NovaCustom NV41 laptop review

General Discussion
61

not yet, I didn’t have time. How do you do that by the way?

1 Like
62

I haven’t had experience running it on Qubes, don’t even know if the test would run. With that said, I run it easily on linux using the command: fwupdmgr security

Here’s some documentation if you are interested in learning more about it.

2 Likes
63

I did run fwupdmgr security from a Fedora 39 Liveusb

Host Security ID: HSI:0! (v1.9.5)

HSI-1
✔ MEI key manifest:              Valid
✔ Platform debugging:            Disabled
✔ SPI lock:                      Enabled
✔ Supported CPU:                 Valid
✔ TPM empty PCRs:                Valid
✔ TPM v2.0:                      Found
✔ UEFI bootservice variables:    Locked
✔ UEFI platform key:             Valid
✔ csme override:                 Locked
✔ csme v0:16.1.25.1865:          Valid
✘ SPI BIOS region:               Unlocked
✘ SPI write:                     Enabled
✘ csme manufacturing mode:       Unlocked

HSI-2
✔ IOMMU:                         Enabled
✔ Intel BootGuard:               Enabled
✔ Platform debugging:            Locked
✘ Intel BootGuard ACM protected: Invalid
✘ Intel BootGuard OTP fuse:      Invalid
✘ Intel BootGuard verified boot: Invalid
✘ TPM PCR0 reconstruction:       Invalid

HSI-3
✔ Intel CET Enabled:             Enabled
✔ Pre-boot DMA protection:       Enabled
✘ Intel BootGuard error policy:  Invalid
✘ Suspend-to-idle:               Disabled
✘ Suspend-to-ram:                Enabled

HSI-4
✔ Intel SMAP:                    Enabled
✘ Encrypted RAM:                 Not supported

Runtime Suffix -!
✔ Intel CET Active:              Not supported
✔ Linux kernel:                  Untainted
✔ Linux swap:                    Encrypted
✔ fwupd plugins:                 Untainted
✘ Linux kernel lockdown:         Disabled
✘ UEFI secure boot:              Disabled

It seems I have a few tweaks to make to improve the security, per the output (trimmed, sorry :D)

2 Likes
64

NV41 with coreboot&heads and secure boot disabled (since it won’t allow USB boot) with fedora40 from stick:

> liveuser@localhost-live:~$ fwupdmgr security
1 Like
65

Some notes based on my understanding of how the test runs:

  • It appears NovaCustom ships the Intel ME with manufacturing mode on which is not great for security. Maybe they can answer why this is the case.
  • Aafik NovaCustom doesn’t support BootGuard so that’s why any test related to BootGuard fails.
  • I don’t have enough information regarding SPI BIOS reigon and SPI write so can’t help with that but I think it is related to BootGuard.
  • I believe you can disable suspend-to-ram and enable suspend-to-idle.
  • Encrypted RAM is only available on vPro enabled CPUs, so if you don’t have one you are out of luck.
  • You have secure boot disabled as Qubes does not support it which is also the reason kernel lockdown shows as disabled.

Looking at this, the only things you can tinker and change are suspend-to-idle and suspend-to-ram. However, your device will not be able to reach higher than HSI 0 if the ME manufacturing mode cannot be disabled. I believe NovaCustom were also thinking of implemtenting BootGuard with their Dasharo firmware so that would be something to look out for.

Here’s the first article I found about risks of shipping ME with manufacturing mode on: Intel ME's Undocumented Manufacturing Mode Suggests CPU Hacking Risks | Tom's Hardware

1 Like
66

I assume you have the Intel ME neutered as part of running coreboot correct? This is why tests show not found.

1 Like
67

Correct (coreboot with heads “payload”). Further description(s) here:

https://osresearch.net/Heads-threat-model/

2 Likes
68

Intel Boot Guard is planned for the next Dasharo firmware update. I don’t see a separate ticket for Intel Boot Guard yet on Dasharo, but we have requested our firmware developers team to integrate this. There were some related discussions about this here: Dasharo Enterprise roadmap for reaching fwupd HSI-4 security level · Issue #463 · Dasharo/dasharo-issues · GitHub. Please feel free to join the discussions!

Some users might prefer not to use Intel Boot Guard as firmware modifications are no longer possible, so it will be optional and prompted as a recommended step during the firmware update.

You can switch between S3 (suspend-to-RAM) and S0ix (suspend-to-idle) in the UEFI firmware settings: Dasharo System Features - Dasharo Universe

We now already have SPI write locks: Dasharo System Features - Dasharo Universe

Encrypted RAM is not feasible, as it is not supported by the CPU, unfortunately. This is also the case for the upcoming V54 and V56 Series models.

