13 ms·

I am Jeremy Soller, Principal Engineer at System76. Let me know if you have any questions. The source for this can be found here: https://github.com/system76/

I am Jeremy Soller, Principal Engineer at System76. Let me know if you have any questions. The source for this can be found here: https://github.com/system76/firmware-open https://github.com/system76/firmware-open There are instructions there for building and testing the firmware in QEMU, you do not need to have our hardware to try it out.

kop316 7y ago
Hello! With only needing the Intel FSP, does that disable the Intel ME? And what other peripherals need closed firmware? You also are not here: https://www.coreboot.org/users.html https://www.coreboot.org/users.html I say that because I have been in the market for a laptop, and I am looking for a free(dom) based laptop. I looked there and it led me down the path of a Purism laptop. Have you also thought about adding some sort of hardware kill switches for Cameras/microphones/Radios?
- jackpot51 7y ago
  The laptops which we will be delivering with open firmware will require the FSP and Intel ME, with the Intel GOP driver being an optional component to enable graphics acceleration in UEFI. The ME is disabled by way of a HECI message early in the boot process, so there are no runtime ME components similar to using the HAP bit on older ME versions. I will get https://www.coreboot.org/users.html https://www.coreboot.org/users.html updated as soon as possible.
  - floatboth 7y ago
    > Intel GOP driver being an optional component to enable graphics acceleration in UEFI libgfxinit works even on Kaby Lake now.. but I see that you're using some ridiculously new 10th-Generation stuff for new laptops. > HECI message early in the boot process, so there are no runtime ME components similar to using the HAP bit on older ME versions Hm, I haven't heard of the HAP bit being gone? Also, you can still remove extra ME modules, right?
    - jackpot51 7y ago
      A few things are going on here. libgfxinit support for Comet Lake is coming. The Intel GOP driver is a bit different than this, though. There is an Intel PEIM graphics driver that comes from the PSP, that provides a software-rendering framebuffer similar to what libgfxinit does. The Intel GOP driver provides some hardware acceleration, which is useful especially for HiDPI systems but not critical to device functionality. The HAP bit does not have an effect since ME version 12. ME 12 was used on Coffee Lake systems, and ME 14 is used on Comet Lake systems. These support a different method of disablement using a HECI message, presumably to make dynamic disabling of the ME easier to do. Our firmware always sends this message, having the same effect as setting the HAP bit. me_cleaner does not appear to function on version 14 of the ME. As soon as it does, we will also utilize me_cleaner to remove ME modules.
  - snagglegaggle 7y ago
    >The ME is disabled by way of a HECI message early in the boot process, so there are no runtime ME components similar to using the HAP bit on older ME versions. But why would I believe this? It seems you're selling snake oil. You can't really call it open firmware if there's still a lot of closed firmware in it.
    - jackpot51 7y ago
      That's like saying you can't call Linux open source because it bundles closed firmware for WiFi, for example... The ME could certainly still be active, that is true, but with modern x86 platforms attempting to disable the ME or PSP using the documented method is the best that can be done. A very large amount of the work the firmware does is done by open source code in either Coreboot, EDK2, or the System76 firmware applications. It is my opinion that this definitely does count as open firmware.
      - snagglegaggle 7y ago
        With nonCPU blobs there is (usually) a memory boundary. Would the bus between the devices be exploitable? Perhaps, but at least it could be hardened, which is not the case with the ME controller. How much the ME controller actually participates in the boot process is irrelevant as long as its position within it can completely and undetectably compromise the entire system. You should look at the libreboot project and read their blurb on why they do not support post-2013 processors. Trying to sell the devices described as open is harmful to the term. They're not. Perhaps the only devices which are at this time are the IBM POWER processors and the Raptor CS motherboards, discounting any silicon backdoors, and in the case of the Raptor motherboard, the ASpeed BMC.
        Enginerrrd 7y ago
        This might be a stupid question, but would adoption of RISC V help fix this issue?
        wmf 7y ago
  - pgeorgi 7y ago
    > I will get https://www.coreboot.org/users.html https://www.coreboot.org/users.html updated as soon as possible. That would be https://review.coreboot.org/c/homepage/+/35957 https://review.coreboot.org/c/homepage/+/35957
  - hlandau 7y ago
    This "disablement" is rather meaningless/misleading. The proprietary ME firmware is instrumental in the boot process and part of the chain of trust. Any 'disablement' of it (really, just a message sent to the ME firmware asking it politely to stop doing anything) after booting is after the horse has bolted.
    - imglorp 7y ago
      I wonder if there's a hardware method to disable ME, something involving the processor lines on the motherboard, before it even gets powered on?
      - isantop 7y ago
        The ME is partly responsible for powering up the main CPU. That kind of thing wouldn't be possible without a reimplementation of the ME from the start.
        tpearson-raptor 7y ago
        Which, it should be noted, is impossible due to Intel's hardware-enforced signature checks. Even if a key were to be stolen from Intel it would then be illegal to use in all Western nations. The ME is off limits to everyone other than Intel and its partners, enforced by both the hardware signatures and some of the most heavily enforced (in terms of consequences) legislation on the face of the planet. Of course that won't stop malware authors, who couldn't care less about replacing the ME firmware to make it secure, but do care very much about the fact that they can hack into the stock, signed Intel ME firmware, then install their malware in a nearly impossible to detect position.
