电调开源固件_开源固件我们为什么要支持它

Firmware is the most powerful software that runs on a platform. It can tear your security concerns apart if configured wrongly, and it can prevent your platform from booting if written faulty. So it should be more important what is running on the lowest level of hardware on your platform. There are several alternatives for the Basic Input Output System (BIOS) your server or laptop is running right now.

固件是在平台上运行的最强大的软件。 如果配置错误，它可能会破坏您的安全问题，并且如果书写有误，它可以防止平台启动。 因此，在平台上最低级别的硬件上运行什么应该更为重要。 服务器或便携式计算机目前正在运行的基本输入输出系统(BIOS)有多种选择。

BIOS is dead since 10 years ago.

BIOS从10年前就死了。

Nowadays the Firmware — this is how you actually call it — can be built upon various frameworks. Most of the firmware today supports the Unified Extensible Firmware Interface(UEFI) standard which has been published in 2007 by Intel, AMD, Microsoft, and other PC manufactures.

如今，可以在各种框架上构建固件(实际上就是您所称的固件)。 如今，大多数固件都支持统一可扩展固件接口(UEFI)标准，该标准已由Intel，AMD，Microsoft和其他PC制造商于2007年发布。

Already 1999 an open-source alternative called LinuxBIOS was born in the Los Alamos National Laboratory with the goal to create a BIOS which boots fast and can be configured more flexible than the current standard. Even though LinuxBIOS, nowadays called coreboot, was constantly improved and is still under development, it only gained traction in the last couple of years.

早在1999年，一个名为LinuxBIOS的开源替代方案就诞生在美国洛斯阿拉莫斯国家实验室，其目标是创建一种BIOS，该BIOS快速启动，并且可以比当前标准更灵活地配置。 即使现在被称为coreboot的LinuxBIOS不断改进并仍在开发中，但它仅在最近几年才受到关注。

最先进的 (State of the Art)

So — what is the state of the art of firmware development? The truth is:

那么-固件开发的最新状态是什么？ 事实是：

Firmware Development is still in the Stone Age

固件开发仍处于石器时代

and here is why: The Majority of the Firmware Development is still Closed Source. That means that only the companies, so-called Independent BIOS Vendors (IBVs), who are actually developing firmware really know the source code. Also: Firmware Development is kind of a monopoly. There are only a hand full of companies who are developing firmware for nearly the complete market of servers and laptops.

原因如下：大多数固件开发仍是封闭源 。 这意味着只有真正在开发固件的公司(所谓的独立BIOS供应商(IBV))才真正知道源代码。 另外：固件开发是一种垄断。 只有少数几家公司正在为几乎整个服务器和笔记本电脑市场开发固件。

Several studies state that competition is good for business — and even better for innovation. Aghion, Bloom, Blundell, Griffithand Howitt analyzed panel data from UK firms in 2005 and showed that competition drives innovation, even though the relation between innovation and intensity of competition is not linear.

多项研究表明，竞争对企业有利，对创新更有利。 Aghion，Bloom，Blundell，Griffithand Howitt分析了2005年来自英国公司的面板数据，结果表明，竞争推动了创新，即使创新与竞争强度之间的关系不是线性的。

提出问题 (Arising Problems)

A few problems arise if the market is dominated by only a couple of companies using opaque techniques:

如果市场仅由使用不透明技术的几家公司主导，则会出现一些问题：

膨胀软件 (Bloatware)

On the Open Source Firmware Conference, 2019 in Silicon Valley Ryan O’Leary and Gan Shun Lim showed that there were able to remove 214 out of 424 DXEs within the boot process. DXEs are drivers which get loaded at boot time within the Driver eXecution Environment(DXE) Phase.

在2019年硅谷的开源固件大会上，Ryan O'Leary和Gan Shun Lim 表明 ，在引导过程中能够删除424个DXE中的214个。 DXE是在启动时在驱动程序执行环境(DXE)阶段加载的驱动程序。

That’s an overall reduction of more than 50%.

总体减少了50％以上。

Normally Firmware needs to be adjusted to every single board. Due to the fact that companies like to save time (and also money) it is much easier to put everything into the firmware that might be needed. This results in more code and longer boot times.

