Slashdot Mirror
AMI Introduces 'Trusted Computing' BIOS
An anonymous reader writes "American Megatrends announced its 'trusted computing' Palladium BIOS on Jan 6. It seems that the encrypted BIOS' integrity will be verified by a special chip or flash ROM, and will in turn verify the 'authenticity, integrity and privacy' of the boot loader and the operating system. Does that mean such machines may refuse to boot any other non-'trusted' OS? After all, the list of supporting corporations include AMD, Intel, IBM, and HP, of whom we heard quite favourable statements about Linux (just for example -- *BSDs will be equally affected) so far."
This will go a long way towards the war on terror. Terrorists wont be able to install and use unauthorized OS's. This could potentially save thousands of lives.
Does that mean such machines may refuse to boot any other non-'trusted' OS?
I'm pretty sure it won't. For now it'll just not have a trusted signature, so no access to Palladium-protected content. But I'm pretty sure that's the bait of a bait&switch operation...
Kjella
Live today, because you never know what tomorrow brings
If you have a palladium processor and palladium motherboard, hard drive whatever, you arent going to be limited to a palladium enabled OS, you just wont be able to use the benefits of a palladium trusted environment. So said microsoft anyhow.
People who think they know everything really piss off those of us that actually do.
...the first "trusted" bootsector virus appears?
If it's true to spec, it will load anything. Just not in the trusted mode.
Comment removed based on user account deletion
This could as easily be for military computers as well as the great unwashed. So I don't think we will be seeing these in home PC's just yet.
Not only that we don't know yet what OS they will work with. So lets not start doomsaying until the first of these are out and there is proof they refuse to run certain operating systems.
--Won't that be grand? Computers and the programs will start thinking and the people will stop. - Dr. Walter Gibbs
"American Megatrends" appears to be an anagram of "reincarnated smegma". Just felt the urge to share that,
Modest doubt is called the beacon of the wise. - William Shakespeare
So, with my limited understanding, I think of this thing running the BIOS through a one-way hash and comparing it to what's written in stone on NVRAM.
Doesn't this mean that you cannot upgrade the BIOS?
Or, that any "upgradeability" is tantamount to leaving a door open to unauthorized "upgrades" to the BIOS?
TIA.
"Provided by the management for your protection."
The original Palladium spec calls for a trusted machine to only allow trusted access by trusted operating systems. This means Palladium-encrypted code won't run except under a Palladium-rated OS. If the OS isn't trusted, then no Palladium-enabled programs can run.
This will mean that WINE will be useless for many future Windows apps, especially those dealing with multimedia. It also means future versions of Windows will be written specifically to defeat applications like VMware, so as to not violate the security.
These are bad, though they don't prevent one from booting a non-Palladium-enabled OS and using alternative applications. What I keep worrying about is the TCPA *2.0* specification. The original spec allows an alternative to a "trusted" platform, but future specs may require a PC boot a Palladium-enabled OS -- or none at all.
Comment removed based on user account deletion
You've just lost one customer, from this point forward, no matter how difficult it may be for me to find other products, I will not buy ANY hardware that contains a BIOS made made by your company.
WHile this may not seem like a big deal, I _am_ in the market for a new system, and have a decent budget to do it with.
"See, we plan ahead! That way, we never have to do anything now."
I honestly don't understand the value (or perceived value) in having this.
My beliefs do not require that you agree with them.
...but does this mean *BSD really is dying, and all those trolls have been right all along?
Comment removed based on user account deletion
That's it. A remote site can know whether or not you're running a trusted (IOW "unhackable") OS/apps. If you do, they'll send you decryption keys for playback and be reasonably sure you won't intercept them, store them permanently etc.
Just follow this little (hypothetical) chain of events:
/dev/null of the computing industry, the OS community is going to need each other to maintain a DRM-free computing zone. Open source, open protocols, open formats, open beer.
1) BIOS on new motherboard will only go into "Palladium-mode" if you're booting a "trusted" OS. For the time being, you can still run linux, but it won't have access to any "Palladium" features.
2) If you're running a "trusted" OS (eg. MS Windows UY [Up Yours]), the OS can hit the 'Net and automatically download and apply updates to itself. At some point, it could quite easily detect the BIOS on your system and apply an update so that...
3) The BIOS will no longer boot non-trusted systems. Also...
