An in-depth ME-'free' laptop thread

Who is This Post For?

Anybody with the following abstract goals:
Seeks ME-neutralised hardware / without AMD PSP or Intel ME entirely.
Seeks secure, moddable, firmware
Seeks a hackable &/ upgradable laptop (that preferably only they can hack)
A laptop that works well with qubes (see here for ‘just works’)

Given the above, this post ought to serve as a quick-hub ‘filter’ for individuals to find the right balance between new/old, moddable/shiny, etc.

Disclaimer

I will refine this as people criticise and give feedback, for now it’s quite high-level: But I hope somebody finds it useful.

Summary

This post is intended to be the ‘go-to’ place on the forum for all questions about Intel-inside laptops for qubes - relating strictly to layers 0,-2, -3 and -4 (explained below).

Extra Disclaimer

To prevent this becoming wikipedia, I will reference relevant links; much reading ahoy.

Firmware/Hardware/Software Layer Abstraction Codes
Layer Description
0 Qubes
-1 Hypervisor (Xen)
-2 Firmware/Bootware
-3 Hardware-(me-ware)
-4 Physics (design, upgradability, etc)
Keeping the list Slim

To keep the list slim, at each layer, (excluding layer -1), will be requirements. As this post is criticised and others give feedback, I will update the requirements accordingly.

Layer Requirements
Layer Item M/P Item M/P
0 Qubes 4.0.4 & 4.1 Support M
-2 Coreboot M Heads Compatible P
-3 <=5th gen intel-core M TXE not present/removable P
-4 Min. 16GB ram & 4 core option M Min 32gb ram & 6 core option P

Current List (keep checking)

Brand Model rYear CPU
Max
TDP(s) Cores RAM
Max
Heads
Lenovo T430 2012 i7-3-QM 35/45W 2-4 16GB yes
Lenovo X230 2012 i7-3-QE 13-45W 2-4 16GB yes
Lenovo W530 2012 i7-3-XM 35-55W 2-4 32GB TBC
FaQ

Why Intel-only?
If, (you know of any open-source projects that document how to neutralise AMD-PSP, (and know of any heads equivs, etc)): I will revise this.
Why would anybody worry about Intel ME as a threat?
We all have different Threat Models - Defense in Depth is always better than none.
Why have you only mentioned coreboot & heads?
I am not aware of any ‘stable’ equivs. that satisfy the other requirements.
Why 16gb ram min, 32gb preferred?
To tame R4.1 && most use-cases 16gb is required min. 32gb is preferred for long-term support.
Why TXE removable preferred?
Because me_cleaner now supports this, and it is DiD at little added cost.
Why 4 core-option minimum?
Because some of us like to pin CPU0 to dom0 for security.
Why <= 5th gen intel-core?
Because only that year’s TXE has been confirmed removable.
Every additional generation is more complex hardware, not just Intel ME but the mobo, firmware etc, and I do not have a holistic understanding of all the extra complexity - so I deem it an unacceptable risk.
How can I pin cores?
Guide coming soon.

Credits (not possible without):

@Sven for the HCL & Community-Recommended List
@deeplow for keeping it tidy :wink:
All the core-team, mod and admin team.
All those who took the time to read, and everyone who is signed-up to the forum :wink:
Everybody on the osfw slack

Work in Progress

There is currently on-going discussion regarding me_cleaner and the security of gen >5. It is highly likely this will be revised ‘soon’.
Intel ME 11.x is the last ME publicly known, (to best of my knowledge), to be ‘cleanable’, rather than simply ‘ask nicely to disable*’(*aka HAP Bit). Hence, for now, this list will not go beyond Intel ME 11.x, so that is intel-core gen 7/8.
I may, (probably), have misinterpreted Intel ME vs TXE meaning. I am awaiting clarification on this.
Until somebody can prove otherwise, <=5th gen mandate is remaining in place. As although first 64gb-ram support for consumer-available laptop CPU is 6th gen - I am not aware of any instance where FSP etc (coreboot requires for >3rd gen, (thanks @airelemental for the tip-off)) and extra-new cr$p/firm-ware is neutralised.
The only exception I am likely to make is to 6th/7th gen - so we can get a 64GB ram laptop with intel ME partially nuked//neutralised onto the list.
If anybody is aware of progress R/E W530 & heads, please let us know.

