Julius Werner

In this lightning talk I will present a draft proposal for new firmware verification infrastructure in coreboot that has been circulating between Google and Intel. Unlike the existing all-or-nothing one-shot verification, this proposal will hash each CBFS file individually and verify them at time of use. It also contains a plan to move the root of trust into the bootblock and verify every stage from there on out, so that we can tie it to an SoC hardware verification scheme like BootGuard.

This is meant as a follow-on presentation to my 'coreboot on ARM' overview from the 2016 conference (http://youtu.be/z-KpAA4_afs) with the goal to present 64-bit differences in the architecture itself and the way coreboot deals with them, with particular focus on the runtime resident component lifted from the Arm Trusted Firmware project. I'll give a basic developer overview of the Trusted Firmware codebase and what parts a new platform port needs to implement to be usable with coreboot. There may also be some war stories from our recent RK3399 implementation.