Is anybody running Qubes on IntelME\AMD-PSP -free hardware?

General Discussion
1

The most recent CPU lineup without such things is AMD 2011 bulldozer (Intel adds IntelME in everything since 2008; and AMD adds AMD-PSP since 2013).
Desktop Bulldozer CPUs (aka Zambezi) allow up to 32GB RAM, AMD-V, presumably RVI.
There are even 1 person in the whole HCL who runs such CPU (8150)! But their sound is not working. Also table shows that it lacks IOMMU.

I wonder,

  1. what would be the best qubes-compatible option to run bulldozer?
  2. what threats presents lack of IOMMU and are there any options for mitigation?
2
1 Like
3

On HCL table IOMMU requirement described as

required for effective isolation of network VMs and PCI passthrough

Wonder why nVMs specifically. Anyway, I have no idea how to use nVM without PCI passthrough. And yet, that person from HCL is using their Qubes somehow.

ALSO, Zambezi (which is desktop bulldozer) is listed on wiki in IOMMU-supported devices because it has RVI (primary source), why FX-8150 is marked as not-supporting in HCL then?
And, since it has RVI, it should support SLAT as well.

UPD: other evidence Zambezi has IOMMU (FX- line is Zambezi)

2 Likes
4

By the way, what CPUs do have PSP and what don’t is not really defined, but bulldozer really shouldn’t. And piledriver is considered “unlikely” to have PSP judging by documentation, but who knows.

1 Like
5

Yes KGPE-D16 using legacy 15h.org coreboot.

6

I would say this is way too paranoid. Intel ME do very little harm unless you run AMT and open management port to public internet. IOMMU by comparison is way more important, it stops a compromised pcie device control your entire device.