3 Likes

M = mandatory, P = preferred?

“Layer Requirements” table is a little confusing, maybe make it hae 3 columns?

I don’t think quad-core or 5th-gen+ should be mandatory… for example, the qubes certified laptops are dual-core 3rd-gen. The T430 already on your list is 3rd-gen. An X230 makes a decent qubes system.

Coreboot laptops that may fit this list, organized based on blobs in firmware:

Coreboot with open source RAM init (may require a blob for video card, not sure)

  • Lenovo G505S (AMD-based, so no Intel ME, and predates AMD PSP)

Coreboot with open source RAM init, leftover ME (after running MECleaner)

  • Lenovo T420/T520/W520
  • Lenovo X230/T430/T530/W530

Coreboot with closed source RAM init, leftover ME (after running MECleaner)

  • Lenovo T440p/540p

Coreboot with closed source RAM init, ME 12+ (MECleaner not compatible), may have other blobs

  • Purism Librem14
  • System76 10th-gen laptops
  • Starlabs Starbook V
  • recent chromebooks

Edit: corrected MECleaner status of newer laptops

2 Likes

Yes, abbreviated to fit table.

Quad-core is covered in FaQ. It is because some of us, (intended post audience), pin CPU0 to dom0 - this would leave only 1 CPU for all VMs in a dual-core system.

Apologies, table says less than or equal to 5th gen. This is covered in FaQ, and is currently being discussed, (as mentioned in Work in Progress).

Thank you for the laptop recommendations, I will check the other requirements soon - I am currently talking with some dev.s on slack regarding me_cleaner.

This looks very, very, interesting. Can you reference the coreboot support/board link/report?
I have updated title to reflect, thanks very much for this contribution :slight_smile:
UPDATE: This is why G505S is not being added to the list.

Sorry, my mistake.

IMHO I think few enough people do this that dual-core should not be disqualifying. There are already very few eligible systems out there, no need to put additional constraints. I would just note which systems are dual-core vs quad-core and let people decide.

1 Like

I will consider this. But given that the T430 & X230*, (*which I am just double-checking meets requirements), can both be upgraded to quad-core - I cannot actually think of a relevant device that is limited to dual core? The ‘system’ in the table is defined as a ‘model’. I.e: you can have dual core, but this list is intended for those who want to keep a system to 4.1 stable (whenever that may be) and beyond; (and are highly likely to pin cpu0 to dom0) - hence I am keeping it for now (unless I am missing something else??).

x230 is not quad-core in any Lenovo factory configuration, nor any Qubes-certified configuration. Which quad-core CPU does x230 support?

1 Like

i7-3615QE

Source

@airelemental

1 Like

Wow, okay, I did not know this mod was available. Thanks for the link…

Don’t thank me, thank the dev.s gods from slack :slight_smile:
Edit: (link added to credits :wink:

Moved this thread into “User Support/Hardware Issues” because it is about what hardware is currently supported by Qubes.

It was clearly off-topic in “All About Qubes” where we discuss things of interest to Qubes OS users, but that are not directly related to Qubes OS.

1 Like

6th/7th-gen Core platform devices (Skylake/Kabylake), as well as Kabylake Refresh (KBL-R) 8th-gen devices use ME 11.x, but not 8th-gen Coffeelake-U/Whiskeylake-U/Cannonlake platform devices – those are ME 12.x

Welcome, @MrChromebox. @airelemental I must confess: I ‘stole’ the link from this guy :wink:

EDIT:
Whilst searching Intel Ark for some 64GB ram <= gen 5 equiv. processors with laptop-level TDP, I came across some ‘spooky’ ‘communications commercial temp’ processors (and chrome died:(
For example:

Here is the ARK-dork:

I would really like to know what products use(d) these CPUs, and where I can buy one :slight_smile: