11 ms·
I am the engineer at System76 currently working on this. We are using ME cleaner with -S on all systems where possible - HAP bit will be set AND code removed. A
by jackpot51 9y ago
I am the engineer at System76 currently working on this. We are using ME cleaner with -S on all systems where possible - HAP bit will be set AND code removed. All systems will then be tested thoroughly in this configuration before it is released to customers.
Relevant source code can be found in the following places, keep in mind that it is still work in progress:
- System76 Driver with Firmware Update support: https://github.com/pop-os/system76-driver/tree/firmware_artful https://github.com/pop-os/system76-driver/tree/firmware_artf...
- Firmware Update Frontend: https://github.com/system76/firmware-update https://github.com/system76/firmware-update
Please ask me anything
- deleted 9y ago[deleted]
- Sir_Substance 9y agoI have so much respect and a little envy for the work you're doing at the moment. You're working on one of the most far-reaching and undeniably positive software projects I've heard of in years. Best of luck! It's possible that at some point (depending on if it gets open sourced) I'll be grabbing some of your work and trying to wrangle it to work on my desktop. Is this an area where I seriously risk bricking my CPU, or are there safeguards that cause these kinds of instructions to either work or safely fail?
- jackpot51 9y agoYes, you risk bricking your computer. You can create a Raspberry Pi with a SPI clip for fixing bricked computers. If you have BootGuard, you will brick your machine, unless you have the manufacturer signing key. We have the signing key for our laptops, so we are able to sign updates for the four systems with BootGuard: galp2, galp3, lemu7, and lemu8.
- microcolonel 9y ago> Is this an area where I seriously risk bricking my CPU As far as I'm aware, there's no particular state involved for you to brick the CPU, but you can easily write a firmware which will prevent boot, or fail some time after boot (In the case of removing critical ME blobs). You could brick your board temporarily, but you're going to be using an external flasher (with a convenient little SOIC clip :- ) anyway, so fixing it is a matter of writing back the old/working image. This is, of course, assuming you are able to write anything that works to the flash, which you might not be able to thanks to BootGuard.
- simcop2387 9y agoDo you expect any flak from Intel on this decision? I hope not, because I'm going to be in the market for a new laptop in the next year or so and this just put you guys at the top of the list.
- jackpot51 9y agoNo, we do not. We do expect to pressure them to do the right thing, which is one of the following: - Release ME source code - Remove ME from consumer products - Have a provable method of disabling the ME entirely
- GordonS 9y agoEven if they released source code, how could we know if was genuine?
- jackpot51 9y agoReproducible builds
- WatchDog 9y agoIt should compile to the same binary, you just don't be able to sign it i guess.
- castle-bravo 9y agoWouldn't that require them to open their compiler too? Compilers can be modified to inject malicious code into specific programs.
- simcop2387 9y agoAs long as the build is reproducible then they don't have to open it up. It would mean however that you'd still need to audit the compiled program to find anything injected in by the compiler.
- leeoniya 9y agohow do you find time to work on all of this and BDFL RedoxOS? is Redox partially sponsored by System76 via allotting time for you to work on it?
- jackpot51 9y agoI work on Redox at night and on weekends. I try to write software that can be used in both places. For example, the graphics library orbclient was used in the firmware updater, and the UEFI library from the firmware updater may be used for a Redox UEFI bootloader.
- feikname 9y agoYou work in Redox almost everyday and at System76, that's pretty impressive, IMO. Kudos to your work.
- jackpot51 9y agoThanks!
- DiabloD3 9y agoI once made a joke we should make an OS in Rust. Awesome, I finally get to see the punchline. ;)
- d6e 9y agoThis Redox? https://www.redox-os.org/ https://www.redox-os.org/
- cassidyjames 9y agoYep! Jeremy (jackpot51) is the lead developer. https://github.com/jackpot51 https://github.com/jackpot51
- castlec 9y agoI literally just got my system dropped by UPS yesterday. What do you suggest I do? Wait a bit or try bricking my system now? Side note: PopOS wasn't ready for release. I had lots of problems getting the initial account created and on corporate wifi (PEAP).
- jackpot51 9y agoWait until the firmware updater is released through the System76 stable PPA.
- castlec 9y agoThanks. Good luck and keep up the good fight.
- phinnaeus 9y agoWas it damaged at all? I would suggest sending it back. In the future, don't accept packages from UPS that show obvious signs of mistreatment. Although I'm not really sure how to do this if they just leave it on your front porch.
- jackpot51 9y agoOn the side note - a new initial setup was released today for Pop that may have fixed your account creation issue. I am sorry if you ran into problems with Pop.
- castlec 9y ago
- Iolaum 9y agoReading this: > System76 will investigate producing a distro-agnostic command line firmware install tool. Follow us on your preferred social network for updates. I am wondering. Have you considered using the [Linux Vendor Firmware Service](https://fwupd.org/ https://fwupd.org/) ?
- jackpot51 9y agoYes, we have. There were compatibility issues that I am still working to resolve.
