4 ms·

The laptops which we will be delivering with open firmware will require the FSP and Intel ME, with the Intel GOP driver being an optional component to enable gr

The laptops which we will be delivering with open firmware will require the FSP and Intel ME, with the Intel GOP driver being an optional component to enable graphics acceleration in UEFI. The ME is disabled by way of a HECI message early in the boot process, so there are no runtime ME components similar to using the HAP bit on older ME versions. I will get https://www.coreboot.org/users.html https://www.coreboot.org/users.html updated as soon as possible.

floatboth 7y ago
> Intel GOP driver being an optional component to enable graphics acceleration in UEFI libgfxinit works even on Kaby Lake now.. but I see that you're using some ridiculously new 10th-Generation stuff for new laptops. > HECI message early in the boot process, so there are no runtime ME components similar to using the HAP bit on older ME versions Hm, I haven't heard of the HAP bit being gone? Also, you can still remove extra ME modules, right?
- jackpot51 7y ago
  A few things are going on here. libgfxinit support for Comet Lake is coming. The Intel GOP driver is a bit different than this, though. There is an Intel PEIM graphics driver that comes from the PSP, that provides a software-rendering framebuffer similar to what libgfxinit does. The Intel GOP driver provides some hardware acceleration, which is useful especially for HiDPI systems but not critical to device functionality. The HAP bit does not have an effect since ME version 12. ME 12 was used on Coffee Lake systems, and ME 14 is used on Comet Lake systems. These support a different method of disablement using a HECI message, presumably to make dynamic disabling of the ME easier to do. Our firmware always sends this message, having the same effect as setting the HAP bit. me_cleaner does not appear to function on version 14 of the ME. As soon as it does, we will also utilize me_cleaner to remove ME modules.
snagglegaggle 7y ago
>The ME is disabled by way of a HECI message early in the boot process, so there are no runtime ME components similar to using the HAP bit on older ME versions. But why would I believe this? It seems you're selling snake oil. You can't really call it open firmware if there's still a lot of closed firmware in it.
- jackpot51 7y ago
  That's like saying you can't call Linux open source because it bundles closed firmware for WiFi, for example... The ME could certainly still be active, that is true, but with modern x86 platforms attempting to disable the ME or PSP using the documented method is the best that can be done. A very large amount of the work the firmware does is done by open source code in either Coreboot, EDK2, or the System76 firmware applications. It is my opinion that this definitely does count as open firmware.
  - snagglegaggle 7y ago
    With nonCPU blobs there is (usually) a memory boundary. Would the bus between the devices be exploitable? Perhaps, but at least it could be hardened, which is not the case with the ME controller. How much the ME controller actually participates in the boot process is irrelevant as long as its position within it can completely and undetectably compromise the entire system. You should look at the libreboot project and read their blurb on why they do not support post-2013 processors. Trying to sell the devices described as open is harmful to the term. They're not. Perhaps the only devices which are at this time are the IBM POWER processors and the Raptor CS motherboards, discounting any silicon backdoors, and in the case of the Raptor motherboard, the ASpeed BMC.
    - Enginerrrd 7y ago
      This might be a stupid question, but would adoption of RISC V help fix this issue?
      - wmf 7y ago
        Not really. Closed firmware exists for reasons that aren't x86-specific so almost all ARM and RISC-V systems will have some form of closed firmware. One problem with x86 is that it's limited to ~3 companies while any company can use ARM or RISC-V so more diversity is possible.
      - pgeorgi 7y ago
pgeorgi 7y ago
> I will get https://www.coreboot.org/users.html https://www.coreboot.org/users.html updated as soon as possible. That would be https://review.coreboot.org/c/homepage/+/35957 https://review.coreboot.org/c/homepage/+/35957
hlandau 7y ago
This "disablement" is rather meaningless/misleading. The proprietary ME firmware is instrumental in the boot process and part of the chain of trust. Any 'disablement' of it (really, just a message sent to the ME firmware asking it politely to stop doing anything) after booting is after the horse has bolted.
- imglorp 7y ago
  I wonder if there's a hardware method to disable ME, something involving the processor lines on the motherboard, before it even gets powered on?
  - isantop 7y ago
    The ME is partly responsible for powering up the main CPU. That kind of thing wouldn't be possible without a reimplementation of the ME from the start.
    - tpearson-raptor 7y ago
      Which, it should be noted, is impossible due to Intel's hardware-enforced signature checks. Even if a key were to be stolen from Intel it would then be illegal to use in all Western nations. The ME is off limits to everyone other than Intel and its partners, enforced by both the hardware signatures and some of the most heavily enforced (in terms of consequences) legislation on the face of the planet. Of course that won't stop malware authors, who couldn't care less about replacing the ME firmware to make it secure, but do care very much about the fact that they can hack into the stock, signed Intel ME firmware, then install their malware in a nearly impossible to detect position.