通常，固件需要针对每个单板进行调整。 由于公司希望节省时间(以及金钱)，因此将所有可能需要的东西放入固件要容易得多。 这导致更多的代码和更长的启动时间。

透明度 (Transparency)

As already stated above, most of the Firmware on modern platforms is closed source, which means that the source code is not made publicly available for everyone. In reality, only a handful of developers actually know or have access to the source code. This also means that is not transparent what actually has been implemented and what code is really running.

如上所述，现代平台上的大多数固件都是封闭源代码，这意味着该源代码并未公开提供给所有人。 实际上，只有少数开发人员实际知道或有权访问源代码。 这也意味着实际实施的内容和实际运行的代码并不透明。

We have to recap that Firmware is actually the first code that runs when the platform boots up and is capable of reading and writing everything without any restrictions — even your encryption won't save you here.

我们必须回顾一下，固件实际上是平台启动时运行的第一个代码，并且能够不受任何限制地读取和写入所有内容-即使您的加密也无法将您保存在这里。

安全 (Security)

There are a few major security concerns in current firmware solutions. The lack of transparency is one of those. In my honest opinion, we can not talk about reliable security, if the implementation of those mechanisms is not available in the public domain. The majority of the cryptography community actually relies on open source. Every known and sane cryptographic algorithm or protocol is publicly documented and available.

当前的固件解决方案中存在一些主要的安全问题。 缺乏透明度就是其中之一。 坦率地说，如果不能在公共领域使用这些机制，我们就不能谈论可靠的安全性。 实际上，大多数密码学社区都依赖于开源。 每个已知且理智的加密算法或协议都已公开记录并可用。

Closed Source Firmware is just a blob..

封闭源固件只是一个问题。

..and that is the problem. We do not know what is happening on the lowest level of the hardware — and especially what goes wrong. Writing bugs and making errors is just natural. Hiding those does not help at all. Security by obscurity is no security at all. Therefore it is no surprise that security researches tend to find new vulnerabilities every now and then in closed source firmware. There is a nice blog about firmware security-related topics which you can find here.

..那就是问题所在。 我们不知道最低级别的硬件上正在发生什么—尤其是出了什么问题。 编写错误和犯错误是很自然的。 隐藏这些根本没有帮助。 默默无闻的安全根本不是安全。 因此，安全研究趋于时常在封闭源固件中发现新漏洞也就不足为奇了。 有一个关于固件安全相关主题的不错的博客，您可以在此处找到。

可能的解决方案 (Possible Solutions)

So — what could solve all the problems mentioned before? Open-Source Firmware. There is a project called coreboot, which has the approach of minimal hardware initialization and then let e.g. the Linux Kernel take over to do the rest of the driver initialization. This would reduce Bloatware because only the hardware needed will be initialized.

那么，什么能解决前面提到的所有问题呢？ 开源固件。 有一个名为coreboot的项目，该项目具有最小化硬件初始化的方法，然后让例如Linux Kernel接管其余的驱动程序初始化。 这将减少Bloatware，因为将仅初始化所需的硬件。

Improving security is a tough call. Humans are writing the code, and humans tend to make errors. The security community developed the technique to make everything publicly available when it comes to security. Every known cryptographic algorithm is available in the public domain. The idea is, that if we open-source the algorithms, we can find flaws or errors in the algorithms or implementation, and can fix them to improve security.

改善安全性是一个艰难的要求。 人类正在编写代码，人类往往会犯错误。 安全社区开发了一种技术，可在涉及安全性时使所有内容公开可用。 每个已知的加密算法都可以在公共领域使用。 想法是，如果我们将算法开源，则可以发现算法或实现中的缺陷或错误，并可以对其进行修复以提高安全性。

The same mindset should apply when it comes to firmware. We should implement security features open-source to improve the implementation and make it more secure by having it publicly reviewed by security researches, companies or universities. And if every firmware shares the same code basis which has been proven to be secure, we can dramatically reduce security flaws in firmware.

对于固件，应该采用相同的思路。 我们应该开放源代码的安全功能，以改进实施并通过安全研究，公司或大学对其进行公开审查来使其更加安全。 而且，如果每个固件都共享相同的代码基础(这已被证明是安全的)，那么我们可以大大减少固件中的安全漏洞。

开源固件 (Open Source Firmware)

There are several Open Source Firmware projects out there — and I like to talk about three of those. They are my personal preference and there could be better ones out there — or not.

