An idea on Intel ME removal: use clusters to avoid the 30 minute shutdown

General Discussion
1

Hello, I have a question.
I am new to QubesOS.

I have heard that it is impossible to remove the ME on modern Intel CPUs as it shuts down in 30 minutes when removed.

What I came up with is to create a cluster of computers with the ME removed and restart them sequentially at intervals of 30 minutes or less.

I think that would avoid the shutdown problem,
I would like to know if it is possible.

Furthermore, is it conceivable to run QOS on that cluster?

Please let me know what you think.

I :heart: :ice_cube: OS

2

Can you please explain use case of this, but for dummies?You usw first computer, then it resets, then…?

3

I think the use case is clear: you can run your modern cluster for anything without Intel ME.

I do not see why it couldn’t work in principle, but it would be a huge waste of resources for frequent reboots and data transfer and for running several machines simultaneously…

4
offtopic

That’s why I asked, Not to say about wasting energy…

5

Let’s say you reboot every 30 minutes and it takes 1 minute to reboot, I think it would only be a 3% time loss.
(1 min / 30 min * 100)

Currently the only computers that can be used without the ME are those supported by LibreBoot, but they are old and consume so much power.
And only very old CPUs are supported,
Modern CPUs consume much less power.

I think this idea is much more energy-efficient :upside_down_face:

6

The problem with the 30 minute shutdown for me is that my work is interrupted because the computer shuts down every 30 minutes.
My point is, "Well, can’t we use clusters to prevent work from being interrupted?

7

You forgot that you need at least two computers for a single task in such case, i.e., you are wasting one whole computer and its resources. Also the regular copying of files takes resources. The latter could be significant, depending on the file sizes.

However you are right about a higher energy efficiency of the newer CPUs. I have no idea whether it would be worth it.

Or maybe do you expect to use them both at the same time as an actual cluster? Perhaps for that you need Qubes Air, which is not ready yet.

Your setup would not be equal to a librebooted computer. The whole reason they are rebooting every 30 minutes is that proprietary software outside of our control is still doing something on your computer that you don’t want. You would still have to trust that the non-removed part of Intel ME is not doing anything else suspicious.

2 Likes
8

I don’t think you are “wasting” the computers, just “using” the resources of the two computers.

Ah, yes, indeed.
Maybe I should compare it to me_cleaner?


So I guess it doesn’t make much sense?

9

Huh?
I thought I was replying to you, but it looks like I posted the above message as a new message.
Anyway, thanks for the reply.

10

You could use the two computers for two different tasks, or sell one of them. Instead you would use them to run a single Qubes OS instance, which likely could work fine on just one computer. How is this not wasting resources? Which benefit of using the two do you see, apart from partly removing Intel ME?

You would not be able to benefit from the additional security through isolation offered by Qubes Air, because you would have to copy all your working files between the computers all the time. However, you might benefit from more CPU power and RAM on Qubes Air, if you find how to use them.

Yes, this could probably be a reasonable comparison.

I saw this as as a reply to me, although the interface doesn’t show it as one. Might be a bug in Discouce @deeplow?

11

The Art of War Quotes

“The supreme art of war is to subdue the enemy without fighting.” ...
“If you know the enemy and know yourself, you need not fear the result of a hundred battles. ...
“Let your plans be dark and impenetrable as night, and when you move, fall like a thunderbolt.”
12

Well, since you worked on it do you mind giving us an high level overview on how that kernel version would achieve such a thing?

Your kernel would run on the main CPU, how would it block or even monitor what the ME is doing?

Why would anyone in their right mind use an unofficial Qubes OS kernel provided by an anonymous person anyway?

1 Like
13

I guess getting chewed up again …
No thanks you’re smart enough I looked into you.

Plus it would be a push to qubes os repo.
Been reviewing all of it for the 3rd time now.
Have been contributing to docs.

Well I coded this at the key of @marmarek on his code style. So I think once he sees that code was done to mimic his style he’s gonna love it!

~X

14

Currently the only computers that can be used without the ME are those supported by LibreBoot, but they are old and consume so much power.