floatboth 7y ago

> Intel GOP driver being an optional component to enable graphics acceleration in UEFI libgfxinit works even on Kaby Lake now.. but I see that you're using some ridiculously new 10th-Generation stuff for new laptops. > HECI message early in the boot process, so there are no runtime ME components similar to using the HAP bit on older ME versions Hm, I haven't heard of the HAP bit being gone? Also, you can still remove extra ME modules, right?

jackpot51 7y ago
A few things are going on here. libgfxinit support for Comet Lake is coming. The Intel GOP driver is a bit different than this, though. There is an Intel PEIM graphics driver that comes from the PSP, that provides a software-rendering framebuffer similar to what libgfxinit does. The Intel GOP driver provides some hardware acceleration, which is useful especially for HiDPI systems but not critical to device functionality. The HAP bit does not have an effect since ME version 12. ME 12 was used on Coffee Lake systems, and ME 14 is used on Comet Lake systems. These support a different method of disablement using a HECI message, presumably to make dynamic disabling of the ME easier to do. Our firmware always sends this message, having the same effect as setting the HAP bit. me_cleaner does not appear to function on version 14 of the ME. As soon as it does, we will also utilize me_cleaner to remove ME modules.

snagglegaggle 7y ago

>The ME is disabled by way of a HECI message early in the boot process, so there are no runtime ME components similar to using the HAP bit on older ME versions. But why would I believe this? It seems you're selling snake oil. You can't really call it open firmware if there's still a lot of closed firmware in it.

jackpot51 7y ago
That's like saying you can't call Linux open source because it bundles closed firmware for WiFi, for example... The ME could certainly still be active, that is true, but with modern x86 platforms attempting to disable the ME or PSP using the documented method is the best that can be done. A very large amount of the work the firmware does is done by open source code in either Coreboot, EDK2, or the System76 firmware applications. It is my opinion that this definitely does count as open firmware.
- snagglegaggle 7y ago
  With nonCPU blobs there is (usually) a memory boundary. Would the bus between the devices be exploitable? Perhaps, but at least it could be hardened, which is not the case with the ME controller. How much the ME controller actually participates in the boot process is irrelevant as long as its position within it can completely and undetectably compromise the entire system. You should look at the libreboot project and read their blurb on why they do not support post-2013 processors. Trying to sell the devices described as open is harmful to the term. They're not. Perhaps the only devices which are at this time are the IBM POWER processors and the Raptor CS motherboards, discounting any silicon backdoors, and in the case of the Raptor motherboard, the ASpeed BMC.
  - Enginerrrd 7y ago
    This might be a stupid question, but would adoption of RISC V help fix this issue?
    - wmf 7y ago
      Not really. Closed firmware exists for reasons that aren't x86-specific so almost all ARM and RISC-V systems will have some form of closed firmware. One problem with x86 is that it's limited to ~3 companies while any company can use ARM or RISC-V so more diversity is possible.
    - pgeorgi 7y ago

pgeorgi 7y ago

> I will get https://www.coreboot.org/users.html https://www.coreboot.org/users.html updated as soon as possible. That would be https://review.coreboot.org/c/homepage/+/35957 https://review.coreboot.org/c/homepage/+/35957

hlandau 7y ago

This "disablement" is rather meaningless/misleading. The proprietary ME firmware is instrumental in the boot process and part of the chain of trust. Any 'disablement' of it (really, just a message sent to the ME firmware asking it politely to stop doing anything) after booting is after the horse has bolted.

imglorp 7y ago
I wonder if there's a hardware method to disable ME, something involving the processor lines on the motherboard, before it even gets powered on?
- isantop 7y ago
  The ME is partly responsible for powering up the main CPU. That kind of thing wouldn't be possible without a reimplementation of the ME from the start.
  - tpearson-raptor 7y ago
    Which, it should be noted, is impossible due to Intel's hardware-enforced signature checks. Even if a key were to be stolen from Intel it would then be illegal to use in all Western nations. The ME is off limits to everyone other than Intel and its partners, enforced by both the hardware signatures and some of the most heavily enforced (in terms of consequences) legislation on the face of the planet. Of course that won't stop malware authors, who couldn't care less about replacing the ME firmware to make it secure, but do care very much about the fact that they can hack into the stock, signed Intel ME firmware, then install their malware in a nearly impossible to detect position.