4) The OS could download a new protocol stack that could render it inoperable with other protocols. An entire new Internet based on the MSOY/BO (Microsoft Ownz You/Bend Over) protocol could spring up almost over night. MS-only network services, online shopping, etc.
Is any of this likely to happen? I don't know. But it would be possible, and I'm not sure I trust Microsoft not to try it. Even if Open Source doesn't relegate MS to the
bytesmythe
Hypocrisy is the resin that holds the plywood of society together.
-- Scott Meyer
Jumpers?
The whole thing will be a BIOS option, just like the P3 serial number was.
This thing will probably stay in the corporate/military domain forever. I see a ton of added complexity to the OS that Joe User wouldn't deal with.
There's a potential for abuse in pretty much any new technology, but I can also see when and where a 'trusted OS' will be a huge step forward.
'Untrusted' hardware will exist so long as there's a market for it. I see no reason to get too worked up over it.
I don't need no instructions to know how to rock!!!!
Also, conceptually, this will still not solve the trust issue, as someone could still open up their case and replace their BIOS chip.
:-)
Ever tried to replace a BIOS that is soldered directly to the board? if so, please let me know how it went.
"See, we plan ahead! That way, we never have to do anything now."
I think this reminds me of the situation with the CPU IDs in the Intel Pentium processors. I have yet to see a BIOS supporting such processors without the ability to disable the serial number.
I suspect that the "trusted computing" features will be similar it its ability to disable such things. It will be required of virtually every motherboard manufacturer who wants to compete. I can't imagine hardware manufacturers being pressured into making a palladium only system.
That's one type of motherboard I won't be buying.
Malike Bamiyi wanted my assistance.
BIOS starts...addressing the TPM chip that verifies the authenticity of the BIOS.
What good is it for the BIOS to verify itself?
If it's not authentic (i.e. compromised), would it really bother to address the TPM chip at all?
"It's a very tangled subsystem." --Windows kernel guru
Comment removed based on user account deletion
According to US patent 6,327,652 that is indeed correct-- unsigned code simply doesn't get any access to secured data, and may not even be allowed to run on the same desktop as signed code. If the boot sector doesn't pass the BIOS's signature check, it's not given access to the machine private key, and therefore can neither unlock locally stored encrypted content nor pose as a trusted system to other machines on the net. The only bait-and-switch here is the possibility of a concerted push by software or content producers to require a trusted runtime. One minor wrinkle is that this will require boot-selector programs like LILO to either be code-signed or be unable to properly boot signed operating systems.
...when you're writing a game...tweak the difficulty of "Easy" to something [your mother] can cope with. -- onion2k
Comment removed based on user account deletion
I told AMI (link in the article: marketing@ami.com) that I don't think of this as a "feature". Computer manufacturers have backed down on much less invasive technologies (Pentium III's unique ID, for instance) before; I'm still a little bit hopeful that with all the competition in the mainboard scene we might be able to convince manufacturers not to adopt consumer-hostile technology like this.
The minute Palladium is up and running on these boxes, watch for manufacturers to go "WinModem" only: meaning BIOS's that only boot Windoze.
Want to boot FreeBSD, so you played around with the BIOS? DMCA days "Go Directly To Jail, Do Not Pass SourceForge, Do Not Collect $200"
If it can only run operating systems that can be trusted, how the hell am I going to be able to get it work with Windows?
Ergonomica Auctorita Illico!
Amazingly, it only takes six Microsoft employees to product +5 posts. Think about it!
Is Oracle, BEA, IBM or any of the OSS projects going to do this? For what? What value is brought by wasting time and money implementing a strategy that has little or no benefit to the customer?
Bah, this is a scarcely concealed attempt to appease the media giants (the people who FUND RIAA). Lack of customer interest will likely cause this to fail.
But what do I know? My company (who's in a "budget crunch") burns enough cash to single-handedly cause global warming, and we're profitable. Whatever, I'm going back to Oz where things make sense...
Computer Science is Applied Philosophy
I run OSX and Linux on PPC machines. I do not miss the world of the paranoids in Redmond.
I don't need a 4 gig chip to type a paper or Photoshop a picture of Rumsfeld and a goat.
Frame rate for games? Got my PS2 for that.
photosMy Photostream
I will never buy one of these systems in my lifetime.