- jackpot51 7y ago
  The update to users.html was merged and will be there shortly: https://review.coreboot.org/c/homepage/+/35957/1 https://review.coreboot.org/c/homepage/+/35957/1
davidw 7y ago
I'm pretty happy with my Dell with Ubuntu, but it's really good to know there are other options out there, and I'll definitely be looking at these next time I need a new system. Thanks for your work!
- jackpot51 7y ago
  Good to hear! If you want to play around with the firmware, you can still do so in virtualization using the qemu model.
  - davidw 7y ago
    You guys probably need a song if you're going to outdo open firmware (Google the open firmware song)!
awinter-py 7y ago
seems from github like there's rust in here? how did you pick rust & how has it gone?
- isantop 7y ago
  Pretty much all compiled code at System76 is currently written in Rust if possible. There's obviously still some C that gets written, but Rust is the de facto standard language here now.
jdright 7y ago
Why no AMD CPUs? I just don't buy anything Intel and I'm for some time looking at System76, but each time I go build a setup I remember why I gave up the last time around. Also, with the price difference between the two it would be a more interesting hardware using this difference to acquire more RAM.
- kjeetgill 7y ago
  I suspect it's because AMD's resurgence is so recent and these things need long lead times for procurement, development, and validation. I'm less familiar with laptops: Do Intel and AMD CPUs even share a common socket?
  - isantop 7y ago
    AMD and Intel do not share a socket.
  - DuskStar 7y ago
    Intel and AMD CPUs do not share a common socket (or chipset) on server, desktop, or mobile platforms. I think the last shared socket was Socket 7 [0], released back in 1995. 0: https://en.wikipedia.org/wiki/Socket_7 https://en.wikipedia.org/wiki/Socket_7
    - kjeetgill 7y ago
      I didn't realize that. I guess it shows that I talk to more people building desktops than I have myself.
  - allset_ 7y ago
    Not only do Intel and AMD processors not share the same socket, processors change socket from generation to generation.
    - cogburnd02 7y ago
      Socket? Ha! Slot 2 forever! Muahahahaha! >:-D
kcolford 7y ago
Will it be possible to install this open firmware on existing Galago/Darter laptops bought before this came out?
- jackpot51 7y ago
  We will be looking into supporting older models starting with the darp5 and galp3-c.
lovehashbrowns 7y ago
System76 has been so great for the Linux laptop community, thank you for your work on that! I got the Galago Pro this past holiday and it has been so perfect for me. :) I hope you guys continue to offer such a great range in hardware configurations. That's what convinced me to go for one of your laptops over the Razer/Dell products since their RAM limit was 16GB when I was shopping around.
- jackpot51 7y ago
  Glad to hear that. I certainly like working with laptops, desktops, and servers across a wide spectrum of hardware - from the Galago Pro to the Thelio Massive
equalunique 7y ago
Recognized the username. Blown away that the same person leading Redox-OS[0] is also in a leadership role at System76!!! [0] https://github.com/redox-os/redox/graphs/contributors https://github.com/redox-os/redox/graphs/contributors
- jackpot51 7y ago
  Yes, that is me. Here's the right link though ;-) https://gitlab.redox-os.org/redox-os/redox/-/graphs/master https://gitlab.redox-os.org/redox-os/redox/-/graphs/master
- islanderfun 7y ago
  Indeed very cool. I was recently surprised to see so much Rust via Pop_os.
dochtman 7y ago
What about oreboot, the Rust version of coreboot? I know you have a history with writing Rust code, so are you looking at oreboot as an alternative to coreboot for these purposes, as well?
- isantop 7y ago
  I can't answer the technical side of that really well (IIRC something about targetting different things or something), but I wanted to comment that the name (Coreboot without the C) is genius. There is an Oreboot sticker on my fridge.
  - skoocda 7y ago
    A bit of a double meaning here too: Rust is actually just hematite (ferric oxide), which is a type of iron ore!
- jackpot51 7y ago
  oreboot does not support x86 at this time, and does not plan to.
  - tpearson-raptor 7y ago
    There's a stated reason for that by the oreboot project -- it's because you can't have a fully open source boot firmware on x86 systems.
jokoon 7y ago
How durable are those laptops when compared to other brands? Do you engineer those laptop a little like ibm did for thinkpads (if I remember, some of them had military rating for dust, temperature etc)? How repairable are they? How difficult was it for those companies to provide components that were OSS friendly? What is the main hurdle? Does it increase costs? Did you experience fightback from providers to make this project happen?
- deleted 7y ago
  [deleted]
- isantop 7y ago
  They're certainly no less durable than most consumer laptops. Our hinges in particular have a reputation for being nice and tight for a long period of time. They aren't ruggedized or anything (like a toughbook), but they'll last a good long while if you aren't super rough with your electronics. Mine gets tossed in a bag at the end of the day and toted around on my back via motorcycle, and I've never felt nervous about that at all. They're also really repairable; there are no proprietary/uncommon screw heads and no glue holding parts down. All of the major electronic components which can be socketed are, CPUs on mobile when soldered a few years ago unfortunately, and you can't really get them socketed anymore). Memory, Wireless, Storage, Battery, etc. are all user-replaceable, and generally repairs don't require bringing the laptop into a service center for repairs.
  - dharmab 7y ago
    > Mine gets tossed in a bag at the end of the day and toted around on my back via motorcycle, and I've never felt nervous about that at all. Glad to hear that you are using your devices outside of a clean room. Whenever I throw my work-issued Macbook in my bag and ride home, it's got dirt in the keys by the time I get home. I was the first in the office to need a keyboard replacement...