- Iolaum 9y agoHopefully they can get resolved in the future. Keep up the good work!
- hughsient 9y agoIt doesn't look like any work at all is actually being done on fwupd from my point of view. I've basically given up hope at this point that System76 is going to do the right thing. Source: Am the LVFS and fwupd maintainer.
- jackpot51 9y agoI am working on embedding all firmware flashing files into one EFI executable when it is built by our CI - this should make it much easier to use from fwupd.
- solarengineer 9y agoHopefully you and the LVFS,fwupd maintainer both cool down a bit and get back to the discussion table. You will both make history here, with more laptop sales and more awareness of LVFS+fwupd. Win-win, as I see it. All the best.
- jackpot51 9y ago
- AdmiralAsshat 9y agoDoes Ubunutu need to remain on the laptop after the driver has been loaded? I'm aware that you're working on a distro-agnostic tool. In the interim period, however, if someone with a System76 laptop wants to use Fedora while still disabling ME, can they simply load stock Ubuntu/pop_OS long enough to install the driver and disable ME and then wipe the drive and reload their OS of choice?
- jackpot51 9y agoYeah, they can certainly do that.
- dsp1234 9y agoJust running from a live cd/usb is probably less disruptive than wiping, installing, wiping, installing.
- tmzt 9y agoCould this be added into something like flashrom from the coreboot project? Would it also be possible to support consumer-controlled signing keys, placing control of the system in whose hands they belong?
- jackpot51 9y agoFirstly, the ME section is locked until a message is sent to the EC. Flashing firmware on a live system can be dangerous, more so on a laptop. Our flashing method has to take place in EFI. Signing keys are fused into the CPU for boot guard when the CPU is attached to the motherboard during production, for soldered CPUs like the U and H class. Having a customer signing key would seriously complicate BIOS updates, as only one key can be utilized, meaning our firmware updates would not work. It would also make returns much more difficult, as all CPUs with customer keys would have to be replaced. Right now, boot guard is only used on the Galago and Lemur.
- tmzt 9y agoThere's no way to use TPM as a store for these signing keys because they are needed too early in the process? Yes, I expect as a general solution for your customers it might be overkill, but as this is basically the cutting edge of public domain research on these topics it would nice to know what's possible for customers who would take the risks. Understood, I have more reading to do in to how the EFI shim/flasher works.
- monocasa 9y agoYa'll hiring?
- cassidyjames 9y agoWe're not actively hiring for anything specific, but we accept interesting applications regardless. See https://system76.com/careers https://system76.com/careers
- 616c 9y agoNext time I consider a laptop, you made it tot the top of my list, even if it costs more. Hear that, Intel? I will put money where my mouth is. I am not sure I can afford any of these RISC-V chips and they are still alpha quality beyond the Talos, but those of my ilk will do their damndest to make you pay for tone deaf reaction.
- srcmap 9y agoMe too! @jackpot51 system76 folks - Are your systems currently using opensource boot bios? If not, any plan to do so in near future?
- jackpot51 9y agoNot currently. I have experimented with coreboot but did not get far yet. We are tied into AMI for most machines right now, and I would love to cut them out and go open source! We may be experimenting with coreboot more in the near future
- carussell 9y agoWould you consider partnering with someone like Dell as a supplier? I've written this elsewhere, but I'll repeat: it seems a shame that folks like System76, Purism, aspiring Kickstarter campaigns et al aren't leveraging the supply chain already in place for Chromebooks. In the case of Purism, for example, x86-64 Chromebooks comparable to Purism's low end models can be had from Dell for 3/4 the asking price of the former. Considering that the driver situation is necessarily a solved problem for Chromebooks, and they're already using coreboot, it seems silly to start a parallel effort to deal in hardware the way System76 and Purism are doing, rather than just approaching Dell about a white label deal to supply you with hardware components that are already known to work.
- _eht 9y agoAlienware went this route and they turned then into mostly generic video card boosted mediocrity. The business model of system76 was what I was personally looking for and I've been very happy with my latest laptop from them. For me personally, the luster would have been lost coming from Dell.
- ezoe 9y agoAny plan to support firmware update via fwupd?
- Erlich_Bachman 9y agoCan you please consider offering ECC memory in your laptops? ECC is a very important technology for businesses. Errors in non-ECC memory, while somewhat rare, are not once-in-lifetime-of-universe, they are more like 1 bitflip per year kind of thing, which for some businesses can be considered worth talking about. There is a demand for this, and almost no one is doing this. The only other company that has done it so far is Lenovo, and if you know anything about privacy and hidden adware and history of spyware - you will not buy any Lenovo product. ECC memory would require a Xeon, but it would be possible to underclock it to bring it to a mobile heat emission profile.
- brians 9y agoOr AMD, or ARM
- deleted 9y ago[deleted]
- jkollross 9y ago45W mobile Xeons that support ECC already exist. https://ark.intel.com/products/series/97141/Intel-Xeon-Processor-E3-v6-Family#@mobile https://ark.intel.com/products/series/97141/Intel-Xeon-Proce...
- Already__Taken 9y agoIsn't mobile more like 15W though?
- mciancia 9y agoDepends on the definition of mobile I guess.
- noir_lord 9y agoI've got a T470P (i7-7700hq), that's a 45W part in a 14" laptop. If I balls to the wall it I can kill the battery in 90 minutes (though they are swappable) but I average ~6 hours under actual work conditions (VMs and Intelligent). It spends the vast majority of time sat at a few percent utilisation but the processing power is there for those few second operations you run infrequently (build from scratch, indexing a large project etc). I love it frankly, not turned desktop on at home more than once or twice since July.
- throwaway7645 9y agoA little off topic: I've been considering system76 for awhile. I see Dell also offers Linux laptops now and has for awhile. Any reason why I should pick system76?
- zachrose 9y agoThat System76 disables Intel ME is pretty cool.
- throwaway7645 9y agoYea...I should've asked in addition to that.
- mpd 9y agoMy home laptop is from a Kudu Pro from System76, while my work laptop is a Dell Precision 5520, with Ubuntu installed. My current Kudu is a replacement for another Kudu that died after a number of years. For my particular case, the Dell has superior hardware (also, it's about a year newer), but its Ubuntu install has strange problems, and I get crash notification popups somewhat often (including immediately upon logging in for the very first time). The Kudu's install has been rock solid. System76 has far superior support.
- s4vi0r 9y agohttps://www.sec.gov/news/press/2010/2010-131.htm https://www.sec.gov/news/press/2010/2010-131.htm Would be a good place to start, as far as not supporting dell goes. Linux is also a first class citizen w/ system76 - Dell has the factory linux xps13 e.g. but I've heard from a handful of friends who use one at work that its obvious Linux was just kinda slapped onto the laptop at the end of manufacturing or whatever. Support is also probably much better with System76.
- oneplane 9y agoThe article and repo seem to be targeting Laptops and there seems to be some specific desktop-related lines in there. In the laptop side of things, it clearly states the Intel ME does not have any function, but it does not say the same for desktops. I imagine the ME is also useless for desktops, but maybe I'm wrong here and there is a reason this distinction is made?
- jackpot51 9y agoThe reason is that our laptops have more homogeneous firmware than our desktops.
- rlonstein 9y ago@jackpot51, any word on if System76 will build a Ryzen-based laptop?
- hyolaris 9y agoI've had this question lately also, and now have another reason for asking.
- gnu8 9y agoI'm not too familiar with the inner workings of Intel ME. Have you verified that setting the HAP bit is effective with the ME code removed? If so, then that is obviously the way to go. However, if the code that interprets the HAP bit and shuts down the ME is removed (as well as everything else not necessary for the computer to run), which option is actually safer, HAP or code removal?
- forapurpose 9y agoA very important question.
- Kliment 9y agoThe safest option is to do both, and that's what's happening here (though the post is not clear on it, they're running me_cleaner with options that both erase all but the initial loader module of ME, and set the bit so it disables itself after startup instead of loading other modules)
- forapurpose 9y agoGenerally speaking, if you have two options, it's not at all true that doing both is necessarily better than doing one or the other.
- jackpot51 9y agoWe do both - set HAP and remove code.
- forapurpose 9y agoI think gnu8 was asking: Does removing the code interfere with HAP mode (e.g., by removing code necessary for HAP to be activated, maintained, operated, etc.)? Is both really safer than one or the other? For example, there may be two drugs that can treat my illness; taking both might not be better than taking one or the other.
- 9y ago
- smacktoward 9y agoGive us a System76 laptop with a TrackPoint and you will need to start carrying a snorkel to be able to breathe underneath the piles of money I will throw at you. (It's never going to happen, I know. But a fellow can dream!)
- cassidyjames 9y agoNever say never! We listen to feedback. :)
- rce 9y ago+1 for TrackPoint! The other thing I can't give up from my Lenovo is having two batteries in the machine (it has a 4 cell 32WH and 6 cell 72WH)
- IE6 9y agoThis - coming from thinkpads the trackpad / keyboard appears to be too much of a downgrade for me to spend money on a System76 but I have been following them for some time.
- linuxnoob 9y agoAnd a X220 style keyboard while you're at it please!
- atomicnumber1 9y agoThis is excellent! Thank You for doing this. Someone is listening.
- haZard_OS 9y agoThank you for all you do! I am still on my first System76 laptop and I am continually impressed with its quality (and Pop OS is sweeeet!).
- srujn 9y agoDo you support Qubes OS on any of your systems?
- colemickens 9y agoWhy why why won't you just use LVFS? A number of OEMs have absolutely no problem delivering updates through all sorts of tools and channels. It feels NIH and is exactly why I'll be buying Dell and never System76. I can one-click flash my Dell forward without configuring or installing anything. For that matter why is there a "HiDPI Service" running? Why is the driver a set of udev rules that could've been upstreamed?