The government has a defect: it's potentially democratic. Corporations have no defect: they're pure tyrannies. -Chomsky
1. Input
2...499. None of your your damn business
500. Output
"Trusted computing", hah! Sure, the apps might trust each other and the system, but I won't!
The promise has been made that the user, or at least the OEM, can add trusted signers.
:) Gimme!
So does this mean I can remove the microsoft signatures to prevent any microsoft code being run at all?
'Untrusted' hardware will exist so long as there's a market for it. I see no reason to get too worked up over it.
Right, because the PC market is governed by pure capitalism. There are no monopolies out there abusing their power and causing the market to do things it wouldn't otherwise do. Good, I guess there's no reason to be worried at all. (shudder)
Life is too short to proofread.
"Weapons should be hardy rather than decorative" - Miyamoto Musashi
I think that goes for OS's too
No. I'd make the same remark, but it would be a bitter sarcastic remark instead of a humorous sarcastic remark.
And illegalizing drugs eliminated that market quite effectively.
Microsoft is not interested in your security. Microsoft doesn't even much care about their own security, as long as the license is already paid for. They only want to make money and lock you into long term deals. The massive and drastic tactics by Microsoft to lock consumers into their platform indefinately is because there is actual competition (Linux, and an invigorated Macintosh) now. It is so plainly obvious that it stuns the senses.
History should already be telling the world never to trust anything from Microsoft.
Well, I am worried about the development too, but at the same time, I think we must realize that no matter what they throw at us, someone will crack the protection.
Ultimately, the entertainment industry will only be able to control individuals who allow themselves to be controlled.
The rest of us will actively seek solutions that remove us from the evil claws of "Digital Rights Management", or rather "Consumer Ass Ramming" as it should really be called.
They can encrypt and protect all they want, but someone will come through. Someone will work constantly on giving us our rights back - even if it means doing so illegally.
If it becomes illegal to have control over one's own system and play off whatever one pleases, I will stand in line to break the law. Constantly. The more they try to control me, the more I will break laws.
I am not saying that people's concerns about violated rights to control one's own system is not justified. I am just saying that we will prevail in the end. With the incredible amount of brainpower available to those with a liberal mind, the entertainment industry may win over the sheep who do not realize what is happening, but they will not get the ones that don't want to be ass-rammed.
Sorry for the rant, but hopefully someone else agrees that the fight is far from over, and no matter what they tro to do, we will continue to fight...
Clever signature text goes here.
This technology is intended to support the TCPA 1.0 specification for "trusted computing". What "trusted computing" is supposed to mean is that if a file has a label on it saying "don't copy me", then it is in principle impossible for the user to copy the file (other than in the ways permitted by the digital "rights" management label).
Once you understand this, you'll see that the purpose is quite clear: of course boxes equipped with this BIOS will refuse to boot Linux. That's the whole point; they will be intended only to boot operating systems that strictly support DRM. Each machine will have unique "integrity tokens" which can be used as digital signatures, so that everything you do on the machine (create a document, contact a web site) can be traced. Since you'll have to pay for your downloads on a credit card, this can all be cross-correlated. The integrity tokens will be digitally signed by the manufacturer, so that any action taken on the net by the owner of one of these beauties can, at least, be traced to the original purchaser of the machine. Secret, DMCA-protected protocols will assure that only "trusted computers" can connect to their web sites.
Now, of course, initial implementations of this concept are likely to have flaws that can be exploited by crackers (example: find some way to write a program that replaces the "trusted" OS with a BSD or Linux kernel; reprogram the flash chip to disable checks), but I fear that they will get it right eventually.
At some point, then, the net will bifurcate: there will be a world of glorified DVD players calling themselves computers interacting with restricted network sites, and a world of general-purpose computers interacting with sites that follow standard protocols. Attempts to outlaw the "free world" will not succeed because it will do too much damage, but those who participate in the "free world" will be viewed with suspicion, called pirates, etc. ISPs might be pressured into refusing to connect with "untrusted" machines.
After five years or so, though, I expect the whole thing to fall apart, because countries that don't go along with this brain damage will acquire a technological lead, as the US enters an era where computer science is treated the way that the USSR treated science: dangerous state secrets not to be shared.