这里有几个开源固件项目-我想谈谈其中的三个。 它们是我的个人喜好，可能还有更好的-或没有。

核心引导 (coreboot)

coreboot is the project that I personally work most of my time with. It evolved over the last two decades (it has its 20th anniversary this year) to a quite big project. It all started in 1999 where the people at the Los Alamos National Laboratory need a solution for the proprietary BIOS and started something that was first called LinusBIOS and later became coreboot.

coreboot是我个人大部分时间都从事的项目。 它在过去的二十年中(今年已经有20周年了)发展成为一个相当大的项目。 这一切始于1999年，当时洛斯阿拉莫斯国家实验室的人员需要专有BIOS的解决方案，并开始了一个名为LinusBIOS的工作，后来又成为coreboot。

The overall idea of coreboot is that we do the minimal hardware initialization and jump as quickly as possible to the Linux kernel, which then should take over the rest. The project wants to reduce multiple code basis, as most of the drivers are already implemented in the Linux kernel — so there is no need to implement it twice (and maybe faulty) in the firmware. Everything that does not necessary needs to be implemented in firmware, will be pushed into the Bootloader / OS which has a kernel running.

coreboot的总体思想是，我们进行最少的硬件初始化，并尽快跳到Linux内核，然后由Linux内核接管其余的工作。 该项目希望减少多种代码基础，因为大多数驱动程序已在Linux内核中实现-因此，无需在固件中实现两次(甚至可能有错误)。 不需要在固件中实现的所有必需内容，都将被推送到运行内核的Bootloader / OS中。

If you want to get into the topic — here is a Getting started with coreboot guide. Also, check out the homepage https://www.coreboot.org . They have a quite active community on IRC or Slack. Right now, coreboot support quite a lot of the newer Intel platforms, from Apollo Lake to Coffee Lake, sadly there is no Scalable Support (yet).

如果您想进入主题， 这里是coreboot入门指南。 另外，请查看主页https://www.coreboot.org 。 他们在IRC或Slack上有一个非常活跃的社区。 现在，coreboot支持很多新的Intel平台，从Apollo Lake到Coffee Lake，可惜还没有可扩展的支持。

矿靴 (oreboot)

oreboot is another project that I want to talk about. Basically it is coreboot without the c — and so it has been completely been rewritten in Rust. You can check out it here. It is a fairly young, but very interesting project. There are two major goals:

oreboot是我要谈论的另一个项目。 基本上，它是不带c的coreboot，因此已完全用Rust重写。 您可以在这里查看 。 这是一个相当年轻但非常有趣的项目。 有两个主要目标：

• Rewrite coreboot in Rust,
  在Rust中重写coreboot，
• oreboot only supports architectures/SoCs which can be booted blobfree.
  oreboot仅支持可以Blobfree引导的体系结构/ SoC。

In contrast to coreboot, where BLOBs are still allowed for the sake of supporting as much SoCs as possible (every modern Intel SoC need closed-sources BLOBs to run), oreboot is very strict and does not allow BLOBs or NDA documents at all. Lately, the dropped support for the ASpeed AST2500, because NDA documents were needed for implementing all registers and functions — so it went out of the tree.

与coreboot相比，为了允许尽可能多的SoC仍然允许使用BLOB(每个现代的英特尔SoC都需要运行封闭源代码BLOB)，相比而言，oreboot非常严格，根本不允许BLOB或NDA文档。 最近，由于实现所有寄存器和功能都需要NDA文档，因此放弃了对ASpeed AST2500的支持-因此它不再适用。

我们正在朝着正确的方向前进。 (We are moving in the right direction.)

Right now it feels that Open Source Firmware is pushing in the right direction. We have some big players on board which have the weight to push firmware development in the right direction. But of course, it is not only the big companies that set the tone. We need more developers on-board which port mainboards to coreboot and more customers who want coreboot as the firmware running on their servers.

现在，感觉开源固件正在朝着正确的方向发展。 我们有一些重要的角色，可以推动固件开发朝着正确的方向发展。 但是，当然，不仅仅是大公司在定下基调。 我们需要更多的开发人员在主板上通过哪个端口将主板引导至coreboot，以及需要更多将coreboot用作服务器上运行的固件的客户。

If you want to get involved or want to know more about Open Source Firmware — feel free to drop me a message.

如果您想参与进来或想了解有关开源固件的更多信息，请随时给我留言。

Other than that — Thanks for reading. Stay curious.

除此之外-感谢您的阅读。 保持好奇心。