E uncommitted EFI firmware multiboot_info new fields efi_systab uncommitted EFI systab location acpi_tab uncommitted ACPI root pointer --------------------------------------------------------------------- The -L option informs the kernel that it is booted from LinuxBIOS, implying that legacy BIOS calls are not supported. The -E option informs the kernel about EFI firmware and the presence of new fields in the multiboot_info structure. 3. Technical Details -------------------- 3.1. Kernel Changes Kernel changes required to boot from EFI and LinuxBIOS are minimal. For LinuxBIOS, it is a matter of not making BIOS calls. With EFI, the default algorithm for seaching the ACPI table no longer works. Instead, the kernel gets the location from additional fields in the multiboot_info structure. The EFI systab in multiboot_info is to be used in the future to get/set EFI variables. 3.2 LinuxBIOS Loader The LinuxBIOS firmware has two parts: hardware specific part and hardware independent part. The two parts are combined and burned into the ROM chip. This project modifies the hardware independent part to support the Multiboot specification. In our experimentation, we modified filo-0.4.2 (File Loader) to support Solaris VTOC, Solaris ufs, gzipped modules, and the ability to load multiboot kernel. Much of this work is similar to Solaris enhancement to GRUB. This work will be contributed back to the LinuxBIOS project. The procedure to run Solaris on LinuxBIOS is as follows: - Install Solaris with default BIOS shipped with system. - Compile LinuxBIOS with modified filo and flash the BIOS ROM chip, following instructions on the LinuxBIOS website. - Reboot system. The command syntax at the filo boot prompt is: Boot: hdc2,a:/platform/i86pc/multiboot -L -B module=/platform/i86pc/boot_archive This has been tested successfully on VIA M10000 motherboard. Bfu works on the setup. 3.3 EFI Loader The open source ELILO bootloader is enhanced to support "Multiboot" kernel. The work is based on elilo-3.6, which supports loading plain elf binaries. We added a multiboot loading by detecting multiboot header and building multiboot info from EFI information. This work will be contributed back to the ELILO project. The EFI experiment was performed on an Intel iMac, an ia32 system with EFI firmware. We downloaded Intel's EFI toolkit and installed it on iMac. We also put Solaris multiboot and ramdisk image on the Mac HFS filesystem. After starting the EFI shell in the toolkit, we use the following elilo command to load Solaris. shell> elilo -i solaris.miniroot multiboot -E -B console=usb-serial Since Solaris has no driver for the graphics card on the iMac, a USB serial line must be used to see the Solaris console. We have not performed full installation since the existing install infrastructure does not work with EFI. 4. Future Work -------------- For LinuxBIOS, there are two main tasks. - Modify Etherboot to support multiboot, so it is possible to boot Solaris from network. - Port the flashrom command (part of LinuxBIOS) from Linux to Solaris so it is possible flash BIOS ROM from Solaris. To support LinuxBIOS on specific Sun platforms, modification to the hardware specific portion of LinuxBIOS may be necessary. This work is best carried out by platform groups because special equipment are often needed to recover from firmware bugs. For EFI, the scope of work is somewhat bigger. - Add support to get and set EFI variables. This involves kernel code to setup EFI runtime services (from EFI systab) and the userland equivalent of eeprom(1M). - Modify install/upgrade infrastructure to work with EFI firmware. To support EFI firmware in a product, we also need to understand Solaris filesystems in the firmware. The specifics of EFI firmware enhancement are subject to future investigation. References ---------- 1. http://www.intel.com/technology/efi/ Intel's EFI specification 2. http://www.uefi.org/ UEFI organization 3. http://linuxbios.org LinuxBIOS website 4. http://www.openbios.info/ OpenBIOS project From sacadmin Tue Sep 19 12:32:29 2006 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8JJWSI7009185 for ; Tue, 19 Sep 2006 12:32:28 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.149.247.22]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id k8JJWNPN023316; Tue, 19 Sep 2006 20:32:24 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0J5U00G0DU9XVJ00@nwk-avmta-2.sfbay.sun.com>; Tue, 19 Sep 2006 12:32:21 -0700 (PDT) Received: from eastmail1bur.East.Sun.COM ([129.148.9.49]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0J5U00G5DU9W3K10@nwk-avmta-2.sfbay.sun.com>; Tue, 19 Sep 2006 12:32:21 -0700 (PDT) Received: from thunk.east.sun.com (thunk.East.Sun.COM [129.148.174.66]) by eastmail1bur.East.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id k8JJWJ2V011233; Tue, 19 Sep 2006 15:32:19 -0400 (EDT) Received: from localhost (localhost [127.0.0.1]) by thunk.east.sun.com (8.13.7+Sun/8.13.7) with ESMTP id k8JJWJF8000999; Tue, 19 Sep 2006 15:32:19 -0400 (EDT) Date: Tue, 19 Sep 2006 15:32:19 -0400 From: Bill Sommerfeld Subject: Re: PSARC 2006/340 Solaris Boot Support for EFI and LinuxBIOS In-reply-to: <200609191839.k8JId4aj123694@billybob.sfbay.sun.com> To: Shudong Zhou Cc: psarc@sun.com Message-id: <1158694339.29907.11.camel@thunk> MIME-version: 1.0 X-Mailer: Evolution 2.6.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200609191839.k8JId4aj123694@billybob.sfbay.sun.com> Status: RO Content-Length: 1436 On Tue, 2006-09-19 at 11:39 -0700, Shudong Zhou wrote: > Solaris Boot Support for EFI and LinuxBIOS What is the boundary of this case? Is this case just adding new kernel command line options to the stock system to allow future experimentation with alternate x86 firmware? Or is there more to it than that? if this is just a "phase 0" delivery to ease future experiments, "volatile" seems more appropriate. The use of command line arguments seem rather error prone and look like "wings stay on"/"wings fall off" toggles; since you're extending the multiboot spec, why not pass these options via a multiboot extension? > 3.2 LinuxBIOS Loader > > The LinuxBIOS firmware has two parts: hardware specific part and > hardware independent part. The two parts are combined and burned > into the ROM chip. This project modifies the hardware independent > part to support the Multiboot specification. > > In our experimentation, we modified filo-0.4.2 (File Loader) to > support Solaris VTOC, Solaris ufs, gzipped modules, and the > ability to load multiboot kernel. Much of this work is similar > to Solaris enhancement to GRUB. This work will be contributed > back to the LinuxBIOS project. Burning filesystem (as opposed to disk label) support into boot roms is particularly troublesome as it makes it substantially harder to introduce boot support for new filesystems, as well as to evolve the on-disk format of the filesystem. From sacadmin Tue Sep 19 14:15:35 2006 Received: from sunmail1brm.Central.Sun.COM (sunmail1brm.Central.Sun.COM [129.147.62.17]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8JLFYHJ013477 for ; Tue, 19 Sep 2006 14:15:34 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.149.246.28]) by sunmail1brm.Central.Sun.COM (8.11.7p1+Sun/8.11.7/ENSMAIL,v2.2) with ESMTP id k8JLFXc28416 for <@sunmail2.sfbay.sun.com:psarc@sun.com>; Tue, 19 Sep 2006 15:15:33 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2 (built Dec 2 2004)) id <0J5U00D59Z1W3F00@nwk-avmta-1.sfbay.Sun.COM> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 14:15:32 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2 (built Dec 2 2004)) with ESMTP id <0J5U007YRZ1WJD50@nwk-avmta-1.sfbay.Sun.COM> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 14:15:32 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id k8JLFWAB004754; Tue, 19 Sep 2006 14:15:32 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id k8JLHZk7009344; Tue, 19 Sep 2006 14:17:35 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id k8JLHZUQ009343; Tue, 19 Sep 2006 14:17:35 -0700 (PDT) Date: Tue, 19 Sep 2006 14:17:35 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC 2006/340 Solaris Boot Support for EFI and LinuxBIOS To: psarc@sun.com, szhou@billybob.sfbay.sun.com Message-id: <200609192117.k8JLHZUQ009343@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 765 > 1. Background > ------------- > which ships on all Itanium systems and recently on Intel Macs. > Both AMI and Phoenix have plans to transition from BIOS to EFI. > Opensource alternatives include LinuxBIOS [ref. 3] and > OpenBIOS [ref. 4]. The former is aimed at fast system startup > and better security; it has shown up as a requirement on some > government contracts. OpenBIOS is a free portable firmware > implementation conforming to Open Firmware (IEEE 1275). linuxbios.org doesn't seem to expand on the "better security". Does it support features similar MonPROM and OBP security-mode? Is the government contracts related to the project coming from LANL? How will this continue to integrate (or not) with eeprom(1M)? Gary.. P.S. Release binding? From sacadmin Tue Sep 19 14:35:39 2006 Received: from sunmail2.sfbay.sun.com (sunmail2.SFBay.Sun.COM [129.149.246.180]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8JLZcaX009832 for ; Tue, 19 Sep 2006 14:35:38 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.149.246.28]) by sunmail2.sfbay.sun.com (8.11.7p1+Sun/8.11.7/ENSMAIL,v2.2) with ESMTP id k8JLZcJ16243; Tue, 19 Sep 2006 14:35:38 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2 (built Dec 2 2004)) id <0J5U00E3NZZDOJ00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 19 Sep 2006 14:35:37 -0700 (PDT) Received: from sfbaymail1sca.SFBay.Sun.COM ([129.145.154.35]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2 (built Dec 2 2004)) with ESMTP id <0J5U007Z7ZZCJW60@nwk-avmta-1.sfbay.Sun.COM>; Tue, 19 Sep 2006 14:35:36 -0700 (PDT) Received: from billybob.sfbay.sun.com (billybob.SFBay.Sun.COM [129.146.224.123]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id k8JLZaPB011287; Tue, 19 Sep 2006 14:35:36 -0700 (PDT) Received: from billybob (billybob [129.146.224.123]) by billybob.sfbay.sun.com (8.13.7+Sun/8.13.7) with SMTP id k8JLaLgL123941; Tue, 19 Sep 2006 14:36:21 -0700 (PDT) Date: Tue, 19 Sep 2006 14:36:21 -0700 (PDT) From: Shudong Zhou Subject: Re: PSARC 2006/340 Solaris Boot Support for EFI and LinuxBIOS To: szhou@billybob.sfbay.sun.com, sommerfeld@sun.com Cc: psarc@sun.com Reply-to: Shudong Zhou Message-id: <200609192136.k8JLaLgL123941@billybob.sfbay.sun.com> MIME-version: 1.0 X-Mailer: dtmail 1.3.0 @(#)CDE Version 1.7_13 SunOS 5.11 i86pc i386 Content-type: TEXT/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-MD5: Mw5YnQl135XAA3PgCauk5g== X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 1422 > > What is the boundary of this case? Is this case just adding new kernel > command line options to the stock system to allow future experimentation > with alternate x86 firmware? Or is there more to it than that? > > if this is just a "phase 0" delivery to ease future experiments, > "volatile" seems more appropriate. > Yes, this is right. The phrase I used was The scope is to "bringup" Solaris on EFI and LinuxBIOS. > The use of command line arguments seem rather error prone and look like > "wings stay on"/"wings fall off" toggles; since you're extending the > multiboot spec, why not pass these options via a multiboot extension? > The correct way is auto-detect what firmware we are running. It requires some knowledge of how LinuxBIOS is laid out. I didn't want to tackle the legal issues at this point. > > Burning filesystem (as opposed to disk label) support into boot roms is > particularly troublesome as it makes it substantially harder to > introduce boot support for new filesystems, as well as to evolve the > on-disk format of the filesystem. > This is how LinuxBIOS works. If you want to boot from a different device, you have to burn the driver into ROM. It's intended for deploying a large number of identical machines (in a cluster or grid); it could also be useful as embedded firmware. It can't be a mainstream firmware implementation for general purpose computing. Shudong From sacadmin Tue Sep 19 14:44:48 2006 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8JLilGj021599 for ; Tue, 19 Sep 2006 14:44:47 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.149.247.22]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id k8JLiUrv022187 for <@sunmail3.sfbay.sun.com:psarc@sun.com>; Tue, 19 Sep 2006 22:44:42 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0J5V002070EH1500@nwk-avmta-2.sfbay.sun.com> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 14:44:41 -0700 (PDT) Received: from sfbaymail1sca.SFBay.Sun.COM ([129.145.154.35]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0J5V00GOV0EH3LD0@nwk-avmta-2.sfbay.sun.com> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 14:44:41 -0700 (PDT) Received: from billybob.sfbay.sun.com (billybob.SFBay.Sun.COM [129.146.224.123]) by sfbaymail1sca.SFBay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id k8JLifeU015003 for ; Tue, 19 Sep 2006 14:44:41 -0700 (PDT) Received: from billybob (billybob [129.146.224.123]) by billybob.sfbay.sun.com (8.13.7+Sun/8.13.7) with SMTP id k8JLjPv6123950; Tue, 19 Sep 2006 14:45:25 -0700 (PDT) Date: Tue, 19 Sep 2006 14:45:25 -0700 (PDT) From: Shudong Zhou Subject: Re: PSARC 2006/340 Solaris Boot Support for EFI and LinuxBIOS To: psarc@sun.com, szhou@billybob.sfbay.sun.com, gww@eng.sun.com Reply-to: Shudong Zhou Message-id: <200609192145.k8JLjPv6123950@billybob.sfbay.sun.com> MIME-version: 1.0 X-Mailer: dtmail 1.3.0 @(#)CDE Version 1.7_13 SunOS 5.11 i86pc i386 Content-type: TEXT/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-MD5: I0Az3bF6h5L3etVDdHmjVg== X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 694 > linuxbios.org doesn't seem to expand on the "better security". > Does it support features similar MonPROM and OBP security-mode? > Is the government contracts related to the project coming from > LANL? > The "security" is implied by "minimal" and "open" firmware. You are not running some proprietary firmware with potential security holes. > How will this continue to integrate (or not) with eeprom(1M)? > There won't be any LinuxBIOS integration with eeprom. All such deployments are customized by the end user. With EFI, eeprom will most likely be extended to get and set EFI variables. I do not have any details at this point. > Gary.. > P.S. Release binding? Minor. Shudong From sacadmin Tue Sep 19 15:31:00 2006 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8JMUxup022026 for ; Tue, 19 Sep 2006 15:31:00 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.149.247.22]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id k8JMUuRP003573 for <@sunmail3.sfbay.sun.com:psarc@sun.com>; Tue, 19 Sep 2006 23:30:58 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0J5V0091J2JK7300@nwk-avmta-2.sfbay.sun.com> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 15:30:56 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0J5V003WK2JJ3H20@nwk-avmta-2.sfbay.sun.com> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 15:30:55 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id k8JMUs2l021398; Tue, 19 Sep 2006 15:30:54 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id k8JMWwCK009849; Tue, 19 Sep 2006 15:32:58 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id k8JMWwjY009848; Tue, 19 Sep 2006 15:32:58 -0700 (PDT) Date: Tue, 19 Sep 2006 15:32:58 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC 2006/340 Solaris Boot Support for EFI and LinuxBIOS To: gww@eng.sun.com, psarc@Sun.Com, szhou@billybob.sfbay.sun.com Message-id: <200609192232.k8JMWwjY009848@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 816 > > linuxbios.org doesn't seem to expand on the "better security". > > Does it support features similar MonPROM and OBP security-mode? > > Is the government contracts related to the project coming from > > LANL? > > > The "security" is implied by "minimal" and "open" firmware. > You are not running some proprietary firmware with potential > security holes. > > > How will this continue to integrate (or not) with eeprom(1M)? > > > There won't be any LinuxBIOS integration with eeprom. All such > deployments are customized by the end user. > > With EFI, eeprom will most likely be extended to get and set > EFI variables. I do not have any details at this point. If I understand correctly neither LinuxBIOS or EFI will do anything to improve the ``PROM'' security vis-a-vis OBP security-mode. Gary.. From sacadmin Tue Sep 19 15:45:44 2006 Received: from sunmail1brm.Central.Sun.COM (sunmail1brm.Central.Sun.COM [129.147.62.17]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8JMjiPk009444 for ; Tue, 19 Sep 2006 15:45:44 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.149.246.28]) by sunmail1brm.Central.Sun.COM (8.11.7p1+Sun/8.11.7/ENSMAIL,v2.2) with ESMTP id k8JMjhc19304 for <@sunmail2.sfbay.sun.com:psarc@sun.com>; Tue, 19 Sep 2006 16:45:43 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2 (built Dec 2 2004)) id <0J5V0020J386N500@nwk-avmta-1.sfbay.Sun.COM> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 15:45:42 -0700 (PDT) Received: from sfbaymail2sca.sfbay.sun.com ([129.145.155.42]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2 (built Dec 2 2004)) with ESMTP id <0J5V002D2386GK00@nwk-avmta-1.sfbay.Sun.COM> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 15:45:42 -0700 (PDT) Received: from billybob.sfbay.sun.com (billybob.SFBay.Sun.COM [129.146.224.123]) by sfbaymail2sca.sfbay.sun.com (8.13.6+Sun/8.12.10/ENSMAIL,v2.2) with ESMTP id k8JMjgp2023411 for ; Tue, 19 Sep 2006 15:45:42 -0700 (PDT) Received: from billybob (billybob [129.146.224.123]) by billybob.sfbay.sun.com (8.13.7+Sun/8.13.7) with SMTP id k8JMkRFU125677; Tue, 19 Sep 2006 15:46:27 -0700 (PDT) Date: Tue, 19 Sep 2006 15:46:27 -0700 (PDT) From: Shudong Zhou Subject: Re: PSARC 2006/340 Solaris Boot Support for EFI and LinuxBIOS To: psarc@sun.com, gww@eng.sun.com Reply-to: Shudong Zhou Message-id: <200609192246.k8JMkRFU125677@billybob.sfbay.sun.com> MIME-version: 1.0 X-Mailer: dtmail 1.3.0 @(#)CDE Version 1.7_13 SunOS 5.11 i86pc i386 Content-type: TEXT/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-MD5: BGbmknAa0CS/M/7O/YbWfQ== X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 572 > > > > With EFI, eeprom will most likely be extended to get and set > > EFI variables. I do not have any details at this point. > > If I understand correctly neither LinuxBIOS or EFI will > do anything to improve the ``PROM'' security vis-a-vis > OBP security-mode. > > Gary.. With LinuxBIOS, you can lock down BIOS ROM to read-only mode so no one can change it without physical access. It's arguably more secure, but it isn't a general solution. I do not know what security features there are in EFI. I'll see what I can find out and take this offline. Shudong From sacadmin Tue Sep 19 16:04:21 2006 Received: from sunmail3.sfbay.sun.com (sunmail3.SFBay.Sun.COM [129.149.247.180]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8JN4LPg003721 for ; Tue, 19 Sep 2006 16:04:21 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.149.247.22]) by sunmail3.sfbay.sun.com (8.11.7p1+Sun/8.11.7/ENSMAIL,v2.2) with ESMTP id k8JN4I313218 for <@sunmail3.sfbay.sun.com:psarc@sun.com>; Tue, 19 Sep 2006 16:04:19 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0J5V00B0P435G700@nwk-avmta-2.sfbay.sun.com> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 16:04:17 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0J5V0035Y4323260@nwk-avmta-2.sfbay.sun.com> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 16:04:14 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id k8JN4E6o000914; Tue, 19 Sep 2006 16:04:14 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id k8JN6Iu3009919; Tue, 19 Sep 2006 16:06:18 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id k8JN6Hlv009918; Tue, 19 Sep 2006 16:06:17 -0700 (PDT) Date: Tue, 19 Sep 2006 16:06:17 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC 2006/340 Solaris Boot Support for EFI and LinuxBIOS To: psarc@sun.com, gww@eng.sun.com, szhou@billybob.sfbay.sun.com Message-id: <200609192306.k8JN6Hlv009918@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 751 > > If I understand correctly neither LinuxBIOS or EFI will > > do anything to improve the ``PROM'' security vis-a-vis > > OBP security-mode. > > > > Gary.. > > With LinuxBIOS, you can lock down BIOS ROM to read-only mode so > no one can change it without physical access. It's arguably > more secure, but it isn't a general solution. > > I do not know what security features there are in EFI. I'll > see what I can find out and take this offline. I guess the best we can do is get an issue to escalate from this case. That being: An important security feature is missing from Solaris x86/x64, PROM security. A project should be funded (or whatever the PC words are today) to bring Solaris X86/x64 to parity with Solaris SPARC. Gary.. From sacadmin Tue Sep 19 16:28:11 2006 Received: from sunmail3.sfbay.sun.com (sunmail3.SFBay.Sun.COM [129.149.247.180]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8JNSBEu003442 for ; Tue, 19 Sep 2006 16:28:11 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.149.246.28]) by sunmail3.sfbay.sun.com (8.11.7p1+Sun/8.11.7/ENSMAIL,v2.2) with ESMTP id k8JNSA320621 for <@sunmail2.sfbay.sun.com:psarc@sun.com>; Tue, 19 Sep 2006 16:28:10 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2 (built Dec 2 2004)) id <0J5V0060956XQA00@nwk-avmta-1.sfbay.Sun.COM> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 16:28:09 -0700 (PDT) Received: from sfbaymail2sca.sfbay.sun.com ([129.145.155.42]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2 (built Dec 2 2004)) with ESMTP id <0J5V0027G56XG760@nwk-avmta-1.sfbay.Sun.COM> for psarc@sun.com (ORCPT psarc@sun.com); Tue, 19 Sep 2006 16:28:09 -0700 (PDT) Received: from billybob.sfbay.sun.com (billybob.SFBay.Sun.COM [129.146.224.123]) by sfbaymail2sca.sfbay.sun.com (8.13.6+Sun/8.12.10/ENSMAIL,v2.2) with ESMTP id k8JNS9g3011374 for ; Tue, 19 Sep 2006 16:28:09 -0700 (PDT) Received: from billybob (billybob [129.146.224.123]) by billybob.sfbay.sun.com (8.13.7+Sun/8.13.7) with SMTP id k8JNSsOa125779; Tue, 19 Sep 2006 16:28:54 -0700 (PDT) Date: Tue, 19 Sep 2006 16:28:54 -0700 (PDT) From: Shudong Zhou Subject: Re: PSARC 2006/340 Solaris Boot Support for EFI and LinuxBIOS To: psarc@sun.com, gww@eng.sun.com Reply-to: Shudong Zhou Message-id: <200609192328.k8JNSsOa125779@billybob.sfbay.sun.com> MIME-version: 1.0 X-Mailer: dtmail 1.3.0 @(#)CDE Version 1.7_13 SunOS 5.11 i86pc i386 Content-type: TEXT/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-MD5: iNl/7eIJDX5M421J/KRfxA== X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 707 > > I guess the best we can do is get an issue to escalate > from this case. That being: An important security feature > is missing from Solaris x86/x64, PROM security. A project > should be funded (or whatever the PC words are today) to > bring Solaris X86/x64 to parity with Solaris SPARC. > > Gary.. Your message needs to get to x86 platform folks. I was thinking FWARC, but I don't know if BIOS are actually being reviewed. It's not clear to me this is the case you want to tag your message on. You are welcome to do so, however. Note that many BIOS implementations do have password protection, etc. To be clear, the message should spell out the specific security features desired. Shudong From sacadmin Wed Sep 20 00:42:28 2006 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k8K7gRN0009959 for ; Wed, 20 Sep 2006 00:42:28 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.149.246.28]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id k8K7gMQF026227 for <@sunmail2.sfbay.sun.com:psarc@sun.com>; Wed, 20 Sep 2006 08:42:26 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2 (built Dec 2 2004)) id <0J5V00605S2MQN00@nwk-avmta-1.sfbay.Sun.COM> for psarc@sun.com (ORCPT psarc@sun.com); Wed, 20 Sep 2006 00:42:22 -0700 (PDT) Received: from sunnl.holland.sun.com ([129.159.201.1]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2 (built Dec 2 2004)) with ESMTP id <0J5V00C7RS2LHZF0@nwk-avmta-1.sfbay.Sun.COM> for psarc@sun.com (ORCPT psarc@sun.com); Wed, 20 Sep 2006 00:42:22 -0700 (PDT) Received: from vaticaan.holland.sun.com (vaticaan [129.159.201.10]) by sunnl.holland.sun.com (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id k8K7gEUV023265; Wed, 20 Sep 2006 09:42:14 +0200 (MEST) Received: from holland (casper@room101 [129.159.201.52]) by vaticaan.holland.sun.com (8.13.6+Sun/8.12.9) with ESMTP id k8K7gDsA000601; Wed, 20 Sep 2006 09:42:14 +0200 (MEST) Date: Wed, 20 Sep 2006 09:42:13 +0200 From: Casper.Dik@sun.com Subject: Re: PSARC 2006/340 Solaris Boot Support for EFI and LinuxBIOS In-reply-to: <200609192246.k8JMkRFU125677@billybob.sfbay.sun.com> Sender: casper@holland.sun.com To: Shudong Zhou Cc: psarc@sun.com, gww@eng.sun.com Message-id: <200609200742.k8K7gDsA000601@vaticaan.holland.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200609192246.k8JMkRFU125677@billybob.sfbay.sun.com> Status: RO Content-Length: 326 >With LinuxBIOS, you can lock down BIOS ROM to read-only mode so >no one can change it without physical access. It's arguably >more secure, but it isn't a general solution. If you flash chips aren't buggy. (the software read-only mode of flash chips is apparently circumventable; the jumper mode apparently is not) Casper