3 ms·

>no proprietary software of any kind Does this include the CPU microcode?

by ubercow13 11y ago

belorn 11y ago
Does the laptop CPU have a writable control store?
- ubercow13 11y ago
  I assume so, you can update Intel microcode https://wiki.archlinux.org/index.php/Microcode https://wiki.archlinux.org/index.php/Microcode
  - Sanddancer 11y ago
    On a stock kernel you can update it. On the kernel this machine ships with, they removed that, along with most other facilities to upload binary firmware, for things like wifi cards, video cards, etc.
- dfox 11y ago
  The CPU certainly does have at least patchable control store. Even ignoring that, there are certainly at least two significant binary blobs still remaining: EC firmware and microcode for e1000. First probably has no major security implications, second is slightly weird as there were security-significant erratas in e1000 that were fixed by microcode update, but on the other hand it's probably more of "random undocumented configuration options" than "executable code" (for some reason Intel tends to call any random binary blob "microcode").
Sanddancer 11y ago
Most of these types of systems will patch out any sort of microcode updating interfaces to keep you from performing such actions. Can't have the user decide to flash the firmware, now can we?
LukeShu 11y ago
Good question! I believe that CPU microcode is still unavailable (though I could, and would love to be, wrong. I'll check with Francis). The FSF's RYF certification (which Gluglug machines have) makes an exception for "software delivered inside auxiliary and low-level processors and FPGAs, within which software installation is not intended after the user obtains the product. This can include, for instance, microcode inside a processor,"[0] Additionally, I known that the firmware on the SSD (if you chose that option) is proprietary--it is covered under the exception as well (as an "auxiliary processor"). However, the criteria goes on to say that if a Free firmware for any exempted components becomes available, the product must "adopt it within a reasonable period of time." (or have their certification withdrawn). [0]: https://www.fsf.org/resources/hw/endorsement/criteria https://www.fsf.org/resources/hw/endorsement/criteria
- ubercow13 11y ago
  Interesting, thanks!
yuhong 11y ago
Which reminds me that I don't see the point of skipping microcode updates when you are running non-free microcode when you are resetting the CPU. This is one reason why practically I think being able to modify the BIOS in the first place is more important.

>no proprietary software of any kind Does this include the CPU microcode?

belorn 11y ago

Does the laptop CPU have a writable control store?

ubercow13 11y ago
I assume so, you can update Intel microcode https://wiki.archlinux.org/index.php/Microcode https://wiki.archlinux.org/index.php/Microcode
- Sanddancer 11y ago
  On a stock kernel you can update it. On the kernel this machine ships with, they removed that, along with most other facilities to upload binary firmware, for things like wifi cards, video cards, etc.
dfox 11y ago
The CPU certainly does have at least patchable control store. Even ignoring that, there are certainly at least two significant binary blobs still remaining: EC firmware and microcode for e1000. First probably has no major security implications, second is slightly weird as there were security-significant erratas in e1000 that were fixed by microcode update, but on the other hand it's probably more of "random undocumented configuration options" than "executable code" (for some reason Intel tends to call any random binary blob "microcode").

Sanddancer 11y ago

Most of these types of systems will patch out any sort of microcode updating interfaces to keep you from performing such actions. Can't have the user decide to flash the firmware, now can we?

LukeShu 11y ago

Good question! I believe that CPU microcode is still unavailable (though I could, and would love to be, wrong. I'll check with Francis). The FSF's RYF certification (which Gluglug machines have) makes an exception for "software delivered inside auxiliary and low-level processors and FPGAs, within which software installation is not intended after the user obtains the product. This can include, for instance, microcode inside a processor,"[0] Additionally, I known that the firmware on the SSD (if you chose that option) is proprietary--it is covered under the exception as well (as an "auxiliary processor"). However, the criteria goes on to say that if a Free firmware for any exempted components becomes available, the product must "adopt it within a reasonable period of time." (or have their certification withdrawn). [0]: https://www.fsf.org/resources/hw/endorsement/criteria https://www.fsf.org/resources/hw/endorsement/criteria

ubercow13 11y ago
Interesting, thanks!

yuhong 11y ago

Which reminds me that I don't see the point of skipping microcode updates when you are running non-free microcode when you are resetting the CPU. This is one reason why practically I think being able to modify the BIOS in the first place is more important.