Turbulent weather, books, and new jobs

Weather issues https://mynorthwest.com/4010489/cliff-mass-warns-of-powerful-storm-approaching-western-washington/ have impacted the region recently. The power at my home was out for a few days but I was able to reach the office. While there I recall one conversation from a colleague "Power outages in India, not just this long." A similar sentiment was express by a Brazilian co-worker. I suppose the outage reflects the pleasure and peril of the Pacific Northwest with its significant old growth and above-ground power lines. One challenge this offered was having to take a 4am PST call from  the office to deliver a talk https://docs.google.com/presentation/d/1gbKhl3ncwRm0QB1ZD3xZhjhRFWxUp_dKtdnQemtpoX0/edit?usp=sharing to an open source firmware event in Germany at https://www.ruhr-uni-bochum.de/en.

Part of my Franken-prezo can be seen below. It was pieced together from old public slides spanning CanSecWest '15 in Vancouver BC through Hacker-to-Hacker circa late '23 in São Paulo, Brazil, viz., 

Recently a local university asked me to give their students a talk on BIOS. I agreed on the conditions that it wasn't at 4am PST and that it was in-person. If they had asked last week I would have added the additional proviso of not occurring during a post wind-pocalypse power outage :)

Given this is a blog that purports to cover musings on firmware and UEFI, I figured that I'd note that recent event.

Speaking of firmware, before this talk and continuing in the spirit of this blog's theme there was an Intel blog posting related to the Open Computing Project Summit recently about open source server host firmware https://community.intel.com/t5/Blogs/Tech-Innovation/Data-Center/Advancing-Open-Source-Firmware-on-Intel-Xeon-6-Based-Platforms/post/1636720 

Postings like this and recent work by 9e mentioned in https://www.phoronix.com/news/9elements-SkylakeX-Coreboot are always nice to see as they describe work with provides community choice and offers additional insight into how this class of platform is built. In addition, this work potentially heightens awareness of the circular economy.

This above-cited blog post-dated my time at Intel and pre-dated my time at.....at.....

As I mentioned in https://vzimmer.blogspot.com/2024/09/reflecting-on-my-time-at-tech-company.html, I felt a bit nervous about retiring when everyone was telling me that I was 'too young.' As such, I cut my retirement a bit short and recently joined a new tech company

(ID# blinded in picture).

The Microsoft experience has been pretty interesting so far. The old and new commute only differ by a small distance shown below. In fact I had taken that trek a few times in the past, both walking during the summer months and driving during the rainy days when collaborating with Microsoft as an Intel employee.

And the Microsoft campus here in Redmond, WA is sprawling. I initially found myself using a maps application on my phone to navigate both walking through and driving across the campus. To my delight, one location I found was a physical library in Microsoft building 92. Real books, not epubs and mobis and pdfs and html renderings.....! And to my surprise there were a couple of familiar titles on the shelves, including a couple of host firmware texts - https://www.degruyter.com/document/doi/10.1515/9781501505751/html?lang=en and https://www.degruyter.com/document/doi/10.1515/9781501505690/html?lang=en. 

And now the latter has been YouTube-ized https://www.youtube.com/watch?v=ZrkX4tdg49s.

When I related this library finding to former Intel colleague (now an eng at AMD?) he shared a snapshot of the books on his home office desktop, including https://www.amazon.com/Beyond-BIOS-Developing-Extensible-Interface/dp/1934053295/.

Speaking of firmware books, Jiming Sun's presentation https://talks.osfc.io/osfc-2024/talk/G8RDEX/  on firmware requirements from a CSP provided a unique perspective.

He also mentioned at the 11:10 minute mark some background on FSP and the embedded firmware book https://link.springer.com/book/10.1007/978-1-4842-0070-4, too. Therein he noted the popularity of the book by way of the site https://bookauthority.org/books/best-firmware-books. 

#1 firmware book? Fascinating metric. I'm not sure about the dataset used to generate that ranking. Although now at Amazon AWS, Jiming was a good collaborator during our joint tenure at Intel. 