    - alexis_fr 7y ago
      I have this phenomenon too: The macbook 2013 has a sealing rubber around the screen when you close it down to the keyboard, yet after transport, there is dust on the screen. I’ve always wondered whether something about the shape or the design sucked the dust into the screen-keyboard void when the lid is closed.
Clubber 7y ago
Do you plan on offering laptops that are 16:9 or 3:2, rather than the 1080p? That's probably the last thing keeping me on a Mac, the panel ratio.
- darkr 7y ago
  1080p is 16:9. I presume you meant 16:10 (which is also my preference)
  - lucb1e 7y ago
    I don't understand why we need another competing standard for such a small difference. Given how small the difference is, I'm in favor for whichever one is more common to avoid black bars below media or other ill-fitting content. As far as I can tell, 16:9 is much more common so I am happy to stick with that on any device and resolution.
    - floatboth 7y ago
      If you mostly watch video — sure, you'll be happy with 16:9. For work, 16:9 on small devices SUCKS SO MUCH. Way way too short.
    - isantop 7y ago
      I often have two editors in vertical columns side by side while I work, and it's nice to have a wider screen. Unfortunately with 16:10, they don't usually add to the vertical resolution but rather subtract from the horizontal resolution (2880x1800 16:10 versus 3200x1800 16:9).
      - opan 7y ago
        What about 1920x1080 (16:9) vs 1920x1200 (16:10) and 2560x1440 (16:9) vs 2560x1600 (16:10)? I have seen it as the norm that height gets added rather than width subtracted.
    - darkr 7y ago
      For anything like text editing, the extra vertical space really does make a difference, even more so in portrait mode. This becomes less noticeable at higher resolutions and larger sizes (e.g 32”+ @4k native).
otter-in-a-suit 7y ago
Glad to hear of this change. However, on a semi-related note, will the issue where a firmware update on dual-boot system (popOS and Windows) consistently breaks systemd-boot, forcing a start into Windows, be addressed in the foreseeable future? I've recently updated the documentation [1], as this issue plagued me multiple times. [1] https://github.com/system76/docs/pull/205 https://github.com/system76/docs/pull/205
- jackpot51 7y ago
  The NVRAM is preserved on firmware updates with this new firmware, so that could fix this issue but I have not encountered it before. Usually it is recommended to install Windows first, and then install Pop!_OS - so that the Windows bootloader has not taken over the default location. Is that how you installed?
  - otter-in-a-suit 7y ago
    If I recall correctly, I did that (have had my Gazelle for several months now). popOS! is using LUKS + LVM, Windows Bitlocker. systemd-boot lives on /boot/efi on one nvme SSD, Windows on another. The LUKS/LVM setup also caused a headache, as the installer (at the time) was not able to handle a custom partition layout for the EFI bootloader for the purpose of dual-booting Windows. I'm not too familiar with the intricacies of the firmware upgrade process (and if it happens, I generally need my laptop and try to fix it as fast as possible ;)), but on every previous firmware update, I had to update the initramfs, run the bootctl installer and in some cases, mess with the systemd-boot loader configs.
enriquto 7y ago
is it possible to replace coreboot by the fully free libreboot (without blobs)? what will stop working if you do that?
- jackpot51 7y ago
  No, it is not possible to boot a Comet Lake Intel CPU without blobs.
  - enriquto 7y ago
    That's a very sad state of affairs.
gray_-_wolf 7y ago
Hi :) As few people already pointed out, it would be nice to see some laptops with AMD CPUs. For me personally, I would also love having trackpoint, have it on my thinkpad and did not use touchpad once.
dorfsmay 7y ago
Are you familiar with the ThinkPad x210? Have you thought of addressing the market of people wanting a small (12 to 13 inch), robuste, laptops with trackpoint and no arbitrary memory limitation? Lenovo has abandoned that market, and there's enough demand for people to create and sell kits for it. Could System 76 fill that gap?
- ggreer 7y ago
  I have an x210. The main reasons I bought it were the keyboard and the screen (2880x1920, which is a 3:2 aspect ratio). If you want a small laptop with 32GB of RAM, the X390 and L390 seem like decent options.
  - busterarm 7y ago
    I have an x270 that I consider to be the best road-warrior laptop they ever made. I was sad when they got rid of the dual battery in the x280.
    - dorfsmay 7y ago
      I needed to upgrade my x220. The newer X series is almost as big as the T series, and is really limited in terms of memory. I ended up getting a T480 which is nice at home, but too big on the road. I looked really hard at System76, but I need a trackpoint. I also looked at the x210, and at the time I thought that was too much work, I'm starting to think it might be worth it.
      - ggreer 7y ago
        My biggest issue with the x210 is that it's hard to find decent batteries. All the 3rd party batteries I've bought have degraded to <50% of their design capacity within 6 months. I need to buy some decent 18650 cells and replace the low quality ones in the aftermarket batteries.
        rvense 7y ago
akincisor 7y ago
I would really love if the system76 laptops had hardware kill switches for the camera and the microphone. If the camera switch also physically occludes the lens, that would be great.
7thaccount 7y ago
Just wanted to give a shout out and say my new System76 machine is awesome and the customer support has been top notch so far. The hardware support and updates have been great and the PoPs distro is great. Thanks for a great product.
tpearson-raptor 7y ago
