[x86] (5) Talking about the Working Model of OEM and ODM on RSA Keys Manufacture

If you're not familiar with "Security Boot", "Boot Guard" or "BIOS Guard" stuffs, you might find this subject quite boring. In case that, I think the better way is to explain it as usual sarcasm style.

Previous features I mentioned are designed or claimed for better security integration on platform, it's like a series of locks that you might only pass with right identity. For example, assume as following scene:

Lock: blocks the boot flow unless the right key is accepted.

Right Keys: Can only manufactured by OS vendor and OEM/ ODM (OEM has the right to decide to use only OEM key or both of OEM and ODM keys)

Since right keys can only manufactured by OS vendor, OEM or ODM, here's the funny question: What if the right is leaked, who should be responsible for it?

Well, four kinds of situation:

(1) OS vendor's key leaked: No doubt that OS vendor should be responsible for it since none can access the key but their self, right?

(2) Only OEM Key used and it's leaked: Of course it's OEM's fault, however, if this method is used, OEM should maintain a safe server allowing ODM to upload the signature file to be signed by OEM's internal private key and download from the server. Guess what? Some OEM takes the effort quickly but some just take other methods...

(3) Only ODM key used and it's leaked: Of course it's ODM's fault, however, every one would blame it on OEM. If any bad things happen, ha ha, some poor engineer would be kicked out. Don't worry about the supervisor, they always find the way out.

(4) OEM and ODM keys used and one leaked: Why we need this method? Why not only OEM key used? Well, it's because some OEM's too lazy to build the safe server responsible for ODM's signature, but still wanna ensure which ODM leaks their key and make sure ODM wouldn't produce other non-official keys. Oh man, it's really complicated, right? More to that, what if OEM or ODM would like to change or testify their own keys in the same BIOS code-base? There we need the compile switch provided by IBV to determine if the OEM/ ODM keys changed or not in current compile time. It's complicated, however, once built, it's easy to use to OEM or ODM, and lazy OEM doesn't have to own the safe server. How lazy and brilliant. By the way, I'm the guy worldwide first figured out this working model to satisfy the lazy OEM supervisor...

Finally, based on the experience I shared previously.  I realize there are two ways to work in OEM:

(1) To Follow and get SLAPPED by supervisor.

-> Advantage: Keep your job well and stable.
-> Disadvantage: Get slapped all the time.

(2) To Create and get FIRED by supervisor.

-> Advantage: Be creative to flexible working models to satisfy various needs.
-> Disadvantage: Be creative is bitching and jealous supervisor finds excuse to fire you someday.



Any way, it's been cool to share some experience with you, if you find any questions, suggestions or comments, please give me some feed-backs, thanks a lot! 

[x86] (3) UEFI BIOS Dynamic and Static Analyzer

Alright everyone, I believe you guys might pass out or fall into some kinds of coma for visiting old x86 museum yesterday (2) Post Mortem: ACPI/ SCI/ Q Event) since that slide is actually the compilation of few insight reports either written in English and Mandarin. Thanks to old great guys and hope my material could be as open minded as they do.

Say, let's see something new today, it's about an idea that none never support it or take it serious but me. UEFI is the BIOS standard highly promoted by Intel...and forced everyone to do so. However, BIOS is an old industry that experienced engineers tend to use traditional debug methods such as break-points. That's what I called single debug view as following diagram.

This kind of debug view is fine when you're dealing with annoying OEM customer or Project Leader urging for issue report. Yeah, just do it and attach all your records from POST code/ debug message from PCH or EC serial out/ break-point insight from IBV or Intel's online debug monitors. However, you're looking at one issue at a time. Or you're looking at two or three issues at the same time, but you're still using single debug view.

As the engineer of one project, you should be fine with single debug view. As the BIOS leader or Feature leader, you might face multiple projects ongoing in the same time and all those projects binding with second/ third source junk components (memory of worse margin, TPM initializes/ wakes up so late), and even more disasters you could possibly image.

So my idea was to create analyze view based on automatic calculation in build time and run-time. With this analyze view, you may control multiple projects at the same time without manual efforts on each project's inspection. More to that, you could create a golden template based on the vendor's reference board to control all your projects. All analyze view reports are generated automatically, no more schedule losing control.

I really love this diagram, it explains how automatic framework collecting data in build-time and run-time to create analyze view.

It's the representation example of analyze view, it's easy to gain the benefit of free and open source diagram automation generator.

See the event schedule mentioned in previously diagram? That overcomes the late initialization/ wake-up issues as well, how I love this.

How thousands of Taiwan BIOS RD still doing their jobs like this...It's not a joke, man.

How it really works and helps us from try and error.

Too shay I still have bad news about this UEFI BIOS Dynamic and Static Analyzer, which is, UEFI is not welcome to future world since x86 members (Vendors, OEM, ODM) are mainly focus on making their own money. Even UEFI is supposed to be open, people tend to doubt it and pay attention to other standards.

Finally, welcome to give me any questions, suggestions or comments, thanks!

[x86] (1) Preliminary

1.5 Year as DELL Commercial NB ODM BIOS RD in Foxconn
0.5 Year as DELL Commercial NB IBV BIOS RD in American Megatrends inc
1.5 Year as NB BIOS Security Features RD Leader (see my digital signature on various projects) in worldwide PC/NB OEM

I spend my first 3.5 years career life as a full time NB BIOS RD crossing OEM/ODM/IBV, and I now feel like I shall share all my experience and knowledge that some might not do so. I hope the upcoming footprints I revealed would help others to better understand the BIOS industry and it would be my career marks as well.

Feel free to ask me any questions whatever how technical it would be, such as "What is the main purpose of Security Boot/ TPM/ HSM/ Trusted Chain/ Measure Boot/ BIOS Guard/ Boot Guard?" Any confusing security features involved in NB/ BIOS, I could give you all-you-can-eat answers full of sarcasm. :)

Anyway, it's just the official beginning of my blog life, cheers and wish me luck. I'm ready to share and learn new stuff as a pure indie engineer now.