Okay, my take, based on working knowledge of 'trusted' computing and hardware design (I used to be a support enginner in Intel's server division,) is as follows:
'Trusted computing' relies on the fact that every component is known to be secure. Of course 'secure' is a cagey term, but in this case, it means that the end application knows that nothing is interfering with it. The uses vary, from DRM to financial transactions, to other uses we haven't thought of. But, there are three main pieces in a trusted system:
1. The hardware. The hardware needs to be 'trusted' in that we are certain that there is no hardware tampering or eavesdropping going on (of course, this applies only the the internals of the computer, a packet sniffer, or even a keyboard monitor, would be external, and ouside the scope of monitoring,) and to make sure that the machine is the machine it's supposed to be. This really started with Intel's Pentium III adding a processor serial number. The point of that (as with Palladium) was that each machine could be positively identified. If you had previously made that computer 'trusted', then set it so that only trusted machines could perform a said transaction, we could guarantee that the end user is who he says he is, from a hardware standpoint. This new BIOS is much the same way. Each board with this BIOS will be able to say "Yes, I am the motherboard that was here when this software was installed, so yes, I am the same computer." Obviously, this has implications for hardware failure, even moreso than Windows XP's activation problems.
2. The OS. The OS must have support for trusted computing. It must be able to partition off the 'trusted' applications from the untrusted ones. It must be able to encrypt the contents of the drive, and only allow trusted applications to access protected data, and only allow trusted applications to access the 'trusted' part of memory. (So as to disallow one program from sniffing the program files, memory, or data transport streams of a protected application.) This would probably see alot of use by multiplayer online games, as they could make certain that no third-party applications that reside on the game-running-PC could be used to cheat. (As with some of the 'god map' programs for Everquest.) Again, this does not protect the data stream once it leaves the computer, an encrypted network connection would be required. Obviously, for the OS parts to work, users must log in to the system with a username and password at least. Biometric security would be better, so as to more certainly guarantee that the user is who he says he is.
3. Applications. The entire purpose of 'trusted computing' is the applications. Applications that need to know that the user is who he says he is, and that is done by both the OS and the hardware. As with the game example above, other uses are financial transactions (for example, you could set it so that only your computer has access to your bank account records, so that even if someone stole your hard drive, and your username and password, they still wouldn't be able to get at your data,) and DRM. It makes a perfect DRM vehicle, as now the labels can enforce the one-computer rule. A downloaded file would refuse to play without the original application, OS, and hardware.
The question is if these systems can boot a non-trusted OS? Of course they can! You won't be able to use trusted features (for example, your bank's online account access wouldn't work,) but you could use it just fine for applications that don't use MS' Palladium. Just like the Pentium III's serial number could be disabled, and all you lost was access to the (very few) programs that required it.
Another non-functioning site was "uncertainty.microsoft.com."
The purpose of that site was not known.
Let's say the Microsoft Watch is a big success. Go ahead and laugh. They've got the bucks to seed these sorts of things into the marketplace for years. Eventually something will stick. If not the Watch then the MS Clock or the MS Hairdryer or the MS Refrigerator, or something.
Now, let's say you, as a geek, have reprogrammed the thing so that it runs FreeWatch, the oss embedded watch OS that does all the cool stuff you want it to.
The next version of the MS Watch is Trusted. It only runs approved software. It only runs approved services. And if it doesn't recognize the os and the software, it just doesn't run. Of course, approved means approved by Microsoft, or by the Watch Software Consortium. And they'll be happy to add FreeWatch, for $500 million and a 25% cut of the profits.
If you don't think that's the way it will work, think again, very carefully. It isn't Trusted to Microsoft until it's utterly predictable. It will only run MS-approved software. It will only display MS colors. Once it's utterly predictable, then support costs go down, service fees go up, and 3. Profit!
Now, extend that to the PC platform. Microsoft's stated goal is for computers to be as predictible as kitchen appliances. That means they run exactly the way it runs. Support costs go down, service fees go up. Paladium, TCPA, DMCA, DRM, it's all the same. It is to give you absolutely reliable computing. To end hacking, cracking, viruses, tinkering, end-user encryption, and everything else most geeks hold near and dear. And incidently, to put the hands of the electronics and entertainment industries into your wallet, forever.
If you think this is unlikely, as yourself, why is the membership list of the TCPA secret?
Maybe you still don't agree with me. Maybe I'm wrong. I really hope so. But perhaps it's worth keeping an eye on things.
Hey I just got a prototype of the trusted computing BIOS. It's not so bad. As far as I can tell I can do all the things that I use to.