On the topic of books, on the Weds workday ahead of the T-day holiday I found another surprise when a coworker dropped by my touchdown/temporary office with one of the firmware books in hand https://link.springer.com/book/10.1007/978-1-4842-7939-7

I like books. And doors on offices are another fascinating phenomena after several decades of largely living in a cubicle. 

Moving beyond the topic of books and continuing with co-workers theme, I see that another former Intel co-worker has left the blue building (Inside Blue to Outside Blue, departed the Blue Planet, gone from being an In-tel to an Out-tel?) is the other half of the 300-issued-patents duo of 2014 https://vzimmer.blogspot.com/2022/09/new-milestones.html who has a new opportunity https://natcast.org/natcast-announces-dr-robert-chau-svp-research

I guess the lure of the 'enhanced retirement package' of September drew him out, too? Maybe it was the new job title and mission which both sound pretty cool.

Speaking of retirement, or now post-retirement, since landing at MS I've tried to look up some former collaborators like https://www.linkedin.com/in/vkurien/ mentioned in https://vzimmer.blogspot.com/2023/02/blue-hat-2023-and-uefi-secure-boot.html but noticed that he's been gone for some time. During this inquiry I observed an interesting aspect of his profile that includes a mention of our joint work, viz., "Co-invented UEFI secure boot with Vincent Zimmer of Intel. UEFI boot vulnerabilities were identified by a novel information flow modeling technique. "

I don't recall ever showing up in someone's LI experience listing. Interesting.

Although I started the blog grousing about weather maladies I really cannot complain so much. Another "Vincent Zimmer" has had it much worse recently https://www.youtube.com/watch?v=db9lTZiUgt8 it appears.

On the flip side, when I was leaving Intel, there was a session where the team was queried about what folks thought the imminent retirees would do post-Intel. One suggestion for me was a future as a patent attorney, and another suggestion was that I'd give a Ted Talk. On the latter suggestion it looks like another "Vincent Zimmer" beat me to the punch https://www.youtube.com/watch?v=eKdCsk3Yw-U. I think that disqualifies me for a future Ted Talk - speaker name hash collision rule :) 

On the topic of the former suggestion of going back to school in the above-listed bon voyage meeting, I attended a Saturday conference https://con.racket-lang.org/ on the Racket programming language during my retirement windows between Intel and MS. During the lunch break-out at UW Kane Hall I expressed my interest in pursuing more formal graduate education when the PhD candidate to my left mentioned "yes, I'm in year 10 of my PHD program. I had to switch advisors and topics." Hmm. Given those types of statistics it would be a foot race between a PHD and Medicare eligibility for me. There were some interesting talks at the conference, though, including a keynote from the SICP https://en.wikipedia.org/wiki/Structure_and_Interpretation_of_Computer_Programs authors

I really enjoyed their first-person view of technology and personal journies therein.

And the conference shared other other bon mots on programming.  Some may think Racket (and functional programming languages like Lisp in general) is so far from mainstream languages that there is little value in delving into these alt-langs, but I'm always surprised at the cross over of ideas from one language community to another or how a clean, pedagogic language can clarify your thinking on a subject.

Maybe I'll just continue the auto-didactic path and see if I can audit some uni courses of interest? I still remember Richard Ladner's https://www.cs.washington.edu/people/faculty/ladner late 1990's wisdom during my UW CS algorithms course - "What I teach you this quarter will become irrelevant soon, but what I can impart to you all is to teach you how to teach yourself and learn on your own." One of these AI sessions reminded me of this spirit in the slide below.

Speaking of gifts that keep on giving.....

Of course even Racket conference touched on AI, mostly via a spoof of LLMs by one UBC prof. 

On a more serious approach to AI, though, I did attend a few IEEE-sponsored IEEE AI events on the UW campus and in Seattle, too. 

I have to confess that the half-dozen LLM and AI texts & papers on my desk didn't receive as much, er, 'attention' (pun intended https://arxiv.org/abs/1706.03762), as I'd like to have applied during the 4 week retirement.

So this is nice symmetry. The blog opened with describing a talk to university students and ended with some wistful higher education sentiments. Not quite Finnegans' Wake of the first and last sentence running together, but good enough for JIT blog-writing I suppose.

I am still holding out using copilot or gemini or chatgpt or locally phi/llama/qwen/.... by way of ollama to create and/or polish these postings. I guess I like to maintain the raw, natural intelligence (or natural obtuseness) feel versus the polished AI-driven edits/creation.  I am curious about other's thoughts on the topic. Maybe I'm just another John Henry versus the machine on this one....But in other activities these tools are amazing....Maybe just for this blog I've leave them out and keep it's artisanal feel :)

And so much for a November posting. Churn in the weather and the tech employment scene seem to be the themes of this posting.  

Reflecting on my time at a tech company (aka 'Retiring from Intel')

I've queued up some blog drafts over the last couple of months but I haven't been able to generate the energy to finish them. They just didn't seem to have enough bulk to them.

So why posting now and with this 'new' content?  

Well, I want to share that I have elected to retire from Intel after 27.5 years. My last day will be September 30. While I'm moving on to the next chapter of life, I'll always cherish the time I spent at Intel. 

And in fact it is with no small amount of temerity I write this message, especially after receiving so many soulful and impactful farewell messages recently from Intel colleagues also opting into this retirement package.  I'm somewhat 'late' in penning my message, I'm afraid (at this point in time I haven't sent out the broad bcc'd "I'm leaving" email).  And then there's my all-time favorite parting message I captured from Sham at the end of the https://vzimmer.blogspot.com/2023/05/open-platforms-snapshot-may-2023.html posting that I could never hope to emulate. 

But emulate I won't. In fact, I'll write this as I do most of my postings, sort of a rambling message to myself; on this sentiment I'm apparently not alone given quote of another 1.5 decade blogger "I keep this blog for me to write, not necessarily for others to read." https://www.jonashietala.se/blog/2024/09/25/why_i_still_blog_after_15_years/. For this particular post I couldn't figure out where to insert a 'TL;DR' since I sometimes think that could be the title or theme of this whole blog series :) I only regret that I won't have a reason to author a successor to https://vzimmer.blogspot.com/2024/02/27-or-anniversarynext12-ai-runtime.html. 

So for more of the TL 'too long," rewind the clock 32.5 years to my first five years post-undergrad in industry prior to Intel.  In those early days of 1992 back in Houston I was introduced to BIOS and embedded firmware development using Intel technology, from the i8051 through i80186 … and culminating with the P6. Beyond the data sheets, I also immersed myself deeply in Intel driven specifications like PCI and I2O (although forgotten by PCI SIG and intel.com, many still live on at https://bitsavers.org/pdf/intel/). These experiences ranged from poring over the black cover data public tomes of data books to the yellow-cover NDA documents, while continually being intrigued by what was happening at Intel via reading reports on the company in print periodicals like EE Times; this was the early 90’s prior to the internet going big.

Who knows? Maybe some of the work I contributed to at Intel, whether papers or books or specifications such as mentioned in https://vzimmer.blogspot.com/2021/01/books-and-computers.html, might end up at bitsavers some day, say Beyond BIOS https://www.amazon.com/Beyond-Bios-Implementing-Extensible-Interface/dp/0974364908 will have a URL like the RMX book http://www.bitsavers.org/pdf/intel/iRMX/iRMX_III/Real-Time_and_Systems_Programming_for_PCs_1993.pdf?

Given my early exposure to Intel, imagine my delight in getting recruited by Intel to lead the development of Itanium firmware for the Merced CPU in late 1996 and joining the Intel High-End Server Division (HESD) in February 1997 in DuPont WA. The Intel recruiter told me that I could ‘go to Hillsboro for Xeon or Dupont for Itanium.’ I wasn’t familiar w/ any place in the PNW so the obvious choice was to join the Intel 64-bit wave! Prior to joining Intel, I still recall my Compaq manager saying when I served notice “I guess you’re going to Portland Oregon” when in fact I was heading to Washington state. Commencing in ’97 I was now part of the mission to help create the technology behind those great products and standards I’d admired so much.  

Since then, I truly realized the saying of Steve Jobs 'The only way to do great work is to love what you do,' and I've truly loved working alongside such talented and dedicated individuals in this work. That was the missing link from my pre-Intel days, namely the broad experience with Intel employees.

Speaking of people and technology and standards, now more than half my life, or these last 27.5 years at Intel, have more than exceeded my hopes, but it’s the people with whom I’ve collaborated, learned, and grown I appreciate the most.  Thank you all for creating a positive and inspiring work environment. From co-creators of the SAL+NuBiOS & SAL+AMI ‘Salami’ firmware for Merced in HESD, the Workstation Product Group (WPG) Kittyhawk native C code that booted Intel P3 on 840 Rambus and Merced 460GX w/ either the AMI 630 ‘furball’ or the EFI sample as the late-stage payloads. Then off to Microcomputer Software Lab (MSL) in MD6 to work on the hit series of scaling EFI from 0.92 to today’s UEFI 2.11, along with “Tiano” that yielded EDK->EDKII and the Intel Platform innovation Framework for the Extensible Firmware Interface (e.g., “Framework”) specifications that have become the UEFI Platform Initialization (PI) specifications of today. This latter work spanned orgs from MSL to EPG to SEG to SSG to SATG to DEG to my final home here in CCG. I guess the only platform group I missed was embedded, although I enjoyed collaborating with those folks from ACSFL in the late 90’s to today’s slim bootloader.

I suppose I can date the badges by BDE or ADE ('Before drop-e' or 'After drop-e') https://vzimmer.blogspot.com/2014/01/advances-in-platform-firmware-beyond.html.

It’s open source platform code like slim bootloader, coreboot, and EDKII features/platforms that have occupied the last 10 years of scaling the Firmware Support Package (FSP), ….. along with the primary mission of FSP to have a clear business boundary between Intel owned versus customer codes. With this last decade also including contributing to NIST 800-193 platform firmware resiliency and recovery.  And and and ….

...and booting.  Measured boot, UEFI Secure boot, ipv6 boot/netboot6, HTTP boot, boot-from-Wifi.....Sometimes I'd use 'booting from a sneaker' as a variant of the Toaster or Fabrikam sort of pedagogic fake device, but given Bluetooth and smart accessories/shoes I suspect this one will fall into the 'life imitates art.'

And I could take a whole detour on security and friends long past. Someone said I was the final member of the below bench to exit. John of PSIRT, Yuriy of threat research, Kirk of all-things-SMM security, ... Zimmer as the UEFI security guy. I still recall a colleague saying 'bring boxes of the Intel Press Beyond BIOS and Shell books. The visitors will love them.' Given the muscle ache from both lugging them down to Portland and back to Seattle I couldn't help but think of the Harold Ramis quote in Ghostbusters that 'print is dead.'  Even those many years ago no one wanted those bulky dead-tree texts.

Beyond the tech milestones, I still recall a few words of wisdom from a now-retired colleague. One was ‘the best architecture is sometimes knowing what to leave out’ (I heard it but didn’t necessarily always practice it) and the other was ‘I don’t know why people don’t get it, but BIOS can be a great career.’  And a great Intel career it has been. Another was ‘the higher leadership ascends you’ll find the more impactful decisions they have to make with successively less information.’  So my take away is that you should take it easy on the bosses, especially in tough times.

And there is my 3-tuple of advice I sometimes give others and myself:  ‘business first, team second, and career third.’  To me this means focus on the business priorities first, even if they transcend your team’s charter. Next help develop and foster a strong team environment for the mission to collaborate on these business challenges.  And a distant third is your career.  I don’t mean to imply career growth is unimportant but more that if you focus on the business priorities and the team, a well-managed company will acknowledge your efforts.  

Also, observe where the interesting problems are being worked and good team cultures exist. Given that insight, when given the opportunity to engage in such focus areas and collaborators it may help your career long term.  And 'keep learning.' This may sound a bit strange coming from me since a boss recently said ‘...and if you don’t want to keep learning then just “retire”.  I personally hope to do both, but the exhortation to 'keep learning' is golden irrespective of one's employer or employment state or age or.....

And given this is a wrap-up sort of blog, I've probably repeated a few themes mentioned before. Some are quite important, though, such as 'it's the people that matter.' Projects and tech come and go. The people are the key invariant of value. For example, sometimes folks think I get excited by books and patents, but it's the co-authors and co-inventors that thrill me. I may forget a book chapter or set of independent claims, but I'll never forget the rich set of colleagues with whom I toiled shoulder-to-shoulder on these endeavors. And these endeavors match my triad of biz/team/career in that they were all done to help further a business strategy, secondarily they entailed team collaboration (sometimes co-authors outside of team or company), and at the end of the day, they may have helped (or hindered) my career arc. As long as I hit #1 and #2, though, I'm at peace.

Other wisdom? Don't bash other technology. I still regret writing 

twenty years ago in  https://www.researchgate.net/publication/377810413_TechnologyIntel_Magazine_-_Advances_in_Platform_Firmware_Beyond_BIOS_and_Across_all_Intel_R_Silicon. You win by being good, not by belittling the competition. And the fact that the PC industry for 20+ years had shipped on this 'monolithic', 'space constrained' BIOS rebutted my argument And to be honest, Tiano in 2004 wasn't the exemplar of software quality and stability.

I find a kindred soul in Prof G's advice that 'work life balance is a myth' https://www.raconteur.net/talent-culture/scott-galloway-work-life-balance-work-from-home but the part I perhaps erred on is ignoring the qualifier 'when you are young.' I have kept this unbalance through 3+ decades :) But it has been a great trip and I can see doing more when there are opportunities to dent some more https://www.goodreads.com/quotes/950437-we-re-here-to-put-a-dent-in-the-universe-otherwise.

I not sure what the next phase of the journey will be, but I couldn't help but laugh when reading this cartoon from the New Yorker recently. I sort of put my own spin on it, although some may say it reads well in its original.

And I sure have quite a reading backlog to attack (see background of posts like https://vzimmer.blogspot.com/2021/11/books-old-age.html). 

Regarding timing of this event, my Fidelity advisor said 'you can retire but there is the risk of you getting bored.' And a retiring Intel security Fellow opined 'you are too young to retire.' In retrospect I realize that I may be a bit junior to many of the 'retirement' cohort I see exiting since I dove head-first into tech w/o MS+PhD or military or ...et al hang-time. But given the exponential arcs of so much happening in tech and the richness of the world, I suspect I can find many a palliative to the specter of boredom (more 'dent' opportunities - see above).

Speaking of 'fellow,' that was definitely a milestone I had hoped to achieve in my quarter-century tenure at Intel. I try not to be sour grapes and think of the externally-hired-in fellows who only had to align with Professor Galloway's 'it's easy to fall in love with someone for an hour' when comparing external versus internal promotions. Instead I'd say Intel offered many open doors for me and perhaps I simply stumbled into the door jam? It was never aspiring toward the fellow role just for the sake of the title. Instead, I view achieving a fellow promotion as both an acknowledgement of the observed fellow-level impact plus the ability to have more insight into and ability to help advise the business (i.e., a bigger platform to help make those 'dents in the universe').

Regarding that out-of-reach cohort, I did have a chance to leave a small mark for system software next to the Fellows and Senior Fellows, as chronicled in https://vzimmer.blogspot.com/2021/07/patents-and-co-inventors.html and https://vzimmer.blogspot.com/2022/09/new-milestones.html. Recall the century-milestones I related of:

• Sr. Fellow (13) Glenn Hinton in architecture https://www.anandtech.com/show/16438/new-intel-ceo-making-waves-rehiring-retired-cpu-architects  on 11/06 reached 100 issued US Patents
• Sr. Fellow Robert Chau (13) in process technology https://medium.com/performance-at-intel/a-bright-future-for-moores-law-9adc7d4bd39d  on 3/10 reached 200 issued US Patents
• Sr. Principal Engineer (11) Vincent Zimmer in system firmware on 7/14 reached 300 issued US Patents

From https://levels.fyi

If not fellow, I have at least tried to level up to my 'Senior' taxonomy this year, though, by applying for senior member status of the ACM https://awards.acm.org/senior-members/award-recipients?year=2024&award=159&region=&submit=Submit&isSpecialCategory= 

and the IEEE, respectively

I just made it into 'senior member' under the 30 year milestone of my time with IEEE, for example. So I'm exiting this tech company as a pure-play 'senior' (e.g., Intel Sr. PE, Sr. member ACM, Sr. member IEEE), it seems. What's next on the 'senior' theme?  More senior moments undoubtedly, sliding into senior citizen-hood, ....?

So now to prepare for the next months. One colleague who left from another tech company years ago into Intel told me it took him 2 years to get over leaving his last shop. And another colleague who left Intel for a FAANG company a couple of years ago told me that you fade away quickly from people's memories at Intel, easily within 2 years (2 mos., 2 days, 2 hrs?). So I guess the overlap is 'getting over' job.last and being forgotten by colleagues.last :)

Time.  Time.  As I sit on 12 weeks of accumulated sabbatical (closing in on 16) & a vacation free recent couple of years, I suppose the universe with this 'enhanced retirement package' has finally figured out a way to make me close my Intel laptop lid. And close it I shall. 

In closing, my personal tell is that once I’m done with the meat of a conversation I start philosophizing too much.  And on that note it’s time to end this conversation since my philosophizing has eaten the word budget on this post more than usual.

Thank you all and good-bye,

Vincent

PS if you ever need to contact me, my info is at the top of https://sites.google.com/site/vincentzimmer/cv

October firmware events

Apropos of the 25 year anniversary of the first IBI/EFI/UEFI boot services at week ago, as commemorated at the 20 year milestone in https://vzimmer.blogspot.com/2018/10/  

                                                        "Ken Reneris     Oct-14-1998"  

there was a question of the coding standards for UEFI https://twitter.com/bexcran/status/1701071379171619236 recently which made me think of Ken. I mentioned how that since Ken had come over to Intel from the Windows NT team at Microsoft it was natural to adopt the NT coding standard https://computernewb.com/~lily/files/Documents/NTDesignWorkbook/coding.pdf for the original IBI/EFI/UEFI work. This includes the EFI_ERROR macros, inf's, CR macro, TPLs as simplified IRQLs https://vzimmer.blogspot.com/2015/06/guids-revisions-interrupts.html, etc. This made IBI/EFI/UEFI a sort of a cultural 'Windows BIOS' given that lineage. 

And Ken as the MS HAL owner continually interfaced with the platform. In fact, standards like ACPI pre-dated IBI/EFI/UEFI by starting in the mid-90's. Ken was deep into that work, too, as evidenced by his solo inventor ship of the now-expired S4 resume patent https://patents.google.com/patent/US6209088B1/en. 

These UEFI technology elements serve a counterpoint with coreboot, which was LinuxBIOS in 99. The latter have technology elements https://www2.cs.arizona.edu/~mccann/cstyle.html, KConfig, etc.  

https://link.springer.com/book/10.1007/978-1-4842-0070-4. So just as we have had parallel growth of Windows and Linux, there have been threads of 'Windows BIOS' (e.g., EDKII UEFI based) and 'LinuxBIOS' (e.g., coreboot and maybe less so u-boot?).

But then again, who uses 'BIOS' https://basicinputoutput.com/2014/08/will-i-be-jailed-for-saying-uefi-bios.html? 

So the blog title is firmware events. Over the last couple of weeks there was a UEFI plugfest in the Portland area and a Open Compute Project (OCP) event in San Jose. As I drove back from the former, I stopped by a bookstore and saw https://www.amazon.com/Beyond-BIOS-Developing-Extensible-Interface/dp/1501514784

on the shelf.

On that same shelf I saw 

and

Though not the immediate book neighbor, the nearby https://www.amazon.com/ARM-Architecture-Reference-Manual-2nd/dp/0201737191 reminded me of Dave Jaggar. Back in the mid-1990's we were development hardware RAID controllers at Compaq and using custom ASICs alongside an AMD 29k RISC CPU. I recall Jaggar from ARM coming to visit and explaining the ARM architecture. Part of the discourse included showing a silicon die with a small portion highlighted for the ARM core itself. It was quite a shock for me to so such small mm-squared for a CPU. My firmware lead (lead == sole design & developer) work on the SMART-2SL 

https://www.amazon.com/Compaq-242777-001-WIDE-SCSI-CONTROLLER-242777001/dp/B0002FDXLQ is but a memory to be rekindled occasionally by seeing aftermarket examples of this device. In addition to being the first device to not have a non-volatile post write cache, this work gave me the opportunity to do some interesting firmware performance innovations with a colleague https://patents.google.com/patent/US6341342B1/en. 

Speaking of CPQ, it has been a strange migration of companies for me. My original internship was with Texaco, which in turn was purchased by Chevron. Then I did my first full-time firmware development at Daniel Industries, later acquired by Emerson Electric. My first foray into PC BIOS was at Texas Microsystems (TMI) working on industrial computers, which then was acquired by Radisys. Finally, my pre-Intel employer Compaq server group was in turn acquired by Hewlett-Packard, and then split into the enterprise side HPe. Luckily Intel is still Intel.

So speaking of the development event, it spanned 3 days. I presented on the first day (lower left image)

https://uefi.org/sites/default/files/resources/Tuesday_02_Kubacki%20and%20Zimmer_Final.pdf and final

day (rightmost image) https://uefi.org/sites/default/files/resources/Firmware%20Configuration%20%E2%80%93%20Past%2C%20Present%2C%20and%20Future_Zimmer.pdf. The first day of the event included a description of SPDM https://www.dmtf.org/standards/spdm and its support introduced into the UEFI 2.10 specification. SPDM is homed at the DMTF but has associated work-product having in groups like UEFI and the Trusted Computing Group (TCG). 

In the Insyde talk Tim Lewis mentioned the growth of attacks on the UEFI network stack after many years of battering SMM. This reminded me of a recent posting I saw https://www.linaro.org/blog/ledge-blogs-uefi-http-and-https-boot-in-u-boot/ where the U-Boot community discussing using https://savannah.nongnu.org/projects/lwip/ which is a similar approach taken in https://github.com/tianocore/edk2-staging/tree/MpNetworkStack mentioned in https://uefi.org/sites/default/files/resources/7_Maciej%20Vincent_INTEL_network%20stack%20performance.pdf. From the days of discussing HTTP booting in 2009 https://dblp.org/rec/conf/csreaSAM/Zimmer09.html?view=bibtex and having the URL boot option mentioned in https://www.rfc-editor.org/rfc/rfc5970.txt has come a long way. Just as EDKII consumes cryptography as a submodule from another community, maybe it's time to do so for the basic networking capabilities.

Given that AWS started in 2006, it may have a bit short-sighted of me to have said "...emergent compute models such as cloud computing." in that SAM 09 paper.

Maybe I was keying off the 09 date of what I thought was the definitive paper on the cloud, viz., https://www2.eecs.berkeley.edu/Pubs/TechRpts/2009/EECS-2009-28.pdf.

