# Why open source firmware is important for security

DevFeed: [Why open source firmware is important for security](<https://devfeed.tech/articles/why-open-source-firmware-is-important-for-security-35219.md>)

Original publisher: [Read original article](<https://blog.jessfraz.com/post/why-open-source-firmware-is-important-for-security/>)

Published: 2019-05-08T15:09:26Z

Content type: article

Language: en

Sources: [Jessie Frazelle](<https://devfeed.tech/sources/jessie-frazelle.md>)

Topics: [Open Source](<https://devfeed.tech/topics/open-source.md>), [Security](<https://devfeed.tech/topics/security.md>), [UEFI](<https://devfeed.tech/topics/uefi.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Xen](<https://devfeed.tech/topics/xen.md>), [cpu](<https://devfeed.tech/topics/cpu.md>), [intel](<https://devfeed.tech/topics/intel.md>), [x86](<https://devfeed.tech/topics/x86.md>)

Tags: [cpu](<https://devfeed.tech/tags/cpu.md>), [firmware](<https://devfeed.tech/tags/firmware.md>), [intel](<https://devfeed.tech/tags/intel.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [operating-systems](<https://devfeed.tech/tags/operating-systems.md>), [security](<https://devfeed.tech/tags/security.md>), [uefi](<https://devfeed.tech/tags/uefi.md>), [x86](<https://devfeed.tech/tags/x86.md>), [xen](<https://devfeed.tech/tags/xen.md>)

## AI overview

The article explains why open-source firmware matters for security. It examines privilege levels below the operating-system kernel, focusing on SMM and UEFI at Ring -2 and Intel Management Engine at Ring -3, where proprietary code has extensive system privileges and limited visibility.

## Source excerpt

I gave a talk recently at GoTo Chicago on Why open source firmware is important and I thought it would be nice to also write a blog post with my findings. This post will focus on why open source firmware is important for security. Privilege Levels In your typical "stack" today you have the various levels of privileges. Ring 3 - Userspace: has the least amount of privileges, short of there being a sandbox in userspace that is restricted further. Ring 0 - Kernel: The operating system kernel, for open source operating systems you get visibility into the code behind this. Ring -1 - Hypervisor: The virtual machine monitor (VMM) that creates and runs virtual machines. For open source hypervisors like Xen, KVM, bhyve, etc you have visibility into the code behind this. Ring -2 - System Management Mode (SMM), UEFI kernel: Proprietary code, more on this below. Ring -3 - Management Engine: Proprietary code, more on this below. The negative rings were made up because there was no other way to express something with more privileges. From the above, it's pretty clear that for Rings -1 to 3, we have the option to use open source software and have a large amount of visibility and control over the software we run. For the privilege levels under Ring -1, we have less control but it is getting better with the open source firmware community and projects. It's counter-intuitive that the code that we have the least visibility into has the most privileges. This is what open source firmware is aiming to fix. Ring -2: SMM, UEFI kernel This ring controls all CPU resources. System management mode (SMM) is invisible to the rest of the stack on top of it. It has half a kernel. It was originally used for power management and system hardware control. It holds a lot of the proprietary designed code and is a place for vendors to add new proprietary features. It handles system events like memory or chipset errors as well as a bunch of other logic. The UEFI Kernel is extremely complex. It has million