No one is controlling my hardware but me. I still worry about the way that Microsoft is &$^^ *$(#@) ()%)$! but other than that it's not too bad.
Oh yeah and I still have concerns about how the government is )^%$ $^*** $#*%$ &^. (&$# %$*@% (^% . But I'm sure we'll be able to stop that.
We do need to watch the entertainment industry also because they're still trying to #@*^ %#^ &$ (&$%)*%.
Yep these new BIOS are nothing to worry about.
The race isn't always to the swift... but that's the way to bet!
"One file slips out and bamo - no one is paying for it anymore."
Well, high-quality digital media with no copy protection has been sold for over 15 years and the people selling it made record profits last year.
Its called the "compact disk". Perhaps you've heard of it? Phillips invented it, and it turns out that not only can you make copies for under five cents, you can compress them digitally to make files to store on any device.
It may catch on.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
It just sends a wake-up call to the TPM chip. "Hey can you take a look at me and tell me I'm clean?" The TPM chip is still the top-level.
Live today, because you never know what tomorrow brings
Read it here: http://www.cl.cam.ac.uk/%7Erja14/tcpa-faq.html
The two last sections are worth repeating here:
Trusted Computing FAQ | Free Dawit Isaak!
Comment removed based on user account deletion
> But isn't one of the "advantages" of Palladium that your friendly neighborhood viruses can no longer run and erase your
> MP3s/JPGs/etc, because they are not "trusted" code? I'm not sure how that will relate to unsigned VB scripts. It's designed
> to protect the consumer from themselves... and legislate what (Microsoft's, I assume) programmers could not implement
> properly.
No, Palladium won't help with that. Most viruses and trojans today are just memory resident processes like any other. There is no easy way to separate a "good" program from a "virus" program. (Seriously, how would it? And how would it be able to tell if a "good" program had an exploitable backdoor or buffer-overflow in it?) It's true that palladium might protect you against, say, boot sector viruses, but there are ways a properly implemented operating system can do this, too.
We already have all the hardware we need to provide computer security (namely, protected memory). Palladium's only purpose is removing the ability for users to inspect and modify their own computers (in an attempt to make DRM schemes fly), so don't listen to what they tell you!
PPC
Don't forget SPARC! It is also an open alternative to Wintel with a good selection of excellent operating systems: Solaris, Linux, and *BSD.
We all should embrace PowerPC, SPARC, MIPS, and other well-known and easily licensed brands of ISAs. These--as long as Congress doesn't screw everything up--will be the path forward when Microsoft, Intel, et. al. try to shove TCPA down everyone's throats.
Also, it certainly doesn't hurt that Sun, SGI, IBM (RS/6000), and Apple all produce really good hardware that lasts into the secondary markets. It isn't hard to find ten-year-old examples of each of these brands still serving useful purposes throughout server rooms and hobbyist desktops all over the world.
When the Wintel-brainwashed masses find themselves backed into an alley with the only exit closing rapidly, we can say to them, "We have the way out!" (imagine Microsoft reeling at the bitter taste of their own words:)
Healthcare article at Kuro5hin
PLEASE go and read about both TCPA and Palladium before flaming them. They are NOT the same thing. Really.
Both TCPA and Palladium are ways of achieving "trusted computing", which is the ability for a program to run in an environment where the program knows (and can certify to people other than the computer's owner) that no other unwanted software is monitoring or modifying its actions. But how they are implemented is quite different.
TCPA uses a secure boot process. The BIOS verifies that the boot block is trusted; the boot block verifies that the os kernel is trusted; the kernel then verifies the trust level of specific applications; etc. This is what this BIOS implements. The main feature of TCPA (in my mind) is HARDWARE SIMPLICITY -- all that is needed is a small extension to the BIOS which modifies the boot process.
Palladium is from Microsoft, and it shows. Palladium is designed to start up in already running copy of pretty-much-unmodified Windows. Loading the Palladium subsystem (now known as a nexus) is supposed to be fairly easy, sort of like loading a device driver. But to get this ability they PAY with hardware complexity -- the CPU itself has to be changed so that the address space of the nexus can be partitioned, so it is not visible to or under the control of the main Windows kernel. This is one of many reasons why you don't see any Palladium enhanced systems in the real world yet -- Intel (or AMD) has not yet started selling a chip which supports what Microsoft needs to make Palladium work. A main design goal in Palladium seems to be "don't mess with Windows, we don't want to break legacy code".