You forgot about AMD ! The latest AMD-without-PSP is significantly more powerful than the latest Intel-without-ME - and there are AMD platforms supported by the opensource coreboot BIOS. Actually, we have been discussing one of them - Lenovo G505S - here: Lenovo G505s - #5 by mike_banon . Quad-core CPU, 16GB RAM, no PSP, works fine with Qubes (i.e. because IOMMU is functional with coreboot), and thanks to coreboot you can be sure there are no backdoors in BIOS

1 Like
15

This is gibberish and shows absolutely no understanding of how ME works - you are creating spam and FUD. Not a great look for your first few posts from suspension.

You cannot do anything in the kernel to have control over ME. The intel ME is a separate microcontroller with its own processor, memory, and I/O and running closed firmware - which has total visibility into the RAM and CPU that you know as “your computer”.

If you know anything about Rings, then you will know that something running in Ring 1 has no control over Ring 0 - but Ring 0 can totally pwn ring 1. The kernel runs in Ring 0. Drivers are Ring 1/2. Userlnd is ring 3. Just think of ME as a kind of “Ring -3” (even though its not, its actually another separate computer inside your computer, with full host memory access)

Heres a handy infographic …

Screenshot 2023-01-14 at 23.27.19
Screenshot 2023-01-14 at 23.27.191158Ă—1146 55.2 KB

and heres some educational reading

5 Likes
16

https://forum.qubes-os.org/t/intel-me-real-threat-for-ordinary-persons/7693/10?u=enmus

2 Likes
17

Hi @mike_banon ! this is a great point. I was sad to see the AMD boards exit coreboot , i had started to work on the HP t730 about 18 months back but it was slow going. too long winded and off topic to go into, - I should have just reached out. love the blog btw. keep up the good work.

2 Likes
19

Hi there @Plexus ! Thank you for the kind words :wink:

I was sad to see the AMD boards exit coreboot

It’s not that bad:

  1. Currently it’s not a big issue: there haven’t been any significant achievements since last November (when our boards got dropped), so by sitting on the outdated coreboot we aren’t missing out too much yet.
  2. When this will become more of an issue, we may come up with the list of “git revert” commands, intended to be applied on top of a coreboot master. These “git revert’s” will undo the commits which drop our boards, as well as the commits which break a coreboot for us somehow - and this way we’ll still get the latest coreboot for our boards. Although, there will be an extra hassle of maintaining this list - of course more “bad commits” might be arriving in the future, and there will be the moments when we get bad ROMs until someone updates this list further…
  3. Actually, our boards may be not completely gone: they got forked to a separate branch, and there’s a chance they might return after the incompatibility with the modern “bells and whistles” like a v4 resource allocator will be addressed

HP T730

Well, it is a thin client which seems to have an embedded AMD RX-427BB CPU with the performance inferior to i.e. A10-6700 / A10-6800K of the coreboot-supported A88XM-E board. Another issue with RX-427BB - is that it’s based on Steamroller, which - still being the architecture of fam15h family - doesn’t have a PSP “backdoor”, but its’ AGESA library already became a binary blob, which seriously ruins the compatibility with the opensource coreboot BIOS. That’s the same reason why - despite that A88XM-E has FM2+ socket - you can’t put A10-7*** CPU to A88XM-E and still enjoy coreboot ; but you’ll be fine with A10-6700 / A10-6800K because their AGESA is 100% opensource - including all that cool low-level stuff like DDR3 memory training…

More info about the “coreboot for AMD” could be found here - and, although it’s written with G505S in mind, the coreboot for A88XM-E / AM1I-A boards is pretty similar and the primary difference is just how to flash a BIOS and what config to use. If you have any plans to get one of these platforms for your coreboot no-ME/PSP experience, I will be happy to answer to all your questions that might arise :wink:

1 Like
20

Any way you can explain this coreboot thing to me? Should I get it even though my system is PSP-less and already has IOMMU?

21

May be the devs are developing 4.2 with coreboot to replace the ME for anyone who are using Intel with Qubes.