2 ms·

Does Ubunutu need to remain on the laptop after the driver has been loaded? I'm aware that you're working on a distro-agnostic tool. In the interim period, how

Does Ubunutu need to remain on the laptop after the driver has been loaded? I'm aware that you're working on a distro-agnostic tool. In the interim period, however, if someone with a System76 laptop wants to use Fedora while still disabling ME, can they simply load stock Ubuntu/pop_OS long enough to install the driver and disable ME and then wipe the drive and reload their OS of choice?

jackpot51 9y ago
Yeah, they can certainly do that.
dsp1234 9y ago
Just running from a live cd/usb is probably less disruptive than wiping, installing, wiping, installing.
tmzt 9y ago
Could this be added into something like flashrom from the coreboot project? Would it also be possible to support consumer-controlled signing keys, placing control of the system in whose hands they belong?
- jackpot51 9y ago
  Firstly, the ME section is locked until a message is sent to the EC. Flashing firmware on a live system can be dangerous, more so on a laptop. Our flashing method has to take place in EFI. Signing keys are fused into the CPU for boot guard when the CPU is attached to the motherboard during production, for soldered CPUs like the U and H class. Having a customer signing key would seriously complicate BIOS updates, as only one key can be utilized, meaning our firmware updates would not work. It would also make returns much more difficult, as all CPUs with customer keys would have to be replaced. Right now, boot guard is only used on the Galago and Lemur.
  - tmzt 9y ago
    There's no way to use TPM as a store for these signing keys because they are needed too early in the process? Yes, I expect as a general solution for your customers it might be overkill, but as this is basically the cutting edge of public domain research on these topics it would nice to know what's possible for customers who would take the risks. Understood, I have more reading to do in to how the EFI shim/flasher works.

jackpot51 9y ago

Yeah, they can certainly do that.

dsp1234 9y ago

Just running from a live cd/usb is probably less disruptive than wiping, installing, wiping, installing.

tmzt 9y ago

Could this be added into something like flashrom from the coreboot project? Would it also be possible to support consumer-controlled signing keys, placing control of the system in whose hands they belong?

jackpot51 9y ago
Firstly, the ME section is locked until a message is sent to the EC. Flashing firmware on a live system can be dangerous, more so on a laptop. Our flashing method has to take place in EFI. Signing keys are fused into the CPU for boot guard when the CPU is attached to the motherboard during production, for soldered CPUs like the U and H class. Having a customer signing key would seriously complicate BIOS updates, as only one key can be utilized, meaning our firmware updates would not work. It would also make returns much more difficult, as all CPUs with customer keys would have to be replaced. Right now, boot guard is only used on the Galago and Lemur.
- tmzt 9y ago
  There's no way to use TPM as a store for these signing keys because they are needed too early in the process? Yes, I expect as a general solution for your customers it might be overkill, but as this is basically the cutting edge of public domain research on these topics it would nice to know what's possible for customers who would take the risks. Understood, I have more reading to do in to how the EFI shim/flasher works.