4 ms·

How does it compare in terms of "philosophical freedom" compared to intel IME? Does it need many binary blobs?

Jtsummers 4y ago
> This puts them somewhere between x86 PCs and a libre-first system like the Talos II in terms of freedom to replace firmware and boot components; while a number of blobs are required in order to boot the system, none of those have the ability to take over the OS or compromise it post-boot (unlike, say, Intel ME and AMD PSP on recent systems, or the DMA-capable chips on the LPC bus running opaque blobs that exist on even old ThinkPads). https://github.com/AsahiLinux/docs/wiki/Introduction-to-Apple-Silicon#Firmware-Overview https://github.com/AsahiLinux/docs/wiki/Introduction-to-Appl... - list of firmware blobs
als0 4y ago
Compared to the iME, not much, since at least the secure enclave subsystem won't run any non-Apple code. The scary difference about the iME is that it is directly connected to the network.
- vetinari 4y ago
  Intel ME is not connected to the network. Intel AMT (vPro) is. You have to pay extra to get it, and there are extra conditions to be fulfilled (LAN or Wifi must be Intel). The difference wrt. Apple Silicon is, that AS firmware blobs run on separate chips and 1) cannot access the main memory freely; they are gated behind IOMMU and 2) there's no SMM equivalent for any of them, so the main CPU time cannot be stolen by firmware.
  - dapids 4y ago
    100% this
- duskwuff 4y ago
  Eh, I'd say the differences go deeper than that. Secure Enclave doesn't appear to have any special access to other resources on the system (like memory), it's initialized by the operating system, not by pre-boot firmware, and the rest of the system works perfectly fine if you leave the SEP uninitialized.
peawee 4y ago
Pretty well outlined here: https://github.com/AsahiLinux/docs/wiki/Introduction-to-Apple-Silicon https://github.com/AsahiLinux/docs/wiki/Introduction-to-Appl... > while a number of blobs are required in order to boot the system, none of those have the ability to take over the OS or compromise it post-boot (unlike, say, Intel ME and AMD PSP on recent systems, or the DMA-capable chips on the LPC bus running opaque blobs that exist on even old ThinkPads).

> This puts them somewhere between x86 PCs and a libre-first system like the Talos II in terms of freedom to replace firmware and boot components; while a number of blobs are required in order to boot the system, none of those have the ability to take over the OS or compromise it post-boot (unlike, say, Intel ME and AMD PSP on recent systems, or the DMA-capable chips on the LPC bus running opaque blobs that exist on even old ThinkPads). https://github.com/AsahiLinux/docs/wiki/Introduction-to-Apple-Silicon#Firmware-Overview https://github.com/AsahiLinux/docs/wiki/Introduction-to-Appl... - list of firmware blobs

als0 4y ago

Compared to the iME, not much, since at least the secure enclave subsystem won't run any non-Apple code. The scary difference about the iME is that it is directly connected to the network.

vetinari 4y ago
Intel ME is not connected to the network. Intel AMT (vPro) is. You have to pay extra to get it, and there are extra conditions to be fulfilled (LAN or Wifi must be Intel). The difference wrt. Apple Silicon is, that AS firmware blobs run on separate chips and 1) cannot access the main memory freely; they are gated behind IOMMU and 2) there's no SMM equivalent for any of them, so the main CPU time cannot be stolen by firmware.
- dapids 4y ago
  100% this
duskwuff 4y ago
Eh, I'd say the differences go deeper than that. Secure Enclave doesn't appear to have any special access to other resources on the system (like memory), it's initialized by the operating system, not by pre-boot firmware, and the rest of the system works perfectly fine if you leave the SEP uninitialized.

peawee 4y ago

Pretty well outlined here: https://github.com/AsahiLinux/docs/wiki/Introduction-to-Apple-Silicon https://github.com/AsahiLinux/docs/wiki/Introduction-to-Appl... > while a number of blobs are required in order to boot the system, none of those have the ability to take over the OS or compromise it post-boot (unlike, say, Intel ME and AMD PSP on recent systems, or the DMA-capable chips on the LPC bus running opaque blobs that exist on even old ThinkPads).