I have one. How are you claiming open source firmware when your hardware requires signed, closed source binaries to even begin to boot? I refer specifically to the Intel Management Engine, which incidentally is why we gave up on x86 many years ago. How did you solve the GPU closed, signed firmware problem for discrete GPUs? How about the WiFi card firmware? I understand your decision to try to keep compatibility with games and Windows, but the result is only partly open source, and that is not what these headlines read. I know we would be interested in assisting System76 (or other prebuilt system OEMs) to start offering POWER products as true open source, owner controlled alternatives to Intel and AMD. For instance, we currently manufacture and sell mainboards that would be a perfect fit for your existing Thelio cases, that work very well with (optional) powerful AMD GPUs -- there's also a 2D HDMI graphics option for true blob-free operation. All you need to do is qualify our mainboard in your devices, and offer software support -- it's a very low risk investment all things considered but would allow System76 to sell truly open source systems vs. partly closed ones. Is there some possible room for collaboration here? The GPU, WiFi, etc. firmware questions are honest questions -- the firmware is potential issue, and the more OEMs/ODMs that work this problem simultaneously in collaboration the higher the chance of a solution being found that will allow even those devices to be freed up and made secure.
- calvinmorrison 7y ago
  kb9, For embedded and laptop devices, are there power devices or other options for truly free firmware? The desktop price point on current boxes are still high, do you foresee those prices dropping in the future? Will newer POWER architectures create a large workload for you or is it more simple? - cal
  - tpearson-raptor 7y ago
    Laptop is a large problem still -- mainly due to GPUs. With desktop, we don't have to deal with the issues associated with a soldered-down non-free GPU; the mainboard works blob-free if desired but the user already expects to install a discrete GPU if they need one. With laptops, the GPU has to be integrated, and there are no GPUs in production today that don't require signed firmware (this is due to the DRM contracts for Netflix and Disney+, that kind of thing). Price point is not likely to drop until we reach a largely self sufficient critical mass of users, developers, and software. Only x86 has crossed that threshold right now, so it's clearly a high bar. Still, the more users we have, the more possibility for pricing drops in the future! New POWER is near seamless from a software perspective, just like on x86. Upgrade kernel, keep using your existing software installs. And since POWER is now an open ISA, that software will basically keep working forever -- if you needed to reimplement it on a 22nd century FPGA due to lack of hardware, you're legally able to do so. This is not the case for x86 or ARM.
somatic 7y ago
Does your website have a public repo?
rhizome 7y ago
OT, but I would love a tenkeyless keyboard option for the larger models.
- FunnyLookinHat 7y ago
  Same here :)
Iv 7y ago
Just wanted to give you some love. It must be really harsh for morale dealing with the OSS crowd who will always consider you don't do enough without recognizing that you are helping building a road where none existed before. Kudos to you!
- tpearson-raptor 7y ago
  Honest question: why do you consider System76 to be building new roads by using locked hardware and offering partial open source firmware for it? Wouldn't the new roads kudos be more appropriately given to all of the folks that made real open hardware happen (RISC-V, OpenPOWER, etc.) years before this partly-open-source system announcement went out? In my mind the RISC-V folks especially were real trailblazers in this space -- they took massive risks when no one, and I mean no one, was doing open source CPUs beyond soft cores. IBM focused more on open firmware, then eventually opened their ISA, but x86 vendors have had no such forward vision in their history -- the x86 vendors have followed in this space, not led, for well over a decade, and indeed both sides of the x86 duopoly (Intel and AMD) are both separately on record as having stated their goal is to take control away from the machine owner in whatever manner they need to in order to fulfill their DRM contracts. Even with this laptop announcement, if I'm honest, more following is being demonstrated -- the coreboot user community had open source firmware ARM laptops (Chromebooks) available quite a long time ago, why weren't those hailed as building new roads when they appeared? Does anyone really think we would have reached a point where an x86 vendor would be trying to advertise even partly open source firmware without the pioneering efforts of the competing, truly open architectures?
  - tpearson-raptor 7y ago
    To the downvoters: I'm guessing you wanted to run Windows 10 "safely" somehow, or sandbox your games. There's almost no other reason to be this stuck on x86; at the end of the day it's just a consumer architecture that some well known privacy disrespecting software requires to run. It's not even that great of an architecture from a technical perspective, it just happens to have the financial weight of the prosumer market behind it right now. Here's reality: This laptop won't stop Windows exfiltrating your data. These x86 systems are leaky, they require sizeable amounts of low level binary firmware to even boot, and proper isolation is near impossible. Try sticking a PCIe diagnostic system on an open PCIe slot and sending commands to the WiFi or Ethernet card -- most likely it'll respond [1]. Then consider the firmware in the various controllers attached to the PCIe bus, including your GPU. It's probably a violation of your game's anticheat system to try to sandbox it. It's definitely a violation of the NVIDIA driver EULA to run it in a virtual machine, unless you pay the enterprise driver license fees and use a server grade adapter. The kind of adapter you won't usually find in a laptop, by the way. This is a topic that I find very frustrating. We all know you want to do the above. It can't be done without license violations all over the place, or head-in-sand make-believe "security", on modern x86 hardware. No wishing, hoping, etc. will make this change. [1] Yes, this is known to happen on specific x86 systems that I have personally tried (in that case, it was a malfunctioning GPU writing to the disk controller!). Invalid cross-device access was also tried on a POWER box, where the invalid accesses were blocked and logged as intended.
vasili111 7y ago
Any plans to make gpu passthrough officially supported for your laptops?

kop316 7y ago

Hello! With only needing the Intel FSP, does that disable the Intel ME? And what other peripherals need closed firmware? You also are not here: https://www.coreboot.org/users.html https://www.coreboot.org/users.html I say that because I have been in the market for a laptop, and I am looking for a free(dom) based laptop. I looked there and it led me down the path of a Purism laptop. Have you also thought about adding some sort of hardware kill switches for Cameras/microphones/Radios?

jackpot51 7y ago
The laptops which we will be delivering with open firmware will require the FSP and Intel ME, with the Intel GOP driver being an optional component to enable graphics acceleration in UEFI. The ME is disabled by way of a HECI message early in the boot process, so there are no runtime ME components similar to using the HAP bit on older ME versions. I will get https://www.coreboot.org/users.html https://www.coreboot.org/users.html updated as soon as possible.
- floatboth 7y ago
  > Intel GOP driver being an optional component to enable graphics acceleration in UEFI libgfxinit works even on Kaby Lake now.. but I see that you're using some ridiculously new 10th-Generation stuff for new laptops. > HECI message early in the boot process, so there are no runtime ME components similar to using the HAP bit on older ME versions Hm, I haven't heard of the HAP bit being gone? Also, you can still remove extra ME modules, right?
  - jackpot51 7y ago
    A few things are going on here. libgfxinit support for Comet Lake is coming. The Intel GOP driver is a bit different than this, though. There is an Intel PEIM graphics driver that comes from the PSP, that provides a software-rendering framebuffer similar to what libgfxinit does. The Intel GOP driver provides some hardware acceleration, which is useful especially for HiDPI systems but not critical to device functionality. The HAP bit does not have an effect since ME version 12. ME 12 was used on Coffee Lake systems, and ME 14 is used on Comet Lake systems. These support a different method of disablement using a HECI message, presumably to make dynamic disabling of the ME easier to do. Our firmware always sends this message, having the same effect as setting the HAP bit. me_cleaner does not appear to function on version 14 of the ME. As soon as it does, we will also utilize me_cleaner to remove ME modules.
- snagglegaggle 7y ago
  >The ME is disabled by way of a HECI message early in the boot process, so there are no runtime ME components similar to using the HAP bit on older ME versions. But why would I believe this? It seems you're selling snake oil. You can't really call it open firmware if there's still a lot of closed firmware in it.
  - jackpot51 7y ago
    That's like saying you can't call Linux open source because it bundles closed firmware for WiFi, for example... The ME could certainly still be active, that is true, but with modern x86 platforms attempting to disable the ME or PSP using the documented method is the best that can be done. A very large amount of the work the firmware does is done by open source code in either Coreboot, EDK2, or the System76 firmware applications. It is my opinion that this definitely does count as open firmware.
    - snagglegaggle 7y ago
      With nonCPU blobs there is (usually) a memory boundary. Would the bus between the devices be exploitable? Perhaps, but at least it could be hardened, which is not the case with the ME controller. How much the ME controller actually participates in the boot process is irrelevant as long as its position within it can completely and undetectably compromise the entire system. You should look at the libreboot project and read their blurb on why they do not support post-2013 processors. Trying to sell the devices described as open is harmful to the term. They're not. Perhaps the only devices which are at this time are the IBM POWER processors and the Raptor CS motherboards, discounting any silicon backdoors, and in the case of the Raptor motherboard, the ASpeed BMC.
      - Enginerrrd 7y ago
        This might be a stupid question, but would adoption of RISC V help fix this issue?
        wmf 7y ago
- pgeorgi 7y ago
  > I will get https://www.coreboot.org/users.html https://www.coreboot.org/users.html updated as soon as possible. That would be https://review.coreboot.org/c/homepage/+/35957 https://review.coreboot.org/c/homepage/+/35957
- hlandau 7y ago
  This "disablement" is rather meaningless/misleading. The proprietary ME firmware is instrumental in the boot process and part of the chain of trust. Any 'disablement' of it (really, just a message sent to the ME firmware asking it politely to stop doing anything) after booting is after the horse has bolted.
  - imglorp 7y ago
    I wonder if there's a hardware method to disable ME, something involving the processor lines on the motherboard, before it even gets powered on?
    - isantop 7y ago
      The ME is partly responsible for powering up the main CPU. That kind of thing wouldn't be possible without a reimplementation of the ME from the start.
      - tpearson-raptor 7y ago
        Which, it should be noted, is impossible due to Intel's hardware-enforced signature checks. Even if a key were to be stolen from Intel it would then be illegal to use in all Western nations. The ME is off limits to everyone other than Intel and its partners, enforced by both the hardware signatures and some of the most heavily enforced (in terms of consequences) legislation on the face of the planet. Of course that won't stop malware authors, who couldn't care less about replacing the ME firmware to make it secure, but do care very much about the fact that they can hack into the stock, signed Intel ME firmware, then install their malware in a nearly impossible to detect position.
jackpot51 7y ago
The update to users.html was merged and will be there shortly: https://review.coreboot.org/c/homepage/+/35957/1 https://review.coreboot.org/c/homepage/+/35957/1

davidw 7y ago

I'm pretty happy with my Dell with Ubuntu, but it's really good to know there are other options out there, and I'll definitely be looking at these next time I need a new system. Thanks for your work!

jackpot51 7y ago
Good to hear! If you want to play around with the firmware, you can still do so in virtualization using the qemu model.
- davidw 7y ago
  You guys probably need a song if you're going to outdo open firmware (Google the open firmware song)!

awinter-py 7y ago

seems from github like there's rust in here? how did you pick rust & how has it gone?

isantop 7y ago
Pretty much all compiled code at System76 is currently written in Rust if possible. There's obviously still some C that gets written, but Rust is the de facto standard language here now.

jdright 7y ago

Why no AMD CPUs? I just don't buy anything Intel and I'm for some time looking at System76, but each time I go build a setup I remember why I gave up the last time around. Also, with the price difference between the two it would be a more interesting hardware using this difference to acquire more RAM.

kjeetgill 7y ago
I suspect it's because AMD's resurgence is so recent and these things need long lead times for procurement, development, and validation. I'm less familiar with laptops: Do Intel and AMD CPUs even share a common socket?
- isantop 7y ago
  AMD and Intel do not share a socket.
- DuskStar 7y ago
  Intel and AMD CPUs do not share a common socket (or chipset) on server, desktop, or mobile platforms. I think the last shared socket was Socket 7 [0], released back in 1995. 0: https://en.wikipedia.org/wiki/Socket_7 https://en.wikipedia.org/wiki/Socket_7
  - kjeetgill 7y ago
    I didn't realize that. I guess it shows that I talk to more people building desktops than I have myself.
- allset_ 7y ago
  Not only do Intel and AMD processors not share the same socket, processors change socket from generation to generation.
  - cogburnd02 7y ago
    Socket? Ha! Slot 2 forever! Muahahahaha! >:-D

kcolford 7y ago

Will it be possible to install this open firmware on existing Galago/Darter laptops bought before this came out?

jackpot51 7y ago
We will be looking into supporting older models starting with the darp5 and galp3-c.

lovehashbrowns 7y ago

System76 has been so great for the Linux laptop community, thank you for your work on that! I got the Galago Pro this past holiday and it has been so perfect for me. :) I hope you guys continue to offer such a great range in hardware configurations. That's what convinced me to go for one of your laptops over the Razer/Dell products since their RAM limit was 16GB when I was shopping around.

jackpot51 7y ago
Glad to hear that. I certainly like working with laptops, desktops, and servers across a wide spectrum of hardware - from the Galago Pro to the Thelio Massive

equalunique 7y ago

Recognized the username. Blown away that the same person leading Redox-OS[0] is also in a leadership role at System76!!! [0] https://github.com/redox-os/redox/graphs/contributors https://github.com/redox-os/redox/graphs/contributors

jackpot51 7y ago
Yes, that is me. Here's the right link though ;-) https://gitlab.redox-os.org/redox-os/redox/-/graphs/master https://gitlab.redox-os.org/redox-os/redox/-/graphs/master
islanderfun 7y ago
Indeed very cool. I was recently surprised to see so much Rust via Pop_os.

dochtman 7y ago

What about oreboot, the Rust version of coreboot? I know you have a history with writing Rust code, so are you looking at oreboot as an alternative to coreboot for these purposes, as well?

isantop 7y ago
I can't answer the technical side of that really well (IIRC something about targetting different things or something), but I wanted to comment that the name (Coreboot without the C) is genius. There is an Oreboot sticker on my fridge.
- skoocda 7y ago
  A bit of a double meaning here too: Rust is actually just hematite (ferric oxide), which is a type of iron ore!
jackpot51 7y ago
oreboot does not support x86 at this time, and does not plan to.
- tpearson-raptor 7y ago
  There's a stated reason for that by the oreboot project -- it's because you can't have a fully open source boot firmware on x86 systems.

jokoon 7y ago

How durable are those laptops when compared to other brands? Do you engineer those laptop a little like ibm did for thinkpads (if I remember, some of them had military rating for dust, temperature etc)? How repairable are they? How difficult was it for those companies to provide components that were OSS friendly? What is the main hurdle? Does it increase costs? Did you experience fightback from providers to make this project happen?

deleted 7y ago
[deleted]
isantop 7y ago
They're certainly no less durable than most consumer laptops. Our hinges in particular have a reputation for being nice and tight for a long period of time. They aren't ruggedized or anything (like a toughbook), but they'll last a good long while if you aren't super rough with your electronics. Mine gets tossed in a bag at the end of the day and toted around on my back via motorcycle, and I've never felt nervous about that at all. They're also really repairable; there are no proprietary/uncommon screw heads and no glue holding parts down. All of the major electronic components which can be socketed are, CPUs on mobile when soldered a few years ago unfortunately, and you can't really get them socketed anymore). Memory, Wireless, Storage, Battery, etc. are all user-replaceable, and generally repairs don't require bringing the laptop into a service center for repairs.
- dharmab 7y ago
  > Mine gets tossed in a bag at the end of the day and toted around on my back via motorcycle, and I've never felt nervous about that at all. Glad to hear that you are using your devices outside of a clean room. Whenever I throw my work-issued Macbook in my bag and ride home, it's got dirt in the keys by the time I get home. I was the first in the office to need a keyboard replacement...
  - alexis_fr 7y ago
    I have this phenomenon too: The macbook 2013 has a sealing rubber around the screen when you close it down to the keyboard, yet after transport, there is dust on the screen. I’ve always wondered whether something about the shape or the design sucked the dust into the screen-keyboard void when the lid is closed.

Clubber 7y ago

Do you plan on offering laptops that are 16:9 or 3:2, rather than the 1080p? That's probably the last thing keeping me on a Mac, the panel ratio.

darkr 7y ago
1080p is 16:9. I presume you meant 16:10 (which is also my preference)
- lucb1e 7y ago
  I don't understand why we need another competing standard for such a small difference. Given how small the difference is, I'm in favor for whichever one is more common to avoid black bars below media or other ill-fitting content. As far as I can tell, 16:9 is much more common so I am happy to stick with that on any device and resolution.
  - floatboth 7y ago
    If you mostly watch video — sure, you'll be happy with 16:9. For work, 16:9 on small devices SUCKS SO MUCH. Way way too short.
  - isantop 7y ago
    I often have two editors in vertical columns side by side while I work, and it's nice to have a wider screen. Unfortunately with 16:10, they don't usually add to the vertical resolution but rather subtract from the horizontal resolution (2880x1800 16:10 versus 3200x1800 16:9).
    - opan 7y ago
      What about 1920x1080 (16:9) vs 1920x1200 (16:10) and 2560x1440 (16:9) vs 2560x1600 (16:10)? I have seen it as the norm that height gets added rather than width subtracted.
  - darkr 7y ago
    For anything like text editing, the extra vertical space really does make a difference, even more so in portrait mode. This becomes less noticeable at higher resolutions and larger sizes (e.g 32”+ @4k native).

otter-in-a-suit 7y ago

Glad to hear of this change. However, on a semi-related note, will the issue where a firmware update on dual-boot system (popOS and Windows) consistently breaks systemd-boot, forcing a start into Windows, be addressed in the foreseeable future? I've recently updated the documentation [1], as this issue plagued me multiple times. [1] https://github.com/system76/docs/pull/205 https://github.com/system76/docs/pull/205

jackpot51 7y ago
The NVRAM is preserved on firmware updates with this new firmware, so that could fix this issue but I have not encountered it before. Usually it is recommended to install Windows first, and then install Pop!_OS - so that the Windows bootloader has not taken over the default location. Is that how you installed?
- otter-in-a-suit 7y ago
  If I recall correctly, I did that (have had my Gazelle for several months now). popOS! is using LUKS + LVM, Windows Bitlocker. systemd-boot lives on /boot/efi on one nvme SSD, Windows on another. The LUKS/LVM setup also caused a headache, as the installer (at the time) was not able to handle a custom partition layout for the EFI bootloader for the purpose of dual-booting Windows. I'm not too familiar with the intricacies of the firmware upgrade process (and if it happens, I generally need my laptop and try to fix it as fast as possible ;)), but on every previous firmware update, I had to update the initramfs, run the bootctl installer and in some cases, mess with the systemd-boot loader configs.

enriquto 7y ago

is it possible to replace coreboot by the fully free libreboot (without blobs)? what will stop working if you do that?

jackpot51 7y ago
No, it is not possible to boot a Comet Lake Intel CPU without blobs.
- enriquto 7y ago
  That's a very sad state of affairs.

gray_-_wolf 7y ago

Hi :) As few people already pointed out, it would be nice to see some laptops with AMD CPUs. For me personally, I would also love having trackpoint, have it on my thinkpad and did not use touchpad once.

dorfsmay 7y ago

Are you familiar with the ThinkPad x210? Have you thought of addressing the market of people wanting a small (12 to 13 inch), robuste, laptops with trackpoint and no arbitrary memory limitation? Lenovo has abandoned that market, and there's enough demand for people to create and sell kits for it. Could System 76 fill that gap?

ggreer 7y ago
I have an x210. The main reasons I bought it were the keyboard and the screen (2880x1920, which is a 3:2 aspect ratio). If you want a small laptop with 32GB of RAM, the X390 and L390 seem like decent options.
- busterarm 7y ago
  I have an x270 that I consider to be the best road-warrior laptop they ever made. I was sad when they got rid of the dual battery in the x280.
  - dorfsmay 7y ago
    I needed to upgrade my x220. The newer X series is almost as big as the T series, and is really limited in terms of memory. I ended up getting a T480 which is nice at home, but too big on the road. I looked really hard at System76, but I need a trackpoint. I also looked at the x210, and at the time I thought that was too much work, I'm starting to think it might be worth it.
    - ggreer 7y ago
      My biggest issue with the x210 is that it's hard to find decent batteries. All the 3rd party batteries I've bought have degraded to <50% of their design capacity within 6 months. I need to buy some decent 18650 cells and replace the low quality ones in the aftermarket batteries.
      - rvense 7y ago

akincisor 7y ago

I would really love if the system76 laptops had hardware kill switches for the camera and the microphone. If the camera switch also physically occludes the lens, that would be great.

7thaccount 7y ago

Just wanted to give a shout out and say my new System76 machine is awesome and the customer support has been top notch so far. The hardware support and updates have been great and the PoPs distro is great. Thanks for a great product.

tpearson-raptor 7y ago

I have one. How are you claiming open source firmware when your hardware requires signed, closed source binaries to even begin to boot? I refer specifically to the Intel Management Engine, which incidentally is why we gave up on x86 many years ago. How did you solve the GPU closed, signed firmware problem for discrete GPUs? How about the WiFi card firmware? I understand your decision to try to keep compatibility with games and Windows, but the result is only partly open source, and that is not what these headlines read. I know we would be interested in assisting System76 (or other prebuilt system OEMs) to start offering POWER products as true open source, owner controlled alternatives to Intel and AMD. For instance, we currently manufacture and sell mainboards that would be a perfect fit for your existing Thelio cases, that work very well with (optional) powerful AMD GPUs -- there's also a 2D HDMI graphics option for true blob-free operation. All you need to do is qualify our mainboard in your devices, and offer software support -- it's a very low risk investment all things considered but would allow System76 to sell truly open source systems vs. partly closed ones. Is there some possible room for collaboration here? The GPU, WiFi, etc. firmware questions are honest questions -- the firmware is potential issue, and the more OEMs/ODMs that work this problem simultaneously in collaboration the higher the chance of a solution being found that will allow even those devices to be freed up and made secure.

calvinmorrison 7y ago
kb9, For embedded and laptop devices, are there power devices or other options for truly free firmware? The desktop price point on current boxes are still high, do you foresee those prices dropping in the future? Will newer POWER architectures create a large workload for you or is it more simple? - cal
- tpearson-raptor 7y ago
  Laptop is a large problem still -- mainly due to GPUs. With desktop, we don't have to deal with the issues associated with a soldered-down non-free GPU; the mainboard works blob-free if desired but the user already expects to install a discrete GPU if they need one. With laptops, the GPU has to be integrated, and there are no GPUs in production today that don't require signed firmware (this is due to the DRM contracts for Netflix and Disney+, that kind of thing). Price point is not likely to drop until we reach a largely self sufficient critical mass of users, developers, and software. Only x86 has crossed that threshold right now, so it's clearly a high bar. Still, the more users we have, the more possibility for pricing drops in the future! New POWER is near seamless from a software perspective, just like on x86. Upgrade kernel, keep using your existing software installs. And since POWER is now an open ISA, that software will basically keep working forever -- if you needed to reimplement it on a 22nd century FPGA due to lack of hardware, you're legally able to do so. This is not the case for x86 or ARM.

somatic 7y ago

Does your website have a public repo?

rhizome 7y ago

OT, but I would love a tenkeyless keyboard option for the larger models.

FunnyLookinHat 7y ago
Same here :)

Iv 7y ago

Just wanted to give you some love. It must be really harsh for morale dealing with the OSS crowd who will always consider you don't do enough without recognizing that you are helping building a road where none existed before. Kudos to you!

tpearson-raptor 7y ago
Honest question: why do you consider System76 to be building new roads by using locked hardware and offering partial open source firmware for it? Wouldn't the new roads kudos be more appropriately given to all of the folks that made real open hardware happen (RISC-V, OpenPOWER, etc.) years before this partly-open-source system announcement went out? In my mind the RISC-V folks especially were real trailblazers in this space -- they took massive risks when no one, and I mean no one, was doing open source CPUs beyond soft cores. IBM focused more on open firmware, then eventually opened their ISA, but x86 vendors have had no such forward vision in their history -- the x86 vendors have followed in this space, not led, for well over a decade, and indeed both sides of the x86 duopoly (Intel and AMD) are both separately on record as having stated their goal is to take control away from the machine owner in whatever manner they need to in order to fulfill their DRM contracts. Even with this laptop announcement, if I'm honest, more following is being demonstrated -- the coreboot user community had open source firmware ARM laptops (Chromebooks) available quite a long time ago, why weren't those hailed as building new roads when they appeared? Does anyone really think we would have reached a point where an x86 vendor would be trying to advertise even partly open source firmware without the pioneering efforts of the competing, truly open architectures?
- tpearson-raptor 7y ago
  To the downvoters: I'm guessing you wanted to run Windows 10 "safely" somehow, or sandbox your games. There's almost no other reason to be this stuck on x86; at the end of the day it's just a consumer architecture that some well known privacy disrespecting software requires to run. It's not even that great of an architecture from a technical perspective, it just happens to have the financial weight of the prosumer market behind it right now. Here's reality: This laptop won't stop Windows exfiltrating your data. These x86 systems are leaky, they require sizeable amounts of low level binary firmware to even boot, and proper isolation is near impossible. Try sticking a PCIe diagnostic system on an open PCIe slot and sending commands to the WiFi or Ethernet card -- most likely it'll respond [1]. Then consider the firmware in the various controllers attached to the PCIe bus, including your GPU. It's probably a violation of your game's anticheat system to try to sandbox it. It's definitely a violation of the NVIDIA driver EULA to run it in a virtual machine, unless you pay the enterprise driver license fees and use a server grade adapter. The kind of adapter you won't usually find in a laptop, by the way. This is a topic that I find very frustrating. We all know you want to do the above. It can't be done without license violations all over the place, or head-in-sand make-believe "security", on modern x86 hardware. No wishing, hoping, etc. will make this change. [1] Yes, this is known to happen on specific x86 systems that I have personally tried (in that case, it was a malfunctioning GPU writing to the disk controller!). Invalid cross-device access was also tried on a POWER box, where the invalid accesses were blocked and logged as intended.

vasili111 7y ago

Any plans to make gpu passthrough officially supported for your laptops?