Thank you for taking time to contact us here at AMI. We are sorry to hear
/ /www.theinquirer.net/?article=7103
h itepaper.pdf
of your decision to not seek out an AMI solution for your next purchase.
While we respect your right to make that decision we would like to take a
minute to underline some relevant points about our announcement that were
not adequately conveyed in the "article" posted on Slashdot. We urge you to
please give us a minute of your time to fully understand what AMI is
offering and thus be able to make a fully informed decision.
It must be noted that AMI has not announced support for Palladium. Palladium
is an initiative by an OS entity that is slated for the future. To be
honest, though we do know about it, AMI has not begun any development
related to it. At this point we have not made any decisions on support
either.
TCPA does not equal Palladium. While certainly there is some future
development overlap between the two, TCPA is being introduced by OEM's as a
security option to protect systems through hardware and firmware. This
feature is completely optional to our customers (OEM's, ODM's, CM's and
other system builders) that they may choose to make it available or not
depending on the needs of their market. We have had requests from a number
of customers for this technology.
Regarding the limitations of a system with TCPA I would offer the link below
to the public specification for further information on compatibility with
different OS's, and hardware. Based on that spec we can tell you that it
does not limit the ability to run Linux (or any other open source solution).
As a smaller company itself, AMI has always supported innovation and
creativity as these have been our main tools in competing against much
larger companies in our industry. We would not do anything that in our
minds would damage our credibility or reputation for world class BIOS
solutions and will carefully evaluate this type of feedback when it does
come time to examine any future technologies. We would also like to
recommend that anyone who is opposed to a Palladium-type solution in the
future, please make that known to OEM's and system builders. As they are
our customers, we definitely listen to them in terms of what they (and
hopefully their customers) will want in future BIOS.
Thank you again for your time in contacting us and we hope that this and
some of the links below will shed some light on AMI's plans.
LINKS
Original Articles on theinquirer.net
http://www.theinquirer.net/?article=7089
http:
AMI TCPA module Whitepaper
http://www.ami.com/support/doc/TCPA_w
TCPA Website
Basically wrote them and told them I wouldn't be buying from them from now on. I would reckon this looks like the company is receiving a bit of angry emails from people who build their own computers and/or are involved in the computer industry.
Maybe they're worried about what WE think!? Nahhh...
This guy is way out there
So, is there a problem? Yes, there is. You can't modify the kernel. If you try, it will not be trusted by the TCPA chip and so no application running on that kernel can gain access to any feature, media or application that requires TCPA. Certifying a Linux kernel (or any other OS) as TCPA-compliant is expensive and you would need to do it for every modification of the kernel. What value is the GPL if you can't use the source to create your own kernel?
Ross Anderson's TCPA / Palladium FAQ has a more detailed discussion (excerpt from section 18):
[TCPA hardware is referred to as the "Fritz chip" in the FAQ]
Trusted Computing FAQ | Free Dawit Isaak!
"'Untrusted' hardware will exist so long as there's a market for it. I see no reason to get too worked up over it.
There will be no market for it. Why would an OEM install hardware that disrupts most "innovative" OS and office software maker that brings them all of there profits!
Linux makes up %2 of the market!
If joe six pack buys a "Free" pc yet can not bring "trusted" word docs home from work or have the latest and greatest XP Media edition to watch all the new hollywood hits or visit porn sites that are "protected" then he will return it. Return == lost profits. I bet Microsoft is blackmailing all the motherboard makers and threatening to throw them out of bussiness if they do not include drm oops I mean pallidium. Porn sites already encrypt alot of there video's into WMV files and I noticed that they also use javascript to prevent copying and pasting pics from there site to your computers. Like the vcr's before them they will drive the market and Microsoft and Hollywood will join them.
The average ignorant joe will demand it and will be forced on everyone. If oracle pisses off Ms then bam they can not develop on Windows. If borland wants to write
We all should be worried and worked up about it. If the apps require it then it will be everywhere.
http://saveie6.com/
Gigabyte offers mobos that support two bios copies. It's there to provide BIOS failover (not that I've ever, ever had a problem with BIOS failing), but perhaps it could be adapted to allow dual-boot bios between Palladium and non-Palladium OSs. Tom's hardware explains Gigabyte Dual Bios