Intel Corporation at the ongoing OSTS (Open Source Technology Summit) conference, several new experimental open projects are being presented. As part of the initiative work is underway to create a scalable and secure replacement for UEFI and BIOS firmware. The project is in its early stages, but the proposed prototype already has sufficient capabilities for booting the operating system kernel. The project is based on the developments from (an open implementation of UEFI) and returns changes to upstream.
ModernFW aims to provide minimalist firmware suitable for use on vertically integrated platforms such as servers for cloud systems. On such systems, there is no need to maintain code in the firmware for backward compatibility and general-purpose components characteristic of traditional UEFI firmware. Eliminating unnecessary code reduces the number of potential vectors for attacks and bugs, positively impacting security and efficiency. This includes efforts to remove support for outdated device types and functionalities that can be performed in the context of the operating system.
Only the necessary device drivers are retained, and minimal support for emulated and virtual devices is provided. Whenever possible, tasks that can be executed at the OS level are moved to the operating system level. Some code is shared between the firmware and the OS kernel. A modular and configurable setup is provided. Support for architectures is currently limited to x86-64 systems, and only Linux is supported for booting (support for other operating systems can be implemented if necessary).
At the same time, Intel project , as part of which an attempt is made to create a hypervisor based on components from
a joint project , in which, alongside Intel, companies like Alibaba, Amazon, Google, and Red Hat are also involved. Rust-VMM is written in Rust and enables the creation of task-specific hypervisors. Cloud Hypervisor is one such hypervisor that provides a high-level virtual machine monitor (VMM) running on top of KVM and optimized for tasks unique to cloud systems. In line with Intel's interests, the primary goal of Cloud Hypervisor is to run modern Linux distributions using para-virtualized devices based on virtio.
Emulation support is kept to a minimum (focusing on paravirtualization). Currently, only x86_64 systems are supported, but AArch64 support is planned. To eliminate unnecessary code and simplify the setup, configuration of CPU, memory, PCI, and NVDIMM is performed at the build stage. Migration of virtual machines between servers is supported. Key objectives include: high responsiveness, low memory consumption, high performance, and minimizing potential attack vectors.
Source: opennet.ru