You can consider using Heads firmware as a better alternative to UEFI Secure Boot: Dasharo coreboot+Heads firmware version - NovaCustom

About the Intel Management Engine (ME), this can be disabled in the UEFI firmware settings and it is disabled for our Heads variant by default. Dasharo System Features - Dasharo Universe

I hope this helps to get a better understanding of our commitment to improve the security of our devices.

5 Likes
69

Thanks for your response and clarification. From my reading of the discussion, NovaCustom plans to have options in the configuration of the device (mainly locking manufacturing mode and enabling BootGuard?) to achieve HSI-3 by default, correct? Also, will users need to be on the Dasharo subscription to use BootGuard once it is implemented in the firmware or not?

1 Like
70

Thank you for your reply!

Yes, this is correct, HSI-1, HSI-2 and HSI-3 will be achieved starting from the next firmware updates. Also for the initial firmware versions of the V54 and V56 Series, unless you have chosen not to fuse your laptop for whatever reason. As said, this fusing process (an important step for Intel Boot Guard) will remain optional.

We will make this part of the default scope of our NovaCustom laptops, which means that there is no subscription required for that.

3 Likes
71

Wonderful. I assume this means NV41 laptops that are currently in use are fused by default until the optional configuration setting is implemented?

I also had questions about firmware updates and HSI-4:

  • I see that LVFS support is still planned for Q3-2024 so how should QubesOS/Linux users update their firmware in the meantime?

  • How long do NovaCustom (specifically NV41) laptops generally receive firmware updates?

  • Are there any plans to support enterprise CPUs that offer TME to achieve HSI-4 or no plans as of yet?

2 Likes
72

Wonderful. I assume this means NV41 laptops that are currently in use are fused by default until the optional configuration setting is implemented?

  • No, they are not fused for now. The fusing process will be optional during the firmware boot, users will be prompted for this.
  • I see that LVFS support is still planned for Q3-2024 so how should QubesOS/Linux users update their firmware in the meantime?

How long do NovaCustom (specifically NV41) laptops generally receive firmware updates?

  • At least 5 years after your purchase. It is likely to be longer, because it is likely that another customer purchases after you.

Are there any plans to support enterprise CPUs that offer TME to achieve HSI-4 or no plans as of yet?

  • Unfortunately, it is not feasible. We have the Ultra 5 125H and Ultra 7 155H CPUs for the next generations. We asked our ODM provider (Clevo) to deliver enterprise CPUs to make TME possible. Sadly, the MOQ for this was 10,000 units, which for our company is too small for now.
5 Likes
73

@novacustom Are there any protections in place, such as blown fuses on security updates, to protect against firmware downgrade attacks?

1 Like
74

E-fuses are part of Intel Boot Guard (at least in our case, but I think it’s a vital component of Intel Boot Guard in general). Intel Boot Guard will be introduced starting from any next NovaCustom-Dasharo firmware release.

In addition, firmware updates are verified with signatures before being applied. I have asked my team if there is any documentation to this procedure, couldn’t find it on a quick search. I expect an answer shortly.

Other general firmware protections are BIOS boot medium lock, SMM BIOS write protection and Early boot DMA Protection, among others. Please note that these are temporarily disabled for one boot loop when updating the firmware. That will no longer be necessary when we finally have Capsule Updates, which we are working on with ETA Q3-2024.

5 Likes
75

Thank you for your answers. If I understand correctly, SMM BIOS write protection
is the same as SMM Isolation (a feature of Windows Secured-Core devices), correct? Also do you have any thoughts about D-RTM and S-RTM? I am still learning more about them and identified TrenchBoot’s Secure Launch as something relevant to this.

1 Like
76

SMM BIOS write protection just blocks the possibility to write to SMM relevant regions of the main SPI (BIOS) chip. From what I have seen in the article, SMM Isolation is more comprehensive and OS-side related too.

I’m not technical enough to say anything abut D-RTM/S-RTM, please consider to post your question here: Sign in to GitHub · GitHub → Question […].

We consider TrenchBoot as a project we might jump in next year.

3 Likes
77

@novacustom I know that these laptops are not vPro Enterprise, but Nova Custom will ever sell those, will TME-MK be supported?

Also, on LVFS, the last update for NV devices are way back in 2022. Are you guys looking to start uploading firmware on there again?

1 Like
78

About TME-MK: if Clevo releases a model with a CPU that supports it, yes. Otherwise, no. Explanation: Sadly, the MOQ for this was 10,000 units, which for our company is too small.

About LVFS: Unfortunately, we had to drop LVFS support because we switched to fully open-source EC firmware and LVFS is not compatible with this. We are now working on a way to update the EC from the firmware directly, which means that we can support LVFS again starting from the next firmware releases :grinning:.

1 Like
79

Is the coreboot + UEFI firmware capable of doing legacy boot? :sweat_smile: I am just asking because TrenchBoot doesn’t work with UEFI just yet

1 Like
80

No, only UEFI.

1 Like