So back to the topic of this blog, namely firmware events. On that topic, the next week came the Open Compute Project (OCP) event in San Jose. I first presented at OCP in 2015 with Mallik Bulusu https://cdrdv2.intel.com/v1/dl/getContent/671185 

and then again in 2016 on firmware updates http://files.opencompute.org/oc/public.php?service=files&t=1f7831234dce58bb875b1b5b24f7154d. 

This session last week was on the universal payload

I have been engaged on server platforms since I was hired into Intel in February 1997 to lead the IA-64 (Merced, Itanium) firmware. Along the way we devised ways to facilitate ease of firmware development, like multi-socket cache-as-RAM https://patents.google.com/patent/US7254676B2/en 

and similar for IA-32 https://patents.google.com/patent/US8078862B2/en. Palsamy and I also collaborated on UEFI and ACPI for RAS and error support https://cdrdv2.intel.com/v1/dl/getContent/671067. 

And all of these threads come together in these recent talks. The SPDM prezo mentioned at the top of the posting here entail facing the post-quantum cryptographic migrations like all of the other standards, including UEFI https://uefi.org/, TCG https://trustedcomputinggroup.org/, and others. The proposal for augmenting UEFI is mentioned in https://bugzilla.tianocore.org/show_bug.cgi?id=4087 and some prezos on the topic can be found at https://uefi.org/sites/default/files/resources/Post%20Quantum%20Webinar.pdf and https://uefi.org/sites/default/files/resources/USF_Security_Webinar_Final.pdf. The specific study on SPDM was posted as a pre-print to https://eprint.iacr.org/2022/1049 and then a journal submission in https://www.mdpi.com/2410-387X/6/4/48. 

Since SPDM has fixed message sizes, the concept of 'chunking' or breaking up the larger payloads demanded by these post-quantum algorithms is a common concern other hardware-based messaging interfaces will face, like the Trusted Computing Group's Trusted Platform Module (TPM). Interestingly this topic of post-quantum impacts on firmware standards that motivated the SPDM paper

 listed above was inspired by the study https://eprint.iacr.org/2021/041 from Cisco.

And during Q/A with the CISA presentation during the UEFI developer event I asked about formal methods for this domain. Since this talk followed the SPDM talk one recommendation was to use formal for the SPDM wire protocol. It turns out the above MDPI SPDM paper is referenced by a few formal studies of SPDM, including https://www.usenix.org/conference/usenixsecurity23/presentation/cremers-spdm and https://ieeexplore.ieee.org/abstract/document/10149352/. 

And speaking of security and standards, this upcoming week is the TCG members meeting at the Google campus in Kirkland, WA. I am Intel's representative on the Technical Committee, assuming that role after Kirk Brannock retired. 

 

But the TCG is not unfamiliar to me. I have been engaged with TCG https://en.wikipedia.org/wiki/Trusted_Computing_Group even when it was called TCPA, as evidenced by work-product like https://patents.google.com/patent/US7200758B2/en and delivering the Itanium and EFI API and platform specification, respectively.

When reading https://research.tue.nl/en/publications/communication-in-a-world-of-pervasive-surveillance-sources-and-me from the mention of Jacob in https://www-theregister-com.cdn.ampproject.org/c/s/www.theregister.com/AMP/2023/09/19/marvell_disputes_claim_that_cavium/, I hearkened back to my first ToorCamp presentation 

Based upon the slide

and discussion around the TPM, Jacob told me that we should design a TPM so that it could quickly be removed from board and chewed up/swallowed if someone tries to take your computer. Quite the privacy-preserving dietary strategy.

It's interesting to see people in person after the years of COVID seclusion and event cancellation or wholly-virtual events. Just like the psychic shock and fatigue of crowds, continual interaction and noise, it is taking a bit of effort to get re-acclimated. Part of the symptomology is falling behind on blogging, I guess, since I had intended to post this entry on the day of the EFI 25-year anniversary, not a week later. Oh well. Only so many free moments on the weekends these days.